yana-ai 1.5.2

Models propose. Yana decides. Humans stay in charge.

A local control plane that sits between any AI model and real power over your machine.

English · Tiếng Việt · 한국어 · 中文

Quick start · How it works · Yana Studio · Performance · Limits · Website

At a glance

Counts are derived from the filesystem by core/scripts/check_counts.py, which CI runs. Timings are local measurements from 2026-10-20; the method is under Performance.

Quick start

Choose one: the desktop app, or the command line.

Desktop app. Download Yana Studio (v1.7.0) from the latest release or yana.vutam.link.

Command line. Govern the agent you already use:

pip install yana-ai    # Python CLI
yana-ai install        # add Yana's hooks and rules to your repo
yana-ai doctor .       # check that everything is wired
cargo install yana-rt  # optional: native runtime, no Python needed

Needs Python 3.11+ (or Rust), Git, and one supported host. All CLI commands are in COMMANDS.md. Yana is not published to npm, see VERSIONING.md.

How it works

A model can say what it wants to do. Yana decides whether that is allowed, and a person can always stop it. Every model takes the same path: Claude, GPT, Gemini, DeepSeek, or one running on your own machine.

flowchart LR
    M["Model<br/>proposes an action"] --> A["Authority<br/>may this agent ask?"]
    A --> C["Capability<br/>which exact power?"]
    C --> P["Policy<br/>rules first, then a human"]
    P -->|allowed| E["Executor<br/>runs only that operation"]
    P -->|denied| X["Blocked<br/>with a reason"]
    E --> L[("Hash-chained<br/>audit log")]
    X --> L

Skills teach an agent how to work. Only a capability can grant permission to act.

System structure

Component	What it does	Status
Yana Studio	Desktop workspace: files, editor, terminals, chat, tasks and a design canvas for a real project (v1.7.0).
Yana IDE	Deeply customized VS Code agent workspace with Yana agent cockpit and office tools.
Runtime yana-rt	Rust engine with one turn loop and one authority contract for every client and every provider.
Governance	Capability manifests, human approval, hash-chained audit log, core-lock integrity.
Giám Thị	Watcher outside any AI session that halts every later tool call when it finds drift.
Harness adapters	Claude Code, Codex, Cursor and Antigravity. Enforcement strength differs per host.
Knowledge layer	100 agents, 2,035 skills, commands and rules that teach agents how to work. They grant no permissions.
Yana OS	Local management plane: agent identity, autonomy levels, quotas, health, quarantine.
Yana Desktop / Web	Earlier Electron shell and web UI. Studio is a separate rebuild, not a reskin.
Yana Wheelbot	Robotics platform on ESP32-S3, in its own repository.

Live means shipped and in use. In development means real code exists but is not feature-complete. Experimental means opt-in and not independently verified.

yana-rt has 41 subcommands. Zero Python dependency. This is the source-defined count across feature builds, including feature-gated ones.

core/
├── hooks/    # 66 PreToolUse / PostToolUse / Stop hooks (63 shell, 3 JavaScript)
├── rules/    # 71 rules, most are guidance the agent applies; hooks enforce a subset
├── agents/   # 100 specialist agents
├── skills/   # 2,035 skills
├── commands/ # 170 Claude Code slash commands
└── config/
    └── core-lock.json    # SHA-256 manifest — 290 core files pinned

Yana Studio (v1.7.0)

One window for the things you switch between when working with AI on a project. Studio talks to models only through yana-rt; the UI layer never calls a provider.

Not built yet: device registry, agent sessions screen, mobile pairing, SSH/Docker execution, permission-lease UI, signed auto-update. Per-screen status lives in tools/yana-studio/SCREEN-STATUS.md.

cd tools/yana-studio
npm ci && npm run rebuild
npm run stage:runtime -- /absolute/path/to/yana-rt
npm start

Runtime: yana-rt

A single Rust binary owns the turn loop and the authority check for every client, so Studio, the CLI and MCP do not each reimplement permission logic.

• Providers: anthropic, openai, gemini, groq, deepseek, openrouter, xai, novita, nvidia, minimax, glm, huggingface, 9router, kimi (cloud), and ollama, lmstudio, llamacpp, turbofieldfare, airllm (local). The canonical list is src/model/catalog.rs; a contract test keeps Studio in sync with it.
• Failover: typed provider errors, fallback providers and credential-pool rotation.
• State: SQLite session store with full-text search, per-profile state, crash recovery, and shadow-git checkpoints with rollback.
• Capability tools: file read/patch, command execution under validation, MCP client over stdio, web.search through a checked HTTPS layer, and a read-only LSP client.
• Optional features: mcp, lsp, pty-bridge, Discord remote adapter. They are off in the default build.

Remaining runtime work is tracked in CURRENT-MILESTONE.md: unifying every client on one capability executor, and testing local-model tool calling against a real local model rather than a mock.

Performance

Measured 2026-10-20 on an Apple M4 MacBook Air (16 GB RAM, macOS 27.2), yana-rt 1.5.1 release build at commit 986093f5, against this repository. Each figure is the mean of 3 runs (100 for startup, 50 for hooks). The Python column is the script that each Rust command replaces. The last column is the 2026-08-26 snapshot; full history and method are in BENCHMARK.md.

Since August, doctor and ci check reached output parity with Python and both got faster. The release binary grew from about 14 MiB.

These are single-machine numbers. Linux and Windows are not measured.

Giám Thị

An independent watcher that runs outside any AI session, from the operating system's own scheduler (launchd on macOS, a systemd timer on Linux, Task Scheduler on Windows) every 6 hours.

1. It compares the repo against a baseline commit a human approved, over the files that control enforcement: hook settings for Claude Code, Codex and Cursor, CI workflows, core/rules, core/gates, core/hooks, core/scripts and src/guard.
2. On drift it writes GIAMTHI_HALT.lock. A hook that runs first on every tool call then denies everything while the lock exists.
3. Only a person deleting the lock clears it. Neither the hook, the watcher nor any environment variable can.

Manage it with yana-ai giamthi install | status | repair | uninstall. It is opt-in, and because it runs on a schedule there is a window of up to 6 hours between a change and the halt. Codex fires PreToolUse only for shell commands, so Yana also checks the lock on SessionStart and UserPromptSubmit for Codex.

Harness adapters

Details and switching commands: adapters/README.md. The 170 Claude Code slash commands (/plan, /verify, /code-review and others) live in core/commands/ and run inside a session.

What protects you, and where it stops

Antigravity screens shell commands only and is bypassed by agy --dangerously-skip-permissions, Cursor does not screen MCP calls, and browser-only web deployments without the Rust runtime are not fully governed. Details: known limitations.

Versioning

Three axes, each with its own number and registry: the product (not distributed), yana-rt on crates.io, and the yana-ai Python package on PyPI. Apps under tools/ ship through GitHub Releases with their own tags (studio-v* for Studio). Current version numbers are left out of this page on purpose, since they go stale; the badges above read them live. See VERSIONING.md.

More

ARCHITECTURE.md · PHILOSOPHY.md · ROADMAP.md · CURRENT-MILESTONE.md · CHANGELOG.md · BENCHMARK.md · CONTRIBUTING.md · SECURITY.md · Acknowledgements · Lineage

Built by one person, no team, no funding: Vũ Văn Tâm, Vietnam
yana.vutam.link · phamlongh230@gmail.com · Apache 2.0