codeep 2.5.1 → 2.6.0

package/README.md

@@ -217,6 +217,43 @@ AI-powered review of your git diff with `/review`:
 
 If there are no git changes, falls back to static analysis automatically.
 
+#### Custom rules (`.codeep/review.json`)
+
+The static reviewer (`codeep review` / `/review --static`) ships a set of
+built-in rules, but a project can tailor them — check a `.codeep/review.json`
+into the repo and the CLI **and** the [Codeep GitHub Action](https://github.com/VladoIvankovic/codeep-action)
+both pick it up automatically (zero LLM cost):
+
+```json
+{
+  "rules": [
+    {
+      "id": "no-internal-import",
+      "pattern": "from ['\"]@acme/internal",
+      "category": "best-practice",
+      "severity": "error",
+      "message": "Don't import from @acme/internal outside the platform team",
+      "suggestion": "Use the public @acme/sdk package",
+      "extensions": [".ts", ".tsx"]
+    }
+  ],
+  "disable": ["todo-comment", "anonymous-function"],
+  "include": ["src/**"],
+  "exclude": ["**/*.test.ts", "vendor/**"]
+}
+```
+
+- **`rules`** — your own checks. `id`, `pattern` (a regex string), and `message`
+  are required; `flags` (default `g`), `category`, `severity`
+  (`error|warning|info|suggestion`), `suggestion`, and `extensions` are optional.
+- **`disable`** — turn off built-in rules by id (e.g. `eval-usage`,
+  `hardcoded-password`, `todo-comment`, `any-type`, `console-statement`,
+  `long-file`, `long-function`, …).
+- **`include` / `exclude`** — glob scoping (`**`, `*`, `?`); `include` empty = all files.
+
+A missing, malformed, or partially-invalid config never breaks a review — bad
+entries are skipped and the run proceeds with whatever is valid.
+
 ### Interactive Mode
 Agent asks clarifying questions when tasks are ambiguous:
 ```
@@ -795,6 +832,28 @@ Hooks and MCP server configs are deliberately **not** synced: hooks run
 arbitrary shell, and MCP configs often embed tokens, so both stay local to each
 machine.
 
+### Privacy & telemetry
+
+Once your CLI is linked, Codeep automatically uploads usage stats (model,
+provider, token counts, estimated cost), session transcripts, `progress.md`,
+and project memory notes to power your dashboard. To opt out of **all** of these
+automatic uploads:
+
+```bash
+export CODEEP_NO_TELEMETRY=1   # also honors the cross-tool DO_NOT_TRACK=1
+```
+
+…or set it permanently in `~/.codeep/config.json`:
+
+```json
+{ "telemetry": false }
+```
+
+With telemetry off, nothing is uploaded automatically — the agent still runs
+fully and talks to your LLM provider directly. Explicit `codeep account push` /
+`account sync` commands are always under your control and are never gated by
+this flag.
+
 ### Tasks
 
 Create, view, and complete tasks directly from the CLI — or manage them on the codeep.dev dashboard:

package/dist/acp/commands.js

@@ -2,7 +2,7 @@
 // Slash command handler for ACP sessions.
 // Mirrors CLI commands from renderer/commands.ts but returns plain text
 // responses (no TUI) suitable for streaming back via session/update.
-import { config, getCurrentProvider, getModelsForCurrentProvider, setProvider, setApiKey, isConfigured, listSessionsWithInfo, startNewSession, loadSession, saveSession, initializeAsProject, isManuallyInitializedProject, setProjectPermission, hasWritePermission, hasReadPermission, } from '../config/index.js';
+import { config, getCurrentProvider, getModelsForCurrentProvider, setProvider, setApiKey, isConfigured, listSessionsWithInfo, startNewSession, loadSession, saveSession, initializeAsProject, isManuallyInitializedProject, setProjectPermission, hasWritePermission, hasReadPermission, isTelemetryEnabled, telemetryForcedOffByEnv, } from '../config/index.js';
 import { getProviderList, getProvider } from '../config/providers.js';
 import { getProjectContext } from '../utils/project.js';
 import { loadCustomCommands } from '../utils/customCommands.js';
@@ -207,14 +207,42 @@ export async function handleCommand(input, session, onChunk, abortSignal) {
         case 'apikey': {
             if (!args.length)
                 return { handled: true, response: showApiKey() };
-            return { handled: true, response: setApiKeyCmd(args[0]) };
+            return { handled: true, response: await setApiKeyCmd(args[0]) };
+        }
+        case 'telemetry': {
+            const sub = args[0]?.toLowerCase();
+            const envOff = telemetryForcedOffByEnv();
+            if (sub === 'on' || sub === 'off') {
+                if (envOff) {
+                    return { handled: true, response: 'Telemetry is forced **off** by the `CODEEP_NO_TELEMETRY` / `DO_NOT_TRACK` env var — unset it to change this. The config flag can\'t override an env var.' };
+                }
+                config.set('telemetry', sub === 'on');
+                return {
+                    handled: true,
+                    response: sub === 'on'
+                        ? 'Telemetry **on** — usage stats, session transcripts, progress and memory notes sync to codeep.dev.'
+                        : 'Telemetry **off** — no automatic cloud uploads. Explicit `/account push` still works.',
+                };
+            }
+            if (sub && sub !== 'status') {
+                return { handled: true, response: 'Usage: `/telemetry` · `/telemetry on` · `/telemetry off`' };
+            }
+            const flag = config.get('telemetry') !== false;
+            const lines = [
+                `**Telemetry:** ${isTelemetryEnabled() ? 'on' : 'off'}`,
+                `- Config flag \`telemetry\`: ${flag}`,
+            ];
+            if (envOff)
+                lines.push('- Forced **off** by `CODEEP_NO_TELEMETRY` / `DO_NOT_TRACK` (env overrides the flag).');
+            lines.push('', 'Toggle with `/telemetry on` | `/telemetry off`. Controls automatic uploads of usage stats, session transcripts, progress, and memory notes.');
+            return { handled: true, response: lines.join('\n') };
         }
         case 'login': {
             const [providerId, apiKey] = args;
             if (!providerId || !apiKey) {
                 return { handled: true, response: 'Usage: `/login <providerId> <apiKey>`\n\n' + buildProviderList() };
             }
-            return { handled: true, response: loginCmd(providerId, apiKey) };
+            return { handled: true, response: await loginCmd(providerId, apiKey) };
         }
         case 'sessions':
         case 'session': {
@@ -1414,6 +1442,7 @@ function buildHelp() {
         '| `/model [id]` | List or switch model |',
         '| `/login <provider> <key>` | Set API key for a provider |',
         '| `/apikey [key]` | Show or set API key |',
+        '| `/telemetry [on\\|off]` | Show or toggle automatic cloud telemetry |',
         '| `/lang [code]` | Set response language (`en`, `hr`, `auto`…) |',
         '| `/grant` | Grant write access for workspace |',
         '',
@@ -1545,18 +1574,29 @@ const INLINE_KEY_WARNING = '\n\n> ⚠️  The key you just typed is now in your
     ' Prefer setting the provider env var (see `/provider`) or using the' +
     ' settings UI in the VS Code extension. Clear the line from history if' +
     ' the machine is shared.';
-function setApiKeyCmd(key) {
+async function setApiKeyCmd(key) {
     const providerId = getCurrentProvider().id;
-    // setApiKey is async (keychain) — fire-and-forget, config cache updated synchronously
-    setApiKey(key, providerId);
+    // Await persistence so the confirmation is only returned once the key is
+    // actually stored (keychain write resolves before the process can exit).
+    try {
+        await setApiKey(key, providerId);
+    }
+    catch {
+        return `Failed to save API key for \`${providerId}\` — secure storage was unavailable. Please try again.`;
+    }
     return `API key for \`${providerId}\` saved.${INLINE_KEY_WARNING}`;
 }
-function loginCmd(providerId, apiKey) {
+async function loginCmd(providerId, apiKey) {
     const provider = getProvider(providerId);
     if (!provider)
         return `Provider \`${providerId}\` not found.\n\n${buildProviderList()}`;
     setProvider(providerId);
-    setApiKey(apiKey, providerId);
+    try {
+        await setApiKey(apiKey, providerId);
+    }
+    catch {
+        return `Failed to save API key for \`${providerId}\` — secure storage was unavailable. Please try again.`;
+    }
     return `Logged in as **${provider.name}** (\`${providerId}\`). Model: \`${provider.defaultModel}\`.${INLINE_KEY_WARNING}`;
 }
 const PREVIEW_MESSAGES = 6; // last N messages to show on session restore

package/dist/acp/server.js

@@ -12,7 +12,7 @@ import { loadMcpServerConfig, mergeMcpServers } from '../utils/mcpConfig.js';
 import { handleMcpSamplingRequest } from '../utils/mcpSamplingBridge.js';
 import { executeCommandAsync } from '../utils/shell.js';
 import { initWorkspace, loadWorkspace, handleCommand } from './commands.js';
-import { autoSaveSession, config, setProvider, setApiKey, listSessionsWithInfo, deleteSession as deleteSessionFile } from '../config/index.js';
+import { autoSaveSession, config, setProvider, setApiKey, getApiKey, getConfiguredProviders, listSessionsWithInfo, deleteSession as deleteSessionFile } from '../config/index.js';
 import { ApiError } from '../api/index.js';
 import { PROVIDERS } from '../config/providers.js';
 import { getCurrentVersion } from '../utils/update.js';
@@ -238,15 +238,19 @@ async function collectEmbeddedContext(blocks) {
     }
     return snippets.join('\n\n');
 }
-/** Check if a provider has an API key stored (reads config directly, no async) */
+/** Check if a provider has an API key stored (synchronous; relies on the cache
+ *  loaded at startup via loadAllApiKeys and the non-secret configuredProviderIds
+ *  index — never reads plaintext key material). */
 function providerHasKey(providerId) {
     // Check environment variable first
     const envKey = PROVIDERS[providerId]?.envKey;
     if (envKey && process.env[envKey])
         return true;
-    // Check stored providerApiKeys
-    const stored = (config.get('providerApiKeys') || []);
-    return stored.some(k => k.providerId === providerId && !!k.apiKey);
+    // In-memory cache (populated from secure storage at startup)
+    if (getApiKey(providerId))
+        return true;
+    // Non-secret index of providers that have a key in secure storage
+    return getConfiguredProviders().some(p => p.id === providerId);
 }
 function buildConfigOptions() {
     const currentModel = config.get('model') ?? '';
@@ -721,8 +725,12 @@ export function startAcpServer() {
             return;
         }
         session.currentModeId = modeId;
-        // Map ACP mode to Codeep agentConfirmation setting
-        config.set('agentConfirmation', modeId === 'manual' ? 'dangerous' : 'never');
+        // Do NOT persist the global `agentConfirmation` config here. The ACP
+        // permission gate is driven per-session by `session.currentModeId` (see the
+        // onRequestPermission wiring in handleSessionPrompt). Writing it globally
+        // would leak this session's mode into other processes — e.g. switching ACP
+        // to 'auto' would silently disarm the TUI's confirmation gate. Mode stays
+        // on the in-memory session object only.
         transport.respond(msg.id, {});
         // Notify Zed of the mode change
         transport.notify('session/update', {
@@ -786,7 +794,11 @@ export function startAcpServer() {
                 const apiKey = value.slice(colonIdx + 1);
                 if (providerId && apiKey) {
                     setProvider(providerId);
-                    setApiKey(apiKey, providerId);
+                    // Cache is updated synchronously inside setApiKey; the keychain write
+                    // resolves while the long-lived server runs. Swallow a persistence
+                    // failure here (secondary path) so it can't become an unhandled
+                    // rejection — the key still works for this session via the cache.
+                    setApiKey(apiKey, providerId).catch(() => { });
                 }
             }
         }

package/dist/config/index.d.ts

@@ -85,7 +85,21 @@ interface ConfigSchema {
     agentApiTimeout: number;
     agentInteractive: boolean;
     projectPermissions: ProjectPermission[];
+    /** @deprecated Legacy PLAINTEXT key store. Kept only so the one-time
+     *  migration into secure storage can read it; emptied afterwards. New keys
+     *  go to the OS keychain via utils/keychain.ts — never written here. */
     providerApiKeys: ProviderApiKey[];
+    /** Non-secret index of provider IDs that have a key in secure storage, so we
+     *  can list/load configured providers without probing the keychain for all
+     *  providers. Secrets themselves never live here. */
+    configuredProviderIds: string[];
+    /** True once legacy plaintext keys (providerApiKeys / apiKey) have been
+     *  migrated into secure storage and wiped from the config file. */
+    keysSecured: boolean;
+    /** Master switch for automatic cloud uploads (usage stats, session
+     *  transcripts, progress, memory notes). Default true; set false to opt out.
+     *  The CODEEP_NO_TELEMETRY / DO_NOT_TRACK env vars also force it off. */
+    telemetry: boolean;
     githubId: string;
     githubUsername: string;
     syncToken: string;
@@ -138,9 +152,11 @@ export declare function loadAllApiKeys(): Promise<void>;
  */
 export declare function getApiKey(providerId?: string): string;
 /**
- * Set API key - stores in config file
+ * Set API key — persists to secure storage (OS keychain), never plaintext.
+ * Returns a promise, but updates the synchronous cache first so callers that
+ * fire-and-forget still see the key immediately via getApiKey().
  */
-export declare function setApiKey(key: string, providerId?: string): void;
+export declare function setApiKey(key: string, providerId?: string): Promise<void>;
 export declare function getMaskedApiKey(providerId?: string): string;
 /**
  * Get list of providers that have API keys configured
@@ -149,10 +165,17 @@ export declare function getConfiguredProviders(): {
     id: string;
     name: string;
 }[];
+export declare function isTelemetryEnabled(): boolean;
+/**
+ * True when an env var (CODEEP_NO_TELEMETRY / DO_NOT_TRACK) is forcing telemetry
+ * off — in which case the `telemetry` config flag can't turn it back on. Lets
+ * the /telemetry command explain why a toggle had no effect.
+ */
+export declare function telemetryForcedOffByEnv(): boolean;
 /**
  * Clear API key for a specific provider
  */
-export declare function clearApiKey(providerId: string): void;
+export declare function clearApiKey(providerId: string): Promise<void>;
 export declare function isConfiguredAsync(providerId?: string): Promise<boolean>;
 export declare function isConfigured(providerId?: string): boolean;
 export declare function getCurrentProvider(): {

package/dist/config/index.js

@@ -4,6 +4,7 @@ import { join, dirname } from 'path';
 import { randomUUID } from 'crypto';
 import { PROVIDERS, getProvider, getProviderBaseUrl } from './providers.js';
 import { logSession } from '../utils/logger.js';
+import { createSecureStorage } from '../utils/keychain.js';
 // We'll initialize GLOBAL_SESSIONS_DIR after config is created (to use config.path)
 /**
  * Get sessions directory - local .codeep/sessions/ if in project, otherwise global
@@ -183,6 +184,9 @@ function createConfig() {
         rateLimitCommands: 10000,
         projectPermissions: [],
         providerApiKeys: [],
+        configuredProviderIds: [],
+        keysSecured: false,
+        telemetry: true,
         githubId: '',
         githubUsername: '',
         syncToken: '',
@@ -272,6 +276,89 @@ if (!existsSync(GLOBAL_SESSIONS_DIR)) {
 }
 // In-memory cache for API keys (populated on first access)
 const apiKeyCache = new Map();
+// ── Secure key storage (OS keychain, plaintext-config fallback) ──────────────
+// API keys persist in the OS keychain via utils/keychain.ts. The cache above is
+// the synchronous read path (getApiKey); the keychain is the async persistence
+// layer (set/load). A non-secret `configuredProviderIds` index in config tells
+// us which providers have a key without probing the keychain for every provider.
+let _secureKeyStore = null;
+function secureKeyStore() {
+    if (!_secureKeyStore)
+        _secureKeyStore = createSecureStorage(config);
+    return _secureKeyStore;
+}
+function addConfiguredProviderId(providerId) {
+    const ids = config.get('configuredProviderIds') || [];
+    if (!ids.includes(providerId)) {
+        config.set('configuredProviderIds', [...ids, providerId]);
+    }
+}
+function removeConfiguredProviderId(providerId) {
+    const ids = config.get('configuredProviderIds') || [];
+    if (ids.includes(providerId)) {
+        config.set('configuredProviderIds', ids.filter(id => id !== providerId));
+    }
+}
+let _migrationPromise = null;
+/**
+ * One-time migration of legacy PLAINTEXT keys (the `providerApiKeys` array and
+ * the very-old single `apiKey` field) into secure storage, then wipe the
+ * plaintext from the config file. Idempotent and guarded so concurrent callers
+ * share a single run. Each key's plaintext is wiped only after its write to
+ * secure storage actually succeeds; any key that fails to persist is retained
+ * and `keysSecured` stays false so the next startup retries — the last copy of
+ * a secret is never destroyed before a new copy is confirmed.
+ */
+async function migrateKeysToSecureStorage() {
+    if (config.get('keysSecured'))
+        return;
+    // Dedupe concurrent callers (loadApiKey + loadAllApiKeys at startup) onto a
+    // single run; cleared in finally so a later un-secured state can re-migrate.
+    if (!_migrationPromise) {
+        _migrationPromise = (async () => {
+            const store = secureKeyStore();
+            const legacyArray = config.get('providerApiKeys') || [];
+            // Only drain entries we actually persisted; keep failures so the next
+            // startup retries instead of destroying the last copy of a key.
+            const failed = [];
+            for (const entry of legacyArray) {
+                if (!entry?.providerId || !entry?.apiKey)
+                    continue;
+                try {
+                    await store.setApiKey(entry.providerId, entry.apiKey);
+                    addConfiguredProviderId(entry.providerId);
+                }
+                catch {
+                    failed.push(entry);
+                }
+            }
+            const legacySingle = config.get('apiKey');
+            let legacySingleMigrated = false;
+            if (legacySingle) {
+                try {
+                    await store.setApiKey('z.ai', legacySingle);
+                    addConfiguredProviderId('z.ai');
+                    legacySingleMigrated = true;
+                }
+                catch { /* keep the legacy field for retry */ }
+            }
+            // Wipe only the plaintext that made it into secure storage.
+            config.set('providerApiKeys', failed);
+            if (legacySingle && legacySingleMigrated)
+                config.set('apiKey', '');
+            // Mark secured only when everything migrated; a partial failure retries.
+            if (failed.length === 0 && (!legacySingle || legacySingleMigrated)) {
+                config.set('keysSecured', true);
+            }
+        })();
+    }
+    try {
+        await _migrationPromise;
+    }
+    finally {
+        _migrationPromise = null;
+    }
+}
 export const LANGUAGES = {
     'auto': 'Auto-detect',
     'en': 'English',
@@ -316,20 +403,12 @@ export async function loadApiKey(providerId) {
             return process.env.ZHIPUAI_API_KEY;
         }
     }
-    // Check config file
-    const providerKeys = config.get('providerApiKeys') || [];
-    const stored = providerKeys.find(k => k.providerId === provider);
-    if (stored?.apiKey) {
-        apiKeyCache.set(provider, stored.apiKey);
-        return stored.apiKey;
-    }
-    // Fallback to legacy apiKey field (for z.ai)
-    if (provider === 'z.ai') {
-        const legacyKey = config.get('apiKey') || '';
-        if (legacyKey) {
-            apiKeyCache.set(provider, legacyKey);
-            return legacyKey;
-        }
+    // Secure storage (OS keychain). Migrate any legacy plaintext keys first.
+    await migrateKeysToSecureStorage();
+    const stored = await secureKeyStore().getApiKey(provider);
+    if (stored) {
+        apiKeyCache.set(provider, stored);
+        return stored;
     }
     return '';
 }
@@ -338,12 +417,14 @@ export async function loadApiKey(providerId) {
  * Should be called at app startup
  */
 export async function loadAllApiKeys() {
-    // Load keys for all configured providers from providerApiKeys
-    const providerKeys = config.get('providerApiKeys') || [];
-    for (const { providerId, apiKey } of providerKeys) {
-        if (apiKey) {
-            apiKeyCache.set(providerId, apiKey);
-        }
+    // Migrate any legacy plaintext keys, then load all from secure storage using
+    // the non-secret configuredProviderIds index (no need to probe every provider).
+    await migrateKeysToSecureStorage();
+    const store = secureKeyStore();
+    for (const providerId of (config.get('configuredProviderIds') || [])) {
+        const key = await store.getApiKey(providerId);
+        if (key)
+            apiKeyCache.set(providerId, key);
     }
     // Also check environment variables for each provider
     for (const [providerId, providerConfig] of Object.entries(PROVIDERS)) {
@@ -354,7 +435,8 @@ export async function loadAllApiKeys() {
             }
         }
     }
-    // Legacy env vars for z.ai
+    // Legacy env vars for z.ai (the legacy `apiKey` config field is migrated into
+    // secure storage by migrateKeysToSecureStorage above).
     if (!apiKeyCache.get('z.ai')) {
         if (process.env.ZAI_API_KEY) {
             apiKeyCache.set('z.ai', process.env.ZAI_API_KEY);
@@ -362,13 +444,6 @@ export async function loadAllApiKeys() {
         else if (process.env.ZHIPUAI_API_KEY) {
             apiKeyCache.set('z.ai', process.env.ZHIPUAI_API_KEY);
         }
-        else {
-            // Fallback to legacy apiKey field
-            const legacyKey = config.get('apiKey') || '';
-            if (legacyKey) {
-                apiKeyCache.set('z.ai', legacyKey);
-            }
-        }
     }
 }
 /**
@@ -379,26 +454,22 @@ export function getApiKey(providerId) {
     return apiKeyCache.get(provider) || '';
 }
 /**
- * Set API key - stores in config file
+ * Set API key — persists to secure storage (OS keychain), never plaintext.
+ * Returns a promise, but updates the synchronous cache first so callers that
+ * fire-and-forget still see the key immediately via getApiKey().
  */
-export function setApiKey(key, providerId) {
+export async function setApiKey(key, providerId) {
     const provider = providerId || config.get('provider');
-    // Update cache immediately
+    // Update cache immediately so synchronous getApiKey() works right away.
     apiKeyCache.set(provider, key);
-    // Store in config
-    const providerKeys = config.get('providerApiKeys') || [];
-    const existing = providerKeys.findIndex(k => k.providerId === provider);
-    if (existing >= 0) {
-        providerKeys[existing].apiKey = key;
-    }
-    else {
-        providerKeys.push({ providerId: provider, apiKey: key });
-    }
-    config.set('providerApiKeys', providerKeys);
-    // Also set legacy field for backwards compatibility (z.ai only)
-    if (provider === 'z.ai') {
-        config.set('apiKey', key);
-    }
+    // Persist to secure storage (keychain, or plaintext-config fallback if the
+    // keychain is unavailable — utils/keychain.ts warns in that case). Let a hard
+    // persistence failure propagate so callers can report it instead of claiming
+    // success; the index + secured flag are set only after a confirmed write.
+    await secureKeyStore().setApiKey(provider, key);
+    addConfiguredProviderId(provider);
+    // No plaintext key was written here, so the store is already "secured".
+    config.set('keysSecured', true);
 }
 export function getMaskedApiKey(providerId) {
     const key = getApiKey(providerId);
@@ -411,33 +482,45 @@ export function getMaskedApiKey(providerId) {
  * Get list of providers that have API keys configured
  */
 export function getConfiguredProviders() {
-    const providerKeys = config.get('providerApiKeys') || [];
-    const configured = [];
-    for (const pk of providerKeys) {
-        if (pk.apiKey && pk.apiKey.length > 0) {
-            const provider = getProvider(pk.providerId);
-            configured.push({
-                id: pk.providerId,
-                name: provider?.name || pk.providerId,
-            });
-        }
-    }
-    return configured;
+    const ids = config.get('configuredProviderIds') || [];
+    return ids.map(id => ({ id, name: getProvider(id)?.name || id }));
+}
+/**
+ * Whether automatic cloud uploads are allowed (usage stats, session
+ * transcripts, progress, memory notes). Opt out via the `telemetry: false`
+ * config flag, the CODEEP_NO_TELEMETRY env var, or the cross-tool DO_NOT_TRACK
+ * convention. Explicit `codeep account push/sync` commands are user-initiated
+ * and are NOT gated by this.
+ */
+function envForcesTelemetryOff() {
+    const off = (v) => !!v && !/^(0|false|no|off)$/i.test(v.trim());
+    return off(process.env.CODEEP_NO_TELEMETRY) || off(process.env.DO_NOT_TRACK);
+}
+export function isTelemetryEnabled() {
+    if (envForcesTelemetryOff())
+        return false;
+    return config.get('telemetry') !== false;
+}
+/**
+ * True when an env var (CODEEP_NO_TELEMETRY / DO_NOT_TRACK) is forcing telemetry
+ * off — in which case the `telemetry` config flag can't turn it back on. Lets
+ * the /telemetry command explain why a toggle had no effect.
+ */
+export function telemetryForcedOffByEnv() {
+    return envForcesTelemetryOff();
 }
 /**
  * Clear API key for a specific provider
  */
-export function clearApiKey(providerId) {
+export async function clearApiKey(providerId) {
     // Clear from cache
     apiKeyCache.delete(providerId);
-    // Clear from config
-    const providerKeys = config.get('providerApiKeys') || [];
-    const filtered = providerKeys.filter(k => k.providerId !== providerId);
-    config.set('providerApiKeys', filtered);
-    // Clear legacy field if z.ai
-    if (providerId === 'z.ai') {
-        config.set('apiKey', '');
+    // Clear from secure storage + the non-secret index
+    try {
+        await secureKeyStore().deleteApiKey(providerId);
     }
+    catch { /* ignore */ }
+    removeConfiguredProviderId(providerId);
 }
 export async function isConfiguredAsync(providerId) {
     const key = await loadApiKey(providerId);

package/dist/renderer/App.js

@@ -82,6 +82,7 @@ const COMMAND_DESCRIPTIONS = {
     'profile': 'Save/load settings profiles',
     'tasks': 'Show pending tasks from codeep.dev dashboard',
     'sync': 'Sync learning preferences and profiles to codeep.dev',
+    'telemetry': 'Show or toggle automatic cloud telemetry (on/off)',
     // 2.0 — surfaced for `/` autocomplete; documented in /help too.
     'compact': 'Summarize older messages to free up context',
     'commands': 'List custom slash commands in .codeep/commands/*.md',
@@ -232,7 +233,7 @@ export class App {
         'multiline', 'memory', 'init',
         'provider', 'model', 'protocol', 'lang', 'grant', 'login', 'logout',
         'context-save', 'context-load', 'context-clear', 'learn',
-        'cost', 'tasks', 'account', 'sync',
+        'cost', 'tasks', 'account', 'sync', 'telemetry',
         // 2.0 — extensions, checkpoints, MCP, custom commands, OpenRouter prefs.
         // Keep in lockstep with COMMAND_DESCRIPTIONS below and helpCategories.
         'compact', 'commands', 'checkpoint', 'checkpoints', 'rewind',