pikuri-os

Offline Linux/OS helper agent + OS-integration tools for the pikuri AI-assistant toolkit.

pikuri-os is the home of bin/pikuri-os: a single, local, network-severed agent that understands and operates the host OS — answer questions about the machine, find and open files, read logs and explain errors, advise on configuration. It is the federation's privacy-first @os member shipped as a standalone single agent (walked through in the guide's OS-assistant chapter; see ideas/pikuri-os.md for the design origin and the work still deferred).

Posture (the load-bearing parts):

  • Egress severed at the kernel. Bash runs in a full-filesystem, net-isolated sandbox (the inverse of the coding agent's networked one), so the trifecta's exfiltration leg is gone by construction — not by a prompt.
  • Every mutation confirmed. Bash/Write/Edit route through the confirmer; a conservative deterministic auto-confirmer waves through only provably-read-only commands.
  • Advise, don't execute, anything privileged or networked. Anything needing sudo or the network is handed to the user to run.
  • Memory is a single MACHINE.md, not mem0 — a CLAUDE.md for this host, appended to the system prompt at boot and editable through the confirmed write path.

Opt-in web research. --with-internet enables web access, but quarantined: web_search / web_scrape / fetch live inside an isolated RESEARCHER sub-agent that has the web tools but no filesystem — reached via the agent tool. The main agent holds no direct web tool, so it has zero unconfirmed egress; you approve each research task before it runs (the human, not the model, authors what leaves the machine), and the researcher — having no private data — can at worst leak that approved task plus the public pages it read. This is a separate network boundary from the bash sandbox, which stays kernel-severed regardless. Off by default; the agent stays networkless until you pass the flag. See ideas/more-confirmers.md for the harder pieces still deferred (editable task prompts, a reject-reason channel).

Target platform: Ubuntu 26.04 LTS or newer, GNOME desktop.

Depends on pikuri-core (Agent + Tool framework), pikuri-workspace (file tools + confirmer), and pikuri-code (Bash + sandbox). Deliberately not pikuri-mcp / pikuri-memory / pikuri-vectordb — severing those keeps the no-egress, audit-first posture honest.

Status: skeleton. The OS-specific surface (localsearch-backed content search, MACHINE.md memory, boot grounding) and the binary land incrementally.