codeep 2.5.0 → 2.5.2

package/README.md

@@ -795,6 +795,28 @@ Hooks and MCP server configs are deliberately **not** synced: hooks run
 arbitrary shell, and MCP configs often embed tokens, so both stay local to each
 machine.
 
+### Privacy & telemetry
+
+Once your CLI is linked, Codeep automatically uploads usage stats (model,
+provider, token counts, estimated cost), session transcripts, `progress.md`,
+and project memory notes to power your dashboard. To opt out of **all** of these
+automatic uploads:
+
+```bash
+export CODEEP_NO_TELEMETRY=1   # also honors the cross-tool DO_NOT_TRACK=1
+```
+
+…or set it permanently in `~/.codeep/config.json`:
+
+```json
+{ "telemetry": false }
+```
+
+With telemetry off, nothing is uploaded automatically — the agent still runs
+fully and talks to your LLM provider directly. Explicit `codeep account push` /
+`account sync` commands are always under your control and are never gated by
+this flag.
+
 ### Tasks
 
 Create, view, and complete tasks directly from the CLI — or manage them on the codeep.dev dashboard:

package/dist/acp/commands.js

@@ -2,7 +2,7 @@
 // Slash command handler for ACP sessions.
 // Mirrors CLI commands from renderer/commands.ts but returns plain text
 // responses (no TUI) suitable for streaming back via session/update.
-import { config, getCurrentProvider, getModelsForCurrentProvider, setProvider, setApiKey, isConfigured, listSessionsWithInfo, startNewSession, loadSession, saveSession, initializeAsProject, isManuallyInitializedProject, setProjectPermission, hasWritePermission, hasReadPermission, } from '../config/index.js';
+import { config, getCurrentProvider, getModelsForCurrentProvider, setProvider, setApiKey, isConfigured, listSessionsWithInfo, startNewSession, loadSession, saveSession, initializeAsProject, isManuallyInitializedProject, setProjectPermission, hasWritePermission, hasReadPermission, isTelemetryEnabled, telemetryForcedOffByEnv, } from '../config/index.js';
 import { getProviderList, getProvider } from '../config/providers.js';
 import { getProjectContext } from '../utils/project.js';
 import { loadCustomCommands } from '../utils/customCommands.js';
@@ -207,14 +207,42 @@ export async function handleCommand(input, session, onChunk, abortSignal) {
         case 'apikey': {
             if (!args.length)
                 return { handled: true, response: showApiKey() };
-            return { handled: true, response: setApiKeyCmd(args[0]) };
+            return { handled: true, response: await setApiKeyCmd(args[0]) };
+        }
+        case 'telemetry': {
+            const sub = args[0]?.toLowerCase();
+            const envOff = telemetryForcedOffByEnv();
+            if (sub === 'on' || sub === 'off') {
+                if (envOff) {
+                    return { handled: true, response: 'Telemetry is forced **off** by the `CODEEP_NO_TELEMETRY` / `DO_NOT_TRACK` env var — unset it to change this. The config flag can\'t override an env var.' };
+                }
+                config.set('telemetry', sub === 'on');
+                return {
+                    handled: true,
+                    response: sub === 'on'
+                        ? 'Telemetry **on** — usage stats, session transcripts, progress and memory notes sync to codeep.dev.'
+                        : 'Telemetry **off** — no automatic cloud uploads. Explicit `/account push` still works.',
+                };
+            }
+            if (sub && sub !== 'status') {
+                return { handled: true, response: 'Usage: `/telemetry` · `/telemetry on` · `/telemetry off`' };
+            }
+            const flag = config.get('telemetry') !== false;
+            const lines = [
+                `**Telemetry:** ${isTelemetryEnabled() ? 'on' : 'off'}`,
+                `- Config flag \`telemetry\`: ${flag}`,
+            ];
+            if (envOff)
+                lines.push('- Forced **off** by `CODEEP_NO_TELEMETRY` / `DO_NOT_TRACK` (env overrides the flag).');
+            lines.push('', 'Toggle with `/telemetry on` | `/telemetry off`. Controls automatic uploads of usage stats, session transcripts, progress, and memory notes.');
+            return { handled: true, response: lines.join('\n') };
         }
         case 'login': {
             const [providerId, apiKey] = args;
             if (!providerId || !apiKey) {
                 return { handled: true, response: 'Usage: `/login <providerId> <apiKey>`\n\n' + buildProviderList() };
             }
-            return { handled: true, response: loginCmd(providerId, apiKey) };
+            return { handled: true, response: await loginCmd(providerId, apiKey) };
         }
         case 'sessions':
         case 'session': {
@@ -1414,6 +1442,7 @@ function buildHelp() {
         '| `/model [id]` | List or switch model |',
         '| `/login <provider> <key>` | Set API key for a provider |',
         '| `/apikey [key]` | Show or set API key |',
+        '| `/telemetry [on\\|off]` | Show or toggle automatic cloud telemetry |',
         '| `/lang [code]` | Set response language (`en`, `hr`, `auto`…) |',
         '| `/grant` | Grant write access for workspace |',
         '',
@@ -1545,18 +1574,29 @@ const INLINE_KEY_WARNING = '\n\n> ⚠️  The key you just typed is now in your
     ' Prefer setting the provider env var (see `/provider`) or using the' +
     ' settings UI in the VS Code extension. Clear the line from history if' +
     ' the machine is shared.';
-function setApiKeyCmd(key) {
+async function setApiKeyCmd(key) {
     const providerId = getCurrentProvider().id;
-    // setApiKey is async (keychain) — fire-and-forget, config cache updated synchronously
-    setApiKey(key, providerId);
+    // Await persistence so the confirmation is only returned once the key is
+    // actually stored (keychain write resolves before the process can exit).
+    try {
+        await setApiKey(key, providerId);
+    }
+    catch {
+        return `Failed to save API key for \`${providerId}\` — secure storage was unavailable. Please try again.`;
+    }
     return `API key for \`${providerId}\` saved.${INLINE_KEY_WARNING}`;
 }
-function loginCmd(providerId, apiKey) {
+async function loginCmd(providerId, apiKey) {
     const provider = getProvider(providerId);
     if (!provider)
         return `Provider \`${providerId}\` not found.\n\n${buildProviderList()}`;
     setProvider(providerId);
-    setApiKey(apiKey, providerId);
+    try {
+        await setApiKey(apiKey, providerId);
+    }
+    catch {
+        return `Failed to save API key for \`${providerId}\` — secure storage was unavailable. Please try again.`;
+    }
     return `Logged in as **${provider.name}** (\`${providerId}\`). Model: \`${provider.defaultModel}\`.${INLINE_KEY_WARNING}`;
 }
 const PREVIEW_MESSAGES = 6; // last N messages to show on session restore

package/dist/acp/server.js

@@ -12,7 +12,7 @@ import { loadMcpServerConfig, mergeMcpServers } from '../utils/mcpConfig.js';
 import { handleMcpSamplingRequest } from '../utils/mcpSamplingBridge.js';
 import { executeCommandAsync } from '../utils/shell.js';
 import { initWorkspace, loadWorkspace, handleCommand } from './commands.js';
-import { autoSaveSession, config, setProvider, setApiKey, listSessionsWithInfo, deleteSession as deleteSessionFile } from '../config/index.js';
+import { autoSaveSession, config, setProvider, setApiKey, getApiKey, getConfiguredProviders, listSessionsWithInfo, deleteSession as deleteSessionFile } from '../config/index.js';
 import { ApiError } from '../api/index.js';
 import { PROVIDERS } from '../config/providers.js';
 import { getCurrentVersion } from '../utils/update.js';
@@ -238,15 +238,19 @@ async function collectEmbeddedContext(blocks) {
     }
     return snippets.join('\n\n');
 }
-/** Check if a provider has an API key stored (reads config directly, no async) */
+/** Check if a provider has an API key stored (synchronous; relies on the cache
+ *  loaded at startup via loadAllApiKeys and the non-secret configuredProviderIds
+ *  index — never reads plaintext key material). */
 function providerHasKey(providerId) {
     // Check environment variable first
     const envKey = PROVIDERS[providerId]?.envKey;
     if (envKey && process.env[envKey])
         return true;
-    // Check stored providerApiKeys
-    const stored = (config.get('providerApiKeys') || []);
-    return stored.some(k => k.providerId === providerId && !!k.apiKey);
+    // In-memory cache (populated from secure storage at startup)
+    if (getApiKey(providerId))
+        return true;
+    // Non-secret index of providers that have a key in secure storage
+    return getConfiguredProviders().some(p => p.id === providerId);
 }
 function buildConfigOptions() {
     const currentModel = config.get('model') ?? '';
@@ -721,8 +725,12 @@ export function startAcpServer() {
             return;
         }
         session.currentModeId = modeId;
-        // Map ACP mode to Codeep agentConfirmation setting
-        config.set('agentConfirmation', modeId === 'manual' ? 'dangerous' : 'never');
+        // Do NOT persist the global `agentConfirmation` config here. The ACP
+        // permission gate is driven per-session by `session.currentModeId` (see the
+        // onRequestPermission wiring in handleSessionPrompt). Writing it globally
+        // would leak this session's mode into other processes — e.g. switching ACP
+        // to 'auto' would silently disarm the TUI's confirmation gate. Mode stays
+        // on the in-memory session object only.
         transport.respond(msg.id, {});
         // Notify Zed of the mode change
         transport.notify('session/update', {
@@ -786,7 +794,11 @@ export function startAcpServer() {
                 const apiKey = value.slice(colonIdx + 1);
                 if (providerId && apiKey) {
                     setProvider(providerId);
-                    setApiKey(apiKey, providerId);
+                    // Cache is updated synchronously inside setApiKey; the keychain write
+                    // resolves while the long-lived server runs. Swallow a persistence
+                    // failure here (secondary path) so it can't become an unhandled
+                    // rejection — the key still works for this session via the cache.
+                    setApiKey(apiKey, providerId).catch(() => { });
                 }
             }
         }

package/dist/config/index.d.ts

@@ -85,7 +85,21 @@ interface ConfigSchema {
     agentApiTimeout: number;
     agentInteractive: boolean;
     projectPermissions: ProjectPermission[];
+    /** @deprecated Legacy PLAINTEXT key store. Kept only so the one-time
+     *  migration into secure storage can read it; emptied afterwards. New keys
+     *  go to the OS keychain via utils/keychain.ts — never written here. */
     providerApiKeys: ProviderApiKey[];
+    /** Non-secret index of provider IDs that have a key in secure storage, so we
+     *  can list/load configured providers without probing the keychain for all
+     *  providers. Secrets themselves never live here. */
+    configuredProviderIds: string[];
+    /** True once legacy plaintext keys (providerApiKeys / apiKey) have been
+     *  migrated into secure storage and wiped from the config file. */
+    keysSecured: boolean;
+    /** Master switch for automatic cloud uploads (usage stats, session
+     *  transcripts, progress, memory notes). Default true; set false to opt out.
+     *  The CODEEP_NO_TELEMETRY / DO_NOT_TRACK env vars also force it off. */
+    telemetry: boolean;
     githubId: string;
     githubUsername: string;
     syncToken: string;
@@ -138,9 +152,11 @@ export declare function loadAllApiKeys(): Promise<void>;
  */
 export declare function getApiKey(providerId?: string): string;
 /**
- * Set API key - stores in config file
+ * Set API key — persists to secure storage (OS keychain), never plaintext.
+ * Returns a promise, but updates the synchronous cache first so callers that
+ * fire-and-forget still see the key immediately via getApiKey().
  */
-export declare function setApiKey(key: string, providerId?: string): void;
+export declare function setApiKey(key: string, providerId?: string): Promise<void>;
 export declare function getMaskedApiKey(providerId?: string): string;
 /**
  * Get list of providers that have API keys configured
@@ -149,10 +165,17 @@ export declare function getConfiguredProviders(): {
     id: string;
     name: string;
 }[];
+export declare function isTelemetryEnabled(): boolean;
+/**
+ * True when an env var (CODEEP_NO_TELEMETRY / DO_NOT_TRACK) is forcing telemetry
+ * off — in which case the `telemetry` config flag can't turn it back on. Lets
+ * the /telemetry command explain why a toggle had no effect.
+ */
+export declare function telemetryForcedOffByEnv(): boolean;
 /**
  * Clear API key for a specific provider
  */
-export declare function clearApiKey(providerId: string): void;
+export declare function clearApiKey(providerId: string): Promise<void>;
 export declare function isConfiguredAsync(providerId?: string): Promise<boolean>;
 export declare function isConfigured(providerId?: string): boolean;
 export declare function getCurrentProvider(): {

package/dist/config/index.js

@@ -4,6 +4,7 @@ import { join, dirname } from 'path';
 import { randomUUID } from 'crypto';
 import { PROVIDERS, getProvider, getProviderBaseUrl } from './providers.js';
 import { logSession } from '../utils/logger.js';
+import { createSecureStorage } from '../utils/keychain.js';
 // We'll initialize GLOBAL_SESSIONS_DIR after config is created (to use config.path)
 /**
  * Get sessions directory - local .codeep/sessions/ if in project, otherwise global
@@ -183,6 +184,9 @@ function createConfig() {
         rateLimitCommands: 10000,
         projectPermissions: [],
         providerApiKeys: [],
+        configuredProviderIds: [],
+        keysSecured: false,
+        telemetry: true,
         githubId: '',
         githubUsername: '',
         syncToken: '',
@@ -272,6 +276,89 @@ if (!existsSync(GLOBAL_SESSIONS_DIR)) {
 }
 // In-memory cache for API keys (populated on first access)
 const apiKeyCache = new Map();
+// ── Secure key storage (OS keychain, plaintext-config fallback) ──────────────
+// API keys persist in the OS keychain via utils/keychain.ts. The cache above is
+// the synchronous read path (getApiKey); the keychain is the async persistence
+// layer (set/load). A non-secret `configuredProviderIds` index in config tells
+// us which providers have a key without probing the keychain for every provider.
+let _secureKeyStore = null;
+function secureKeyStore() {
+    if (!_secureKeyStore)
+        _secureKeyStore = createSecureStorage(config);
+    return _secureKeyStore;
+}
+function addConfiguredProviderId(providerId) {
+    const ids = config.get('configuredProviderIds') || [];
+    if (!ids.includes(providerId)) {
+        config.set('configuredProviderIds', [...ids, providerId]);
+    }
+}
+function removeConfiguredProviderId(providerId) {
+    const ids = config.get('configuredProviderIds') || [];
+    if (ids.includes(providerId)) {
+        config.set('configuredProviderIds', ids.filter(id => id !== providerId));
+    }
+}
+let _migrationPromise = null;
+/**
+ * One-time migration of legacy PLAINTEXT keys (the `providerApiKeys` array and
+ * the very-old single `apiKey` field) into secure storage, then wipe the
+ * plaintext from the config file. Idempotent and guarded so concurrent callers
+ * share a single run. Each key's plaintext is wiped only after its write to
+ * secure storage actually succeeds; any key that fails to persist is retained
+ * and `keysSecured` stays false so the next startup retries — the last copy of
+ * a secret is never destroyed before a new copy is confirmed.
+ */
+async function migrateKeysToSecureStorage() {
+    if (config.get('keysSecured'))
+        return;
+    // Dedupe concurrent callers (loadApiKey + loadAllApiKeys at startup) onto a
+    // single run; cleared in finally so a later un-secured state can re-migrate.
+    if (!_migrationPromise) {
+        _migrationPromise = (async () => {
+            const store = secureKeyStore();
+            const legacyArray = config.get('providerApiKeys') || [];
+            // Only drain entries we actually persisted; keep failures so the next
+            // startup retries instead of destroying the last copy of a key.
+            const failed = [];
+            for (const entry of legacyArray) {
+                if (!entry?.providerId || !entry?.apiKey)
+                    continue;
+                try {
+                    await store.setApiKey(entry.providerId, entry.apiKey);
+                    addConfiguredProviderId(entry.providerId);
+                }
+                catch {
+                    failed.push(entry);
+                }
+            }
+            const legacySingle = config.get('apiKey');
+            let legacySingleMigrated = false;
+            if (legacySingle) {
+                try {
+                    await store.setApiKey('z.ai', legacySingle);
+                    addConfiguredProviderId('z.ai');
+                    legacySingleMigrated = true;
+                }
+                catch { /* keep the legacy field for retry */ }
+            }
+            // Wipe only the plaintext that made it into secure storage.
+            config.set('providerApiKeys', failed);
+            if (legacySingle && legacySingleMigrated)
+                config.set('apiKey', '');
+            // Mark secured only when everything migrated; a partial failure retries.
+            if (failed.length === 0 && (!legacySingle || legacySingleMigrated)) {
+                config.set('keysSecured', true);
+            }
+        })();
+    }
+    try {
+        await _migrationPromise;
+    }
+    finally {
+        _migrationPromise = null;
+    }
+}
 export const LANGUAGES = {
     'auto': 'Auto-detect',
     'en': 'English',
@@ -316,20 +403,12 @@ export async function loadApiKey(providerId) {
             return process.env.ZHIPUAI_API_KEY;
         }
     }
-    // Check config file
-    const providerKeys = config.get('providerApiKeys') || [];
-    const stored = providerKeys.find(k => k.providerId === provider);
-    if (stored?.apiKey) {
-        apiKeyCache.set(provider, stored.apiKey);
-        return stored.apiKey;
-    }
-    // Fallback to legacy apiKey field (for z.ai)
-    if (provider === 'z.ai') {
-        const legacyKey = config.get('apiKey') || '';
-        if (legacyKey) {
-            apiKeyCache.set(provider, legacyKey);
-            return legacyKey;
-        }
+    // Secure storage (OS keychain). Migrate any legacy plaintext keys first.
+    await migrateKeysToSecureStorage();
+    const stored = await secureKeyStore().getApiKey(provider);
+    if (stored) {
+        apiKeyCache.set(provider, stored);
+        return stored;
     }
     return '';
 }
@@ -338,12 +417,14 @@ export async function loadApiKey(providerId) {
  * Should be called at app startup
  */
 export async function loadAllApiKeys() {
-    // Load keys for all configured providers from providerApiKeys
-    const providerKeys = config.get('providerApiKeys') || [];
-    for (const { providerId, apiKey } of providerKeys) {
-        if (apiKey) {
-            apiKeyCache.set(providerId, apiKey);
-        }
+    // Migrate any legacy plaintext keys, then load all from secure storage using
+    // the non-secret configuredProviderIds index (no need to probe every provider).
+    await migrateKeysToSecureStorage();
+    const store = secureKeyStore();
+    for (const providerId of (config.get('configuredProviderIds') || [])) {
+        const key = await store.getApiKey(providerId);
+        if (key)
+            apiKeyCache.set(providerId, key);
     }
     // Also check environment variables for each provider
     for (const [providerId, providerConfig] of Object.entries(PROVIDERS)) {
@@ -354,7 +435,8 @@ export async function loadAllApiKeys() {
             }
         }
     }
-    // Legacy env vars for z.ai
+    // Legacy env vars for z.ai (the legacy `apiKey` config field is migrated into
+    // secure storage by migrateKeysToSecureStorage above).
     if (!apiKeyCache.get('z.ai')) {
         if (process.env.ZAI_API_KEY) {
             apiKeyCache.set('z.ai', process.env.ZAI_API_KEY);
@@ -362,13 +444,6 @@ export async function loadAllApiKeys() {
         else if (process.env.ZHIPUAI_API_KEY) {
             apiKeyCache.set('z.ai', process.env.ZHIPUAI_API_KEY);
         }
-        else {
-            // Fallback to legacy apiKey field
-            const legacyKey = config.get('apiKey') || '';
-            if (legacyKey) {
-                apiKeyCache.set('z.ai', legacyKey);
-            }
-        }
     }
 }
 /**
@@ -379,26 +454,22 @@ export function getApiKey(providerId) {
     return apiKeyCache.get(provider) || '';
 }
 /**
- * Set API key - stores in config file
+ * Set API key — persists to secure storage (OS keychain), never plaintext.
+ * Returns a promise, but updates the synchronous cache first so callers that
+ * fire-and-forget still see the key immediately via getApiKey().
  */
-export function setApiKey(key, providerId) {
+export async function setApiKey(key, providerId) {
     const provider = providerId || config.get('provider');
-    // Update cache immediately
+    // Update cache immediately so synchronous getApiKey() works right away.
     apiKeyCache.set(provider, key);
-    // Store in config
-    const providerKeys = config.get('providerApiKeys') || [];
-    const existing = providerKeys.findIndex(k => k.providerId === provider);
-    if (existing >= 0) {
-        providerKeys[existing].apiKey = key;
-    }
-    else {
-        providerKeys.push({ providerId: provider, apiKey: key });
-    }
-    config.set('providerApiKeys', providerKeys);
-    // Also set legacy field for backwards compatibility (z.ai only)
-    if (provider === 'z.ai') {
-        config.set('apiKey', key);
-    }
+    // Persist to secure storage (keychain, or plaintext-config fallback if the
+    // keychain is unavailable — utils/keychain.ts warns in that case). Let a hard
+    // persistence failure propagate so callers can report it instead of claiming
+    // success; the index + secured flag are set only after a confirmed write.
+    await secureKeyStore().setApiKey(provider, key);
+    addConfiguredProviderId(provider);
+    // No plaintext key was written here, so the store is already "secured".
+    config.set('keysSecured', true);
 }
 export function getMaskedApiKey(providerId) {
     const key = getApiKey(providerId);
@@ -411,33 +482,45 @@ export function getMaskedApiKey(providerId) {
  * Get list of providers that have API keys configured
  */
 export function getConfiguredProviders() {
-    const providerKeys = config.get('providerApiKeys') || [];
-    const configured = [];
-    for (const pk of providerKeys) {
-        if (pk.apiKey && pk.apiKey.length > 0) {
-            const provider = getProvider(pk.providerId);
-            configured.push({
-                id: pk.providerId,
-                name: provider?.name || pk.providerId,
-            });
-        }
-    }
-    return configured;
+    const ids = config.get('configuredProviderIds') || [];
+    return ids.map(id => ({ id, name: getProvider(id)?.name || id }));
+}
+/**
+ * Whether automatic cloud uploads are allowed (usage stats, session
+ * transcripts, progress, memory notes). Opt out via the `telemetry: false`
+ * config flag, the CODEEP_NO_TELEMETRY env var, or the cross-tool DO_NOT_TRACK
+ * convention. Explicit `codeep account push/sync` commands are user-initiated
+ * and are NOT gated by this.
+ */
+function envForcesTelemetryOff() {
+    const off = (v) => !!v && !/^(0|false|no|off)$/i.test(v.trim());
+    return off(process.env.CODEEP_NO_TELEMETRY) || off(process.env.DO_NOT_TRACK);
+}
+export function isTelemetryEnabled() {
+    if (envForcesTelemetryOff())
+        return false;
+    return config.get('telemetry') !== false;
+}
+/**
+ * True when an env var (CODEEP_NO_TELEMETRY / DO_NOT_TRACK) is forcing telemetry
+ * off — in which case the `telemetry` config flag can't turn it back on. Lets
+ * the /telemetry command explain why a toggle had no effect.
+ */
+export function telemetryForcedOffByEnv() {
+    return envForcesTelemetryOff();
 }
 /**
  * Clear API key for a specific provider
  */
-export function clearApiKey(providerId) {
+export async function clearApiKey(providerId) {
     // Clear from cache
     apiKeyCache.delete(providerId);
-    // Clear from config
-    const providerKeys = config.get('providerApiKeys') || [];
-    const filtered = providerKeys.filter(k => k.providerId !== providerId);
-    config.set('providerApiKeys', filtered);
-    // Clear legacy field if z.ai
-    if (providerId === 'z.ai') {
-        config.set('apiKey', '');
+    // Clear from secure storage + the non-secret index
+    try {
+        await secureKeyStore().deleteApiKey(providerId);
     }
+    catch { /* ignore */ }
+    removeConfiguredProviderId(providerId);
 }
 export async function isConfiguredAsync(providerId) {
     const key = await loadApiKey(providerId);

package/dist/renderer/App.js

@@ -82,6 +82,7 @@ const COMMAND_DESCRIPTIONS = {
     'profile': 'Save/load settings profiles',
     'tasks': 'Show pending tasks from codeep.dev dashboard',
     'sync': 'Sync learning preferences and profiles to codeep.dev',
+    'telemetry': 'Show or toggle automatic cloud telemetry (on/off)',
     // 2.0 — surfaced for `/` autocomplete; documented in /help too.
     'compact': 'Summarize older messages to free up context',
     'commands': 'List custom slash commands in .codeep/commands/*.md',
@@ -232,7 +233,7 @@ export class App {
         'multiline', 'memory', 'init',
         'provider', 'model', 'protocol', 'lang', 'grant', 'login', 'logout',
         'context-save', 'context-load', 'context-clear', 'learn',
-        'cost', 'tasks', 'account', 'sync',
+        'cost', 'tasks', 'account', 'sync', 'telemetry',
         // 2.0 — extensions, checkpoints, MCP, custom commands, OpenRouter prefs.
         // Keep in lockstep with COMMAND_DESCRIPTIONS below and helpCategories.
         'compact', 'commands', 'checkpoint', 'checkpoints', 'rewind',

package/dist/renderer/commands.js

@@ -5,7 +5,7 @@
  * decoupled from global state. Import-heavy commands use dynamic imports
  * to keep startup time low.
  */
-import { config, getCurrentProvider, getModelsForCurrentProvider, PROTOCOLS, LANGUAGES, setProvider, setApiKey, clearApiKey, getApiKey, saveSession, startNewSession, loadSession, listSessionsWithInfo, deleteSession, renameSession, setProjectPermission, saveProfile, loadProfile, applyProfile, listProfiles, deleteProfile, initializeAsProject, isManuallyInitializedProject, } from '../config/index.js';
+import { config, getCurrentProvider, getModelsForCurrentProvider, PROTOCOLS, LANGUAGES, setProvider, setApiKey, clearApiKey, getApiKey, isTelemetryEnabled, telemetryForcedOffByEnv, saveSession, startNewSession, loadSession, listSessionsWithInfo, deleteSession, renameSession, setProjectPermission, saveProfile, loadProfile, applyProfile, listProfiles, deleteProfile, initializeAsProject, isManuallyInitializedProject, } from '../config/index.js';
 import { getProjectContext } from '../utils/project.js';
 import { getCurrentVersion } from '../utils/update.js';
 import { getProviderList, getProvider } from '../config/providers.js';
@@ -245,6 +245,35 @@ export async function handleCommand(command, args, ctx) {
             ctx.app.addMessage({ role: 'system', content: lines.join('\n') });
             break;
         }
+        case 'telemetry': {
+            const sub = args[0]?.toLowerCase();
+            const envOff = telemetryForcedOffByEnv();
+            if (sub === 'on' || sub === 'off') {
+                if (envOff) {
+                    ctx.app.notify('Telemetry is forced OFF by CODEEP_NO_TELEMETRY / DO_NOT_TRACK — unset that env var to change it.');
+                    break;
+                }
+                config.set('telemetry', sub === 'on');
+                ctx.app.notify(sub === 'on'
+                    ? 'Telemetry on — usage stats, transcripts, progress & notes sync to codeep.dev.'
+                    : 'Telemetry off — no automatic cloud uploads.');
+                break;
+            }
+            if (sub && sub !== 'status') {
+                ctx.app.notify('Usage: /telemetry · /telemetry on · /telemetry off');
+                break;
+            }
+            const flag = config.get('telemetry') !== false;
+            const tLines = ['## Telemetry', ''];
+            tLines.push(`**State**      ${isTelemetryEnabled() ? 'on' : 'off'}`);
+            tLines.push(`**Flag**       telemetry = ${flag}`);
+            if (envOff)
+                tLines.push('**Env**        forced off by CODEEP_NO_TELEMETRY / DO_NOT_TRACK (overrides the flag)');
+            tLines.push('');
+            tLines.push('Toggle with `/telemetry on` or `/telemetry off`. Controls automatic uploads of usage stats, session transcripts, progress, and memory notes.');
+            ctx.app.addMessage({ role: 'system', content: tLines.join('\n') });
+            break;
+        }
         case 'grant': {
             setProjectPermission(ctx.projectPath, true, true);
             ctx.setHasWriteAccess(true);
@@ -880,8 +909,13 @@ Format: use headers per category, only include categories where you found issues
             ctx.app.showLogin(providers.map(p => ({ id: p.id, name: p.name, description: p.description, subscribeUrl: p.subscribeUrl, noApiKey: p.noApiKey })), async (result) => {
                 if (result) {
                     setProvider(result.providerId);
-                    await setApiKey(result.apiKey);
-                    ctx.app.notify('Logged in successfully');
+                    try {
+                        await setApiKey(result.apiKey);
+                        ctx.app.notify('Logged in successfully');
+                    }
+                    catch {
+                        ctx.app.notify('Could not save the API key (secure storage unavailable).');
+                    }
                 }
             });
             break;
@@ -901,11 +935,11 @@ Format: use headers per category, only include categories where you found issues
                     return;
                 if (result === 'all') {
                     for (const p of configuredProviders)
-                        clearApiKey(p.id);
+                        void clearApiKey(p.id);
                     ctx.app.notify('Logged out from all providers. Use /login to sign in.');
                 }
                 else {
-                    clearApiKey(result);
+                    void clearApiKey(result);
                     const provider = configuredProviders.find(p => p.id === result);
                     ctx.app.notify(`Logged out from ${provider?.name || result}`);
                     if (result === currentProvider.id) {

package/dist/renderer/main.js

@@ -278,7 +278,14 @@ async function showLoginFlow() {
                                 renderCurrentStep();
                                 return;
                             }
-                            await setApiKey(key);
+                            try {
+                                await setApiKey(key);
+                            }
+                            catch {
+                                loginError = 'Could not save the API key (secure storage unavailable). Please try again.';
+                                renderCurrentStep();
+                                return;
+                            }
                             cleanup();
                             resolve(key);
                         },
@@ -414,11 +421,15 @@ Commands (in chat):
         if (sub === 'sync' || sub === 'pull') {
             // Pull API keys from codeep.dev and save to local config
             const { pullKeys } = await import('../utils/codeepCloud.js');
-            const { getSyncToken, setApiKey } = await import('../config/index.js');
+            const { getSyncToken, setApiKey, loadAllApiKeys: loadKeys } = await import('../config/index.js');
             if (!getSyncToken()) {
                 console.log('\n  Not linked to codeep.dev. Run: codeep account\n');
                 process.exit(1);
             }
+            // Run the one-time plaintext->keychain migration BEFORE storing any pulled
+            // key. Otherwise the first setApiKey flips keysSecured=true and any local
+            // legacy plaintext keys would never migrate (orphaned, invisible).
+            await loadKeys();
             process.stdout.write('  Pulling keys from codeep.dev...');
             const keys = await pullKeys();
             if (!keys) {
@@ -430,10 +441,17 @@ Commands (in chat):
                 console.log(' no keys found.\n  Add keys at codeep.dev/dashboard');
             }
             else {
+                let synced = 0;
                 for (const [provider, key] of Object.entries(keys)) {
-                    setApiKey(key, provider);
+                    try {
+                        await setApiKey(key, provider);
+                        synced++;
+                    }
+                    catch {
+                        console.log(`\n  Warning: could not securely store the key for ${provider}.`);
+                    }
                 }
-                console.log(` synced ${count} key${count !== 1 ? 's' : ''}.`);
+                console.log(` synced ${synced} key${synced !== 1 ? 's' : ''}.`);
             }
             // Also pull portable personal config — personalities + custom commands +
             // the user profile. Additive merge (never clobbers local files).

package/dist/utils/agent.d.ts

@@ -13,6 +13,15 @@ import { undoLastAction, undoAllActions, getCurrentSession, getRecentSessions, f
 import { VerifyResult } from './verify';
 import { TaskPlan, SubTask } from './taskPlanner';
 export type PermissionOutcome = 'allow_once' | 'allow_always' | 'reject_once' | 'reject_always';
+export type PermissionDecision = 'allow-once' | 'allow-always' | 'deny-once' | 'deny-always';
+/**
+ * Map a permission outcome to a decision, FAILING CLOSED: a dangerous tool is
+ * allowed only on an explicit allow outcome. `reject_*` deny, and — critically —
+ * any unknown/malformed outcome from a buggy or hostile client also denies
+ * (deny-once) rather than slipping through to execution. Pure + exported so the
+ * invariant is unit-tested independently of the agent loop.
+ */
+export declare function classifyPermissionOutcome(outcome: string | undefined | null): PermissionDecision;
 export interface AgentOptions {
     maxIterations: number;
     maxDuration: number;

package/dist/utils/agent.js

@@ -103,6 +103,22 @@ function compressMessages(messages, actions) {
     debug(`Context compressed: ${totalChars} chars → keeping first + summary + last ${keep} messages`);
     return [firstMessage, summaryMessage, ...recentMessages];
 }
+/**
+ * Map a permission outcome to a decision, FAILING CLOSED: a dangerous tool is
+ * allowed only on an explicit allow outcome. `reject_*` deny, and — critically —
+ * any unknown/malformed outcome from a buggy or hostile client also denies
+ * (deny-once) rather than slipping through to execution. Pure + exported so the
+ * invariant is unit-tested independently of the agent loop.
+ */
+export function classifyPermissionOutcome(outcome) {
+    if (outcome === 'allow_always')
+        return 'allow-always';
+    if (outcome === 'allow_once')
+        return 'allow-once';
+    if (outcome === 'reject_always')
+        return 'deny-always';
+    return 'deny-once'; // 'reject_once' OR anything unexpected → fail closed
+}
 /**
  * Build the result for a run that paused at a safety limit. Pausing is a normal,
  * resumable state — not an error — so the summary tells the user how to resume.
@@ -779,15 +795,18 @@ export async function runAgent(prompt, projectContext, options = {}) {
                         continue;
                     }
                     const outcome = await opts.onRequestPermission(toolCall);
-                    if (outcome === 'allow_always') {
+                    // Fail CLOSED: allow ONLY on an explicit allow outcome; reject_* and
+                    // any malformed/unknown outcome deny (see classifyPermissionOutcome).
+                    const decision = classifyPermissionOutcome(outcome);
+                    if (decision === 'allow-always') {
                         alwaysAllowedTools.add(toolCall.tool);
                     }
-                    else if (outcome === 'reject_always') {
-                        alwaysRejectedTools.add(toolCall.tool);
-                        rejectResult();
-                        continue;
+                    else if (decision === 'allow-once') {
+                        // proceed this once
                     }
-                    else if (outcome === 'reject_once') {
+                    else {
+                        if (decision === 'deny-always')
+                            alwaysRejectedTools.add(toolCall.tool);
                         rejectResult();
                         continue;
                     }

package/dist/utils/codeepCloud.js

@@ -7,7 +7,7 @@
  */
 import { randomBytes, createHash } from 'crypto';
 import { spawn } from 'child_process';
-import { getGithubId, getSyncToken, setGithubAccount, setSyncToken, getDeviceId } from '../config/index.js';
+import { getGithubId, getSyncToken, setGithubAccount, setSyncToken, getDeviceId, isTelemetryEnabled } from '../config/index.js';
 import { hostname } from 'os';
 const API_BASE = 'https://codeep.dev';
 const POLL_INTERVAL_MS = 2000;
@@ -110,6 +110,8 @@ export function generateProjectId(projectRoot) {
  * Retries up to 2 times on network errors or 5xx responses.
  */
 export function reportStats(payload) {
+    if (!isTelemetryEnabled())
+        return; // user opted out of automatic uploads
     const githubId = getGithubId();
     if (!githubId)
         return; // not linked, skip silently
@@ -124,6 +126,8 @@ export function reportStats(payload) {
     }).catch(() => { });
 }
 export async function reportStatsAsync(payload) {
+    if (!isTelemetryEnabled())
+        return; // user opted out of automatic uploads
     const githubId = getGithubId();
     if (!githubId)
         return;
@@ -320,6 +324,8 @@ export const pushCommands = () => pushBundle('commands');
  * Fire-and-forget. Only sends if linked and sync_token is available.
  */
 export function syncSession(payload) {
+    if (!isTelemetryEnabled())
+        return; // user opted out of conversation/session upload
     const githubId = getGithubId();
     const syncToken = getSyncToken();
     if (!githubId || !syncToken)
@@ -335,6 +341,8 @@ export function syncSession(payload) {
     }).catch(() => { });
 }
 export async function syncSessionAsync(payload) {
+    if (!isTelemetryEnabled())
+        return; // user opted out of conversation/session upload
     const githubId = getGithubId();
     const syncToken = getSyncToken();
     if (!githubId || !syncToken)
@@ -354,6 +362,8 @@ export async function syncSessionAsync(payload) {
  * Fire-and-forget. Only sends if linked (githubId + syncToken).
  */
 export function syncProgress(payload) {
+    if (!isTelemetryEnabled())
+        return; // user opted out of automatic uploads
     const githubId = getGithubId();
     const syncToken = getSyncToken();
     if (!githubId || !syncToken)
@@ -483,6 +493,8 @@ export async function pullUserProfile() {
     }
 }
 export async function syncMemoryNotes(projectName, notes) {
+    if (!isTelemetryEnabled())
+        return; // user opted out of automatic uploads
     const syncToken = getSyncToken();
     if (!syncToken)
         return;

package/dist/utils/keychain.js

@@ -1,10 +1,23 @@
 import { logger } from './logger.js';
-// keytar is a native addon — load dynamically so compiled binaries fall back gracefully
-let keytar = null;
-try {
-    keytar = (await import('keytar')).default;
+// keytar is a native addon — load it LAZILY (on first use), never at module
+// top level. A top-level `await import()` here gives the module a top-level
+// await, which makes `bun build --compile` reject any CommonJS require() that
+// transitively depends on this file (renderer/main.js → codeepCloud → config →
+// keychain). Lazy loading keeps the module side-effect-free at import time.
+let _keytar = null;
+let _keytarTried = false;
+async function loadKeytar() {
+    if (!_keytarTried) {
+        _keytarTried = true;
+        try {
+            _keytar = (await import('keytar')).default;
+        }
+        catch {
+            _keytar = null; /* native addon unavailable */
+        }
+    }
+    return _keytar;
 }
-catch { /* native addon unavailable */ }
 const SERVICE_NAME = 'codeep';
 class KeychainStorage {
     getAccountName(providerId) {
@@ -12,9 +25,11 @@ class KeychainStorage {
     }
     async getApiKey(providerId) {
         try {
+            const kt = await loadKeytar();
+            if (!kt)
+                return null;
             const account = this.getAccountName(providerId);
-            const password = await keytar.getPassword(SERVICE_NAME, account);
-            return password;
+            return await kt.getPassword(SERVICE_NAME, account);
         }
         catch (error) {
             logger.debug(`Failed to get API key from keychain: ${error}`);
@@ -23,8 +38,11 @@ class KeychainStorage {
     }
     async setApiKey(providerId, apiKey) {
         try {
+            const kt = await loadKeytar();
+            if (!kt)
+                throw new Error('keytar unavailable');
             const account = this.getAccountName(providerId);
-            await keytar.setPassword(SERVICE_NAME, account, apiKey);
+            await kt.setPassword(SERVICE_NAME, account, apiKey);
         }
         catch (error) {
             throw new Error(`Failed to store API key in keychain: ${error}`);
@@ -32,8 +50,11 @@ class KeychainStorage {
     }
     async deleteApiKey(providerId) {
         try {
+            const kt = await loadKeytar();
+            if (!kt)
+                return;
             const account = this.getAccountName(providerId);
-            await keytar.deletePassword(SERVICE_NAME, account);
+            await kt.deletePassword(SERVICE_NAME, account);
         }
         catch (error) {
             logger.debug(`Failed to delete API key from keychain: ${error}`);
@@ -89,10 +110,11 @@ class SmartStorage {
             return;
         try {
             const testKey = '__codeep_test__';
-            if (!keytar)
+            const kt = await loadKeytar();
+            if (!kt)
                 throw new Error('keytar unavailable');
-            await keytar.setPassword(SERVICE_NAME, testKey, 'test');
-            await keytar.deletePassword(SERVICE_NAME, testKey);
+            await kt.setPassword(SERVICE_NAME, testKey, 'test');
+            await kt.deletePassword(SERVICE_NAME, testKey);
             this.useKeychain = true;
         }
         catch {

package/dist/utils/projectIntelligence.js

@@ -126,6 +126,74 @@ export function saveProjectIntelligence(projectPath, intelligence) {
         return false;
     }
 }
+/**
+ * Complete default intelligence skeleton — every nested section is present so
+ * consumers (e.g. generateContextFromIntelligence) never dereference an
+ * undefined section. Used as the merge base when normalizing a loaded file.
+ */
+function createBaseIntelligence(projectPath) {
+    return {
+        version: INTELLIGENCE_VERSION,
+        scannedAt: new Date().toISOString(),
+        projectPath,
+        name: basename(projectPath),
+        type: 'Unknown',
+        description: '',
+        structure: {
+            totalFiles: 0,
+            totalDirectories: 0,
+            languages: {},
+            topDirectories: [],
+        },
+        dependencies: {
+            runtime: [],
+            dev: [],
+            frameworks: [],
+        },
+        keyFiles: [],
+        entryPoints: [],
+        scripts: {},
+        architecture: {
+            patterns: [],
+            mainModules: [],
+            ciSystem: null,
+            containerization: [],
+            monorepoTool: null,
+        },
+        conventions: {
+            indentation: 'spaces',
+            quotes: 'single',
+            semicolons: true,
+            namingStyle: 'camelCase',
+        },
+        testing: {
+            framework: null,
+            testDirectory: null,
+            hasTests: false,
+        },
+        notes: [],
+    };
+}
+/**
+ * Merge a loaded (possibly partial or older-schema) intelligence object over
+ * the complete default skeleton so every nested section is guaranteed present.
+ * An interrupted scan or an older CLI can write a file that is missing whole
+ * sections (e.g. `conventions`); without this, reading `conventions.indentation`
+ * downstream throws "Cannot read properties of undefined". Nested objects are
+ * merged per-section so partial sub-objects are also backfilled.
+ */
+function normalizeIntelligence(data, projectPath) {
+    const base = createBaseIntelligence(projectPath);
+    return {
+        ...base,
+        ...data,
+        structure: { ...base.structure, ...data.structure },
+        dependencies: { ...base.dependencies, ...data.dependencies },
+        architecture: { ...base.architecture, ...data.architecture },
+        conventions: { ...base.conventions, ...data.conventions },
+        testing: { ...base.testing, ...data.testing },
+    };
+}
 /**
  * Load intelligence from .codeep/intelligence.json
  */
@@ -135,9 +203,13 @@ export function loadProjectIntelligence(projectPath) {
         if (!existsSync(filePath))
             return null;
         const data = JSON.parse(readFileSync(filePath, 'utf-8'));
+        if (!data || typeof data !== 'object')
+            return null;
         if (data.version !== INTELLIGENCE_VERSION)
             return null;
-        return data;
+        // Backfill any missing sections so a partial/interrupted file can't crash
+        // downstream consumers that assume a complete shape.
+        return normalizeIntelligence(data, projectPath);
     }
     catch {
         return null;
@@ -159,6 +231,10 @@ export function isIntelligenceFresh(projectPath, maxAgeHours = 24) {
  * Generate AI-friendly context from intelligence
  */
 export function generateContextFromIntelligence(intelligence) {
+    // Defensive: backfill any missing sections so a partial object (e.g. from an
+    // older/interrupted scan, or an external SDK caller) can't crash the
+    // formatter on a nested dereference like `conventions.indentation`.
+    intelligence = normalizeIntelligence((intelligence ?? {}), intelligence?.projectPath ?? '');
     const lines = [];
     lines.push(`# Project: ${intelligence.name}`);
     lines.push(`Type: ${intelligence.type}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeep",
-  "version": "2.5.0",
+  "version": "2.5.2",
   "description": "AI-powered coding assistant built for the terminal. Multiple LLM providers, project-aware context, and a seamless development workflow.",
   "type": "module",
   "main": "dist/index.js",