@mrciphersmith/keryx 0.2.10 → 0.2.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +226 -225
  2. package/dist/cli.js +12 -7
  3. package/package.json +12 -7
package/README.md CHANGED
@@ -6,52 +6,89 @@
6
6
 
7
7
  <p align="center"><strong>One project-local brain for your AI agents and your team.</strong></p>
8
8
 
9
+ <p align="center">
10
+ Version-controlled repository context for Codex, Claude, Cursor,<br>
11
+ and any other AI coding agent.
12
+ </p>
13
+
9
14
  <p align="center">
10
15
  <a href="https://github.com/MrCipherSmith/keryx/actions/workflows/ci.yml"><img src="https://github.com/MrCipherSmith/keryx/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
16
+ <a href="https://www.npmjs.com/package/@mrciphersmith/keryx"><img src="https://img.shields.io/npm/v/@mrciphersmith/keryx.svg" alt="npm"></a>
11
17
  <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License: MIT"></a>
12
- <a href="package.json"><img src="https://img.shields.io/badge/version-0.2.0-blue.svg" alt="Version"></a>
13
18
  </p>
14
19
 
15
- `keryx` is a CLI that installs a small `.metaproject/` workspace into any codebase, giving AI agents and developers one shared, versioned source of context: a code graph, an architecture wiki, normalized health and test reports, long-term memory, and agent skills. Instead of context scattered across scratchpads, CI logs, and IDE rule files that never agree, everything lives in one git-diffable place that both humans and agents read from.
16
-
17
- The core is deterministic, local, and offline — with zero runtime dependencies. Every model-backed or precision feature is strictly opt-in, so a fresh install behaves identically whether or not you enable them.
18
-
19
- > **Model assets are optional.** Tree-sitter parsing uses downloadable grammars
20
- > that are **not bundled and not required**; when a grammar is absent, the graph
21
- > falls back to its deterministic resolver.
22
- >
23
- > **Two model-backed features are off in a way a download will not fix.**
24
- > Semantic memory search and the ML security detectors have no runtime shipped —
25
- > the ONNX stack was removed for weight, so their runtime identifiers are empty
26
- > strings (`src/security/detect/index.ts`, `src/memory/config.ts`). Re-enabling
27
- > them means editing those constants and installing a transformers.js-API
28
- > package, not supplying an asset. Both run on their deterministic floor
29
- > instead: lexical recall, and regex plus entropy.
30
-
31
- Most things degrade rather than break, but not everything. `keryx ctx rg` exits
32
- non-zero without `ripgrep` on `PATH` rather than falling back, and the
33
- model-backed commands — `test suggest`, `flow plan`, `memory reflect --narrate`,
34
- `health explain --narrate` — have no deterministic mode and exit non-zero
35
- without a credential. `wiki enrich` is the exception that degrades: it exits 0
36
- and marks pages skipped.
37
-
38
- ## What this removes
39
-
40
- An agent starts every task by re-deriving what your repository already knows.
41
- Which files relate to which. What the architecture decision was and why. Which
42
- tests cover the thing being changed. What broke last time someone tried this.
20
+ `keryx` turns what agents keep rediscovering about your repository into durable
21
+ Markdown and JSON under `.metaproject/`: code relationships, architecture,
22
+ project memory, relevant tests, quality signals, agent skills, and task state.
23
+ Every agent and every teammate reads the same context, and it is reviewed in a
24
+ diff like the rest of the code.
25
+
26
+ The core is deterministic, local, offline, and has no required runtime
27
+ dependencies.
28
+ keryx does not replace your coding agent and does not make engineering
29
+ decisions it gives every agent the same project context instead of letting
30
+ each one reconstruct the repository from scratch.
31
+
32
+ ```bash
33
+ npm install -g @mrciphersmith/keryx
34
+
35
+ cd path/to/your-project
36
+ keryx init --yes
37
+ keryx gdgraph build
38
+ ```
39
+
40
+ Local-first · deterministic core · offline by default · MIT
41
+
42
+ ## Why keryx
43
+
44
+ An agent starts every task by re-deriving what your repository already knows:
45
+
46
+ - which files and symbols are connected;
47
+ - what a change is going to affect;
48
+ - which architectural decision constrains it, and why;
49
+ - which tests verify the behaviour;
50
+ - what broke the last time someone tried this;
51
+ - which project rules apply.
52
+
43
53
  That work is repeated per task, per agent, per person — and the answers land in
44
54
  scratchpads, CI logs and IDE rule files that never agree with each other.
45
55
 
46
- keryx materializes those answers **into the repository**, as Markdown and JSON
47
- under `.metaproject/`, and points every agent at one index. The context is
48
- versioned with the code, readable in a diff, and shared by the humans and the
49
- agents alike.
56
+ keryx materializes those answers **into the repository**. The context is
57
+ versioned with the code, readable in a diff, and shared by humans and agents
58
+ alike, whichever agent runtime happens to be open.
59
+
60
+ ## What you get
61
+
62
+ | Need | keryx provides |
63
+ |------|----------------|
64
+ | Understand a change | Dependency and call graph, symbol/concept lookup, affected-set blast radius |
65
+ | Recover project intent | Architecture wiki with grounded retrieval and code↔wiki backlinks |
66
+ | Avoid repeating an investigation | Long-term project memory: lessons, decisions, constraints, known mistakes |
67
+ | Choose what to verify | Related tests for a file, changed-scope runs, coverage-map test impact analysis |
68
+ | Judge readiness | Normalized health reports and a quality gate over lint, types, tests, coverage, complexity |
69
+ | Coordinate work | Versioned task flows, managed review packages, generated agent skills |
70
+ | Keep agents inside boundaries | Deterministic secret / PII / prompt-injection scanning, redaction, policy gate, OS sandbox |
50
71
 
51
- ### What it looks like when it works
72
+ ## A typical agent workflow
52
73
 
53
- Real output, from a real run on [express](https://github.com/expressjs/express)
54
- — cloned fresh, four commands, nothing edited:
74
+ One task, one repository, no re-exploration:
75
+
76
+ ```bash
77
+ keryx gdgraph affected src/payments/retry.ts # what a change here touches
78
+ keryx wiki ask "How are payment retries designed?"
79
+ keryx memory search "payment retry" # decisions and past failures
80
+ keryx test related src/payments/retry.ts # the verification scope
81
+ keryx health run --changed # normalized quality result
82
+ ```
83
+
84
+ The agent gets structural context, architectural intent, previous decisions, the
85
+ tests that matter, and a normalized health result — without reconstructing any of
86
+ it by reading files at random.
87
+
88
+ ### What it looks like on a real repository
89
+
90
+ Real output from a fresh clone of
91
+ [express](https://github.com/expressjs/express) — four commands, nothing edited:
55
92
 
56
93
  ```console
57
94
  $ keryx init --yes
@@ -78,208 +115,182 @@ $ keryx gdgraph affected lib/express.js
78
115
  - index.js
79
116
  ```
80
117
 
81
- That last answer — *what breaks if I change this* — is the one an agent
82
- otherwise spends a dozen file reads guessing at, and gets wrong on the files
83
- that matter most.
84
-
85
- ### Is this for you?
86
-
87
- **Probably not, if:**
88
-
89
- - **you want a hosted service.** There is no server, no account, no dashboard in
90
- the cloud. If nothing runs on your machine, nothing runs.
91
- - **you are on Linux and need the network allowlist.** The domain allowlist,
92
- credential masking and TLS termination are macOS-only and **refuse** to run on
93
- Linux rather than quietly doing less. Filesystem containment and network
94
- on/off work on both.
95
- - **you need remote approvals today.** `keryx serve` exists, but a turn whose
96
- policy decision is `ask` terminates in a recorded denial. Approvals are not
97
- implemented yet.
98
- - **you want it to think for you.** keryx does deterministic mechanics — scan,
99
- graph, score, checksum. The judgement stays with the agent and with you.
118
+ That last answer — *what breaks if I change this* — is exactly the context the
119
+ affected graph supplies deterministically, in one command.
100
120
 
101
- **Probably yes, if** you run agents against a repository you care about, more
102
- than once, and you have noticed them rediscovering the same things.
121
+ ### What lands in your repository
103
122
 
104
- ## Quick Start
105
-
106
- **Requirements:** `git` and `bun` (>= 1.1.0). Code search (`keryx ctx rg` and the
107
- agent's `search_code` tool) additionally requires [ripgrep](https://github.com/BurntSushi/ripgrep)
108
- (`rg`) on `PATH` install it with `brew install ripgrep` (macOS) or `apt install ripgrep`
109
- (Debian/Ubuntu). Without it, code search is unavailable and the harness falls back to
110
- reading files directly.
111
-
112
- ### Install / update (global)
113
-
114
- ```bash
115
- npm install -g @mrciphersmith/keryx
123
+ ```text
124
+ .metaproject/
125
+ ├── index.md # the routing index every agent reads first
126
+ ├── wiki/ # architecture, domain models, decisions, flows
127
+ ├── memory/ # lessons, decisions, constraints, known mistakes
128
+ ├── skills/ # bundled agent skills and routing
129
+ ├── project-skills/ # skills generated from your own modules
130
+ ├── rules/ # your AGENTS.md / CLAUDE.md as project rules
131
+ ├── data/gdgraph/ # graph artifacts, module map, query results
132
+ ├── data/testing/ # test context, related tests, normalized reports
133
+ ├── data/health/ # normalized health artifacts and trends
134
+ └── flows/ # task flows with frozen acceptance criteria
116
135
  ```
117
136
 
118
- > **The package is scoped, and the scope matters.** The unscoped name `keryx` on
119
- > npm belongs to [an unrelated project](https://github.com/actionhero/keryx) —
120
- > `npm install -g keryx` installs a different program. The executable this
121
- > package installs is still called `keryx`.
137
+ All Markdown and JSON. All diffable. All yours.
122
138
 
123
- Or use the managed installer, which lays out `~/.keryx/keryx` with a wrapper at
124
- `~/.local/bin/keryx`. Re-run either command to upgrade.
139
+ ## Core capabilities
125
140
 
126
- ```bash
127
- # curl (short)
128
- curl -fsSL https://raw.githubusercontent.com/MrCipherSmith/keryx/main/install | bash
141
+ Grouped by what you are trying to do, not by internal module layout.
129
142
 
130
- # bun (short) — pipe into bun (Bun cannot run remote https://…/file.ts as entrypoint)
131
- curl -fsSL https://raw.githubusercontent.com/MrCipherSmith/keryx/main/install.ts | bun -
132
- ```
143
+ **Understand the codebase**
133
144
 
134
- Pure Bun without the `curl` binary:
145
+ - **gdgraph** language-aware dependency graph for TypeScript/JavaScript, Java
146
+ (Maven/Gradle) and Python: cycle and orphan queries, concept and symbol lookup,
147
+ shortest paths, affected-set blast radius, PageRank repo map, and an optional
148
+ tree-sitter symbol/call graph.
149
+ - **gdwiki** — a Markdown architecture wiki with hierarchical indexes, link
150
+ checks, code↔wiki backlinks, and grounded `wiki ask` retrieval.
151
+ - **gdctx** — compact command, search and file-read output, so agents keep raw
152
+ logs out of their context window while the full output stays on disk.
135
153
 
136
- ```bash
137
- bun -e 'await Bun.spawn(["bash","-s"],{stdin:await fetch("https://raw.githubusercontent.com/MrCipherSmith/keryx/main/install"),stdout:"inherit",stderr:"inherit"}).exited'
138
- ```
154
+ **Preserve knowledge**
139
155
 
140
- Both paths run `scripts/install.sh --global` under the hood. Ensure `~/.local/bin` is on `PATH`:
156
+ - **memory** long-term project memory with indexing, lexical search, dedup and
157
+ bitemporal validity, so a lesson learned once stays learned.
158
+ - **gdskills** — bundled and project-generated agent skills with routing,
159
+ verification, learning from reviews, and export to different agent runtimes.
141
160
 
142
- ```bash
143
- export PATH="$HOME/.local/bin:$PATH"
144
- ```
161
+ **Change with confidence**
145
162
 
146
- ### Interactive shell (TUI agent harness)
163
+ - **testing** testing context, related-test selection, changed-scope runs, and
164
+ an opt-in coverage-map Test Impact Analysis.
165
+ - **health** — normalized reports from TypeScript, tests, audit, complexity,
166
+ coverage and lint (optional SonarQube), plus a quality gate and trends.
167
+ - **review** — managed review packages under `.metaproject/reviews/`, standalone
168
+ or attached to a flow, so review findings become durable project artifacts.
147
169
 
148
- Bare `keryx` is the **CLI** (lists commands / usage). The interactive TUI agent
149
- harness starts only with **`keryx shell`**:
170
+ **Operate agents**
150
171
 
151
- ```bash
152
- keryx # CLI help metaproject commands
153
- keryx shell # OpenTUI + agent harness (default UI)
154
- ```
172
+ - **tasks** — an agent-first Task Manager driven by `keryx flow`, with frozen
173
+ acceptance criteria and status gates.
174
+ - **security** deterministic secrets / PII / prompt-injection / egress
175
+ scanning, redaction, and a policy gate at agent write seams, with a committed
176
+ evaluation corpus.
177
+ - **mcp** — an opt-in [Model Context Protocol](https://modelcontextprotocol.io)
178
+ server exposing read-only module services to agents.
155
179
 
156
- Useful `shell` flags:
180
+ `keryx modules` toggles modules by manifest key; `keryx status` shows what is
181
+ enabled. Nine modules are on after `init`; `mcp` is opt-in.
157
182
 
158
- | Flag | Effect |
159
- |------|--------|
160
- | *(default)* | TUI + agent |
161
- | `--no-tui` | classic readline shell |
162
- | `--chat` | chat without tools (readline) |
163
- | `--agent` | agent mode explicitly |
164
- | `--provider <p> --model <m>` | skip the provider/model picker |
165
- | `--base-url <url>` | custom provider endpoint |
183
+ ## Quick start
166
184
 
167
- Examples:
185
+ **Requirements:** `git` and `bun` (>= 1.1.0).
168
186
 
169
187
  ```bash
170
- keryx shell --provider ollama --model llama3.1:latest
171
- keryx shell --no-tui
172
- keryx shell --chat
173
- ```
174
-
175
- ### First project setup
188
+ npm install -g @mrciphersmith/keryx
176
189
 
177
- ```bash
178
190
  cd path/to/your-project
179
191
  keryx init
180
-
181
192
  keryx gdgraph build # code dependency graph
182
193
  keryx test analyze # testing context report
183
194
  keryx health run --changed # normalized health report
184
-
185
195
  keryx dash # human admin dashboard
186
196
  ```
187
197
 
188
- `keryx init` creates a `.metaproject/` workspace and connects your existing
198
+ `keryx init` creates the `.metaproject/` workspace and connects your existing
189
199
  `AGENTS.md` / `CLAUDE.md` entrypoints to it, so agents are routed to the right
190
- module automatically. See the
191
- [onboarding guide](docs/docs/onboarding.md) for the full first-run walkthrough
192
- and alternative install paths (managed curl installer, or project-local).
193
-
194
- ## Core Ideas
195
-
196
- A few pieces of jargon, defined once:
197
-
198
- - **gdgraph** — a *code graph*: language-aware dependency and import graph of your
199
- repo (TypeScript/JavaScript, Java via Maven/Gradle, and Python), with
200
- cycle/orphan queries, concept and symbol lookup, call-aware impact analysis,
201
- shortest paths, and a PageRank-ranked repo map.
202
- - **gdctx** — *compact context output*: runs commands, searches, and file reads
203
- and stores condensed results so agents don't flood their context with raw logs.
204
- - **gdwiki** — an *architecture wiki*: a Markdown knowledge base of domain
205
- models, decisions, and flows, with grounded `wiki ask` retrieval, hierarchical
206
- indexes, and backlinks between wiki pages and code.
207
- - **gdskills** — *agent skills*: bundled and project-generated skills that route
208
- agents to the right workflow, plus verification and export to different runtimes.
209
-
210
- ## Modules
211
-
212
- `keryx` itself is the toolkit core (`init`, `status`, `update`, `dashboard`,
213
- `rules`, `standard`, `agents`) and manages the `.metaproject/` structure. It
214
- ships these modules:
215
-
216
- - **gdgraph** — code dependency graph with language-aware import resolution (TypeScript/JavaScript, Java Maven/Gradle, Python); concept search, file/symbol paths, affected-set blast radius, PageRank repo map, and an optional tree-sitter symbol/call graph.
217
- - **gdctx** — compact command / search / read output plus opt-in routing guards for supported agent runtimes.
218
- - **gdwiki** — Markdown project wiki with hierarchical indexes, backlinks, link checks, collection, and grounded retrieval.
219
- - **gdskills** — bundled and generated agent skills with routing, verification, learning, and export.
220
- - **health** — normalized code-health reports from TypeScript, tests, audit, complexity, coverage, and lint (optional SonarQube).
221
- - **testing** — testing context, related-test selection, changed-scope runs, and an opt-in coverage-map Test Impact Analysis.
222
- - **memory** — long-term Markdown project memory with indexing, lexical search, dedup and bitemporal validity. The embedding seam exists but ships with no runtime — see the note above.
223
- - **tasks** — an agent-first Task Manager driven by `keryx flow` for issue/task lifecycle tracking.
224
- - **security** — deterministic secrets / PII / prompt-injection / egress scanning, redaction, and a policy gate at agent write seams.
225
- - **mcp** — opt-in [Model Context Protocol](https://modelcontextprotocol.io) server exposing read-only module services to agents. A real module, but **off by default** — the nine above are on after `init`, this one is not.
226
-
227
- `keryx modules` toggles modules by manifest key. Two caveats worth knowing:
228
- `security` is enabled by default but is **not** in that command's module list, so
229
- it cannot be toggled there; and toggling any module currently drops an enabled
230
- `mcp` from the manifest.
231
-
232
- **`review` and `serve` are commands, not modules.** They have no manifest entry
233
- and are not toggleable — `keryx review` writes managed review packages under
234
- `.metaproject/reviews/`, and `keryx serve` is the loopback HTTP entry described
235
- below. Earlier versions of this README listed them alongside the modules; that
236
- conflated three different things.
237
-
238
- Two cross-cutting commands improve agent startup and routing:
239
-
240
- - `keryx orient` emits or installs a compact graph + wiki orientation block at
241
- turn start for Claude, Codex, and Cursor.
242
- - `keryx agents bootstrap` installs the Metaproject discovery rule in supported
243
- global agent entrypoints.
244
-
245
- ## How Agents Use It
200
+ module automatically.
246
201
 
247
- After `init`, agents follow the root `AGENTS.md`/`CLAUDE.md` pointer to
248
- `.metaproject/index.md`, which routes them to the right module. For example:
202
+ > **The package is scoped, and the scope matters.** The unscoped name `keryx` on
203
+ > npm belongs to [an unrelated project](https://github.com/actionhero/keryx).
204
+ > Install `@mrciphersmith/keryx`; the executable it installs is called `keryx`.
249
205
 
250
- ```text
251
- Find the files related to payment retry handling, explain the relationships,
252
- and use the keryx tools for context discovery before broad raw search.
253
- ```
206
+ Alternative install paths — the managed installer (`~/.keryx` with a wrapper in
207
+ `~/.local/bin`), project-local installs, and running from source are in the
208
+ [onboarding guide](docs/docs/onboarding.md).
254
209
 
255
- The agent is directed to use `gdgraph` for navigation, `gdctx` for large output,
256
- `gdwiki` and `memory` for decisions and history, and `flow` for managed work —
257
- only for the modules you've enabled.
210
+ ### Interactive shell
258
211
 
259
- For an always-current starting map, install the optional orientation hook:
212
+ Bare `keryx` prints the CLI surface. The interactive TUI agent harness starts
213
+ with `keryx shell`:
260
214
 
261
215
  ```bash
262
- keryx orient install-hook --runtime codex
216
+ keryx # CLI help
217
+ keryx shell # TUI + agent (default UI)
218
+ keryx shell --no-tui # classic readline shell
219
+ keryx shell --chat # chat without tools
220
+ keryx shell --provider ollama --model llama3.1:latest
263
221
  ```
264
222
 
265
- For traceable review work, create a standalone review package or attach one to
266
- an existing flow:
223
+ ## Agent integrations
224
+
225
+ | Runtime | Integration |
226
+ |---------|-------------|
227
+ | Claude Code | `CLAUDE.md` routing, orientation hook, security hooks, MCP server |
228
+ | Codex | `AGENTS.md` routing and orientation hook |
229
+ | Cursor | Rules/orientation, security hooks, MCP server |
230
+ | Any other agent | Repository-local Markdown/JSON artifacts under `.metaproject/` |
231
+
232
+ After `init`, agents follow the root `AGENTS.md`/`CLAUDE.md` pointer to
233
+ `.metaproject/index.md`, which routes them to the right capability. Two commands
234
+ sharpen that routing:
267
235
 
268
236
  ```bash
269
- keryx review start --target branch --ref feature/example
270
- keryx review attach --flow 001 --target pull-request --ref 42
237
+ keryx orient install-hook --runtime codex # graph + wiki map at turn start
238
+ keryx agents bootstrap install --runtime claude
239
+ keryx mcp install --runtime cursor # opt-in read-only MCP server
271
240
  ```
272
241
 
273
- For agents that speak the Model Context Protocol, `keryx mcp install` wires a
274
- read-only MCP server into Cursor or Claude in one command (opt-in, off by
275
- default). See the [architecture doc](docs/docs/architecture.md) for the module
276
- data flows.
242
+ ## Requirements and compatibility
243
+
244
+ | Requirement | Status |
245
+ |-------------|--------|
246
+ | Bun | >= 1.1.0 |
247
+ | Git | Required |
248
+ | ripgrep | Required only for `keryx ctx rg` and the agent's `search_code` tool |
249
+ | Model provider credential | Required only for the optional AI commands below |
250
+ | macOS | Full support, including the complete policy sandbox |
251
+ | Linux | Full core support; filesystem containment and network on/off (needs `bubblewrap`) |
252
+ | Windows | Core CLI is not verified in CI; the OS sandbox is macOS/Linux only |
253
+ | CI | Ubuntu and macOS runners on every push |
254
+
255
+ ## Optional AI features
256
+
257
+ The graph, wiki, memory, testing, health, task, review and security workflows are
258
+ deterministic and run with no model provider at all. A small set of commands adds
259
+ model-generated suggestions or narration on top, and those require a configured
260
+ credential:
261
+
262
+ - `keryx test suggest <file>` — a test plan matching your project's frameworks
263
+ - `keryx flow plan <id>` — task breakdown for a flow
264
+ - `keryx memory reflect --narrate` — a narrative summary of project memory
265
+ - `keryx health explain <target> --narrate` — a readable explanation of a health result
266
+ - `keryx wiki enrich` — model-written wiki pages (skips pages without a credential)
267
+
268
+ Semantic embeddings and ML security classifiers are not bundled in the current
269
+ release. Memory search uses lexical retrieval, and security scanning uses
270
+ deterministic rules plus entropy analysis — both fully functional on that floor.
271
+ The seams exist for the model-backed variants when they ship.
272
+
273
+ Tree-sitter grammars for the symbol/call graph are downloadable and optional; the
274
+ graph falls back to its deterministic resolver when a grammar is absent.
277
275
 
278
- ## Remote Entry (opt-in, off by default)
276
+ ## Current limitations
279
277
 
280
- `keryx serve` is a second door into the same agent harness `keryx shell` uses —
281
- a loopback-bound HTTP listener, so a Telegram bot or a browser workspace can
282
- drive a run without a second agent runtime or a second owner of session state.
278
+ | Limitation | Impact | Alternative |
279
+ |------------|--------|-------------|
280
+ | No remote approval transport | A remote turn whose policy decision is `ask` ends in a recorded denial | Run approval-requiring turns locally |
281
+ | Domain allowlist is macOS-only | Domain-level egress policy, credential masking and TLS termination refuse to run on Linux rather than silently doing less | Filesystem containment and network on/off work on both |
282
+ | No bundled embedding runtime | No semantic ranking in memory search | Lexical memory search remains fully available |
283
+ | ripgrep is external | `keryx ctx rg` needs `rg` on `PATH` | Install ripgrep, or let the agent read files directly |
284
+ | Model commands need a credential | The five commands above exit non-zero without one | Everything else runs deterministically offline |
285
+
286
+ Full detail, including known defects and platform caveats:
287
+ [limitations](docs/docs/limitations.md).
288
+
289
+ ## Remote entry (opt-in, off by default)
290
+
291
+ `keryx serve` is a second door into the same agent harness `keryx shell` uses — a
292
+ loopback-bound HTTP listener, so a Telegram bot or a browser workspace can drive
293
+ a run without a second agent runtime or a second owner of session state.
283
294
 
284
295
  ```bash
285
296
  keryx serve config init # write the listener config
@@ -288,27 +299,18 @@ keryx serve # bind 127.0.0.1 and listen
288
299
  keryx serve status --json # configuration state
289
300
  ```
290
301
 
291
- It is **off unless you configure it**, binds loopback unless you pass
292
- `--acknowledge-non-loopback`, and authenticates *before* routing so an
293
- unauthenticated caller cannot tell a known path from an unknown one. Routes
294
- today: `GET /v1/status`, `GET /v1/projects`, `POST /v1/turns` with
295
- per-project idempotency keys, and `GET /v1/turns/<id>` for the durable record
296
- and its server-sent-event stream.
297
-
298
- Two boundaries worth knowing before you point anything at it:
299
-
300
- - **The remote policy profile may never be weaker than the local one**; it is
301
- compared on every turn, and a weaker profile is refused rather than accepted.
302
- - **Approvals are not implemented yet.** A turn whose policy decision is `ask`
303
- terminates in a *recorded denial* — it is never auto-approved.
302
+ It is off unless you configure it, binds loopback unless you pass
303
+ `--acknowledge-non-loopback`, and authenticates *before* routing, so an
304
+ unauthenticated caller cannot tell a known path from an unknown one. The remote
305
+ policy profile may never be weaker than the local one — it is compared on every
306
+ turn and a weaker profile is refused. See
307
+ [drive keryx remotely](docs/docs/guides/drive-keryx-remotely.md) for routes and
308
+ setup.
304
309
 
305
- `keryx projects` manages the user-global registry these routes address projects
306
- by; `keryx init` registers a project into it.
310
+ ## CI integration
307
311
 
308
- ## CI Integration
309
-
310
- `keryx` is designed so CI can publish normalized, committable artifacts that
311
- humans and agents read later:
312
+ CI can publish normalized, committable artifacts that humans and agents read
313
+ later:
312
314
 
313
315
  ```bash
314
316
  keryx gdgraph build
@@ -317,28 +319,25 @@ keryx health run --changed
317
319
  keryx dashboard build
318
320
  ```
319
321
 
320
- Use `keryx health gate --strict-warn` to fail a job on the normalized health
321
- gate instead of parsing raw linter/test logs, and `keryx security eval --corpus
322
- all` to fail on any detector breaching its committed false-negative threshold.
322
+ `keryx health gate --strict-warn` fails a job on the normalized health gate
323
+ instead of parsing raw linter/test logs, and `keryx security eval --corpus all`
324
+ fails on any detector breaching its committed false-negative threshold. See
325
+ [run keryx in CI](docs/docs/guides/run-in-ci.md).
323
326
 
324
327
  ## Documentation
325
328
 
326
- Full developer documentation — reverse-engineered from the source — lives under
327
- [docs/docs/](docs/docs/):
328
-
329
329
  - **[Onboarding](docs/docs/onboarding.md)** — install paths, first-run walkthrough, the build loop.
330
330
  - **[Architecture](docs/docs/architecture.md)** — the four-layer pattern, invariants, cross-module data flows.
331
331
  - **[Module reference](docs/docs/modules.md)** — one section per module: purpose, CLI surface, mechanics, data paths.
332
- - **[CLI reference](docs/docs/cli-reference.md)** — every command, subcommand, and flag.
332
+ - **[CLI reference](docs/docs/cli-reference.md)** — every command, subcommand, flag and exit code.
333
333
  - **[Workspace & lifecycle](docs/docs/workspace-and-lifecycle.md)** — the `.metaproject/` contract and `init`/`update` lifecycle.
334
-
335
- - **[Changelog](CHANGELOG.md)** — what has landed since `v0.1.0`, including a
336
- standing list of known gaps.
334
+ - **[Limitations](docs/docs/limitations.md)** — known gaps, platform caveats, and what to do instead.
335
+ - **[Changelog](CHANGELOG.md)** — what has landed since `v0.1.0`.
337
336
 
338
337
  Run `keryx <command> --help` (or `keryx` with no arguments) for the live command
339
338
  surface.
340
339
 
341
- ## Local Development
340
+ ## Local development
342
341
 
343
342
  ```bash
344
343
  bun ./src/cli.ts init
@@ -346,6 +345,8 @@ bun ./src/cli.ts status
346
345
  bun run check # typecheck + tests
347
346
  ```
348
347
 
348
+ Contributions are welcome — see [CONTRIBUTING.md](CONTRIBUTING.md).
349
+
349
350
  ## License
350
351
 
351
352
  MIT. See [LICENSE](LICENSE).
package/dist/cli.js CHANGED
@@ -48183,8 +48183,8 @@ Usage:
48183
48183
  // package.json
48184
48184
  var package_default = {
48185
48185
  name: "@mrciphersmith/keryx",
48186
- version: "0.2.10",
48187
- description: "CLI-first metaproject workspace for AI agents, code graph, project memory, health reports, testing context, wiki, skills, and task flows.",
48186
+ version: "0.2.11",
48187
+ description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
48188
48188
  private: false,
48189
48189
  publishConfig: {
48190
48190
  access: "public"
@@ -48197,15 +48197,20 @@ var package_default = {
48197
48197
  },
48198
48198
  keywords: [
48199
48199
  "ai-agents",
48200
- "agent-tooling",
48200
+ "coding-agents",
48201
+ "agent-context",
48202
+ "repository-context",
48201
48203
  "code-graph",
48202
48204
  "project-memory",
48205
+ "test-impact-analysis",
48203
48206
  "developer-tools",
48204
- "bun",
48205
- "typescript",
48207
+ "model-context-protocol",
48208
+ "mcp",
48209
+ "claude-code",
48210
+ "cursor",
48211
+ "codex",
48206
48212
  "cli",
48207
- "knowledge-base",
48208
- "multi-agent"
48213
+ "bun"
48209
48214
  ],
48210
48215
  bin: {
48211
48216
  keryx: "./dist/cli.js"
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@mrciphersmith/keryx",
3
- "version": "0.2.10",
4
- "description": "CLI-first metaproject workspace for AI agents, code graph, project memory, health reports, testing context, wiki, skills, and task flows.",
3
+ "version": "0.2.11",
4
+ "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
5
5
  "private": false,
6
6
  "publishConfig": {
7
7
  "access": "public"
@@ -14,15 +14,20 @@
14
14
  },
15
15
  "keywords": [
16
16
  "ai-agents",
17
- "agent-tooling",
17
+ "coding-agents",
18
+ "agent-context",
19
+ "repository-context",
18
20
  "code-graph",
19
21
  "project-memory",
22
+ "test-impact-analysis",
20
23
  "developer-tools",
21
- "bun",
22
- "typescript",
24
+ "model-context-protocol",
25
+ "mcp",
26
+ "claude-code",
27
+ "cursor",
28
+ "codex",
23
29
  "cli",
24
- "knowledge-base",
25
- "multi-agent"
30
+ "bun"
26
31
  ],
27
32
  "bin": {
28
33
  "keryx": "./dist/cli.js"