Haven

Free, open-source remote access & mobile workspace for Android —
SSH · Mosh · VNC · RDP · SFTP · SMB · email · cloud storage, a local Linux shell, mesh networking, and a consent-gated AI-agent endpoint

"Haven is an interesting vibe coding experiment. Let's see what comes out of it." — DBP

GitHub Releases • F-Droid

_{▶ Watch: the terminal — and every Haven screen — made translucent over the device wallpaper (new in 5.60.4). Live wallpaper: MagicFluids.}

At a glance

• Terminal — Mosh / Eternal Terminal / SSH, tmux-aware session restore, configurable keyboard toolbar, OSC 7/8/9/52/133/777 integration.
• Desktops — VNC (RFB 3.8 / VeNCrypt), RDP (IronRDP + EGFX), a GPU-accelerated native Wayland compositor, and a multi-distro local-desktop manager.
• Files & cloud — unified browser for SFTP/SCP, SMB, and 60+ cloud providers; cross-filesystem copy/move, editor and image tools; plus on-device FFmpeg transcode, HLS streaming, and DLNA.
• Connections — port forwarding (-L/-R/-D/-J), SOCKS/HTTP/Tor proxies, per-app WireGuard & Tailscale tunnels, port knocking and fwknop SPA, and SSH keys (incl. FIDO2/SK).
• Email — ProtonMail (bridge protocol) and any IMAP/SMTP mailbox; compose / reply / forward, multi-account, attachments; plus Mail Rules inbound automation.
• AI chat — chat with self-hosted or API models (OpenAI-compatible, Ollama, Anthropic, Gemini) over per-profile tunnel routing; image attach for vision models, clipboard copy/paste both ways, opt-in encrypted saved transcripts.
• Local Linux — a Linux userland via PRoot (no root, any Android 8+ device): Alpine, Debian, Arch, or Void, side-by-side.
• USB forwarding — broker an attached USB device through Android and re-expose it to the agent, into the Linux guest, or over USB/IP to a remote host (e.g. a phone-hosted YubiKey, touch on the phone).
• Reticulum — rnsh shell, file transfer, and -L/-D port forwarding over Reticulum mesh, pure Kotlin. The one transport that keeps working with no internet at all.
• Agent transport (MCP) — an optional MCP server exposing ~130 consent-gated, audited tools; the agent can even see and operate Haven itself for a self-hosting build → install → verify loop.
• Security — biometric lock, no telemetry, encrypted backup/restore (AES-256-GCM).

See docs/FEATURES.md for the full feature index.

Why one app

The list above is the parts; the point is how they compose. Each of these is one flow inside Haven — no second app, no curl | ssh incantation:

• Tap a 4K MKV in Google Drive → FFmpeg transcodes it over HTTP and the result lands back in the same Drive folder, never touching local disk.
• SSH to a box, forward its port, tap the VNC profile that targets localhost — the desktop opens in the same app, keyboard and clipboard shared.
• Cut a log directory from an S3 bucket, switch tabs, paste it onto an SFTP server — rclone does the server-side copy when it can, otherwise Haven streams it through.
• Run your agent CLI in the on-device Linux shell; it pushes over the SSH agent you forwarded from your laptop while you watch on the same screen.
• Cast a cloud video to the TV across the room over HLS, copy the LAN URL from the snackbar, send it to a friend so they can watch too.

The phone is the thin client, Haven is the thin-client OS, and the cloud, your servers, and your agents are the computer. Width is sufficient; composition is the point. (Vision.)

Languages

Available in 12 languages: English, Chinese (simplified), Spanish, Hindi, Arabic (with RTL support), Portuguese, Bengali, Russian, Japanese, Korean, French, and German. The UI follows the device language.

Want to help translate? Improve a translation or add a new language straight from the web translation page — no cloning or setup; your changes become a GitHub pull request. See Languages & translation for details.

Install

Both builds have the same features — SSH, Mosh, Eternal Terminal, VNC, RDP, SFTP, SMB, email, and cloud storage. IronRDP (Rust) is built from source via cargo-ndk. rclone (Go) is built from source via gomobile.

Pick one channel and stay on it. The two channels are signed with different keys — GitHub Releases use Haven's own release key; F-Droid builds from source and signs with F-Droid's per-app key. Android treats different signing keys as different apps, so you can't update in place from one channel to the other — switching means uninstall + reinstall, which clears app data (back up first via Settings → Backup). Direct sideloads and Obtainium track the GitHub Releases key.

Signing certificate SHA-256 (to verify a sideloaded APK with apksigner verify --print-certs):

• GitHub Releases: ea03a3a70e1c11d0a78932f959b21f20d8735d9cd750997657cb7f7d7c2b90b3
• F-Droid: ea05a89431961b8ac53c36725452673c2be1c2d7b6e48771617b974e6092b332

Build from source

Requires Rust with Android targets, cargo-ndk, Go 1.26+, and gomobile:

# Rust (for RDP)
rustup target add aarch64-linux-android x86_64-linux-android
cargo install cargo-ndk

# Go (for rclone cloud storage)
go install golang.org/x/mobile/cmd/gomobile@latest
go install golang.org/x/mobile/cmd/gobind@latest

git clone --recurse-submodules https://github.com/GlassHaven/Haven.git
cd Haven
./gradlew assembleDebug

Output: app/build/outputs/apk/debug/haven-*-debug.apk

Documentation

• Features — detailed feature descriptions.
• Backup file format — wire format, the PBKDF2/AES-GCM envelope, and a Python recipe for manual decryption if the in-app importer fails.
• Maintainer Protocol — the /maintain skill driving Haven's maintenance loop (CI triage, release readiness, issue response, and dependency tracking) run by Qwen3.8-Flash running locally via llama-claude, with daily security audit passes performed by GLM5.3-flash.
• Release process — versioning, tagging, and F-Droid steps.
• Privacy policy.
• Vision.

Third-party libraries

Backing

Haven sits on top of the projects listed in the table above — the heavy lifting was done long before this repo existed.

Most of the direction Haven has taken has come from the user base, not from a roadmap: bug reports, screenshots of edge cases, "have you tried…” comments on long issue threads. Qwen3.8-Flash running locally writes most of the actual code; the maintainer's role is closer to that of a messenger between the user group and the model: listening, setting the agenda, and quality-checking.

A small recurring amount comes in via Ko-fi and Liberapay. It helps offset the electricity costs of running the work above, and it's a clear signal that the work is useful to people. The project continues regardless of donations.

License

AGPLv3

• Inline images in the terminal. SSH programs that speak the Kitty or iTerm2 graphics protocol — image viewers, chart tools, preview generators — can now display raster images inline where the cursor is. Each image asks first: a consent dialog with Deny, Allow, and an always-allow latch for the session. Terminal settings carry the policy (Off / Ask / Always, Ask by default), and it is readable and writable over MCP as terminal_inline_images. (#583)
• Dependency updates. Tailscale 1.102.5 in the rclone bridge; uniffi 0.32.2 and smallvec 1.16.2 in the RDP native code.

Which APK?

haven-<version>-<abi>-release.apk — the full app, and what F-Droid carries. If in doubt, take this one.

haven-<version>-<abi>-terminal-release.apk — the same app with the desktop and media parts left out, for people who only use Haven for SSH, terminals, files and storage. Less than half the size on arm64. It drops RDP and SPICE remote desktop, the native Wayland desktop, and ffmpeg — so no media conversion, and no video previews or streaming in the file browser. VNC is kept, so a Linux desktop running inside Haven's guest still works.

Both are signed with the same key and carry the same version number, so you can install either over the other without losing connections, keys or your Linux guest. The shared version number does mean an updater will not offer to move you between them — switching is a deliberate download.

<abi> is your device's CPU: arm64 for essentially every modern phone, armv7 for older 32-bit devices, x64 for emulators.

Full Changelog: https://github.com/GlassHaven/Haven/compare/v5.89.16...v5.89.17