Terminal in the browser: what runs, what doesn't, and where your files go

Is it a real shell, or a command palette with a prompt?

It is a real shell. The terminal in SLICC runs just-bash, a bash-compatible shell interpreter written in TypeScript and drawn in the page by xterm.js, and it reports itself as bash 5.1. Pipes, loops, arithmetic expansion, redirection and exit codes behave the way a shell script expects.

The commands run in the same tab and read the same files the agent reads, so awk, sed, jq and rg work on the output of each other the usual way. The shell itself does not run on a remote machine.

$ echo $BASH_VERSION
5.1.0(1)-release
$ for n in 1 2 3; do printf "%s " $((n * n)); done; echo
1 4 9
$ seq 1 100 | awk '{s += $1} END {print s}'
5050
$ false || echo "exit status: $?"
exit status: 1
$ echo "piped" | tr a-z A-Z | rev
DEPIP

Can it run git in a browser tab?

Yes. git in SLICC is isomorphic-git, a JavaScript implementation of git, working on the virtual filesystem. Clone, add, commit, branch, checkout, diff, merge, rebase, stash, fetch, pull and push are all listed in git --help.

A shallow clone of this website's own repository checked out 308 files in about ten seconds. Pushing to GitHub needs a personal access token, set with git config github.token, as the man page describes.

$ git clone --depth 1 https://github.com/ai-ecoverse/slicc-website.git site 2>&1 | tail -2
Checked out 308 files.
done.
$ cd site
$ git log --oneline -1
b77bbb5 man references: keep authored links as anchors (#64)
$ find blocks -name "*.js" | xargs wc -l | sort -n | tail -3
 530 blocks/different/different.js
 535 blocks/footer/footer.js
4793 total

The last command is an ordinary pipeline over the cloned files: find, xargs, wc, sort.

Which git commands are missing?

blame, bisect, worktree, submodule and git grep are not implemented in SLICC's git; each one answers "is not a git command". The everyday loop of init, add, commit, log, branch and merge is there.

A missing subcommand fails at once with a clear message instead of doing half the job, which is the failure mode you want from a version control tool.

$ git init
Initialized empty Git repository in /tmp/tc/cap/demo/.git/
$ echo "hello" > README.md
$ git add README.md
$ git -c user.name=cone -c user.email=cone@example.com commit -m "first commit"
[main 8252123] first commit
$ git log --oneline
8252123 first commit
$ git blame README.md
git: 'blame' is not a git command. See 'git help'.

Where do my files live?

In a virtual filesystem inside the browser's own storage for the SLICC site: the Origin Private File System, which SLICC reads and writes through ZenFS. Paths look like Unix. /workspace belongs to the main agent, /shared to every agent, /tmp is scratch that, unlike a Unix /tmp, survives a reload, and /mnt holds mounts.

The command table is virtual too. which answers /usr/bin/git, and /usr/bin lists one entry per command, although ls / leaves /usr out of the listing.

$ ls /
cones
mnt
scoops
shared
tmp
workspace
$ which git node python3
/usr/bin/git
/usr/bin/node
/usr/bin/python3
$ ls /usr/bin | wc -l
262

Can it read or write files on my disk?

Only a folder you choose. By default nothing in the SLICC filesystem is backed by your disk, and mount info says so: host-backed: no. Running mount /mnt/project opens your operating system's folder picker, and the folder you pick is then read and written from the shell for real.

The picker needs a click from you, so only the main agent can open it; sub-agents cannot mount a local folder on their own. The same mount command attaches S3-compatible buckets and Adobe Document Authoring or AEM sources, and umount detaches them.

$ mount info /tmp
/tmp (vfs)
  case: sensitive
  unicode: byte-exact (stored as-written)
  executable-bit: supported
  names: byte-exact
  max-filename-length: 1024
  writable: yes
  host-backed: no

What happens when I close the tab?

Running commands stop, and your files stay. The shell, its processes and the agent all live in the SLICC tab, so closing it ends them, the way closing a terminal window ends its jobs. The files are in persistent browser storage, which df reports as persisted, so the browser does not evict them to free space.

They are still there when SLICC opens again. Clearing the site data for SLICC in your browser deletes them, as it would for any site. Anything you want outside the browser, push with git or write to a mounted folder.

$ df -h | grep -E "Quota|Persisted"
Quota:       11.8 GB
Persisted:   true

Can it reach the network, or does CORS get in the way?

curl reaches ordinary URLs, including APIs that send no CORS headers. In the Chrome extension its requests go through the extension's service worker, and in the CLI through the local SLICC server, so the browser's cross-origin rules do not block them.

In the extension, curl uses the extension's cookie jar. Binary downloads with -o land in the virtual filesystem, ready for the next command in the pipe.

$ curl -s https://api.github.com/repos/ai-ecoverse/slicc | jq -r ".full_name, .license.spdx_id"
ai-ecoverse/slicc
Apache-2.0

Which programming languages run in the terminal?

JavaScript, SQL and TypeScript work with no setup: node, sqlite3, tsc and esbuild. Python works after a one-line install, covered in the next answer.

node is a JavaScript runtime shim, not Node.js itself. It reports v20.0.0-js-shim, supports fs and child_process, and refuses require("http") with a hint to use fetch().

$ node --version
v20.0.0-js-shim
$ node -e "console.log([1,2,3].map(x => x * 2))"
[2,4,6]
$ sqlite3 :memory: "select sqlite_version(), 6*7"
3.49.1|42
$ tsc --version
Version 6.0.3
$ esbuild --version
0.28.2

Does Python work?

After a bootstrap, yes. python3 in SLICC is Pyodide, CPython compiled to WebAssembly, and it is not preinstalled: the first run tells you to run ipk add pyodide@314.0.6, which fetches the package from npm (about 14 MB unpacked). After that install, python3 in the same folder ran and reported Python 3.14.2 on Emscripten.

There is no interactive REPL. Pass code with -c, a script path or stdin. Packages with C extensions import only if they have an Emscripten build.

$ python3 -c "print(1 + 1)"
pyodide is not installed in node_modules: run `ipk add pyodide@314.0.6` (no network fallback)
$ ipk add pyodide@314.0.6
ipk: installed pyodide@314.0.6 -> /tmp/tc/py2/node_modules/pyodide

which reports /usr/bin/python3 before the install as well. The command exists; the interpreter arrives with the package.

What does not work in the browser terminal?

Anything that expects a native Linux machine. The command list has no system package manager such as apt, and C compilers, make and full-screen programs such as vim, less or top are absent too. Node cannot start an HTTP server. It is also not your host shell: your PATH, dotfiles and installed tools are not here.

Smaller surprises: bash --version treats the flag as a script name, and the five git subcommands above are missing. Some native work is reachable through an emulated Linux guest, in the table below.

$ gcc --version
bash: gcc: command not found
$ apt install htop
bash: apt: command not found
$ node -e "require(\"http\").createServer()" 2>&1 | head -1
Error: require('http'): Node built-in 'http' is not available in the browser environment. Use fetch() instead.
$ bash --version
bash: --version: No such file or directory

How many commands are there, and how do I check for one?

About 200 are built in, sorted into 24 categories. The exact number depends on which skills you have installed, because skills can add their own commands. Run commands for the live list, <command> --help for the flags, or man for the manual page.

The same manual is on this site. Start at /man/commands and check the one command you care about before you believe any count, including ours.

$ commands | sed -n "3,4p"
  File operations:
    ls, cat, head, tail, wc, touch, mkdir, rm, cp, mv, ln, chmod, stat, readlink, file, rmdir, rsync
$ man git | sed -n 3p
  Distributed version control system implemented with isomorphic-git

Is it safe to give an AI agent this shell?

Safer than giving it yours, and the limits are yours to set. Each sub-agent SLICC starts with agent gets its own writable folder, next to shared scratch folders such as /tmp, and a list of the commands it may run. Anything outside that goes to the main agent as an approval request through sudo, an approval step in SLICC, not Unix root. The main agent allows it once, allows it always, or denies it with a reason the sub-agent can read, and a request nobody answers times out without running. The shell cannot see your disk unless you mounted a folder, and it cannot run native programs.

Other browser agents also act inside your signed-in browser, so that part is not special. What SLICC combines is sandboxed sub-agents with per-agent path and command allow-lists, next to a POSIX shell, a virtual filesystem and git, in the browser, on your own model provider tokens.

$ agent --help | head -12
usage: agent <cwd> <allowed-commands> <prompt>

Spawns a sub-scoop, feeds it a task, blocks until the agent loop completes,
then prints the scoop's final message on stdout.

Arguments:
  <cwd>               Working directory for the spawned scoop. Becomes the
                      scoop's sole writable prefix. Relative paths are resolved
                      against the current shell's cwd; '.', '..', and absolute
                      paths are all supported.
  <allowed-commands>  Comma-separated list of bash commands the scoop may run.
                      Use '*' to allow every command. Whitespace is trimmed

What do I need to try it?

Chrome, the SLICC extension and an account with a model provider. The extension keeps a SLICC tab pinned, and the terminal and the agent run in that tab. The terminal needs no key of its own; the agent uses your model provider tokens.

Once it is open, type commands and check this page against it.

Install the Chrome extension

Read the source on GitHub