odai — pronounced like the trickster; it lives in your machine and does your chores.
odai is local-only — the primary backend is Chrome's built-in AI (the Prompt API, stable since Chrome 148) via installed Google Chrome on every platform; llama-server (loopback) is the local fallback; Apple FM and Phi Silica (Copilot+) are opportunistic per-OS extras. No cloud, no remote endpoints, no keys.
The Prompt API is model-agnostic by design, so odai names its backend for the interface rather than the model. The on-device model is Gemini Nano today; Gemma 4 is the base for the next Gemini Nano and is already testable in Chrome Canary behind the "Gemma 4 for Built-in AI" flag.
@socketsecurity/odai is a local, on-device AI library for browser and Node.
It wraps the browser's built-in AI Prompt API behind a type-safe,
backend-agnostic seam, hardens small-model JSON output, and ships bench — an
evaluation harness that scores any backend on real Socket workloads. It exists
so Socket code can feature-detect, prompt, and parse on-device model responses
without scattering DOM-specific checks across consumers.
pnpm install @socketsecurity/odaiimport { createOdaiModel } from '@socketsecurity/odai'
const model = await createOdaiModel()
const { raw } = await model.promptStreaming(
'Summarize this page in one sentence.',
)
console.log(raw)createOdaiModel picks a backend by precedence: the explicit backend
option, then the ODAI_BACKEND env var, then the availability probe order —
chrome-builtin, llama-server, apple-fm, windows-phi-silica,
simulator.
The package ships a odai bin for single-shot, keyless AI steps in scripts
and CI. Input arrives on stdin or --input; the parsed result prints as one
JSON line on stdout, diagnostics go to stderr.
git diff | odai commit-msg
printf 'Critical: 2\nHigh: 5\n' | odai triage
odai summarize --input README.md
odai patch --input src/greet.js --instruction "use a template literal"
odai classify-deps --input narrowed-dep-diff.json
odai backends
printf '%s\n' '{"id":"a","task":"summarize","input":"release notes..."}' '{"id":"b","task":"commit-msg","input":"diff --git..."}' | odai batchEvery prompt runs under a hard budget — --timeout <ms> or the
ODAI_TIMEOUT_MS env var, default 120000 — so a wedged engine can never hang
a job. Exit codes are the CI contract:
| code | meaning |
|---|---|
| 0 | success — parsed JSON on stdout |
| 1 | model or task failure — invalid reply, timeout, or engine error |
| 2 | usage error |
| 69 | no backend available — treat as a clean skip in CI |
When nothing is provisioned the CLI prints the exact provisioning steps for
each backend and exits 69; odai backends prints per-backend availability
JSON with the reason for every unavailable engine.
odai batch reads a JSONL manifest (stdin or --input), runs every task over a single backend launch, and prints one JSON line per entry in manifest order — {"id","ok":true,"value":…} or {"id","ok":false,"error":…}. It exits 0 when the batch ran even if every task failed (failures are in-band lines), 2 on a malformed manifest (checked in full before any task runs), and 69 when no backend is available. --timeout is the per-task budget; --raw is not accepted.
Run the bench evaluation harness against the built-in simulator, or score a
real backend with --backend:
pnpm run bench
pnpm run bench --backend=chrome-builtinContributor commands
pnpm install
pnpm run check
pnpm run testMIT