A native Windows AI agent: a floating command bar with a console beneath it, wired to PowerShell, the desktop, Office, Outlook, Teams and a browser.
It does not wrap a terminal. It hosts PowerShell 7 in‑process, drives windows through UI Automation, talks to Office over COM — and shows every command and tool call while it makes them.
Shellvis has entered the building.
The console is the product, not a debug view.
Every tool call is a card: whether it worked, what ran, what it was given, how long it took, and the full output one click away. The mark is a shape rather than a colour, because colour here means one thing only — something went wrong.
The prose answer goes to a window of its own. Conversation and activity run on different clocks, and mixing them makes a record that serves neither.
The part that makes it an assistant rather than a shell.
A whole conversation by its thread key, and the history with one person in both directions — so a suggested reply is in the register you already use with them.
Replies and new messages are drafts. Not a rule that can be waived: the mail interface has no send function at all.
What someone prefers, what you owe them, when it is due. They surface attached to the mail and calendar results that mention them, rather than being remembered.
Once, ahead of the thing, on a schedule. What has already been said is absent from the result, so a job every five minutes stays quiet.
Your own list, in the application you already look at, syncing to your phone — not a second list inside this one.
The Vista behaviour rebuilt: frameless, five colours, dragged anywhere, saved without asking, back where you left them after a restart.
There is no button for them, and no menu. You ask: “stick a note on the desktop: call Weber back, 0151…” or “a green note with the shopping list”. A line or two — longer text is refused and goes to the notes database instead, because a sticky note is a reminder and not a document. Ask “what is on the desktop” to see what is already up.
A run that finds something worth knowing raises a desktop alert like Outlook's: bottom right, no focus taken, gone in seven seconds, and a click opens the message window with the report.
Most runs raise nothing. A run has to say for itself that something matters, and the default is silence — an alert for a routine result teaches you to dismiss the next one unread, and then the one that mattered is lost with it. Everything waits while Windows says you are presenting, in a full-screen call or away.
“every morning at eight, the day's appointments and anything falling
due” is the whole setup. Shellvis writes the job and registers a real task
under \Shellvis in Task Scheduler that calls itself with
--job.
So it fires whether or not Shellvis is open, and it is visible and editable in a tool you already have. Every change asks first, in every permission mode: a scheduled job is the one thing here that acts unattended, on a timer, indefinitely.
Eighty-seven on a machine with no Home Assistant, no privileged service and no Thunderbird.
| Area | What it reaches |
|---|---|
| Desktop | The UI Automation tree of any window, with a short reference for every element. Clicks and typing address references, never coordinates. |
| Shell | PowerShell 7 in one persistent runspace, Windows PowerShell 5.1 out of process for the modules that need it, WSL, and background processes. |
| Gallery | Search, install and import a module, and use its cmdlets in the next turn — without ten thousand cmdlet names in the prompt. |
| Office | Word, Excel and PowerPoint without Office installed, plus the documents you have open right now, plus PDF export. |
| Outlook | Mail, threads, correspondence history, calendar, contacts and tasks. Opening a message puts it in front of you. |
| Teams | Open a chat with the message written but unsent; join the meeting on a calendar entry. |
| Browser | Its own persistent profile, driven over the DevTools protocol. A click that would land on a cookie banner is refused, not faked. |
| Skills & memory | What it has learned about this machine, disclosed in three tiers so it costs a line and not a page. |
| Scheduler | List, add, change, remove and disable scheduled jobs by saying so. Each one becomes a Windows task, so it fires with Shellvis closed. |
| Connectors | A directory with one YAML file in it teaches Shellvis a REST API it has never seen. Drop it in and its tools are there on the next start. |
| Privileged | A separate service, six operations, every one of them asking first — even the ones that only read. |
Connectors are how that list grows without a rebuild. The manifest names the variable
holding a credential and can never hold its value; only a GET is allowed to
run without asking; and no package can shadow a built-in tool. Three ship with Shellvis,
for a self-hosted Jira, its service desk and Confluence.
How to build one →
The rules that shape the whole thing.
One parameter, and it lands in the conversation you already have open.
A script, a task, a shortcut — anything that can start a program can put a question to Shellvis:
If a Shellvis is already running, the parameter is handed to that instance rather than starting a second one. That is not an optimisation: a second copy would mean a second PowerShell runspace and a second COM apartment, and the answer would appear in a window you are not looking at. A prompt arrives as an ordinary turn and does not raise the window over what you are doing.
The channel is a named pipe whose ACL grants exactly one account — the one that created it. What travels through it is a prompt for an agent that can drive the desktop and read mail, so another signed-in user must not be able to write to it.
Two modes, and the difference is whether a privileged service exists.
No administrator rights. Installs under your own profile, starts with you, and can do everything except the operations that genuinely need elevation.
Adds a separate LocalSystem process reached over a named pipe whose ACL grants exactly two identities and explicitly denies the network. It accepts six named operations, not a command channel, and refuses to touch its own service, the boot configuration, the antivirus or the shadow copies.
Forty-one harnesses, seven hundred-odd checks, and the ones that are not run.
Most of what could go wrong here is about what a real process, a real mailbox or a real window actually does, so most of the checking is against those rather than against mocks. Outlook is driven for real and the run asserts that no Outlook process is left behind. A browser is launched for real, because everything interesting about browser automation is what the browser really does.
What is not checked is written down as plainly as what is. The privileged service has never run as a service, because the development machine grants no administrator rights; the Thunderbird extension has never met Thunderbird. Those are in the README under known limitations, not discovered later.