autopilot-ai 1.2.2 → 1.5.0

package/README.md

@@ -1,3 +1,7 @@
+<p align="center">
+  <img src="https://raw.githubusercontent.com/sinameraji/autopilot/main/docs/logo.png" alt="Autopilot logo" width="160">
+</p>
+
 <h1 align="center">autopilot <sub>(formerly kimiflare)</sub></h1>
 
 <p align="center">
@@ -88,6 +92,18 @@ Earlier kimiflare versions ran on Cloudflare Workers AI / AI Gateway. On the fir
 - Memory keeps working unchanged: embeddings use the same `bge-base-en-v1.5` model, now via OpenRouter.
 - `/gateway`, `autopilot auth cloudflare`, `--cloud` and the Cloud-only commands are gone. `/multi-agent` (Commute) still deploys to your Cloudflare account and keeps using `CLOUDFLARE_ACCOUNT_ID` / `CLOUDFLARE_API_TOKEN` for that.
 
+### Local Hotcell research workers
+
+`spawn_worker` can optionally run read-only research in a local [Hotcell](https://github.com/sinameraji/hotcell) sandbox instead of the remote Commute worker. Install and start Hotcell, add your OpenRouter key to the Hotcell host key store (`hotcell keys add openrouter`), then opt in with either:
+
+```sh
+KIMIFLARE_WORKER_BACKEND=hotcell autopilot
+```
+
+or add `"workerBackend": "hotcell"` to `~/.config/kimiflare/config.json`. Remote workers remain the default. Each local worker uses an isolated cell with a pinned clean Git revision and a Hotcell-enforced spend ceiling; the exact active session model is passed through. The real provider key stays in Hotcell's host key store.
+
+The current local backend is **research-only**: workers cannot write files, run shell commands, create PRs, or use MCP tools. They can inspect repository files only inside the cloned workspace; environment files, VCS metadata, and credential paths are blocked. The parent workspace must be clean and have a credential-free HTTPS or SSH `origin` that the Hotcell daemon can clone. Local uncommitted changes are never copied. Results are returned for coordinator review and are not applied automatically. Hotcell CLI/daemon setup and gateway availability are required.
+
 ### Model
 
 You pick the model on first run, and can switch any time with `/model`. The picker opens on the **best & latest** models — recent, tool-capable models ranked by the agentic and coding benchmark scores OpenRouter publishes (Artificial Analysis), at most two per lab — so it stays current as new models ship, with no list maintained in code. Start typing to fuzzy-search all of them (`sonet` finds Claude Sonnet, `gpt 6` the GPT-6 family). Or set one directly:
@@ -130,6 +146,27 @@ The same pair can be persisted in `~/.config/kimiflare/config.json` as `baseUrl`
 - Model ids pass through in the request body unchanged; your endpoint owns provider dispatch.
 - Cost is the local estimate only — your endpoint does its own metering.
 
+### Requesty (optional)
+
+[Requesty](https://requesty.ai) is another OpenAI-compatible gateway you can use with your own key
+instead of OpenRouter. It is opt-in: it is only used when no OpenRouter key and no custom endpoint
+are configured, so an existing setup never changes.
+
+```sh
+export REQUESTY_API_KEY="<your key>"   # from https://app.requesty.ai/api-keys
+autopilot                              # or: autopilot auth requesty (checks and saves the key)
+autopilot -p "..." -m openai/gpt-4o-mini
+```
+
+- The key can also live in `~/.config/kimiflare/config.json` as `requestyApiKey` (the env var wins).
+- `REQUESTY_BASE_URL` picks a region, e.g. `https://router.eu.requesty.ai/v1` for the EU. Only https URLs on Requesty's hosts (`router.requesty.ai`, `router.eu.requesty.ai`, `router.us.requesty.ai`, `router.ap.requesty.ai`) are accepted, so the key is never sent anywhere else.
+- `/model` lists Requesty's managed policies first (short ids such as `kimi-k2.6` or
+  `claude-sonnet-4-5`), then its full `vendor/model` catalog. Both kinds of id work.
+- Defaults on Requesty: `kimi-k2.6` for the main model, `deepseek-v4-flash` for side calls, and
+  `openai/text-embedding-3-small` for memory embeddings.
+- Cost per turn is the one Requesty reports inline. `/key` shows whether the key is valid; OpenRouter
+  only features (browser sign in, `/key set`, the billed cost lookup) are not available.
+
 ### One-shot mode
 
 ```sh
@@ -189,6 +226,9 @@ OpenRouter key is required. Resolved in this priority order:
 2. **Environment variables**: `OPENROUTER_API_KEY` / `KIMIFLARE_OPENROUTER_KEY`
 3. **Config file**: `~/.config/kimiflare/config.json`
 
+A [Requesty](#requesty-optional) key (`requestyApiKey` in `config`, or `REQUESTY_API_KEY`) also works
+when no OpenRouter key is set; pass a Requesty model id such as `openai/gpt-4o-mini` as `model`.
+
 Pass `provider` in `createAgentSession` options to set OpenRouter provider-routing preferences for that session.
 
 **For Electron / desktop apps**, we recommend storing the key in the OS keychain (e.g. Electron `safeStorage` or `keytar`) and passing it explicitly:
@@ -269,11 +309,23 @@ autopilot
 | `/mcp list` / `/mcp reload` | Manage MCP servers |
 | `/reasoning` | Toggle chain-of-thought display |
 | `/model` | Pick a model from OpenRouter's catalog (or `/model <id>`, `/model list [filter]`) |
+| `/jev` | Ask Jev for a typed, scoped one-shot decision |
+| `/subagents off\|suggest\|auto` | Set the harness's subagent routing policy (default: `suggest`) |
 | `/key` | Show your OpenRouter key's spend and credit (`/key set <key>`, `/key clear`) |
 | `/cost` | Show OpenRouter-confirmed cost by session, day, month and all time |
 | `/update` | Check for updates |
 | `/help` | List all commands |
 
+### Subagent routing
+
+`/subagents suggest` is the default. `off` disables harness-initiated suggestions; `suggest` recommends a worker for likely parallel work but tells the coordinator to ask before dispatch; `auto` lets the coordinator call `spawn_worker` when confidence is high. Explicit requests to use agents or work without them take precedence over this automatic policy. `/subagents auto` is also available through `KIMIFLARE_SUBAGENT_POLICY=auto` or `subagentPolicy: "auto"` in config.
+
+The harness never starts a worker directly. The coordinator remains responsible for defining independent missions and synthesizing results. Jev is consulted only for substantial but ambiguous candidates, receives at most 1,200 characters of redacted task text (no chat history, project files, system prompt, or tool output), and has a 4-second timeout; any failure falls back to local sequential work. Clear routine or sequential tasks do not call Jev. Every `spawn_worker` call still requires its normal tool permission and obeys provider, read-only, spend, concurrency, and timeout limits—even in `auto` mode.
+
+## Running shell commands yourself
+
+Type `!` followed by a command (for example `! gh auth login`) to run it in your own terminal, inside the session. Logins, password prompts and interactive programs work because the command gets the real TTY. The output is added to the conversation so the agent can see it. The agent's own `bash` tool has no terminal, so autopilot suggests `! <command>` when something needs you: a login, a `sudo` password, an SSH passphrase, or a secret you'd rather not paste into chat. On macOS and Linux the output is captured with `script(1)`; elsewhere the command still runs but its output isn't captured.
+
 ## Keyboard shortcuts
 
 | Shortcut | Action |