what it does
kosa8 is built for AI assistants that write and run code on your behalf. That job needs three things. A safe room to work in. A way to try several ideas at once. An honest record of what happened.
01 · saving and copying
Most backup tools save your files. kosa8 saves the whole running machine — the programs that are open, what they were part-way through doing, and the files. Bringing it back doesn't restart anything: a web server that was running is still running, still serving, from the moment you saved it.
That's what makes copying useful. A copy isn't a fresh machine you have to set up. It's the finished one, already warm, ready to try something.
$ kosa8 snapshot create web --id before-the-risky-bit saved in 1196ms (118MB on disk) # … the AI makes a mess … $ kosa8 snapshot restore before-the-risky-bit --name clean back in 1059ms — exactly as it was
Save once, then bring back as many independent copies as you need. Each gets its own identity so they don't clash.
Save before letting the AI do something risky. If it goes wrong, go back to the moment before.
A saved machine can be uploaded and brought back on a different computer, still mid-task.
02 · trying several ideas
Give kosa8 a list of things to try. It makes one copy per idea, runs them all at once, and tells you which worked and how long each took. The winner is kept; the rest are cleaned up for you.
The point is that the slow setup is shared. Four ideas cost roughly what one costs, because the expensive part already happened.
$ kosa8 explore web --variant "go test ./..." \\ --variant "go test -race ./..." COPY RESULT TIME *web-explore-624462 ok 340ms web-explore-624463 failed 1352ms
03 · the sealed room
kosa8 comes ready to run Claude Code, Codex, Cursor, Gemini, Copilot, OpenCode, AZMX and a plain shell. For each one you decide up front: which folder it can see, which websites it can reach, and which passwords it's given. Those limits are enforced by the machine itself.
This is the difference between telling an assistant not to do something and making it impossible. If it tries to reach a website you didn't allow, the connection simply fails.
NAME CAN REACH WHAT IT IS claude api.anthropic.com Claude Code codex api.openai.com OpenAI Codex cursor api.cursor.sh Cursor copilot api.githubcopilot.com GitHub Copilot gemini generativelanguage.googleapis.com Gemini azmx api.azmx.ai AZMX AI opencode api.anthropic.com, api.openai.com OpenCode shell nothing at all a plain terminal $ kosa8 agent run claude
04 · the AI drives it
kosa8 speaks the standard language AI tools use to control other software. So it can make its own copies and save its own checkpoints. It can run experiments side by side. You don't type the commands.
Anything that changes something is flagged, so your AI tool can ask before doing it.
sandbox_explore try several ideas at once, report the winner sandbox_fork make copies of a running machine sandbox_snapshot save the current state snapshot_restore go back to a saved state …and 21 more for containers, images, logs and builds
Third-party AI plugins can be run inside their own sealed machine, so a plugin you don't fully trust can't reach your files.
kosa8 can run an AI model on your own computer, so nothing has to be sent anywhere.
05 · proof, not promises
Every action goes into a log. Each entry is sealed with the one before it. Change an old entry and every later one stops matching. kosa8 tells you exactly which one broke. Faking it convincingly needs a secret key, not just access to the file.
$ kosa8 audit verify audit chain intact: 908 entries verified
The same record is what your bill is calculated from — so you can check the invoice yourself rather than taking our word for it.