A re-implementation of the kernel's shell path for the browser, modelling the shipped default: commands run sandboxed, so what is clean runs — and is logged. Simplified, not exhaustive: the Python original decides more cases than these patterns name. Two things the page cannot show: before any of these stages the real kernel checks who is asking (and there is no default allowlist), and file tools walk their own pipeline — system floor, identity, secrets, persistence, effect. The authoritative version is the Python one; 179 adversarial cases run against it on every install and every update.