Semlith Files

Every agent client on the machine, from every project

• semlith setup registers semlith in every client that documents a registration command, at the scope that client spells "every project", rather than registering Claude Code alone and printing the other twenty-six as stanzas to paste. --yes registers too, where it used to skip the step.
• Every registration is the stdio form: the client launches semlith mcp, which reads the agent key from ~/.semlith/agent.key itself. No configuration file semlith writes carries the key or names ${SEMLITH_AGENT_KEY}, and a rotation reconfigures nothing.
• An existing semlith entry is removed before the new one is added, at every scope the client has — including the project-scope entry in ~/.claude.json that made semlith invisible from every directory but one.
• semlith setup --register-all, and a control on the portal's Agents page, write the configuration file of the ten clients that have no registration command. Every path is listed before anything is written, each file is backed up beside itself, each merge keeps every key it did not come to change, and a file that does not parse is refused rather than replaced.
• docs/clients.md carries the registration facts in its fence info strings, so the document a human reads and the one src/clients.rs parses are one file.
• The shell startup block semlith setup writes carries PATH and nothing else. It used to export SEMLITH_AGENT_KEY by reading the key file at every shell start, which made sense while every client stanza named that variable; none does now, so the export put a credential into the environment of every process you start in exchange for nothing. A block written by an earlier version is replaced — semlith setup used to leave any block it found alone, so an upgrade kept the export for ever.

semlith doctor

• New command, with --json and --fix. Per client: installed, registered, at what scope, and what to run otherwise. Plus the four Privacy rules that are readings of this machine. Exits non-zero when something is wrong.
• A portal view of the same report, from the same route.

The Privacy page can fix what it reports

• Every failing rule carries the command that repairs it, copyable.
• directory modes, agent key, and model cache when the cache is your own carry a button as well. A repair narrows access, is idempotent, touches only a path semlith owns, and is confirmed by re-running the rule's own check; it reports 0700, was 0755 so it can be undone by hand.
• private addresses gets the manual step and no button. It fails on a variable in the environment the daemon inherited, and no process can unset a variable in its parent's.
• Fixed: the agent key check rendered the same sentence whether the mode was compliant or not, so a key at 0644 read exactly like one at 0600.

Fixed

• One corpus indexed twice now produces one index, and the retrieval harness reproduces its own numbers (#88). Three runs of one binary over one corpus gave three different hit@k, the graph-only denominator moved, and bytes per answer tracked where the corpus was checked out. Four causes, all measured: the graph walk read its frontier out of a randomly-seeded HashMap; the file walk took whatever order the filesystem gave it, so chunk ids moved; the fusion and rerank sorts left exact ties where they found them; and the index checkpoint was timed rather than counted, so it split an embedding batch at a different point on every run — and the embedder pads a batch to its longest sequence, which changes the last bits of every vector in it. The maps are ordered, the walk is sorted, both sorts are total, and the checkpoint interval counts files.
• SEMLITH_CHECKPOINT_SECS is now SEMLITH_CHECKPOINT_FILES. It was never part of the documented environment — it exists so a test need not wait thirty seconds — and it is what made an index run depend on the clock.

Install

macOS and Linux

:::sh
curl -fsSL https://raw.githubusercontent.com/semlith/semlith/main/install.sh | sh

Windows

:::powershell
irm https://raw.githubusercontent.com/semlith/semlith/main/install.ps1 | iex

Or download the archive for your platform below, unpack it, and put semlith on your PATH. Intel macOS has no prebuilt binary: ONNX Runtime no longer publishes x86_64 macOS builds.

Verify a download against SHA256SUMS before running it.