@milisp/keke 0.1.42 → 0.1.43

package/README.md

@@ -2,19 +2,20 @@
 
 [中文文档](README.zh-CN.md) | [Architecture](docs/architecture.md) | [Config](docs/config.md) | [Roadmap](docs/ROADMAP.md)
 
-**keke** is a local coding agent: a ~7 MB native binary, no Node or Python
-runtime, with the agent surface — not just a chat box that runs a shell.
+**keke** is a local coding agent in a ~7 MB native binary — no Node or Python
+runtime. Sign in with the ChatGPT or Grok subscription you already pay for, or
+bring any API key, all from one tool. The TUI, `keke exec`, and desktop apps
+(over ACP) drive the same session.
 
 Subagents, MCP, skills, Claude-compatible plugins, hooks, plan mode,
-per-turn checkpoints, OS sandboxing, ACP (so a desktop app can drive the same
-session as the TUI), and multi-provider routing. Memory and repository plugins
-stay off until you turn them on.
+per-turn checkpoints, and OS sandboxing are built in. Memory and repository
+plugins stay off until you turn them on.
 
 [![asciicast](https://asciinema.org/a/1266474.svg)](https://asciinema.org/a/1266474)
 
 ## Why keke?
 
-- **A full agent, not a thin CLI.** Interactive TUI and `keke exec` for scripts
+- **One session, every surface.** Interactive TUI and `keke exec` for scripts
   and CI, both on one session protocol. Concurrent subagents (bounded, and a
   child cannot spawn another), background shell tasks, and `/loop` for a prompt
   that comes back later. Plan mode can research and write a plan, not the repo.
@@ -23,15 +24,15 @@ stay off until you turn them on.
   any API key. Codex, Grok, Claude, OpenAI-compatible endpoints, Ollama, and
   vLLM — Chat Completions, Responses, or Anthropic Messages. Several accounts
   for one provider, picked by the directory you are in. A compatible endpoint
-  is a few lines of `config.toml`; it does not require a new build, and
-  `keke-core` has no vendor-specific code.
+  is a few lines of `config.toml`; it does not require a new build. The engine
+  crates cannot depend on any vendor plugin — CI fails the build if they do
+  ([`scripts/check-layering.py`](scripts/check-layering.py)).
 
-- **Capable, but not on by default.** Skills can be disabled. Persistent memory
+- **Off by default.** Skills can be disabled. Persistent memory
   is off until you set a directory. Hooks and MCP servers that ship with a
-  repository do not run on `git clone`; a person approves their exact command
-  lines, and nothing they add can undo a denial.
+  repository don't run on `git clone` (see [Safety](#safety)).
 
-- **Undo without touching your git history.** Each turn snapshots the working
+- **Checkpoints outside your repo.** Each turn snapshots the working
   tree in a store outside your repository, so reverting the agent's edits is
   not a stash and not a commit.
 
@@ -81,15 +82,19 @@ all other settings are documented in [`docs/config.md`](docs/config.md).
 
 - **Sandboxing & approvals** — shell commands run under an OS sandbox
   (Seatbelt on macOS, Landlock + seccomp on Linux): by default they may write
-  only inside the workspace, cannot touch `.git`, and cannot reach the
-  network; stepping outside is reviewed each time (by the guardian in Auto mode,
-  otherwise by you). On Windows, which has no
-  sandbox, every command asks you instead. A repository's own config can
-  tighten that but never loosen it. See
+  only inside the workspace and have no direct network access; on macOS, and
+  on Linux with the opt-in bubblewrap backend, domains and ports can be
+  approved per command. Git hooks and config are read-only
+  (enforced on macOS). Stepping outside is reviewed each time — by the guardian
+  in Auto mode, otherwise by you; `approval_policy = "never"` skips that
+  review. On Windows, which has no sandbox, every command asks you instead. A
+  repository's own config can tighten that but never loosen it. CI fails
+  rather than skips if the runner cannot enforce the sandbox. See
   [`docs/config.md`](docs/config.md#sandbox).
 - **Plugin trust** — repository-provided plugins (hooks, MCP servers) never
   execute on `git clone` alone; a person must approve them, keyed to their
-  exact contents, not their path. There's no flag to turn that gate off.
+  exact contents, not their path, and nothing they add can undo a denial.
+  There's no flag to turn that gate off.
 
 ## License
 

package/README.zh-CN.md

@@ -3,30 +3,31 @@
 [English](README.md) | [架构设计](docs/architecture.md) | [配置文档](docs/config.md) | [路线图](docs/ROADMAP.md)
 
 **keke** 是本地编码 agent：约 7 MB 的原生二进制，不需要 Node 或 Python
-运行时，带的是完整的 agent 能力，而不只是一个能跑 shell 的聊天框。
+运行时。用你已经在付费的 ChatGPT 或 Grok 订阅登录，或任意 API Key，都在同一个工具里完成。
+TUI、`keke exec` 和桌面应用（通过 ACP）共用同一个会话。
 
 子 agent、MCP、skills、兼容 Claude 目录结构的插件、hooks、规划模式、
-按轮次的检查点、操作系统级沙箱、ACP（桌面应用与 TUI 走同一套会话），以及多供应商路由。
+按轮次的检查点和操作系统级沙箱都已内置。
 记忆和仓库自带的插件默认关闭，直到你打开它们。
 
 [![asciicast](https://asciinema.org/a/1266474.svg)](https://asciinema.org/a/1266474)
 
 ## 为什么选择 keke？
 
-- **完整的 agent，不是薄 CLI。** 交互式 TUI 与面向脚本和 CI 的 `keke exec`
+- **一个会话，所有入口。** 交互式 TUI 与面向脚本和 CI 的 `keke exec`
   共用一套会话协议。并发子 agent（有上限，子 agent 不能再派生子 agent）、后台
   shell 任务，以及 `/loop`：一条稍后会再送回来的提示。规划模式可以调研并写下计划，但不能改仓库。
 
 - **用你已经在付的账。** 用 ChatGPT（Codex）或 Grok 订阅登录，或任意 API Key。
   Codex、Grok、Claude、OpenAI 兼容端点、Ollama、vLLM —— Chat Completions、
   Responses 或 Anthropic Messages。同一供应商可登录多个账户，按所在目录选用。
-  兼容端点在 `config.toml` 里写几行即可，不必重新编译；`keke-core` 不含厂商特定代码。
+  兼容端点在 `config.toml` 里写几行即可，不必重新编译。引擎 crate 不能依赖任何厂商插件，
+  违反时 CI 会直接失败（[`scripts/check-layering.py`](scripts/check-layering.py)）。
 
-- **能力在，但默认不自动启用。** Skills 可以禁用。持久记忆在设定目录之前是关闭的。
-  随仓库提供的 hooks 和 MCP 服务器不会因为 `git clone` 就执行；必须由人批准其确切的命令行，
-  而且它们不能把已有的拒绝改回允许。
+- **默认关闭。** Skills 可以禁用。持久记忆在设定目录之前是关闭的。
+  随仓库提供的 hooks 和 MCP 服务器不会因为 `git clone` 就执行（见[安全](#安全)）。
 
-- **撤销，但不碰你的 git 历史。** 每一轮都把工作区快照存到仓库之外的存储里，
+- **检查点在仓库之外。** 每一轮都把工作区快照存到仓库之外的存储里，
   回退 agent 的修改既不是 stash，也不是一次提交。
 
 ## 安装
@@ -72,8 +73,8 @@ Provider 路由、API Key、本地模型、网关、按目录账户及其他设
 
 ## 安全
 
-- **沙箱与审批** — shell 命令运行在操作系统级沙箱中（macOS 用 Seatbelt，Linux 用 Landlock + seccomp）：默认只能写入工作区、不能改动 `.git`、不能访问网络；需要越过沙箱时每次都会询问你。Windows 没有沙箱，每条命令都会先询问你。仓库自带的配置只能收紧、不能放宽沙箱。详见 [`docs/config.md`](docs/config.md#sandbox)。
-- **插件信任** — 仓库自带的插件（hooks、MCP servers）不会仅因 `git clone` 就执行；必须由人按**内容**（而非路径）批准。没有关闭该门禁的开关。
+- **沙箱与审批** — shell 命令运行在操作系统级沙箱中（macOS 用 Seatbelt，Linux 用 Landlock + seccomp）：默认只能写入工作区、没有直接联网能力；macOS 上，以及 Linux 启用可选的 bubblewrap 后端时，域名和端口可按命令逐次审批；Git 的 hooks 和 config 只读（macOS 上强制）。越过沙箱时每次都会审查：Auto 模式由 guardian 审查，其他模式由你确认；`approval_policy = "never"` 会跳过审查。Windows 没有沙箱，每条命令都会先询问你。仓库自带的配置只能收紧、不能放宽沙箱。运行环境无法强制执行沙箱时，CI 会失败而不是跳过。详见 [`docs/config.md`](docs/config.md#sandbox)。
+- **插件信任** — 仓库自带的插件（hooks、MCP servers）不会仅因 `git clone` 就执行；必须由人按**内容**（而非路径）批准，且它们不能把已有的拒绝改回允许。没有关闭该门禁的开关。
 
 ## 许可证
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@milisp/keke",
-  "version": "0.1.42",
+  "version": "0.1.43",
   "description": "keke is a multi-vendor terminal coding agent.",
   "license": "Apache-2.0",
   "bin": {
@@ -18,12 +18,12 @@
     "win32"
   ],
   "optionalDependencies": {
-    "@milisp/keke-darwin-x64": "0.1.42",
-    "@milisp/keke-darwin-arm64": "0.1.42",
-    "@milisp/keke-linux-x64": "0.1.42",
-    "@milisp/keke-linux-arm64": "0.1.42",
-    "@milisp/keke-win32-x64": "0.1.42",
-    "@milisp/keke-win32-arm64": "0.1.42"
+    "@milisp/keke-darwin-x64": "0.1.43",
+    "@milisp/keke-darwin-arm64": "0.1.43",
+    "@milisp/keke-linux-x64": "0.1.43",
+    "@milisp/keke-linux-arm64": "0.1.43",
+    "@milisp/keke-win32-x64": "0.1.43",
+    "@milisp/keke-win32-arm64": "0.1.43"
   },
   "repository": {
     "type": "git",