Kaku - Moses Yebei

The Problem

Terminal emulators force a choice: either a feature-rich but slow option like WezTerm, or a fast but bare-bones alternative. For AI coding workflows, that trade-off means either waiting on startup and rendering, or giving up integrated AI assistance, shell integrations, and polished defaults.

What This Does

Kaku is a deeply customized fork of WezTerm, rebuilt in Rust for speed and out-of-the-box usability. It keeps full Lua config compatibility with WezTerm while adding AI-assisted command recovery and natural-language-to-command conversion. The core lives in crates/ (416 Rust files), with a separate GUI layer in kaku-gui/ and shell integration scripts in assets/shell-integration/.

The repo is a portfolio of 11 self-contained projects, not a single codebase. Substantial ones include config/ (Lua config parsing and defaults), termwiz/ (terminal widget library), mux/ (multiplexer), and crates/wezterm-font/ (font rendering with FreeType and HarfBuzz bindings).

How It Is Wired

Execution starts in crates/kaku-relay/src/main.rs:144 (main), which reaches 400 functions and spawns a relay process. The run function in crates/promise/src/spawn.rs:250 reaches 407 functions and is the central execution hub. The AI panel and command injection flow through crates/kaku-remote/src/lib.rs:975 (start).

The most-connected functions carry the widest blast radius: map (called from 221 places), is_empty (157), and Err (137). config/src/keyassignment.rs is the most-imported file (70 callers), defining key bindings and actions. config/src/config.rs handles file and database I/O for settings persistence.

External effects: 41 functions read/write files, 3 touch a database, 11 spawn subprocesses, and 2 call inference models. The traced path main -> run exits via cmd.run for subprocess execution. The module graph shows 8 internal modules with no circular dependencies—clean structure for a fork this size.

How To Use It

Setup: Build from source with make (Makefile present) or cargo build --release (Cargo.toml at root). Dockerfile exists at crates/kaku-relay/Dockerfile for containerized relay deployment.

Configuration: Use WezTerm's Lua config format directly—no migration needed. The config loader is in config/src/lib.rs. AI provider settings (OpenAI, Claude, etc.) are configured via the kaku ai command.

Running it: Launch the kaku binary from kaku/ or install via Homebrew: brew install tw93/tap/kakuku. The README documents macOS DMG installation and first-launch shell setup.

Real-World Use

A developer running a failing build command gets an AI-suggested fix inline. Press Cmd + Shift + E to apply it, or type # deploy to staging and Kaku converts that to the actual command. The relay crate handles remote sessions, and shell integration scripts (zsh, fish) auto-configure prompt, diff, and navigation tools.

Code Health & Issues

Static analysis found 607 findings (264 high, 308 medium, 35 low), all one kind: deep nesting (max depth 8) in assets/macos/Kaku.app/Contents/Resources/kaku.lua, config/derive/src/attr.rs, and config/src/config.rs. Fix: flatten with early returns and extract inner blocks.

SDLC observations from the structure:

Med - No Dependabot/Renovate across 69 manifests
Med - Docker base images (rust:1.85-slim, debian:bookworm-slim) unpinned by digest
Med - No dependency vulnerability scan in CI
Med - Large binaries in repo (14.4MB libGLESv2.dylib, 7.6MB test data)
Med - persist-credentials: false missing on checkout in .github/workflows/ci.yml
Med - No non-root USER in relay Dockerfile
Low - No job timeouts in workflows; missing .editorconfig, .gitattributes

The Bottom Line

Kaku delivers a genuinely fast, well-integrated terminal with AI features that work out of the box. The WezTerm fork lineage means mature terminal internals with a cleaner, more opinionated surface. The deep nesting and missing dependency hygiene are real but fixable; the architecture is sound for a production tool.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

1,070 files

Rust416
C183
C/C++ Header139
TOML76
Markdown74
Shell33

ReactDocker

Module dependencies

The 8 most depended-upon modules of 8, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_c_content_pages_roadmap_data["roadmap-data"] n1_ontent_pages_roadmap_data_en["roadmap-data-en"] n2_deps_cairo_cairo_version["version"] n3_website_astro_config["astro.config"] n4_website_playwright_config["playwright.config"] n5_website_src_content_config["config"] n6_website_src_env_d["env.d"] n7_website_tests_smoke_spec["smoke.spec"] n1_ontent_pages_roadmap_data_en --> n0_c_content_pages_roadmap_data

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

medium6

low2

Enable Dependabot or Renovatemedium

69 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium2 occurrences

crates/kaku-relay/Dockerfile

rust:1.85-slim, debian:bookworm-slim

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium4 occurrences

assets/macos/Kaku.app/libGLESv2.dylib

4 blobs over 5MB: libGLESv2.dylib 14.4MB, BidiTest.txt 7.6MB, BidiCharacterTest.txt 6.6MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/ci.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Add a non-root USER to the imagemedium

crates/kaku-relay/Dockerfile

CMD or ENTRYPOINT with no USER directive

A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.

Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.

Set timeout-minutes on the workflow jobslow2 occurrences

.github/workflows/ci.yml

2 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.