Skip to content

Changelog

Notable changes, newest first. The format follows Keep a Changelog, and versions follow semantic versioning over the command line and the settings: a removed or renamed setting or command is a major bump, or a minor one while the version starts with 0.

Unreleased

0.2.0 - 2026-11-09

Keryx installs with one line and no clone, and every command starts with keryx. An installed service needs nothing done: the new commands write the same units the scripts did.

Added

  • A one-line install: curl -fsSL https://raw.githubusercontent.com/wak31415/keryx/main/install.sh | sh. It installs the keryx command with both coding agents and starts keryx setup. It needs no Python, uv or clone: it brings its own. Keryx is published on PyPI as keryx-voice, so a tool of your own can have Keryx in its editor with pip install keryx-voice.
  • keryx service install installs and starts the background service with its tunnel (systemd on Linux, launchd on macOS), and keryx service uninstall removes them. The last section of keryx setup runs it.
  • keryx upgrade updates an installed Keryx and restarts the service onto the new version. It checks that the new version starts before it restarts anything. You can also ask for an upgrade on a call: Keryx installs it while you talk, restarts once the call ends, and rings you back to say which version it is on. If nothing newer exists, it tells you at once.
  • keryx approvals --install-hook installs the approval bridge's hook into Claude Code, and --uninstall-hook takes it out.

Removed

  • scripts/install-systemd.sh, scripts/install-launchd.sh, scripts/install-claude-hook.sh and scripts/lib.sh, replaced by the commands above. scripts/dev.sh stays, for working on Keryx from a clone.
  • keryx migrate, keryx config import-env and keryx plugins install --from-settings, which moved settings from before 0.1.0, and the refusal to start beside a .env in the working directory.
  • FAKE_AGENTS, the old name of DEMO_MODE, and the hidden serve options --fake-agents and --no-wakeword.

0.1.2 - 2026-11-04

Fixes to how results reach you, finished tasks' reports on Slack, and updated dependencies. Nothing to change on your side: no setting or command was renamed or removed.

Security

  • certifi 2026.10.18 drops the emSign root certificates whose intermediate CA keys were compromised (GHSA-6q48-6c7w-9gw2, critical). It is the certificate bundle that the HTTP libraries under the OpenAI and Twilio clients trust by default.

Changed

  • A finished task's whole report is posted to your Slack DM. While the send_to_slack plugin is on, each report is posted under a line naming the task, with its headings, tables and links rendered and no link previews. The request and the spoken summary are left out, and a long report is no longer split mid-list. On a call, questions about a finished task are answered from its report instead of starting new work. Messages sent with send_to_slack render Markdown the same way.
  • Dependencies are updated. The Codex agent runs on openai-codex 0.163.0 and its bundled codex CLI. Twilio 9.12.0, websockets 17.2 and numpy 2.5.4 are updated too.

Fixed

  • No call-back on top of the call you are already on. If a task you asked to be called back about finished while you had rung Keryx again, your phone rang mid-call with the same result. The call-back now waits for that call to end. It does not ring at all if you gave the PIN on that call after hearing the result, or if the result was marked as heard.
  • A result read out mid-call is recorded as heard. It used to come back at the top of the next call. The announcement replaced the assistant's instructions for that turn, including the one that says to record it; it no longer does, and it now asks for the record in the same turn.
  • A result you heard before giving the PIN is not told to you again after it. Once the PIN is in, it is recorded as heard instead of being repeated.
  • Asking about your email no longer misses the thread you meant because of one broad word. A search with alternatives now looks for each one separately, so newer mail matching a common word cannot push out the thread you asked about, and the summary sees more threads. When nothing matches, the assistant says what it searched for, so you can correct a misheard name or word.
  • The assistant asks when part of a request comes through garbled. If a phrase transcribes as nonsense, it asks one short question about that part instead of acting on it.
  • The restart watchdog starts on its own instead of through the whole app. A code change that breaks the import no longer silences the alert that Keryx never came back.
  • The installers work from a path with a space or a % in it. The systemd units quote the checkout and the uv and cloudflared paths, and the launchd plists escape every value, so a checkout such as ~/My Projects/keryx no longer leaves a unit that will not start.

0.1.1 - 2026-10-19

Fixes from an audit of 0.1.0, and updated dependencies. Nothing to change on your side: no setting or command was renamed or removed.

Security

  • Dependencies with published advisories are updated. aiohttp 3.14.4, multidict 6.9.1, mcp 1.30.0, PyJWT 2.15.0 and urllib3 2.8.0 each fix one or more advisories. Keryx does not import any of them; they come in through Twilio and the Claude Agent SDK.

  • Typing your PIN on an approval call can no longer approve anything. When Keryx called about a Claude Code prompt, a digit of your PIN typed after the keypad menu opened went to the menu, so the PIN's first "1" could approve the request. Digits now reach the menu only when no PIN entry is in progress, and the call no longer asks for the PIN first.

  • A line break in speech can no longer mark a call as authorized. Transcript lines are written on one line, so nobody can make the assistant say the marker that recall reads.
  • Hook-framework files are no longer approvable by phone. A write to .pre-commit-config.yaml, .husky/ or any lefthook configuration is refused, as .git already was: the git commit a keypad may approve next would run what is in them.
  • The service can no longer re-enable approval calls or delete transcripts. keryx approvals --enable and keryx forget now refuse when a subagent runs them. Anyone can still switch approvals off.
  • A PIN said in pairs is now redacted from transcripts. "Forty-two forty-two forty-two" is replaced with [PIN] like single digits are. The transcript is also redacted again before the memory update reads it, which covers the lines spoken before a first PIN was set.

Changed

  • The coding agents' SDKs are updated. The Codex agent runs on openai-codex 0.158.0 and its bundled codex CLI, and the Claude agent on claude-agent-sdk 0.2.160 and its bundled Claude Code CLI.

Fixed

  • A follow-up's result is read out again. A task re-run by send_followup is now owed a call-back and a place in the next call's digest, instead of keeping the old "told" stamp. Only a finished task can be marked as told.
  • A restart that waits too long now fails visibly. It used to give up after 40 minutes and clear its record, so keryx restart --status read as if nothing had happened and the call-back never came. It now records the failure and tells you.
  • A crash no longer leaves a task "running" for ever. At startup, Keryx marks any task that was still running when it stopped as failed ("Keryx stopped while this was running"), so it stops blocking restarts and follow-ups. You hear about it in your next call.
  • A database upgrade that is interrupted no longer stops Keryx from starting. The tasks.db upgrade now runs in one transaction.
  • Two memory updates no longer overwrite each other. When two calls end close together, the second update now waits for the first, so neither call drops out of the memory.
  • Anthropic spend for a workspace now counts only that workspace. check_billing used to read the whole organization's spend and report it as the workspace's, against the workspace's budget.
  • The service can no longer lift a limit by setting it very high. A limit it may tune, such as SUBAGENT_TIMEOUT_S, is now refused above ten times its default. You can still set any value yourself.

0.1.0 - 2026-09-30

The first public release. You call a phone number and talk to your voice assistant, Lyra by default. Keryx is the service behind it: it hands the work you ask for to a coding agent on your machine, keeps that work running after you hang up, remembers what happened between calls, and calls you when there's news.

Added

  • A voice assistant you can call. A Twilio number puts you through to an assistant that runs on the OpenAI Realtime API. It's called Lyra unless you choose another name, and Jarvis is a second built-in persona with its own voice. It answers small questions itself, with a web search when it needs one.
  • Tasks that keep running after you hang up. Anything larger becomes a task for Claude Code or Codex, in the project you name. In a later call, you can ask how a task is going, add instructions, or cancel it. If both agents are set up, you can say which one to use.
  • Call-backs. When a task finishes, or needs a decision from you, Keryx calls you and the assistant tells you the result. If your Twilio account can send SMS, you can turn on texts with a link to the written report. Texting is off by default.
  • Continuity between calls. Each call starts with the results you haven't heard yet and what the assistant remembers about you. Keryx updates that memory after every call in which you gave the PIN. With the PIN, you can also ask about anything said in an earlier call. Your first call is a short introduction, so the assistant can learn what you work on and how you like to be answered.
  • Security for a phone line. Keryx answers only your own numbers. A PIN of six to eight digits guards everything that acts on your behalf, and wrong guesses count across calls toward a lockout. You can set the PIN on the keypad during your first call. A call that Keryx places to your own phone can answer the question it's calling about without the PIN. SECURITY.md has the threat model.
  • The approval bridge. If a Claude Code session on your screen stops to ask for permission and you don't answer within five minutes, Keryx calls you, and you answer on the keypad. Only routine, reversible commands can be approved by phone.
  • Keryx can grow during a call. Ask for a new voice command, and a coding agent writes it as a tool of your own, ready on the next call without a restart. A change to Keryx itself ends with a restart and a call to confirm that the new code is running. If it doesn't start, a watchdog calls you with a plain alert.
  • Plugins. Slack, email, billing, and Slurm cluster status are optional voice tools that you turn on in keryx setup or with keryx plugins install.
  • Bug reports and feature requests by voice. If you turn it on, "that's a bug, report it" files a GitHub issue on Keryx's repository with nothing personal in it. It's off by default, and only you can turn it on.
  • Setup and upkeep from the command line. keryx setup is a wizard that asks only for what's still missing, and keryx doctor checks the whole setup. keryx config, keryx auth, and keryx tasks cover settings, sign-ins, and what each task did and cost. keryx forget and two retention settings delete old transcripts and tasks.
  • A demo mode. keryx serve --demo lets you try the phone before a coding agent is set up. Every task comes back with a sample answer, and no agent tokens are spent.
  • Linux and macOS. Keryx runs as a systemd or launchd service, keeps its files in the standard XDG directories, and stores secrets in files only you can read.