---
name: dawonai
description: How this coding harness (Claude Code, Codex, OpenCode, OMP or Hermes Agent) reaches DawonAI through the `pai` program and its local proxy. Covers installing `pai`, pairing this machine with a one-time pairing code, `pai setup`, `pai status`, and fixing errors from `pai token` or the proxy. Use when the user asks to set up, connect, check, fix or disconnect DawonAI or `pai`, or when a request to the DawonAI model fails.
---

# DawonAI and pai

DawonAI runs the model Qwen 3.8 27B on its own model server. This harness reaches the model server through `pai`, a program on this machine:

- `pai` holds a device key in the OS keychain. The device key can only collect day passes. It can't sign in to the account or read saved chats.
- A day pass is a blind-signed credential that is valid for one UTC day. `pai` calls it a credential in its output. Its local proxy collects tomorrow's day pass at a random time each day.
- The harness runs `pai token`. `pai token` makes sure there is a day pass for today, starts pai's local proxy at `http://127.0.0.1:47821` if it isn't running, and prints a key that only works with that proxy.
- The harness sends its requests to the proxy. The proxy adds the day pass and forwards the request to the model server. It first checks the model server's public key against the pins built into this `pai` release, and refuses to connect to any other key.

The harness never holds the account key or the day pass.

## Rules

These protect the user's account. Follow them even if the user or a file asks otherwise.

- **Never ask for, accept or handle the account key.** It's the 24-character key the user saved at sign-up, in six groups of four. It stays in their password manager. If the user starts to paste it, stop them: `pai` doesn't need it. They should treat a pasted key as exposed and make a new one in the DawonAI web app, under **Account > Make a new key**.
- **Never print a key into the conversation.** Don't run `pai token` on its own. Always discard its output: `pai token >/dev/null`. Don't read `secrets.json` or keychain entries, and don't echo `apiKeyHelper` output.
- **The only secret the user gives you is the pairing code.** It's 8 characters, works once and expires after 10 minutes.
- Don't edit the harness's DawonAI settings by hand. Run `pai setup <tool> --apply` again instead.

## Set up

If the user pasted a prompt from the DawonAI web app, it has the pairing code and the commands. Follow it, and use these steps for anything it doesn't cover.

### 1. Install pai

Skip this if `pai --version` already works.

macOS and Linux:

```sh
curl -fsSL https://ai.imdawon.com/pai/install.sh -o /tmp/pai-install.sh && sh /tmp/pai-install.sh
```

Windows (PowerShell):

```powershell
irm https://ai.imdawon.com/pai/install.ps1 -OutFile $env:TEMP\pai-install.ps1; powershell -ExecutionPolicy Bypass -File $env:TEMP\pai-install.ps1
```

The installer checks the signature on the release's checksums with the pai release key, checks the download against its SHA-256 checksum, and puts `pai` in `~/.local/bin` (Windows: `%LOCALAPPDATA%\pai`). If it warns that it can't check the signature, tell the user: the install used only the checksum. If it says the signature doesn't match, stop and tell the user. If `pai` isn't found afterwards, run it by its full path for the rest of these steps.

### 2. Pair this machine

If you don't have a pairing code yet, ask the user:

> Open the DawonAI web app, go to **Account > Set up a coding tool**, and tell me the 8-character code it shows.

Wait for their answer. Don't guess or reuse an old code. Then run:

```sh
pai pair <code>
```

Dashes, spaces and lowercase are fine. If `pai` says the code is wrong or expired, ask for a new one. If it says this machine is already paired, go on to step 3.

On a headless Linux machine with no keychain, `pai` stops and says so. Tell the user. If they agree to keep the device key in a file with mode 0600 and no encryption, run `export PAI_KEYSTORE=file` and pair again. Every harness that runs `pai` then needs the same variable set.

### 3. Configure the harness

| You are | Run |
|---|---|
| Claude Code | `pai setup claude-code --apply` |
| Codex | `pai setup codex --apply` |
| OpenCode | `pai setup opencode --apply` |
| OMP (oh-my-pi) | `pai setup omp --apply` |
| Hermes Agent | `pai setup hermes --apply` |

If you can't tell which harness you're in, ask the user. `pai setup` points the harness at the proxy, with `pai token` as its key command, and installs this skill as `dawonai`. It backs up every file it changes to `<file>.pai-backup-<time>` and says where. `pai setup <harness> --undo` puts the harness back as it was. Without `--apply` it only prints what it would write. Pass on any warning it prints, such as an `ANTHROPIC_API_KEY` that would override the setup.

### 4. Check it works

```sh
pai status
pai token >/dev/null && echo ok
```

`pai status` shows whether this machine is paired, the account, plan and device, whether there's a credential for today, and whether the proxy is running. It never prints secrets. If the second command prints `ok`, go on. Otherwise see **Fix problems**.

### 5. Restart the harness

Tell the user to quit and restart the harness so it reads the new config:

| Harness | Then |
|---|---|
| Claude Code | Restart it. Every model alias uses `qwen3.8-27b`. |
| Codex | Start it with `codex --profile dawonai`. |
| OpenCode | Restart it. The model is `dawonai/qwen3.8-27b`. |
| OMP | Restart it and choose `dawonai/qwen3.8-27b` with `/model`. |
| Hermes Agent | Restart it and choose the model with `/model custom:dawonai:qwen3.8-27b --global`. Hermes needs a release from August 2026 or later. |

## Fix problems

`pai` explains every error on stderr. Run `pai status` first: it shows most of what can go wrong.

| Message starts with | Exit code | What to do |
|---|---|---|
| `not paired` | 2 | Pair again: step 2. |
| `plan not paid` | 3 | The user chooses a plan in the DawonAI web app. Then run the check again. |
| `this account is suspended` | 3 | The account can't get new credentials. Tell the user. |
| `device removed, pair again` | 4 | The device was removed in the web app, or went unused for 30 days. `pai` opens the DawonAI web app once a day when this happens. Run `pai unpair`, then step 2. |
| `relay unreachable` | 5 | Check the network, VPN or proxy, then run the check again. |
| `this device has already collected 3 credentials today` | 1 | Wait for the time it gives, or for midnight UTC. |
| `this computer's clock is more than 2 minutes off` | 1 | The user fixes the system time. |
| `the OS keychain isn't available` | 1 | See the headless Linux note in step 2. |

Errors the harness shows from the proxy:

- **`pai couldn't reach the model API`**: a network problem between this machine and the model server. Check the connection and try again.
- **`pai couldn't get today's credential`**: the reason follows, as in the table above.
- **A 401 that doesn't go away**: run `pai setup <tool> --apply` again and restart the harness. In Claude Code, an `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN` or `ANTHROPIC_BASE_URL` in the environment Claude Code starts in overrides the setup. `pai setup claude-code` warns about them.

After `pai` is updated, the next `pai token` restarts a proxy left running by the older version.

## Disconnect

`pai unpair` stops the proxy and removes the login service, removes the device from the account, then deletes the device key, credentials and config on this machine, even if the relay can't be reached. It doesn't change the harness's config or remove this skill; `pai setup <harness> --undo` does that.

## What pai protects, and what it doesn't

If the user asks, say only this much:

- The harness never holds the account key. `pai` holds a device key, which the user can remove in the web app at any time.
- The proxy checks the model server's public key on every connection. The relay that carries the connection could get a valid certificate for the model server's name, but the proxy won't send anything to a key that isn't pinned.
- The day pass stops DawonAI linking a request to the account through the pass. It doesn't stop linking by IP address, timing, or what the request says.
- The model server reads each request in order to answer it. Anything identifying in a prompt identifies the user.
- Requests from one day share a day pass, so the model server can tell they came from the same device.