@mrciphersmith/keryx 0.2.10 → 0.2.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +226 -225
- package/dist/cli.js +12 -7
- package/package.json +12 -7
package/README.md
CHANGED
|
@@ -6,52 +6,89 @@
|
|
|
6
6
|
|
|
7
7
|
<p align="center"><strong>One project-local brain for your AI agents and your team.</strong></p>
|
|
8
8
|
|
|
9
|
+
<p align="center">
|
|
10
|
+
Version-controlled repository context for Codex, Claude, Cursor,<br>
|
|
11
|
+
and any other AI coding agent.
|
|
12
|
+
</p>
|
|
13
|
+
|
|
9
14
|
<p align="center">
|
|
10
15
|
<a href="https://github.com/MrCipherSmith/keryx/actions/workflows/ci.yml"><img src="https://github.com/MrCipherSmith/keryx/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
|
|
16
|
+
<a href="https://www.npmjs.com/package/@mrciphersmith/keryx"><img src="https://img.shields.io/npm/v/@mrciphersmith/keryx.svg" alt="npm"></a>
|
|
11
17
|
<a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT"></a>
|
|
12
|
-
<a href="package.json"><img src="https://img.shields.io/badge/version-0.2.0-blue.svg" alt="Version"></a>
|
|
13
18
|
</p>
|
|
14
19
|
|
|
15
|
-
`keryx`
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
20
|
+
`keryx` turns what agents keep rediscovering about your repository into durable
|
|
21
|
+
Markdown and JSON under `.metaproject/`: code relationships, architecture,
|
|
22
|
+
project memory, relevant tests, quality signals, agent skills, and task state.
|
|
23
|
+
Every agent and every teammate reads the same context, and it is reviewed in a
|
|
24
|
+
diff like the rest of the code.
|
|
25
|
+
|
|
26
|
+
The core is deterministic, local, offline, and has no required runtime
|
|
27
|
+
dependencies.
|
|
28
|
+
keryx does not replace your coding agent and does not make engineering
|
|
29
|
+
decisions — it gives every agent the same project context instead of letting
|
|
30
|
+
each one reconstruct the repository from scratch.
|
|
31
|
+
|
|
32
|
+
```bash
|
|
33
|
+
npm install -g @mrciphersmith/keryx
|
|
34
|
+
|
|
35
|
+
cd path/to/your-project
|
|
36
|
+
keryx init --yes
|
|
37
|
+
keryx gdgraph build
|
|
38
|
+
```
|
|
39
|
+
|
|
40
|
+
Local-first · deterministic core · offline by default · MIT
|
|
41
|
+
|
|
42
|
+
## Why keryx
|
|
43
|
+
|
|
44
|
+
An agent starts every task by re-deriving what your repository already knows:
|
|
45
|
+
|
|
46
|
+
- which files and symbols are connected;
|
|
47
|
+
- what a change is going to affect;
|
|
48
|
+
- which architectural decision constrains it, and why;
|
|
49
|
+
- which tests verify the behaviour;
|
|
50
|
+
- what broke the last time someone tried this;
|
|
51
|
+
- which project rules apply.
|
|
52
|
+
|
|
43
53
|
That work is repeated per task, per agent, per person — and the answers land in
|
|
44
54
|
scratchpads, CI logs and IDE rule files that never agree with each other.
|
|
45
55
|
|
|
46
|
-
keryx materializes those answers **into the repository
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
56
|
+
keryx materializes those answers **into the repository**. The context is
|
|
57
|
+
versioned with the code, readable in a diff, and shared by humans and agents
|
|
58
|
+
alike, whichever agent runtime happens to be open.
|
|
59
|
+
|
|
60
|
+
## What you get
|
|
61
|
+
|
|
62
|
+
| Need | keryx provides |
|
|
63
|
+
|------|----------------|
|
|
64
|
+
| Understand a change | Dependency and call graph, symbol/concept lookup, affected-set blast radius |
|
|
65
|
+
| Recover project intent | Architecture wiki with grounded retrieval and code↔wiki backlinks |
|
|
66
|
+
| Avoid repeating an investigation | Long-term project memory: lessons, decisions, constraints, known mistakes |
|
|
67
|
+
| Choose what to verify | Related tests for a file, changed-scope runs, coverage-map test impact analysis |
|
|
68
|
+
| Judge readiness | Normalized health reports and a quality gate over lint, types, tests, coverage, complexity |
|
|
69
|
+
| Coordinate work | Versioned task flows, managed review packages, generated agent skills |
|
|
70
|
+
| Keep agents inside boundaries | Deterministic secret / PII / prompt-injection scanning, redaction, policy gate, OS sandbox |
|
|
50
71
|
|
|
51
|
-
|
|
72
|
+
## A typical agent workflow
|
|
52
73
|
|
|
53
|
-
|
|
54
|
-
|
|
74
|
+
One task, one repository, no re-exploration:
|
|
75
|
+
|
|
76
|
+
```bash
|
|
77
|
+
keryx gdgraph affected src/payments/retry.ts # what a change here touches
|
|
78
|
+
keryx wiki ask "How are payment retries designed?"
|
|
79
|
+
keryx memory search "payment retry" # decisions and past failures
|
|
80
|
+
keryx test related src/payments/retry.ts # the verification scope
|
|
81
|
+
keryx health run --changed # normalized quality result
|
|
82
|
+
```
|
|
83
|
+
|
|
84
|
+
The agent gets structural context, architectural intent, previous decisions, the
|
|
85
|
+
tests that matter, and a normalized health result — without reconstructing any of
|
|
86
|
+
it by reading files at random.
|
|
87
|
+
|
|
88
|
+
### What it looks like on a real repository
|
|
89
|
+
|
|
90
|
+
Real output from a fresh clone of
|
|
91
|
+
[express](https://github.com/expressjs/express) — four commands, nothing edited:
|
|
55
92
|
|
|
56
93
|
```console
|
|
57
94
|
$ keryx init --yes
|
|
@@ -78,208 +115,182 @@ $ keryx gdgraph affected lib/express.js
|
|
|
78
115
|
- index.js
|
|
79
116
|
```
|
|
80
117
|
|
|
81
|
-
That last answer — *what breaks if I change this* — is the
|
|
82
|
-
|
|
83
|
-
that matter most.
|
|
84
|
-
|
|
85
|
-
### Is this for you?
|
|
86
|
-
|
|
87
|
-
**Probably not, if:**
|
|
88
|
-
|
|
89
|
-
- **you want a hosted service.** There is no server, no account, no dashboard in
|
|
90
|
-
the cloud. If nothing runs on your machine, nothing runs.
|
|
91
|
-
- **you are on Linux and need the network allowlist.** The domain allowlist,
|
|
92
|
-
credential masking and TLS termination are macOS-only and **refuse** to run on
|
|
93
|
-
Linux rather than quietly doing less. Filesystem containment and network
|
|
94
|
-
on/off work on both.
|
|
95
|
-
- **you need remote approvals today.** `keryx serve` exists, but a turn whose
|
|
96
|
-
policy decision is `ask` terminates in a recorded denial. Approvals are not
|
|
97
|
-
implemented yet.
|
|
98
|
-
- **you want it to think for you.** keryx does deterministic mechanics — scan,
|
|
99
|
-
graph, score, checksum. The judgement stays with the agent and with you.
|
|
118
|
+
That last answer — *what breaks if I change this* — is exactly the context the
|
|
119
|
+
affected graph supplies deterministically, in one command.
|
|
100
120
|
|
|
101
|
-
|
|
102
|
-
than once, and you have noticed them rediscovering the same things.
|
|
121
|
+
### What lands in your repository
|
|
103
122
|
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
123
|
+
```text
|
|
124
|
+
.metaproject/
|
|
125
|
+
├── index.md # the routing index every agent reads first
|
|
126
|
+
├── wiki/ # architecture, domain models, decisions, flows
|
|
127
|
+
├── memory/ # lessons, decisions, constraints, known mistakes
|
|
128
|
+
├── skills/ # bundled agent skills and routing
|
|
129
|
+
├── project-skills/ # skills generated from your own modules
|
|
130
|
+
├── rules/ # your AGENTS.md / CLAUDE.md as project rules
|
|
131
|
+
├── data/gdgraph/ # graph artifacts, module map, query results
|
|
132
|
+
├── data/testing/ # test context, related tests, normalized reports
|
|
133
|
+
├── data/health/ # normalized health artifacts and trends
|
|
134
|
+
└── flows/ # task flows with frozen acceptance criteria
|
|
116
135
|
```
|
|
117
136
|
|
|
118
|
-
|
|
119
|
-
> npm belongs to [an unrelated project](https://github.com/actionhero/keryx) —
|
|
120
|
-
> `npm install -g keryx` installs a different program. The executable this
|
|
121
|
-
> package installs is still called `keryx`.
|
|
137
|
+
All Markdown and JSON. All diffable. All yours.
|
|
122
138
|
|
|
123
|
-
|
|
124
|
-
`~/.local/bin/keryx`. Re-run either command to upgrade.
|
|
139
|
+
## Core capabilities
|
|
125
140
|
|
|
126
|
-
|
|
127
|
-
# curl (short)
|
|
128
|
-
curl -fsSL https://raw.githubusercontent.com/MrCipherSmith/keryx/main/install | bash
|
|
141
|
+
Grouped by what you are trying to do, not by internal module layout.
|
|
129
142
|
|
|
130
|
-
|
|
131
|
-
curl -fsSL https://raw.githubusercontent.com/MrCipherSmith/keryx/main/install.ts | bun -
|
|
132
|
-
```
|
|
143
|
+
**Understand the codebase**
|
|
133
144
|
|
|
134
|
-
|
|
145
|
+
- **gdgraph** — language-aware dependency graph for TypeScript/JavaScript, Java
|
|
146
|
+
(Maven/Gradle) and Python: cycle and orphan queries, concept and symbol lookup,
|
|
147
|
+
shortest paths, affected-set blast radius, PageRank repo map, and an optional
|
|
148
|
+
tree-sitter symbol/call graph.
|
|
149
|
+
- **gdwiki** — a Markdown architecture wiki with hierarchical indexes, link
|
|
150
|
+
checks, code↔wiki backlinks, and grounded `wiki ask` retrieval.
|
|
151
|
+
- **gdctx** — compact command, search and file-read output, so agents keep raw
|
|
152
|
+
logs out of their context window while the full output stays on disk.
|
|
135
153
|
|
|
136
|
-
|
|
137
|
-
bun -e 'await Bun.spawn(["bash","-s"],{stdin:await fetch("https://raw.githubusercontent.com/MrCipherSmith/keryx/main/install"),stdout:"inherit",stderr:"inherit"}).exited'
|
|
138
|
-
```
|
|
154
|
+
**Preserve knowledge**
|
|
139
155
|
|
|
140
|
-
|
|
156
|
+
- **memory** — long-term project memory with indexing, lexical search, dedup and
|
|
157
|
+
bitemporal validity, so a lesson learned once stays learned.
|
|
158
|
+
- **gdskills** — bundled and project-generated agent skills with routing,
|
|
159
|
+
verification, learning from reviews, and export to different agent runtimes.
|
|
141
160
|
|
|
142
|
-
|
|
143
|
-
export PATH="$HOME/.local/bin:$PATH"
|
|
144
|
-
```
|
|
161
|
+
**Change with confidence**
|
|
145
162
|
|
|
146
|
-
|
|
163
|
+
- **testing** — testing context, related-test selection, changed-scope runs, and
|
|
164
|
+
an opt-in coverage-map Test Impact Analysis.
|
|
165
|
+
- **health** — normalized reports from TypeScript, tests, audit, complexity,
|
|
166
|
+
coverage and lint (optional SonarQube), plus a quality gate and trends.
|
|
167
|
+
- **review** — managed review packages under `.metaproject/reviews/`, standalone
|
|
168
|
+
or attached to a flow, so review findings become durable project artifacts.
|
|
147
169
|
|
|
148
|
-
|
|
149
|
-
harness starts only with **`keryx shell`**:
|
|
170
|
+
**Operate agents**
|
|
150
171
|
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
172
|
+
- **tasks** — an agent-first Task Manager driven by `keryx flow`, with frozen
|
|
173
|
+
acceptance criteria and status gates.
|
|
174
|
+
- **security** — deterministic secrets / PII / prompt-injection / egress
|
|
175
|
+
scanning, redaction, and a policy gate at agent write seams, with a committed
|
|
176
|
+
evaluation corpus.
|
|
177
|
+
- **mcp** — an opt-in [Model Context Protocol](https://modelcontextprotocol.io)
|
|
178
|
+
server exposing read-only module services to agents.
|
|
155
179
|
|
|
156
|
-
|
|
180
|
+
`keryx modules` toggles modules by manifest key; `keryx status` shows what is
|
|
181
|
+
enabled. Nine modules are on after `init`; `mcp` is opt-in.
|
|
157
182
|
|
|
158
|
-
|
|
159
|
-
|------|--------|
|
|
160
|
-
| *(default)* | TUI + agent |
|
|
161
|
-
| `--no-tui` | classic readline shell |
|
|
162
|
-
| `--chat` | chat without tools (readline) |
|
|
163
|
-
| `--agent` | agent mode explicitly |
|
|
164
|
-
| `--provider <p> --model <m>` | skip the provider/model picker |
|
|
165
|
-
| `--base-url <url>` | custom provider endpoint |
|
|
183
|
+
## Quick start
|
|
166
184
|
|
|
167
|
-
|
|
185
|
+
**Requirements:** `git` and `bun` (>= 1.1.0).
|
|
168
186
|
|
|
169
187
|
```bash
|
|
170
|
-
|
|
171
|
-
keryx shell --no-tui
|
|
172
|
-
keryx shell --chat
|
|
173
|
-
```
|
|
174
|
-
|
|
175
|
-
### First project setup
|
|
188
|
+
npm install -g @mrciphersmith/keryx
|
|
176
189
|
|
|
177
|
-
```bash
|
|
178
190
|
cd path/to/your-project
|
|
179
191
|
keryx init
|
|
180
|
-
|
|
181
192
|
keryx gdgraph build # code dependency graph
|
|
182
193
|
keryx test analyze # testing context report
|
|
183
194
|
keryx health run --changed # normalized health report
|
|
184
|
-
|
|
185
195
|
keryx dash # human admin dashboard
|
|
186
196
|
```
|
|
187
197
|
|
|
188
|
-
`keryx init` creates
|
|
198
|
+
`keryx init` creates the `.metaproject/` workspace and connects your existing
|
|
189
199
|
`AGENTS.md` / `CLAUDE.md` entrypoints to it, so agents are routed to the right
|
|
190
|
-
module automatically.
|
|
191
|
-
[onboarding guide](docs/docs/onboarding.md) for the full first-run walkthrough
|
|
192
|
-
and alternative install paths (managed curl installer, or project-local).
|
|
193
|
-
|
|
194
|
-
## Core Ideas
|
|
195
|
-
|
|
196
|
-
A few pieces of jargon, defined once:
|
|
197
|
-
|
|
198
|
-
- **gdgraph** — a *code graph*: language-aware dependency and import graph of your
|
|
199
|
-
repo (TypeScript/JavaScript, Java via Maven/Gradle, and Python), with
|
|
200
|
-
cycle/orphan queries, concept and symbol lookup, call-aware impact analysis,
|
|
201
|
-
shortest paths, and a PageRank-ranked repo map.
|
|
202
|
-
- **gdctx** — *compact context output*: runs commands, searches, and file reads
|
|
203
|
-
and stores condensed results so agents don't flood their context with raw logs.
|
|
204
|
-
- **gdwiki** — an *architecture wiki*: a Markdown knowledge base of domain
|
|
205
|
-
models, decisions, and flows, with grounded `wiki ask` retrieval, hierarchical
|
|
206
|
-
indexes, and backlinks between wiki pages and code.
|
|
207
|
-
- **gdskills** — *agent skills*: bundled and project-generated skills that route
|
|
208
|
-
agents to the right workflow, plus verification and export to different runtimes.
|
|
209
|
-
|
|
210
|
-
## Modules
|
|
211
|
-
|
|
212
|
-
`keryx` itself is the toolkit core (`init`, `status`, `update`, `dashboard`,
|
|
213
|
-
`rules`, `standard`, `agents`) and manages the `.metaproject/` structure. It
|
|
214
|
-
ships these modules:
|
|
215
|
-
|
|
216
|
-
- **gdgraph** — code dependency graph with language-aware import resolution (TypeScript/JavaScript, Java Maven/Gradle, Python); concept search, file/symbol paths, affected-set blast radius, PageRank repo map, and an optional tree-sitter symbol/call graph.
|
|
217
|
-
- **gdctx** — compact command / search / read output plus opt-in routing guards for supported agent runtimes.
|
|
218
|
-
- **gdwiki** — Markdown project wiki with hierarchical indexes, backlinks, link checks, collection, and grounded retrieval.
|
|
219
|
-
- **gdskills** — bundled and generated agent skills with routing, verification, learning, and export.
|
|
220
|
-
- **health** — normalized code-health reports from TypeScript, tests, audit, complexity, coverage, and lint (optional SonarQube).
|
|
221
|
-
- **testing** — testing context, related-test selection, changed-scope runs, and an opt-in coverage-map Test Impact Analysis.
|
|
222
|
-
- **memory** — long-term Markdown project memory with indexing, lexical search, dedup and bitemporal validity. The embedding seam exists but ships with no runtime — see the note above.
|
|
223
|
-
- **tasks** — an agent-first Task Manager driven by `keryx flow` for issue/task lifecycle tracking.
|
|
224
|
-
- **security** — deterministic secrets / PII / prompt-injection / egress scanning, redaction, and a policy gate at agent write seams.
|
|
225
|
-
- **mcp** — opt-in [Model Context Protocol](https://modelcontextprotocol.io) server exposing read-only module services to agents. A real module, but **off by default** — the nine above are on after `init`, this one is not.
|
|
226
|
-
|
|
227
|
-
`keryx modules` toggles modules by manifest key. Two caveats worth knowing:
|
|
228
|
-
`security` is enabled by default but is **not** in that command's module list, so
|
|
229
|
-
it cannot be toggled there; and toggling any module currently drops an enabled
|
|
230
|
-
`mcp` from the manifest.
|
|
231
|
-
|
|
232
|
-
**`review` and `serve` are commands, not modules.** They have no manifest entry
|
|
233
|
-
and are not toggleable — `keryx review` writes managed review packages under
|
|
234
|
-
`.metaproject/reviews/`, and `keryx serve` is the loopback HTTP entry described
|
|
235
|
-
below. Earlier versions of this README listed them alongside the modules; that
|
|
236
|
-
conflated three different things.
|
|
237
|
-
|
|
238
|
-
Two cross-cutting commands improve agent startup and routing:
|
|
239
|
-
|
|
240
|
-
- `keryx orient` emits or installs a compact graph + wiki orientation block at
|
|
241
|
-
turn start for Claude, Codex, and Cursor.
|
|
242
|
-
- `keryx agents bootstrap` installs the Metaproject discovery rule in supported
|
|
243
|
-
global agent entrypoints.
|
|
244
|
-
|
|
245
|
-
## How Agents Use It
|
|
200
|
+
module automatically.
|
|
246
201
|
|
|
247
|
-
|
|
248
|
-
|
|
202
|
+
> **The package is scoped, and the scope matters.** The unscoped name `keryx` on
|
|
203
|
+
> npm belongs to [an unrelated project](https://github.com/actionhero/keryx).
|
|
204
|
+
> Install `@mrciphersmith/keryx`; the executable it installs is called `keryx`.
|
|
249
205
|
|
|
250
|
-
|
|
251
|
-
|
|
252
|
-
|
|
253
|
-
```
|
|
206
|
+
Alternative install paths — the managed installer (`~/.keryx` with a wrapper in
|
|
207
|
+
`~/.local/bin`), project-local installs, and running from source — are in the
|
|
208
|
+
[onboarding guide](docs/docs/onboarding.md).
|
|
254
209
|
|
|
255
|
-
|
|
256
|
-
`gdwiki` and `memory` for decisions and history, and `flow` for managed work —
|
|
257
|
-
only for the modules you've enabled.
|
|
210
|
+
### Interactive shell
|
|
258
211
|
|
|
259
|
-
|
|
212
|
+
Bare `keryx` prints the CLI surface. The interactive TUI agent harness starts
|
|
213
|
+
with `keryx shell`:
|
|
260
214
|
|
|
261
215
|
```bash
|
|
262
|
-
keryx
|
|
216
|
+
keryx # CLI help
|
|
217
|
+
keryx shell # TUI + agent (default UI)
|
|
218
|
+
keryx shell --no-tui # classic readline shell
|
|
219
|
+
keryx shell --chat # chat without tools
|
|
220
|
+
keryx shell --provider ollama --model llama3.1:latest
|
|
263
221
|
```
|
|
264
222
|
|
|
265
|
-
|
|
266
|
-
|
|
223
|
+
## Agent integrations
|
|
224
|
+
|
|
225
|
+
| Runtime | Integration |
|
|
226
|
+
|---------|-------------|
|
|
227
|
+
| Claude Code | `CLAUDE.md` routing, orientation hook, security hooks, MCP server |
|
|
228
|
+
| Codex | `AGENTS.md` routing and orientation hook |
|
|
229
|
+
| Cursor | Rules/orientation, security hooks, MCP server |
|
|
230
|
+
| Any other agent | Repository-local Markdown/JSON artifacts under `.metaproject/` |
|
|
231
|
+
|
|
232
|
+
After `init`, agents follow the root `AGENTS.md`/`CLAUDE.md` pointer to
|
|
233
|
+
`.metaproject/index.md`, which routes them to the right capability. Two commands
|
|
234
|
+
sharpen that routing:
|
|
267
235
|
|
|
268
236
|
```bash
|
|
269
|
-
keryx
|
|
270
|
-
keryx
|
|
237
|
+
keryx orient install-hook --runtime codex # graph + wiki map at turn start
|
|
238
|
+
keryx agents bootstrap install --runtime claude
|
|
239
|
+
keryx mcp install --runtime cursor # opt-in read-only MCP server
|
|
271
240
|
```
|
|
272
241
|
|
|
273
|
-
|
|
274
|
-
|
|
275
|
-
|
|
276
|
-
|
|
242
|
+
## Requirements and compatibility
|
|
243
|
+
|
|
244
|
+
| Requirement | Status |
|
|
245
|
+
|-------------|--------|
|
|
246
|
+
| Bun | >= 1.1.0 |
|
|
247
|
+
| Git | Required |
|
|
248
|
+
| ripgrep | Required only for `keryx ctx rg` and the agent's `search_code` tool |
|
|
249
|
+
| Model provider credential | Required only for the optional AI commands below |
|
|
250
|
+
| macOS | Full support, including the complete policy sandbox |
|
|
251
|
+
| Linux | Full core support; filesystem containment and network on/off (needs `bubblewrap`) |
|
|
252
|
+
| Windows | Core CLI is not verified in CI; the OS sandbox is macOS/Linux only |
|
|
253
|
+
| CI | Ubuntu and macOS runners on every push |
|
|
254
|
+
|
|
255
|
+
## Optional AI features
|
|
256
|
+
|
|
257
|
+
The graph, wiki, memory, testing, health, task, review and security workflows are
|
|
258
|
+
deterministic and run with no model provider at all. A small set of commands adds
|
|
259
|
+
model-generated suggestions or narration on top, and those require a configured
|
|
260
|
+
credential:
|
|
261
|
+
|
|
262
|
+
- `keryx test suggest <file>` — a test plan matching your project's frameworks
|
|
263
|
+
- `keryx flow plan <id>` — task breakdown for a flow
|
|
264
|
+
- `keryx memory reflect --narrate` — a narrative summary of project memory
|
|
265
|
+
- `keryx health explain <target> --narrate` — a readable explanation of a health result
|
|
266
|
+
- `keryx wiki enrich` — model-written wiki pages (skips pages without a credential)
|
|
267
|
+
|
|
268
|
+
Semantic embeddings and ML security classifiers are not bundled in the current
|
|
269
|
+
release. Memory search uses lexical retrieval, and security scanning uses
|
|
270
|
+
deterministic rules plus entropy analysis — both fully functional on that floor.
|
|
271
|
+
The seams exist for the model-backed variants when they ship.
|
|
272
|
+
|
|
273
|
+
Tree-sitter grammars for the symbol/call graph are downloadable and optional; the
|
|
274
|
+
graph falls back to its deterministic resolver when a grammar is absent.
|
|
277
275
|
|
|
278
|
-
##
|
|
276
|
+
## Current limitations
|
|
279
277
|
|
|
280
|
-
|
|
281
|
-
|
|
282
|
-
|
|
278
|
+
| Limitation | Impact | Alternative |
|
|
279
|
+
|------------|--------|-------------|
|
|
280
|
+
| No remote approval transport | A remote turn whose policy decision is `ask` ends in a recorded denial | Run approval-requiring turns locally |
|
|
281
|
+
| Domain allowlist is macOS-only | Domain-level egress policy, credential masking and TLS termination refuse to run on Linux rather than silently doing less | Filesystem containment and network on/off work on both |
|
|
282
|
+
| No bundled embedding runtime | No semantic ranking in memory search | Lexical memory search remains fully available |
|
|
283
|
+
| ripgrep is external | `keryx ctx rg` needs `rg` on `PATH` | Install ripgrep, or let the agent read files directly |
|
|
284
|
+
| Model commands need a credential | The five commands above exit non-zero without one | Everything else runs deterministically offline |
|
|
285
|
+
|
|
286
|
+
Full detail, including known defects and platform caveats:
|
|
287
|
+
[limitations](docs/docs/limitations.md).
|
|
288
|
+
|
|
289
|
+
## Remote entry (opt-in, off by default)
|
|
290
|
+
|
|
291
|
+
`keryx serve` is a second door into the same agent harness `keryx shell` uses — a
|
|
292
|
+
loopback-bound HTTP listener, so a Telegram bot or a browser workspace can drive
|
|
293
|
+
a run without a second agent runtime or a second owner of session state.
|
|
283
294
|
|
|
284
295
|
```bash
|
|
285
296
|
keryx serve config init # write the listener config
|
|
@@ -288,27 +299,18 @@ keryx serve # bind 127.0.0.1 and listen
|
|
|
288
299
|
keryx serve status --json # configuration state
|
|
289
300
|
```
|
|
290
301
|
|
|
291
|
-
It is
|
|
292
|
-
`--acknowledge-non-loopback`, and authenticates *before* routing
|
|
293
|
-
unauthenticated caller cannot tell a known path from an unknown one.
|
|
294
|
-
|
|
295
|
-
|
|
296
|
-
|
|
297
|
-
|
|
298
|
-
Two boundaries worth knowing before you point anything at it:
|
|
299
|
-
|
|
300
|
-
- **The remote policy profile may never be weaker than the local one**; it is
|
|
301
|
-
compared on every turn, and a weaker profile is refused rather than accepted.
|
|
302
|
-
- **Approvals are not implemented yet.** A turn whose policy decision is `ask`
|
|
303
|
-
terminates in a *recorded denial* — it is never auto-approved.
|
|
302
|
+
It is off unless you configure it, binds loopback unless you pass
|
|
303
|
+
`--acknowledge-non-loopback`, and authenticates *before* routing, so an
|
|
304
|
+
unauthenticated caller cannot tell a known path from an unknown one. The remote
|
|
305
|
+
policy profile may never be weaker than the local one — it is compared on every
|
|
306
|
+
turn and a weaker profile is refused. See
|
|
307
|
+
[drive keryx remotely](docs/docs/guides/drive-keryx-remotely.md) for routes and
|
|
308
|
+
setup.
|
|
304
309
|
|
|
305
|
-
|
|
306
|
-
by; `keryx init` registers a project into it.
|
|
310
|
+
## CI integration
|
|
307
311
|
|
|
308
|
-
|
|
309
|
-
|
|
310
|
-
`keryx` is designed so CI can publish normalized, committable artifacts that
|
|
311
|
-
humans and agents read later:
|
|
312
|
+
CI can publish normalized, committable artifacts that humans and agents read
|
|
313
|
+
later:
|
|
312
314
|
|
|
313
315
|
```bash
|
|
314
316
|
keryx gdgraph build
|
|
@@ -317,28 +319,25 @@ keryx health run --changed
|
|
|
317
319
|
keryx dashboard build
|
|
318
320
|
```
|
|
319
321
|
|
|
320
|
-
|
|
321
|
-
|
|
322
|
-
|
|
322
|
+
`keryx health gate --strict-warn` fails a job on the normalized health gate
|
|
323
|
+
instead of parsing raw linter/test logs, and `keryx security eval --corpus all`
|
|
324
|
+
fails on any detector breaching its committed false-negative threshold. See
|
|
325
|
+
[run keryx in CI](docs/docs/guides/run-in-ci.md).
|
|
323
326
|
|
|
324
327
|
## Documentation
|
|
325
328
|
|
|
326
|
-
Full developer documentation — reverse-engineered from the source — lives under
|
|
327
|
-
[docs/docs/](docs/docs/):
|
|
328
|
-
|
|
329
329
|
- **[Onboarding](docs/docs/onboarding.md)** — install paths, first-run walkthrough, the build loop.
|
|
330
330
|
- **[Architecture](docs/docs/architecture.md)** — the four-layer pattern, invariants, cross-module data flows.
|
|
331
331
|
- **[Module reference](docs/docs/modules.md)** — one section per module: purpose, CLI surface, mechanics, data paths.
|
|
332
|
-
- **[CLI reference](docs/docs/cli-reference.md)** — every command, subcommand, and
|
|
332
|
+
- **[CLI reference](docs/docs/cli-reference.md)** — every command, subcommand, flag and exit code.
|
|
333
333
|
- **[Workspace & lifecycle](docs/docs/workspace-and-lifecycle.md)** — the `.metaproject/` contract and `init`/`update` lifecycle.
|
|
334
|
-
|
|
335
|
-
- **[Changelog](CHANGELOG.md)** — what has landed since `v0.1.0
|
|
336
|
-
standing list of known gaps.
|
|
334
|
+
- **[Limitations](docs/docs/limitations.md)** — known gaps, platform caveats, and what to do instead.
|
|
335
|
+
- **[Changelog](CHANGELOG.md)** — what has landed since `v0.1.0`.
|
|
337
336
|
|
|
338
337
|
Run `keryx <command> --help` (or `keryx` with no arguments) for the live command
|
|
339
338
|
surface.
|
|
340
339
|
|
|
341
|
-
## Local
|
|
340
|
+
## Local development
|
|
342
341
|
|
|
343
342
|
```bash
|
|
344
343
|
bun ./src/cli.ts init
|
|
@@ -346,6 +345,8 @@ bun ./src/cli.ts status
|
|
|
346
345
|
bun run check # typecheck + tests
|
|
347
346
|
```
|
|
348
347
|
|
|
348
|
+
Contributions are welcome — see [CONTRIBUTING.md](CONTRIBUTING.md).
|
|
349
|
+
|
|
349
350
|
## License
|
|
350
351
|
|
|
351
352
|
MIT. See [LICENSE](LICENSE).
|
package/dist/cli.js
CHANGED
|
@@ -48183,8 +48183,8 @@ Usage:
|
|
|
48183
48183
|
// package.json
|
|
48184
48184
|
var package_default = {
|
|
48185
48185
|
name: "@mrciphersmith/keryx",
|
|
48186
|
-
version: "0.2.
|
|
48187
|
-
description: "
|
|
48186
|
+
version: "0.2.11",
|
|
48187
|
+
description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
|
|
48188
48188
|
private: false,
|
|
48189
48189
|
publishConfig: {
|
|
48190
48190
|
access: "public"
|
|
@@ -48197,15 +48197,20 @@ var package_default = {
|
|
|
48197
48197
|
},
|
|
48198
48198
|
keywords: [
|
|
48199
48199
|
"ai-agents",
|
|
48200
|
-
"
|
|
48200
|
+
"coding-agents",
|
|
48201
|
+
"agent-context",
|
|
48202
|
+
"repository-context",
|
|
48201
48203
|
"code-graph",
|
|
48202
48204
|
"project-memory",
|
|
48205
|
+
"test-impact-analysis",
|
|
48203
48206
|
"developer-tools",
|
|
48204
|
-
"
|
|
48205
|
-
"
|
|
48207
|
+
"model-context-protocol",
|
|
48208
|
+
"mcp",
|
|
48209
|
+
"claude-code",
|
|
48210
|
+
"cursor",
|
|
48211
|
+
"codex",
|
|
48206
48212
|
"cli",
|
|
48207
|
-
"
|
|
48208
|
-
"multi-agent"
|
|
48213
|
+
"bun"
|
|
48209
48214
|
],
|
|
48210
48215
|
bin: {
|
|
48211
48216
|
keryx: "./dist/cli.js"
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mrciphersmith/keryx",
|
|
3
|
-
"version": "0.2.
|
|
4
|
-
"description": "
|
|
3
|
+
"version": "0.2.11",
|
|
4
|
+
"description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
|
|
5
5
|
"private": false,
|
|
6
6
|
"publishConfig": {
|
|
7
7
|
"access": "public"
|
|
@@ -14,15 +14,20 @@
|
|
|
14
14
|
},
|
|
15
15
|
"keywords": [
|
|
16
16
|
"ai-agents",
|
|
17
|
-
"
|
|
17
|
+
"coding-agents",
|
|
18
|
+
"agent-context",
|
|
19
|
+
"repository-context",
|
|
18
20
|
"code-graph",
|
|
19
21
|
"project-memory",
|
|
22
|
+
"test-impact-analysis",
|
|
20
23
|
"developer-tools",
|
|
21
|
-
"
|
|
22
|
-
"
|
|
24
|
+
"model-context-protocol",
|
|
25
|
+
"mcp",
|
|
26
|
+
"claude-code",
|
|
27
|
+
"cursor",
|
|
28
|
+
"codex",
|
|
23
29
|
"cli",
|
|
24
|
-
"
|
|
25
|
-
"multi-agent"
|
|
30
|
+
"bun"
|
|
26
31
|
],
|
|
27
32
|
"bin": {
|
|
28
33
|
"keryx": "./dist/cli.js"
|