Shellvis

A native Windows AI agent: a floating command bar with a console beneath it, wired to PowerShell, the desktop, Office, Outlook, Teams and a browser.

It does not wrap a terminal. It hosts PowerShell 7 in‑process, drives windows through UI Automation, talks to Office over COM — and shows every command and tool call while it makes them.

Shellvis has entered the building.

You can watch it work

The console is the product, not a debug view.

Every tool call is a card: whether it worked, what ran, what it was given, how long it took, and the full output one click away. The mark is a shape rather than a colour, because colour here means one thing only — something went wrong.

calendar_list8 appointment(s) from 2026-08-24 to 2026-08-30260ms
mail_thread3 message(s) in this conversation184ms
powershell_runDrive TotalGB UsedGB FreeGB PctFree860ms
program_openpolicy on this machine forbids opening programsdenied
🗣answered, 132 wordsanswer

The prose answer goes to a window of its own. Conversation and activity run on different clocks, and mixing them makes a record that serves neither.

It keeps your desk

The part that makes it an assistant rather than a shell.

Reads mail in context

A whole conversation by its thread key, and the history with one person in both directions — so a suggested reply is in the register you already use with them.

Never sends

Replies and new messages are drafts. Not a rule that can be waived: the mail interface has no send function at all.

Keeps notes about people

What someone prefers, what you owe them, when it is due. They surface attached to the mail and calendar results that mention them, rather than being remembered.

Reminds you before

Once, ahead of the thing, on a schedule. What has already been said is absent from the result, so a job every five minutes stays quiet.

Outlook tasks

Your own list, in the application you already look at, syncing to your phone — not a second list inside this one.

Sticky notes

The Vista behaviour rebuilt: frameless, five colours, dragged anywhere, saved without asking, back where you left them after a restart.

There is no button for them, and no menu. You ask: “stick a note on the desktop: call Weber back, 0151…” or “a green note with the shopping list”. A line or two — longer text is refused and goes to the notes database instead, because a sticky note is a reminder and not a document. Ask “what is on the desktop” to see what is already up.

Tells you, without taking the screen

A run that finds something worth knowing raises a desktop alert like Outlook's: bottom right, no focus taken, gone in seven seconds, and a click opens the message window with the report.

Most runs raise nothing. A run has to say for itself that something matters, and the default is silence — an alert for a routine result teaches you to dismiss the next one unread, and then the one that mattered is lost with it. Everything waits while Windows says you are presenting, in a full-screen call or away.

Schedules itself, through Windows

“every morning at eight, the day's appointments and anything falling due” is the whole setup. Shellvis writes the job and registers a real task under \Shellvis in Task Scheduler that calls itself with --job.

So it fires whether or not Shellvis is open, and it is visible and editable in a tool you already have. Every change asks first, in every permission mode: a scheduled job is the one thing here that acts unattended, on a timer, indefinitely.

Ninety-nine tools, and room for more

Eighty-seven on a machine with no Home Assistant, no privileged service and no Thunderbird.

AreaWhat it reaches
DesktopThe UI Automation tree of any window, with a short reference for every element. Clicks and typing address references, never coordinates.
ShellPowerShell 7 in one persistent runspace, Windows PowerShell 5.1 out of process for the modules that need it, WSL, and background processes.
GallerySearch, install and import a module, and use its cmdlets in the next turn — without ten thousand cmdlet names in the prompt.
OfficeWord, Excel and PowerPoint without Office installed, plus the documents you have open right now, plus PDF export.
OutlookMail, threads, correspondence history, calendar, contacts and tasks. Opening a message puts it in front of you.
TeamsOpen a chat with the message written but unsent; join the meeting on a calendar entry.
BrowserIts own persistent profile, driven over the DevTools protocol. A click that would land on a cookie banner is refused, not faked.
Skills & memoryWhat it has learned about this machine, disclosed in three tiers so it costs a line and not a page.
SchedulerList, add, change, remove and disable scheduled jobs by saying so. Each one becomes a Windows task, so it fires with Shellvis closed.
ConnectorsA directory with one YAML file in it teaches Shellvis a REST API it has never seen. Drop it in and its tools are there on the next start.
PrivilegedA separate service, six operations, every one of them asking first — even the ones that only read.

Connectors are how that list grows without a rebuild. The manifest names the variable holding a credential and can never hold its value; only a GET is allowed to run without asking; and no package can shadow a built-in tool. Three ship with Shellvis, for a self-hosted Jira, its service desk and Confluence. How to build one →

What it will not do quietly

The rules that shape the whole thing.

The burden of proof is on reading. A command runs without asking only when it can be proved to read: the verb, the syntax tree and the command shape all have to agree. Anything unproven asks. There is no "probably harmless".
Some things always ask. Installing a module from the gallery, any privileged operation, running script in a signed-in browser page. No mode waives those, and that is the whole difference between them and merely writing something.
Nobody is there at three in the morning. A scheduled run refuses every approval rather than granting it, and its prompt says so — otherwise it burns rounds retrying something that will never be allowed.
An empty result is an answer. "No appointments this week" is a fine thing to say. Filling the gap with plausible-looking entries is the worst thing an assistant can do, and it happened here once: six invented appointments, dated to a year that had not happened, from a calendar query that legitimately found nothing.
Dictation stays on the machine. Whisper runs locally by default. Hosted recognition exists as an option, is never reached automatically, and says so in the console every single time it is used.

Anything can ask it a question

One parameter, and it lands in the conversation you already have open.

A script, a task, a shortcut — anything that can start a program can put a question to Shellvis:

Shellvis.Shell.exe --prompt "what is due today"
Shellvis.Shell.exe --job morning-briefing

If a Shellvis is already running, the parameter is handed to that instance rather than starting a second one. That is not an optimisation: a second copy would mean a second PowerShell runspace and a second COM apartment, and the answer would appear in a window you are not looking at. A prompt arrives as an ordinary turn and does not raise the window over what you are doing.

The channel is a named pipe whose ACL grants exactly one account — the one that created it. What travels through it is a prompt for an agent that can drive the desktop and read mail, so another signed-in user must not be able to write to it.

Install

Two modes, and the difference is whether a privileged service exists.

As a user

No administrator rights. Installs under your own profile, starts with you, and can do everything except the operations that genuinely need elevation.

With the service

Adds a separate LocalSystem process reached over a named pipe whose ACL grants exactly two identities and explicitly denies the network. It accepts six named operations, not a command channel, and refuses to touch its own service, the boot configuration, the antivirus or the shadow copies.

Download the installers · Requirements · Configuration

How it is verified

Forty-one harnesses, seven hundred-odd checks, and the ones that are not run.

Most of what could go wrong here is about what a real process, a real mailbox or a real window actually does, so most of the checking is against those rather than against mocks. Outlook is driven for real and the run asserts that no Outlook process is left behind. A browser is launched for real, because everything interesting about browser automation is what the browser really does.

What is not checked is written down as plainly as what is. The privileged service has never run as a service, because the development machine grants no administrator rights; the Thunderbird extension has never met Thunderbird. Those are in the README under known limitations, not discovered later.