@milisp/keke 0.1.8 → 0.1.10

package/README.md

@@ -1,6 +1,6 @@
 # keke
 
-[中文文档](README.zh-CN.md) | [Architecture](docs/architecture.md) | [Roadmap](docs/ROADMAP.md)
+[中文文档](README.zh-CN.md) | [Architecture](docs/architecture.md) | [Config](docs/config.md) | [Roadmap](docs/ROADMAP.md)
 
 keke is a local terminal coding agent built for zero-vendor lock-in. 
 Works with subscriptions you already have, standard API keys, or self-hosted local models.
@@ -9,6 +9,8 @@ Works with subscriptions you already have, standard API keys, or self-hosted loc
 
 - **Protocol: ACP for every client**
   Speaks the open Agent Client Protocol for both external client integrations and its internal TUI/agent seam.
+- **Multi-Account & Per-Directory Routing**
+  Login to multiple subscription accounts (e.g., work and personal) and automatically route requests based on workspace directory path.
 - **Script & CI First (`keke exec`)**
   Supports one-shot execution out of the box for non-interactive scripting and automated CI pipelines.
 - **Vendor-Isolated Engine**
@@ -23,7 +25,9 @@ curl -fsSL https://raw.githubusercontent.com/milisp/keke-agent/main/scripts/inst
 ```
 
 This downloads the latest prebuilt binary for your platform into
-`~/.local/bin` (override with `KEKE_INSTALL_DIR`).
+`~/.local/bin` (override with `KEKE_INSTALL_DIR`). Piping a remote script into
+`sh` runs it with your privileges — inspect it first if that matters to you:
+`curl -fsSL .../install.sh | less`.
 
 ### npm
 
@@ -35,95 +39,47 @@ You can also grab a binary directly from the
 [latest release](https://github.com/milisp/keke-agent/releases/latest), or build
 from source with `cargo build --release`.
 
-## Try it
+## Try it (30 seconds)
 
 ```sh
-# Sign in with a subscription you already pay for
+keke doctor                              # see which providers/logins resolve, before you rely on one
+
+# Sign in with a subscription you already pay for...
 keke login codex
 keke login grok
-
 # ...or bring a key
-export OPENAI_API_KEY=sk-...
+export ANTHROPIC_API_KEY=sk-ant-...
 
 keke exec "what does this project do?"   # one-shot, for scripts and CI
 keke                                     # interactive TUI
 keke resume                              # pick the last conversation back up
-keke doctor                              # which providers and logins resolve
 ```
 
-## What you can point it at
-
-| Provider | How you authenticate | Notes |
-| --- | --- | --- |
-| OpenAI / ChatGPT | `keke login codex`, or `OPENAI_API_KEY` | OAuth flow ported from codex |
-| Anthropic Claude | `ANTHROPIC_API_KEY` | Built in; the default provider. API key only — no subscription login |
-| xAI Grok | `keke login grok`, or `XAI_API_KEY` | Built in |
-| Local (Ollama, vLLM, …) | none | Your code never leaves the machine |
-| Any OpenAI-compatible gateway | `env_key` in `config.toml` | Company proxies, NVIDIA NIM, routers |
-
-Anything not built in is a few lines of `$KEKE_HOME/config.toml`, not a code
-change:
+Provider routes, API keys, local models, gateways, per-directory accounts, and
+all other settings are documented in [`docs/config.md`](docs/config.md).
 
-```toml
-[providers.ollama]
-base_url = "http://localhost:11434/v1"
-default_model = "gpt-oss:20b"
-
-[providers.anthropic]
-base_url = "https://api.anthropic.com"
-env_key = "ANTHROPIC_API_KEY"
-wire = "messages"
-```
-
-`wire` picks the request format — `chat_completions` (the default),
-`responses`, or `messages` — so a new endpoint is a config entry rather than a release.
-
-Behind a corporate proxy or a TLS-intercepting gateway, a declared provider
-can also carry a CA certificate, a proxy, and headers your gateway wants for
-routing or audit:
-
-```toml
-[providers.internal-gateway]
-base_url = "https://gateway.corp.internal/v1"
-env_key = "INTERNAL_GATEWAY_API_KEY"
-ca_cert_path = "/etc/ssl/certs/corp-root-ca.pem"
-proxy = "http://proxy.corp.internal:8080"
-proxy_username = "svc-keke"
-proxy_password_env_key = "CORP_PROXY_PASSWORD"
-
-[providers.internal-gateway.headers]
-X-Department-Token = "env:DEPT_TOKEN"
-X-Company-User-Id = "milisp-labs"
-```
+## Safety
 
-A header value written as `env:VAR_NAME` is resolved from the environment
-rather than taken literally, so a secret header need not sit in the config
-file in the clear. `authorization` is reserved for the provider's own
-credential and cannot be set here.
+- **Sandboxing & approvals** — `approval_policy` and `sandbox_mode` are
+  configurable to match how you run it ([`docs/config.md`](docs/config.md)).
+- **Plugin trust** — repository-provided plugins (hooks, MCP servers) never
+  execute on `git clone` alone; a person must approve them, keyed to their
+  exact contents, not their path. There's no flag to turn that gate off.
 
 ## Status
 
 Usable day to day. `keke exec`, the TUI, and the ACP server all run real
 sessions end to end; runtime plugins (skills, commands, hooks, MCP servers)
 install in the Claude Code format, and repository-provided ones stay inert
-until you approve them. Switching models inside a running session is not
-implemented yet — see [`docs/ROADMAP.md`](docs/ROADMAP.md).
-
-## Where it comes from
-
-keke is a fresh implementation built by studying three open agent repos:
-OpenAI's **codex**, xAI's **grok-build**, and **deepseek-harness** — whose
-seam-first architecture (a hard boundary between engine and vendor, not a
-convention) is the idea keke leans on hardest. Some pieces are ported
-outright and attributed in the crate that carries them (codex's OAuth login
-flow, for instance); most of it is keke's own code, shaped by what worked and
-what didn't in those three. What keke does differently — and why that
-matters enough to enforce in CI — is in
-[`docs/architecture.md`](docs/architecture.md); the invariants themselves are
-in [`AGENTS.md`](AGENTS.md).
+until you approve them. `/model` switches models inside a running session
+(tied to their provider so config can't persist an invalid pairing), and the
+agent can spawn subagents — isolated child sessions given one task that
+report back a single answer instead of their whole search trace. See
+[`docs/ROADMAP.md`](docs/ROADMAP.md) for what's next.
 
 ## License
 
-Apache-2.0. See [`LICENSE`](LICENSE) and [`NOTICE`](NOTICE); code ported from
-other projects is attributed in the `THIRD_PARTY_NOTICES.md` of the crate that
-contains it.
+Apache-2.0. See [`LICENSE`](LICENSE) and [`NOTICE`](NOTICE). Design rationale
+and source attribution are documented in
+[`docs/architecture.md`](docs/architecture.md#why-it-is-shaped-this-way) and
+`THIRD_PARTY_NOTICES.md` files in the relevant crates.

package/README.zh-CN.md

@@ -1,16 +1,20 @@
 # keke
 
-[![CI](https://github.com/milisp/keke-agent/actions/workflows/ci.yml/badge.svg)](https://github.com/milisp/keke-agent/actions)
+[English](README.md) | [架构设计](docs/architecture.md) | [配置文档](docs/config.md) | [路线图](docs/ROADMAP.md)
 
-[English](README.md)
+keke 是一个专为“零厂商锁定”打造的本地终端编码 agent。
+可直接搭配你已有的付费订阅、标准 API Key 或自托管的本地模型使用。
 
-keke 是一个运行在本地终端的编码 agent，可以搭配任意模型使用——你已经订阅的
-服务、一个 API key，或者你自己机器上跑的模型。
+## 为什么选择 keke？
 
-keke 通过 stdio 提供开放的 Agent Client Protocol，所以任何支持 ACP 的
-GUI（编辑器、Zed 之类）都能像终端一样驱动它。如果想在脚本或 CI 里用，用
-`keke exec`。如果想用一个它还不认识的模型，在 `config.toml` 里声明即
-可——引擎里不需要改任何厂商相关的代码。
+- **协议：为所有客户端提供 ACP 支持**
+  无论是外部客户端集成，还是内部 TUI 与 agent 之间的解耦边界，统一基于开放的 Agent Client Protocol (ACP)。
+- **多账户与按目录路由**
+  登录多个订阅账户（例如工作账户和个人账户），并根据工作区目录路径自动路由请求。
+- **脚本与 CI 优先（`keke exec`）**
+  开箱即用支持非交互式一次性执行，专为脚本自动化与 CI 流水线设计。
+- **与厂商隔离的引擎核心**
+  `keke-core` 内部没有任何厂商特定的逻辑。添加标准模型端点无需修改任何引擎代码——只需在 `config.toml` 中简单声明配置即可。
 
 ## 安装
 
@@ -20,8 +24,7 @@ GUI（编辑器、Zed 之类）都能像终端一样驱动它。如果想在脚
 curl -fsSL https://raw.githubusercontent.com/milisp/keke-agent/main/scripts/install.sh | sh
 ```
 
-该脚本会为你的平台下载最新的预编译二进制文件到 `~/.local/bin`
-（可通过 `KEKE_INSTALL_DIR` 覆盖）。
+该脚本会下载适合你平台的最新预编译二进制文件至 `~/.local/bin`，也可以通过 `KEKE_INSTALL_DIR` 指定安装目录。
 
 ### npm 安装
 
@@ -29,71 +32,32 @@ curl -fsSL https://raw.githubusercontent.com/milisp/keke-agent/main/scripts/inst
 npm install -g @milisp/keke
 ```
 
-你也可以直接从 [latest release](https://github.com/milisp/keke-agent/releases/latest)
-下载预编译二进制文件，或者用 `cargo build --release` 从源码构建。
+你也可以直接从 [最新 Release](https://github.com/milisp/keke-agent/releases/latest) 下载二进制文件，或使用 `cargo build --release` 从源码构建。
 
-## 试一试
+## 快速试用（30 秒）
 
 ```sh
-# 用你已经付费的订阅登录
+keke doctor                              # 检查 provider 和登录配置
+
+# 使用已有付费订阅登录……
 keke login codex
 keke login grok
+# ……或直接配置 API Key
+export ANTHROPIC_API_KEY=sk-ant-...
 
-# ……或者直接用 key
-export XAI_API_KEY=xai-...
-
-keke exec "what does this project do?"   # 一次性运行，适合脚本和 CI
+keke exec "what does this project do?"   # 一次性运行，适合脚本与 CI
 keke                                     # 交互式 TUI
-keke resume                              # 接着上一次的对话继续
-keke doctor                              # 查看哪些 provider 和登录能解析成功
+keke resume                              # 恢复上一次的对话
 ```
 
-## 你能接入什么
-
-| Provider | 如何认证 | 说明 |
-| --- | --- | --- |
-| OpenAI / ChatGPT | `keke login codex`，或 `OPENAI_API_KEY` | OAuth 流程从 codex 移植而来 |
-| xAI Grok | `keke login grok`，或 `XAI_API_KEY` | 内置，默认 provider |
-| Anthropic | `config.toml` 中的 `env_key` | 声明时用 `wire = "messages"` |
-| 本地模型（Ollama、vLLM 等） | 无需认证 | 代码不会离开这台机器 |
-| 任意 OpenAI 兼容网关 | `config.toml` 中的 `env_key` | 公司代理、NVIDIA NIM、路由器等 |
-
-内置支持之外的服务，只需要在 `$KEKE_HOME/config.toml` 里加几行，不需要改代码：
-
-```toml
-[providers.ollama]
-base_url = "http://localhost:11434/v1"
-default_model = "gpt-oss:20b"
-
-[providers.anthropic]
-base_url = "https://api.anthropic.com"
-env_key = "ANTHROPIC_API_KEY"
-wire = "messages"
-```
-
-`wire` 决定请求格式——`chat_completions`（默认）、`responses`，或
-`messages`——所以接入新接口只是一条配置，而不是一次发版。
-
-## 现状
+配置文件位置、Provider 声明、API Key、本地模型、多账号、按目录切换账号及其他设置，详见 [`docs/config.md`](docs/config.md)。
 
-日常使用已经可用。`keke exec`、TUI 和 ACP server 都能完整跑通一次会话；
-运行时插件（skills、commands、hooks、MCP servers）按 Claude Code 的格式
-安装，仓库自带的插件在你批准之前始终处于未激活状态。在运行中的会话里切换
-模型这个功能还没实现——详见 [`docs/ROADMAP.md`](docs/ROADMAP.md)。
+## 功能状态
 
-## 灵感来源
+keke 已支持日常开发所需的完整会话。你可以使用 `keke exec` 执行一次性任务，也可以通过 TUI 或 ACP 接入自己的编辑器和客户端。运行时插件（skills、commands、hooks、MCP servers）遵循 Claude Code 格式安装；会话中还可以使用 `/model` 切换模型，并生成独立的子 agent 处理分配的任务。
 
-keke 是通过研究三个开源 agent 项目——OpenAI 的 **codex**、xAI 的
-**grok-build**，以及 **deepseek-harness**——写出来的全新实现，其中
-deepseek-harness 提倡的 seam-first 架构（引擎和厂商之间是硬边界，而不是
-约定）是 keke 最依赖的一个想法。少数部分是直接移植过来的，并在承载它的
-crate 中注明来源（比如 codex 的 OAuth 登录流程）；其余大部分都是 keke
-自己的代码，只是被这三者的经验（包括踩过的坑）塑造出来的。keke 的不同
-之处、以及为什么值得在 CI 里强制执行，详见
-[`docs/architecture.md`](docs/architecture.md)；不变量本身在
-[`AGENTS.md`](AGENTS.md)。
+后续规划请参见 [`docs/ROADMAP.md`](docs/ROADMAP.md)。
 
 ## 许可证
 
-Apache-2.0。详见 [`LICENSE`](LICENSE) 与 [`NOTICE`](NOTICE)；从其他项目移植
-的代码会在承载它的 crate 的 `THIRD_PARTY_NOTICES.md` 中注明来源。
+Apache-2.0。详见 [`LICENSE`](LICENSE) 与 [`NOTICE`](NOTICE)。设计背景与代码来源说明见 [`docs/architecture.md`](docs/architecture.md#why-it-is-shaped-this-way) 及相关 crate 中的 `THIRD_PARTY_NOTICES.md`。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@milisp/keke",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "keke is a multi-vendor terminal coding agent.",
   "license": "Apache-2.0",
   "bin": {
@@ -18,11 +18,11 @@
     "win32"
   ],
   "optionalDependencies": {
-    "@milisp/keke-darwin-x64": "0.1.8",
-    "@milisp/keke-darwin-arm64": "0.1.8",
-    "@milisp/keke-linux-x64": "0.1.8",
-    "@milisp/keke-linux-arm64": "0.1.8",
-    "@milisp/keke-win32-x64": "0.1.8"
+    "@milisp/keke-darwin-x64": "0.1.10",
+    "@milisp/keke-darwin-arm64": "0.1.10",
+    "@milisp/keke-linux-x64": "0.1.10",
+    "@milisp/keke-linux-arm64": "0.1.10",
+    "@milisp/keke-win32-x64": "0.1.10"
   },
   "repository": {
     "type": "git",