@milisp/keke 0.1.41 → 0.1.43

package/README.md

@@ -2,24 +2,39 @@
 
 [中文文档](README.zh-CN.md) | [Architecture](docs/architecture.md) | [Config](docs/config.md) | [Roadmap](docs/ROADMAP.md)
 
-**keke** is a local terminal coding agent built in Rust for zero vendor lock-in.  
-**7 MB download · zero external runtime dependencies · instant startup.**
+**keke** is a local coding agent in a ~7 MB native binary — no Node or Python
+runtime. Sign in with the ChatGPT or Grok subscription you already pay for, or
+bring any API key, all from one tool. The TUI, `keke exec`, and desktop apps
+(over ACP) drive the same session.
+
+Subagents, MCP, skills, Claude-compatible plugins, hooks, plan mode,
+per-turn checkpoints, and OS sandboxing are built in. Memory and repository
+plugins stay off until you turn them on.
 
 [![asciicast](https://asciinema.org/a/1266474.svg)](https://asciinema.org/a/1266474)
 
 ## Why keke?
 
-- **Use what you already pay for**  
-  Sign in with ChatGPT (Codex) or Grok subscriptions, or drop in any API key. No need to switch providers just to try a different model.
+- **One session, every surface.** Interactive TUI and `keke exec` for scripts
+  and CI, both on one session protocol. Concurrent subagents (bounded, and a
+  child cannot spawn another), background shell tasks, and `/loop` for a prompt
+  that comes back later. Plan mode can research and write a plan, not the repo.
 
-- **Multi-account, per-directory routing**  
-  Log in to work and personal accounts once. keke automatically picks the right one based on the directory you’re in.
+- **Use what you already pay for.** Sign in with ChatGPT (Codex) or Grok, or
+  any API key. Codex, Grok, Claude, OpenAI-compatible endpoints, Ollama, and
+  vLLM — Chat Completions, Responses, or Anthropic Messages. Several accounts
+  for one provider, picked by the directory you are in. A compatible endpoint
+  is a few lines of `config.toml`; it does not require a new build. The engine
+  crates cannot depend on any vendor plugin — CI fails the build if they do
+  ([`scripts/check-layering.py`](scripts/check-layering.py)).
 
-- **Script- and CI-friendly**  
-  `keke exec "..."` runs one-shot tasks non-interactively — ready for scripts and pipelines.
+- **Off by default.** Skills can be disabled. Persistent memory
+  is off until you set a directory. Hooks and MCP servers that ship with a
+  repository don't run on `git clone` (see [Safety](#safety)).
 
-- **Vendor-isolated core**  
-  `keke-core` contains zero vendor-specific logic. Point it at any OpenAI-compatible endpoint with a few lines in `config.toml`.
+- **Checkpoints outside your repo.** Each turn snapshots the working
+  tree in a store outside your repository, so reverting the agent's edits is
+  not a stash and not a commit.
 
 ## Install
 
@@ -67,15 +82,19 @@ all other settings are documented in [`docs/config.md`](docs/config.md).
 
 - **Sandboxing & approvals** — shell commands run under an OS sandbox
   (Seatbelt on macOS, Landlock + seccomp on Linux): by default they may write
-  only inside the workspace, cannot touch `.git`, and cannot reach the
-  network; stepping outside is reviewed each time (by the guardian in Auto mode,
-  otherwise by you). On Windows, which has no
-  sandbox, every command asks you instead. A repository's own config can
-  tighten that but never loosen it. See
+  only inside the workspace and have no direct network access; on macOS, and
+  on Linux with the opt-in bubblewrap backend, domains and ports can be
+  approved per command. Git hooks and config are read-only
+  (enforced on macOS). Stepping outside is reviewed each time — by the guardian
+  in Auto mode, otherwise by you; `approval_policy = "never"` skips that
+  review. On Windows, which has no sandbox, every command asks you instead. A
+  repository's own config can tighten that but never loosen it. CI fails
+  rather than skips if the runner cannot enforce the sandbox. See
   [`docs/config.md`](docs/config.md#sandbox).
 - **Plugin trust** — repository-provided plugins (hooks, MCP servers) never
   execute on `git clone` alone; a person must approve them, keyed to their
-  exact contents, not their path. There's no flag to turn that gate off.
+  exact contents, not their path, and nothing they add can undo a denial.
+  There's no flag to turn that gate off.
 
 ## License
 

package/README.zh-CN.md

@@ -2,24 +2,33 @@
 
 [English](README.md) | [架构设计](docs/architecture.md) | [配置文档](docs/config.md) | [路线图](docs/ROADMAP.md)
 
-**keke** 是用 Rust 编写的本地终端编码 agent，目标是零厂商锁定。  
-**下载约 7 MB · 无外部运行时依赖 · 即开即用。**
+**keke** 是本地编码 agent：约 7 MB 的原生二进制，不需要 Node 或 Python
+运行时。用你已经在付费的 ChatGPT 或 Grok 订阅登录，或任意 API Key，都在同一个工具里完成。
+TUI、`keke exec` 和桌面应用（通过 ACP）共用同一个会话。
+
+子 agent、MCP、skills、兼容 Claude 目录结构的插件、hooks、规划模式、
+按轮次的检查点和操作系统级沙箱都已内置。
+记忆和仓库自带的插件默认关闭，直到你打开它们。
 
 [![asciicast](https://asciinema.org/a/1266474.svg)](https://asciinema.org/a/1266474)
 
 ## 为什么选择 keke？
 
-- **用你已经在付的账**  
-  用 ChatGPT（Codex）或 Grok 订阅登录，或直接填入任意 API Key。不必为了试另一个模型而换供应商。
+- **一个会话，所有入口。** 交互式 TUI 与面向脚本和 CI 的 `keke exec`
+  共用一套会话协议。并发子 agent（有上限，子 agent 不能再派生子 agent）、后台
+  shell 任务，以及 `/loop`：一条稍后会再送回来的提示。规划模式可以调研并写下计划，但不能改仓库。
 
-- **多账户、按目录路由**  
-  工作和私人账户各登录一次。keke 会根据当前目录自动选用对应账户。
+- **用你已经在付的账。** 用 ChatGPT（Codex）或 Grok 订阅登录，或任意 API Key。
+  Codex、Grok、Claude、OpenAI 兼容端点、Ollama、vLLM —— Chat Completions、
+  Responses 或 Anthropic Messages。同一供应商可登录多个账户，按所在目录选用。
+  兼容端点在 `config.toml` 里写几行即可，不必重新编译。引擎 crate 不能依赖任何厂商插件，
+  违反时 CI 会直接失败（[`scripts/check-layering.py`](scripts/check-layering.py)）。
 
-- **适合脚本和 CI**  
-  `keke exec "..."` 以非交互方式跑一次性任务，可直接放进脚本和流水线。
+- **默认关闭。** Skills 可以禁用。持久记忆在设定目录之前是关闭的。
+  随仓库提供的 hooks 和 MCP 服务器不会因为 `git clone` 就执行（见[安全](#安全)）。
 
-- **与厂商隔离的核心**  
-  `keke-core` 不含任何厂商特定逻辑。在 `config.toml` 里写几行，即可指向任意 OpenAI 兼容端点。
+- **检查点在仓库之外。** 每一轮都把工作区快照存到仓库之外的存储里，
+  回退 agent 的修改既不是 stash，也不是一次提交。
 
 ## 安装
 
@@ -64,8 +73,8 @@ Provider 路由、API Key、本地模型、网关、按目录账户及其他设
 
 ## 安全
 
-- **沙箱与审批** — shell 命令运行在操作系统级沙箱中（macOS 用 Seatbelt，Linux 用 Landlock + seccomp）：默认只能写入工作区、不能改动 `.git`、不能访问网络；需要越过沙箱时每次都会询问你。Windows 没有沙箱，每条命令都会先询问你。仓库自带的配置只能收紧、不能放宽沙箱。详见 [`docs/config.md`](docs/config.md#sandbox)。
-- **插件信任** — 仓库自带的插件（hooks、MCP servers）不会仅因 `git clone` 就执行；必须由人按**内容**（而非路径）批准。没有关闭该门禁的开关。
+- **沙箱与审批** — shell 命令运行在操作系统级沙箱中（macOS 用 Seatbelt，Linux 用 Landlock + seccomp）：默认只能写入工作区、没有直接联网能力；macOS 上，以及 Linux 启用可选的 bubblewrap 后端时，域名和端口可按命令逐次审批；Git 的 hooks 和 config 只读（macOS 上强制）。越过沙箱时每次都会审查：Auto 模式由 guardian 审查，其他模式由你确认；`approval_policy = "never"` 会跳过审查。Windows 没有沙箱，每条命令都会先询问你。仓库自带的配置只能收紧、不能放宽沙箱。运行环境无法强制执行沙箱时，CI 会失败而不是跳过。详见 [`docs/config.md`](docs/config.md#sandbox)。
+- **插件信任** — 仓库自带的插件（hooks、MCP servers）不会仅因 `git clone` 就执行；必须由人按**内容**（而非路径）批准，且它们不能把已有的拒绝改回允许。没有关闭该门禁的开关。
 
 ## 许可证
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@milisp/keke",
-  "version": "0.1.41",
+  "version": "0.1.43",
   "description": "keke is a multi-vendor terminal coding agent.",
   "license": "Apache-2.0",
   "bin": {
@@ -18,12 +18,12 @@
     "win32"
   ],
   "optionalDependencies": {
-    "@milisp/keke-darwin-x64": "0.1.41",
-    "@milisp/keke-darwin-arm64": "0.1.41",
-    "@milisp/keke-linux-x64": "0.1.41",
-    "@milisp/keke-linux-arm64": "0.1.41",
-    "@milisp/keke-win32-x64": "0.1.41",
-    "@milisp/keke-win32-arm64": "0.1.41"
+    "@milisp/keke-darwin-x64": "0.1.43",
+    "@milisp/keke-darwin-arm64": "0.1.43",
+    "@milisp/keke-linux-x64": "0.1.43",
+    "@milisp/keke-linux-arm64": "0.1.43",
+    "@milisp/keke-win32-x64": "0.1.43",
+    "@milisp/keke-win32-arm64": "0.1.43"
   },
   "repository": {
     "type": "git",