A personal AI substrate for the terminal.

Most AI tools are a chatbot pretending to be a developer. xlii inverts that: it puts a language-model agent at the shell level of your own machine, under constraints most AI tooling does not adopt: your files are the source of truth, everything you curate is plain text you own, and the model is never trusted as a security boundary.

The first hour Read the design $pip install xlii

xlii code · ~/proj

mode: —  ·  trust: guarded  ·  surface: code
[$] git status --short
 M xlii/shellgate.py
[$] ? what does the change to shellgate do
Adds container runtimes to SYSTEM_BINARIES so `docker run` classifies
as modifies-system instead of read-only. One test added. No behavior
change for known binaries.
[$] /plan make unknown binaries fail closed
mode: plan  ·  trust: guarded  ·  surface: code
1. Add READ_ONLY_BINARIES allowlist
2. Default unknown → modifies-project in _classify_segment
3. Add xfail rows for docker / socat / nested $()
   → /execute to proceed, /cancel to drop
[$] /execute
edit_file xlii/shellgate.py  ·  write_file tests/test_shellgate_fail_closed.py
bash  intent=network   pytest -q && git push
      classified: network — run it? [y/N]

Three ideas carry the design.

Everything else follows from them.

Local truth

Files on disk are authoritative.

Hosted retrieval, indexes, and mirrors are derived and disposable. Remote custody is a per-project dial that includes zero: a project initialized with --local, and every home session, never leaves the machine.

You compose it

Curation is the durable asset.

Personas, reference docs, API plugins, roles, skills, memory pages: all Markdown you can read, edit, version, and move. Models are interchangeable components behind a stable interface. The vendor provides primitives; you compose the system.

Not a boundary

The model is never the security boundary.

What the agent says it intends is advisory. Whether a command runs, whether a path may be written, whether a worker may escalate, is decided by code that classifies independently and fails closed.

What it is

A shell-first REPL. A bare line is a shell command with a real TTY. ?text addresses the agent. /cmd is a slash command.
Three session kinds. Home (the machine, never synced), project (a folder you chose), chat (a persona with its own memory).
One kernel, many clients. Terminal UI, browser, desktop window, and a multi-instance control plane are views over the same session.
A verification culture. Cold-context checks, blind peer review, cross-vendor second opinions, and an autonomous loop whose judges can lock tests.

What it is not

Not an IDE. Bring your own editor. Inline diffs and visual context are out of scope.
Not a hosted chatbot. There is no vendor-side memory and no account beyond your model provider's key.
Not a cloud agent host. Where cloud agents help, xlii delegates to them through adapters rather than re-hosting them.
Not for everyone. It rewards investment. Casual users may bounce; that trade is deliberate.

Four kinds of work, four tool palettes.

Not personalities layered on one agent — different tool sets, enforced in code.

Coordinate

Orchestrator

The agent you talk to. Full palette, including the ability to dispatch parallel workers.

Operate

Ops posture

Read tools plus shell for machine diagnostics. The shell gate is the brake.

Build

Code and rail

Writes unlocked; plan domain locked. The rail holds writes shut through four design stages.

Verify

Judges and reviewers

Read-only, often on a different model or vendor than the builder. Starved verifiers return inconclusive, never fail.

Safety lives in code.

Every shell command is classified independently of what the model declared, and the stronger classification wins.

read-onlyls, grep, git status, pytest
modifies-projectwrites inside the tree, interpreters, build tools
networkcurl, ssh, package installs, git push — prompts unless trusted
modifies-systemsudo, services, mounts, signals — always prompts, no tier waives it

Workers are read-only by architecture. No write tools, no dispatch, no client pool, and a shell ceiling enforced by the classifier rather than by instruction.
Path containment. File tools resolve inside the project root after following symlinks. Write domains are derived from the active mode every turn and never stored.
Human-only operations. Destruction and administration need a real foreground console and a fresh secret. No request flag is accepted as proof of a human.
Fail closed. Unknown mode, unknown trust tier, unparseable input, or no human to ask: the answer is refuse or escalate, never permit.
Inbound channels are RCE surfaces. A paired phone, a webhook, a browser tab: each is gated by identity, trust, and an explicit open window — not by the transport being encrypted.

One session. Several ways in.

Every client is a projection of the same kernel. The kernel never imports a client — that rule is enforced in CI.

xlii codeThe inline REPL. Shell-primary, full TTY.

--tuiFull-screen terminal UI with panes, dock, and image preview.

xlii serveThe TUI in a browser tab. Loopback or tailnet; a public mode sits behind a pairing code and your reverse proxy.

--tauriA desktop window over the same session, with lock overlay and theme packs.

xlii daemonMulti-instance control plane: star topology, one controller, capped keys on nodes, bound trust-on-first-use pairing.

Where it stands.

Alpha. The architecture is settled; surfaces and details still move. It runs end-to-end against a real xAI account and is xAI-first today, with external providers supported for worker agents.

About 142k lines of Python across 519 modules, with a hermetic suite of roughly 5,400 tests that passes in three minutes without network access or API keys. Import contracts, generated documentation, and security scanning gate every push.

Known limitations are documented, including the current gaps in the shell classifier and the fact that content the agent reads is gated by consequence, not filtered on the way in. See the design document rather than discovering them.