Veyllo
Install
VAFThe desktop app: the agent runs in its own window, locally on your machine.Veyllo app SoonThe agent on iPhone and Android, with voice and notifications.FrameworkBuild your own agents on the Python library.Veyllo APIEvery model VAF needs, behind one keySelf-hostOne host on your server, your whole team on itFor companiesRoll it out to your team, on your terms
PricingNewsSign in
Back to news
0.1.0a34Release noteOpus via VAF Harness

VAF 0.1.0a34: stronger protection for sign-ins and sessions

VAF 0.1.0a34 closes many security holes and, with the Lean (API) profile, runs through API providers on a small VPS without a GPU.

0.1.0a34 is out. Many of the security fixes concern sign-ins, sessions and HTTPS access. A password alone used to open the API before the 2FA code was entered. Signing out deleted only the browser's cookie, and a password change ended no session either, so a copied token stayed valid for the rest of its day. Settings, Account now lists every device signed in to your account and lets you sign one out.

vaf update

Two features are new:

  • VAF can now be installed on a small VPS without a GPU and without local models. install.sh (Linux and macOS) asks for a profile: Full (local) stays the default, and Lean (API) downloads no models for chat, voice calls, speech-to-text or text-to-speech. Chat and speech-to-text then go to the API providers set in Settings, the containers' memory limits halve to about 4 GB, and a 7.5 GB speech image is left out.
  • Everything VAF keeps can be backed up with vaf backup create into one encrypted file, which VAF verifies right after writing. vaf backup restore puts it back, with the recovery key on a new machine too. A restore whose sandbox environments cannot come back there is refused before anything changes. On an installation from before 0.1.0a34, first replace the key with vaf secure renew-recovery-key, then write a new backup.

This command sets up a rented Linux server without a GPU; an existing install switches with vaf profile api --prune. There, VAF is meant to be reached over a VPN only, not from the open internet.

./install.sh --server --profile api

The changes to sign-ins and sessions take effect only after VAF restarts. A sign-in on another device then lasts up to 30 days instead of one and ends after 7 days without use; setting local_network_jwt_expiry_hours to 24 brings back the daily sign-in. Your own scripts on other devices need a token from Settings, Account, Tokens for programs, and first-time setup from another device a code from vaf setup code. On an existing installation, vaf secure rotate-db replaces the shipped database passwords, and an installed WhatsApp bridge gets the patched audio parser with npm ci in vaf/whatsapp_node while VAF is stopped.

Full release notes for 0.1.0a34 on GitHub