The agent
that stays.

One service per identity

Each resident is its own gateway process under systemd, launchd or Task Scheduler. The OS restarts it; closing a terminal does not end the agent. Registered with one command, kurahi service.

One state root

Everything an identity owns lives under KOLO_HOME. kurahi init is the single first-run command: identity, bind policy, provider profile, doctor report. Japanese messages with --lang ja.

Scoped pairing

One-shot invitations with a scope — observe, attach, admin, owner — enforced on the server. Devices prove an Ed25519 key, receive a short-lived access token and a rotating refresh token; reuse of a retired token revokes the family. Dated re-consent.

Audit chain and integrity gate

Every authentication, pairing, attach, admin action and tool execution is appended to a hash-chained log; kurahi audit verify recomputes it. Protected policy files are digested at boot; in enforce mode a mismatch refuses to start.

A described API

OpenAPI 3.1 at /doc, generated from the router: 65 HTTP operations and 104 WebSocket methods, each with its auth kind and minimum scope. The @kodasoken/kurahi-client package is generated from it and CI fails on drift. kurahi api reaches anything the gateway can do.

Sessions with several clients

Any attach-scoped credential can list live sessions and attach a terminal, a script or a messaging pipe. All attached clients receive the same event stream. LINE and WhatsApp pipes are session clients, not separate bots.

Code Mode and MCP

The agent writes one script that calls many tools in a sandboxed worker — one round trip, with wall-clock, heap and tool-call limits. MCP servers over stdio or HTTP appear as tools under the same policy and audit.

Agent controls and jobs

Per-run step limits, a doom-loop detector for identical or no-progress calls, permission globs over paths and commands. Every run is a job: list, inspect, cancel, with completion notices; cancels are audited.

Plugins with a lifecycle

In-process plugins with a manifest and schema, hot reload without a gateway restart, a dispose step, quarantine on failure. Six bundled ops plugins: health watchdog, log rotation, memory boot inject, circadian, self-check, proactive triggers.

Bundles, update, support

Prebuilt bundles for Linux, macOS and Windows with a pinned runtime — no Node.js install. SHA-256 sums, a CycloneDX SBOM and SLSA provenance on each release; kurahi update refuses a mismatched checksum. kurahi support writes a redacted diagnostics bundle.

Secrets and providers

An encrypted secrets store (OS keyring or encrypted file); nothing on argv, nothing in logs. Provider-agnostic: a Japan-hosted default profile (Sakura AI Engine), any OpenAI-compatible endpoint with your own key, or a local model server. A registry of 209 providers, 17 curated and 192 generated from a public catalogue; kurahi providers test makes one request and reports latency.

Proven continuity

A conformance suite shows that a resident is the same resident after a model swap, a gateway restart, a state-directory move and a session close. Ten invariants, C0 to C9, over signed hash-chained manifests: identity files, memory recall, role and permissions, unfinished work, audit chain, secrets, signer, sessions and transcripts, and the resident answering as itself. kurahi continuity run, verify and badge; the suite runs in CI on every push.

Evidence bundles with replay

Every job records a hash-chained event log — model turns, tool calls, file snapshots, permission decisions, loop-guard verdicts — signed at job end. kurahi evidence export writes a bundle that a third party verifies offline; kurahi evidence replay and the /evidence/<job> view step through it event by event.

Policy as code

One signed policy.yaml per gateway, refused unsigned in enforce mode. Budgets per agent and per fleet (tokens and cost per day, tool calls per hour, wall clock per job), approvals by tool class, an egress allowlist and a kill switch that aborts running jobs within one event-loop tick. Every decision is audited with the rule that made it. kurahi policy show, validate, sign, verify, diff, apply, kill, release.

Channel-native residents

One session per conversation; commands such as /status, /jobs, /cancel and /evidence from any channel; approvals answered by keyword in the channel; a per-channel delivery queue with retries, dedupe and dead letters; system replies in English, Japanese and Portuguese; a generic webhook channel for anything else.

The factory

Boards of cards under KOLO_HOME/factory with an audited state machine from inbox to merged. A runner hands each card to the KIP headless engine as a job, streams its events into the card timeline and the evidence log, opens the pull request and merges only under the card’s policy. A /factory Kanban, an API and kurahi factory on the command line.

Terminal parity

Session switcher, unified diffs for file edits, slash commands, eight themes and JSON theme files, a direct key and a leader chord for every action, export to Markdown or JSON, an external editor, formatters after edits, file snapshots with undo and redo, @path attachments.

Language servers

Diagnostics appended to every write, edit and apply_patch result, so the agent sees type errors in the same turn. Definition, references, hover and diagnostics as tools. Defaults for TypeScript, Python, Go, Rust and Java; a server runs only when its command is on PATH, nothing is downloaded.

Verified on three platforms

Release 2.0.3 passed its unit, gateway and extension suites in CI on Linux, macOS and Windows, and the Linux bundle was installed from the public installer and answered kurahi --version with no Node.js on the PATH.