LLM OS 0.4.4

Version 0.4.4 · October 2026 · changelog

An operating system with no apps until you ask for one.

You describe a program. LLM OS writes it, checks it, sandboxes it and runs it — and rewrites it when you want something changed or it crashes.

Run it Source on GitHub
a notepad generating 13.4k chars streamed · live preview · 13 s analyzer 0 critical, 0 warnings manifest 📝 Notepad · opens .txt .md .csv .json … permissions fs:read fs:write storage:local approved launched app-1 add a search box that filters the current folder ✎ Files Files v2 swapped into the same window · data kept · 12.5 s /theme nordic winter night theme “Nordic Winter Night” · contrast checked · applied to every app /desktop menubar on top, clock in the middle, dock on the left desktop “Night Studio” · 6 pinned apps · Mail not installed yet — click to write it
0.4

What's new in 0.4.

Latest: 0.4.4 — Every image is now tested for what it is for. Full changelog →

  • 0.4.0

    A desktop you describe.

    /desktop with a taskbar or a dock, a Prompt button instead of a Start menu, Alt+Tab — and apps that can be drawn without a browser.

  • 0.4.1

    Your data on its own disk; your changes win.

    Upgrading is a disk swap. An app you changed stays yours when a release ships a newer one, and any app can be upgraded with a bigger model.

  • 0.4.2

    It tells you what’s running.

    A boot screen with every service and what to do when one is missing — and a security review of the whole sandbox boundary, every finding fixed.

  • 0.4.3

    Make it bigger by clicking or by saying so.

    The first setting that works both ways, and data that knows its format so upgrades can change it safely.

  • 0.4.4

    Every image is tested before it ships.

    Booted and used like a person would — which is how we found, and fixed, a Desktop image that never showed LLM OS on its screen.

screenshots

What it looks like right now.

Real screenshots of the prototype, not mockups.

Full HD desktop with a menubar, a dock, and Terminal, Writer and Reader windows
/desktop dock at 1920×1080: menu bar with the Prompt launcher, a dock with running-app dots, Terminal, Writer and Reader working on the same files.
The same apps with a taskbar at the bottom
/desktop taskbar: a taskbar with the Prompt button, open windows, status and clock.
A desktop designed from a description: menubar with a centered clock and a dock on the left
Designed from a sentence: clock in the middle, dock on the left. “Mail” isn’t installed, so its ◌ writes it on first click.
Boot screen listing services: data disk OK, AI models warning with a fix, local models failed, apps and sandbox OK
First boot of the micro VM with the data disk and no model configured yet: what works, what doesn’t, and the one thing to do about it.
The Tasks app in the browser-based shell
In the browser. The portable Tasks app, rendered to HTML by the shell.
The same Tasks app drawn by the native renderer
Native renderer, no browser. The same tree drawn by a 1.4 MB Rust binary, straight to pixels.
A panel showing a notepad app rendered while its code is still being generated
Generation in progress: 13.5k characters in, the toolbar and editor already render. Scripts stay off until the app is analyzed and approved.
The same desktop re-themed in blue-grey with a green accent
/theme nordic winter night — the shell and both running apps change together, without restarting anything.
seven months

Same prompt, February and September.

“A notepad”, generated for LLM OS twice. The editor itself was already good in February. What changed is what an app is allowed to be part of.

Notepad generated by Claude Opus 4.6 in February 2026
February 2026 · Claude Opus 4.6 · v0.2. A capable editor in an isolated box: text lives in the app’s private storage, and nothing else on the system can see it.
Notepad generated by Claude Opus 5.5 in September 2026, editing meeting-notes.md
September 2026 · Claude Opus 5.5 · v0.3. Opens and saves real files, registers itself for .txt, .md, .csv and friends, keeps an unsaved draft across restarts, and follows the system theme.

Seven months and one model generation apart — and the newer model is cheaper to run. That is the point of building an OS this way: a normal program doesn’t get better when models do, but here an app is a prompt with a version history. Press ↻ on any app in the registry and it is written again by whatever model you have today, linked to the version it replaces.

The same notepad prompt generated by three different models in February
For scale, February’s three-model comparison: Opus 4.6, DeepSeek Coder V2 16B and Qwen 2.5 14B on the same prompt. Local models still run the whole OS offline — they just write simpler apps.
how it works

From a sentence to a running program.

The model writes the code. Everything that decides what the code is allowed to do is deterministic.

  1. You ask“A pomodoro timer that logs sessions to a file.” Add “using opus” to pick a model.
  2. A router classifies the requestSandboxed page or background process? A tiny local model decides; regex if there is none.
  3. The gateway picks a model and generatesOllama, Claude, OpenAI or any compatible endpoint. The strongest available model gets the hard requests.
  4. A static analyzer reads the resultNo LLM in this step. eval, frame escapes, nested iframes and obfuscation are blocked.
  5. You approve what it may doFiles, network, AI, clipboard — each is a capability you can untick.
  6. It runs in a sandboxAn iframe with no network and a strict CSP, a WASM worker, or a Docker container for services.
sdk

What a generated app can call.

Apps get no direct access to anything. Every service goes through one global object, and each one is tied to a capability the user granted.

LLMOS.uiRender elements, notifications, confirm dialogs.ui:window
LLMOS.storagePrivate key/value store for the app, kept across restarts and new versions.storage:local
LLMOS.fsThe user’s files, shared by all apps. Read, write, list, stat, mkdir, remove.fs:read · fs:write
LLMOS.osLaunch arguments, open a file in its handler app, set the window title.—
LLMOS.aiAsk the system’s language model. Lets an app summarise, translate, classify.ai:generate
LLMOS.netHTTP through the kernel. Public internet only; private and metadata addresses are refused.network:http
LLMOS.ipcPublish and subscribe between running apps.ipc:bus
LLMOS.clipboardRead and write the clipboard.clipboard:rw
LLMOS.ui.appPortable UI: state + a view built from components. Runs in the browser and on the native renderer.ui:window
LLMOS.capsCheck or request a capability at runtime; the user gets a prompt.—
security

Assume the generated code is hostile.

A model can be prompt-injected, and it can simply write bad code. The design doesn’t rely on it behaving.

LayerWhat it stops
Prompt sanitizerKnown injection phrasing and hidden zero-width characters before anything reaches a model.
Static analyzer~35 deterministic rules: eval and friends, frame escapes, service workers, encoded payloads.
Iframe sandbox + CSPNo network, no same-origin, no external resources. The app can only post messages to the shell.
Shell syscall checkEvery message is matched against the capabilities you approved, even if the app bypasses the SDK.
Kernel token checkFile, network and AI calls also need an HMAC-signed capability token bound to that app.
API guardOther websites and rebound DNS names cannot call the kernel on localhost.

Found a way out of the sandbox? Please open an issue — it is the most useful thing anyone can contribute.

models

Local first, cloud when you want it.

Without any model the OS still boots and routes with regex. Add a small local model and it routes better; add a large one and it writes good apps offline.

ProviderTypical useConfigure
OllamaOffline generation with Qwen, DeepSeek Coder and others. Free.OLLAMA_URL
AnthropicOpus 5 by default; Opus 5.5, Sonnet, Haiku or Fable on request.ANTHROPIC_API_KEY
OpenAI-compatibleOpenAI, OpenRouter, Groq, Together, vLLM, LM Studio.OPENAI_BASE_URL
roadmap

Where this is going.

The long-term idea: the shell, the drivers and eventually the kernel are generated too, and the only thing that persists between boots is your data and your profile. That is years away. This is the near term.

done

  • Bootable VM images
  • Six-provider model gateway
  • Capability tokens
  • App registry with versions
  • In-place modify and self-heal
  • Shared files and file handlers
  • Live generation view
  • Generated system themes
  • Generated desktop layouts
  • Portable UI + native renderer spike

next

  • Keyboard and mouse for the native renderer
  • Run portable apps natively (QuickJS/WASM), no browser in the micro image
  • Mail through a kernel IMAP/SMTP service
  • Undo: roll an app back to any earlier version
  • Evaluation suite for modify/fix quality across models

later

  • Multi-file apps with a backend
  • The whole shell as portable UI, drawn natively
  • Change the screen resolution of the desktop VM — click or describe it, like scaling
  • Shell regenerated at boot from your profile
  • WASM as the default app runtime
  • Rust microkernel, UEFI boot
run it

From source, or as a VM.

No npm dependencies. Node 20 or newer.

git clone https://github.com/DayZAnder/llm-os
cd llm-os
cp .env.example .env      # set OLLAMA_URL and/or ANTHROPIC_API_KEY
node src/server.js        # http://localhost:3000
npm test                  # 604 tests
ImageContentsSizeDownload
MicroBuildroot, Node.js, Dropbear. Sandboxed apps only.~50 MBqcow2 · vhdx · ova
ServerAlpine, Docker, Node.js. Adds background process apps.~700 MBqcow2 · vhdx · ova
DesktopServer plus a full-screen Chromium kiosk.~1 GBqcow2 · vhdx · ova

The VM images are from the v0.4.4 release. Attach llmos-data (vhdx, vmdk) as a second disk so your apps and files survive upgrades. Log in as root / llmos and change the password, then open http://<vm-ip>:3000. If you reach the VM by IP instead of a localhost port forward, add that address to LLMOS_ALLOWED_HOSTS. qcow2 for Proxmox/KVM, vhdx for Hyper-V, ova for VirtualBox/VMware. All releases · third-party licenses.

values

The four rules every change is checked against.

A deterministic scan in CI, a model review on pull requests, and a human with the final say.

  1. Protect the user first.No telemetry, no tracking. Apps are sandboxed; when in doubt, deny.
  2. Empower the user.No artificial limits or paywalls. Build whatever you need, as long as it doesn’t harm others.
  3. Take a piece, leave a piece.Use it freely. If it helps you, give something back.
  4. Nothing is perfect.Not these rules, not this code. Ship, learn, improve.