The Desktop image shows LLM OS on its screen.

The full-screen browser never started in a VM: the display stack was missing the device manager it needs, and VMs without a GPU need software drawing. App icons were empty boxes too (no emoji font).

Functional tests for every image, before every release.

Each image is booted and used: write an app, save and open a file, a permission refused, desktop and display settings — and for the Desktop image, its own screen and keyboard. Then the previous release with your data, this one on the same disk, and back again.

A fresh VM no longer reports local models as failed.

Not having Ollama is a choice, not an error.

Display scale: point and click, or describe it.

Settings → Display has sizes from 75% to 200%. Or type /display 150%, or /display I sit far from the screen. Both go through the same check in the kernel; the model only proposes, and an answer that makes things smaller when you asked for bigger is sent back.

Your data knows its format.

A future version that changes how data is stored converts it once at boot, after backing up what it touches. Going back to an older version never converts it back, and the boot screen tells you.

Apps say which SDK they were written for.

An app shared from a newer LLM OS asks before it runs instead of breaking quietly.

Opening files needs file access; permissions you grant survive updates.

An app without permissions could launch other apps through “open file”. And a permission granted while an app ran was lost when it was updated.

A boot screen, and a list of what’s running.

Your data, AI models, apps, sandbox, background apps, self-improvement — each with its state and, when something is missing, the one thing to do about it. /status shows it again; the VM console prints the same list, systemd-style.

Move an older install’s data to its own disk.

llmos-data-move copies apps, files and settings from a 0.4.0 VM to the data disk, so the next upgrade is a disk swap. A data disk attached to a running install is filled automatically on the next boot.

Settings and app data survive a hard power-off.

Found by booting the released image: files written in the last ~30 seconds came back empty after a VM was stopped. Every write of your data is now flushed to disk before it counts as saved, and the VMs power off cleanly when the hypervisor asks them to.

The Server and Desktop images boot again.

The 0.4.1 images stopped at the bootloader. Every image is now booted in CI before it is released — with a data disk, a shutdown from the hypervisor, and an upgrade that must keep your data.

Desktop layouts have neutral names.

/desktop taskbar and /desktop dock; the old names still work. Minimize, maximize and close sit on the right, where people expect them; ✎ modify and ⇪ upgrade on the left of the title.

An app can no longer hand its window to a web page.

A sandboxed app could navigate its own frame to any site, and the page there kept the app’s permissions. The browser now refuses such pages, and an app that tries is closed.

Apps can’t impersonate the OS to each other, or inherit another app’s data.

One app could answer another app’s pending requests with fake data. And after a fresh browser profile, a new app could get the private storage of an old one.

Permission prompts can’t be ambushed.

An app could time a permission request to catch your next Enter key. Prompts now default to “no”, “Allow” unlocks after a moment, a “no” is remembered, and taking a permission away takes effect at once.

Websites can’t crash or frame the OS; apps can’t reach your network through IPv6 tricks.

Plus: stricter checks on apps from the community registry, which is no longer contacted at startup unless you turn it on.

A separate data disk for the VMs.

Apps, files and settings live on llmos-data; upgrading means replacing the OS disk.

Your version of an app wins.

When a new release ships a newer built-in app, the one you changed is still the one that opens.

Upgrade an app with a bigger model.

⇪ in the title bar or Ctrl+Alt+U: pick any installed or cloud model and let it improve the running app.

Describe your desktop.

/desktop taskbar, /desktop dock, or any description: a taskbar at the bottom (Windows-like) or a menu bar with a dock (Mac-like), dock position, clock, window buttons, wallpaper. The model proposes a layout, the kernel validates every field. Pinned apps that don’t exist yet are written the first time you click them.

A Prompt button instead of a Start menu.

Search your apps or describe a new one from the same box. Also on the Super/Windows key and Ctrl+Space.

Alt+Tab window switcher.

Works in kiosk mode and on the native renderer; in a normal browser, where the host OS keeps Alt+Tab, use Alt+` instead. Shortcuts work even while an app has focus.

Terminal, Writer and Reader.

A shell for the OS itself (files, network, the model), a word processor that saves HTML documents, and a reader-mode browser that shows pages without scripts, trackers or cookies.

Portable UI.

Apps can describe their interface as plain data — columns, rows, text, buttons, inputs — instead of HTML. The browser renders it today; the same tree can be drawn by anything. Terminal and Tasks are written this way.

Native renderer (spike).

A 1.4 MB Rust binary lays out and draws portable apps in Full HD in about 2 ms, to a PNG or a Linux framebuffer. No input and no app logic yet — but the layout already matches the browser.

Watch the app being written.

Generation streams from every provider. A preview renders the half-finished app as the code arrives — with scripts disabled, since nothing runs before the analyzer and your approval.

Modify a running app from its title bar.

Describe the change; the model rewrites the app and it is swapped into the same window with its data intact. Every version is kept in the registry with its parent.

Self-healing.

Runtime errors are captured inside the sandbox and shown on the window. One click sends the code and the errors back for a fix.

Shared filesystem and file associations.

Apps declare which file types they handle. Opening a file launches the right app — or, if none exists, offers to write one.

Apps can use the model.

LLMOS.ai.complete() behind the ai:generate capability, rate-limited per app.

Network proxy, clipboard, inter-app messaging, runtime permission prompts.

Describe a theme, get a theme.

/theme nordic winter night asks the model for a palette. The kernel checks every value and the text contrast before applying it — too dark, and the model gets one try to fix it. Every running app re-themes at once.

Regenerate with today’s model.

Every generated app in the registry has a ↻ button that runs its original prompt again on the current model and stores the result as a new version.

Two default apps: Files and Notepad.

Written by Claude Opus 5.5 against the new SDK. Files got its search box through the modify loop.

Claude Opus 5 by default; "… using opus 5.5", "… with fable" as prompt hints.

Streaming generation, prompt caching, refusal fallback. Truncated output is detected instead of silently producing a broken app.

The kernel API rejects cross-origin and DNS-rebinding requests.

Before this, any web page you visited could talk to localhost:3000 — including the Docker endpoints.

Capabilities are enforced on every call, twice.

Once in the shell for each message an app sends, and again in the kernel with a signed token. Registry apps that ask for files, network or AI need your approval.