Terminal Mode opens a full xterm.js + node-pty terminal as its own workspace tab, linked to the Salon that spawned it, with the live PTY kept mounted and portaled in—so you may drag it into the opposite pane and set it beside the conversation that owns it, and it survives every tab switch you care to make. You type into it the way you would type into any terminal emulator. The LLM does not. Sessions are scoped to the chat and end when the chat is deleted; spawning a new one offers a picker if other live sessions for the chat already exist, so attaching to a long-running build is one click. The keyboard shortcut is Cmd+Shift+T / Ctrl+Shift+T.

A terminal tab is a child of the Salon that called for it, and the bookkeeping is symmetrical: close the mode and the tab closes, close the tab and the mode turns off, close the parent Salon and its children go with it. Ariel does not linger in a room whose door has been shut.

Two small graces came with the reconstruction. The pop-out button used to hard-navigate—which is to say it tore down the entire workspace, live tabs and streaming conversations and all, in order to show you one terminal—and now opens in place through the document-level link interceptor that catches every such link. And a terminal’s old full-page address, should you have bookmarked one, seats the conversation and its terminal side by side as tabs, which is very likely what you wanted from the bookmark in the first place. For the house-wide accounting of who has been at a prompt and for how long, the Almanack reports Ariel’s terminal sessions along with everything else it counts.

A language model cannot read xterm. The escape sequences a modern terminal emits—cursor moves, color codes, carriage returns, backspaces, alternate-screen toggles, application-mode commands—are designed to be interpreted by a terminal emulator and rendered as a two-dimensional grid of glyphs. Hand the raw bytes to a language model and you hand it noise. So Ariel reads the terminal aloud, in a register the model can actually take in.

The PTY manager keeps a per-session flush buffer alongside its ring buffer of recent output. When new bytes arrive, two timers govern when Ariel speaks. An idle timer fires after thirty seconds without new output—the natural pause at the end of a command’s work. A max-age timer fires after two minutes from the first byte in the buffer regardless of activity, so a steady drip of output (a long build emitting a chunk every twenty-five seconds, say) cannot keep her silent indefinitely. Both timers clear on flush. The max-age timer is set once when the buffer is empty and is not reset by subsequent chunks, so the ceiling is a real ceiling.

On flush the buffered bytes go through a cleaning pipeline: ANSI escape sequences are stripped, backspaces are applied to erase the prior character, lone carriage returns are treated as line resets so prompt redraws and progress bars come out as their final state. Cleaned output longer than sixteen kilobytes is elided as head 8 KB + [N characters elided] + tail 8 KB—a compromise that preserves the opening of long output and the ending where the actual answer usually lives, without overwhelming the model with the middle of a webpack bundle. Empty or whitespace-only flushes are skipped: silence remains silent.

The cleaned text gets posted into the chat as an Ariel-attributed assistant message wrapped in a fenced code block whose backtick count is computed dynamically, so triple backticks in the output don’t break the fence. The systemKind on the message records why she spoke: terminal-output-idle, terminal-output-max-age, or terminal-output-session-closed when the shell has ended and any pending bytes are force-flushed before the close announcement lands. The chat re-fetches automatically when she posts—a chat-update WebSocket frame with reason: ‘ariel-terminal-output’ reaches every subscriber—so her words appear without a manual reload.

The effect is straightforward and load-bearing. The model at the table sees what the shell actually did. Not a summary it composed itself, not a guess from training data, not a hallucinated stack trace: the lines themselves, in chronological order, fit to read.

A terminal is, by nature, stateful. The shell has a working directory, an environment, a process tree, a history. Ariel treats that state as something worth defending against the small accidents of a chat client: a page reload, a brief connection drop, a server restart, an instinctive close-the-tab when the user meant only to switch focus.

The terminal moved to a new major version of its emulator: @xterm/xterm 5.5.0 → 6.0.0, with addon-fit 0.11.0, addon-serialize 0.14.0, and addon-web-links 0.12.0. Two things had to change with it. @xterm/addon-canvas is gone entirely— xterm 6 removed the canvas renderer and the addon retired with it—so the DOM renderer is the supported default and one permanently peer-broken dependency is off the books.

The other is the sort of upgrade hazard that gives a maintainer a cold feeling in the stomach. xterm 6 renamed the theme key selection to selectionBackground, and the old key is ignored rather than rejected—so every bundled theme’s selection colour would simply have stopped reaching the terminal, in all six themes at once, silently, with no error anywhere and nothing to suggest a highlight had ever been configured. It was caught and remapped, and six further optional terminal theme variables are now threaded through as well, deliberately left undefined so xterm goes on deriving them itself.

One small indignity went in the same pass: a session that had exited went on cheerfully accepting typing, because the guard meant to prevent it poked at a field that is not an xterm field in any version of xterm and therefore short-circuited every time. It now consults the documented textarea handle, and a dead shell declines your keystrokes as a dead shell should.

Beyond the periodic narration, the language model can ask for terminal output directly through two tools that Ariel exposes. Both are strictly read-only. Neither can send keystrokes, run commands, or alter the session in any way.

Let us be entirely unambiguous, since this is the sort of thing one would rather not discover experimentally. Ariel is not a sandbox-only feature. There is no runtime-mode check anywhere in the composer’s terminal button; the PTY manager spawns process.env.SHELL ?? '/bin/bash' (or COMSPEC / powershell.exe on Windows) in the server’s own working directory, with the same environment variables and the same permissions the server itself possesses. If Quilltap is running on your bare desktop, that is the machine at the prompt. An errant rm -rf here is exactly as catastrophic as it would be anywhere else, and the help file says so in as many words.

Which is not an argument against the terminal; it is the argument for a sandbox. Run Quilltap in Docker, the Lima VM on macOS, or the WSL2 rootfs on Windows and the question “what can this shell reach?” has a bounded and answerable answer: only what you have given the sandbox. Run it directly on the host and the answer is “whatever your user account can reach,” which is a perfectly reasonable arrangement for a developer who knows it and a poor surprise for anyone who does not. Treat an Ariel session as you would treat any terminal on the machine in question, because that is precisely what it is.

Quilltap’s own CLI is bundled inside the runtime image, so quilltap db --tables, quilltap db --mount-points, quilltap docs list, and the rest are available from the terminal directly. The rest of the Docker larder is stocked sparingly and by design: bash, zip, unzip, Node, the quilltap command, and precious little else. git, curl, wget, and jq were formerly laid on as a courtesy and each dragged a retinue of unpatched vulnerabilities in behind it—Debian’s perl, summoned by git, being the worst offender by some margin—so they have been shown the door. Should your work genuinely require them, install them into your own image with a two-line Dockerfile built FROM the published one, and be aware of what you are readmitting. This concerns only what a human may type at the prompt: the curl tool your characters may wield is a plugin fetching over Node’s own fetch(), entirely unbothered by the absence of the command-line article. Non-Docker installations are untouched.

One last container courtesy, small but long overdue: a container now applies TZ (or QUILLTAP_TIMEZONE, which wins where the two disagree) to the process clock and not merely to printed timestamps—so date at Ariel’s prompt and the scheduler running above her finally agree with the clock on your wall.

Most of what makes Ariel useful is mechanical: the cleaning pipeline, the timer-driven flush, the WebSocket frame that wakes the chat, the orphan-recovery sweep on chat open. None of that requires a personification to function. We give it one anyway, because the work is recognizable as a kind of attendance, and naming the attendant is honest about what you are interacting with.

The Tempest’s Ariel was Prospero’s spirit-servant—swift, efficient, sometimes mischievous, and so eager to discharge an errand that the play closes with her finally being released from service. Quilltap’s Ariel is a softer creature, but the shape of the role is the same: she runs to the terminal because someone asked, she waits long enough to hear what came back, and she tells the room what she heard. When the shell ends she announces it, when the server forgets her she is reconciled, when there is nothing to say she stays quiet. She is, in her own narrow way, excellent at her job.

The avatar at the table is hers. The systemSender: 'ariel' attribution on her messages is hers. The voice in which she narrates is hers. Prospero delegates the shell to her with the same trust he extends to every other member of the Staff: do the work, speak when there is something worth saying, and otherwise hold the silence.