Codeep

v2.8.0 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 1mo AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai ai-agent ai-agents ai-tools cli-app

Affected surfaces

auth

ReleasePort's take

Light signal

editorial:auto 1mo

Codeep v2.8.0 changes API key handling: keys remain local unless users explicitly enable syncing with the new /keysync command.

Why it matters: API keys no longer transfer automatically; admins must run `/keysync on` to opt‑in, affecting any scripts using `codeep account push` or `account sync`.

Summary

AI summary

API keys now stay local by default; syncing them to codeep.dev requires explicit opt‑in via /keysync.

Changes in this release

Type	Severity	Summary	CVE
Security	High	API keys now default to local storage only; syncing requires explicit opt‑in API keys now default to local storage only; syncing requires explicit opt‑in Source: granite4.1:30b@2026-06-09-audit Confidence: low	—
Breaking	High	`codeep account push` and `account sync` no longer transfer API keys unless `/keysync on` is enabled `codeep account push` and `account sync` no longer transfer API keys unless `/keysync on` is enabled Source: llm_adapter@2026-06-09 Confidence: high	—
Feature	Medium	/keysync command added to opt‑in/out of API key syncing (off by default) /keysync command added to opt‑in/out of API key syncing (off by default) Source: llm_adapter@2026-06-09 Confidence: high	—
Feature	Medium	`codeep account purge-keys` added to delete all server‑stored API keys `codeep account purge-keys` added to delete all server‑stored API keys Source: llm_adapter@2026-06-09 Confidence: high	—

Full changelog

API keys are now keychain-first and stay local by default — syncing them to codeep.dev is an explicit opt-in (/keysync on), and codeep account purge-keys wipes any keys already on the server.

Added

/keysync on|off|status — opt in (or out) of syncing API keys to
codeep.dev. OFF by default: your keys live only in the OS keychain unless
you enable this. When on, codeep account push/sync upload/download keys;
the command warns that synced keys are stored server-readable. Also available
in /settings, and forced off by the CODEEP_NO_KEY_SYNC env var (org policy).
codeep account purge-keys — delete every API key stored on codeep.dev in
one shot (cloud-only; your local OS keychain is untouched). A clean exit if you
synced keys before and want them off the server.

Changed

codeep account push / account sync no longer move API keys unless cloud
key sync is enabled (/keysync on). They still push/pull personalities,
custom commands, and your profile as before — only the secret half is gated.
Existing users who relied on key sync just run /keysync on once.

Breaking Changes

API key handling changed to local‑only by default; remote syncing requires explicit /keysync on command (previously keys synced automatically).

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Codeep

Get notified when new releases ship.

About Codeep

All releases →

Related context

Related tools

Earlier breaking changes

v2.4.1 MiniMax M3 replaces MiniMax-M2.7 as default model across all providers.
v2.0.0 McpServer protocol now optional fields `command`, `args`, plus new `url` and `headers`; version bumped to 2.0.0.