Liri
Linglong Bird · Personal AI Assistant · Local-first · Security by design
$ git clone https://github.com/cocosoft/Liri.git A road that is still being built
On 25 May 2026 it was a single v0.1 with 100 commits. Five months later it holds 4,000+ files and 27 channels — and the bill that comes with them: a 7,000-line monolith, 105 oversized files nobody had registered, and one "dead code cleanup" that deleted the entire sandbox subsystem.
We restored it, then turned deletion, boundaries and state vocabularies into CI gates one by one. The road is not finished.
What is Liri
Liri is a personal AI assistant built on a TypeScript + Rust architecture.
It is far more than a chatbot — it can understand intent, run commands, manage tasks, call tools and even collaborate with other AI agents. One engine powers every entry point: terminal, desktop, IM and MCP.
71 modular subsystems, 4,109 TypeScript files and 429 desktop components — all trimmable per build variant.
Capabilities
Eight differentiated capabilities, every one of them verifiable in the GitHub source
Deep agent engine
An in-house TAOR loop with strategy, memory and checkpoints
- TAOR decision cycle (Think-Act-Observe-Reason)
- 4 agent strategies: general / coding / exploration / planning
- Checkpoint resume keeps long-running tasks recoverable after interruption
- Layered context windows with three-tier automatic compaction
- 8 termination reasons plus per-round circuit breaking to stop runaway loops
5 layers of defense in depth
Rust AST compile-time analysis → five lines of defense → multi-backend sandbox isolation
- Compile-time Bash analysis via Rust FFI AST
- 37 dangerous-command rules + 14 injection rules
- Guardrail policy rule engine
- AutoMode risk classifier
- Sandbox coverage across Landlock / macOS / Windows / Docker / SSH / PTY
69 built-in tools
23 categories spanning files, commands, network, media, code and collaboration
- Rust AST-level Bash execution
- LSP-powered code intelligence
- Web scraping and search
- Notebook, image, audio and video processing
- Full MCP client and server support
27 messaging channels
27 channel adapters, with WeChat / WeCom / DingTalk / Feishu / QQ all supported
- Telegram / Discord / Slack / WhatsApp
- WeChat / WeCom / DingTalk / Feishu / QQ / Yuanbao
- Email / SMS / Webhook / IRC / Matrix
- A unified channel catalog with gateway routing
- Compile-time channel trimming for smaller builds
Enterprise-grade observability
OpenTelemetry integration, alerting and health checks
- Tracing + metrics aligned with OTel GenAI semantic conventions
- Tiered structured logging
- Alert rules and incident management
- Health checks, backups and data archiving
- Replayable, auditable session events
Pluggable architecture
Plugin SDK, skill system and four protocols — trimmable per build variant
- 5 build variants: core / personal / coding / enterprise / headless
- Plugin marketplace with hot loading and signature verification
- Three isolated skill sources (built-in / user / third-party)
- MCP / ACP / A2A / LSP protocols
- Four-stage startup (T0–T3) with on-demand loading
Local-first
Ollama / llama.cpp local models, with data staying on your machine by default
- Local inference that runs fully offline
- A single SQLite data file that never leaves the device
- Sessions stored as append-only events.jsonl
- Cloud providers as an optional enhancement
- Workspace-isolated sandbox directories
Smart routing
19 task classes × 4 tiers × 5 decision stages, plus provider fallback chains
- 19 task types detected automatically
- 4 tiers: simple / medium / complex / reasoning
- 5 decision stages: switch → fast path → session stickiness → LLM judgment → tier
- FallbackChain across providers with retry policies
- Pricing and context windows both read from the database
Layered like an operating system
A thin kernel, subsystem boundaries and dependency gates; local-first is the default, not a switch.
Kernel
@openliri/kernel is its own package exposing a thin interface, guarded by gates K01–K08
Subsystems
Tools, channels, memory, routing, sandbox and tasks each have their own entry points and boundaries
Gates
A 6-layer dependency direction plus 20+ architecture checks — violations block CI
Local-first
Data stays on your machine by default; models can run fully local
Five layers of defense in depth
From compile-time AST analysis to runtime sandboxing: every rule count, threshold and fallback policy lives in the source code
🦀 Compile-time Rust AST analysis
Compile-time Rust FFI performs AST-level security analysis before code runs, checked against 37 dangerous-command rules
Compile-time Rust AST analysis
Compile-timeRust FFI performs AST-level security analysis before code runs, checked against 37 dangerous-command rules
- The Rust FFI layer parses the Bash AST
- Bash AST parsing with 37 dangerous-command rules
- Variable-injection detection and path-traversal blocking
- Argument-tampering detection with allowlisted command validation
🔍 TypeScript semantic analysis
Runtime Compound commands are judged segment by segment at runtime, with rejection reasons tied to the exact statement
TypeScript semantic analysis
RuntimeCompound commands are judged segment by segment at runtime, with rejection reasons tied to the exact statement
- Compound read-only commands pass segment by segment instead of being rejected wholesale
- 14 injection patterns detected, including zero-width characters and environment-variable poisoning
- 10 shell-specific rules (bash / PowerShell / cmd)
- Rejection messages point to the real cause and the offending statement
⚙️ Guardrail rule engine
Policy A configurable policy rule system with fine-grained authorization by tool, channel and user group
Guardrail rule engine
PolicyA configurable policy rule system with fine-grained authorization by tool, channel and user group
- deny-by-default with allowlists
- Permission granularity: tool → rule → fingerprint
- Rule changes take effect immediately, with no restart required
- Rejections report the rule source and the matched statement
🤖 AutoMode classifier
Adaptive Scores risk from task and tool context, then decides automatically whether to allow, ask or deny
AutoMode classifier
AdaptiveScores risk from task and tool context, then decides automatically whether to allow, ask or deny
- Risk grading based on command semantics and tool context
- Low-risk commands are allowed automatically per policy
- High-risk commands move to approval and land in the Inbox
- Untrusted commands default to asking rather than denial
🔒 Sandboxed execution
Isolation 6 isolation backends — Landlock / macOS / Windows / Docker / SSH / PTY — so overreaching commands never touch the host
Sandboxed execution
Isolation6 isolation backends — Landlock / macOS / Windows / Docker / SSH / PTY — so overreaching commands never touch the host
- Linux Landlock: kernel-level filesystem restrictions
- macOS sandbox / Windows Low IL + Job object fallback
- Docker: full isolation with resource and network policies
- SSH remote execution and controlled PTY paths
- Honest degradation with a clear notice when no backend is available
Security by the numbers
Compile-time Rust AST analysis · TypeScript semantic analysis · Guardrail rule engine · AutoMode classifier · Sandboxed execution
Smart Routing
Picks a model tier from task type and difficulty, then falls back through your configured order when the primary provider is unavailable
Auto-detects 19 task types (8 common ones below)
5-layer decision pipeline
Provider fallback chain
Primary model down → automatic fallback → degradation without interruption
Voice Interaction
More than typing — say what you need, and Liri understands, acts and answers
Voice Input
Local faster-whisper or SenseVoice, or OpenAI Whisper in the cloud
Voice Output
Local Piper or Edge / OpenAI in the cloud, or your own custom command
Tool-native
Speech itself is a tool the model can call whenever it needs one
Every Surface
Desktop and terminal share the same speech service
Hands-free operation · Multitasking · Accessibility · Voice shortcuts · Say it anywhere, and it is done
The Second Brain
Knowledge base → Memory → Session events: three retrievable context layers, all stored on your machine
Knowledge Base
Markdown on disk plus semantic indexing, with sources cited in every result
Memory System
Layered memory plus SQLite vector tables, recalled with relevance weighting
Session Event Log
Everything that enters a model request becomes a session event you can replay
Organize & Govern
Curate knowledge when idle, compress context when it overflows — two real background pipelines
DreamEngine five-stage pipeline
Layered Context Governance
When a long conversation overflows, the oldest turns are dropped first, cutting build-time memory from O(total) to O(window). A “raw text is retrievable” note survives the cut, details can be paged back in, and token watermarks trigger automatic compression.
PDCA Self-Improvement Loop
For long-running tasks, Liri runs the Plan-Do-Check-Act loop on its own: decompose the task → execute steps → review results → revise the plan, until it finishes or hits a stop condition.
Desktop Client
Built with Tauri 2.11 + React 19 · 429 TSX components · 32 feature pages · a complete desktop experience
Interface structure illustration — not an actual screenshot
27 messaging channels
Every one of the 27 channels ships with a matching adapter. Set its environment variables to switch it on, or trim it out at build time.
27 channels in total · one unified catalog · enable per channel · compile-time trimming
Ecosystem
Plugin marketplace + MCP marketplace + three skill sources + template marketplace = a composable Liri ecosystem
MCP marketplace
5 source adapters, one search
Plugin marketplace
Local, npm and remote registries
Three skill sources
Built-in, user and third-party — physically isolated
Templates & protocols
Agent and document templates, ready to plug in
More than a feature list
Three things that are easy to miss and used every day.
Buddy persona
Not a tool — a companion. Its look is generated deterministically from a seed, so the same Buddy always looks the same; growth state is persisted and accumulates across sessions.
Transparent costs
Pricing read from the database, attribution to the provider-reported model name, every call written to cost_records; budgets warn, then compress, then block.
Four kinds of users
Developers run commands and edit code; security leads get AST-level blocking and audit trails; ops teams run it as a service; everyone else reaches it from a chat app.
Current limitations
What is not finished yet during rapid iteration — written down so you do not have to discover it the hard way.
Security awaits external audit
Pending audit5 defense layers and 6 sandbox backends are implemented, with 51 sandbox-related files you can review one by one — but no third-party security audit has been completed yet.
Desktop interactions still being polished
Polishing429 TSX components and 32 pages are in place; shortcuts, animations and edge cases are still being refined.
Marketplace catalog is still small
In progressThe plugin market, MCP market and skill sources work end to end, but the installable catalog is still growing.
Get Started
Three steps: install dependencies → configure your API key → run dev
Install dependencies
$ git clone https://github.com/cocosoft/Liri.git
$ cd Liri/app && bun install
Configure your API key
$ cp .env.example .env
$ # edit .env and add your API key Launch Liri
$
bun run dev
Open Source · Community
Liri is open source, and every contributor is welcome