v0.4.4

What's Changed

• docs(readme): show the demo as a GIF above the fold by @slewinus in #136
• feat(cli): restore backups made with --recipient (closes #59) by @slewinus in #137
• feat(dev): sign local builds so macOS stops asking for the password by @slewinus in #138
• fix(ci): ship the mcp feature, and add klef mcp install by @slewinus in #139
• chore(release): klef 0.4.4 by @slewinus in #140

Full Changelog: v0.4.3...v0.4.4

v0.4.3

What's Changed

• docs: fix the install instructions and drop the Touch ID claim by @slewinus in #131
• fix(cli): don't pass KLEF_PASSPHRASE to spawned children by @slewinus in #130
• perf(core): cache the decrypted age vault between calls by @slewinus in #132
• docs(changelog): add the missing [0.4.2] section by @slewinus in #133
• chore(release): klef 0.4.3 / klef-core 0.3.2 by @slewinus in #134

Full Changelog: v0.4.2...v0.4.3

v0.4.2 — bug-fix patch

Bug-fix patch on v0.4.1. Three fixes from the backlog audit, plus README translated to English.

Fixes

• #127 fix(cli): preserve env_var on klef edit <name> without --as (closes #71). Editing a key's value no longer silently clobbers a custom env_var set at add time — protects secret-rotation flows.
• #128 fix(cli): exit cleanly on BrokenPipe instead of panicking (closes #73). klef list | head, klef tags | grep -q ..., and any piped command now behave like standard Unix tools (clean exit, no Rust panic on stderr). New outln!/out! macros centralize the handling — no unsafe, workspace stays unsafe_code = "forbid".
• #129 fix(core): hold the exclusive restore lock across both phases (closes #72). New Store::restore(&[BundleEntry]) acquires the lock once; legacy 2-phase API marked #[deprecated] (non-breaking).

Docs

• #126 docs(readme): full English translation of the README.

Versions

• klef 0.4.1 → 0.4.2
• klef-core 0.3.0 → 0.3.1
• klef-gui unchanged (0.2.1) — picks up klef-core 0.3.1 via path dep.

Compatibility

No breaking changes. klef-core public surface preserved (old 2-phase restore API still works, just deprecated).

Tests

265/265 passing across klef and klef-core (24 suites, including 8 new regression tests across the three fixes).

Thanks to @LEKALIF for the three PRs.

v0.4.1

Full Changelog: v0.4.0...v0.4.1

v0.4.0

The big distribution release. klef now ships as a single Homebrew install bundling the CLI and the macOS menu bar GUI, plus an MCP server for Claude Desktop / Claude Code.

Install

brew install slewinus/tap/klef && xattr -dr com.apple.quarantine /Applications/klef.app

That's the whole onboarding. CLI lands on $PATH, GUI in /Applications/klef.app (icon in the menu bar). Linux users: cargo install klef --features mcp.

Headline features

klef mcp — let AI agents use your keys without seeing them

A Model Context Protocol server that exposes two tools:

• klef_list — names + metadata, never values.
• klef_run — spawns a process with klef: refs injected as env vars; the agent sees the program's stdout/stderr (with best-effort redaction) but never the secret value.

Authorization is policy-driven via ~/Library/Application Support/klef/mcp-policy.toml (or ~/.config/klef/... on Linux). NDJSON audit log with pre-spawn fail-closed gate. Hard shell denylist on argv[0]. Process-group kill on timeout.

Configure Claude Desktop / Claude Code:

claude mcp add klef klef mcp        # Claude Code
# Or for Claude Desktop, add to ~/Library/Application Support/Claude/claude_desktop_config.json:
# { "mcpServers": { "klef": { "command": "klef", "args": ["mcp"] } } }

See docs/mcp.md for the full setup + threat model. Closes #24.

klef keychain configure — stop the macOS password re-prompts

If you've been getting "type your login password" prompts every 10–30 minutes, this disables the macOS keychain auto-lock timeout (one-shot, idempotent, with the exact revert command printed). klef detects the issue automatically and prints a one-time banner pointing you at the command.

klef keychain configure
# macOS keychain configured: no timeout, no lock-on-sleep.
# To revert, run:
#     security set-keychain-settings -u -t 600 -l /Users/you/Library/Keychains/login.keychain-db

See docs/macos-keychain.md. Opt-out via KLEF_NO_KEYCHAIN_AUTOCONFIG=1.

GUI improvements

• Single Homebrew install: cask klef includes both .app and CLI binary.
• New monochrome shield icon, designed to read at every size (menu bar tray, Dock, DMG installer).
• .env import file picker button (drag-drop also still works from Finder).
• Quit button in the popover header.
• Drag-drop no longer auto-hides the popover when dragging from another app.

Caveats

The macOS DMG is not yet code-signed with an Apple Developer ID — Gatekeeper will quarantine the .app on first launch. The install command above runs xattr -dr com.apple.quarantine to clear it. Proper signing + auto-update is tracked in #123.

Apple Silicon only for the GUI in this release. Intel macOS support is bundled into #123 (CI build matrix).

Distribution channels

Channel	Command	Includes
Homebrew (macOS)	brew install slewinus/tap/klef	CLI + GUI
Cargo (any)	cargo install klef --features mcp	CLI
Direct download	Releases page	DMG + tarballs

Crates published: klef 0.4.0 + klef-core 0.2.0.

Full changelog

See CHANGELOG.md and the auto-generated PR list below.

---

Auto-generated PR list:

• fix(envfile): export prefix + inline comments (#50, #51) — #56
• feat: encrypted file backend via age (#12) — #57
• fix(age-backend): metadata stored inside encrypted vault — #64
• fix: status backend, trim_end, drop stale Linux hint — #65
• fix: atomic add/rename + reverse desync detection — #67
• fix: inter-process locking on vault and index — #68
• docs: GUI app design — #66
• refactor: cargo workspace split — #70
• feat(core): DTOs for GUI/MCP API surface — #76
• feat(gui): Tauri scaffold + Svelte 5 + menu-bar tray (S2.2a/b/c) — #77 #78 #80
• feat(gui): search bar — #82
• feat(gui): MVP v0.1.0 — full CRUD + hotkey — #99
• fix(gui): modal positioning — #100
• feat(gui): open at login + Keychain access help — #121
• feat(gui): drag-drop .env import — #119
• feat(gui): UI redesign — Raycast-inspired light theme — #122
• feat(mcp): full MCP server in 14 commits — closes #24
• feat(keychain): klef keychain configure + auto-detect banner

Full diff: v0.3.0...v0.4.0

v0.3.0

What's Changed

• Feat/discover by @slewinus in #35
• feat(discover): --skip-pattern + --skip-defaults by @slewinus in #42
• feat(completions): bash and fish dynamic name completion by @slewinus in #43
• docs(readme): hero + comparison table + crates.io install by @slewinus in #45
• feat(edit): --note-edit opens $EDITOR for the note (closes #14) by @LEKALIF in #44
• feat: encrypted backup + restore via age (#22) by @slewinus in #46
• docs: embed asciinema demo (#41) by @slewinus in #52
• fix(store): propagate non-NotFound backend errors from remove by @slewinus in #53
• feat: tags for organizing keys (#36) by @slewinus in #54
• chore(release): bump to v0.3.0 by @slewinus in #55

New Contributors

• @LEKALIF made their first contribution in #44

Full Changelog: v0.2.0...v0.3.0

v0.2.0

What's Changed

• feat(v0.2-batch-1): klef status + import + add hint, remove alias by @slewinus in #27
• feat(v0.2-batch-2): Linux hints, list --verbose/--filter, --value-from-file, set-note by @slewinus in #29
• chore: v0.2 polish — docs refresh + zsh dynamic completion by @slewinus in #30
• feat(distribution): release workflow + Homebrew formula scaffolding by @slewinus in #31
• chore(release): bump to v0.2.0 by @slewinus in #32
• docs: AI-readable documentation (llms.txt + llms-full.txt + LLM usage guide) by @slewinus in #34

Full Changelog: v0.1.0...v0.2.0

klef v0.1.0 — MVP

First public release. Local-first CLI vault for API keys.

✨ Highlights

• 10 commands : add, get, show, list, rm, edit, rename, export, run, completions
• Keychain natif macOS + Linux Secret Service (via keyring crate)
• Killer feature : klef run --env-file .env -- <cmd> résout les klef:<name> dans le .env et execvp la commande — secrets jamais en clair sur disque, signaux propagés naturellement
• 43 tests passent sur macOS + Ubuntu via GitHub Actions
• Local-first : zéro serveur, zéro cloud, zéro télémétrie

📦 Install

cargo install --git https://github.com/slewinus/klef --tag v0.1.0

Homebrew formula et binaires pré-compilés en cours pour la v0.2 (#10, #11).

📚 Documentation

• README
• Design spec
• Quickstart
• Full CHANGELOG

🗺️ Roadmap

• v0.2 : klef import .env, klef status, Homebrew, binaires pré-compilés, meilleurs messages d'erreur Linux (milestone)
• v0.3+ : backend chiffré age headless/CI, sync iCloud Keychain, GUI native (milestone)

🤖 Released with Claude Code