FAQ

It never runs a command silently. The first time in a session that codai wants to run a shell command, write a file or do anything in the browser, an ask card appears and nothing happens until you answer — Allow once, Always allow (this session) or Deny. Anything that is not a clear yes is a deny. Output is capped at 64 KB per stream and every command has a timeout (30 s by default, 10 minutes at most), so a runaway command is killed with the processes it started.

If you click Allow, the command really runs with your user's permissions — read the card the way you would read a script before pasting it into a terminal.

Only the approved folders in Settings → Executor (default: your home folder). Paths are canonicalised, so .. tricks and symlinks pointing outside are rejected. Reads are capped at 512 KB, writes at 2 MB, listings at 500 entries.

Desktop (computer control): Strict asks before every action in sensitive apps and before any key chord that can close or destroy work; Assisted (recommended) acts freely in ordinary apps, asks in sensitive ones and never types secrets; Autopilot keeps only the credential filter — use it while watching.

Android: strict asks before every action; assisted (default) before anything that sends or pays and inside sensitive apps; autopilot only before sending or paying. Messaging apps additionally have ask / block / allow.

Desktop: Esc or Stop cancels the turn and releases the lease; closing the window releases it too. During computer control Ctrl+Alt+Space (or Esc twice) is the kill switch, and your own mouse or keyboard input pauses the agent. Android: Stop in the chat or on the bubble; every turn also has a time budget (4 minutes by default). From another device an editor or owner can send cancel.

While a task runs it can see what is on screen, including text you typed into a visible field. Android masks password fields from accessibility services, but other sensitive text — a bank balance, a 2FA code — is visible. That is why banking, wallet, payment, authenticator, password-manager and system Settings apps are sensitive: in assisted mode every action inside them needs your approval. Do not ask codai to do things in apps you would not hand to a friend.

Most likely a task was dispatched to this desktop from your phone or the hub — the app checks every 30 seconds and runs them; every step is in the session transcript. Turn it off with Settings → Executor → Run tasks dispatched to this device. If you do not recognise the session at all, revoke unknown devices in hub → Security → Devices and rotate your key.

A session can be viewed by several devices at once, but only one should be doing the work. That device holds the lease (30 seconds, renewed every 10). Run here on the desktop claims it; the app gives it back on Stop or close. If another device holds it you see who, and can Take over.

Because the device executing it is not this one — the work is on your phone, another computer or a dispatched host, and you are watching a live mirror. It flips to LOCAL when you claim the lease with Run here.

Owner — everything, including Run here, rename, share, delete. Editor — watch, send, answer, cancel. Viewer — watch only; controls are shown disabled with the reason. Roles are assigned when a session is shared from the hub (to a user, an org, or an expiring link).

Both. Dispatch targets one of your devices and wakes it (push on Android, 30-second poll on the desktop). From the desktop, Continue on phone sends the conversation to the phone; from the phone or the hub, dispatch a task to a named desktop. The web app's Run on picker is the same idea for tools: the browser chats, a desktop executes.

Yes, for chat. File and shell tools need a host — a desktop signed in with the same account with Serve as a remote host on. Until one is online you see Chat only in the browser.

The apps are free and open source (Apache-2.0). Running the model costs whatever your codai plan bills — every session shows a cost card (desktop) or Cost · Receipt sheet (Android) broken down by model. Budgets in Settings cap a stuck task. With your own provider key the provider bills you directly; on-device steps on the phone cost nothing.

Your messages, the conversation history the model needs, tool results (the command output or file content codai asked for), and a copy of every step so your other devices show the same transcript. Your API key goes only to the gateway URL you configured, as an Authorization header. There is no analytics or telemetry SDK in any of the apps. Traces, memory and file checkpoints stay on the device.

Desktop: secrets.json in the app's data folder (%APPDATA%\ro.codai.desktop on Windows), read only by the app. Web: this browser's localStorage for app.codai.ro. Android: encrypted shared preferences. Sign out removes it and revokes the device server-side; you can also revoke any device from hub → Security → Devices.

Only if you opt in. Training consent is off by default; toggle it in the app (Settings → About on Android, the legal screen on desktop) or with PATCH /v1/account.

Desktop: Windows x64 today (installer, MSI, portable zip, signed auto-updates). Linux .AppImage / .deb / .rpm are built from the same source when a Linux build is produced for a release; computer control and global shortcuts are Windows-only. macOS is configured but not published. Web: any modern browser. Android: 11 or newer; the on-device model wants a recent flagship. No iPhone version — iOS does not let third-party apps drive other apps.

The desktop and web apps need the gateway (or a local model via Ollama / LM Studio on the desktop). On Android, with the on-device model downloaded and mode local-first, simple tasks — open an app, tap through screens, set an alarm — run with no internet; harder steps wait for a connection.

While a task runs, yes — reading the screen and especially running the on-device model on the GPU uses power like a game. Idle, codai does nothing in the background unless you enabled the daily digest or session sync. Battery: Unrestricted only stops Android from killing a task midway; it does not make codai run more.

The desktop fetches https://codai.ro/api/desktop/latest.json, downloads a newer installer and checks its minisign signature against the public key compiled into the app; a file that does not verify is refused. The web app is always current. Android updates come from wherever you installed it (Play or a new APK signed with the same key). Details and manual checks: Verify downloads.

Yes. Desktop and Android: set the Gateway URL on first run or in Settings. The desktop build allows https://*.codai.ro plus http://localhost / 127.0.0.1; another domain needs the http:default scope widened in src-tauri/capabilities/default.json and your own build. The web app needs your gateway to allow the app.codai.ro origin.