sai

sai is a GPLv3 Android coding agent designed around a local workspace. Its name combines AI with a sail: a compact agent built to move work forward from a phone, a Debian/PRoot-compatible runtime, explicit tool approvals, and bring-your-own model API credentials.

Current implementation (1.3.1 Preview 2 / runtime r58)

• sai now provides three real Harness clients instead of reimplementing their agent loops: pinned DeepSeek Harness 0.1.0-rc.6, official Codex through codex app-server, and Claude Code through its matching Agent SDK/CLI protocol. Node 24.19.0, Codex 0.147.0 and Claude Code 2.1.233 are carried in the verified offline runtime; each client keeps its native projects, history, commands and approvals.

• Android projects, models and legacy conversations migrate without exposing credentials. DSH resolves provider references through an Android Keystore credential plugin, and the old Kotlin loop no longer receives main UI, voice, desktop or diagnostic tasks.

• First-party capabilities live in dsh-plugins/ as separately versioned DSH bundles: UI, Android, voice, models, request guard, GitHub, market, pet, artifacts and legacy import. Third-party plugin discovery reads the maintained awesome-dsh-plugin catalog, while sai still performs its own bundle, path, lifecycle-script and permission preflight.

• Two pinned community optimization presets are preinstalled but never forced on a session: Anchored Standard for Minimal-aligned first-turn anchoring and Router Standard for task-aware spec/react/weak routing (including a Flash-specific weak persona). Both are removable and reinstallable from the extension center; the suite's unrestricted runtime injector is not bundled.

• The DSH local origin is protected by a random HttpOnly session cookie, authenticated health checks and an allowlisted Android bridge; no general JavaScript interface is exposed.

• Native Kotlin and Jetpack Compose UI for Android 10 and newer.

• DSH event-sourced sessions with steering, approvals, compaction and background recovery.

• OpenAI Responses, OpenAI-compatible Chat Completions, Anthropic-compatible, and Gemini protocol adapters.

• Multi-project and multi-session workspace UI, structured event rendering, collapsible composer, attachment source selection, ZIP project import, Git import checkpoints, file tools, patch previews, command risk classification, and resumable jobs.

• Room v3 provider profiles with multiple models per provider, encrypted API keys, model discovery/manual models, reasoning controls, and task-level usage reporting. DeepSeek prices and totals are displayed in CNY.

• An operational extension center for installed extensions, discovery, MCP, Skills ZIP/Git imports, Hooks, plugin manifests, static diagnostics, live MCP probes, built-in recommendations, rollback metadata, and safe disabled-by- default installation.

• DSH-native append-only events, Steer input, context compaction, code tools, Git operations, browser capabilities and explicit speech requests.

• Press-to-talk input with send/microphone state merging, upward cancellation, live partial captions, and an optional, independently uninstallable Voice Pack using streaming Zipformer plus Paraformer final correction. Voice-call mode supports short speak summaries and Steer-style interruption.

• An Agent-only WebView environment with expiring DOM node identifiers, observe/click/input/select/submit/navigation/screenshot operations, and no JavaScript interface exposed to web pages.

• A Tauri 2 Windows companion with QR pairing, a pinned-certificate TLS WebSocket, X25519/HKDF/AES-GCM application encryption, project/session lists, conflict-safe text editing, basic Agent conversations, and bidirectional source-format DSH/Codex/Claude session synchronization with SHA-256 conflict checks. Codex and Claude sync into their native desktop session roots; DSH accepts an explicit desktop session directory. Conflicts are reported rather than overwritten. Desktop requests cannot approve dangerous actions on behalf of the phone.

• ABI-matched PRoot/loader libraries for ARM64 and x86_64, a native forkpty bridge, and an interactive terminal surface.

• Offline-bundled GitHub CLI 2.97.0 for ARM64/x86_64, with browser device login and an optional advanced Token entry. Both paths migrate the credential into Android Keystore, erase the temporary gh config, and inject GH_TOKEN only into the individual trusted child process.

• A shared request-protection layer for model APIs, GitHub, MCP/Skill catalogs: bounded concurrency, GitHub mutation serialization, Retry-After handling, exponential backoff for idempotent requests, and host cooldowns.

• dsh-plugin/ is an installable DeepSeek Harness bundle exposing one stable sai_mobile bridge tool while leaving all Android approvals on the phone.

• The base Debian 13 runtime, Git, GitHub CLI, Node 24 and pinned DSH are bundled for offline first start with SHA-256 verification. Optional language toolchains and the independently uninstallable Voice Pack remain separate downloads.

• Runtime activation is atomic. The previous verified DSH closure remains available from the failure screen; a rollback is pinned across app restarts until the user explicitly restores the APK-bundled runtime.

The provider harness, GUI, persistence, approval system, native PRoot runtime, PTY bridge and rootfs installer build together as an ARM64 or x86_64 APK. Native artifacts can be reproduced with the pinned staging or from-source workflows documented in native/README.md. The 1.2.0 preview 6 ARM64 build is intended for in-place validation on a vivo X200s-class device without clearing app data. It includes the compact two-row composer, canvas-style PTY terminal, single-instance task pet, settings search, and full application themes.

The desktop directory contains the Tauri 2 companion and its security notes. The encrypted live session and Harness conversation synchronization are implemented. Automatic mDNS reconnection and persistent Windows Credential Manager identity are still tracked as the next connection-hardening milestone; a desktop restart currently requires a fresh QR scan.

Website and downloads

The responsive product website lives in site/ and is deployed by GitHub Pages on every push to main. It introduces both the Android app and the Windows companion, and resolves its download buttons against the latest GitHub Release at runtime.

Pushing a version tag such as v1.2.0-dsh-preview.2 runs the unified release workflow. It tests and packages the ARM64/x86_64 Android builds, builds the Windows NSIS installer, creates the optional sai-voice-pack-zh-en.apk, generates SHA256SUMS.txt, CycloneDX SBOM and license notices, and publishes all outputs in one Release. The two ABI-specific DSH Runtime Packs are released alongside a detached Ed25519 signature so the runtime and the Android shell have independent update artifacts.

Starting with preview 6, the Android app checks GitHub Releases once per day and can download the correct ABI APK itself. It verifies SHA256SUMS.txt and requires the APK signing certificate to match the currently installed sai before opening Android's system installer. Updates are never installed silently.

Build

The project pins Android Gradle Plugin 9.2.0, Gradle 9.4.1, Kotlin 2.3.21, compile SDK 37, target SDK 36, and minimum SDK 29. Set sdk.dir in local.properties, then run scripts/build.ps1.

All large development data is redirected away from the system drive:

• Android Studio: D:\Code\Android Studio
• Android SDK/NDK: D:\Code\Android\Sdk
• JDK 17: D:\Code\Java\jdk-17.0.20+8
• AVD images: D:\Code\Android\Avd
• Gradle cache and distributions: D:\Code\GradleHome
• Android Studio indexes and plugins: D:\Code\Android\StudioData

Use scripts/start-android-studio.ps1 so the IDE also inherits these paths.

More detail is in docs/ARCHITECTURE.md and docs/BUILDING.md.

Security boundary

PRoot provides Linux userspace compatibility, not Docker-grade isolation. Do not execute untrusted repositories or extensions. Provider secrets stay in Android Keystore-backed encrypted storage and are never injected into shell environments by default.