nasrinAI
NasrinAI is a local-first AI assistant: people can ask it anything, and
businesses can connect it to their own websites, apps, POS and customer service.
Status: Core phases 0–10 and the upgrade phases are on main, including the secured API, guest/business access, model routing, image creation, tools, connectors, knowledge/memory, red-team hardening, and the current Connect foundation. NasrinAI Connect remains fail-closed: Gate A is implemented, while actual provider installation stays blocked until a real provider adapter has install, live verification, rollback, and recovery support.
Run it
Needs Node.js 22 or newer. There is nothing to install.
npm test # every server test
AI_PROVIDER=fake npm start # local test run on http://localhost:10000, no keys needed
Without database settings the server keeps data in memory (development only).
To deploy, see docs/deploy-vercel.md; for sign-in,
docs/sign-in.md. To answer with
your own model, see docs/local-model.md.
Change documentation: Every PR must update relevant Markdown documentation and the PR change log, including scope and observed validation results.
Platform-wide engineering contract: Chat, Code, Video Studio, and shared services — acceptance criteria, security, routing, testing, mobile UX, and definition of done.
API
All /v1 routes except status, guest sessions and sign-in need Authorization: Bearer <credential>.
| Route | What it does |
|---|
GET /v1/status | Is the AI on, is it NasrinAI's own model or an outside one, which files and natural voices it supports |
POST /v1/guest/sessions | Starts a guest session (with X-NasrinAI-Key from a business website: a guest of that business) |
POST /v1/auth/email/start, /v1/auth/email/verify | Sign in with an emailed code (page only; sets the sign-in cookie) |
GET /v1/auth/google/start | Sign in with Google (when AUTH_GOOGLE=true) |
POST /v1/auth/refresh, /v1/auth/sign-out | Renew the access token from the cookie; sign out |
GET /v1/plans | Free, Max and Ultra plans, their prices, and your plan |
POST /v1/plans/checkout | { plan } → a PayMongo checkout link (signed-in users) |
POST /v1/payments/paymongo | PayMongo's payment webhook (signature-checked) |
GET /v1/models | The tiers this caller may pick (NasrinAI, Pro, Max, Ultra), and the default |
POST /v1/chat | { message, conversation_id?, model?, attachments? } → the reply (model is a tier id; attachments: photos, PDFs, text files as base64) |
POST /v1/images/brief | { prompt, photo?, answers? } → up to 5 adaptive questions, or the creative brief and its summary |
POST /v1/images | { prompt, photo?, brief?, conversation_id? } → one picture (built from the brief when given); send it again to regenerate |
GET /v1/images/:id | A picture, only for the person who made it |
POST /v1/videos | Shared asynchronous MP4 video-generation service for eligible Max/Ultra users; OpenRouter clips are capped at the verified 8-second single-shot limit |
GET /v1/videos/:id | Owner-authorized video job status for the shared generation service |
GET /v1/videos/:id/content | Completed MP4 from the shared generation service, only for its owner |
Coding and file analysis scope
NasrinAI can help inspect code and supported attachments, explain errors, and suggest changes. In this scope it does not execute untrusted code or shell commands, and it does not add the Artifact Generation feature, OCR, publishing, or deployment automation. Never report tests or commands as run unless a real runner returned the result. See secure coding and file analysis boundaries.
Layout
| Path | What it is |
|---|
server.js | Starts the HTTP server (local runs and other hosts) |
api/index.js | The same app as a Vercel function |
src/ | Gateway, limits, conversations, chat, AI providers |
public/ | The chat page |
db/ | Database migration and its tests |
test/ | Server tests (node:test) |
docs/ | Roadmap, security, database, deployment, decisions, planned features, universal slash commands, PR change log |
Decisions
Composer controls on startup
Composer toolbar controls render immediately with the composer on page load. Their visibility must not depend on model or professional-catalog availability; asynchronous catalog loading may update functionality, but must not hide or delay the controls. Keep the initial HTML and CSS free of startup rules that set the composer toolbar to visibility: hidden.
Skills and capabilities
See the NasrinAI Skills documentation for the full professional skills catalog, intelligence tiers, multimodal capabilities, system capability descriptions, and implementation-status guidance. The structured skills knowledge base is intended for retrieval-backed answers when users ask what NasrinAI can do. Catalog entries are not proof of live implementation; verify current configuration and tests before promising availability.
