Release v0.2.0 · bespinian/keera-gateway

v0.2.0

Claude subscriptions. People on a Claude Team or Enterprise plan can use
Claude Code through Keera, and their plan pays. Keera still applies
guardrails, records usage and shows how much of the plan each person uses.
The person's Claude sign-in goes to Anthropic unchanged and is never stored.
See docs/subscriptions.md.
Everything belongs to an organisation. Models, MCP servers, sandbox
classes and guardrails are now per organisation. Nothing is shared between
tenants. The catalogue files are now templates that each new organisation
starts with.
Model catalog. Models → Model catalog lists every model the providers
offer, with context window, list prices, release date and where it is
served. You can search, filter and sort it, and add a model from it in one
click.
Phoeniqs is a new provider, served from Switzerland.

Every message is now sent with one of your own active keys, so it follows
that key's guardrails, rate limits and budgets, and shows in its usage.
Attach images.
Show the model's reasoning.

Sandboxes get a repository token only for repositories in the guardrail's
allowed_repos. This is checked again on every token refresh.
Each identity provider can only sign in people from its own email domains
(KEERA_OIDC_<N>_DOMAINS).
The user endpoint no longer changes the role of a person who already exists.
Use keera user role for that.
The gateway won't start if KEERA_SECRET_KEY or KEERA_METRICS_TOKEN is
shorter than 16 characters.
Releases reach SLSA level 3. Verify them with
gh attestation verify ... --signer-workflow bespinian/keera-gateway/.github/workflows/release-build.yml.
Added SECURITY.md.

Purging old usage keeps the spend windows that are still open, so budgets
stay correct.
A Redis rate-limit bucket's clock never moves backwards.
The release pipeline was missing a permission.

Single sign-on: the unprefixed KEERA_OIDC_* settings are gone. List
providers in KEERA_OIDC_PROVIDERS and configure each one with
KEERA_OIDC_<N>_*. SSO now requires KEERA_PUBLIC_URL. If you have more
than one provider, each one needs KEERA_OIDC_<N>_DOMAINS.
KEERA_OIDC_REDIRECT_URL and KEERA_OIDC_ADOPT_BY_EMAIL were removed.
KEERA_SECRET_KEY is required.
KEERA_MODELS_FILE and KEERA_SANDBOXES_FILE only seed new
organisations. To change an existing one, use
keera model apply <file> --org <id> or keera s>.
Sandboxes: KEERA_SANDBOX_MODEL was removed. A sandbox's agent now uses
the first chat model its key may use. The `KEERA_
were removed, so the Kubernetes driver must run inside the cluster where it
creates sandboxes.
Compose: compose.cpu.yaml is gone, and llama.cpp is now the default in
compose.yaml. Run podman compose up -d, and a
GPU host.
A size, duration or on/off setting that can't be
default. An invalid Redis URL, sandbox driver, forge or default role stops
the gateway from starting.