What's in there

• Help when you're stuck — install issues, provider setup, weird errors, someone will get you sorted
• Ideas and feedback — suggest features, vote on what gets built next
• Plugins and skills — share what you've made, find what others built
• Sneak peeks — see what's coming before it lands
• Me — I hang out there and answer questions at 2am. It's a whole thing.

Who's it for

Everyone. New users figuring out setup, builders sharing plugins, people who just want to talk AI agents. No gatekeeping, no stupid questions.

Come say hi

https://sarahai.co.uk/discord

SARAH itself is free forever and MIT open source — grab it at https://sarahai.co.uk and then come tell us what you built.

Chat replies are back in their bubbles

Replies now appear in their chat bubbles again instead of only being visible in Command Center. Small thing, big difference to actually using the app.

Big projects no longer hang on switch

Switching projects no longer hangs on large projects, and project panels no longer show a phantom "No projects yet" while they're still loading.

Invisible duplicates cleaned up

Invisible duplicate assistant rows are removed from existing chats automatically — and a backup is kept, so nothing is lost.

Time Machine stops scanning build folders

Time Machine no longer scans build folders such as Rust target/, and polluted history folders are cleaned up automatically. Faster snapshots, less noise.

Getting it

SARAH v1.0.9 for Linux and Windows — free forever, MIT open source:

https://sarahai.co.uk

Chats, projects, settings and provider keys are kept when updating.

1.0.5 made SARAH 100% free forever. 1.0.6 makes it hardened. If you run 1.0.5, update — in-app or from https://sarahai.co.uk

Here's what changed, in plain English.

Plugins can't run code on import anymore

This was the scariest one. Previously, importing a .sarah plugin could execute it. Now uploads are validated by parsing/compiling only, manifests are JSON-encoded, generated tools can't inject code through filenames, imports are contained to app/project plugin roots, and plugin tool calls time out instead of hanging the agent.

Tokens out of URLs

The master API token is no longer placed in any window URL. Electron delivers it through sender-validated IPC, proves the backend knows the same token with an HMAC handshake before loading, and the browser UI uses scoped media tokens for images, audio and downloads. /api/health accepts the token header only, settings updates use an explicit allowlist, and query-string master tokens are rejected everywhere.

Teams is locked down

Teams was new in 1.0.5, and 1.0.6 secures it properly:

• The host is the only source of truth for guest permissions. Relay-supplied permissions are ignored, presence frames can't inject unknown members or revive removed ones, and removed guests are blocked from messages and agent triggers.
• Every room message is signed with Ed25519 and verified on receipt — forged agent messages are dropped, and only the host can produce agent-classified messages.
• Members without chat permission don't receive the room key or encrypted history, on both host and relay.
• Invite relay URLs must use TLS, private/link-local/metadata addresses are refused.
• The relay caps connections, frames, history and outbox growth, with per-IP limits, and creates rooms / approves joins transactionally.
• Team history sent to agents is trimmed to a token budget to stop memory bloat.
• Secret values are redacted from guest-triggered prompts, and the hidden-file list now covers .git-credentials, .netrc, SSH keys, password databases and token stores.

Your data is safer

• Providers, projects, settings, chats, memory, schedules, runs, MCP config, sandboxes and Time Machine manifests now write atomically with temp files and renames.
• Damaged data files are preserved as .corrupt-* backups and reported instead of silently loading empty defaults — there's a Data Health section in Settings to list and restore them.
• Settings, providers, chats, tokens, pairing codes and logs are written with owner-only permissions, with a startup migration for older installs.
• Deleting a chat only removes the original after a backup succeeds.
• Snapshot manifests can't write outside the project root, and Time Machine ignore rules no longer silently drop source folders.
• Corrupt project indexes no longer create a phantom Default project, project roots can't be the install tree / data dir / home / root, and allowed outside folders are now scoped per project instead of globally.
• Quoted shell commands can no longer bypass the outside-folder gate, and the filesystem root can't be allowlisted.

Updates, releases and installers hardened

• Update extraction has uncompressed-size caps, applier temp files are private, Windows cleanup only targets SARAH's own processes, rollback deletes files the failed update created, and the embedded update key always outranks a writable sidecar.
• CSP is pinned to hashes of the actual boot script, remote images are no longer allowed, and the CSP refreshes when the built UI changes.
• Release ZIPs are deterministic, the feed records the source commit, the feed is published after the archives, uploads refuse plaintext FTP, and live artifacts are checked against the signed feed.
• Uninstallers require a SARAH marker and refuse to erase the home folder or filesystem root. The Linux installer verifies the Chromium sandbox helper before making it setuid root, and the launcher refuses to silently disable the renderer sandbox.
• Stop/quit flows verify a listener is this install's own server before killing it.

Reliability and performance

• Chat stream failures are reported again, the editor no longer loses unsaved buffers when an agent opens a file, saves no longer mark changed text clean, file opens are sequenced, and stale diagnostics/git gutters no longer paint the wrong file.
• MCP tools survive beyond the first agent turn, failed connections no longer cache dead clients, provider calls have deadlines, and maxTokens actually reaches the API.
• Compaction always keeps the newest turn and no longer hides the original context-overflow error.
• Projects/Marketplace no longer trigger an infinite refresh loop, background tabs pause polling, settings typing is debounced, and terminal run caches are pruned.
• The run queue enforces a concurrency cap, and Stop stops every tracked run.
• Chat sidebar summaries and run records are cached, run writes are coalesced.
• Git: branch names starting with - are rejected, committing selected paths no longer sweeps in other staged files, and discarding untracked files moves them to trash instead of deleting.
• Screenshots are full-resolution lossless (up to 4K previews, 3840px attachments) — the model still gets a smaller copy to control token cost.
• Clipboard IPC is sender-validated, avatar URLs restricted to http(s), theme url() limited to data/blob.
• Core blocking overlays now expose dialog roles, aria-modal and labels, with proper Escape/focus handling.
• Plus: voice cache caps, watcher cleanup, macOS notification fixes, LSP/sandbox no longer blocking the event loop, FTP transfers aborting at the size cap, and scheduled jobs no longer blocking each other.

Getting it

SARAH 1.0.6 for Linux and Windows, still 100% free forever:

https://sarahai.co.uk

Updates verify the SHA-256 hash and the ed25519 feed signature before installing anything.

Not a trial. Not a free tier with the good parts locked behind a key. The price of SARAH is now nothing, permanently.

No licence, no tiers, no upgrade path

As of 1.0.5 there's one product. SARAH for Linux, SARAH for Windows. That's the whole catalogue.

What this removes:

• The licence key and the activation screen
• The separate Premium and Free builds — there's one build per platform now
• Every premium feature being gated: sandboxes, multi-chat and GitHub writes are just part of the app

There's nothing to upgrade to, because there's nothing above free.

Why

Because the tiering was friction.

It meant maintaining two build pipelines, a signing and verification chain for licence entitlements, and an activation flow — all so that people could be separated from features that were already written and already shipped. Every hour spent on that was an hour not spent on the app.

Removing it makes SARAH easier to ship, easier to support, and easier to explain. Fewer moving parts is a feature.

If you bought a key along the way: nothing changes for you, and you don't need to do anything to keep using it. If you feel hard done by, get in touch and I'll sort it out.

New in 1.0.5: Teams

The other half of this release is something I've wanted for a while.

Teams lets you invite people into a shared group chat with multiple agents in the room.

Previously SARAH was a conversation between you and one agent. With Teams you can bring in other people and more than one agent at once — so the right specialist can weigh in on a problem in the same thread, rather than you copy-pasting context between separate windows and hoping nothing got lost in translation.

Think: a project room where the people who need to be in the decision and the agents best suited to the work are both present. One chat, multiple agents, your team.

Getting it

SARAH 1.0.5 for Linux and Windows:

https://sarahai.co.uk

Updates verify the SHA-256 hash and the ed25519 feed signature before installing anything, so you're not running a half-copied install.

One thing I want to say plainly, since it matters: SARAH going free is not a limited-time offer and there isn't a paid version coming back. If you find it useful, tell someone. That's genuinely the whole business model now.

SARAH stands for Spective Studios Architectural Runtime Agent Holder. It is a desktop workspace for working with AI agents across real projects: files, code, tools, notes, tasks, and integrations all live close together. Instead of treating every conversation as a one-off, SARAH lets an agent work with the context and resources of a project.

More than one model, one place to work

You can connect different AI providers, including OpenAI-compatible services and local Ollama models, then choose the model that fits the job. That means your workflow does not have to be tied to a single provider or a single model lineup.

The workspace is designed around projects. Each project can bring together its files, chats, agents, skills, plugins, tasks, notes, and environment. That context helps turn “Can you help with this?” into a practical workflow: inspect the relevant files, make a change, run a check, and keep the result with the project.

Agents with useful tools

SARAH agents can work with files and run commands, and they can use plugins and connected MCP servers to reach other services. Skills can teach repeatable workflows; plugins can add focused capabilities. You can also build and package your own tools, rather than waiting for a vendor to add the integration you need.

For people who want more control, SARAH includes Plan and Build modes, a Command Center for live runs and approvals, and a Time Machine for snapshots and undo. You can review what an agent is doing, steer a run, or stop it. The goal is not to make AI feel magical; it is to make its work visible and manageable.

Why SARAH stands apart

No single application is best for every person or every task. SARAH’s difference is its combination of flexibility and hands-on agency: multiple model providers, project-level context, extensible tools, and a desktop environment where you can inspect and shape the work. It aims to feel less like another chatbot tab and more like a capable teammate’s workbench—one that you configure, guide, and improve.

Whether you are writing, coding, researching, automating a routine, or building a new integration, SARAH is designed to keep the conversation connected to the work itself.

SARAH is built for people who want AI not only to answer, but to help move a project forward—with the person still in control.