ARCH — Agent Runtime & Capability Hub

Natural-language intent in. Safe, approved operations across a whole fleet out.

ARCH is a self-hosted agent orchestrator — a control plane for running AI coding and ops agents against real machines. You describe what you want in plain language; ARCH plans it, executes it through permission-gated capabilities, and shows you every command before it runs. Live at arch.crat.ch.

Unlike a chat window bolted onto a terminal, ARCH is built around a self-extending capability library: every useful command an agent runs once can be registered as a reusable, scoped capability — so the platform gets more capable the more you use it.

What you can do with it

• Drive agents over SSH — run Claude, Ollama or Gemini/Antigravity agents against any registered server, scoped to a project (a working directory on a destination).
• Chat, edit and operate live — streaming chat, file read/edit, and a real interactive terminal in the browser over a WebSocket bridge.
• Call capabilities with approval gates — agents invoke reusable shell / HTTP / internal actions through a fenced-block protocol; risky ones pause for your one-click approval.
• Review proposals — agents publish suggested fixes as structured proposals with runnable, step-by-step remediation (auto / guided / passive).
• Automate with watchers — trigger agent runs from webhooks or schedules.
• Build a knowledge base — searchable notes, facts and credentials the agents (and the voice assistant) can draw on.
• Ask by voice — a separate voice + text home assistant answers from the knowledge base and can trigger capabilities hands-free.

The four pillars

Pillar	What it is
Run Destinations	SSH targets ARCH operates on. One pooled connection per host multiplexes shell, exec and file transfer.
Projects	A destination + working directory + default model. Each has its own chat, files, terminal, proposals and run history.
Knowledge Base	Tagged, searchable entries — facts, references and secrets — queryable by agents and the assistant.
Capability Library	Reusable, permission-scoped actions (shell / HTTP / internal) shared across every project.

A platform that grows itself

The capability library is the heart of ARCH. Agents talk to the runtime through fenced blocks — to invoke an action they emit:

{"name": "docker_ps", "params": {"host": "media-server"}}

...and when an agent finds itself running the same command twice, it registers it as a new capability, which becomes available on its very next turn. The library already spans Proxmox / LXC provisioning, DNS (Cloudflare), reverse-proxy records, media services (Sonarr, Radarr, Lidarr, Jellyfin, Jellyseerr, SABnzbd), Logto identity, GitHub, Redmine, a wiki and per-host SSH runners — every one behind an approval gate.

Findings and fixes come back as proposals: a title, a markdown write-up, and ordered shell steps the operator can run automatically, step-by-step, or by hand.

Architecture, fused

Concern	Powered by
UI + API	Next.js 15 (App Router) + TypeScript
Runtime	Custom Node HTTP server via tsx — not next start; adds WebSocket bridges + background engines
Live channels	WebSocket bridges for the interactive terminal and live speech-to-text
Datastore	SurrealDB (accessed only through typed helpers)
Remote work	ssh2, one pooled connection per destination, multiplexed channels
Identity / SSO	Logto (OIDC, Authorization Code + PKCE)
Agent engines	Claude CLI · Ollama · Antigravity/Gemini, invoked over SSH
Edge / TLS	Nginx Proxy Manager + Let's Encrypt

The browser never touches a database directly — the custom server brokers every privileged call, streams agent output over SSE, and holds secrets server-side.

Security model

• Admins are defined only by an allow-list of identity subjects and can never be locked out.
• Managed users are added explicitly and are strictly read-only; every destination, project, capability, watcher and secret mutation is admin-gated.
• Resources carry an owner and a visibility flag; private items are masked as 404 to anyone not allowed to see them.
• Sessions are short-lived signed JWTs; roles are computed from the subject on every read, never trusted from the token.
• Every shell capability requires explicit approval before it runs — the agent proposes, the human disposes.

Status

Live in production at arch.crat.ch and under active development. Agent runs, streaming chat, the terminal and speech-to-text bridges, the knowledge base, the self-extending capability library, proposals and the voice assistant are all running. Fittingly, ARCH is developed on itself — the orchestrator is used to build and deploy the orchestrator.