Locus v0.1.6

On-device GGUF models you can find and download inside Locus, a calmer chat for long agent tasks, a self-test and a storage screen, and every screen reworked after a full UI audit. This is also the first Locus release whose APKs reproduce byte for byte from source, so F-Droid can verify and publish Locus's own signed APKs.

Highlights

• GGUF models on the phone. Run llama.cpp models alongside Gemma. Pick from a short list of small models that call tools, search Hugging Face, or add a model by URL or file. Downloads run in the background, resume where they stopped, and are checked against their published SHA-256.
• Small models no longer loop on tools. On-device models under 1B parameters are now Chat only, new chats on them send no tool list, and every model stops after three steps in a row where every tool call was refused.
• A calmer chat for long tasks. Each turn's work folds into one section, repeated test runs are one row, and the plan and composer share one band at the bottom.
• Self-test and Storage in Settings → About & privacy → Diagnostics. Storage now counts GGUF models too.
• Helpers hand back what they had when they time out or are stopped, and the helper time limit is a setting.
• Clearer failures. ChatGPT and OpenAI errors say what failed, with Details and a way out. A check no longer says "passed" over a failed build.
• UI audit. Every screen is on the design system, readable at 200% font, with AA contrast and tool names in words.
• Security. Skills, helpers and the persona are sealed against changes made from Linux, workspace writes can't be redirected by a link, and local MCP servers' secrets are hidden from the rest of Linux.
• Reproducible, attested releases. The APKs reproduce byte for byte apart from the signature, are signed in a separate job that never runs the build, and carry a build provenance attestation.

Full list: CHANGELOG.md.

Most of this is unit-tested and hasn't been tried on a phone yet; docs/STATE.md keeps the list. Locus is in active development, and the way data is stored can still change between versions.

Install

Download locus-v0.1.6-arm64-v8a.apk below and open it on an Android 8.0+ phone (allow installs from your browser or file manager when asked). It's the one for nearly every phone; locus-v0.1.6-x86_64.apk is for x86_64 Chromebooks and emulators. Both are signed with Locus's release key and install over earlier releases.

Checksums (SHA-256)

268ce18985c3868c92d1665983b471d63e99fe6e3e767dd2f7dcee9494601b1e  locus-v0.1.6-arm64-v8a.apk
c150bc5e3e36cb80d8ccf28ea06c00205325c8a2fc0e7bc98b26470919183784  locus-v0.1.6-x86_64.apk
22add3fbf83042b04475516b0b48afaa2dc7d6bbad9762f66d6a62dfa7788f2f  locus-v0.1.6-mapping.txt

Verify

sha256sum -c SHA256SUMS.txt
apksigner verify --print-certs locus-v0.1.6-arm64-v8a.apk
# certificate SHA-256 digest: 0fc4ab07aa5522dfabac92d818fd5cf075ead96da4e2b40a757ac80541490e1b
gh attestation verify locus-v0.1.6-arm64-v8a.apk --repo springmusk026/locus \
  --signer-workflow springmusk026/locus/.github/workflows/release.yml

To check it reproduces: in a fresh clone of the tag, run ./gradlew :app:assembleRelease -Plocus.abi=arm64-v8a -Plocus.unsigned=true, then apksigcopier compare locus-v0.1.6-arm64-v8a.apk --unsigned app/build/outputs/apk/release/app-arm64-v8a-release-unsigned.apk. Details in docs/FDROID.md.

The R8 mapping (locus-v0.1.6-mapping.txt) turns stack traces from these APKs back into readable names.

Locus v0.1.5

Install: download locus-v0.1.5-arm64-v8a.apk below and open it on an Android 8.0+ phone (allow installs from your browser or file manager when asked). It's the one for nearly every phone; locus-v0.1.5-x86_64.apk is for x86_64 Chromebooks and emulators. Both are signed with Locus's release key; check them against SHA256SUMS.txt if you like.

Locus is in active development, and the way data is stored can still change between versions. See CHANGELOG.md for what's in it.

A big release: voice mode, a real terminal, Linux you can manage from the Workspace, Telegram remote control, interactive artifacts, remembered approvals, new ways into Locus from the rest of Android, and an opt-in update check. It also closes a long list of security gaps found in review.

Tested how? Everything here is unit-tested and passed CI. Most of it hasn't been tried on a real phone yet. Entries say Not yet tried on the phone where the design notes record that, and docs/STATE.md keeps the full list.

Highlights

• Voice mode: a hands-free conversation with the agent, with the same tools and approvals as typing.
• An interactive terminal in Locus's Linux, with tabs and an extra-keys row.
• Linux in the Workspace: install, repair, remove and check Linux from Home → Files, with a health page and a package list.
• Telegram remote: approve background tasks from Telegram, or start tasks by messaging your bot for a time you choose.
• Interactive artifacts: charts, diagrams and small tools in a reply run as live, sandboxed previews.
• Remembered approvals: "Don't ask again" for one tool and one site, folder, recipient or command, in this chat or for 30 days.
• Ways into Locus: launcher shortcuts, Direct Share, a quick settings tile, a home-screen widget, "Ask Locus" on selected text, the default assistant role, and automation intents for Tasker and scripts.
• Opt-in update check: off by default; when on, Locus finds a new release, verifies the APK and hands it to Android's installer.
• Privacy: after a task reads your private data, opening a new site with anything in the address asks first, so a PIN can't leave in a short link.

Security

• Private data can't leave in a short link without asking. See docs/design/taint.md, "Disclosure".
  • Before, opening an address was an observation, allowed in read-only and Workspace chats, and it only asked when the query was over 300 characters. So after reading a file, the agent could open https://site.example/4821 and send a PIN or a line of the file with no card.
  • Once a task has read your private data (files, memory, chat history, mail, calendar, a contact, git diffs, deploy settings), opening a new host with anything in its path, query or fragment asks, whatever its length, in every chat mode. A background run refuses it instead.
  • Searching (DuckDuckGo, Google, Bing), Wikipedia articles, sites you named or set up, local servers, bare hosts and sites the task already opened work as before.
  • Allow site for the rest of a task. The card offers Allow site ("Allow images.unsplash.com for the rest of this task"), so a mood board of ten photos needs one tap instead of ten. It covers exactly that host, only until the task ends, and is never saved: the next task asks again, another host still asks, and background runs still refuse. It isn't offered when anything besides the address made the call ask. Voice mode and Telegram can't answer these cards.
• Remembered approvals are strict. See docs/design/remembered-approvals.md.
  • A command rule such as "Always allow git grep TODO" used to cover any command that started with those words. Options that make a harmless tool run another program got through (git grep TODO --open-files-in-pager="sh -c '…'", tar --checkpoint-action=exec=…, zip -TT …, git -c core.pager=…). Now words after a rule's own words must be plain paths or words, with no quotes, = values, globs or shell syntax. Program-running options are refused in every spelling (--opt=v, --opt v, abbreviations, bundles such as -nO) for git, tar, zip, rg, find, Gradle, npm and go.
  • sed, awk, pagers, editors, and wrappers that run another program (env, xargs, nice, timeout, nohup, sudo, su, flock, strace) are never remembered.
  • Once a task has read outside content (a web page, mail, Telegram, an MCP result), a command rule no longer runs a command without asking. The card says which rule was held back and why.
  • A folder rule can't be redirected through a symbolic link. With src/alias -> private/, a write to src/alias/config.txt used to land in private/ without a card. Now a path that goes through a symbolic link, or resolves anywhere but where it says, is neither covered by a folder rule nor offered as one, and the check runs again right before the write.
• A skill or helper name can't leave its folder. skill_read_file used the skill name as its folder without checking it, so a name such as ../.. let the agent read Locus's other private files (settings, chats, memory) without asking. Every entry point that takes a skill or helper name now accepts only a valid name, and the folder must be a direct child of the skills or helpers folder and not a symbolic link. Linked skill or helper folders are no longer listed or loaded.
• Skills someone else wrote are outside content. What skill_use and skill_read_file return from a skill imported from GitHub or a zip, or drafted by the agent, now taints the task like a web page: sending, saving memory or opening a host you didn't name then asks. Skills you wrote yourself are unchanged.
• Remote execution stays inside the project folder. See docs/design/remote-execution.md.
  • Sync-back could be made to write, back up or delete files outside the project by a name such as .. or a folder that was a link. Names that can't be a plain file are now refused, and every path is checked right before each operation. Refused files are named in the result.
  • Uploads don't follow links, and a project folder that is itself a link outside the workspace isn't synced.
  • Each sync downloads into its own temporary folder, so two projects syncing at once can't delete each other's downloads.
  • Replacing a file on the machine moves the old one aside first and restores it if a step fails.
  • The vault-value check streams each file in constant memory and now covers every file, not only those under 2 MB.
• Another app can't pass itself off as an app you always allow. When Android didn't name the app starting a task, Locus took the creator of the result PendingIntent as the caller, but Android says who made a PendingIntent, not who handed it over. Now only getCallingPackage() and, on Android 14+, getLaunchedFromPackage() name the caller. A request with no named caller always shows the sheet and can't be allowed always, so apps that use plain startActivity (such as Tasker's Send Intent) are asked every time. See docs/design/android-bridge.md, "Who may ask".
• A workflow input can't switch off the workflow's approval points. An input containing </workflow_plan>, which another app could send through the automation intents, cut the plan short and dropped its always_ask steps, allowed_tools fence and checks. Inputs containing Locus's tags are now refused, < is escaped inside the plan, the plan is read to the last closing tag, and a plan that doesn't read back fences the run (every call that changes something asks). Existing chats keep their cached prompt. See docs/design/workflows.md.
• Provider addresses, proxies and SSH host keys are sealed. A program that changed the settings file could point a provider at its own server, add a proxy or CA certificate, or swap an SSH host key, and the next request would send the API key there. These are now sealed with their own Keystore key (EndpointSeal). If the seal breaks, each provider shows "Check address" and sends nothing until you save it, proxies and imported certificates are removed, and SSH host keys are cleared. Existing installs are sealed on update without an alert. See docs/design/linux-isolation.md.
• A connector can't borrow another connector's key or sign-in. An injected page could have the agent draft a connector at its own address naming GitHub's key. Now an OAuth connector uses only its own sign-in, and a token goes only to the server it was issued for (RFC 8707). A key goes only to the address it was saved or confirmed for. The agent can't draft a connector that names another connector's key, a built-in's key or a key already in the vault, and a draft's card says whose key it would use and where it goes. Existing connectors keep working; a key shared between addresses shows Confirm key once. See docs/design/mcp-connectors.md, "Keys belong to an address".
• An email approval card shows where the mail really goes. For "alice@company.com" <drop@attacker.example>, the card showed the trusted-looking name first. Cards now list only the parsed addresses, for to and cc, and a display name that looks like an address is refused when sending.
• A tool call that changes something is never re-run on an MCP server's word. A server could do a write, then fail with text containing "401", and get it run twice. Now only an HTTP 401 from the transport counts as a refused sign-in, only read calls are retried, and for any other call Locus renews the sign-in and tells the agent the call may not have run.
• A restore can't fill the phone. Extracting a backup stops, as damaged, once files unpack to more than the manifest declares (plus 10%, at least 1 MB) or past 500,000 entries, and it checks there is room before writing anything.
• The Activity log hides secrets. Vault values, Authorization headers and cookies, t...

Locus v0.1.4

Install: download locus-v0.1.4-arm64-v8a.apk below and open it on an Android 8.0+ phone (allow installs from your browser or file manager when asked). It's the one for nearly every phone; locus-v0.1.4-x86_64.apk is for x86_64 Chromebooks and emulators. Both are signed with Locus's release key; check them against SHA256SUMS.txt if you like.

Locus is in active development, and the way data is stored can still change between versions. See CHANGELOG.md for what's in it.

What's Changed

Other changes

• Setup: Telegram and SSH "None"; shared SSH fields; row helpers in designsystem by @springmusk026 in #59
• Chat and workspace: "What was sent (not kept)", Undo on delete, summarise icon by @springmusk026 in #60
• Coding harness, round two: syntax check, read-before-edit, lenient matching, saved output, git_commit by @springmusk026 in #61
• Fix flaky ConversationsViewModelTest (running chat shows before first message) by @springmusk026 in #63
• MCP follow-ups: use a saved key, prefer the MCP server in new chats by @springmusk026 in #62
• Fix: a confirmed backup restore was never applied by @springmusk026 in #64
• Make a backup restore all-or-nothing at startup by @springmusk026 in #65
• Fallback chains and key pools by @springmusk026 in #67
• Compact inside a running task and recover from context overflow by @springmusk026 in #73
• Run view-model tests' IO work on the test dispatcher by @springmusk026 in #75
• Security: debug signing, share target and notification intents by @springmusk026 in #69
• Docs: November 2026 research and roadmap by @springmusk026 in #70
• Make the vault part of the journalled restore swap by @springmusk026 in #71
• Changes card with per-file undo (change tracking, part 1) by @springmusk026 in #68
• Scheduled runs say how they ended; guard background service starts by @springmusk026 in #76
• Taint runs that read outside content; harden fetch_url and the browser gate by @springmusk026 in #72
• Local crash and exit log; recover from corrupt stores and a lost vault key by @springmusk026 in #77
• Verification cards for build and test runs (change tracking, part 2) by @springmusk026 in #74
• Keep Linux away from Locus's processes and seal tool permissions by @springmusk026 in #78
• Never wipe saved keys on a Keystore failure: ask, keep copies, recover by @springmusk026 in #79
• Ship one APK per ABI; prepare developer verification and IzzyOnDroid by @springmusk026 in #80
• Save long tool output to files, run reads together, cache the prefix for an hour by @springmusk026 in #81
• Task receipts: one record of how each task went by @springmusk026 in #83
• Plan Projects and the next eight roadmap items by @springmusk026 in #82
• Projects, part 1: scoped workspace, memory, prompt and permissions (core) by @springmusk026 in #86
• Device instrumentation tests with a scripted model by @springmusk026 in #84
• Projects, part 2: Projects screens, home strip, chat chip and editor by @springmusk026 in #89
• Model capability negotiation by @springmusk026 in #88
• Fix SSH in release builds: keep sshlib's Ed25519 JCA classes, check by-name classes after R8 by @springmusk026 in #90
• Run a reviewer-blocked call at the next step, inside the running task by @springmusk026 in #92
• Agent benchmarks: 38 tasks, deterministic graders, pass@1 / pass^k, cost and time by @springmusk026 in #85
• Reusable workflows, part 1: save a task as a workflow and run it again by @springmusk026 in #94
• Reusable workflows, part 2: run a workflow on a schedule by @springmusk026 in #95
• Integration: #97 #98 #99 #96 #87 #91 tested together by @springmusk026 in #100
• Overnight log by @springmusk026 in #16
• Bump io.github.huarangmeng:latex-renderer from 1.5.6 to 1.6.3 by @dependabot[bot] in #66
• Docs: refresh after #64-#100 by @springmusk026 in #101
• Release 0.1.4 by @springmusk026 in #102

New Contributors

• @dependabot[bot] made their first contribution in #66

Full Changelog: v0.1.3...v0.1.4

Locus v0.1.3

Install: download locus-v0.1.3.apk below and open it on an Android 8.0+ phone (allow installs from your browser or file manager when asked). Both APKs are signed with Locus's release key; check them against SHA256SUMS.txt if you like.

locus-v0.1.3-debug.apk is the same version unminified, for bug reports with readable stack traces. It's larger and slower; install one or the other.

Locus is in active development, and the way data is stored can still change between versions. See CHANGELOG.md for what's in it.

What's Changed

Other changes

• No step limit for chats by @springmusk026 in #41
• Chat polish: fixes from the UI audit by @springmusk026 in #43
• Settings & library polish: fixes from the UI audit by @springmusk026 in #42
• App polish: onboarding, notifications, Insights and Activity fixes from the audit by @springmusk026 in #44
• Docs: refresh after the polish pass by @springmusk026 in #45
• Fixes from testing on the phone by @springmusk026 in #46
• More fixes from testing on the phone by @springmusk026 in #47
• Insights: model names as the picker shows them by @springmusk026 in #48
• Fix flaky LocalMcpServersTest: a crash the watcher notices first is still a crash by @springmusk026 in #49
• SSH: "No authentication" option for sandbox machines by @springmusk026 in #50
• MCP server templates and annotation-based tool risk by @springmusk026 in #51
• Side questions: /btw as in Claude Code by @springmusk026 in #52
• Settings → Integrations: recommend the official MCP server by @springmusk026 in #54
• Coding harness: precise edits, glob, grep, outline, project info and service logs by @springmusk026 in #53
• Mid-task instructions: messages told while the agent works join the task by @springmusk026 in #55
• Move the Terminal and Browser toggles into the composer by @springmusk026 in #56
• Build: deterministic KSP (serialize around google/ksp#3286) + Hilt ViewModel APK check by @springmusk026 in #57
• Release 0.1.3 by @springmusk026 in #58

Full Changelog: v0.1.2...v0.1.3

Locus v0.1.2

Install: download locus-v0.1.2.apk below and open it on an Android 8.0+ phone (allow installs from your browser or file manager when asked). Both APKs are signed with Locus's release key; check them against SHA256SUMS.txt if you like.

locus-v0.1.2-debug.apk is the same version unminified, for bug reports with readable stack traces. It's larger and slower; install one or the other.

Locus is in active development, and the way data is stored can still change between versions. See CHANGELOG.md for what's in it.

What's Changed

New

• Open search results at the matching message by @springmusk026 in #14
• Supabase and Render integrations by @springmusk026 in #15
• Editable helper prompts by @springmusk026 in #18
• Telegram as a reach-me channel by @springmusk026 in #19
• Exact Insights: model and latency per reply, and where tokens went (database v9) by @springmusk026 in #20
• agent_send: continue a finished or partial helper by @springmusk026 in #21
• ask_user: questions the agent waits on by @springmusk026 in #22
• Read replies aloud, and share a chat as Markdown or PDF by @springmusk026 in #23
• Encrypted backup and restore by @springmusk026 in #25
• Per-chat modes: Read-only, Workspace and Full by @springmusk026 in #26
• Import skills from a GitHub link or a zip by @springmusk026 in #27
• "What was sent": see the exact request for a reply, secrets scrubbed by @springmusk026 in #29
• Prepare for F-Droid: versions in source, opt-in Linux download, fastlane metadata, draft recipe by @springmusk026 in #33
• Android 16 Live Updates for running agent tasks by @springmusk026 in #35
• On-device models: real backend, speed, benchmark, RAM warnings, unload by @springmusk026 in #30
• LaTeX maths and Mermaid diagrams in replies by @springmusk026 in #32
• Local MCP servers that run inside the Linux workspace by @springmusk026 in #36
• Task budgets: cap tokens, estimated cost and time per task by @springmusk026 in #37
• Steer and queue: send while the agent works; steer a running helper by @springmusk026 in #38
• Per-provider network settings: extra headers, proxy, custom CA by @springmusk026 in #39

Fixes

• Tests: coverage report, 116 new tests, and three security and reliability fixes by @springmusk026 in #31
• Reliability fixes learned from comparable apps' bug reports by @springmusk026 in #24
• Turn on Anthropic prompt caching; Android 17 local network permission; spend-limit errors by @springmusk026 in #28

Other changes

• Comparable apps research and roadmap ideas by @springmusk026 in #17
• Launch video by @springmusk026 in #34
• Release 0.1.2 by @springmusk026 in #40

Full Changelog: v0.1.1...v0.1.2

Locus v0.1.1

Install: download locus-v0.1.1.apk below and open it on an Android 8.0+ phone (allow installs from your browser or file manager when asked). Both APKs are signed with Locus's release key; check them against SHA256SUMS.txt if you like.

locus-v0.1.1-debug.apk is the same version unminified, for bug reports with readable stack traces. It's larger and slower; install one or the other.

Locus is in active development, and the way data is stored can still change between versions. See CHANGELOG.md for what's in it.

What's Changed

New

• Full-text search over chat messages by @springmusk026 in #12

Fixes

• Keep the token line on one line and fork titles whole-word by @springmusk026 in #10
• Release the minified APK, and publish tags as the latest release by @springmusk026 in #11
• Provider form: no stale model-list error, and Cancel for ChatGPT sign-in by @springmusk026 in #13

Full Changelog: v0.1.0...v0.1.1

Locus v0.1.0 (debug)

Debug build of Locus v0.1.0, for testing. Signed with Locus's release key.

Install: download locus-v0.1.0-debug.apk below and open it on an Android 8.0+ phone (allow installs from your browser or file manager when asked). Check it against SHA256SUMS.txt if you like.

Debug builds are larger and slower than release builds, and may change how data is stored between versions. See CHANGELOG.md for what's in it.

What's Changed

New

• A proper README and debug releases by @springmusk026 in #9

Other changes

• Offer Run again when a chat ends on the user's message by @springmusk026 in #3
• Fix the crash when opening the browser full screen by @springmusk026 in #4
• Show the terminal and browser buttons only when they have something to show by @springmusk026 in #5
• Message branching: regenerate, edit as a branch, and fork by @springmusk026 in #6
• Deploy workspace folders to Cloudflare as Workers static sites by @springmusk026 in #7
• Model picker: one search, favourites, recents and model details (refs #1) by @springmusk026 in #8

New Contributors

• @springmusk026 made their first contribution in #3

Full Changelog: https://github.com/springmusk026/locus/commits/v0.1.0