Termlet is a browser-only terminal simulation. Contributions should keep the core safe, portable, and easy to fork.
npm run verifyverify runs syntax checks, unit tests, the performance benchmark, Markdown link smoke, the focused security scan, the dist build, and the GitHub Pages demo smoke. The core has no runtime dependencies.
See docs/quality-gates.md for the standard gate list and the optional release checks.
- Keep terminal input as data. Do not introduce real shell, PTY, subprocess, or arbitrary JavaScript execution.
- Render command output as text. Use events for trusted renderer-owned UI effects.
- Keep site personality in presets and examples, not in core command plugins.
- Add tests for new parser behavior, filesystem mutations, permission checks, persistence, and destructive-command guards.
- Prefer small ES modules and stable public APIs over framework-specific code.
- Put generic Linux-like commands in
src/plugins/basic-commands.mjsorsrc/plugins/system-commands.mjs. - Put site/game/blog-specific commands in a new plugin or preset.
- Return
{ stdout, stderr, status, events }throughok()orfail(). - Use
ctx.signalfor interruptible async work. - Use
ctx.fsfor file access and pass{ cwd, home, user, groups }. - Add a test in
test/core.test.mjs.
- Update
CHANGELOG.md. - Run
npm run verify. - Check
npm run api:smokeandnpm run package:smokebefore publishing a package. - Confirm
SECURITY.mdstill matches any new command or adapter behavior.