Lockkeeper 1.4.0

Library mode shrinks the skill list your agent carries into every session, and
Lockkeeper is now one command away in Claude Code, the MCP Registry and skills.sh.

New

• Library mode: lockkeeper library status|move|restore. Claude Code (and other
  agents) put every skill's name and description from their own skills folder into
  each session; library move --apply moves those skills to ~/.agents/library,
  which Lockkeeper indexes and routes but no agent loads, so only the skills a prompt
  needs reach the context. Plans first, --keep NAME for favorites, requires the
  routing hook for Claude Code, and library restore --apply undoes it. See
  configuration.
• Claude Code plugin: /plugin marketplace add Hannay001/lockkeeper, then
  /plugin install lockkeeper@lockkeeper, adds the routing hook, the MCP server and
  the router skill in one step (the lockkeeper command must be installed).
  library move accepts the plugin as routing, and hooks install warns when the
  plugin is enabled, since prompts would be routed twice.
• Listed in the official MCP Registry as io.github.Hannay001/lockkeeper; each
  release publishes there from the release workflow, with GitHub OIDC and no stored
  secret.
• npx skills add Hannay001/lockkeeper installs the router skill for any agent.

Lockkeeper 1.3.0

A fresh pip install lockkeeper now works out of the box, Lockkeeper moves to the
Functional Source License, and telemetry asks once instead of staying silent.

License

• Lockkeeper is now licensed under the Functional Source License, Version 1.1, ALv2
  Future License
  (FSL-1.1-ALv2). You can use, modify and share it for any purpose, including at work
  and on commercial projects, except offering it, or a product built from it, as a
  competing commercial product or service. Each release becomes Apache 2.0 two years
  after it ships. Releases up to and including 1.2.0 remain under the MIT license.

New

• Telemetry asks once. lockkeeper init and lockkeeper hooks install ask whether to
  share anonymous daily usage counts (Enter means yes), only in an interactive
  terminal, never in scripts or CI or when DO_NOT_TRACK is set, and never again once
  answered. It stays off until you say yes. See
  docs/TELEMETRY.md.
• The README, the one-prompt installer and the Windows notes install from PyPI:
  pipx install lockkeeper, lockkeeper init, lockkeeper rebuild.
• Releases run from Actions → publish → Run workflow: it uploads to PyPI, then
  creates the tag and GitHub release with the CHANGELOG notes, and it refuses a commit
  it couldn't tag before uploading anything. See
  docs/RELEASING.md.

Fixed

• A fresh pip install lockkeeper could not build its index: rebuild and route
  failed with "Required runtime snapshot is missing" until lockkeeper snapshot-runtimes was run (a git checkout hid it with seeded placeholders). They
  now capture the agent inventories themselves, or start from empty ones if the
  agents' CLIs fail. On 1.2.0, run lockkeeper snapshot-runtimes once first. CI now
  installs the built package into a brand-new home and routes a task.

Lockkeeper 1.2.0

The biggest release since the first one: Lockkeeper picks the right skill far more
often, routes every prompt automatically in Claude Code, works inside any MCP client,
and stays fast at tens of thousands of skills.

Highlights

• Much better skill choices. On the public SkillRouter benchmark (75 real agent
  tasks), a correct skill is ranked first 65.3% of the time among 26,000 skills (was
  34.7%) and 54.7% among 79,141 (was 25.3%), with no model. The set an agent receives
  now carries 52% of the skills a task needs (was 21%). See docs/BENCHMARK.md.
• Route every prompt automatically. lockkeeper hooks install claude adds a
  Claude Code hook that gives each prompt the installed skills that fit it, with the
  exact files to read.
• MCP server. lockkeeper mcp serves route, search and audit to Codex,
  Cursor, Windsurf, Cline and any other MCP client, with the index kept loaded.
• Fast at scale. Routing a long task over 79k skills went from 19.9 s to 2.5 s
  (26k: 6.5 s to 0.7 s).

New

• lockkeeper hooks install|show|remove claude [--scope user|project] [--firewall]:
  one-command setup for per-prompt routing and, optionally, the live firewall.
• lockkeeper route-hook: the UserPromptSubmit hook itself. It never blocks a prompt,
  skips slash commands and short replies, and never waits on a re-index.
• lockkeeper mcp [--runtime ...]: MCP stdio server (protocol 2025-06-18, 2025-03-26,
  2024-11-05).
• Bundle size setting: a route returns up to 10 capabilities by default. Choose 3 to 20
  per call (--max, or max in the MCP route tool), with LOCKKEEPER_BUNDLE_SIZE,
  or with bundle_size in a config file. Changing it never triggers a re-index. See
  configuration.
• lockkeeper telemetry on|off|status|show|flush: opt-in, anonymous daily usage
  counts. Off by default; DO_NOT_TRACK and CI always turn it off; no endpoint is
  configured yet. See docs/TELEMETRY.md.
• Body keywords: at rebuild, each skill, agent and command keeps its 24 most
  distinctive body words (tf-idf across your library), so routing matches what a
  skill covers, not only its one-line description.
• scripts/bench_routing.py: reproducible routing benchmark on SkillRouter Eval Core.
• scripts/bench_route_latency.py, run in CI with a latency budget.
• Optional decision-provider stage (Laya, hosted Jev, cross-encoders, any
  /v1/systemone server) with shadow mode and scripts/eval_decision.py.
• Resource corpora: a large reference collection routes as one capability and returns
  its best-matching entries.
• Docs: configuration, firewall,
  benchmark, telemetry,
  releasing.

Improved

• Rare, specific words weigh more than common ones (graded IDF), and breadth of match
  counts linearly, so generic skills no longer win long tasks.
• Prompts are read the way agents write them: dotted filenames (packets.pcap finds
  pcap), plural forms, sentence punctuation, and English function words.
• Bundles fill toward the bundle size with close matches (at least half the best
  match's score) instead of stopping at four. Needed skills delivered rose from 44.7%
  to 57.7% on 26k skills and from 41.7% to 52.1% on 79k.
• Ranking is indexed, so a query only touches the skills it can match.
• The registry notices installed, removed, moved or updated skills, agents, commands
  and plugins on every query and repairs itself, ignoring harness session noise.
• The README is rewritten for new users; detailed reference moved to docs/.

Fixed

• Long prompts are routed instead of rejected (the limit used to be 64 words).
• Different skills that share a name are no longer hidden behind each other.
• Words written with umlauts never matched a description.
• Decision providers could push their whole shortlist below skills they never saw, and
  low-probability providers were ignored as "flat".
• Firewall fail-open paths: unscanned script types, symlink escapes, hook JSON-escaping
  evasions, a hook crash on deeply nested JSON, LLM-pass verdict downgrades, and config
  typos that silently disabled the live hook.
• The README no longer trips Lockkeeper's own scanner.

Upgrade notes

• The registry format changed: existing registries rebuild themselves once, on the
  first query after upgrading.
• Re-indexing reads skill bodies, so it takes longer on very large libraries (79k
  skills: 42 s to 100 s). Typical libraries still take seconds.
• Routes return up to 10 capabilities by default (typically 4 to 8 before), and the
  Claude Code hook uses the same size (it used 6). An agent that reads every routed
  skill reads about twice as much skill text. For leaner bundles, set
  bundle_size = 6 or LOCKKEEPER_BUNDLE_SIZE=6.
• search --json results no longer include the internal keywords field.
• With a decision provider in rerank mode, the provider now only reorders its
  shortlist, using scores normalized across that shortlist.

v1.1.2 — Security and release-integrity patch

Fail-closed fixes at the audit and hook boundaries, plus two install-path defects found while verifying this release.

Security

• Symlink audit escape. A symlink or Windows junction used as the top-level recursive audit target is now rejected, so an audit (and the opt-in LLM scan) cannot escape into unrelated local files.
• Oversized hook payloads. Payloads beyond the scan limit are blocked instead of allowing an uninspected tail.
• High-risk hook traffic. Any payload with a high or critical finding is blocked. Medium-only suspect content stays warning-only to control false positives.
• Receipt verification. Verification short-circuits before any scan work, so it never scans or transmits the current directory.
• Malformed manifests. A broken package.json no longer crashes --check-deps.

Install and proof

Both of these were found by running the documented install paths end to end, not by code review:

• pip install was broken. snapshot-runtimes listed codex-tools.json as a written artifact but only wrote it when it already existed. A git clone masked this because data/snapshots ships a seed copy, so every pip-based install left rebuild, route, and bundle failing with "Required runtime snapshot is missing".
• The proof table could not be regenerated. bench_context_savings.py crashed with a KeyError on any index that did not match all six benchmark tasks. It had no test coverage; it does now.

Also

• Package metadata corrected to 1.1.2 with modern SPDX/setuptools fields.
• README proof regenerated from a single verified run against a 58,018-capability index. Two per-task figures had drifted.

Verified on Linux, macOS, and Windows across Python 3.11-3.14.

Full changelog: v1.1.1...v1.1.2

v1.1.1 — Hardening: packaging, security fixes, quality fixes

lockkeeper v1.1.1 — hardening release

Follow-up to v1.1.0 closing two loose ends and applying fixes from a deep security + quality audit.

Packaging

• pyproject.toml wheel packaging with console entry points: lockkeeper, lockkeeper-audit, lockkeeper-hook
• New package-smoke CI job: builds sdist+wheel, installs into a scratch venv, and functionally smokes the installed CLI (entry points + firewall blocking a hostile fixture) on ubuntu and windows

Security (external deep audit)

• Fixed detection bypass: lines over 4096 chars were skipped entirely by line-based rules; they are now scanned in overlapping windows
• New rules: secret env-var interpolation into network commands (env_interpolation_exfil, case-insensitive), network commands touching credential stores (credential_upload_exfil)
• Suppression markers now floor verdicts at suspect — a file that suppressed findings can never audit clean; stacked invisible-unicode + homoglyph findings also floor at suspect
• Hook mode caps stdin at 8 MB with truncation notice instead of unbounded read
• LLM tier: https-only endpoints, credential-shaped text redacted before egress, capped re-read
• Receipt keys created with O_CREAT|O_EXCL|O_NOFOLLOW + fchmod 0600; atomic writes clamp inherited modes to ≤0644
• RecursionError-safe parsing of untrusted JSON (snapshots, plugin manifests, receipts, package.json)

Quality

• Fixed P0: load_registry validated every record against the hardcoded "skill" type, rejecting all agent/command/entrypoint sources and breaking search/route/bundle/check on mixed registries
• Fixed P0: umlauts are now folded before query tokenization, so German queries route correctly

Privacy

• Independent privacy audit: working tree and full git history verified clean (anonymized commit metadata, empty snapshot templates, OCR'd demo assets)

Full changelog: v1.1.0...v1.1.1

v1.1.0 — Audit firewall + native Windows

lockkeeper v1.1.0

npm for your agent's context — with a built-in prompt-injection firewall.

Audit firewall (lockkeeper audit)

• Static, stdlib-only analysis of any skill/plugin/MCP definition: instruction override, exfiltration (network calls touching secrets/env/ssh), obfuscation (base64/eval/homoglyphs/zero-width), destructive commands, hidden directives
• Severity-weighted verdicts: clean / suspect (warn) / hostile (block); JSON + human output; --strict non-zero exit for CI gates
• T01–T09 taxonomy mapping (SkillTrustBench-comparable findings)
• Binary/.pyc payloads hashed and floored to suspect
• lockkeeper hook: Claude Code / Codex PreToolUse-style hook scanning live tool payloads
• Optional LLM deep-scan tier (--llm-scan, OpenAI-compatible provider via env; off by default)
• Dependency CVE gate against osv.dev (--check-deps, keyless, cached)
• Signed audit receipts (--receipt-out / --verify-receipt) for CI evidence
• Reranking study: body-aware second-stage ranking evaluated and rejected at personal-registry scale

Native Windows

• Full test matrix on windows-latest across Python 3.11–3.14
• Runtime symlink-capability probing: unprivileged environments skip cleanly instead of erroring
• Platform fixes found by the new Windows leg: forward-slash path markers in runtime detection, extended-length (\\?\) prefix stripping and case-insensitive symlink verification, USERPROFILE-aware config resolution
• Actionable error when symlink creation fails on Windows, pointing at the new docs/windows.md (Developer Mode requirement; junction fallback rejected — directory-only targets and is_symlink() semantics break verification gates)

Housekeeping

• Rebrand to lockkeeper (alias capability-registry retained)
• Seed snapshot bootstrap gated behind extensions.seed_snapshots; runtime snapshots write to a machine-local state dir
• Security hardening pass closing external-audit findings in the audit firewall and registry

Full changelog: v1.0.0...v1.1.0

cap v1.0.0

First public release.

cap is a cross-runtime capability router for coding agents with a built-in prompt-injection firewall: one local index over Claude Code, Codex, Cursor, OpenCode, Hermes and Jcode; tasks route to a bounded, lane-diverse capability bundle instead of loading everything at once.

Highlights:

• Zero dependencies — pure Python 3.11+ standard library
• cap audit firewall: exfiltration, obfuscated execution, credential access, hidden directives, invisible Unicode — with SkillTrustBench T01–T09 taxonomy tags
• cap hook: PreToolUse-style runtime filter that blocks hostile tool calls live
• Binary-payload floor: shipped .pyc/.so never audits clean
• Declarative per-project policy packs; harness auto-binding via cap init / cap doctor
• Windows-portable locking, ReDoS-guarded scanning, strict CI exit codes