WebX11 Docs

v4.5.22 38 core · ext 160+ commands

🚀 Welcome to newOS4

🎮 New here? Type tutorial in the terminal to start a 2-minute interactive tour!

🖥️ Terminal OS

Full virtual filesystem with ls, cd, cat, touch, edit, find, grep and 50+ Unix-like commands.

🤖 AI Assistant

Built-in AI agent with tool calling, skills, memory, and 28 tools. Just type ai "your question".

🧩 Module System

50 modules across 3 layers — Browse on Modules page → (dynamic, searchable, live status)

📚 Skills

Browse live on the Skills page → (searchable, filterable, no hardcoded lists).

🔤 First 6 Commands

helpShow all commands
lsList files
catView file content
clearClear terminal
touchCreate a file
aiAsk the AI assistant

📋 Workflow

  1. Type help — see every available command
  2. Type ls — browse files in your virtual drive
  3. Type touch hello.txt — create a file
  4. Type edit hello.txt — write something and save
  5. Type ai "summarize this" — let AI analyze your files
  6. Type status — check system health

🔧 Quick Start

Type help to see all 130+ commands grouped by category. Use help <command> for details on a specific one.

The 📋 Quick Commands panel (Ctrl+K) has clickable cards for common tasks.

For the full reference, switch to the 📘 User Guide tab — it covers every module, filesystem, AI, skills, configuration, and all extended modules in detail.

🔧 Module Development API

Ext Module Structure

Modules are ES6 classes with 3 required and 1 optional method:

class MyModule {
  constructor() { this.commands = {}; this.terminal = null; }
  requirements() { return { met: true, missing: [] }; }
  getHelpInfo() { return { 'mycmd': 'mycmd — What it does' }; }
  registerCommands() { this.commands['mycmd'] = (args) => { /* ... */ }; }
}
// Auto-register:
if (typeof window.webx11 !== 'undefined' && window.webx11) {
  webx11.moduleManager.registerModule(new MyModule(), 'url');
}

VFS (Virtual FileSystem) API

Access via this.terminal.fs:

MethodReturnsDescription
readFile(path)string or nullRead file content
writeFile(path, content)booleanWrite string to file
ls(path)arrayList directory entries
mkdir(path)booleanCreate directory
rm(path)booleanRemove file
rmdir(path)booleanRemove empty directory
touch(path)booleanCreate empty file
cd(path)booleanChange current directory
pwd()stringCurrent directory path
mv(old, new)booleanMove/rename file
cp(src, dst)booleanCopy file

AI Tool Definition Format

Add tools to module-aiassist.js in getToolDefinitions() (around line 300):

{
  type: 'function',
  function: {
    name: 'my_tool',
    description: 'What it does — AI reads this to decide when to call it.',
    parameters: { type: 'object', properties: {
      paramName: { type: 'string', description: 'What this param does' }
    }, required: ['paramName'] }
  }
}

Then add a case 'my_tool': handler in runTool() (around line 1000). Return JSON.stringify(...).

Skill Format

Skills are markdown files with YAML frontmatter, stored in /skills/ in VFS:

---
name: my-skill
description: Brief description
tags: [tag1, tag2]
---
# Skill Body

Instructions, examples, and workflows here.

OllamaManager API

Property/MethodDescription
.endpointCurrent Ollama API URL
.currentModelActive model name
.modelsArray of available models
.connectedBoolean connection state
.connect()Connect to Ollama, load models
.chatWithTools()AI chat with tool calling support

window.webx11 Global

The terminal instance is exposed globally as window.webx11 (aliased as webx11). This gives access to everything:

webx11.fs                    // VFS instance
webx11.moduleManager        // Module registry
webx11.ollamaManager        // Ollama connection
webx11.security             // Security manager
webx11.executeCommand(cmd)  // Run a terminal command programmatically
webx11.print(text, type)    // Print to terminal output
webx11.tutorialModule       // Tutorial progress (if active)
webx11.inputField           // DOM input element

⛅ Overview

WebX11 v4.5.24 is a browser-based Unix-like terminal — dynamic modules, AI assistant (Ollama), persistent virtual filesystem, web search, voice input, code editor, and a full skill system. Everything runs client-side in your browser.

🧩 18 Core + 14 Ext

Modules loaded at startup. Shell with pipes, redirects, vars, and scripts.

🤖 Agent with Tools

28 tools — file ops, web search, skills, modules. Destructive action confirmations with inline bar + countdown.

📚 Skills System

Persistent procedural memory. Create, patch, search, export skills for repeatable workflows.

💾 VFS + Sessions

Virtual filesystem persists in localStorage. Save/load/export sessions.

🎤 Voice Input

Speech recognition in the terminal. Works in Chrome, Edge, Safari.

🌐 Web Search

SearXNG + DuckDuckGo fallback + URL fetch/extract. All built-in.

☁️ WebDAV Sync

Push, pull, backup VFS to any WebDAV server.

📱 Mobile First

Touch-optimized. srcdoc HTML preview works on mobile.

✏️ Text Editor

Inline VFS editor — edit <path> opens a modal with save/cancel.

🔗 Aliases

ll, h, cls built-in. Define custom aliases with alias x=y.

🚀 Quick Start

  1. Open index.html in Chrome/Edge
  2. Watch the splash screen load modules
  3. Type help + Enter
  4. Use the quick-action buttons above the input area

First Commands

# List VFS files
ls

# List files faster
ll

# Connect to Ollama AI
ollamaconnect

# Chat with AI
ai what's in this directory?

# Create a file
put hello.txt Hello World

# Edit a file
edit hello.txt

# Search the web
search quantum computing

# Find files
find hello

# Compare two files
diff a.txt b.txt
⌨️ Keyboard Shortcuts
  • Enter — Execute
  • Tab — Cycle autocomplete
  • ↑/↓ — Command history
  • Esc — Hide autocomplete / stop AI
  • | — Pipe: ls | grep hello

📖 New to feedback? How feedback works — which channel to use, what gets sent, and when to expect an answer.

📖 Full Command Reference

⚠️ There is no shell. The terminal splits your line into argv and hands it to one command — it does not interpret ;, &&, || or redirection. Those are now refused with an explicit message instead of being folded into the command's arguments (which used to produce a plausible wrong answer): wc -l a && grep -c x a → refused; run two commands. A single cmd | cmd pipeline works in the interactive terminal (not in the AI run_command tool). wc, grep and friends take one path per call unless documented otherwise — wc -c a b now prints a line per file plus a total.

System

CommandDescriptionExample
helpShow all commandshelp
clear / clsClear terminalcls
echoPrint textecho Hello
memShow memory usagemem
configView/set terminal config (max-lines, history, pipe-buffer)config terminal-max-lines 500
statusSystem statusstatus
font-sizeChange font size (8–32)font-size 16
load-localLoad module from VFS or URLload-local modules/ext/calc.js
startup-modulesOpen startup module selectorstartup-modules
previewPreview HTML in iframepreview test.html
reset memClear AI memory (context, patterns, profile)reset mem --confirm
reset vfsClear virtual filesystem to empty rootreset vfs --confirm
reset configReset all config to defaultsreset config --confirm
reset allWipe everything (nuclear)reset all --confirm
logrotateRotate current.log to dated archivelogrotate
health-checkAudit VFS, modules, logs, trash, skillshealth-check
memory-map-exportGenerate memory map from /memory/index.jsonmemory-map-export
checkpointCreate VFS snapshotcheckpoint
checkpoint-listList VFS checkpointscheckpoint-list
rollbackRestore VFS from checkpointrollback
checkpoint-delDelete a checkpointcheckpoint-del
smart-promptToggle context-aware promptsmart-prompt
testRun test suitetest auto
[ … ] / test …POSIX file and string test for chains — silent, combines with && / ||. Operators: -f -d -e -z -n ! = !=. The expression form of test is routed to this; test with no expression still runs the suite.[ -f /notes.txt ] && echo yes

AI Assistant

CommandDescriptionExample
ai / askChat with AI (tool-calling)ai create a notes file
ai-clearReset conversation contextai-clear
ai-systemView/set system promptai-system
ai-contextShow conversation memoryai-context
ai-allowAllow pending destructive actionai-allow
ai-denyDeny pending destructive actionai-deny
ai-stopCancel running AI requestai-stop
ai-compressManually compress conversation contextai-compress
ai-configView/set AI loop config (max-turns, max-context, max-context-tokens, confirm-timeout(0=disabled), chat-lock-timeout, skill-debounce, trivial-optimization, temperature, top-p, max-tokens, thinking) and AI tool budgets in characters (read-page-chars, read-result-chars, tool-context-budget, fetch-chars — each 500-200000; read-page-chars/read-result-chars use the model default when unset)ai-config max-turns 12
ai-statsPer-tool telemetry for this browser (localStorage webx11_tool_stats): calls, ok %, avg duration, KB returned, truncation rate — for finding which tools flood the AI contextai-stats
debugToggle AI debug mode (ext module)debug
debug-aiToggle AI tool-call debug paneldebug-ai
debug-ai-lastShow last AI response (content, tool calls, errors)debug-ai-last
debug-ai-sendShow what was sent to the AI (messages with roles)debug-ai-send
debug-ai-logDump full tool call log for current sessiondebug-ai-log
archive-listList archived session snapshotsarchive-list
archive-readView an archive by filenamearchive-read 2026-06-25-14-30.json
mem-debugMemory diagnostic (tool call log, heap, localStorage sizes)mem-debug
reset-memClear AI internal logs without touching VFS/configreset-mem

Debug Supervisor

CommandDescriptionExample
debug-statsError summary (total, unique, clusters, top issues)debug-stats
debug-historyShow last N errors with hash, type, severitydebug-history 10
debug-analyzeDeep analysis of a specific error (root cause, fix suggestions)debug-analyze a1b2c3d4
debug-trendsError frequency over time, grouped by day and typedebug-trends 7
debug-fixSuggest and optionally auto-apply fix for an errordebug-fix a1b2c3d4
debug-healthCheck DebugSupervisorModule health statusdebug-health
feedback <message>Send a message to the operator agent (alias hermes); feedback -- <text> forces a messagefeedback download link 403s on mobile
feedback list [status]List stored /stear reports — status new, read or archived (admin)feedback list new
feedback read <id>Show one report in full, including any reply (admin)feedback read 12
feedback reply <id> <text>Publish a reply — the reporter sees it in /stear → My reports; status becomes read (admin)feedback reply 12 shipped in v4.6.92
feedback archive|reopen <id>Move a report between archived and new (admin)feedback archive 12
feedback statsCounts per status plus the dashboard URL (admin)feedback stats
feedback dashboardOpen /admin/feedback.html in a new tab (admin)feedback dashboard
feedback-admin <sub>Admin alias for the feedback subcommands (list|read|reply|archive|reopen|stats|dashboard)feedback-admin stats

Skills

CommandDescriptionExample
skill-listList all skillsskill-list
skill-viewView skill contentskill-view web-scraper
skill-createCreate a skillskill-create name desc "steps" tags
skill-patchUpdate a skillskill-patch name "new content"
skill-deleteDelete a skillskill-delete oldskill
skill-exportExport skill to JSONskill-export myskill
skill-importImport skill from JSONskill-import
skill-syncRebuild skill indexskill-sync
skill-webdav-syncPush all skills to WebDAV as JSONskill-webdav-sync

Config

CommandDescriptionExample
configGet a config valueconfig
config-setSet a config valueconfig-set key value
config-listList all configconfig-list
config-deleteDelete a config entryconfig-delete key
config-exportExport config as JSONconfig-export
config-resetReset all configconfig-reset

📚 Guides

Long-form guides live in the VFS under /guides/. The AI writes them there; you can reach them three ways:

  • guides — list what exists, newest first (this is the index that did not exist before v4.6.63)
  • preview <name> — render an HTML guide in the preview pane
  • cat <name> — read a markdown guide as text

Published guides on this server:

📁 Filesystem

All VFS files persist in localStorage. ls, cd, pwd work like a real terminal. Clickable output — tap a file to cat, tap a dir to cd.

CommandDescriptionExample
ls / llList filesll
cdChange directorycd notes
pwdPrint working directorypwd
catView filecat readme.txt
putCreate file with contentput hello.txt Hello World
editOpen in modal editoredit notes.md
rmDelete filerm temp.txt
mkdirCreate directorymkdir projects
rmdirRemove directoryrmdir empty
trashMove file to trashtrash temp.txt
trash-dirMove directory to trashtrash-dir olddir
ls-trashList items in trashls-trash
empty-trashPermanently delete all trash itemsempty-trash
mvMove/renamemv old.txt new.txt
cpCopy filecp a.txt b.txt
touchCreate empty filetouch newfile.txt
treeDirectory treetree
findRecursive file searchfind .txt
diffCompare two filesdiff a.txt b.txt
grepSearch file contentsgrep hello *.txt
headFirst N lineshead file.txt 10
tailLast N linestail file.txt 10
sortSort file linessort file.txt
wcCount lines/words/charswc file.txt
duDisk usagedu
uploadUpload file from deviceupload
downloadDownload filedownload file.txt
vfs-sizeShow VFS size report (top files, system dirs)vfs-size
vfs-cleanNuke snapshots, sessions, and trashvfs-clean
vfs-exportDownload VFS as JSONvfs-export
vfs-importImport VFS from JSONvfs-import
session-saveSave a session snapshotsession-save
session-loadLoad a session snapshotsession-load mysession
session-listList all saved sessionssession-list
session-deleteDelete a sessionsession-delete old
session-exportExport session as JSON downloadsession-export mysession
session-importImport a session from filesession-import
sed -n 'N,Mp' | s/a/b/ | /pat/d | -iPrint or edit VFS file lines
filesOpen the Files panel

🤖 AI Assistant

Tool-Calling Agent The AI runs a full agent loop with 28 tools: filesystem, web search, URL fetch, skills, WPM, session memory, user profile, module introspection.

How It Works

  1. Type ai <request>
  2. AI loads relevant skills + recent session memory
  3. Decides which tools to call (up to 8 turns)
  4. Destructive tools trigger an inline confirm bar — no dark overlay
  5. 120s countdown: yellow → bold red at 30s → pulsing at 10s
  6. Type ai-allow / ai-deny or tap the buttons
  7. After complex tasks, AI suggests creating a skill
⚠️ Destructive Tools write_file, delete_file, make_directory, edit_module require confirmation before executing. run_command only requires confirmation for destructive commands (rm, kill, format) — safe-read commands like ls, find, tree are auto-approved.

Available Tools

ToolDescriptionDestructive?
list_filesList VFS directory❌
read_fileRead file (8k trunc)❌
write_fileWrite to file✅
make_directoryCreate directory✅
delete_fileDelete file/dir✅
get_statusSystem status❌
get_helpList commands❌
web_searchSearXNG + DDG❌
web_fetchExtract URL content❌
run_commandExecute terminal cmd (safe-read auto-approved)❌ (only destructive cmds)
load_skillsSearch relevant skills❌
create/patch/list_skillsSkill management❌
view/edit/test/reloadModule operationsedit ✅
user_get/set/list/forgetUser profile❌
session_save/load/recent/statsSession memory❌
vaultmind_connectConnect wallet to VaultMind AI (reads key from SecretVault)❌
vaultmind_statusCheck VaultMind session status❌
vaultmind_queryQuery VaultMind: prices, portfolio, chat❌
webx <question>Ask the assistant (short alias of webxai)
webxai <question>Ask the assistant a one-off question
wx <question>Alias of webxai
ai-model [name]Show or set the active model
ai-ignore <path>Exclude a path from AI context
commit-statusShow the pending AI file-commit batch
commit-approveApply the pending AI file commits
commit-denyDiscard the pending AI file commits
contextShow the active AI context profile
contextsList context profiles
context-new <name> <display> <systemPrompt>Create a context profile
context-delete <name>Delete a context profile
context-auto on|offAuto-switch contexts
smart-ask <question>Ask with automatic context selection

Sound Notification

A short "ding" plays via WebAudio when AI finishes. Toggle with the 🔊 Sound button in quick-actions. Persists in localStorage.

🔄 Agent Loop Studio

Pluggable Agent Loops Switch between profiles that control max turns, tool sets, temperature, system prompt directives, and loop behavior — without restarting.

Commands

CommandDescription
agent-loopsList all profiles with turns, tools, and benchmark results
agent-loops <name>Switch to a named profile
agent-loops new <name> <desc>Create a new profile from defaults
agent-loops edit <name> <key> <val>Edit a profile setting (dot-notation, e.g. loop.maxTurns 12)
agent-loops delete <name>Delete a profile (not default)
agent-loops clone <src> <dst>Clone a profile
agent-loops export <name>Export profile as JSON
agent-loops reset <name>Reset profile to defaults
bench <profile> [--tasks=ids]Run benchmark suite on a profile (6 tasks: fs-navigate, fs-create-read, nvfs-resolve, web-search, multi-tool, code-edit)
bench-compare <p1> <p2>Compare benchmark results of two profiles

Default Profiles

ProfileTurnsToolsTempUse Case
default8allinheritBalanced general-purpose
minimal44 (custom)0.3Fast, low-token simple tasks
research67 (custom)0.5Read-only web + file exploration
safe8all (destructive disabled)0.5No destructive tools
creative12all0.9More turns, higher creativity
coder10all0.2Code-focused with append directive

System Prompt Layering

CommandEffect
ai-system +"directive"Prepend a directive to the active profile's system prompt (persists to profile)
ai-system -"directive"Append a directive to the active profile's system prompt (persists to profile)
ai-system "text"Full replace (persists to localStorage, overrides profile)
ai-system resetRestore default system prompt

Self-Improvement

After each AI run, _postRunReview() detects anomalies: near-max-turns, high token usage, tool failures, and above-benchmark consumption. Lessons are auto-saved as VFS skills under /skills/loop-lesson-*.

AI Tools

The AI can also manage profiles via tools: agent_loop_list, agent_loop_switch, agent_loop_create, agent_loop_benchmark.

📚 Skills System

Dynamic Browser Skills are now in a dedicated dynamic page →. Search, filter by category, browse all 17 skills with descriptions and tags — no more hardcoded lists.

📄 skills.html

Dynamic skill browser — searchable, filterable card grid with tag badges, category pills, and update dates. Zero hardcoded data.

📘 guide.html

Quick user guide with anchor-navigable sections, module refs, and command examples.

Terminal Commands

# List all skills
skill-list

# Create a skill
skill-create my-skill "Does X" "Steps to do X" "tag1,tag2"

# View / patch / delete
skill-view my-skill
skill-patch my-skill "Updated steps"
skill-delete my-skill

# Export / Import
skill-export my-skill
skill-import

Auto-Creation

When the AI encounters the same tool error 3+ times, a workaround skill is auto-created. Every 20 messages, skills are audited for staleness.

CommandDescription
learn-skill <topic>Learn a new skill from a topic
skill-validate <name>Validate a skill file
skill-auditAudit all installed skills
skill-restore <name>Restore a skill from its backup
skill-pack-coreInstall / verify the core skill pack

🤖 Ollama

Local or Remote AI WebX11 connects to any Ollama instance. All tool-calling and chat features require a connection.

Setup

# Install & pull a model
curl -fsSL https://ollama.com/install.sh | sh
ollama pull llama2

# Start Ollama
ollama serve

# In WebX11
ollamaconnect

Commands

CommandDescription
ollamaconnectConnect to Ollama
ollamasetproxySet remote endpoint
ollamamodelsList models
ollamasetmodelSet active model
ollamadisconnectDisconnect
ollamaOpen Ollama Manager UI
modelsList all models
model-infoModel details
model-pullPull a model
model-deleteDelete a model
model-runRun model with prompt
🔌 CORS for Remote OLLAMA_ORIGINS="*" ollama serve

🌐 Search & Web

SearXNG + DDG + URL Fetcher Three modules provide comprehensive web capabilities via the proxy API.
CommandModuleDescriptionExample
search / sSearXNGWeb searchsearch raspberry pi
fetch / webFetcherFetch URL contentfetch https://example.com
extractFetcherClean readable textextract https://news.article
imagesSearXNGImage searchimages cats
videos <query>Video search via SearXNG

The AI agent also has web_search and web_fetch tools using the same APIs.

🎤 Voice & Sound

Speech Recognition A 🎤 button in the input area activates SpeechRecognition. Chrome, Edge, Safari 14.1+. Not Firefox.
  • Tap 🎤 to start listening — button pulses green
  • Say your command — recognized text fills the input
  • Tap again or wait to stop
  • Red flash indicates failure

Sound

Toggle AI response "ding" with the 🔊 Sound button. Persists in localStorage.

CommandDescription
speak <text>Speak text aloud (TTS)
voiceVoice settings and microphone test
analyze <file> [--frames N] [--spectrogram] [--beats] [--scene]Analyze an audio or video file

⚙️ Configuration

All config values stored as webx11_config_* in localStorage. Use the ⚙ Config button or CLI commands.

Notable Keys

KeyDescriptionValues
webx11_config_ai_soundAI sound toggleon, off
webx11_config_voice_visibleMic button visibilityon, off

Persisted State

KeyDescription
webx11_filesystemVFS JSON
webx11_modulesLoaded module URLs
webx11_ollama_endpointOllama API URL
webx11_ollama_modelSelected model
webx11_startup_modulesStartup selection
webx11_font_sizeFont size (8–32)
webx11_command_historyCommand history
webx11_terminal_outputPersisted output
webx11_ai_contextAI conversation history
webx11_user_profileAI user profile
webx11_aliasesUser-defined aliases
bugGenerate a bug report from the current session
factory-reset-old --confirmLegacy full reset (prefer factory-reset)
setfont <px>Set terminal font size (alias of font-size)

🔒 Secret Vault

Encrypted Secrets Manager AES-256-GCM encrypted key-value storage in localStorage. Lock/unlock with a PIN — secrets are never stored in plain text. Vault status persists across sessions.
CommandDescription
secret-setEncrypt and store a secret
secret-getDecrypt and display a secret value
secret-listList all stored secret names
secret-delRemove a stored secret
secret-lockLock the vault (clears key from memory)
secret-unlockUnlock the vault with PIN
secret-setpinSet or change vault PIN
secret-statusShow vault status (locked/unlocked/pin set)
encrypt <path> <passphrase>AES-256-GCM encrypt a VFS file
decrypt <path.enc> <passphrase>Decrypt a .enc file

🧠 VaultMind AI

Hyperliquid AI Assistant VaultMind is an AI-powered wallet assistant for Hyperliquid. It provides market data, portfolio analysis, transaction analysis, and AI chat agents.

Setup

  1. Store your Hyperliquid private key: secret-set hyperliquid_key 0x...
  2. Ask the AI to connect: ai connect to vaultmind or use the vaultmind_connect tool
  3. Check status: ai check vaultmind status or vaultmind_status

AI Tools

ToolDescription
vaultmind_connectReads hyperliquid_key from SecretVault, authenticates with VaultMind backend, stores session token
vaultmind_statusChecks if a valid VaultMind session token exists in localStorage
vaultmind_queryQuery endpoints: prices, portfolio, transactions, copy-trade, or chat with an AI agent

API Endpoints (proxied via nginx)

PathBackend
/vmai/Proxied to VaultMind backend at 127.0.0.1:8000
/vmai-api/Alias for frontend chat — also proxied to 127.0.0.1:8000
vaultmind-connectConnect VaultMind to the trading API
vaultmind-statusVaultMind connection and balance status
vaultmind-query <prices|portfolio|transactions|copy-trade|chat>Query VaultMind
wallet-lookup <address>Look up a wallet address

🧩 Module System

25 Core + 17 Ext Modules loaded in dependency order at startup. Toggle ext modules with ⚙ gear on splash.

Commands

CommandDescription
modulesOpen Module Manager UI
loadmod <url>Load module from URL
removemod <name>Remove a module
listmodsList all loaded modules
load-localLoad module from VFS or URL
loadlocalAlias for load-local
js <expr>Evaluate JavaScript in page context (browser only — no Node built-ins such as fs)
js-run <path>Load and execute a JS file from VFS (browser only — no Node built-ins)
startup-modulesConfigure boot modules
module-load <name>Load a module by name
module-unload <name>Unload a module
module-enable <name>Enable a module for startup
module-reset <name>Reset a module to its shipped source

Boot Order

  1. Splash screen with ⚙ gear
  2. Foundation: virtual-fs.js → module-manager.js → ollama-manager.js → terminal.js
  3. Built-in modules loaded async
  4. Ext modules loaded if selected
  5. Splash hides, terminal ready

Code Editor

The AI can edit_module(name) to copy source into the Code Editor modal. Edit inline, then 💾 Save & Test to load live from /_mods/. Use test_module without reloading the page.

You can also type edit modules/ext/foo.js — the editor now mirrors saves to _mods/<name>.js so test_module works from either path.

🧰 Extended Modules

WebDAV Sync

CommandDescription
webdav-configConfigure server
webdav-statusConnection status
webdav-lsList remote dir
webdav-pushPush file
webdav-pullPull file
webdav-backupBackup VFS
webdav-restoreRestore VFS
webdav-backup-listList backups
webdav-browserVisual file explorer modal

Calculator & Cron

CommandModuleDescription
calccalc.jsEvaluate math / unit conversion
cron-everycron.jsSchedule a command
cron-listcron.jsList scheduled jobs
cron-stopcron.jsStop a job
cron-clearcron.jsClear all jobs

Theme, WPM & Mindmap

CommandModuleDescription
themetheme.jsSet color theme (dark, light, amber, cyber, …)
wpmwpm.jsPackage manager
mindmapmindmap.jsShow file structure as mindmap

Server Monitor

CommandDescription
serverAdd server to monitor
serversList monitored servers
server-checkPing a server
server-removeRemove server
monitorToggle auto-monitoring
course open <lessonId> | course listCourse browser
kanban add <task> | list | done <id>Task board
three add text <text> | reset | screenshot3D scene commands
gui-run <command>Run a command and render its output in the GUI panel
gui-text <content>Render text in the GUI panel
gui-clearClear the GUI panel
gzip <path>Compress a VFS file to .gz
wget <url> [filename]Download a URL and save it to the VFS

Aliases

Built-in: ll = ls, h = help, cls = clear. Define custom: alias x=ls -la. Remove: unalias x. Persists in localStorage.

🔧 BusyBox Utilities

16 Unix Utility Commands Lightweight utility commands for everyday terminal work — identity, path, text, and system info tools. All work standalone and with shell pipes.
CommandDescriptionExample
whichLocate command in module registry + fuzzy suggestionswhich ls
envList local env vars (webx11_, ollama, user profile)env
dateCurrent time (local, ISO, UTC, Unix timestamp)date
calASCII calendar for any month/yearcal 12 2026
yesOutput repeated string (capped at 50)yes test
seqGenerate number sequenceseq 1 5
base64Base64 encode/decodebase64 -d aGVsbG8=
printfFormatted print (%s, %d, %f)printf "hello %s" world
cutExtract column from filecut -f2 -d, data.csv
uniqFilter adjacent duplicatesuniq lines.txt
hostnameShow host/platform infohostname
whoamiShow current userwhoami
basenameStrip directory from pathbasename /a/b/c.txt
dirnameStrip filename from pathdirname /a/b/c.txt
sleepCountdown delay (1-30s)sleep 3
expandConvert tabs to spacesexpand code.txt

All file-reading commands (cut, uniq, expand) work with shell pipes: cat data.csv | cut -f2 -d, | uniq.

🪟 Floating UI Elements

Buttons, Menus & Panels Create persistent floating UI elements that survive page reload — buttons that run commands, collapsible menus with sub-buttons, and informational panels.
CommandDescriptionExample
floating-addAdd a floating element (btn, menu, or panel)floating-add btn quick-status ls -la
floating-removeRemove a floating elementfloating-remove quick-status
floating-listList all floating elementsfloating-list
floating-posReposition an element (x y in px, or auto)floating-pos menu1 100 200
floating-clearRemove all floating elementsfloating-clear
floating-toggleShow/hide a floating elementfloating-toggle menu1

Usage Examples

# Simple button — click to run a command
floating-add btn quick ls -la

# Menu with sub-buttons (btn:Label:command)
floating-add menu tools Tools btn:Status:status btn:Help:help btn:Check:health-check

# Panel with info text
floating-add panel info "Server: production | Uptime: 12d"

# You can drag buttons and menu headers to reposition them
# Position persists across page reloads

🔍 Runtime Debug — /sys/

Virtual /sys/ filesystem Live runtime state mounted as browsable VFS files. Cat, grep, tree, find all work — no special commands needed. Never persisted to localStorage.

Path Reference

# Overview
cat /sys/info

# Memory
cat /sys/heap/stats
cat /sys/heap/breakdown

# AI Internal Logs
cat /sys/logs/tool-calls
cat /sys/logs/errors
cat /sys/logs/commands

# VFS Stats
cat /sys/vfs/stats
cat /sys/vfs/largest

# Module Info
ls /sys/modules/
cat /sys/modules/calc/info

# DOM / Config
cat /sys/dom/node-count
cat /sys/config/ai
cat /sys/config/version

Also available: mem-debug (one-shot text output), reset-mem (clear AI internal logs without touching VFS or config), and the DebugSupervisorModule (debug-stats, debug-history, debug-analyze, debug-trends, debug-fix, debug-health) for persistent error tracking and root-cause analysis.

🐚 Shell

Pipes · Redirects · Variables · Scripts The shell module sits on top of every command — pipes, redirections, variable substitution, command chaining, and VFS script execution work automatically without any prefix.

Pipes |

Chain commands by piping stdout to the next command's stdin. Pipe-aware commands (grep, head, tail, sort, wc, cut, uniq, expand) auto-read from pipe when no file argument is given.

# Filter file listing
ls | grep .md

# Count lines matching pattern
cat notes.txt | grep error | wc

# Pipeline: filter → sort → head
cat data.csv | grep 2026 | sort | head -5

Redirects > >> <

# Write output to file
cal > /tmp/calendar.txt

# Append to file
echo "new line" >> log.txt

# Read file as stdin
grep error < log.txt

Command Chaining

# AND: next runs only if previous succeeds
touch test.txt && echo "created"

# OR: next runs only if previous fails
rm nonexistent || echo "failed"

# Sequence: runs in order regardless
cd /skills; ls

Variables

# Set a variable
export GREET=hello

# Reference in any command
echo $GREET

# List all vars
set

# Remove a var
unset GREET

Scripts

VFS files with .sh extension can be executed line by line. Variables persist across lines.

# Create a script in VFS
echo 'export NAME=WebX11' > greet.sh
echo 'echo "Hello, $NAME!"' >> greet.sh

# Run it
script greet.sh
sh greet.sh

Shell Commands

CommandDescription
export <var>=<val>Set a shell variable
unset <var>Remove a shell variable
setList all shell variables
script <path.sh>Run a VFS script file
sh <path.sh>Alias for script — run a VFS script file
alias [name=value]List aliases or set a custom alias name=command
unalias <name>Remove a custom alias
h · s · llShort aliases: h = help, s = web search, ll = detailed listing
dashboard [--watch|--stop]Collect live telemetry and open the dashboard page; --watch re-collects every 5 s
cost [on|off]Retail prices per model, today's anonymous free-message allowance and this session's token spend; on/off toggles a per-reply cost line (usage is an alias)
usage [--json] [--reset]LLM token usage report for this browser (per model, cost estimate)
dfVirtual filesystem usage
freeJS heap / memory snapshot
topBusiest commands and modules by activity
psCommands and follows currently running
history [--search <term>]Command history, optionally filtered
run <script>Execute a saved script from the VFS
sysmsg [on|off]Toggle system messages
view_module <name>Print a module's source
node <script.js>Run a JS file from the VFS (alias of js-run)

🪄 Floating UI

Remixable floating buttons · Menus · Panels The Floating Module lets you or the AI spawn persistent floating UI elements that survive page reloads. All state is kept in localStorage.
CommandDescription
floating-add btn <id> <label> <command>Spawn a floating button that runs a terminal command
floating-add menu <id> <label> btn:Sub|cmd ...Spawn a collapsible floating menu with sub-buttons
floating-add panel <id> <title> <content>Spawn a floating text panel
floating-remove <id>Remove a floating element
floating-listShow all floating elements with IDs and positions
floating-pos <id> <x|auto> <y|auto>Reposition a floating element
floating-toggle <id>Show/hide a floating element
floating-clearRemove all floating elements
# Create a button
floating-add btn files "📁 Files" ls

# Create a collapsible menu
floating-add menu tools "🔧 Tools" btn:Help|help btn:Clear|clear

# Create a status panel
floating-add panel status "📊 Status" "Ready"

# List all elements
floating-list

# Hide without removing
floating-toggle files

🔒 Security & Guardrails

Protecting Your Terminal Three layered protections — guardrails block dangerous patterns, confidence escalation requires AI to self-assess, shadow VFS previews filesystem impact.

Guardrail Policy

Pre-execution guardrails intercept AI tool calls and block or warn on patterns matching dangerous operations:

RuleDescriptionSeverity
rm-rf-blockPrevent recursive force deletes🔴 deny
curl-pipe-bashBlock curl-to-bash execution🔴 deny
rm-outer-vfsBlock deletion of sensitive metadata files🔴 deny
mass-deleteBlock mass-delete operations🔴 deny
chmod-777Block world-writable permissions🔴 deny
eval-dangerBlock dynamic code execution (eval/exec/system)🔴 deny
external-dlExternal file download warning🟡 warn
env-overwriteModifying environment variables🟡 warn

Commands

CommandDescription
guardrailShow guardrail policy rules and violation count
guardrail-add <id> <severity> <pattern> <tools...>Add a custom guardrail rule (severity: deny/warn)
guardrail-remove <id>Remove a guardrail rule
shadow <command>Execute command in Shadow VFS — snapshot, run, diff changes
shadow-commitAccept shadow VFS changes
shadow-rollbackUndo shadow VFS changes

Confidence Escalation

When the AI requests destructive actions, it must declare Confidence: N% in its reasoning. Below 90%, manual approval is required. If no confidence is declared, manual approval is required by default. This prevents the AI from making low-confidence destructive changes.

💬 Sessions

Sessions persist AI conversation logs in VFS /memory/. The AI auto-loads recent sessions at start for continuity.

AI Tools

ToolDescription
session_saveSave summary
session_loadLoad by date
session_recentShow last N
session_statsAggregate statistics
session-newStart a fresh AI session (clears context, keeps history)

The terminal auto-saves session state every 60s and auto-restores on page reload.

💾 Storage

localStorage Persistence Everything survives hard refreshes via 15+ localStorage keys.
# Clear all WebX11 data
localStorage.clear()
location.reload()

# Back up / restore VFS
vfs-export
vfs-import

~5–10MB per domain. Only URLs (not code) are stored for modules.

☁️ WebDAV

Cloud sync with your WebX11 space. File-tree browser UI with bulk actions.

CommandDescription
webdav-config <url> <token>Configure WebDAV connection
webdav-statusShow sync status and connection health
webdav-ls [path]List remote files
webdav-push <local> [remote]Upload file to cloud
webdav-pull <remote> [local]Download file from cloud
webdav-browserOpen file-tree browser UI with checkboxes, context menu, inline rename, per-file preview 👁 / open-in-new-tab ⛶ buttons, minimize-to-floating and share-URL header buttons
webdav-rm <path>Delete remote file/directory
webdav-mkdir <path>Create remote directory
webdav-rename <old> <new>Rename remote file
webdav-move <src> <dst>Move remote file (alias for rename)
webdav-backupBackup entire space
webdav-login <user>Store WebDAV credentials for this session

Browser Features

  • Checkbox select + Select All toggle
  • Bulk action bar: Delete, Move, Download selected files
  • Inline rename: double-click filename
  • Right-click context menu with all operations
  • Breadcrumb navigation
  • Create-directory button
  • Keyboard shortcuts: j/k navigate, Space select, Enter open

🤖 Agent Orchestration

Register, list, and delegate tasks to AI agents with lease-based lifecycle management.

CommandDescription
agent-listList all registered agents with status
agent-status <id>Show detailed status for a specific agent
agent-register <name> <model>Register a new AI agent
agent-unregister <id>Remove an agent from the registry
lease-listShow active leases — agent tasks with status and TTL
orchestrate <task>Delegate multi-step task to agent orchestrator
orchestrate-parallel <task>Decompose and run sub-tasks in parallel (auto-splits on "and"/"then")
orchestrate-decompose <task>Preview how a task would be split into sub-tasks
orchestrate-resultShow results of the last parallel batch
orchestrator-statusShow orchestrator agent pool status
orchestrator-listList all spawned agents with full details
orchestrator-spawn <role> [caps...]Spawn a new worker agent
orchestrator-sleep <id>Suspend agent to VFS (survives reload)
orchestrator-wake <id>Restore agent from VFS sleep state
orchestrator-kill <id>Terminate an agent and revoke leases
orchestrator-purgeRemove dead agents (>60s silent)
orchestrator-config <key> <value>Tune: spawn-limit, spawn-strategy, heartbeat-timeout, idle-timeout, restart-policy, a2a-polling (on/off), a2a-poll-interval, heartbeat-check, idle-sweep-interval, dead-purge-timeout, consensus-size, consensus-strategy, consensus-timeout, pipeline-auto-fix, pipeline-stage-timeout (persisted)
orchestrator-restart-policy <id> <policy>Set per-agent restart policy: on-failure, always, never
consensus <question>Consensus: spawn N agents, debate, resolve by majority vote
consensus-statusShow current/active consensus round status
consensus-historyShow past consensus rounds and resolutions
pipeline <test|deploy|verify|history|config>Autonomous CI/CD: test agents/modules, deploy (test→auto-fix→verify), history, config
lease-create <agent-id> [duration] [task]Create a time-bound lease for a worker agent
lease-listShow active leases — agent tasks with status and TTL
lease-revoke <id>Revoke an active lease
lease-renew <id> <seconds>Extend an active lease by N seconds
orchestrator-schedule <role> <interval_s> <task...>Schedule a recurring task for a role
orchestrator-schedulesList scheduled tasks
orchestrator-unschedule <id>Remove a scheduled task

📜 A2A Contracts

Define and enforce agent-to-agent contracts with input/output schema validation. Contracts are stored in /.contracts/ and validated during orchestrator delegation.

CommandDescription
a2a-send <agent-id> <json>Send an A2A message to an agent's VFS inbox
a2a-listShow all A2A messages with pending status
contract-register <role> [fields...] --output [fields...]Register a contract with input/output schema
contract-listList all registered contracts
a2a-post <to> <type> <capability> <payload>Post a message to another agent's mailbox
a2a-pollRead your own inbox
a2a-ack <id>Acknowledge a message
a2a-reject <id>Reject a message
a2a-statusMailbox counters per agent
a2a-pruneDrop old and acknowledged messages

🧠 Neural VFS

Semantic concept-indexing layer over the hierarchical VFS. Scans files and builds a concept → path mapping using filenames, tags, and headers.

CommandDescription
memgraph-statusMemory graph node/edge counts
memgraph-search <q>Find nodes by label or type
memgraph-statsMost connected nodes, strongest edges
memgraph-exportExport graph as JSON
memgraph-pruneRemove stale low-weight edges
nvfs-statusShow index stats and last scan time
nvfs-resolve <concept>Find files related to a concept (exact + fuzzy)
nvfs-tree [concept]Show concept-to-file mapping tree
nvfs-config [key] [value]View/set config (fuzzy-limit, tree-files, tree-concepts, resolve-files, deep-index, deep-model)
nvfs-alias list|add|remove|clearManage concept aliases
nvfs-sync [--deep]Incremental background sync dirty files
nvfs-saveForce-save semantic index to VFS disk
nvfs-cancelCancel running index operation
nvfs-index-graph [--deep]Build the NVFS index dependency graph

📊 Server Monitor

Uptime monitoring for external services + self-optimization telemetry tracking tool latency and error rates.

CommandDescription
server <name> <url>Add a server to monitor
serversList all monitored servers
server-check <name>Check a server's current status
monitorToggle auto-monitoring (60s interval)
system-healthTool latency, VFS stats, modules, memory, error rates
predict <task>Predict task duration, tool turns, and confidence
predictor-statusPrediction model accuracy and data points
predictor-config <k> <v>Tune confidence-threshold, min-data-points

🔧 Debug Panel

Toggle the debug overlay to monitor system internals in real-time.

CommandDescription
debugToggle debug panel on/off
debug-syncPush debug records to the configured sync endpoint
debug-sync-url <url>Show or set the sync endpoint
feedback <message>Send feedback to the WebX11 maintenance agent (appears in its next triage run)feedback download link 403s on mobile
feedback-inboxRead replies from the maintenance agent (requires an admin session)feedback-inbox

Debug Panel Shows

  • Memory — localStorage usage, VFS size, session context size
  • Events — registered event listeners, module event bindings
  • Errors — recent JS errors with stack traces
  • Modules — loaded count, broken references, cache state

Useful for troubleshooting module load failures, VFS corruption, and AI context bloat.

🧪 Sandboxed Execution

WebWorkers provide isolated contexts for task execution. Each worker gets a VFS snapshot so operations don't interfere with the main terminal.

CommandDescription
sandbox-statusShow worker pool health and task metrics
sandbox-config <k> <v>Configure max-workers, min-workers
sandbox-run <task>Execute a task in the sandbox pool

orchestrate --sandboxed <task> routes delegation through the sandbox for full isolation.

🧠 Memory Graph

Cross-session persistent graph database tracking files, concepts, tasks, and tools. Nodes store metadata, edges record relationships with weighted strength. Survives page reloads via VFS persistence.

CommandDescription
memgraph-statusShow node/edge counts and graph health
memgraph-search <q>Find nodes by label, type, or id
memgraph-statsMost connected nodes and strongest edges
memgraph-exportExport full graph as JSON to VFS
memgraph-pruneRemove stale low-weight edges (>30d, <3 uses)
memgraph-learn <entity> <fact>Add a fact to the memory graph
memgraph-agent <agentId>Show one agent's memory subgraph
memgraph-session [YYYY-MM-DD]Show a day's session graph
memgraph-decay-config <days> <min_uses>Tune memory decay

Context is automatically injected into AI prompts for cross-session awareness.

🌐 World Model

System self-awareness engine. Synthesizes data from memory graph, module system, skills index, telemetry, and agent pool into a unified model at /system/world-model.json. Auto-refreshes every 5 minutes.

CommandDescription
world-modelShow full world model breakdown
world-model-summaryOne-line system status summary
world-model-ask <q>Query modules, skills, agents, health, or changes
world-model-refreshForce re-synthesis immediately
world-model-config <k> <v>Tune refresh-interval and max-projects

🔒 Security

FeatureStatus
Input Validation✅
Output Escaping✅
No eval() on User Input✅
Path Traversal Prevention✅
Sandboxed File System✅
AI Destructive Confirmations✅ Required + 120s countdown
Iframe Preview Sandbox✅ allow-same-origin allow-scripts

Security Levels

LevelBehavior
0Unrestricted — all commands allowed without confirmation
1 (default)Confirm destructive actions (rm, overwrite, etc.)
2Deny sensitive commands (rm -rf, encrypt operations)
3Deny all dangerous commands (requires deliberate override)
CommandDescription
security-level <0-3>Set active security level
securityShow full status: level, blocked count, destructive/system/whitelist sets, suspicious flags, registered commands
security-destructive listShow destructive command set
security-destructive add|remove <cmd>Add/remove command from destructive set (persisted)
security-system listShow system command set
security-system add|remove <cmd>Add/remove command from system set (persisted)
security-whitelist listShow whitelist command set
security-whitelist add|remove <cmd>Add/remove command from whitelist (persisted)
security-flag listShow suspicious flags
security-flag add|remove <flag>Add/remove suspicious flag (persisted, -- prefix optional)
cmd-allow <command>Add command to allowlist (bypasses restrictions)
cmd-deny <command>Add command to denylist (always blocked)
⚠️ Module Loading Only load modules from trusted sources — they have full terminal access.

🔧 Troubleshooting

IssueSolution
AI not respondingRun ollamaconnect first, ensure Ollama is running
Voice not workingChrome/Edge/Safari only. Grant mic permission
Module fails to loadCheck CORS on the hosting server
Data lost after refreshCheck localStorage is enabled. Private mode clears data
AI actions not confirmingConfirm bar auto-denies after 120s. Type ai-allow
Sound not playingBrowser may need first user gesture. Toggle off/on
Ollama CORS errorOLLAMA_ORIGINS="*" ollama serve

Debug

# Console
F12 → Console

# View AI state
ai-system
ai-context

# Module status
listmods

⚡ Quick Reference

WebX11 v4.5.11
helpShow all commands
clsClear terminal
llList files
cd <dir>Change directory
cat <f>View file
edit <f>Edit file
ai <msg>Chat with AI
search <q>Web search
find <q>File search
diff a bCompare files
ollamaconnectConnect AI
ai-allowAllow destructive
ai-denyDeny destructive
modulesModule Manager
skill-listList skills
aliasList aliases
previewHTML preview
uploadUpload file
| pipeChain commands
> fileRedirect output
whichLocate command
envShow env vars
scriptRun .sh file
dateShow time
calShow calendar
base64Encode/decode
nvfs-indexBuild semantic index
nvfs-resolveFind files by concept
nvfs-syncSync dirty files
nvfs-saveSave index to disk
nvfs-cancelCancel index op
jsEval JS expression
js-runRun JS file
vfs-sizeVFS size report
vfs-cleanNuke system dirs
mindmap svgRender mindmap as SVG
guiSimple GUI builder
contract-listList A2A contracts
modules-listList all 45 modules
orchestrateDelegate to agent
system-healthSystem diagnostics
seqNumber sequence
whoamiShow user
basenameStrip dir path

📄 One-page Quick Reference cheat sheet — printable, dark mode, all commands.

📋 Changelog

v4.6.91 — October 2026 context says what it dropped
  • The window warns before it forgets. At 80% of the token budget the terminal says so once — ⚠️ Context 90% full (900/1000 tokens) — instead of only announcing the fall after compression. It does not repeat on every turn.
  • Trimming leaves a marker. Old turns used to vanish silently, so a long task "remembered" a conversation that never started that way. The window now opens with [context trim: 6 earlier message(s) left this window — the earliest was: "turn 0 original brief text…"].
  • The help text stopped lying. max-context-tokens claimed a default of 2000; the code has always used 12000.
  • On the "400k / 422k" report: no such limit exists in this codebase — the only budgets are maxContextTokens (12 000) and maxContext × 2 messages. That figure came from outside the app; nothing here was changed to chase it.
v4.6.88–90 — October 2026 one phantom entry, three bugs
  • A directory listing invented a sys entry. ls injects the virtual /sys — but it tested the argument instead of the result, so after cd _agents the listing showed sys inside _agents, and a follow-up list_files('_agents/sys') failed with "Directory not found". The listing lied; the resolver was right. Injection now happens only for the root directory.
  • tree crashed on the root listing. The same virtual entry was pushed into the walk and then dereferenced, throwing Cannot read properties of undefined mid-output — a partial tree, which is where two different file counts came from.
  • The file counts now agree. The world model's walk descended into the synthetic /sys subtree, so it reported 146 files in 114 directories for a store that holds 44 in 15. It skips virtual entries now, and matches an independent walk exactly.
v4.6.86–87 — October 2026 audit honesty, static assets
  • "Broken refs: 2" named neither of them — because both were documentation. The checker grepped for skill-view <name> in every skill's prose, so the placeholder and a quoted example counted as missing skills. Placeholders are now skipped, and any real breakage is named: Broken refs: 1 (probe-broken-ref → ghost-skill).
  • Two quick reloads no longer break the app. Opening newOS4 costs about 35 module requests at once; the site-wide rate zone (60 r/min, burst 50) treated that as a flood and served 503 for part of the bundle — measured 4 modules failing on a third reload. Static module and skill files now have their own zone; HTML and API requests keep the strict one.
v4.6.85 — October 2026 no invented numbers
  • "999d unused" was a placeholder, printed as if measured. A skill with no usage telemetry got daysUnused = 999, so the audit listed it as unused for nearly three years — a fabricated figure that invited archiving good skills. It now separates the two real cases: (never used) when there is no lastUsed at all, and a genuine day count otherwise.
  • The audit already distinguished untracked skills. 24 skills with no telemetry are reported as untracked, not stale — the sentinel was the one place that still pretended to know.
v4.6.83–84 — October 2026 world_model_query
  • The first tool the system prompt tells the model to call no longer fails. world_model_query with the default detail parsed _modelDigest() as JSON — but that digest was a JSON string cut at 4000 characters with …(digest truncated) glued on, so it threw Unexpected end of JSON input every time. detail:"full" worked only because it returned the object and never parsed anything.
  • A digest shrinks, it does not break. The model now builds a real snapshot object and drops list lengths (40 → 20 → 10 → 5 → 3 → 1 → 0), and if still too large drops whole sections, reporting what it left out in omitted. The string form is only produced at the edge, and is always parseable.
v4.6.82 — October 2026 skill-create parser
  • A skill created from the terminal is now the skill you wrote. The old parser joined every argument with a space — so line breaks vanished — and treated the last argument as a tag list whenever it contained a comma, which it then also left inside the body. A multi-line skill arrived as one line carrying a dozen bogus tags, and it still reported success.
  • Bodies can come from a file. skill-create <name> <desc> /path/to/body.md --tags=a,b --category=x keeps markdown exactly as written; inline text still works for one-liners.
  • Tags are opt-in. Only --tags= creates tags — a comma in your prose is no longer a taxonomy. skill-patch accepts a path too, for the same reason.
v4.6.81 — October 2026 two silent failures
  • Delegation no longer lies. outboxResult was declared inside the branch that needs the AI module but read outside it, so any delegation with the module missing threw outboxResult is not defined — caught as an agent failure, leaving the worker idle with no result. It now returns queued — AI module not loaded, nothing executed instead of a crash or a false "completed".
  • Markdown renders. _docs/*.md was served as application/octet-stream, so every document opened as a download. Now text/markdown, with nosniff.
  • One reply path. agent-replies.php answers 410 Gone for reads as well as writes, pointing at the chat channel.
v4.6.72–80 — October 2026 hardening after review
  • The agent can finally see the answer. The terminal's 30 s poller and the agent's chat_hermes read shared one cursor, so the poller printed each reply and advanced past it — the human saw it, the model got an empty list. They now keep separate cursors, and the tool's first read returns the whole thread.
  • A corrupt thread is an error, not an empty one. A damaged file used to read as [], and the next append rewrote it with a single message. It now fails with 500 and leaves the file alone; chat.py list shows it as CORRUPT instead of breaking the listing.
  • Cursor survives truncation. More than 50 new messages cut the response; the cursor now stops at the cut instead of the thread tail, so nothing in between is skipped for good. Same-millisecond posts get strictly increasing epochs.
  • No more double replies. hermes-poll printed every reply twice; it now prints one 🤖 line per message.
  • Retry guidance that matches reality. 429 says how many seconds to wait. A 503 means the front-end rate zone fired before the app — retry, it is not your mistake.
  • Hardening. chat.py show validates the thread id (a ../ path used to reach any .json on the host); lock files are group-writable so both sides can open them; the auto-reply prompt treats message text as untrusted data and never acts on instructions found in it.
v4.6.71 — October 2026 chat bridge
  • Chat with Hermes from the terminal. hermes <message> (alias: feedback) sends to the operator channel and prints the message id. Replies appear by themselves within 30 seconds; hermes-poll checks immediately.
  • Contract first. Shapes, error codes and the millisecond cursor live in _docs/chat-contract.md. A wrong token is 401, oversize text is 413 (rejected, never trimmed), rate limits are 429 with retry_after_ms.
  • One write path. feedback no longer files a bug report; the old replies endpoint answers 410 Gone. hermes-reset rotates the browser's token and starts a fresh thread.
  • The in-page agent can ask too. New tool chat_hermes — send a question, read the answer on a later step.
  • Server side. Per-thread and per-IP rate windows, atomic writes, data/chat/ unreachable from the web. Host CLI: scripts/chat.py list|show|reply.
v4.6.57–68 — October 20262026-10-23
  • No shell — and it now says so — ;, && and || are refused with an explicit message instead of being folded into the command's argv (where wc -l f && grep -c x f returned a plausible wrong number). A | arriving from the AI run_command tool is refused too, because that path bypasses the pipe splitter and degraded the pattern to empty. Documented at the top of the command reference.
  • Multiple paths in wc — wc -c a b printed only a and exited clean. It now prints one line per file plus a total, and reports each missing file separately.
  • ls prints text — it rendered only clickable chips (DOM-only), so any capture — the AI run_command tool, the diagnostics sweep — saw an empty result and reported "directory empty".
  • view_module shows what is deployed — it returned the _mods/<Class>.js edit cache first, unversioned, so after a rebuild it showed pre-fix source while the bundle was new. It now fetches the deployed file and prefixes the version; the cache is a labelled fallback.
  • load_skills searches tokens, not one phrase — the query used to be tested whole against name+description+tags, so "telemetry dashboard" returned 0 while "telemetry" returned 1, and a sentence could never match. Skill bodies were never searched. It now tokenises (stopwords dropped), scores name > description/tags > body, weights by how many tokens matched, keeps a phrase bonus so word order cannot zero a real hit, and reports matchedTokens: 2/3 with each result.
  • On-demand workers, named as such — orchestrator-status no longer reports a dispatch ratio as a defect: it prints Mode: on-demand — N/M worker(s) available, X delegation(s) this session, counted inside delegateTask(). Spawn-on-demand is the design; a worker with nothing to do is healthy.
  • Predictor store: server canonical — the file under the user's WebDAV space is authoritative; the browser copy is a 5-minute read-through cache written through on save. A banner appears only when the two disagree, naming both counts. No new endpoint and no unauthenticated write path was added.
  • grep, head and tail take several paths — they read only the first path argument and exited clean on the rest, the same silent drop wc had. Multiple files now print file:line: text (grep) or ==> file <== (head/tail), and grep -c prints one count per file. tail -f stays single-file and says so.
  • An invalid grep pattern is an answer, not a crash — it used to throw out of the command handler into the error ledger, which is the ledger that has to stay trustworthy. It now prints grep: invalid pattern: … and returns.
  • Agent status says what it means — four agents showed sleeping with no way to tell "waiting for work" from "never handed a task". They now read parked — NEVER SCHEDULED (0 tasks since …) or waiting for work (3 tasks, last …), plus a dispatch line and a warning when spawning happened but nothing was ever dispatched.
  • A guide you can actually find — guides lists /guides/ newest-first; the help page has a Guides section with the command, the preview/cat hints and links to published guides.
  • One error counter — errors, get_dashboard_data and the world model tallied three different sinks (0 / 18 / 11 in the same second). All three now read terminal.countErrors() (DebugSupervisor DB + failed tool calls); the VFS log is reported separately as a mirror, and terminal.log('ERROR', …) now records into the same DB instead of a second store nobody read.
  • Predictor arithmetic — the stored field named mape held a sum, so any JSON consumer read a mean that was n times too large (now errorSum); errorPct is stored raw and clamped only at render (a 475× miss used to be flattened to 500%); predictions are floored at 1 s and floor-hits are not scored, because one 0.079 s aborted run was rounding the next prediction to 0 s.
v4.6.56 — October 20262026-10-23
  • Predictor accuracy was structurally 0% — the denominator counted every observed run while the numerator only moved when a stored prediction matched, and predictions were stored only by the manual predict command. Unpaired runs no longer enter the accuracy denominator; the AI loop now registers a prediction per turn (notePrediction) and predict_task returns a tracked predictionId instead of discarding its estimate.
  • Paired scoring — a prediction is consumed by threaded id → task hash → cli-only feature similarity ≥ 0.5, within a 15-minute TTL (predictor-config pair-ttl <seconds>). A run counts as correct within 30% or 3 seconds of the predicted duration; predictor-status shows paired accuracy, mean error, turns error, pending predictions and unpaired runs.
  • Schema v2 — stored payloads from v1 are migrated on load: observed runs and the prediction counter are kept, the meaningless correct/total counters are dropped. Task text is stored as an FNV-1a hash, never in plaintext. Tuning (confidence-threshold, min-data-points, pair-ttl) now persists.
  • Knobs that do something — min-data-points now scales prediction confidence (it was declared, displayed and settable but never read), durations exclude chat-lock queue wait, and the confidence percentages on predict/predict_task will move for the same history (fewer points ⇒ lower confidence).
v4.6.52 — October 20262026-10-22
  • Documentation backlog cleared — 74 commands that the code registered but this page never documented are now in their own sections: dashboard (with --watch/--stop), usage, ps/top/df/free, the six a2a-* mailbox commands, webxai/webx/wx, context/contexts/context-new/context-delete/context-auto/smart-ask, the commit-* approval trio, module-load|unload|enable|reset, memgraph-agent|session|decay-config, orchestrator-schedule|schedules|unschedule, skill-validate|audit|restore|pack-core, learn-skill, encrypt/decrypt, gzip/wget, kanban, three, course, videos, speak/voice/analyze, gui-run|text|clear, the vaultmind-* set, debug-sync/debug-sync-url, setfont, bug, session-new, files, node, sed, nvfs-index-graph, wallet-lookup, ai-model, ai-ignore, webdav-login, view_module, run, sysmsg, history.
  • Ghost rows removed — commands, check, sandbox-kill and webdav-explorer were documented here but are not registered anywhere in the code. Their rows are gone; the sandbox prose no longer promises sandbox-kill.
  • Audit method — the command list is now derived from terminal.js (_baseWhitelist, internals, cmd === dispatch) plus every commands['…'] registration in modules/, so the next gap can be found mechanically.
v4.5.86 — July 20262026-07-04
  • Cold module activation — Three modules (Memory Graph, Predictor, World Model) were loaded but produced zero actionable data. All now wired into the AI agent loop.
  • Predictor feedback loop — predictor.recordResult() now called after multi-turn AI tasks (toolTurns ≥ 2). Predictor accumulates historical data for duration/turn predictions. Previously had zero call sites — module was dead.
  • New AI tools — predict_task (estimate task duration before starting) and world_model_query (query system self-awareness: modules, skills, files, agents, health, changes, projects). AI now has 51 tools (was 49).
  • Memory graph noise suppression — getContextForPrompt() returns empty string when graph has ≤2 nodes and 0 edges. Eliminates useless [Memory Graph Context] 1 nodes, 0 edges token waste on every AI turn.
  • Memory graph task recording — recordTask() now called for direct AI conversations, not just orchestrator tasks. Graph learns about all AI interactions.
  • memgraph-learn command — Documented in help.html but never implemented. Now creates concept+fact nodes with weighted edge. memgraph-learn <entity> <fact>.
  • getStats() alias — Orchestrator's _pipelineVerify() called memgraph.getStats() but the method was showStats(). Added getStats() alias returning {nodes, edges, types, totalAccesses}.
  • World Model summary fix — _getTotalModules() returned registry count (7) instead of max(loaded, registry) (43). Summary now shows 43/43 not 43/7.
  • Dashboard World Model panel — New section showing version, last synthesized time, module/skill/file/agent counts, memory graph stats, health, active projects, recent changes.
  • System prompt update — Now mentions predict_task and world_model_query capabilities.
  • Cache: 2026-07-04-v4.5.86 — hard refresh required
v4.5.64–v4.5.67 — June 20262026-06-18
  • Orphan removal — Removed 5 dead modules from core-bundle: MyModule, ModuleIOModule, DynamicPromptsModule, SmartContextModule, DuckDuckGoModule. 454 lines, 23KB saved. 12+ ghost commands cleaned from help.html. modules-index.json 50→45 entries. rebuild-bundles.py updated to prevent resurrection.
  • Unified reset command — Supersedes factory-reset, reset-vfs, reset-mem, config-reset. Subcommands: reset mem (AI state), reset vfs (filesystem), reset config (settings), reset all (nuclear). Old commands kept as aliases.
  • Agent loop detection — agenticLoop now tracks repeated tool calls. Same tool+args 3× triggers loop break with system message. Prevents AI from wasting 8 turns calling ls.
  • Agent optimization default OFF — trivial-optimization was always ON by default (!== 'false'). Changed to default OFF (=== 'true'). Use ai-config trivial-optimization on to enable.
  • JS Console fix — js / js-run commands were not in the security whitelist. At level 1+ they were classified "unknown" and routed to AI instead of dispatching. Added to whitelist — now works.
  • Telemetry throttle — ServerMonitor persisted tool-latency logs every 20 calls. Throttled to every 100 calls or 5 minutes. ~80% fewer VFS writes.
  • Pipe security fix — Pipe chains (cmd1 | cmd2) bypassed ALL security classification. rm foo | cat ran rm with zero checks even at Paranoid level. Each pipe stage now passes through _classify() — destructive and system commands blocked at level 1+.
  • Cache: 2026-06-18-v4.5.67 — hard refresh required
v4.5.45–v4.5.63 — June 20262026-06-12 to 2026-06-17
  • Critical ext bundle — 7 command-critical ext modules (editor, shell, alias, finder, filemgr, diff, busybox) promoted into critical-ext-bundle.js (2,365 lines). Solves HTTP 503 request-storm during boot.
  • Core module bundle — All core modules concatenated into core-bundle.js. Single <script> tag replaces 30 individual loads. rebuild-bundles.py script added.
  • VFS session bloat fixes — v2 metadata-only sessions (no VFS tree). Checkpoints strip system dirs, capped at 3. _purgeTrash() on boot (24h TTL). WebDAV backup deep-clones + strips.
  • New modules — module-agent-registry.js (A2A transport), module-leases.js (agent lifecycle), module-aiasm.js (assembly), module-duckduckgo.js (search, later orphaned), debug-panel.js, skill-pack-core.js.
  • A2A scratchpad architecture — Orchestrator agent-to-agent transport with prune timers, heartbeat checks, idle sweep. 6 a2a-* commands.
  • Orchestrator rewrite — delegateTask re-enters full agentic loop. spawnAgent, orchestrate-parallel, orchestrate-decompose, consensus protocol.
  • Deep architecture audit — 3 parallel subagent investigation of AI subsystem, VFS/state, security/dispatch. Found pipe security bypass, 5 orphaned modules, 6 duplicate localStorage keys, 19 unregistered intervals, 47 bare fetch() calls.
  • Cache: various — hard refresh required
v4.5.44 — June 20262026-06-11
  • Mindmap organization overhaul — Pain point #5 shipped. The mindmap command went from 12 subcommands to 40. mindmap.js grew from 321 to 1127 lines.
  • Multi-mindmap support — No more losing work when switching. mindmap new foo + mindmap new bar creates two in-memory mindmaps. mindmap switch foo to jump between them. mindmap list-loaded shows all in-memory. Current is marked with *, dirty mindmaps with [DIRTY].
  • Dirty-flag warning on load — mindmap load foo now warns if the current mindmap has unsaved changes. Use --force to override.
  • Find by text — mindmap find <text> searches all node text + tags (case-insensitive). Returns matching IDs and depth.
  • Move nodes — mindmap move <id> <new-parent-id> reparents a node (with all its children). Validates against cycles (can't move under self or descendant).
  • Undo — Stack of last 10 destructive ops. mindmap undo reverses: add, remove, rename, move, color, tag, weight, merge.
  • Human-readable aliases — mindmap alias <id> <name> gives a memorable name. All commands that take an ID (edit, move, color, etc.) now accept either ID or alias.
  • Disambiguated delete — mindmap delete <name> still deletes a FILE (backward compat). New mindmap remove <id> removes a NODE. mindmap delete-file is the explicit form.
  • Import — mindmap import <file> reads from VFS, auto-detects format (JSON/Mermaid/Markdown) by extension or content. Re-generates IDs to avoid collisions.
  • Merge — mindmap merge <name> [--into=<id>] adds a saved mindmap under the current root (or specified parent). Conflict-free: just appends.
  • Diff — mindmap diff <name1> <name2> shows added/removed/modified nodes between two saved mindmaps.
  • Stats — mindmap stats shows total nodes, max depth, nodes per level, colors used, top 10 tags, dirty status, last save time.
  • Tags cross-node — mindmap tags-list [<tag>] shows all tags + counts, or all nodes with a specific tag.
  • Clone — mindmap clone <id> duplicates a node and its children with new IDs. Text gets " (copy)" suffix.
  • Archive — mindmap archive <name> saves to /mindmaps/archive/<name>-<ts>.json. Auto-cleans to last 20.
  • Weight — mindmap weight <id> <1-5> scales node size in SVG output (1=small, 5=large, default=3).
  • Mermaid export — mindmap mermaid (or mindmap export mermaid) prints Mermaid mindmap syntax. Auto-escapes parentheses, brackets, ampersands.
  • JSON export — mindmap json prints the internal JSON (with aliases). Both Markdown and JSON get copied to clipboard.
  • Refresh HTML — mindmap refresh-html regenerates the standalone architecture page from modules-index.json. Writes to /mindmaps/_generated-architecture.html in VFS, prints preview. Deploy with cat <file> > mindmap.html.
  • SVG layout fix — New _layoutTree() algorithm computes subtree widths first, then positions. Handles 30+ node mindmaps without going off-screen. weight affects node size.
  • Cache: 2026-06-11-v4.5.44 — hard refresh required
v4.5.43 — June 20262026-06-11
  • Module management overhaul — Pain point #3 finally shipped. module-list now groups by category (CORE/EXTENSION/FOUNDATION), supports --core --ext --foundation --lazy --eager --loaded --unloaded --failed --disabled --search=<pat> --flat flags, and shows aggregate summary (size, count, failed, disabled).
  • module-info <name> — Shows module details: status, category, type, path, size, lazy flag, and the full list of commands it provides (the biggest gap). Listed in 2 columns.
  • module-stats — Aggregate view: total/loaded/unloaded/lazy/eager/failed/disabled + total size + total commands.
  • module-disable / module-enable — Persistently disable a module from auto-loading. Stored in localStorage webx11_module_disabled. Survives refresh. module-loader.js now checks this list and skips disabled modules with a ⊘ marker in the splash.
  • module-reload / module-reset — Reload shows old→new diff. Reset clears module's localStorage state and reloads.
  • System troubleshooting commands — Pain point #4.
  • version — Single command shows: version, build date (parsed from script tag), cache key, browser engine, online status.
  • uptime — Time since page load (formatted Xh Ym Zs) + last save time.
  • errors [n] — Alias for logs [n] ERROR. Shows last N errors. Says "No errors found" when logs are clean.
  • doctor — Runs 8 health checks (network, ollama, VFS size, heap, logs, recent errors, localStorage quota, disabled modules), ranks by severity (🔴/🟡/🟢), shows top 5, and gives recommended actions.
  • bug-report — Generates a markdown report with system info, recent errors, recent commands, disabled modules, top-level VFS listing. Saves to /tmp/bug-report-<timestamp>.md. Send this file when reporting a bug.
  • test-net — Checks browser online status, proxy API (/api/stats), Ollama connection, and internet (HEAD to duckduckgo.com). Green/red status for each.
  • mem enhanced — Now shows JS heap + localStorage size + sessionStorage size + VFS in-memory size + total. Color-coded thresholds (green/yellow/red).
  • Trust violations fixed — Removed ghost commands commands and check from getHelpInfo() (they were in help but never registered). Fixed memory-map-export to actually save to /memory/reference.md (was: print to terminal).
  • Cache: 2026-06-11-v4.5.43 — hard refresh required
v4.5.41 — June 20262026-06-11
  • Search result quality fix — Default engines changed from google,bing,brave,wikipedia to mojeek,bing. Previous default had 3/4 engines broken (Google/Brave/Wikipedia block datacenter IPs); Bing worked but returned French-localized results due to server's Amsterdam IP. Mojeek is a privacy-focused crawler-based search that returns English results regardless of server location.
  • Result deduplication — /api/search now dedupes results by domain and prefers Mojeek over Bing (Mojeek is more relevant in this environment). Two-pass: Mojeek first, then Bing for domains not already seen.
  • Verified: search quantum computing now returns "Quantum computing - Wikipedia" as the #1 result (was "iPhone - Apple"). search how to cook risotto now returns actual risotto recipes (was "Cook, les épices bio" - a French spice site).
  • Cache: 2026-06-11-v4.5.41 — hard refresh required
v4.5.40 — June 20262026-06-10
  • AI assistant POST support — web_fetch tool now accepts method=POST, body, and content_type params. AI can now fetch POST-only APIs (Hyperliquid, financial APIs) without telling the user to "use curl". POST routes through /api/fetch; GET still uses /api/extract for cleaner output.
  • AI assistant error parsing — web_search and web_fetch now parse JSON errors from proxy and surface the real reason (was just "HTTP 500" with no details).
  • 30s frontend timeout — fetch, extract, and search now abort after 30s with a helpful message. Replaces 15s silent freeze. Implementation: AbortController.
  • Loading indicator for --summarize — Shows "⏳ AI overview will be generated (1-3s)..." before the LLM call, so user knows the terminal is alive.
  • Extract follow-up hint — After extract, shows: "💡 Try summarize <url> for AI summary, or nvfs-resolve <concept> to find related files".
  • Backend script/style strip — Extract's regex fallback now strips <script>, <style>, <noscript> and HTML comments. Prevents raw JS leaking into extracted text on BS4 failures.
  • web alias removed — Was a duplicate of fetch that didn't appear in autocomplete. Confusing. Just use fetch.
  • Cache: 2026-06-10-v4.5.40 — hard refresh required
v4.5.39 — June 20262026-06-10
  • POST support in /api/fetch — Proxy was GET-only, blocking any API that requires POST (Hyperliquid /info, etc). Now accepts method=POST&body=...&content_type=... query params with 10KB body cap and method-aware cache key.
  • fetch command gains 3 flags — --post=BODY sends a POST request with the given body, --type=CT sets the Content-Type header (defaults to application/json if --post is set), --raw shows untruncated response. Example: fetch https://api.hyperliquid.xyz/info --post='{"type":"l2Book","coin":"HYPE"}' --type=application/json
  • Better error messages — Frontend fetch now parses JSON error from proxy and shows the real reason (was just "HTTP 502" with no details).
  • Cache: 2026-06-10-v4.5.39 — hard refresh required
v4.5.38 — June 20262026-06-10
  • Keyboard shortcuts — Ctrl+L clears the output area, Ctrl+C cancels the current input line (prints ^C), Ctrl+U clears the input field. Standard terminal conventions now work.
  • Shift+Tab cycles backward — autocomplete suggestions can be cycled in both directions.
  • Send button → 48px tappable — was 31px (fails mobile/tablet tap target). Now min-width: 48px; min-height: 48px per Android/iOS standards.
  • Autocomplete argType fixes — nvfs-config, nvfs-alias, skill-list now show enum values (config keys, alias actions, skill categories) instead of file paths. nvfs-sync/nvfs-save/nvfs-cancel/nvfs-status marked as argType: 'none' so they don't show file suggestions.
  • Stale autocomplete cleared — Tab suggestions from prior input no longer linger when you start typing something new.
  • History cap on startup — terminal-cmd-history config now applies on page load, not "next save" (which never happened).
  • Cache: 2026-06-10-v4.5.38 — hard refresh required
v4.5.37 — June 20262026-06-10
  • /skills/index.json re-index loop FIXED — skill-pack-core.seed() was rewriting the updated timestamp for all 8 core skills on every page refresh, causing NVFS to see a hash mismatch and re-queue the 7KB JSON for LLM extraction every run. Now seed() compares existing file content to bundled content and only writes the index if something actually changed. Eliminates the 5-concepts-from-1-file loop on every refresh.
  • One-time data fix — After deploying, the existing stale updated timestamp in your VFS will be re-evaluated on next refresh. If it matches the bundled timestamp, the loop stops immediately. If not, one final write happens and the loop is dead thereafter.
  • Cache: 2026-06-10-v4.5.37 — hard refresh required
v4.5.36 — June 20262026-06-10
  • Deep pass output shows file paths — Was "5 LLM concepts across 1 file" (no path). Now lists up to 20 files with their concept counts. Makes it obvious if a single file keeps re-processing every refresh (loop detection).
  • Auto-sync output shows file paths — Same treatment: "re-indexed N file(s)" now lists the actual paths so you can see what's looping.
  • nvfs-status shows LLM/fast breakdown — Two new lines: "Fast concepts: N" and "LLM concepts: N (across M files)". Proves persistence is working without needing DevTools inspection.
  • Deep pass message clearer — "added N new LLM concepts (M files). Total in index: X" — distinguishes the per-pass delta from the persisted total.
  • Cache: 2026-06-10-v4.5.36 — hard refresh required
v4.5.35 — June 20262026-06-10
  • NVFS bug fix audit (7 bugs) — Stale /sys/... entries from pre-v4.5.34 builds cause permanent re-index loops. init() now auto-purges them on first run with a one-time warning.
  • Cancel responsive — nvfs-cancel now checks between every LLM call (was: between every batch of 3). Stop within one 30s call instead of waiting up to 90s.
  • Save race fixed — nvfs-save and end of deep pass now await in-flight VFS save instead of clobbering the debounce flag. Prevents silent LLM concept loss on concurrent writes.
  • init() now awaits VFS load — Was fire-and-forget; first nvfs-status could return empty even when an index existed. module-manager.js already awaits init(), so making it async is safe.
  • Deep-mode warning shown once — Was spammy on every nvfs-index call. Tracked by session flag _warnedAboutLLMStrip.
  • Tag extraction fixed — _extractConcepts used tagMatches[0] (whole match) instead of capture group, so inline #tag1 #tag2 only captured #tag1. Now correctly splits on commas or captures all hash tags.
  • Filter defensive — _isSystemFile split into clean two-check structure. node_modules check now uses normalized path so node_modules/foo.js (no leading slash) also gets filtered.
  • Cache: 2026-06-10-v4.5.35 — hard refresh required
v4.5.34 — June 20262026-06-10
  • NVFS deep index persistence — LLM-generated concepts now survive page refresh. _processDeepQueue() calls _saveIndex(). Deep concepts written to disk on completion.
  • nvfs-save command — nvfs-save force-saves the semantic index to VFS disk immediately. Useful before hard refresh.
  • Auto-sync deep mode — nvfs-sync --deep or nvfs-config deep-index on now triggers LLM analysis for dirty files, not just fast filename concepts.
  • Safety guard — Running nvfs-index without --deep when saved index contains LLM concepts prints a warning: they'll be stripped from re-indexed files.
  • JS Console module — New js <expression> command evals JavaScript in page context. js-run <path> loads and executes a VFS script file. Auto-loads at startup.
  • Module registration — console added to packages.json, terminal.js ext loader, and skipList. Auto-loads on next refresh.
  • Cache: 2026-06-10-v4.5.34 — hard refresh required
v4.5.24 — June 20262026-06-08
  • tar / untar commands — New pure-JS tarball parser in cryptogzip.js. tar <src-dir> <out.tar[.gz]> bundles a VFS directory; untar <path.tar[.gz]> [dest-dir] extracts back. Auto-detects gzip wrapper. Fixes the "downloaded newos4.tar.gz but can't extract" problem.
  • Binary-safe gzip — gunzip now preserves binary content (was UTF-8 only). Updated to use base64 roundtrip for binary files.
  • POSIX ustar format — Reads & writes standard ustar tarballs (compatible with GNU tar, BSD tar, macOS tar).
  • Cheatsheet updated — Added 8 entries under 🔧 Tools for tar/untar/gzip/gunzip/encrypt/decrypt/diff/edit
  • System prompt — tar/untar added to [ALL OTHERS] command list
v4.5.23 — June 20262026-06-08
  • Doc version sync — Help page title, overview, and footer updated to v4.5.22 to match deployed module-loader.js
  • Whitepaper v4.5.22 — Bumped from v4.3.0-beta; Last Updated 2026-06-08
  • Deprecated module-modmgr — Removed from BUILTIN array (was duplicate of module-manager.js). Set auto_load=false, layer=deprecated. File retained for one release for rollback safety; deletion scheduled v4.6.0
  • Fixed modules-index class — module-loader class changed from filename string "module-loader.js" to null (foundation file, not a module class)
  • packages.json cleanup — Renamed neural-vfs to neural-vfs-core, category → core, added note that NVFS is built-in not a WPM package
  • Cheatsheet coverage — Added 4 missing commands: sandbox-config, memgraph-export, predictor-config, world-model-config
  • Audit script fix — audit-newos4-filesystem.py now respects skills/index.json for orphan detection (no more 26 false-positive warnings on valid skill JSONs)
v4.5 — June 20262026-06-06
  • Security Config CLI — security-destructive, security-system, security-whitelist, security-flag add|remove|list with localStorage persistence and boot loading
  • Enhanced security command — Shows all sets (destructive, system, whitelist, flags) plus registered command count
  • AI loop config — ai-config max-turns|max-context|trivial-optimization with persistence across sessions
  • Unified config CLI — config command with 4 terminal tuning keys (max-lines, history, pipe-buffer), all persisted in localStorage
  • Extended ai-config — New keys: max-context-tokens, confirm-timeout, chat-lock-timeout, skill-debounce with range validation
  • Safe-read run_command — run_command now command-aware: ls, find, tree, cat auto-approved; only mutating commands require confirmation
  • Whitelist expanded (50+ cmds) — find, grep, tree, head, tail, wc, sort, du, diff, which, hostname, and all BusyBox read-only utils now whitelisted
  • Security-bypass fix — run_command AI tool now routes through checkAndRun() security layer instead of bypassing
  • list_files root fallback — relative paths retry from root if cwd-relative lookup fails
  • Confirm timeout configurable — ai-config confirm-timeout <seconds> accepts 0+ (0 = no confirm / auto-approve all, no upper cap). Dynamic label on confirm bar shows actual timeout.
  • Auto-sync Neural VFS — write_file/mkdir/rm/mv/cp automatically mark index dirty; auto-reindexes after 10s debounce. nvfs-alias command for concept aliases. Hybrid discovery fallback in nvfs-resolve (live VFS scan when index empty). Staleness warning in nvfs-status if index >4h old.
  • 5 modules whitelisted — system-health, server, servers, server-check, monitor run directly
  • OllamaModule consolidated — Removed duplicate ollamamodels code path (redirects to models), centralized endpoint via ollamaManager.endpoint
  • Neural VFS async indexing — Chunked processing with progress percentage, no UI freeze on large VFS. Improved _summarize (section heading → paragraph → sentence → fallback)
  • Neural VFS display-limit config — nvfs-config command with 4 keys (fuzzy-limit, tree-files, tree-concepts, resolve-files), persisted
  • Orchestrator event bus — In-memory pub/sub for instant A2A delivery (VFS polling remains as fallback). Improved _deriveCapabilities with 14 keyword mappings
  • Orchestrator extended config — 4 new interval keys (a2a-poll-interval, heartbeat-check, idle-sweep-interval, dead-purge-timeout) + all config now persists across sessions
  • Cache: 2026-06-06-v4.5.11 — hard refresh required
v4.5.12 — June 20262026-06-06
  • Tiered Indexing toggle — nvfs-config deep-index on|off switches between Fast (metadata-only, instant) and Deep (LLM-assisted, semantic) modes. Off by default. nvfs-index --deep or nvfs-sync --deep forces deep mode per-run.
  • Configurable deep model — nvfs-config deep-model <name> selects the LLM for deep indexing. Default: gemma4:31b-cloud for speed. Example: nvfs-config deep-model gemma4:31b-cloud for deeper analysis.
  • Status bar indicator — Real-time 🧠 status in terminal bar: concept count + 🌊 wave for deep mode, 🟡 amber for pending auto-sync, 🧠 Deep Indexing progress percentage during LLM processing.
  • nvfs-sync command — nvfs-sync [--deep] for incremental background sync of dirty files.
  • Deep concept extraction — LLM generates 2-5 semantic concepts per file (configurable model via nvfs-config deep-model, default gemma4:31b-cloud, 2000 chars, 3-file batches with UI yield). Fast filename-concepts stored immediately, LLM concepts augment in background queue.
  • nvfs-status mode display — Shows 🌊 Deep or ⚡ Fast mode.
  • LLM self-healing — If Ollama disconnected, deep mode silently falls back to fast metadata-only.
  • Cache: 2026-06-06-v4.5.12 — hard refresh required
v4.5.2 — June 20262026-06-06
  • VFS Size Diagnostics — vfs-size shows total VFS size, top 5 largest files, and system dir sizes
  • VFS Clean — vfs-clean / vfs clean — nuke snapshots, sessions, trash in one shot
  • Fractal checkpoint fix — checkpoint() no longer deep-clones its own /_snapshots/, eliminating recursive bloat. Same for session-save
  • Ghost commands wired — checkpoint, checkpoint-list, checkpoint-del, rollback had help text but no handlers — now actually work
  • Autocomplete fix — Built-in commands (vfs-clean, vfs-size) now appear in dropdown
  • Editor→_mods bridge — edit path/to/module.js now mirrors to _mods/ for test_module compatibility
  • Skill WebDAV Sync — skill-webdav-sync pushes all skills to WebDAV as JSON files
v4.5.11 — June 20262026-06-06
  • init(terminal) fix — loadModuleFromCode and loadModuleFromURL now pass this.terminal to init(), fixing PredictorModule fatal error
  • Save & Test returns value — saveCodeEditor checks loadModuleFromCode return before printing success
  • StateSyncModule recovered — Extracted from backup, saved to ~/.hermes/scripts/
  • PredictorModule hasSync — Feature detection for sync/recall tasks with tuned duration/turn prediction
  • Cache: 2026-06-06-v4.5.11 — hard refresh required
v4.4 — June 20262026-06-05
  • v4.4 complete — 46 modules, 24 skills, full A2A lifecycle, sandboxed execution, memory graph, world model, health monitoring
  • A2A Mailbox Transport — a2a-send, a2a-list, 500ms polling with envelope routing (request/response/broadcast/heartbeat)
  • Autonomous sub-agent spawning — auto-role derivation, sleep/reanimate VFS serialization
  • Sandboxed execution — WebWorker pool sandbox-run (there is no sandbox-kill; tasks end on timeout) with inline fallback for headless
  • A2A Protocol — Agent contract system: contract-register, contract-list, schema validation in orchestrator
  • Self-Optimization Telemetry — system-health command showing tool latency, VFS stats, error rates
  • AI tool: nvfs_resolve — AI can search VFS by concept
  • Skills consolidated — 9 → 4 unified; index rebuilt minified
  • Docs sync — vision.html and whitepaper updated
  • Cache: 2026-06-03-neuralvfs — hard refresh required
v4.3.2 — June 20262026-06-04
  • mindmap svg — Inline SVG rendering with colored rects + bezier curves
  • GUI Builder — gui, gui-button, gui-input — SimpleGUIModule registered
  • mermaid.min.js — Downloaded for webx11_mindmap.html
  • get_module_status fixed — Shows all 34 loaded modules (was only HTTP-loaded)
  • view_module fixed — Uses modules-index.json to resolve class→file paths
  • module-ollamamodels merged — Into module-ollama (13 commands total)
  • concept:// URIs — cat concept://skill resolves via Neural VFS
  • Module categorization — modules-list shows [core], [ext], [infra] layer tags
  • 5 modules whitelisted — system-health, server, servers, server-check, monitor run directly
v4.3 — June 20262026-06-02
  • WebDAV Browser — Modern file-tree UI with checkboxes, Select All, bulk actions (Delete, Move, Download), inline rename (double-click), context menu, breadcrumbs, keyboard shortcuts
  • WebDAV commands — webdav-browser, webdav-rm, webdav-mkdir, webdav-rename, webdav-move, webdav-backup
  • Skill Pack System — Auto-loads 12 skills on startup, seed/reload support, skill-pack-core.js manages in-memory index
  • Agent Orchestration — agent-list, agent-register, lease-list, orchestrate for multi-step delegation
  • Security Layer — security-level 0-3 with granular restrictions, cmd-allow/cmd-deny per-command access control
  • Debug Panel — debug toggle shows memory, events, errors, module health
  • Chat Cleanup — Removed chat-setapi, chat-setmodel, chat-ask; single chat command toggles overlay
  • Module count refactored: 18 core + 14 ext (was 25+17)
  • Download fix — switched from resp.text() to resp.blob() for binary-safe downloads; same fix for image preview (FileReader DataURL)
  • Cache: v=40 — hard refresh required
v4.2.1 — May 20262026-05-27
  • BusyBox — 16 new utility commands: which, env, date, cal, yes, seq, base64, printf, cut, uniq, hostname, whoami, basename, dirname, sleep, expand
  • Shell — Full pipe (|), redirect (>, >>, <), chain (&&, ||, ;), variable ($VAR), and VFS script execution (script)
  • Pipe-aware commands (grep, head, tail, sort, wc, cut, uniq, expand) auto-read from pipe via temp file injection
  • export, unset, set — shell variable management
  • Multiple ASI and VFS API bug fixes (fs.fsWrite → fs.writeFile across 3 modules)
  • Test Suite — 32 automated regression tests. Run with load-local modules/test/test-suite.js then test, test auto, or test list
  • Cache v34 — hard refresh required
v4.2 — May 20262026-05-25
  • Editor — edit <path> opens inline VFS editor modal
  • Diff — diff a b LCS-based comparison + diff --module
  • Aliases — ll, h, cls defaults + custom alias definition
  • File Finder — find <query> recursive VFS search
  • Agent loop: capped at 8 turns (was 1), edit_module destructive confirmation, model auto-validation
  • ai-stop now cancels chat + stream, not just tool calls
  • Unknown commands awaited, "Command not found" suppressed on AI route
  • loopResult scope fix — no more undefined error on AI fail
  • Preview iframe allows JS (allow-scripts), cache bump v=18
  • Splash fallback + startup modal list all 12 ext modules
v4.12026-05-23
  • AI Agent with full tool-calling loop (28 tools)
  • Inline destructive confirmation bar with 120s countdown timer
  • Skills system (8 CLI commands + UI modal)
  • Voice input (🎤 button, SpeechRecognition, show/hide toggle)
  • Sound notification (🔊 toggle, WebAudio ding)
  • AI spinner in status bar
  • Session system (save/load/recent/stats)
  • WebDAV sync (8 commands)
  • Web search (SearXNG + DDG + URL fetch/extract)
  • Config manager (6 commands + UI)
  • Startup modules selector (⚙ gear on splash)
  • Code editor modal (module editing, save & test live)
  • HTML preview via srcdoc (mobile)
  • File/dir autocomplete, pipe support
  • Smart context profiles, dynamic prompts with variables
  • Server monitor, ChatStudio overlay
  • Modular architecture: 23 JS modules, async loader
v4.02026-05-20
  • Monolith refactored into core/ext modules
  • Async module loader with splash screen
  • Config manager modal
  • Bootloader fix for disabled modules
↑