v0.3.0-rc is out: https://github.com/fodelf/YoungAi/releases/tag/v0.3.0-rc
This is the last RC built on DeepSeek-V4.1-Flash. Download the package for your machine (linux-aarch64 for DGX Spark, darwin-arm64 for Apple Silicon), unpack it, run the ds4-train inside, open http://<host>:8000/, and download the model from the Models page.

YoungAi

A personal AI assistant that lives on your own machine.
Hold to talk. It remembers what you tell it, browses the web, writes Word/PDF/PowerPoint/Excel files, makes videos, keeps following up on a job, and hands the result to the next app on your phone. Model, memory and files all stay on the box.

Website · user guide · English · 中文 · Hugging Face · Technical notes

The model behind it is DeepSeek V4.1 Flash (510 GB as released), shrunk to 113.6 GB and running on a single 128 GB DGX Spark with a 1M-token context. Open source, MIT. Plain C99 + CUDA (Metal on Apple Silicon), one Makefile, no third-party libraries linked.

What it does

A request comes in, the assistant does the work in a sandbox, then hands the result on. The screenshot above is a real run: "find me the cheapest DGX Spark on the web" took 16 minutes, 12 rounds and 43 tool calls, all on the machine itself.

The assistant's tools (this table is what the model sees; there is no scenario-specific prompt):

Voice input: hold to talk

Like WeChat: with the input box empty, the rightmost button is a microphone; tap it to get a "Hold to talk" bar, hold and speak, and let go to send right away. Slide up before letting go to cancel. The limit is 30 seconds. Speech recognition also runs on the machine's GPU, so the audio never leaves it.

• The recognizer is moonshine-tiny-zh (27M parameters, 108 MB), run by this project's own C + GPU kernels (CUDA / Metal), with no Python or ONNX. On the Spark a 3.4-second utterance takes 51 ms to transcribe.

• Chinese only. It is the smallest tier: the paper reports a 29–36% character error rate on hard test sets (crowd-sourced recordings, many accents). Speaking clearly into a phone does much better, but it is a notch below large models.

• To turn it on, put the model's files in gguf/asr/moonshine-tiny-zh/ and load the model again on Models; a microphone appears next to the input box. Without that folder the feature simply does not exist: no microphone, no error.

  mkdir -p gguf/asr/moonshine-tiny-zh && cd gguf/asr/moonshine-tiny-zh
  for f in config.json tokenizer.json model.safetensors LICENSE.txt; do
    curl -fLO https://huggingface.co/moonshine-ai/moonshine-tiny-zh/resolve/main/$f
  done
  

• Browsers only grant the microphone over https or localhost; over http://<LAN-IP> there is no microphone, and the rightmost button is just Send.

• Status: transcripts on the Mac (Metal) and the Spark (CUDA) match the official reference implementation character for character, and the production server on the Spark passed a smoke test. A real phone has been tried on a few sentences (two wrong characters in three); the formal acceptance run (10 sentences on each of three phones) has not been done yet.

Safety: the sandbox, not trust in the model

• Every tool call runs in a fresh child process that locks itself into a kernel sandbox first: Landlock + seccomp on Linux, Seatbelt on macOS. If the sandbox cannot be applied, the call is refused. Thirty-odd escape tests pass on both the Mac and the Spark.
• The gatekeeper is one deterministic C function, not a second model acting as judge. Writes and deletes outside the workspace need your OK (this once / this session / always); arguments that look like passwords, card numbers or one-time codes are refused outright; the assistant cannot touch its own config directory, so it cannot grant itself permissions.
• Web content is untrusted input: after reading a page, standing approvals for outbound actions stop applying.
• Every action is one line in an audit log (audit.jsonl), browsable on the Activity tab, where approvals can be revoked.
• The honest limit: there is no VM. The assistant runs as your user; if the machine is compromised, so is the assistant.

Get started

You need a DGX Spark (Linux aarch64 with the CUDA 13 runtime, ~320 GB free SSD). The web tools need Firefox, which Ubuntu on the Spark ships.

git clone https://github.com/fodelf/YoungAi.git ~/ds4-main && cd ~/ds4-main
make cuda-spark
./ds4-train --host 0.0.0.0 --port 8000      # open http://<host>:8000/

1. Models: press Download (~317 GB, resumable), then Load (~2 minutes).
2. Assistant: just talk. Conversations, memory and the workspace live in ~/.ds4/assistant/.
3. Phone: open the page and Add to Home Screen to get an app. Location, clipboard, sharing and push need https: enter a cloud server in Settings and turn on the tunnel, or use Tailscale. Steps and troubleshooting: docs/pwa.md (Chinese).
4. Tasks: type one sentence to hand a job over.
5. Skills: create one, or import a folder with a SKILL.md (the repo ships one for slide decks: skills/pptx/).

How every tab and every tool works, and what happens when something goes wrong: the user guide.

Two more things it does

Train on your own data. One JSON object per line, in either of Unsloth's two shapes; drop the file on Data, press Start on Train. Nothing is mounted automatically: turn on the Post-train switch next to the chat box to use it. Full walk-through: technical notes §4.3.

{"messages":[{"role":"user","content":"What was the entry price?"},{"role":"assistant","content":"30.39"}],"context":"…the source document…"}
{"text":"Raw text, trained as-is (continued pretraining)."}

Use it as an API. /v1/chat/completions, /v1/completions, /v1/responses, /v1/messages (OpenAI / Anthropic compatible). Create a key on the API tab and send Authorization: Bearer <key> (also from localhost; without it you get 401). "temperature": 0 gives byte-identical output every run. With the speech model installed there is also /v1/audio/transcriptions: the request body is a 16 kHz mono WAV as-is (not OpenAI's multipart form) and the reply is {"text":"…"}; other sample rates or formats get a 400 saying what arrived. API only, no Studio, no build:

curl -fsSLO https://huggingface.co/wenzhouwu/YoungAi-DeepSeek-V4.1-Flash/resolve/main/install.sh
bash install.sh                      # --domain law for another domain (default: code); --endpoint https://hf-mirror.com for a mirror

The model

With a sidecar, how often our next token matches the original full-precision model's goes up 2.9–3.7 points (code: 78.6% → 82.3%). Method and full tables: technical notes §5.

On a Mac, make builds the Metal version; 126 GPU kernel tests pass on a real Apple GPU. The full model has not run on a Mac yet (ours has 16 GB).

Limits

• Tested end to end only on the DGX Spark; every number here comes from it.
• One machine, one model: background tasks and your chat take turns rather than running in parallel.
• Sites behind a login or a captcha stay closed to the assistant; it says what it could not open instead of guessing.
• Sidecars are scored on held-out text, not on end-to-end tasks.

Danger mode (experimental) — disclaimer

Settings has a Danger mode switch, off by default. Turning it on starts a virtual Android 13 phone on the host (Linux only: the kernel needs binder; macOS cannot run it) and gives the model six phone_* tools: look at the screen, tap, swipe, press keys, type, open apps. The workbench gets a Phone tab with the live screen (H.264 stream decoded by your browser), and /api/phone/* is a plain REST API that the page, the model and your own scripts all share (docs/assistant_phone.md). Read this before you flip the switch:

• The model acts on its own. With danger mode on, nobody confirms ordinary taps. The phone starts empty (no SIM, no accounts, no app store), but any account you sign into and any APK you install there, the model can use — it may send messages, place orders, pay, or delete things. Whoever turns the switch on bears the consequences.
• The step that actually pays asks you first, every time. Filling in an amount or tapping "Transfer" / "Buy now" goes through; before a tap, swipe or Enter on a window the app marks as secure (password, payment, login pages) or on a button reading Pay / Place order / 确认支付 …, a red card appears: a fresh screenshot with the spot it wants to tap and the amount on screen, or, for a secure window that cannot be captured, the last screen before it (who gets how much). It can only be allowed once and is never remembered; one approval on a secure window covers the rest of that window and ends when it closes. The model cannot type on secure windows: you type passwords yourself in the Phone tab. This catches the pages it can recognise: a final pay button with no UI text on a window not marked secure goes through unasked.
• Screen content is untrusted input. Text inside apps and web pages can try to instruct the model. The phone runs in its own namespaces with a hard memory cap and cannot reach your LAN or the host, but this is not a guarantee against every misuse.
• It will not bypass anti-bot checks. If an app shows a slide captcha or a risk-control screen, you do it yourself in the Phone tab; the model is not told to get around it. Do not use this to circumvent any app's terms of service or other people's rights.
• The phone system is a third-party image (redroid, Apache-2.0) that this project's runtime (ds4-phone, ~600 lines of C, no Docker) boots directly; its one-time setup needs sudo once (scripts/phone_prepare_linux.sh).
• The live video needs a secure context (https, or the page opened as localhost); over plain http://<LAN-IP> browsers withhold WebCodecs and the tab falls back to one screenshot per second.

Author · acknowledgements · license

Wenzhou Wu (吴文周) · 310066827@qq.com. Questions, reproduction reports and collaboration are welcome; bugs and pull requests go to GitHub.

YoungAi started as a fork of antirez/ds4 (DwarfStar, Salvatore Sanfilippo's DeepSeek V4 engine). GGUF, layouts such as q4_K and much kernel know-how come from llama.cpp and GGML; the GGML copyright notice stays in LICENSE. The model is DeepSeek's; thanks for releasing the weights and the reference code.

Engine: MIT (LICENSE). The quantized weights derive from DeepSeek V4.1 Flash, also MIT (LICENSE-DeepSeek).

Voice input is Powered by Moonshine AI. The moonshine-tiny-zh recognizer is not MIT; it is under the Moonshine AI Community License: free for research and non-commercial use; commercial use requires registering at moonshine.ai/community-license, the license ends automatically once you and your affiliates exceed US$1M in annual revenue, and its outputs may not be used to train foundation models. This repository does not ship its weights; using it is your call.