01
The flight recorder
Claude Code deletes transcripts after 30 days.
kaprek reads ~/.claude/projects and keeps the black box.
Every session becomes a searchable thread: user turns, tool calls, subagent transcripts. The parser streams multi-hundred-megabyte JSONL files. Search runs on SQLite FTS5, over redacted content only.
Viewing the tape needs nothing but Node.
Chat and triggers need the CLI you already signed into.
02
The approval inbox
A trigger starts a turn at 03:00. The agent wants a command you marked as “ask first.” Nobody is at the desk. Nothing waits.
The question is filed. The agent continues with everything else. The turn ends.
The question survives the turn. It survives restarting kaprek. When you answer in the morning, exactly the approved action runs: byte-for-byte, exactly once. A second call, or a call one byte different, goes back into the inbox. Unanswered questions lapse after 24 hours.
Strict modes block the work. Auto modes let the agent decide alone. kaprek parks the question, then honors the answer.
$ git push origin fix/checkout-timeoutA different command goes back to the inbox.
03
Triggers and missions
Point a trigger at a schedule, a file change, or a clipboard match. kaprek runs the prompt through your CLI and writes a local run and cost log.
A trigger every 30 minutes is 48 requests a day you did not individually click. Know that before you point one at anything sensitive.
Missions keep the work together. Name a goal. Point it at a real project directory. Every chat, task, and pending question of that work hangs on the mission.
By default agents run jailed in kaprek’s workspace. A mission directory is the one deliberate door out — typed by you, checked on every turn.
~/work/shop-api · 2 chats · 1 open question
jail: working dir = mission dir · checked this turn
04
What leaves your machine
kaprek binds to 127.0.0.1, has zero runtime dependencies, and operates no server of its own. No account. No telemetry.
Stays here
Chat logs, trigger config, run and cost log, missions, search index, preserved artifacts, the approval inbox. A static guard test fails the build if a network call is added to the Node code.
Goes to Anthropic or OpenAI
Everything the agent actually processes — because your installed CLI sends it under your account. Every chat message. Every trigger prompt. kaprek adds no destination of its own and never asks for an API key.
Secret redaction is on by default: ten patterns for keys and tokens, replaced before anything is digested or indexed.
Read the tests in the repo instead of trusting this page.
Why not the built-in permission prompts?
Claude Code’s own questions die with the process, and the transcript is gone after 30 days. kaprek keeps the tape past the delete, keeps the question in an inbox that survives a restart, and keeps parallel missions tracked while you sleep.