Regent

The problem

Every capable AI assistant is a remote service. Using one means shipping your files, your messages and your API keys to someone else’s infrastructure, and trusting a privacy policy you cannot audit.

Regent is the opposite bet: a cross-platform assistant that runs natively on Windows, macOS and Linux, keeps every key and every byte of user data on the device, and still does the things people actually want — voice with vision, coding, memory, and messaging.

Architecture

A Rust core handles retrieval, memory and execution, exposed through a single-binary CLI and a background daemon. A TypeScript layer provides the interactive surface. Splitting it this way keeps the hot paths — indexing, search, file access — in a language with predictable memory behaviour, while leaving the interface fast to iterate on.

Thirty-six architecture decision records document why each boundary sits where it does. That was not documentation for its own sake: with a codebase spanning two languages and a daemon, the ADRs are what make the trade-offs recoverable months later.

Tri-modal retrieval, and why it is eval-gated

Memory retrieval runs three ways at once: keyword for exact recall, semantic for meaning, and graph for relationships between entries. Any one of the three fails on cases the others handle.

The part that matters is not the three modes — it is that they are held to a number. An eval suite gates the retrieval layer at recall@5 ≥ 0.75, and a curator process prunes stale entries automatically so the index does not rot as it grows. Without the eval, “we added semantic search” is a claim. With it, it is a measurement that fails loudly when a change makes retrieval worse.

Running untrusted input safely

Regent connects to 17+ messaging platforms — Slack, Telegram, Discord, WhatsApp, Teams, Jira, Twilio — behind a single gateway. Inbound messages are, by definition, untrusted input arriving from the open internet.

Two controls make that tractable. Webhooks are signature-verified, so a message that does not prove its origin never reaches the agent. And execution triggered by inbound messages is filesystem-jailed, so a prompt-injection attempt in a Telegram message cannot reach beyond its sandbox.

The coding agent auto-reverts

Regent includes an autonomous coding agent that plans a change, edits files, and then runs the target repository’s own test suite. If the suite fails, it reverts.

That last clause is the whole design. An agent that writes code and stops is a liability — it leaves the user’s project in a state neither of them understands. Running the project’s existing tests means the bar for “did this work” is the bar the project already set, not one the agent invented.

Engineering standards

Per-crate test suites, cargo-deny for supply-chain auditing, GitHub Actions CI, and a published security policy. For a single-maintainer project these are the things that make outside contribution possible at all.