AI News
商业产业 Hacker News AI 2026-10-10T10:52 正文 ok 1347 words

🔶 Talorys：运行在 Cloudflare 免费层上的自托管个人 AI Agent

英文标题：🔶 Talorys – A self-hosted personal AI agent on Cloudflare's free tier

Talorys 是一款免费、开源的个人 AI 助手，完全运行在用户自己的 Cloudflare 账户中，不依赖 Talorys 开发者运营的服务器、数据库或账户。它提供流式聊天、可编辑记忆、任务与项目管理、定时提醒和自动化功能，并可使用 Cloudflare Workers AI 的 `@cf/zai-org/glm-4.7-flash` 模型。其架构通过私有 Worker、Durable Objects SQLite 和 service binding 隔离 API，不为 Agent 暴露公网 URL。项目面向 Cloudflare Workers Free 计划设计，但 AI 推理及请求等资源仍受 Cloudflare 配额限制。
打开原文相关 3 · 机会 1
media3.2 KB media132.6 KB media109.1 KB media167.0 KB media176.6 KB media89.1 KB media60.8 KB media120.3 KB

中文

你的个人 AI Agent。你自己的云。

Talorys 是一款免费、开源的个人 AI 助手，完全运行在你自己的 Cloudflare 账户内。它可以与你聊天、记住重要事项、管理任务、笔记和项目，并按计划执行提醒和例行任务——无需 Talorys 开发者运营任何服务器、数据库或账户。

一个人。一个 Cloudflare 账户。一条命令。一个个人 AI Agent。

npx create-talorys@latest
  • 私密助手——支持流式响应、Markdown 和工具活动指示器的聊天。
  • 记忆——可持久保存、查看、编辑和删除的个人事实与偏好。每轮对话只会将最相关的记忆发送给模型。
  • 语义检索（可选）——可按语义和关键词查找记忆，并按最新优先列出及显示保存日期。默认关闭；可在“设置 → AI”中开启，或使用 --semantic 安装。参见 docs/semantic-recall.md。
  • 任务、笔记和项目——可在 UI 中完整执行 CRUD，也可通过聊天操作（例如：“明天添加一项任务来审查我的项目”）。
  • 自动化——一次性和循环提醒、每日任务摘要及可选的 AI 例行任务，均会发送到应用内通知中心。它们基于 Durable Object alarms 运行，因此无需任何服务始终在线。
  • 按单用户设计——无注册、无账户、无团队。安装程序会设置所有者密码。
  • 无需 AI 也可运行——即使 Workers AI 不可用，或免费配额已经用完，任务、笔记、记忆和提醒仍可正常工作。
聊天与工具活动 任务
聊天 任务
记忆（深色模式） 自动化
记忆 自动化

移动端 登录

Browser ──HTTPS──▶ Cloudflare Pages (React app + /api Pages Function)
                         │  service binding (no public URL)
                         ▼
                   Private Worker (Hono router)
                         │  getAgentByName("personal-agent")
                         ▼
                   TalorysAgent — Cloudflare Agents SDK Durable Object
                     ├─ SQLite: conversations, memories, tasks, notes, projects,
                     │          automations, sessions, settings, usage
                     ├─ Workers AI: @cf/zai-org/glm-4.7-flash (streaming + tool calling)
                     └─ Alarms: reminders and recurring schedules
  • 浏览器只会与自己的 *.pages.dev 网站通信。/api/* 请求会运行一个 Pages Function，并通过**服务绑定（service binding）**将请求转发至 Agent Worker。
  • Agent Worker 部署时设置了 workers_dev: false 和 preview_urls: false：它没有公网 URL。
  • 身份验证和授权在 Worker 中进行，而不是在前端完成。
  • 聊天响应全链路以 Server-Sent Events 方式流式传输。

更多详情：docs/architecture.md。

3. 使用的 Cloudflare 服务

服务 用途 免费计划
Cloudflare Pages 前端 + Pages Function 是
Cloudflare Workers 私有 API Worker 是
Durable Objects（SQLite） 所有数据、调度 alarms 是
Workers AI 聊天模型（@cf/zai-org/glm-4.7-flash） 是，按日分配额度

Talorys 不会配置 R2、D1、KV、Vectorize、AI Search、Workflows 或任何付费服务。

npx create-talorys@latest

安装程序会：

  1. 检查 Node.js（22+），并使用其内置的 Wrangler CLI（会检测全局安装的 wrangler/cf，但并不要求安装）。
  2. 验证你的 Cloudflare 登录状态，或者在浏览器中打开 Cloudflare 授权页面。
  3. 让你选择账户（如果你拥有多个账户）和 Agent 名称。
  4. 要求设置所有者密码（隐藏输入，并进行强度检查）。密码会使用 PBKDF2-SHA256 在本地哈希，并且仅作为 Cloudflare secret 保存。
  5. 生成一个 256 位会话密钥和唯一资源名称（talorys-<id>-agent、talorys-<id>-web）。
  6. 部署私有 Worker（创建其 SQLite Durable Object），保存 secrets，创建并部署带有 service binding 的 Pages 项目。
  7. 验证线上部署状态（前端、认证端点、未认证访问拦截、存储健康状况），不会运行任何 AI 推理。
  8. 输出 Cloudflare 报告的真实 https://….pages.dev URL。

它会写入一个 talorys/ 目录，其中包含 talorys.json（安装 ID、账户 ID、资源名称、URL——不含 secrets）以及可部署产物。请保留该目录，以便后续更新。

安装中断了？ 在相同位置再次运行同一命令即可。它会协调已存在的资源：不会创建重复资源；如果密码已配置，也不会再次要求输入密码；并且绝不会删除任何数据。

非交互式安装：TALORYS_OWNER_PASSWORD=... npx create-talorys@latest --yes --account-id <id>（未登录时需设置 CLOUDFLARE_API_TOKEN）。

浏览器登录使用 Wrangler 的标准 OAuth 流程——无需 Global API Key。如果改用 API token，则需要以下权限：

  • Account › Workers Scripts › Edit
  • Account › Cloudflare Pages › Edit
  • Account › Workers AI › Read
  • Account › Account Settings › Read
  • User › User Details › Read（可选；用于显示你的电子邮件地址）

参见 docs/deployment.md。

打开安装程序输出的 URL，输入所有者密码，然后开始聊天。你可以从任意数量的设备登录——它们都属于同一位所有者。可在设置 → 安全中管理会话。

忘记密码？在你的 talorys/ 目录中运行：

npx create-talorys@latest reset-password

这将替换密码 secret，并使所有设备退出登录。

所有数据均存储在你的 Cloudflare 账户内一个由 SQLite 支持的 Durable Object（personal-agent）中。Talorys 不包含遥测、分析、追踪或广告代码，也不会向其开发者发送任何信息。

Cloudflare 会为提供其服务而处理你的数据——包括对你的聊天消息，以及每个提示词中包含的相关记忆运行 Workers AI 推理。请查阅 Cloudflare 的隐私政策和 Workers AI 条款。

安全模型与威胁缓解措施：docs/security.md。

7. 免费内容与可能产生费用的内容

Talorys 的设计目标是适配 Cloudflare Workers Free 计划，并且绝不会自行启用付费功能。但这并不意味着“无限免费”：

  • 免费计划具有账户级配额（请求量、Durable Object 使用量、每日 Workers AI Neuron 分配额度）。配额由 Cloudflare 设定，并可能发生变化。
  • 当 AI 分配额度耗尽时，聊天界面会显示清晰提示，并在每日重置后恢复。其他功能会继续运行，数据不会受到影响。
  • 如果你的账户使用付费计划，超出包含额度的使用量将由 Cloudflare 按照你的计划计费。

内置护栏（可在设置 → AI中调整）包括：单次请求最大输出 token 数、最大上下文 token 数（较早历史会被摘要）、最大工具调用次数和推理步骤数、每日最大 AI 请求数，以及每日最大计划 AI 运行次数。简单提醒和任务摘要永远不会使用 AI。“用量”面板会展示本地估算值，并链接至 Cloudflare 控制台以查看精确的 Neuron 用量。

要求：Node.js 22+。

git clone https://github.com/rociiu/talorys.git
cd talorys
npm install
npm run dev

npm run dev 会在一个终端中启动 Agent Worker（wrangler dev，端口 8787）、带有 service binding 的 Pages Function 代理（wrangler pages dev，端口 8788），以及 Vite UI（http://localhost:5173）。它会创建 apps/agent/.dev.vars，其中包含本地密码（talorys-dev-password，可通过 TALORYS_DEV_PASSWORD 覆盖），并使用确定性的模拟 AI provider，因此无需登录 Cloudflare。状态会持久化在 .wrangler/state 中。

其他脚本：npm run build、npm test、npm run test:e2e、npm run test:pack、npm run typecheck、npm run lint。参见 docs/development.md。

设置 → 隐私 → 下载备份会生成 talorys-backup.json，其中包含对话、记忆、任务、笔记、项目、设置和自动化（绝不包含会话或凭据）。导入会验证文件，并在一个事务中合并其内容；重复导入同一份备份不会造成问题。设置中包括实际生效的安装程序默认值。如果导入的时区发生变化，保留的本地自动化任务也会按该时区重新调度。

在你的 talorys/ 目录中运行：

npx create-talorys@latest update

这会将最新版 Worker 和前端重新部署至同一套资源。Durable Object namespace 永远不会被重新创建（迁移仅可追加），所有者密码和会话会被保留，并且 schema 迁移将在首次请求时自动以事务方式运行。还可使用：status 和 doctor。

问题 解决方法
安装程序中途停止 再次运行同一命令；它会继续执行。
“did not pass its health checks yet” 新建的 pages.dev 站点可能需要几分钟。请重新运行。
权限错误 使用你有权编辑 Workers 和 Pages 的账户，或使用具备上述权限的 token。
聊天提示 AI 分配额度已用完 等待每日重置；或在“设置 → AI”中启用 Demo 模式。
多次登录失败后被锁定 等待 15 分钟，或使用 CLI 重置密码。

npx create-talorys@latest doctor 会自动检查所有内容。更多内容参见 docs/troubleshooting.md。

apps/agent              Private Worker: Hono API, TalorysAgent, tools, SQLite repositories
apps/web                React + Vite app, Pages Function (functions/api/[[path]].ts)
packages/shared         Zod schemas, types, recurrence/DST logic, password hashing
packages/create-talorys The one-command installer (npm package)
tests/e2e               Playwright UI tests
tests/smoke             Optional real-account deployment test
docs/                   Architecture, deployment, development, security, troubleshooting

感谢所有为 Talorys 作出贡献的人：

MIT

English / 原文

Your personal AI agent. Your own cloud.

Talorys is a free, open-source personal AI assistant that runs entirely inside your own Cloudflare account. It chats with you, remembers what matters, manages tasks, notes and projects, and runs reminders and routines on a schedule — without any server, database or account operated by the Talorys developers.

One person. One Cloudflare account. One command. One personal AI agent.

npx create-talorys@latest
  • A private assistant — chat with streaming responses, Markdown and tool activity indicators.
  • Memory — durable personal facts and preferences you can view, edit and delete. Only the most relevant memories are sent to the model on each turn.
  • Semantic recall (optional) — finds memories by meaning as well as keyword, and lists them newest first with their saved date. Off by default; turn it on in Settings → AI or install with --semantic. See docs/semantic-recall.md.
  • Tasks, notes and projects — full CRUD in the UI, and from chat ("Add a task to review my project tomorrow").
  • Automations — one-time and recurring reminders, daily task digests and optional AI routines, delivered to an in-app notification center. They run on Durable Object alarms, so nothing has to stay online.
  • Single-user by design — no signup, no accounts, no teams. The installer sets the owner password.
  • Works without AI — tasks, notes, memories and reminders keep working if Workers AI is unavailable or your free quota is used up.
Chat with tool activity Tasks
Chat Tasks
Memory (dark mode) Automations
Memory Automations

Mobile Login

Browser ──HTTPS──▶ Cloudflare Pages (React app + /api Pages Function)
                         │  service binding (no public URL)
                         ▼
                   Private Worker (Hono router)
                         │  getAgentByName("personal-agent")
                         ▼
                   TalorysAgent — Cloudflare Agents SDK Durable Object
                     ├─ SQLite: conversations, memories, tasks, notes, projects,
                     │          automations, sessions, settings, usage
                     ├─ Workers AI: @cf/zai-org/glm-4.7-flash (streaming + tool calling)
                     └─ Alarms: reminders and recurring schedules
  • The browser only ever talks to your *.pages.dev site. /api/* requests run a Pages Function that forwards them over a service binding to the agent Worker.
  • The agent Worker is deployed with workers_dev: false and preview_urls: false: it has no public URL.
  • Authentication and authorization happen in the Worker, not the frontend.
  • Chat responses stream as Server-Sent Events end-to-end.

More detail: docs/architecture.md.

3. Cloudflare services used

Service Used for Free plan
Cloudflare Pages Frontend + Pages Function Yes
Cloudflare Workers Private API Worker Yes
Durable Objects (SQLite) All data, scheduling alarms Yes
Workers AI Chat model (@cf/zai-org/glm-4.7-flash) Yes, daily allocation

Talorys does not provision R2, D1, KV, Vectorize, AI Search, Workflows or any paid service.

npx create-talorys@latest

The installer:

  1. Checks Node.js (22+) and uses its bundled Wrangler CLI (any globally installed wrangler/cf is detected but not required).
  2. Verifies your Cloudflare login, or opens Cloudflare's authorization page in your browser.
  3. Lets you choose an account (if you have several) and an agent name.
  4. Asks for an owner password (hidden input, strength-checked). It is hashed locally with PBKDF2-SHA256 and stored only as a Cloudflare secret.
  5. Generates a 256-bit session secret and unique resource names (talorys-<id>-agent, talorys-<id>-web).
  6. Deploys the private Worker (creating its SQLite Durable Object), stores secrets, creates and deploys the Pages project with the service binding.
  7. Verifies the live deployment (frontend, auth endpoint, unauthenticated rejection, storage health) without running any AI inference.
  8. Prints the real https://….pages.dev URL reported by Cloudflare.

It writes a talorys/ directory containing talorys.json (installation id, account id, resource names, URL — no secrets) and the deployable artifacts. Keep it for updates.

Interrupted? Run the same command again in the same place. It reconciles what already exists: no duplicate resources, no password re-prompt if the password is already configured, and no data is ever deleted.

Non-interactive installs: TALORYS_OWNER_PASSWORD=... npx create-talorys@latest --yes --account-id <id> (with CLOUDFLARE_API_TOKEN set if you are not logged in).

Browser login uses Wrangler's standard OAuth flow — no Global API Key. If you use an API token instead, it needs:

  • Account › Workers Scripts › Edit
  • Account › Cloudflare Pages › Edit
  • Account › Workers AI › Read
  • Account › Account Settings › Read
  • User › User Details › Read (optional; shows your email)

See docs/deployment.md.

Open the URL the installer prints, enter your owner password, and start chatting. Sign in from any number of devices — they are all the same owner. Manage sessions under Settings → Security.

Forgot the password? From your talorys/ directory:

npx create-talorys@latest reset-password

This replaces the password secret and signs out every device.

All data is stored in a single SQLite-backed Durable Object (personal-agent) in your Cloudflare account. Talorys has no telemetry, analytics, tracking or advertising code and sends nothing to its developers.

Cloudflare processes your data to provide its services — including running Workers AI inference on your chat messages and the relevant memories included in each prompt. Review Cloudflare's privacy policy and Workers AI terms.

Security model and threat mitigations: docs/security.md.

7. What is free and what may cost money

Talorys is designed to fit the Cloudflare Workers Free plan and never enables paid features on its own. It is not "unlimited free", though:

  • Free plans have account-level quotas (requests, Durable Object usage, a daily Workers AI Neuron allocation). Quotas are set by Cloudflare and can change.
  • When the AI allocation is exhausted, chat shows a clear message and resumes after the daily reset. Everything else keeps working, and your data is untouched.
  • If your account is on a paid plan, usage beyond included amounts is billed by Cloudflare under your plan.

Built-in guardrails (adjustable in Settings → AI): max output tokens, max context tokens (older history is summarized), max tool calls and reasoning steps per request, max AI requests per day, and max scheduled AI runs per day. Simple reminders and task digests never use AI. The Usage panel shows local estimates and links to the Cloudflare dashboard for exact Neuron usage.

Requirements: Node.js 22+.

git clone https://github.com/rociiu/talorys.git
cd talorys
npm install
npm run dev

npm run dev starts the agent Worker (wrangler dev, port 8787), the Pages Function proxy with its service binding (wrangler pages dev, port 8788) and the Vite UI (http://localhost:5173) in one terminal. It creates apps/agent/.dev.vars with a local password (talorys-dev-password, override with TALORYS_DEV_PASSWORD) and uses the deterministic mock AI provider, so no Cloudflare login is needed. State persists in .wrangler/state.

Other scripts: npm run build, npm test, npm run test:e2e, npm run test:pack, npm run typecheck, npm run lint. See docs/development.md.

Settings → Privacy → Download backup produces talorys-backup.json with conversations, memories, tasks, notes, projects, settings and automations (never sessions or credentials). Import validates the file and merges it in one transaction; importing the same backup twice is harmless. Settings include the effective installer defaults. If an imported timezone changes, retained local automations are also rescheduled in that timezone.

From your talorys/ directory:

npx create-talorys@latest update

This redeploys the latest Worker and frontend to the same resources. The Durable Object namespace is never recreated (migrations are append-only), the owner password and sessions are kept, and schema migrations run automatically and transactionally on first request. Also available: status and doctor.

Problem Fix
Installer stopped midway Re-run the same command; it resumes.
"did not pass its health checks yet" New pages.dev sites can take a few minutes. Re-run.
Permission errors Use an account where you can edit Workers and Pages, or a token with the permissions above.
Chat says the AI allocation is used up Wait for the daily reset; or enable Demo mode in Settings → AI.
Locked out after failed logins Wait 15 minutes, or reset the password with the CLI.

npx create-talorys@latest doctor checks everything automatically. More in docs/troubleshooting.md.

apps/agent              Private Worker: Hono API, TalorysAgent, tools, SQLite repositories
apps/web                React + Vite app, Pages Function (functions/api/[[path]].ts)
packages/shared         Zod schemas, types, recurrence/DST logic, password hashing
packages/create-talorys The one-command installer (npm package)
tests/e2e               Playwright UI tests
tests/smoke             Optional real-account deployment test
docs/                   Architecture, deployment, development, security, troubleshooting

Thanks to everyone who has contributed to Talorys:

MIT