🚀 Welcome to newOS4
tutorial in the terminal to start a 2-minute interactive tour!
🖥️ Terminal OS
Full virtual filesystem with ls, cd, cat, touch, edit, find, grep and 50+ Unix-like commands.
🤖 AI Assistant
Built-in AI agent with tool calling, skills, memory, and 28 tools. Just type ai "your question".
🧩 Module System
50 modules across 3 layers — Browse on Modules page → (dynamic, searchable, live status)
📚 Skills
Browse live on the Skills page → (searchable, filterable, no hardcoded lists).
🔤 First 6 Commands
📋 Workflow
- Type
help— see every available command - Type
ls— browse files in your virtual drive - Type
touch hello.txt— create a file - Type
edit hello.txt— write something and save - Type
ai "summarize this"— let AI analyze your files - Type
status— check system health
🔧 Quick Start
Type help to see all 130+ commands grouped by category. Use help <command> for details on a specific one.
The 📋 Quick Commands panel (Ctrl+K) has clickable cards for common tasks.
For the full reference, switch to the 📘 User Guide tab — it covers every module, filesystem, AI, skills, configuration, and all extended modules in detail.
🔧 Module Development API
Ext Module Structure
Modules are ES6 classes with 3 required and 1 optional method:
class MyModule {
constructor() { this.commands = {}; this.terminal = null; }
requirements() { return { met: true, missing: [] }; }
getHelpInfo() { return { 'mycmd': 'mycmd — What it does' }; }
registerCommands() { this.commands['mycmd'] = (args) => { /* ... */ }; }
}
// Auto-register:
if (typeof window.webx11 !== 'undefined' && window.webx11) {
webx11.moduleManager.registerModule(new MyModule(), 'url');
}
VFS (Virtual FileSystem) API
Access via this.terminal.fs:
| Method | Returns | Description |
|---|---|---|
readFile(path) | string or null | Read file content |
writeFile(path, content) | boolean | Write string to file |
ls(path) | array | List directory entries |
mkdir(path) | boolean | Create directory |
rm(path) | boolean | Remove file |
rmdir(path) | boolean | Remove empty directory |
touch(path) | boolean | Create empty file |
cd(path) | boolean | Change current directory |
pwd() | string | Current directory path |
mv(old, new) | boolean | Move/rename file |
cp(src, dst) | boolean | Copy file |
AI Tool Definition Format
Add tools to module-aiassist.js in getToolDefinitions() (around line 300):
{
type: 'function',
function: {
name: 'my_tool',
description: 'What it does — AI reads this to decide when to call it.',
parameters: { type: 'object', properties: {
paramName: { type: 'string', description: 'What this param does' }
}, required: ['paramName'] }
}
}
Then add a case 'my_tool': handler in runTool() (around line 1000). Return JSON.stringify(...).
Skill Format
Skills are markdown files with YAML frontmatter, stored in /skills/ in VFS:
---
name: my-skill
description: Brief description
tags: [tag1, tag2]
---
# Skill Body
Instructions, examples, and workflows here.
OllamaManager API
| Property/Method | Description |
|---|---|
.endpoint | Current Ollama API URL |
.currentModel | Active model name |
.models | Array of available models |
.connected | Boolean connection state |
.connect() | Connect to Ollama, load models |
.chatWithTools() | AI chat with tool calling support |
window.webx11 Global
The terminal instance is exposed globally as window.webx11 (aliased as webx11). This gives access to everything:
webx11.fs // VFS instance
webx11.moduleManager // Module registry
webx11.ollamaManager // Ollama connection
webx11.security // Security manager
webx11.executeCommand(cmd) // Run a terminal command programmatically
webx11.print(text, type) // Print to terminal output
webx11.tutorialModule // Tutorial progress (if active)
webx11.inputField // DOM input element
⛅ Overview
WebX11 v4.5.24 is a browser-based Unix-like terminal — dynamic modules, AI assistant (Ollama), persistent virtual filesystem, web search, voice input, code editor, and a full skill system. Everything runs client-side in your browser.
🧩 18 Core + 14 Ext
Modules loaded at startup. Shell with pipes, redirects, vars, and scripts.
🤖 Agent with Tools
28 tools — file ops, web search, skills, modules. Destructive action confirmations with inline bar + countdown.
📚 Skills System
Persistent procedural memory. Create, patch, search, export skills for repeatable workflows.
💾 VFS + Sessions
Virtual filesystem persists in localStorage. Save/load/export sessions.
🎤 Voice Input
Speech recognition in the terminal. Works in Chrome, Edge, Safari.
🌐 Web Search
SearXNG + DuckDuckGo fallback + URL fetch/extract. All built-in.
☁️ WebDAV Sync
Push, pull, backup VFS to any WebDAV server.
📱 Mobile First
Touch-optimized. srcdoc HTML preview works on mobile.
✏️ Text Editor
Inline VFS editor — edit <path> opens a modal with save/cancel.
🔗 Aliases
ll, h, cls built-in. Define custom aliases with alias x=y.
🚀 Quick Start
- Open
index.htmlin Chrome/Edge - Watch the splash screen load modules
- Type
help+ Enter - Use the quick-action buttons above the input area
First Commands
# List VFS files ls # List files faster ll # Connect to Ollama AI ollamaconnect # Chat with AI ai what's in this directory? # Create a file put hello.txt Hello World # Edit a file edit hello.txt # Search the web search quantum computing # Find files find hello # Compare two files diff a.txt b.txt
- Enter — Execute
- Tab — Cycle autocomplete
- ↑/↓ — Command history
- Esc — Hide autocomplete / stop AI
- | — Pipe:
ls | grep hello
📖 New to feedback? How feedback works — which channel to use, what gets sent, and when to expect an answer.
📖 Full Command Reference
;, &&, || or
redirection. Those are now refused with an explicit message instead of being folded
into the command's arguments (which used to produce a plausible wrong answer):
wc -l a && grep -c x a → refused; run two commands.
A single cmd | cmd pipeline works in the interactive terminal (not in the AI
run_command tool). wc, grep and friends take
one path per call unless documented otherwise — wc -c a b now
prints a line per file plus a total.
System
| Command | Description | Example |
|---|---|---|
help | Show all commands | help |
clear / cls | Clear terminal | cls |
echo | Print text | echo Hello |
mem | Show memory usage | mem |
config | View/set terminal config (max-lines, history, pipe-buffer) | config terminal-max-lines 500 |
status | System status | status |
font-size | Change font size (8–32) | font-size 16 |
load-local | Load module from VFS or URL | load-local modules/ext/calc.js |
startup-modules | Open startup module selector | startup-modules |
preview | Preview HTML in iframe | preview test.html |
reset mem | Clear AI memory (context, patterns, profile) | reset mem --confirm |
reset vfs | Clear virtual filesystem to empty root | reset vfs --confirm |
reset config | Reset all config to defaults | reset config --confirm |
reset all | Wipe everything (nuclear) | reset all --confirm |
logrotate | Rotate current.log to dated archive | logrotate |
health-check | Audit VFS, modules, logs, trash, skills | health-check |
memory-map-export | Generate memory map from /memory/index.json | memory-map-export |
checkpoint | Create VFS snapshot | checkpoint |
checkpoint-list | List VFS checkpoints | checkpoint-list |
rollback | Restore VFS from checkpoint | rollback |
checkpoint-del | Delete a checkpoint | checkpoint-del |
smart-prompt | Toggle context-aware prompt | smart-prompt |
test | Run test suite | test auto |
[ … ] / test … | POSIX file and string test for chains — silent, combines with && / ||. Operators: -f -d -e -z -n ! = !=. The expression form of test is routed to this; test with no expression still runs the suite. | [ -f /notes.txt ] && echo yes |
AI Assistant
| Command | Description | Example |
|---|---|---|
ai / ask | Chat with AI (tool-calling) | ai create a notes file |
ai-clear | Reset conversation context | ai-clear |
ai-system | View/set system prompt | ai-system |
ai-context | Show conversation memory | ai-context |
ai-allow | Allow pending destructive action | ai-allow |
ai-deny | Deny pending destructive action | ai-deny |
ai-stop | Cancel running AI request | ai-stop |
ai-compress | Manually compress conversation context | ai-compress |
ai-config | View/set AI loop config (max-turns, max-context, max-context-tokens, confirm-timeout(0=disabled), chat-lock-timeout, skill-debounce, trivial-optimization, temperature, top-p, max-tokens, thinking) and AI tool budgets in characters (read-page-chars, read-result-chars, tool-context-budget, fetch-chars — each 500-200000; read-page-chars/read-result-chars use the model default when unset) | ai-config max-turns 12 |
ai-stats | Per-tool telemetry for this browser (localStorage webx11_tool_stats): calls, ok %, avg duration, KB returned, truncation rate — for finding which tools flood the AI context | ai-stats |
debug | Toggle AI debug mode (ext module) | debug |
debug-ai | Toggle AI tool-call debug panel | debug-ai |
debug-ai-last | Show last AI response (content, tool calls, errors) | debug-ai-last |
debug-ai-send | Show what was sent to the AI (messages with roles) | debug-ai-send |
debug-ai-log | Dump full tool call log for current session | debug-ai-log |
archive-list | List archived session snapshots | archive-list |
archive-read | View an archive by filename | archive-read 2026-06-25-14-30.json |
mem-debug | Memory diagnostic (tool call log, heap, localStorage sizes) | mem-debug |
reset-mem | Clear AI internal logs without touching VFS/config | reset-mem |
Debug Supervisor
| Command | Description | Example |
|---|---|---|
debug-stats | Error summary (total, unique, clusters, top issues) | debug-stats |
debug-history | Show last N errors with hash, type, severity | debug-history 10 |
debug-analyze | Deep analysis of a specific error (root cause, fix suggestions) | debug-analyze a1b2c3d4 |
debug-trends | Error frequency over time, grouped by day and type | debug-trends 7 |
debug-fix | Suggest and optionally auto-apply fix for an error | debug-fix a1b2c3d4 |
debug-health | Check DebugSupervisorModule health status | debug-health |
feedback <message> | Send a message to the operator agent (alias hermes); feedback -- <text> forces a message | feedback download link 403s on mobile |
feedback list [status] | List stored /stear reports — status new, read or archived (admin) | feedback list new |
feedback read <id> | Show one report in full, including any reply (admin) | feedback read 12 |
feedback reply <id> <text> | Publish a reply — the reporter sees it in /stear → My reports; status becomes read (admin) | feedback reply 12 shipped in v4.6.92 |
feedback archive|reopen <id> | Move a report between archived and new (admin) | feedback archive 12 |
feedback stats | Counts per status plus the dashboard URL (admin) | feedback stats |
feedback dashboard | Open /admin/feedback.html in a new tab (admin) | feedback dashboard |
feedback-admin <sub> | Admin alias for the feedback subcommands (list|read|reply|archive|reopen|stats|dashboard) | feedback-admin stats |
Skills
| Command | Description | Example |
|---|---|---|
skill-list | List all skills | skill-list |
skill-view | View skill content | skill-view web-scraper |
skill-create | Create a skill | skill-create name desc "steps" tags |
skill-patch | Update a skill | skill-patch name "new content" |
skill-delete | Delete a skill | skill-delete oldskill |
skill-export | Export skill to JSON | skill-export myskill |
skill-import | Import skill from JSON | skill-import |
skill-sync | Rebuild skill index | skill-sync |
skill-webdav-sync | Push all skills to WebDAV as JSON | skill-webdav-sync |
Config
| Command | Description | Example |
|---|---|---|
config | Get a config value | config |
config-set | Set a config value | config-set key value |
config-list | List all config | config-list |
config-delete | Delete a config entry | config-delete key |
config-export | Export config as JSON | config-export |
config-reset | Reset all config | config-reset |
📚 Guides
Long-form guides live in the VFS under /guides/. The AI writes them there; you can
reach them three ways:
guides— list what exists, newest first (this is the index that did not exist before v4.6.63)preview <name>— render an HTML guide in the preview panecat <name>— read a markdown guide as text
Published guides on this server:
📁 Filesystem
All VFS files persist in localStorage. ls, cd, pwd work like a real terminal. Clickable output — tap a file to cat, tap a dir to cd.
| Command | Description | Example |
|---|---|---|
ls / ll | List files | ll |
cd | Change directory | cd notes |
pwd | Print working directory | pwd |
cat | View file | cat readme.txt |
put | Create file with content | put hello.txt Hello World |
edit | Open in modal editor | edit notes.md |
rm | Delete file | rm temp.txt |
mkdir | Create directory | mkdir projects |
rmdir | Remove directory | rmdir empty |
trash | Move file to trash | trash temp.txt |
trash-dir | Move directory to trash | trash-dir olddir |
ls-trash | List items in trash | ls-trash |
empty-trash | Permanently delete all trash items | empty-trash |
mv | Move/rename | mv old.txt new.txt |
cp | Copy file | cp a.txt b.txt |
touch | Create empty file | touch newfile.txt |
tree | Directory tree | tree |
find | Recursive file search | find .txt |
diff | Compare two files | diff a.txt b.txt |
grep | Search file contents | grep hello *.txt |
head | First N lines | head file.txt 10 |
tail | Last N lines | tail file.txt 10 |
sort | Sort file lines | sort file.txt |
wc | Count lines/words/chars | wc file.txt |
du | Disk usage | du |
upload | Upload file from device | upload |
download | Download file | download file.txt |
vfs-size | Show VFS size report (top files, system dirs) | vfs-size |
vfs-clean | Nuke snapshots, sessions, and trash | vfs-clean |
vfs-export | Download VFS as JSON | vfs-export |
vfs-import | Import VFS from JSON | vfs-import |
session-save | Save a session snapshot | session-save |
session-load | Load a session snapshot | session-load mysession |
session-list | List all saved sessions | session-list |
session-delete | Delete a session | session-delete old |
session-export | Export session as JSON download | session-export mysession |
session-import | Import a session from file | session-import |
sed -n 'N,Mp' | s/a/b/ | /pat/d | -i | Print or edit VFS file lines | |
files | Open the Files panel |
🤖 AI Assistant
How It Works
- Type
ai <request> - AI loads relevant skills + recent session memory
- Decides which tools to call (up to 8 turns)
- Destructive tools trigger an inline confirm bar — no dark overlay
- 120s countdown: yellow → bold red at 30s → pulsing at 10s
- Type
ai-allow/ai-denyor tap the buttons - After complex tasks, AI suggests creating a skill
write_file, delete_file, make_directory, edit_module require confirmation before executing. run_command only requires confirmation for destructive commands (rm, kill, format) — safe-read commands like ls, find, tree are auto-approved.
Available Tools
| Tool | Description | Destructive? |
|---|---|---|
list_files | List VFS directory | ❌ |
read_file | Read file (8k trunc) | ❌ |
write_file | Write to file | ✅ |
make_directory | Create directory | ✅ |
delete_file | Delete file/dir | ✅ |
get_status | System status | ❌ |
get_help | List commands | ❌ |
web_search | SearXNG + DDG | ❌ |
web_fetch | Extract URL content | ❌ |
run_command | Execute terminal cmd (safe-read auto-approved) | ❌ (only destructive cmds) |
load_skills | Search relevant skills | ❌ |
create/patch/list_skills | Skill management | ❌ |
view/edit/test/reload | Module operations | edit ✅ |
user_get/set/list/forget | User profile | ❌ |
session_save/load/recent/stats | Session memory | ❌ |
vaultmind_connect | Connect wallet to VaultMind AI (reads key from SecretVault) | ❌ |
vaultmind_status | Check VaultMind session status | ❌ |
vaultmind_query | Query VaultMind: prices, portfolio, chat | ❌ |
webx <question> | Ask the assistant (short alias of webxai) | |
webxai <question> | Ask the assistant a one-off question | |
wx <question> | Alias of webxai | |
ai-model [name] | Show or set the active model | |
ai-ignore <path> | Exclude a path from AI context | |
commit-status | Show the pending AI file-commit batch | |
commit-approve | Apply the pending AI file commits | |
commit-deny | Discard the pending AI file commits | |
context | Show the active AI context profile | |
contexts | List context profiles | |
context-new <name> <display> <systemPrompt> | Create a context profile | |
context-delete <name> | Delete a context profile | |
context-auto on|off | Auto-switch contexts | |
smart-ask <question> | Ask with automatic context selection |
Sound Notification
A short "ding" plays via WebAudio when AI finishes. Toggle with the 🔊 Sound button in quick-actions. Persists in localStorage.
🔄 Agent Loop Studio
Commands
| Command | Description |
|---|---|
agent-loops | List all profiles with turns, tools, and benchmark results |
agent-loops <name> | Switch to a named profile |
agent-loops new <name> <desc> | Create a new profile from defaults |
agent-loops edit <name> <key> <val> | Edit a profile setting (dot-notation, e.g. loop.maxTurns 12) |
agent-loops delete <name> | Delete a profile (not default) |
agent-loops clone <src> <dst> | Clone a profile |
agent-loops export <name> | Export profile as JSON |
agent-loops reset <name> | Reset profile to defaults |
bench <profile> [--tasks=ids] | Run benchmark suite on a profile (6 tasks: fs-navigate, fs-create-read, nvfs-resolve, web-search, multi-tool, code-edit) |
bench-compare <p1> <p2> | Compare benchmark results of two profiles |
Default Profiles
| Profile | Turns | Tools | Temp | Use Case |
|---|---|---|---|---|
default | 8 | all | inherit | Balanced general-purpose |
minimal | 4 | 4 (custom) | 0.3 | Fast, low-token simple tasks |
research | 6 | 7 (custom) | 0.5 | Read-only web + file exploration |
safe | 8 | all (destructive disabled) | 0.5 | No destructive tools |
creative | 12 | all | 0.9 | More turns, higher creativity |
coder | 10 | all | 0.2 | Code-focused with append directive |
System Prompt Layering
| Command | Effect |
|---|---|
ai-system +"directive" | Prepend a directive to the active profile's system prompt (persists to profile) |
ai-system -"directive" | Append a directive to the active profile's system prompt (persists to profile) |
ai-system "text" | Full replace (persists to localStorage, overrides profile) |
ai-system reset | Restore default system prompt |
Self-Improvement
After each AI run, _postRunReview() detects anomalies: near-max-turns, high token usage, tool failures, and above-benchmark consumption. Lessons are auto-saved as VFS skills under /skills/loop-lesson-*.
AI Tools
The AI can also manage profiles via tools: agent_loop_list, agent_loop_switch, agent_loop_create, agent_loop_benchmark.
📚 Skills System
📄 skills.html
Dynamic skill browser — searchable, filterable card grid with tag badges, category pills, and update dates. Zero hardcoded data.
📘 guide.html
Quick user guide with anchor-navigable sections, module refs, and command examples.
Terminal Commands
# List all skills skill-list # Create a skill skill-create my-skill "Does X" "Steps to do X" "tag1,tag2" # View / patch / delete skill-view my-skill skill-patch my-skill "Updated steps" skill-delete my-skill # Export / Import skill-export my-skill skill-import
Auto-Creation
When the AI encounters the same tool error 3+ times, a workaround skill is auto-created. Every 20 messages, skills are audited for staleness.
| Command | Description |
|---|---|
learn-skill <topic> | Learn a new skill from a topic |
skill-validate <name> | Validate a skill file |
skill-audit | Audit all installed skills |
skill-restore <name> | Restore a skill from its backup |
skill-pack-core | Install / verify the core skill pack |
🤖 Ollama
Setup
# Install & pull a model curl -fsSL https://ollama.com/install.sh | sh ollama pull llama2 # Start Ollama ollama serve # In WebX11 ollamaconnect
Commands
| Command | Description |
|---|---|
ollamaconnect | Connect to Ollama |
ollamasetproxy | Set remote endpoint |
ollamamodels | List models |
ollamasetmodel | Set active model |
ollamadisconnect | Disconnect |
ollama | Open Ollama Manager UI |
models | List all models |
model-info | Model details |
model-pull | Pull a model |
model-delete | Delete a model |
model-run | Run model with prompt |
OLLAMA_ORIGINS="*" ollama serve
🌐 Search & Web
| Command | Module | Description | Example |
|---|---|---|---|
search / s | SearXNG | Web search | search raspberry pi |
fetch / web | Fetcher | Fetch URL content | fetch https://example.com |
extract | Fetcher | Clean readable text | extract https://news.article |
images | SearXNG | Image search | images cats |
videos <query> | Video search via SearXNG |
The AI agent also has web_search and web_fetch tools using the same APIs.
🎤 Voice & Sound
- Tap 🎤 to start listening — button pulses green
- Say your command — recognized text fills the input
- Tap again or wait to stop
- Red flash indicates failure
Sound
Toggle AI response "ding" with the 🔊 Sound button. Persists in localStorage.
| Command | Description |
|---|---|
speak <text> | Speak text aloud (TTS) |
voice | Voice settings and microphone test |
analyze <file> [--frames N] [--spectrogram] [--beats] [--scene] | Analyze an audio or video file |
⚙️ Configuration
All config values stored as webx11_config_* in localStorage. Use the ⚙ Config button or CLI commands.
Notable Keys
| Key | Description | Values |
|---|---|---|
webx11_config_ai_sound | AI sound toggle | on, off |
webx11_config_voice_visible | Mic button visibility | on, off |
Persisted State
| Key | Description |
|---|---|
webx11_filesystem | VFS JSON |
webx11_modules | Loaded module URLs |
webx11_ollama_endpoint | Ollama API URL |
webx11_ollama_model | Selected model |
webx11_startup_modules | Startup selection |
webx11_font_size | Font size (8–32) |
webx11_command_history | Command history |
webx11_terminal_output | Persisted output |
webx11_ai_context | AI conversation history |
webx11_user_profile | AI user profile |
webx11_aliases | User-defined aliases |
bug | Generate a bug report from the current session |
factory-reset-old --confirm | Legacy full reset (prefer factory-reset) |
setfont <px> | Set terminal font size (alias of font-size) |
🔒 Secret Vault
| Command | Description |
|---|---|
secret-set | Encrypt and store a secret |
secret-get | Decrypt and display a secret value |
secret-list | List all stored secret names |
secret-del | Remove a stored secret |
secret-lock | Lock the vault (clears key from memory) |
secret-unlock | Unlock the vault with PIN |
secret-setpin | Set or change vault PIN |
secret-status | Show vault status (locked/unlocked/pin set) |
encrypt <path> <passphrase> | AES-256-GCM encrypt a VFS file |
decrypt <path.enc> <passphrase> | Decrypt a .enc file |
🧠 VaultMind AI
Setup
- Store your Hyperliquid private key:
secret-set hyperliquid_key 0x... - Ask the AI to connect:
ai connect to vaultmindor use thevaultmind_connecttool - Check status:
ai check vaultmind statusorvaultmind_status
AI Tools
| Tool | Description |
|---|---|
vaultmind_connect | Reads hyperliquid_key from SecretVault, authenticates with VaultMind backend, stores session token |
vaultmind_status | Checks if a valid VaultMind session token exists in localStorage |
vaultmind_query | Query endpoints: prices, portfolio, transactions, copy-trade, or chat with an AI agent |
API Endpoints (proxied via nginx)
| Path | Backend |
|---|---|
/vmai/ | Proxied to VaultMind backend at 127.0.0.1:8000 |
/vmai-api/ | Alias for frontend chat — also proxied to 127.0.0.1:8000 |
vaultmind-connect | Connect VaultMind to the trading API |
vaultmind-status | VaultMind connection and balance status |
vaultmind-query <prices|portfolio|transactions|copy-trade|chat> | Query VaultMind |
wallet-lookup <address> | Look up a wallet address |
🧩 Module System
Commands
| Command | Description |
|---|---|
modules | Open Module Manager UI |
loadmod <url> | Load module from URL |
removemod <name> | Remove a module |
listmods | List all loaded modules |
load-local | Load module from VFS or URL |
loadlocal | Alias for load-local |
js <expr> | Evaluate JavaScript in page context (browser only — no Node built-ins such as fs) |
js-run <path> | Load and execute a JS file from VFS (browser only — no Node built-ins) |
startup-modules | Configure boot modules |
module-load <name> | Load a module by name |
module-unload <name> | Unload a module |
module-enable <name> | Enable a module for startup |
module-reset <name> | Reset a module to its shipped source |
Boot Order
- Splash screen with ⚙ gear
- Foundation:
virtual-fs.js→module-manager.js→ollama-manager.js→terminal.js - Built-in modules loaded async
- Ext modules loaded if selected
- Splash hides, terminal ready
Code Editor
The AI can edit_module(name) to copy source into the Code Editor modal. Edit inline, then 💾 Save & Test to load live from /_mods/. Use test_module without reloading the page.
You can also type edit modules/ext/foo.js — the editor now mirrors saves to _mods/<name>.js so test_module works from either path.
🧰 Extended Modules
WebDAV Sync
| Command | Description |
|---|---|
webdav-config | Configure server |
webdav-status | Connection status |
webdav-ls | List remote dir |
webdav-push | Push file |
webdav-pull | Pull file |
webdav-backup | Backup VFS |
webdav-restore | Restore VFS |
webdav-backup-list | List backups |
webdav-browser | Visual file explorer modal |
Calculator & Cron
| Command | Module | Description |
|---|---|---|
calc | calc.js | Evaluate math / unit conversion |
cron-every | cron.js | Schedule a command |
cron-list | cron.js | List scheduled jobs |
cron-stop | cron.js | Stop a job |
cron-clear | cron.js | Clear all jobs |
Theme, WPM & Mindmap
| Command | Module | Description |
|---|---|---|
theme | theme.js | Set color theme (dark, light, amber, cyber, …) |
wpm | wpm.js | Package manager |
mindmap | mindmap.js | Show file structure as mindmap |
Server Monitor
| Command | Description |
|---|---|
server | Add server to monitor |
servers | List monitored servers |
server-check | Ping a server |
server-remove | Remove server |
monitor | Toggle auto-monitoring |
course open <lessonId> | course list | Course browser |
kanban add <task> | list | done <id> | Task board |
three add text <text> | reset | screenshot | 3D scene commands |
gui-run <command> | Run a command and render its output in the GUI panel |
gui-text <content> | Render text in the GUI panel |
gui-clear | Clear the GUI panel |
gzip <path> | Compress a VFS file to .gz |
wget <url> [filename] | Download a URL and save it to the VFS |
Aliases
Built-in: ll = ls, h = help, cls = clear. Define custom: alias x=ls -la. Remove: unalias x. Persists in localStorage.
🔧 BusyBox Utilities
| Command | Description | Example |
|---|---|---|
which | Locate command in module registry + fuzzy suggestions | which ls |
env | List local env vars (webx11_, ollama, user profile) | env |
date | Current time (local, ISO, UTC, Unix timestamp) | date |
cal | ASCII calendar for any month/year | cal 12 2026 |
yes | Output repeated string (capped at 50) | yes test |
seq | Generate number sequence | seq 1 5 |
base64 | Base64 encode/decode | base64 -d aGVsbG8= |
printf | Formatted print (%s, %d, %f) | printf "hello %s" world |
cut | Extract column from file | cut -f2 -d, data.csv |
uniq | Filter adjacent duplicates | uniq lines.txt |
hostname | Show host/platform info | hostname |
whoami | Show current user | whoami |
basename | Strip directory from path | basename /a/b/c.txt |
dirname | Strip filename from path | dirname /a/b/c.txt |
sleep | Countdown delay (1-30s) | sleep 3 |
expand | Convert tabs to spaces | expand code.txt |
All file-reading commands (cut, uniq, expand) work with shell pipes: cat data.csv | cut -f2 -d, | uniq.
🪟 Floating UI Elements
| Command | Description | Example |
|---|---|---|
floating-add | Add a floating element (btn, menu, or panel) | floating-add btn quick-status ls -la |
floating-remove | Remove a floating element | floating-remove quick-status |
floating-list | List all floating elements | floating-list |
floating-pos | Reposition an element (x y in px, or auto) | floating-pos menu1 100 200 |
floating-clear | Remove all floating elements | floating-clear |
floating-toggle | Show/hide a floating element | floating-toggle menu1 |
Usage Examples
# Simple button — click to run a command floating-add btn quick ls -la # Menu with sub-buttons (btn:Label:command) floating-add menu tools Tools btn:Status:status btn:Help:help btn:Check:health-check # Panel with info text floating-add panel info "Server: production | Uptime: 12d" # You can drag buttons and menu headers to reposition them # Position persists across page reloads
🔍 Runtime Debug — /sys/
Path Reference
# Overview cat /sys/info # Memory cat /sys/heap/stats cat /sys/heap/breakdown # AI Internal Logs cat /sys/logs/tool-calls cat /sys/logs/errors cat /sys/logs/commands # VFS Stats cat /sys/vfs/stats cat /sys/vfs/largest # Module Info ls /sys/modules/ cat /sys/modules/calc/info # DOM / Config cat /sys/dom/node-count cat /sys/config/ai cat /sys/config/version
Also available: mem-debug (one-shot text output), reset-mem (clear AI internal logs without touching VFS or config), and the DebugSupervisorModule (debug-stats, debug-history, debug-analyze, debug-trends, debug-fix, debug-health) for persistent error tracking and root-cause analysis.
🐚 Shell
Pipes |
Chain commands by piping stdout to the next command's stdin. Pipe-aware commands (grep, head, tail, sort, wc, cut, uniq, expand) auto-read from pipe when no file argument is given.
# Filter file listing ls | grep .md # Count lines matching pattern cat notes.txt | grep error | wc # Pipeline: filter → sort → head cat data.csv | grep 2026 | sort | head -5
Redirects > >> <
# Write output to file cal > /tmp/calendar.txt # Append to file echo "new line" >> log.txt # Read file as stdin grep error < log.txt
Command Chaining
# AND: next runs only if previous succeeds touch test.txt && echo "created" # OR: next runs only if previous fails rm nonexistent || echo "failed" # Sequence: runs in order regardless cd /skills; ls
Variables
# Set a variable export GREET=hello # Reference in any command echo $GREET # List all vars set # Remove a var unset GREET
Scripts
VFS files with .sh extension can be executed line by line. Variables persist across lines.
# Create a script in VFS echo 'export NAME=WebX11' > greet.sh echo 'echo "Hello, $NAME!"' >> greet.sh # Run it script greet.sh sh greet.sh
Shell Commands
| Command | Description |
|---|---|
export <var>=<val> | Set a shell variable |
unset <var> | Remove a shell variable |
set | List all shell variables |
script <path.sh> | Run a VFS script file |
sh <path.sh> | Alias for script — run a VFS script file |
alias [name=value] | List aliases or set a custom alias name=command |
unalias <name> | Remove a custom alias |
h · s · ll | Short aliases: h = help, s = web search, ll = detailed listing |
dashboard [--watch|--stop] | Collect live telemetry and open the dashboard page; --watch re-collects every 5 s |
cost [on|off] | Retail prices per model, today's anonymous free-message allowance and this session's token spend; on/off toggles a per-reply cost line (usage is an alias) |
usage [--json] [--reset] | LLM token usage report for this browser (per model, cost estimate) |
df | Virtual filesystem usage |
free | JS heap / memory snapshot |
top | Busiest commands and modules by activity |
ps | Commands and follows currently running |
history [--search <term>] | Command history, optionally filtered |
run <script> | Execute a saved script from the VFS |
sysmsg [on|off] | Toggle system messages |
view_module <name> | Print a module's source |
node <script.js> | Run a JS file from the VFS (alias of js-run) |
🪄 Floating UI
| Command | Description |
|---|---|
floating-add btn <id> <label> <command> | Spawn a floating button that runs a terminal command |
floating-add menu <id> <label> btn:Sub|cmd ... | Spawn a collapsible floating menu with sub-buttons |
floating-add panel <id> <title> <content> | Spawn a floating text panel |
floating-remove <id> | Remove a floating element |
floating-list | Show all floating elements with IDs and positions |
floating-pos <id> <x|auto> <y|auto> | Reposition a floating element |
floating-toggle <id> | Show/hide a floating element |
floating-clear | Remove all floating elements |
# Create a button floating-add btn files "📁 Files" ls # Create a collapsible menu floating-add menu tools "🔧 Tools" btn:Help|help btn:Clear|clear # Create a status panel floating-add panel status "📊 Status" "Ready" # List all elements floating-list # Hide without removing floating-toggle files
🔒 Security & Guardrails
Guardrail Policy
Pre-execution guardrails intercept AI tool calls and block or warn on patterns matching dangerous operations:
| Rule | Description | Severity |
|---|---|---|
rm-rf-block | Prevent recursive force deletes | 🔴 deny |
curl-pipe-bash | Block curl-to-bash execution | 🔴 deny |
rm-outer-vfs | Block deletion of sensitive metadata files | 🔴 deny |
mass-delete | Block mass-delete operations | 🔴 deny |
chmod-777 | Block world-writable permissions | 🔴 deny |
eval-danger | Block dynamic code execution (eval/exec/system) | 🔴 deny |
external-dl | External file download warning | 🟡 warn |
env-overwrite | Modifying environment variables | 🟡 warn |
Commands
| Command | Description |
|---|---|
guardrail | Show guardrail policy rules and violation count |
guardrail-add <id> <severity> <pattern> <tools...> | Add a custom guardrail rule (severity: deny/warn) |
guardrail-remove <id> | Remove a guardrail rule |
shadow <command> | Execute command in Shadow VFS — snapshot, run, diff changes |
shadow-commit | Accept shadow VFS changes |
shadow-rollback | Undo shadow VFS changes |
Confidence Escalation
When the AI requests destructive actions, it must declare Confidence: N% in its reasoning. Below 90%, manual approval is required. If no confidence is declared, manual approval is required by default. This prevents the AI from making low-confidence destructive changes.
💬 Sessions
Sessions persist AI conversation logs in VFS /memory/. The AI auto-loads recent sessions at start for continuity.
AI Tools
| Tool | Description |
|---|---|
session_save | Save summary |
session_load | Load by date |
session_recent | Show last N |
session_stats | Aggregate statistics |
session-new | Start a fresh AI session (clears context, keeps history) |
The terminal auto-saves session state every 60s and auto-restores on page reload.
💾 Storage
# Clear all WebX11 data localStorage.clear() location.reload() # Back up / restore VFS vfs-export vfs-import
~5–10MB per domain. Only URLs (not code) are stored for modules.
☁️ WebDAV
Cloud sync with your WebX11 space. File-tree browser UI with bulk actions.
| Command | Description |
|---|---|
webdav-config <url> <token> | Configure WebDAV connection |
webdav-status | Show sync status and connection health |
webdav-ls [path] | List remote files |
webdav-push <local> [remote] | Upload file to cloud |
webdav-pull <remote> [local] | Download file from cloud |
webdav-browser | Open file-tree browser UI with checkboxes, context menu, inline rename, per-file preview 👁 / open-in-new-tab ⛶ buttons, minimize-to-floating and share-URL header buttons |
webdav-rm <path> | Delete remote file/directory |
webdav-mkdir <path> | Create remote directory |
webdav-rename <old> <new> | Rename remote file |
webdav-move <src> <dst> | Move remote file (alias for rename) |
webdav-backup | Backup entire space |
webdav-login <user> | Store WebDAV credentials for this session |
Browser Features
- Checkbox select + Select All toggle
- Bulk action bar: Delete, Move, Download selected files
- Inline rename: double-click filename
- Right-click context menu with all operations
- Breadcrumb navigation
- Create-directory button
- Keyboard shortcuts:
j/knavigate,Spaceselect,Enteropen
🤖 Agent Orchestration
Register, list, and delegate tasks to AI agents with lease-based lifecycle management.
| Command | Description |
|---|---|
agent-list | List all registered agents with status |
agent-status <id> | Show detailed status for a specific agent |
agent-register <name> <model> | Register a new AI agent |
agent-unregister <id> | Remove an agent from the registry |
lease-list | Show active leases — agent tasks with status and TTL |
orchestrate <task> | Delegate multi-step task to agent orchestrator |
orchestrate-parallel <task> | Decompose and run sub-tasks in parallel (auto-splits on "and"/"then") |
orchestrate-decompose <task> | Preview how a task would be split into sub-tasks |
orchestrate-result | Show results of the last parallel batch |
orchestrator-status | Show orchestrator agent pool status |
orchestrator-list | List all spawned agents with full details |
orchestrator-spawn <role> [caps...] | Spawn a new worker agent |
orchestrator-sleep <id> | Suspend agent to VFS (survives reload) |
orchestrator-wake <id> | Restore agent from VFS sleep state |
orchestrator-kill <id> | Terminate an agent and revoke leases |
orchestrator-purge | Remove dead agents (>60s silent) |
orchestrator-config <key> <value> | Tune: spawn-limit, spawn-strategy, heartbeat-timeout, idle-timeout, restart-policy, a2a-polling (on/off), a2a-poll-interval, heartbeat-check, idle-sweep-interval, dead-purge-timeout, consensus-size, consensus-strategy, consensus-timeout, pipeline-auto-fix, pipeline-stage-timeout (persisted) |
orchestrator-restart-policy <id> <policy> | Set per-agent restart policy: on-failure, always, never |
consensus <question> | Consensus: spawn N agents, debate, resolve by majority vote |
consensus-status | Show current/active consensus round status |
consensus-history | Show past consensus rounds and resolutions |
pipeline <test|deploy|verify|history|config> | Autonomous CI/CD: test agents/modules, deploy (test→auto-fix→verify), history, config |
lease-create <agent-id> [duration] [task] | Create a time-bound lease for a worker agent |
lease-list | Show active leases — agent tasks with status and TTL |
lease-revoke <id> | Revoke an active lease |
lease-renew <id> <seconds> | Extend an active lease by N seconds |
orchestrator-schedule <role> <interval_s> <task...> | Schedule a recurring task for a role |
orchestrator-schedules | List scheduled tasks |
orchestrator-unschedule <id> | Remove a scheduled task |
📜 A2A Contracts
Define and enforce agent-to-agent contracts with input/output schema validation. Contracts are stored in /.contracts/ and validated during orchestrator delegation.
| Command | Description |
|---|---|
a2a-send <agent-id> <json> | Send an A2A message to an agent's VFS inbox |
a2a-list | Show all A2A messages with pending status |
contract-register <role> [fields...] --output [fields...] | Register a contract with input/output schema |
contract-list | List all registered contracts |
a2a-post <to> <type> <capability> <payload> | Post a message to another agent's mailbox |
a2a-poll | Read your own inbox |
a2a-ack <id> | Acknowledge a message |
a2a-reject <id> | Reject a message |
a2a-status | Mailbox counters per agent |
a2a-prune | Drop old and acknowledged messages |
🧠 Neural VFS
Semantic concept-indexing layer over the hierarchical VFS. Scans files and builds a concept → path mapping using filenames, tags, and headers.
| Command | Description |
|---|---|
memgraph-status | Memory graph node/edge counts |
memgraph-search <q> | Find nodes by label or type |
memgraph-stats | Most connected nodes, strongest edges |
memgraph-export | Export graph as JSON |
memgraph-prune | Remove stale low-weight edges |
nvfs-status | Show index stats and last scan time |
nvfs-resolve <concept> | Find files related to a concept (exact + fuzzy) |
nvfs-tree [concept] | Show concept-to-file mapping tree |
nvfs-config [key] [value] | View/set config (fuzzy-limit, tree-files, tree-concepts, resolve-files, deep-index, deep-model) |
nvfs-alias list|add|remove|clear | Manage concept aliases |
nvfs-sync [--deep] | Incremental background sync dirty files |
nvfs-save | Force-save semantic index to VFS disk |
nvfs-cancel | Cancel running index operation |
nvfs-index-graph [--deep] | Build the NVFS index dependency graph |
📊 Server Monitor
Uptime monitoring for external services + self-optimization telemetry tracking tool latency and error rates.
| Command | Description |
|---|---|
server <name> <url> | Add a server to monitor |
servers | List all monitored servers |
server-check <name> | Check a server's current status |
monitor | Toggle auto-monitoring (60s interval) |
system-health | Tool latency, VFS stats, modules, memory, error rates |
predict <task> | Predict task duration, tool turns, and confidence |
predictor-status | Prediction model accuracy and data points |
predictor-config <k> <v> | Tune confidence-threshold, min-data-points |
🔧 Debug Panel
Toggle the debug overlay to monitor system internals in real-time.
| Command | Description | |
|---|---|---|
debug | Toggle debug panel on/off | |
debug-sync | Push debug records to the configured sync endpoint | |
debug-sync-url <url> | Show or set the sync endpoint | |
feedback <message> | Send feedback to the WebX11 maintenance agent (appears in its next triage run) | feedback download link 403s on mobile |
feedback-inbox | Read replies from the maintenance agent (requires an admin session) | feedback-inbox |
Debug Panel Shows
- Memory — localStorage usage, VFS size, session context size
- Events — registered event listeners, module event bindings
- Errors — recent JS errors with stack traces
- Modules — loaded count, broken references, cache state
Useful for troubleshooting module load failures, VFS corruption, and AI context bloat.
🧪 Sandboxed Execution
WebWorkers provide isolated contexts for task execution. Each worker gets a VFS snapshot so operations don't interfere with the main terminal.
| Command | Description |
|---|---|
sandbox-status | Show worker pool health and task metrics |
sandbox-config <k> <v> | Configure max-workers, min-workers |
sandbox-run <task> | Execute a task in the sandbox pool |
orchestrate --sandboxed <task> routes delegation through the sandbox for full isolation.
🧠 Memory Graph
Cross-session persistent graph database tracking files, concepts, tasks, and tools. Nodes store metadata, edges record relationships with weighted strength. Survives page reloads via VFS persistence.
| Command | Description |
|---|---|
memgraph-status | Show node/edge counts and graph health |
memgraph-search <q> | Find nodes by label, type, or id |
memgraph-stats | Most connected nodes and strongest edges |
memgraph-export | Export full graph as JSON to VFS |
memgraph-prune | Remove stale low-weight edges (>30d, <3 uses) |
memgraph-learn <entity> <fact> | Add a fact to the memory graph |
memgraph-agent <agentId> | Show one agent's memory subgraph |
memgraph-session [YYYY-MM-DD] | Show a day's session graph |
memgraph-decay-config <days> <min_uses> | Tune memory decay |
Context is automatically injected into AI prompts for cross-session awareness.
🌐 World Model
System self-awareness engine. Synthesizes data from memory graph, module system, skills index, telemetry, and agent pool into a unified model at /system/world-model.json. Auto-refreshes every 5 minutes.
| Command | Description |
|---|---|
world-model | Show full world model breakdown |
world-model-summary | One-line system status summary |
world-model-ask <q> | Query modules, skills, agents, health, or changes |
world-model-refresh | Force re-synthesis immediately |
world-model-config <k> <v> | Tune refresh-interval and max-projects |
🔒 Security
| Feature | Status |
|---|---|
| Input Validation | ✅ |
| Output Escaping | ✅ |
| No eval() on User Input | ✅ |
| Path Traversal Prevention | ✅ |
| Sandboxed File System | ✅ |
| AI Destructive Confirmations | ✅ Required + 120s countdown |
| Iframe Preview Sandbox | ✅ allow-same-origin allow-scripts |
Security Levels
| Level | Behavior |
|---|---|
0 | Unrestricted — all commands allowed without confirmation |
1 (default) | Confirm destructive actions (rm, overwrite, etc.) |
2 | Deny sensitive commands (rm -rf, encrypt operations) |
3 | Deny all dangerous commands (requires deliberate override) |
| Command | Description |
|---|---|
security-level <0-3> | Set active security level |
security | Show full status: level, blocked count, destructive/system/whitelist sets, suspicious flags, registered commands |
security-destructive list | Show destructive command set |
security-destructive add|remove <cmd> | Add/remove command from destructive set (persisted) |
security-system list | Show system command set |
security-system add|remove <cmd> | Add/remove command from system set (persisted) |
security-whitelist list | Show whitelist command set |
security-whitelist add|remove <cmd> | Add/remove command from whitelist (persisted) |
security-flag list | Show suspicious flags |
security-flag add|remove <flag> | Add/remove suspicious flag (persisted, -- prefix optional) |
cmd-allow <command> | Add command to allowlist (bypasses restrictions) |
cmd-deny <command> | Add command to denylist (always blocked) |
🔧 Troubleshooting
| Issue | Solution |
|---|---|
| AI not responding | Run ollamaconnect first, ensure Ollama is running |
| Voice not working | Chrome/Edge/Safari only. Grant mic permission |
| Module fails to load | Check CORS on the hosting server |
| Data lost after refresh | Check localStorage is enabled. Private mode clears data |
| AI actions not confirming | Confirm bar auto-denies after 120s. Type ai-allow |
| Sound not playing | Browser may need first user gesture. Toggle off/on |
| Ollama CORS error | OLLAMA_ORIGINS="*" ollama serve |
Debug
# Console F12 → Console # View AI state ai-system ai-context # Module status listmods
⚡ Quick Reference
📄 One-page Quick Reference cheat sheet — printable, dark mode, all commands.
📋 Changelog
- The window warns before it forgets. At 80% of the token budget the
terminal says so once —
⚠️ Context 90% full (900/1000 tokens)— instead of only announcing the fall after compression. It does not repeat on every turn. - Trimming leaves a marker. Old turns used to vanish silently, so a long
task "remembered" a conversation that never started that way. The window now opens with
[context trim: 6 earlier message(s) left this window — the earliest was: "turn 0 original brief text…"]. - The help text stopped lying.
max-context-tokensclaimed a default of 2000; the code has always used 12000. - On the "400k / 422k" report: no such limit exists in this codebase —
the only budgets are
maxContextTokens(12 000) andmaxContext × 2messages. That figure came from outside the app; nothing here was changed to chase it.
- A directory listing invented a
sysentry.lsinjects the virtual/sys— but it tested the argument instead of the result, so aftercd _agentsthe listing showedsysinside_agents, and a follow-uplist_files('_agents/sys')failed with "Directory not found". The listing lied; the resolver was right. Injection now happens only for the root directory. treecrashed on the root listing. The same virtual entry was pushed into the walk and then dereferenced, throwingCannot read properties of undefinedmid-output — a partial tree, which is where two different file counts came from.- The file counts now agree. The world model's walk descended into the
synthetic
/syssubtree, so it reported 146 files in 114 directories for a store that holds 44 in 15. It skips virtual entries now, and matches an independent walk exactly.
- "Broken refs: 2" named neither of them — because both were documentation.
The checker grepped for
skill-view <name>in every skill's prose, so the placeholder and a quoted example counted as missing skills. Placeholders are now skipped, and any real breakage is named:Broken refs: 1 (probe-broken-ref → ghost-skill). - Two quick reloads no longer break the app. Opening newOS4 costs about
35 module requests at once; the site-wide rate zone (60 r/min, burst 50) treated that as a
flood and served
503for part of the bundle — measured 4 modules failing on a third reload. Static module and skill files now have their own zone; HTML and API requests keep the strict one.
- "999d unused" was a placeholder, printed as if measured. A skill with no
usage telemetry got
daysUnused = 999, so the audit listed it as unused for nearly three years — a fabricated figure that invited archiving good skills. It now separates the two real cases:(never used)when there is nolastUsedat all, and a genuine day count otherwise. - The audit already distinguished untracked skills. 24 skills with no telemetry are reported as untracked, not stale — the sentinel was the one place that still pretended to know.
- The first tool the system prompt tells the model to call no longer fails.
world_model_querywith the default detail parsed_modelDigest()as JSON — but that digest was a JSON string cut at 4000 characters with…(digest truncated)glued on, so it threwUnexpected end of JSON inputevery time.detail:"full"worked only because it returned the object and never parsed anything. - A digest shrinks, it does not break. The model now builds a real
snapshot object and drops list lengths (40 → 20 → 10 → 5 → 3 → 1 → 0), and if still too
large drops whole sections, reporting what it left out in
omitted. The string form is only produced at the edge, and is always parseable.
- A skill created from the terminal is now the skill you wrote. The old parser joined every argument with a space — so line breaks vanished — and treated the last argument as a tag list whenever it contained a comma, which it then also left inside the body. A multi-line skill arrived as one line carrying a dozen bogus tags, and it still reported success.
- Bodies can come from a file.
skill-create <name> <desc> /path/to/body.md --tags=a,b --category=xkeeps markdown exactly as written; inline text still works for one-liners. - Tags are opt-in. Only
--tags=creates tags — a comma in your prose is no longer a taxonomy.skill-patchaccepts a path too, for the same reason.
- Delegation no longer lies.
outboxResultwas declared inside the branch that needs the AI module but read outside it, so any delegation with the module missing threwoutboxResult is not defined— caught as an agent failure, leaving the worker idle with no result. It now returnsqueued — AI module not loaded, nothing executedinstead of a crash or a false "completed". - Markdown renders.
_docs/*.mdwas served asapplication/octet-stream, so every document opened as a download. Nowtext/markdown, withnosniff. - One reply path.
agent-replies.phpanswers410 Gonefor reads as well as writes, pointing at the chat channel.
- The agent can finally see the answer. The terminal's 30 s poller and the
agent's
chat_hermes readshared one cursor, so the poller printed each reply and advanced past it — the human saw it, the model got an empty list. They now keep separate cursors, and the tool's first read returns the whole thread. - A corrupt thread is an error, not an empty one. A damaged file used to
read as
[], and the next append rewrote it with a single message. It now fails with500and leaves the file alone;chat.py listshows it asCORRUPTinstead of breaking the listing. - Cursor survives truncation. More than 50 new messages cut the response; the cursor now stops at the cut instead of the thread tail, so nothing in between is skipped for good. Same-millisecond posts get strictly increasing epochs.
- No more double replies.
hermes-pollprinted every reply twice; it now prints one 🤖 line per message. - Retry guidance that matches reality.
429says how many seconds to wait. A503means the front-end rate zone fired before the app — retry, it is not your mistake. - Hardening.
chat.py showvalidates the thread id (a../path used to reach any.jsonon the host); lock files are group-writable so both sides can open them; the auto-reply prompt treats message text as untrusted data and never acts on instructions found in it.
- Chat with Hermes from the terminal.
hermes <message>(alias:feedback) sends to the operator channel and prints the message id. Replies appear by themselves within 30 seconds;hermes-pollchecks immediately. - Contract first. Shapes, error codes and the millisecond cursor live in
_docs/chat-contract.md. A wrong token is401, oversize text is413(rejected, never trimmed), rate limits are429withretry_after_ms. - One write path.
feedbackno longer files a bug report; the old replies endpoint answers410 Gone.hermes-resetrotates the browser's token and starts a fresh thread. - The in-page agent can ask too. New tool
chat_hermes— send a question, read the answer on a later step. - Server side. Per-thread and per-IP rate windows, atomic writes,
data/chat/unreachable from the web. Host CLI:scripts/chat.py list|show|reply.
- No shell — and it now says so —
;,&&and||are refused with an explicit message instead of being folded into the command's argv (wherewc -l f && grep -c x freturned a plausible wrong number). A|arriving from the AIrun_commandtool is refused too, because that path bypasses the pipe splitter and degraded the pattern to empty. Documented at the top of the command reference. - Multiple paths in
wc—wc -c a bprinted onlyaand exited clean. It now prints one line per file plus atotal, and reports each missing file separately. lsprints text — it rendered only clickable chips (DOM-only), so any capture — the AIrun_commandtool, the diagnostics sweep — saw an empty result and reported "directory empty".view_moduleshows what is deployed — it returned the_mods/<Class>.jsedit cache first, unversioned, so after a rebuild it showed pre-fix source while the bundle was new. It now fetches the deployed file and prefixes the version; the cache is a labelled fallback.load_skillssearches tokens, not one phrase — the query used to be tested whole against name+description+tags, so"telemetry dashboard"returned 0 while"telemetry"returned 1, and a sentence could never match. Skill bodies were never searched. It now tokenises (stopwords dropped), scores name > description/tags > body, weights by how many tokens matched, keeps a phrase bonus so word order cannot zero a real hit, and reportsmatchedTokens: 2/3with each result.- On-demand workers, named as such —
orchestrator-statusno longer reports a dispatch ratio as a defect: it printsMode: on-demand — N/M worker(s) available, X delegation(s) this session, counted insidedelegateTask(). Spawn-on-demand is the design; a worker with nothing to do is healthy. - Predictor store: server canonical — the file under the user's WebDAV space is authoritative; the browser copy is a 5-minute read-through cache written through on save. A banner appears only when the two disagree, naming both counts. No new endpoint and no unauthenticated write path was added.
grep,headandtailtake several paths — they read only the first path argument and exited clean on the rest, the same silent dropwchad. Multiple files now printfile:line: text(grep) or==> file <==(head/tail), andgrep -cprints one count per file.tail -fstays single-file and says so.- An invalid
greppattern is an answer, not a crash — it used to throw out of the command handler into the error ledger, which is the ledger that has to stay trustworthy. It now printsgrep: invalid pattern: …and returns. - Agent status says what it means — four agents showed
sleepingwith no way to tell "waiting for work" from "never handed a task". They now readparked — NEVER SCHEDULED (0 tasks since …)orwaiting for work (3 tasks, last …), plus a dispatch line and a warning when spawning happened but nothing was ever dispatched. - A guide you can actually find —
guideslists/guides/newest-first; the help page has a Guides section with the command, the preview/cat hints and links to published guides. - One error counter —
errors,get_dashboard_dataand the world model tallied three different sinks (0 / 18 / 11 in the same second). All three now readterminal.countErrors()(DebugSupervisor DB + failed tool calls); the VFS log is reported separately as a mirror, andterminal.log('ERROR', …)now records into the same DB instead of a second store nobody read. - Predictor arithmetic — the stored field named
mapeheld a sum, so any JSON consumer read a mean that was n times too large (nowerrorSum);errorPctis stored raw and clamped only at render (a 475× miss used to be flattened to 500%); predictions are floored at 1 s and floor-hits are not scored, because one 0.079 s aborted run was rounding the next prediction to 0 s.
- Predictor accuracy was structurally 0% — the denominator counted every observed run while the numerator only moved when a stored prediction matched, and predictions were stored only by the manual
predictcommand. Unpaired runs no longer enter the accuracy denominator; the AI loop now registers a prediction per turn (notePrediction) andpredict_taskreturns a trackedpredictionIdinstead of discarding its estimate. - Paired scoring — a prediction is consumed by threaded id → task hash → cli-only feature similarity ≥ 0.5, within a 15-minute TTL (
predictor-config pair-ttl <seconds>). A run counts as correct within 30% or 3 seconds of the predicted duration;predictor-statusshows paired accuracy, mean error, turns error, pending predictions and unpaired runs. - Schema v2 — stored payloads from v1 are migrated on load: observed runs and the prediction counter are kept, the meaningless
correct/totalcounters are dropped. Task text is stored as an FNV-1a hash, never in plaintext. Tuning (confidence-threshold,min-data-points,pair-ttl) now persists. - Knobs that do something —
min-data-pointsnow scales prediction confidence (it was declared, displayed and settable but never read), durations exclude chat-lock queue wait, and the confidence percentages onpredict/predict_taskwill move for the same history (fewer points ⇒ lower confidence).
- Documentation backlog cleared — 74 commands that the code registered but this page never documented are now in their own sections:
dashboard(with--watch/--stop),usage,ps/top/df/free, the sixa2a-*mailbox commands,webxai/webx/wx,context/contexts/context-new/context-delete/context-auto/smart-ask, thecommit-*approval trio,module-load|unload|enable|reset,memgraph-agent|session|decay-config,orchestrator-schedule|schedules|unschedule,skill-validate|audit|restore|pack-core,learn-skill,encrypt/decrypt,gzip/wget,kanban,three,course,videos,speak/voice/analyze,gui-run|text|clear, thevaultmind-*set,debug-sync/debug-sync-url,setfont,bug,session-new,files,node,sed,nvfs-index-graph,wallet-lookup,ai-model,ai-ignore,webdav-login,view_module,run,sysmsg,history. - Ghost rows removed —
commands,check,sandbox-killandwebdav-explorerwere documented here but are not registered anywhere in the code. Their rows are gone; the sandbox prose no longer promisessandbox-kill. - Audit method — the command list is now derived from
terminal.js(_baseWhitelist,internals,cmd ===dispatch) plus everycommands['…']registration inmodules/, so the next gap can be found mechanically.
- Cold module activation — Three modules (Memory Graph, Predictor, World Model) were loaded but produced zero actionable data. All now wired into the AI agent loop.
- Predictor feedback loop —
predictor.recordResult()now called after multi-turn AI tasks (toolTurns ≥ 2). Predictor accumulates historical data for duration/turn predictions. Previously had zero call sites — module was dead. - New AI tools —
predict_task(estimate task duration before starting) andworld_model_query(query system self-awareness: modules, skills, files, agents, health, changes, projects). AI now has 51 tools (was 49). - Memory graph noise suppression —
getContextForPrompt()returns empty string when graph has ≤2 nodes and 0 edges. Eliminates useless[Memory Graph Context] 1 nodes, 0 edgestoken waste on every AI turn. - Memory graph task recording —
recordTask()now called for direct AI conversations, not just orchestrator tasks. Graph learns about all AI interactions. memgraph-learncommand — Documented in help.html but never implemented. Now creates concept+fact nodes with weighted edge.memgraph-learn <entity> <fact>.getStats()alias — Orchestrator's_pipelineVerify()calledmemgraph.getStats()but the method wasshowStats(). AddedgetStats()alias returning{nodes, edges, types, totalAccesses}.- World Model summary fix —
_getTotalModules()returned registry count (7) instead ofmax(loaded, registry)(43). Summary now shows43/43not43/7. - Dashboard World Model panel — New section showing version, last synthesized time, module/skill/file/agent counts, memory graph stats, health, active projects, recent changes.
- System prompt update — Now mentions
predict_taskandworld_model_querycapabilities. - Cache:
2026-07-04-v4.5.86— hard refresh required
- Orphan removal — Removed 5 dead modules from core-bundle:
MyModule,ModuleIOModule,DynamicPromptsModule,SmartContextModule,DuckDuckGoModule. 454 lines, 23KB saved. 12+ ghost commands cleaned from help.html.modules-index.json50→45 entries.rebuild-bundles.pyupdated to prevent resurrection. - Unified
resetcommand — Supersedesfactory-reset,reset-vfs,reset-mem,config-reset. Subcommands:reset mem(AI state),reset vfs(filesystem),reset config(settings),reset all(nuclear). Old commands kept as aliases. - Agent loop detection —
agenticLoopnow tracks repeated tool calls. Same tool+args 3× triggers loop break with system message. Prevents AI from wasting 8 turns callingls. - Agent optimization default OFF —
trivial-optimizationwas always ON by default (!== 'false'). Changed to default OFF (=== 'true'). Useai-config trivial-optimization onto enable. - JS Console fix —
js/js-runcommands were not in the security whitelist. At level 1+ they were classified "unknown" and routed to AI instead of dispatching. Added to whitelist — now works. - Telemetry throttle — ServerMonitor persisted tool-latency logs every 20 calls. Throttled to every 100 calls or 5 minutes. ~80% fewer VFS writes.
- Pipe security fix — Pipe chains (
cmd1 | cmd2) bypassed ALL security classification.rm foo | catranrmwith zero checks even at Paranoid level. Each pipe stage now passes through_classify()— destructive and system commands blocked at level 1+. - Cache:
2026-06-18-v4.5.67— hard refresh required
- Critical ext bundle — 7 command-critical ext modules (editor, shell, alias, finder, filemgr, diff, busybox) promoted into
critical-ext-bundle.js(2,365 lines). Solves HTTP 503 request-storm during boot. - Core module bundle — All core modules concatenated into
core-bundle.js. Single<script>tag replaces 30 individual loads.rebuild-bundles.pyscript added. - VFS session bloat fixes — v2 metadata-only sessions (no VFS tree). Checkpoints strip system dirs, capped at 3.
_purgeTrash()on boot (24h TTL). WebDAV backup deep-clones + strips. - New modules —
module-agent-registry.js(A2A transport),module-leases.js(agent lifecycle),module-aiasm.js(assembly),module-duckduckgo.js(search, later orphaned),debug-panel.js,skill-pack-core.js. - A2A scratchpad architecture — Orchestrator agent-to-agent transport with prune timers, heartbeat checks, idle sweep. 6
a2a-*commands. - Orchestrator rewrite —
delegateTaskre-enters full agentic loop.spawnAgent,orchestrate-parallel,orchestrate-decompose, consensus protocol. - Deep architecture audit — 3 parallel subagent investigation of AI subsystem, VFS/state, security/dispatch. Found pipe security bypass, 5 orphaned modules, 6 duplicate localStorage keys, 19 unregistered intervals, 47 bare fetch() calls.
- Cache: various — hard refresh required
- Mindmap organization overhaul — Pain point #5 shipped. The
mindmapcommand went from 12 subcommands to 40.mindmap.jsgrew from 321 to 1127 lines. - Multi-mindmap support — No more losing work when switching.
mindmap new foo+mindmap new barcreates two in-memory mindmaps.mindmap switch footo jump between them.mindmap list-loadedshows all in-memory. Current is marked with*, dirty mindmaps with[DIRTY]. - Dirty-flag warning on load —
mindmap load foonow warns if the current mindmap has unsaved changes. Use--forceto override. - Find by text —
mindmap find <text>searches all node text + tags (case-insensitive). Returns matching IDs and depth. - Move nodes —
mindmap move <id> <new-parent-id>reparents a node (with all its children). Validates against cycles (can't move under self or descendant). - Undo — Stack of last 10 destructive ops.
mindmap undoreverses: add, remove, rename, move, color, tag, weight, merge. - Human-readable aliases —
mindmap alias <id> <name>gives a memorable name. All commands that take an ID (edit,move,color, etc.) now accept either ID or alias. - Disambiguated delete —
mindmap delete <name>still deletes a FILE (backward compat). Newmindmap remove <id>removes a NODE.mindmap delete-fileis the explicit form. - Import —
mindmap import <file>reads from VFS, auto-detects format (JSON/Mermaid/Markdown) by extension or content. Re-generates IDs to avoid collisions. - Merge —
mindmap merge <name> [--into=<id>]adds a saved mindmap under the current root (or specified parent). Conflict-free: just appends. - Diff —
mindmap diff <name1> <name2>shows added/removed/modified nodes between two saved mindmaps. - Stats —
mindmap statsshows total nodes, max depth, nodes per level, colors used, top 10 tags, dirty status, last save time. - Tags cross-node —
mindmap tags-list [<tag>]shows all tags + counts, or all nodes with a specific tag. - Clone —
mindmap clone <id>duplicates a node and its children with new IDs. Text gets " (copy)" suffix. - Archive —
mindmap archive <name>saves to/mindmaps/archive/<name>-<ts>.json. Auto-cleans to last 20. - Weight —
mindmap weight <id> <1-5>scales node size in SVG output (1=small, 5=large, default=3). - Mermaid export —
mindmap mermaid(ormindmap export mermaid) prints Mermaid mindmap syntax. Auto-escapes parentheses, brackets, ampersands. - JSON export —
mindmap jsonprints the internal JSON (with aliases). Both Markdown and JSON get copied to clipboard. - Refresh HTML —
mindmap refresh-htmlregenerates the standalone architecture page frommodules-index.json. Writes to/mindmaps/_generated-architecture.htmlin VFS, prints preview. Deploy withcat <file> > mindmap.html. - SVG layout fix — New
_layoutTree()algorithm computes subtree widths first, then positions. Handles 30+ node mindmaps without going off-screen.weightaffects node size. - Cache:
2026-06-11-v4.5.44— hard refresh required
- Module management overhaul — Pain point #3 finally shipped.
module-listnow groups by category (CORE/EXTENSION/FOUNDATION), supports--core --ext --foundation --lazy --eager --loaded --unloaded --failed --disabled --search=<pat> --flatflags, and shows aggregate summary (size, count, failed, disabled). module-info <name>— Shows module details: status, category, type, path, size, lazy flag, and the full list of commands it provides (the biggest gap). Listed in 2 columns.module-stats— Aggregate view: total/loaded/unloaded/lazy/eager/failed/disabled + total size + total commands.module-disable / module-enable— Persistently disable a module from auto-loading. Stored inlocalStoragewebx11_module_disabled. Survives refresh.module-loader.jsnow checks this list and skips disabled modules with a⊘marker in the splash.module-reload / module-reset— Reload shows old→new diff. Reset clears module's localStorage state and reloads.- System troubleshooting commands — Pain point #4.
version— Single command shows: version, build date (parsed from script tag), cache key, browser engine, online status.uptime— Time since page load (formattedXh Ym Zs) + last save time.errors [n]— Alias forlogs [n] ERROR. Shows last N errors. Says "No errors found" when logs are clean.doctor— Runs 8 health checks (network, ollama, VFS size, heap, logs, recent errors, localStorage quota, disabled modules), ranks by severity (🔴/🟡/🟢), shows top 5, and gives recommended actions.bug-report— Generates a markdown report with system info, recent errors, recent commands, disabled modules, top-level VFS listing. Saves to/tmp/bug-report-<timestamp>.md. Send this file when reporting a bug.test-net— Checks browser online status, proxy API (/api/stats), Ollama connection, and internet (HEAD to duckduckgo.com). Green/red status for each.memenhanced — Now shows JS heap + localStorage size + sessionStorage size + VFS in-memory size + total. Color-coded thresholds (green/yellow/red).- Trust violations fixed — Removed ghost commands
commandsandcheckfromgetHelpInfo()(they were in help but never registered). Fixedmemory-map-exportto actually save to/memory/reference.md(was: print to terminal). - Cache:
2026-06-11-v4.5.43— hard refresh required
- Search result quality fix — Default engines changed from
google,bing,brave,wikipediatomojeek,bing. Previous default had 3/4 engines broken (Google/Brave/Wikipedia block datacenter IPs); Bing worked but returned French-localized results due to server's Amsterdam IP. Mojeek is a privacy-focused crawler-based search that returns English results regardless of server location. - Result deduplication —
/api/searchnow dedupes results by domain and prefers Mojeek over Bing (Mojeek is more relevant in this environment). Two-pass: Mojeek first, then Bing for domains not already seen. - Verified:
search quantum computingnow returns "Quantum computing - Wikipedia" as the #1 result (was "iPhone - Apple").search how to cook risottonow returns actual risotto recipes (was "Cook, les épices bio" - a French spice site). - Cache:
2026-06-11-v4.5.41— hard refresh required
- AI assistant POST support —
web_fetchtool now acceptsmethod=POST,body, andcontent_typeparams. AI can now fetch POST-only APIs (Hyperliquid, financial APIs) without telling the user to "use curl". POST routes through/api/fetch; GET still uses/api/extractfor cleaner output. - AI assistant error parsing —
web_searchandweb_fetchnow parse JSON errors from proxy and surface the real reason (was just "HTTP 500" with no details). - 30s frontend timeout —
fetch,extract, andsearchnow abort after 30s with a helpful message. Replaces 15s silent freeze. Implementation:AbortController. - Loading indicator for
--summarize— Shows "⏳ AI overview will be generated (1-3s)..." before the LLM call, so user knows the terminal is alive. - Extract follow-up hint — After
extract, shows: "💡 Trysummarize <url>for AI summary, ornvfs-resolve <concept>to find related files". - Backend script/style strip — Extract's regex fallback now strips
<script>,<style>,<noscript>and HTML comments. Prevents raw JS leaking into extracted text on BS4 failures. webalias removed — Was a duplicate offetchthat didn't appear in autocomplete. Confusing. Just usefetch.- Cache:
2026-06-10-v4.5.40— hard refresh required
- POST support in
/api/fetch— Proxy was GET-only, blocking any API that requires POST (Hyperliquid/info, etc). Now acceptsmethod=POST&body=...&content_type=...query params with 10KB body cap and method-aware cache key. fetchcommand gains 3 flags —--post=BODYsends a POST request with the given body,--type=CTsets the Content-Type header (defaults toapplication/jsonif--postis set),--rawshows untruncated response. Example:fetch https://api.hyperliquid.xyz/info --post='{"type":"l2Book","coin":"HYPE"}' --type=application/json- Better error messages — Frontend
fetchnow parses JSON error from proxy and shows the real reason (was just "HTTP 502" with no details). - Cache:
2026-06-10-v4.5.39— hard refresh required
- Keyboard shortcuts —
Ctrl+Lclears the output area,Ctrl+Ccancels the current input line (prints^C),Ctrl+Uclears the input field. Standard terminal conventions now work. - Shift+Tab cycles backward — autocomplete suggestions can be cycled in both directions.
- Send button → 48px tappable — was 31px (fails mobile/tablet tap target). Now
min-width: 48px; min-height: 48pxper Android/iOS standards. - Autocomplete argType fixes —
nvfs-config,nvfs-alias,skill-listnow show enum values (config keys, alias actions, skill categories) instead of file paths.nvfs-sync/nvfs-save/nvfs-cancel/nvfs-statusmarked asargType: 'none'so they don't show file suggestions. - Stale autocomplete cleared — Tab suggestions from prior input no longer linger when you start typing something new.
- History cap on startup —
terminal-cmd-historyconfig now applies on page load, not "next save" (which never happened). - Cache:
2026-06-10-v4.5.38— hard refresh required
- /skills/index.json re-index loop FIXED —
skill-pack-core.seed()was rewriting theupdatedtimestamp for all 8 core skills on every page refresh, causing NVFS to see a hash mismatch and re-queue the 7KB JSON for LLM extraction every run. Nowseed()compares existing file content to bundled content and only writes the index if something actually changed. Eliminates the 5-concepts-from-1-file loop on every refresh. - One-time data fix — After deploying, the existing stale
updatedtimestamp in your VFS will be re-evaluated on next refresh. If it matches the bundled timestamp, the loop stops immediately. If not, one final write happens and the loop is dead thereafter. - Cache:
2026-06-10-v4.5.37— hard refresh required
- Deep pass output shows file paths — Was "5 LLM concepts across 1 file" (no path). Now lists up to 20 files with their concept counts. Makes it obvious if a single file keeps re-processing every refresh (loop detection).
- Auto-sync output shows file paths — Same treatment: "re-indexed N file(s)" now lists the actual paths so you can see what's looping.
- nvfs-status shows LLM/fast breakdown — Two new lines: "Fast concepts: N" and "LLM concepts: N (across M files)". Proves persistence is working without needing DevTools inspection.
- Deep pass message clearer — "added N new LLM concepts (M files). Total in index: X" — distinguishes the per-pass delta from the persisted total.
- Cache:
2026-06-10-v4.5.36— hard refresh required
- NVFS bug fix audit (7 bugs) — Stale
/sys/...entries from pre-v4.5.34 builds cause permanent re-index loops.init()now auto-purges them on first run with a one-time warning. - Cancel responsive —
nvfs-cancelnow checks between every LLM call (was: between every batch of 3). Stop within one 30s call instead of waiting up to 90s. - Save race fixed —
nvfs-saveand end of deep pass now await in-flight VFS save instead of clobbering the debounce flag. Prevents silent LLM concept loss on concurrent writes. - init() now awaits VFS load — Was fire-and-forget; first
nvfs-statuscould return empty even when an index existed.module-manager.jsalready awaits init(), so making it async is safe. - Deep-mode warning shown once — Was spammy on every
nvfs-indexcall. Tracked by session flag_warnedAboutLLMStrip. - Tag extraction fixed —
_extractConceptsusedtagMatches[0](whole match) instead of capture group, so inline#tag1 #tag2only captured#tag1. Now correctly splits on commas or captures all hash tags. - Filter defensive —
_isSystemFilesplit into clean two-check structure.node_modulescheck now uses normalized path sonode_modules/foo.js(no leading slash) also gets filtered. - Cache:
2026-06-10-v4.5.35— hard refresh required
- NVFS deep index persistence — LLM-generated concepts now survive page refresh.
_processDeepQueue()calls_saveIndex(). Deep concepts written to disk on completion. - nvfs-save command —
nvfs-saveforce-saves the semantic index to VFS disk immediately. Useful before hard refresh. - Auto-sync deep mode —
nvfs-sync --deepornvfs-config deep-index onnow triggers LLM analysis for dirty files, not just fast filename concepts. - Safety guard — Running
nvfs-indexwithout--deepwhen saved index contains LLM concepts prints a warning: they'll be stripped from re-indexed files. - JS Console module — New
js <expression>command evals JavaScript in page context.js-run <path>loads and executes a VFS script file. Auto-loads at startup. - Module registration —
consoleadded to packages.json, terminal.js ext loader, and skipList. Auto-loads on next refresh. - Cache:
2026-06-10-v4.5.34— hard refresh required
- tar / untar commands — New pure-JS tarball parser in cryptogzip.js.
tar <src-dir> <out.tar[.gz]>bundles a VFS directory;untar <path.tar[.gz]> [dest-dir]extracts back. Auto-detects gzip wrapper. Fixes the "downloaded newos4.tar.gz but can't extract" problem. - Binary-safe gzip —
gunzipnow preserves binary content (was UTF-8 only). Updated to use base64 roundtrip for binary files. - POSIX ustar format — Reads & writes standard ustar tarballs (compatible with GNU tar, BSD tar, macOS tar).
- Cheatsheet updated — Added 8 entries under 🔧 Tools for tar/untar/gzip/gunzip/encrypt/decrypt/diff/edit
- System prompt — tar/untar added to [ALL OTHERS] command list
- Doc version sync — Help page title, overview, and footer updated to v4.5.22 to match deployed module-loader.js
- Whitepaper v4.5.22 — Bumped from v4.3.0-beta; Last Updated 2026-06-08
- Deprecated module-modmgr — Removed from BUILTIN array (was duplicate of module-manager.js). Set auto_load=false, layer=deprecated. File retained for one release for rollback safety; deletion scheduled v4.6.0
- Fixed modules-index class —
module-loaderclass changed from filename string"module-loader.js"tonull(foundation file, not a module class) - packages.json cleanup — Renamed
neural-vfstoneural-vfs-core, category →core, added note that NVFS is built-in not a WPM package - Cheatsheet coverage — Added 4 missing commands:
sandbox-config,memgraph-export,predictor-config,world-model-config - Audit script fix —
audit-newos4-filesystem.pynow respectsskills/index.jsonfor orphan detection (no more 26 false-positive warnings on valid skill JSONs)
- Security Config CLI —
security-destructive,security-system,security-whitelist,security-flagadd|remove|list with localStorage persistence and boot loading - Enhanced security command — Shows all sets (destructive, system, whitelist, flags) plus registered command count
- AI loop config —
ai-config max-turns|max-context|trivial-optimizationwith persistence across sessions - Unified config CLI —
configcommand with 4 terminal tuning keys (max-lines, history, pipe-buffer), all persisted in localStorage - Extended ai-config — New keys:
max-context-tokens,confirm-timeout,chat-lock-timeout,skill-debouncewith range validation - Safe-read run_command —
run_commandnow command-aware:ls,find,tree,catauto-approved; only mutating commands require confirmation - Whitelist expanded (50+ cmds) — find, grep, tree, head, tail, wc, sort, du, diff, which, hostname, and all BusyBox read-only utils now whitelisted
- Security-bypass fix —
run_commandAI tool now routes throughcheckAndRun()security layer instead of bypassing - list_files root fallback — relative paths retry from root if cwd-relative lookup fails
- Confirm timeout configurable —
ai-config confirm-timeout <seconds>accepts 0+ (0 = no confirm / auto-approve all, no upper cap). Dynamic label on confirm bar shows actual timeout. - Auto-sync Neural VFS —
write_file/mkdir/rm/mv/cpautomatically mark index dirty; auto-reindexes after 10s debounce.nvfs-aliascommand for concept aliases. Hybrid discovery fallback innvfs-resolve(live VFS scan when index empty). Staleness warning innvfs-statusif index >4h old. - 5 modules whitelisted — system-health, server, servers, server-check, monitor run directly
- OllamaModule consolidated — Removed duplicate
ollamamodelscode path (redirects tomodels), centralized endpoint viaollamaManager.endpoint - Neural VFS async indexing — Chunked processing with progress percentage, no UI freeze on large VFS. Improved
_summarize(section heading → paragraph → sentence → fallback) - Neural VFS display-limit config —
nvfs-configcommand with 4 keys (fuzzy-limit, tree-files, tree-concepts, resolve-files), persisted - Orchestrator event bus — In-memory pub/sub for instant A2A delivery (VFS polling remains as fallback). Improved
_deriveCapabilitieswith 14 keyword mappings - Orchestrator extended config — 4 new interval keys (a2a-poll-interval, heartbeat-check, idle-sweep-interval, dead-purge-timeout) + all config now persists across sessions
- Cache:
2026-06-06-v4.5.11— hard refresh required
- Tiered Indexing toggle —
nvfs-config deep-index on|offswitches between Fast (metadata-only, instant) and Deep (LLM-assisted, semantic) modes. Off by default.nvfs-index --deepornvfs-sync --deepforces deep mode per-run. - Configurable deep model —
nvfs-config deep-model <name>selects the LLM for deep indexing. Default:gemma4:31b-cloudfor speed. Example:nvfs-config deep-model gemma4:31b-cloudfor deeper analysis. - Status bar indicator — Real-time 🧠 status in terminal bar: concept count + 🌊 wave for deep mode, 🟡 amber for pending auto-sync, 🧠 Deep Indexing progress percentage during LLM processing.
- nvfs-sync command —
nvfs-sync [--deep]for incremental background sync of dirty files. - Deep concept extraction — LLM generates 2-5 semantic concepts per file (configurable model via
nvfs-config deep-model, defaultgemma4:31b-cloud, 2000 chars, 3-file batches with UI yield). Fast filename-concepts stored immediately, LLM concepts augment in background queue. - nvfs-status mode display — Shows 🌊 Deep or ⚡ Fast mode.
- LLM self-healing — If Ollama disconnected, deep mode silently falls back to fast metadata-only.
- Cache:
2026-06-06-v4.5.12— hard refresh required
- VFS Size Diagnostics —
vfs-sizeshows total VFS size, top 5 largest files, and system dir sizes - VFS Clean —
vfs-clean/vfs clean— nuke snapshots, sessions, trash in one shot - Fractal checkpoint fix —
checkpoint()no longer deep-clones its own/_snapshots/, eliminating recursive bloat. Same forsession-save - Ghost commands wired —
checkpoint,checkpoint-list,checkpoint-del,rollbackhad help text but no handlers — now actually work - Autocomplete fix — Built-in commands (vfs-clean, vfs-size) now appear in dropdown
- Editor→_mods bridge —
edit path/to/module.jsnow mirrors to_mods/for test_module compatibility - Skill WebDAV Sync —
skill-webdav-syncpushes all skills to WebDAV as JSON files
- init(terminal) fix —
loadModuleFromCodeandloadModuleFromURLnow passthis.terminaltoinit(), fixing PredictorModule fatal error - Save & Test returns value —
saveCodeEditorchecksloadModuleFromCodereturn before printing success - StateSyncModule recovered — Extracted from backup, saved to
~/.hermes/scripts/ - PredictorModule hasSync — Feature detection for sync/recall tasks with tuned duration/turn prediction
- Cache:
2026-06-06-v4.5.11— hard refresh required
- v4.4 complete — 46 modules, 24 skills, full A2A lifecycle, sandboxed execution, memory graph, world model, health monitoring
- A2A Mailbox Transport —
a2a-send,a2a-list, 500ms polling with envelope routing (request/response/broadcast/heartbeat) - Autonomous sub-agent spawning — auto-role derivation, sleep/reanimate VFS serialization
- Sandboxed execution — WebWorker pool
sandbox-run(there is nosandbox-kill; tasks end on timeout) with inline fallback for headless - A2A Protocol — Agent contract system:
contract-register,contract-list, schema validation in orchestrator - Self-Optimization Telemetry —
system-healthcommand showing tool latency, VFS stats, error rates - AI tool: nvfs_resolve — AI can search VFS by concept
- Skills consolidated — 9 → 4 unified; index rebuilt minified
- Docs sync — vision.html and whitepaper updated
- Cache:
2026-06-03-neuralvfs— hard refresh required
- mindmap svg — Inline SVG rendering with colored rects + bezier curves
- GUI Builder —
gui,gui-button,gui-input— SimpleGUIModule registered - mermaid.min.js — Downloaded for webx11_mindmap.html
- get_module_status fixed — Shows all 34 loaded modules (was only HTTP-loaded)
- view_module fixed — Uses modules-index.json to resolve class→file paths
- module-ollamamodels merged — Into module-ollama (13 commands total)
- concept:// URIs —
cat concept://skillresolves via Neural VFS - Module categorization —
modules-listshows [core], [ext], [infra] layer tags - 5 modules whitelisted — system-health, server, servers, server-check, monitor run directly
- WebDAV Browser — Modern file-tree UI with checkboxes, Select All, bulk actions (Delete, Move, Download), inline rename (double-click), context menu, breadcrumbs, keyboard shortcuts
- WebDAV commands —
webdav-browser,webdav-rm,webdav-mkdir,webdav-rename,webdav-move,webdav-backup - Skill Pack System — Auto-loads 12 skills on startup, seed/reload support, skill-pack-core.js manages in-memory index
- Agent Orchestration —
agent-list,agent-register,lease-list,orchestratefor multi-step delegation - Security Layer —
security-level 0-3with granular restrictions,cmd-allow/cmd-denyper-command access control - Debug Panel —
debugtoggle shows memory, events, errors, module health - Chat Cleanup — Removed
chat-setapi,chat-setmodel,chat-ask; singlechatcommand toggles overlay - Module count refactored: 18 core + 14 ext (was 25+17)
- Download fix — switched from
resp.text()toresp.blob()for binary-safe downloads; same fix for image preview (FileReader DataURL) - Cache:
v=40— hard refresh required
- BusyBox — 16 new utility commands:
which,env,date,cal,yes,seq,base64,printf,cut,uniq,hostname,whoami,basename,dirname,sleep,expand - Shell — Full pipe (
|), redirect (>,>>,<), chain (&&,||,;), variable ($VAR), and VFS script execution (script) - Pipe-aware commands (
grep,head,tail,sort,wc,cut,uniq,expand) auto-read from pipe via temp file injection export,unset,set— shell variable management- Multiple ASI and VFS API bug fixes (
fs.fsWrite→fs.writeFileacross 3 modules) - Test Suite — 32 automated regression tests. Run with
load-local modules/test/test-suite.jsthentest,test auto, ortest list - Cache v34 — hard refresh required
- Editor —
edit <path>opens inline VFS editor modal - Diff —
diff a bLCS-based comparison +diff --module - Aliases —
ll,h,clsdefaults + custom alias definition - File Finder —
find <query>recursive VFS search - Agent loop: capped at 8 turns (was 1),
edit_moduledestructive confirmation, model auto-validation ai-stopnow cancels chat + stream, not just tool calls- Unknown commands awaited, "Command not found" suppressed on AI route
loopResultscope fix — no more undefined error on AI fail- Preview iframe allows JS (
allow-scripts), cache bumpv=18 - Splash fallback + startup modal list all 12 ext modules
- AI Agent with full tool-calling loop (28 tools)
- Inline destructive confirmation bar with 120s countdown timer
- Skills system (8 CLI commands + UI modal)
- Voice input (🎤 button, SpeechRecognition, show/hide toggle)
- Sound notification (🔊 toggle, WebAudio ding)
- AI spinner in status bar
- Session system (save/load/recent/stats)
- WebDAV sync (8 commands)
- Web search (SearXNG + DDG + URL fetch/extract)
- Config manager (6 commands + UI)
- Startup modules selector (⚙ gear on splash)
- Code editor modal (module editing, save & test live)
- HTML preview via srcdoc (mobile)
- File/dir autocomplete, pipe support
- Smart context profiles, dynamic prompts with variables
- Server monitor, ChatStudio overlay
- Modular architecture: 23 JS modules, async loader
- Monolith refactored into core/ext modules
- Async module loader with splash screen
- Config manager modal
- Bootloader fix for disabled modules