CLI

The ka-agent binary has four visible subcommands (plus the hidden __worker the runtime supervises; you never invoke it by hand).

Command	What it does
ka-agent run	The resident daemon: runtime, optional Telegram channel, admin unix socket, graceful SIGINT/SIGTERM. Alias: ka-agent daemon.
ka-agent status	Query a running daemon over its admin socket: session, status, strand, budgets, crashes, queue.
ka-agent chat	A local console surface over the runtime: streaming replies, approval prompts (/y, /n), cost lines.
ka-agent doctor	Instance health report: config, data directories, engine pin.

All subcommands take -c/--config <path> to point at a specific ka-agent.toml.

Config resolution

1. --config flag, if given;
2. else $KA_AGENT_CONFIG, if set;
3. else $XDG_CONFIG_HOME/ka-agent/ka-agent.toml, defaulting to ~/.config/ka-agent/ka-agent.toml.

An invalid config is reported and exits; the daemon never silently falls back to defaults.

The admin socket

ka-agent run always binds one admin unix socket at <data>/admin.sock (mode 0600). It is deliberately read-only in M2: status is the only operation. There are no write operations over the socket by design; policy changes, pairing and grants stay on the local CLI and file plane. Nothing over the socket can approve, prompt, or reconfigure the engine.

ka-agent status is the reference client (3 second timeout, friendly hint when the daemon is not running).