kavach-ai 0.2.0 → 0.3.0

package/README.md

@@ -4,9 +4,8 @@ Your agents, your data, your machine.
 
 ```bash
 npm install -g kavach-ai
-kavach install model         # local model, ~1.5GB
-kavach login --key <key>     # from https://bluehawks.ai/kavach/key
-kavach open                  # studio at http://localhost:5181
+kavach install model         # local model, ~1.5GB — this is the whole product
+kavach open                  # studio at http://localhost:15181
 ```
 
 The package is `kavach-ai`; the command it installs is `kavach`. (`kavach` on
@@ -16,13 +15,45 @@ The binary ships inside a small per-platform package that npm selects
 automatically, so there is no download step and nothing to fetch outside the
 registry — it installs cleanly behind a corporate proxy.
 
-Kavach needs a key to run. Get one at <https://bluehawks.ai/kavach/key>, then
-either paste it into the screen Kavach shows on first launch or pass it to
-`kavach login`. Kavach Basic is $4/month and Advanced is $8/month.
+A key is optional. Without one you are on the free tier, which is the local
+model, the local knowledge base and local dictation — no account, no network,
+nothing leaving the machine. A key adds cloud model providers and unlocks your
+plan's sections of the studio (Advanced adds evaluation, observability and
+governance; teams are the Enterprise plan); get one at <https://bluehawks.ai/kavach/key> and
+enter it with `kavach login`, or from the studio itself: the header shows a
+tier chip (Free / Basic / Advanced) and clicking it opens the key entry, which
+is also where the upgrade prompt links when something paid-only is refused.
+Kavach Basic is $4.99/month and Advanced is $9.99/month. Your first key starts a 14-day trial of everything, Basic and Advanced.
 
 The key is checked against Kavach when the daemon starts and periodically after
 that. Between those checks everything runs locally on your own machine — the
-model included — so ordinary offline work is unaffected.
+model included — so ordinary offline work is unaffected, and an install that
+cannot reach Kavach falls back to the free tier rather than stopping.
+
+## Free vs paid
+
+| | Free (no key) | Basic $4.99/mo | Advanced $9.99/mo |
+|---|---|---|---|
+| Local model chat | yes | yes | yes |
+| Knowledge base — local embeddings and search | yes | yes | yes |
+| Voice, transcribed on your machine | yes | yes | yes |
+| Chat with a cloud provider you connected (OpenAI, Anthropic, …) | no | yes | yes |
+| `auto` / `paid` routing to a cloud model | no | yes | yes |
+| Org mode and control-plane sync | no | yes | yes |
+| Shared knowledge across a team | no | no | yes |
+
+The boundary is enforced by the daemon, not by the UI: a Free install routes
+every turn to the model on your machine, and a request that names a cloud
+provider — or asks for the `paid` tier, which means the same thing — is
+refused with HTTP 402 and a `kavach_plan_required` code. The studio reads that
+code in its one central error parser, so the refusal is answered with a themed
+upgrade prompt carrying the daemon's own sentence and a link to buy a key,
+rather than by whatever generic error the page happened to have. The tier chip
+in the header reads the same daemon's answer. Nothing about the free tier needs
+a network connection to work.
+
+`KAVACH_ENFORCE_KEY=0` turns the enforcement off. That is for local
+development against a stubbed control plane, not for use.
 
 ## What runs where
 
@@ -51,10 +82,13 @@ so a stolen token grants access to nothing.
 The composer's toggle picks how a turn is served:
 
 - **local** — the bundled local model. No per-token cost and no network call
-  at inference time; the daemon still needs a valid key to start.
+  at inference time. This is what every tier of the free plan can reach.
 - **auto** — scores the task, then routes to the cheapest connected model that
-  can handle it. The default.
-- **paid** — always the strongest model you have connected.
+  can handle it. The default. On the free tier it can only reach the local
+  model.
+- **paid** — always the strongest model you have connected. Paid plan only:
+  without a key this is a request for a cloud model, and the daemon answers
+  402.
 
 `auto` explains itself: hover the model chip to see which model answered and
 why.
@@ -71,10 +105,16 @@ kavach install engine    the inference engine only, without a model
 kavach model list        show the models this machine can run
 kavach model use <id>    switch local models
 kavach doctor            check the install and report anything wrong
-kavach status            show entitlement and configuration
-kavach login             link this install to a Kavach account
+kavach status            show entitlement, tier and configuration
+kavach login             link this install to a Kavach account (optional)
 ```
 
+`kavach status` prints a `Tier` line: the tier the control plane issued
+(`free`, `basic`, `advanced`). It is the same tier the studio's header chip
+shows. Anything that is not currently entitled — no key, an expired trial, an
+entitlement the daemon could not confirm — reports `free`, because that is
+exactly what it gets.
+
 ## Local models
 
 `kavach install model` probes the machine and picks:
@@ -122,23 +162,28 @@ pay nothing for it.
 
 ## Trial and billing
 
-The trial is **7 days**, and the clock lives on Kavach's servers keyed to your
-installation — reinstalling or deleting `~/.kavach` does not restart it.
+The trial is **14 days** and unlocks everything, Basic and Advanced. It starts when you mint your first key — that is
+the moment you have decided you want something a key is needed for, so the
+clock starts there rather than when you created an account. The clock lives on
+Kavach's servers keyed to your installation: reinstalling or deleting
+`~/.kavach` does not restart it.
 
-When a trial or subscription lapses, Kavach becomes **read-only**:
+When a trial or subscription lapses, an **org deployment** becomes
+**read-only**:
 
 - everything you created is still there and still readable
 - writes are refused, and scheduled agents stop running
 - nothing is deleted, and billing keeps working so you can resume
 
-**Your data is never held hostage.** A lapsed subscription stops Kavach from
-starting, but nothing under `~/.kavach` is touched, altered or uploaded — your
-chats, documents and run history stay exactly where they are and become
-available again the moment the key is renewed.
+**Your data is never held hostage.** A laptop install is never locked: it falls
+back to the free tier, which keeps the local model, the knowledge base and
+dictation working, and org-mode writes are refused until billing is settled.
+Nothing under `~/.kavach` is touched, altered or uploaded — your chats,
+documents and run history stay exactly where they are.
 
-Note that this changed in 0.2.0. Up to 0.1.x an install with no key ran the
-local model indefinitely; from 0.2.0 a key is required to start. Installs
-already on 0.1.x are not affected until they upgrade.
+Note that this changed in 0.3.0. Up to 0.2.x an install with no key ran
+nothing: every route answered 402 until a key was entered. From 0.3.0 no key
+means the free tier, enforced at the daemon.
 
 ## Automations
 
@@ -162,6 +207,7 @@ bases, shared agents, and cron that actually fires.
 | `KAVACH_WHISPER_RELEASE_BASE` | Mirror for whisper.cpp engine downloads |
 | `KAVACH_BINARY` | Run a specific binary, e.g. one you built yourself |
 | `KAVACH_LOG` | Log filter, e.g. `kavach_client=debug` |
+| `KAVACH_ENFORCE_KEY` | `0` disables the free-tier boundary (development only) |
 
 ## Uninstalling
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "kavach-ai",
-  "version": "0.2.0",
-  "description": "Kavach \u2014 your agents, your data, your machine. Runs a local AI model and studio on your own hardware.",
+  "version": "0.3.0",
+  "description": "Kavach — your agents, your data, your machine. Runs a local AI model and studio on your own hardware.",
   "keywords": [
     "ai",
     "agents",
@@ -29,9 +29,7 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@kavach-ai/cli-darwin-arm64": "0.2.0",
-    "@kavach-ai/cli-darwin-x64": "0.2.0",
-    "@kavach-ai/cli-linux-x64": "0.2.0",
-    "@kavach-ai/cli-linux-arm64": "0.2.0"
+    "@kavach-ai/cli-linux-x64": "0.3.0",
+    "@kavach-ai/cli-linux-arm64": "0.3.0"
   }
 }

package/scripts/platform.js

@@ -33,17 +33,18 @@ const fs = require('fs');
  * Kept as a literal map rather than built by string concatenation so that
  * `require.resolve` sees a static name and bundlers do not have to guess.
  */
+// macOS is out of 0.3.0 (owner decision 2026-10-22): its binaries need a Mac
+// to build and none was available. Restore these two lines (and the TARGETS
+// and optionalDependencies entries) when a Mac build is part of the release.
+//   'darwin-arm64': '@kavach-ai/cli-darwin-arm64',
+//   'darwin-x64': '@kavach-ai/cli-darwin-x64',
 const PACKAGES = {
-  'darwin-arm64': '@kavach-ai/cli-darwin-arm64',
-  'darwin-x64': '@kavach-ai/cli-darwin-x64',
   'linux-x64': '@kavach-ai/cli-linux-x64',
   'linux-arm64': '@kavach-ai/cli-linux-arm64',
 };
 
 /** Rust target triples, used by the release build and the generator. */
 const TARGETS = {
-  'darwin-arm64': 'aarch64-apple-darwin',
-  'darwin-x64': 'x86_64-apple-darwin',
   'linux-x64': 'x86_64-unknown-linux-gnu',
   'linux-arm64': 'aarch64-unknown-linux-gnu',
 };