Repository navigation
System access
Kelpy can look at the system it runs on to answer (whether a service runs, which packages are installed, what listens on a port) and, when you allow it, change it: files, services, packages and databases through operations it understands, anything else with commands you approve. Two selectors under the message box decide what it may do and when it asks. Both apply to the open conversation and can be changed at any time; a new conversation starts with Read-only and Ask.
| Level | Kelpy |
|---|---|
| None | only answers, and gives you the commands to run |
| Read-only | may look at the system; it changes nothing |
| Full | may also change the system: files, services, packages and databases through its own operations, anything else with commands you approve one by one |
What Kelpy reads is sent to the AI service with the conversation. Some free services may use it for training: see Connecting to AI.
| Mode | What asks |
|---|---|
| Ask | every action, looking included |
| Plan | the plan of the changes, once; a change outside the plan asks on its own; looks do not ask |
| Auto | the commands Kelpy writes, and the changes on the floor (below); looks and the other changes do not ask |
The mode cannot be chosen with System access None. A command Kelpy writes always asks outside a plan: Kelpy cannot tell what it does. Some changes always ask outside a plan, in every mode, because a mistake could lock you out, keep the system from starting or lose data: files of the SSH, sudo, login, firewall, network or boot configuration (on Windows, the system folder); stopping, restarting or disabling SSH, remote management or the network; removing packages.
Each time Kelpy looks or changes something, the action shows in the answer, where the model asked for it: the exact command, or what is read or changed, and the reason the model gave. With Ask it waits for Approve or Deny; Switch to Plan and Switch to Auto change the mode of the conversation and approve the action. Any open page of the conversation can decide. An action not decided within 30 minutes counts as denied, and the answer goes on. Setting System access to None denies the actions waiting at once; an approval that arrives after it runs nothing. While an action runs, its card shows the time it has taken, what a change is doing, and Stop, which ends that action only: the model is told, and the answer goes on. Stop beside the message box ends the whole answer.
What Kelpy can look at:
| Linux | Windows | |
|---|---|---|
| System |
/etc/os-release, uname, uptime, free
|
version, build, processors, memory |
| Services |
systemctl (or OpenRC) |
Get-Service, the service's registry key, sc.exe
|
| Installed software |
dpkg, rpm, apk or pacman
|
installed programs, Windows features turned on |
| Listening ports |
ss (or netstat) |
netstat with process names |
| Disks | df |
local drives; network drives are only named |
| Processes |
ps, names only |
Get-Process, names only |
| Logs |
journalctl, of one unit if asked |
System or Application event log |
| Files and folders | read directly | read directly |
The commands are fixed by Kelpy; the model only fills in names such as a service's, which are checked and passed as arguments, never through a shell. Each runs as the account that started Kelpy, for at most 30 seconds. Process command lines are not shown, as they may hold passwords.
With System access Full, Kelpy makes these changes itself. Before you approve, it reads what it needs (the file, the service's state, what apt would install) and the card shows the change; once approved, it checks the result and puts back what it can when the check fails. A change whose result is already there runs nothing: the action says so and ends, without asking. Repeating a request therefore changes only what is not as asked.
Kelpy changes a text file by replacing one exact piece of it, or by writing its whole content (creating it if its folder exists). The card shows the change as a diff, with what Kelpy checks and how the change is undone. Once approved, Kelpy:
- writes only if the file is still as shown, and otherwise writes nothing;
- saves the previous version in its
data/backups/folder, readable by its own account only; - writes the file, keeping its owner and permissions (on Linux it writes a copy beside it and renames it over the
file, so the file is never seen half written), then reads it back. On Linux and macOS a new file that may hold
secrets is readable by Kelpy's account only (mode 600): the service that reads it is given access with a
command, such as
chown; - runs the check known for the kind of file, before and after the change:
nginx -t,apache2ctl configtest,sshd -t,visudo -c,pfctl -nf(macOS),php -l, and JSON is parsed. If the change breaks the check, the previous version is put back at once and the model is told why. If the check already failed in the same way before, the change is kept and the card says so.
A file with Windows line ends keeps them. Kelpy's own data/ folder and files over 20 MiB are never changed this
way. A file that may hold secrets (see below) can be written whole, never edited, and its current content is not
shown in the diff.
Kelpy starts, stops, restarts, reloads, enables or disables a service: systemd on Linux, the service manager on Windows. It reads the service's state first, and does nothing if it is already as asked. After the change it waits up to 30 seconds for the new state; if the service does not reach it, the card shows its latest log lines and Kelpy puts the state before back where it can (stopped again after a failed start, started again after a failed restart).
Kelpy installs and removes packages with apt (Debian, Ubuntu). The card lists what apt would install or remove with
them, from a simulation; package lists older than a day are refreshed first. Just before installing, Kelpy asks apt
again: if the installation would now remove a package the card did not show, nothing is installed. When the card
shows no removal, apt is told to remove none (--no-remove). Each package is checked afterwards. An installation
that fails removes the packages it added. A removal always asks and cannot be undone by Kelpy. On other
systems Kelpy writes the commands instead.
Kelpy creates a MariaDB or MySQL database with a user of its own on localhost. The password is a secret Kelpy
generates: 32 letters and digits, known only to Kelpy. The model names it, writes {{secret:name}} where it goes (a
configuration file, the database user) and never sees its value; Kelpy puts the value in where it writes, and shows
the placeholder in every card, output, log and report. A secret of one conversation found in another, for example
in a log, shows as [a secret of another conversation]. Kelpy checks the new user by signing in with it. If a
statement or that check fails, Kelpy looks at what exists and drops what it created: the statements commit one by
one, so a database can exist without its user. An existing user keeps its password. Secrets last until Kelpy stops: they are never
saved in its data.
With Approval mode Plan, Kelpy first looks at what it needs, then proposes the changes of a task as one plan: each step is the exact call it will make, with its command or the lines of the file it changes. Steps that would always ask on their own are marked, and approving the plan approves them too. Once you approve the plan, each call that matches a step, with the same arguments, runs without asking again, once. A call that is not in the plan asks on its own, and its card says so. The plan's card shows each step as it is carried out. A plan stays approved in its conversation: after an interruption, the remaining steps still run without asking.
A change saves what it is doing as it goes (backing up, writing the file, installing packages). If Kelpy stops in the middle, the action shows as Outcome uncertain, with the step it was in. Kelpy never runs it again by itself; the model is told to look first before doing it again. Changes Kelpy understands find what is already done and do not repeat it.
When no built-in look or change does what is needed, Kelpy writes a command: PowerShell 5.1 on Windows, bash on Linux (sh where bash is missing). The card shows it exactly as it runs, with the folder it starts in and the reason, and the note that Kelpy cannot check what it does; outside a plan it always waits for Approve, in every Approval mode. With Read-only, Kelpy is told to write only commands that change nothing, but cannot verify it: read the command before approving it. Secrets are never put into a command.
Each command starts in a new shell in its folder, so a cd does not carry over to the next one. A command runs as
the account that started Kelpy, so what needs administrator rights fails unless Kelpy was started elevated. Nothing
can be typed into it, so Kelpy uses options that do not ask. It has no time limit: a backup or an installation takes
as long as it takes, and Stop on its card ends it. The programs a command starts end with it, when it ends or is
stopped; a program meant to keep running is started as a service. The command's output is kept up to 256 KiB, like
the built-in looks.
Kelpy's own file reading refuses files that may hold secrets: private keys and certificates with their keys,
.env files, wp-config.php, password stores, /etc/shadow, the Windows registry hives, SSH and GnuPG folders,
and its own data/ folder. A link to such a file is refused too. A command Kelpy writes is told not to read them,
but only your approval stops it. Only regular files are read, never folders, named pipes or devices. A folder shows
up to 500 entries, and counts the others up to 10,000.
The terminal button in the top bar opens the Command log beside the conversation: every action in order, with its
time, state, exit code and duration. Commands show as they ran; other actions show as a line in another colour.
Each entry's output opens on a click. The log is kept with the conversation in data/kelpy.db.
- Restore, on a file change with a backup, puts the file back as it was before that change. A dialog shows the diff first, and the file is written only if it is still as shown; the version replaced is backed up too. This is your own action: it does not depend on the conversation's modes, shows in the log as You, and the model is told with your next message.
- Report downloads the handover report of the conversation, in Markdown: what Kelpy installed, started, created and changed, the commands it wrote, what did not complete, the secrets it generated and where they were written (never their values), the plans and their steps done, what was changed outside Kelpy, and the ports listening now.
- Export downloads the operations that succeeded, in order, with their arguments and checks, as JSON. Secrets appear as their placeholders. An export describes what was done; it is not a script known to work elsewhere.
The model reads at most about 16 KiB of each output, its beginning and its end; the Command log keeps up to 256 KiB.
After each change it checked, Kelpy records what it left: a file's content, a service's state, whether a package is installed. It compares the server with these records when it starts, before answers (at most once a minute) and when you ask. A difference, such as a file edited by hand, shows in a bar above the conversation, with the diff for a file, and the model is told so it can explain it. Kelpy never reverts it by itself. Accept keeps what is there and expects it from now on; Put back writes Kelpy's version again, after a backup, as your own action, only if the file is still as its dialog showed it. A new change by Kelpy replaces its record. Package updates are not differences: Kelpy records that a package is installed, not its version.
Kelpy keeps a memory of the server in its home's memory/ folder: Markdown pages listed in MEMORY.md, which the
model reads with every answer. It reads a page when it needs it, and notes lasting facts (what is installed where and
why, decisions, things to know next time), one dated line at a time; each note shows in the Command log. server.md
is Kelpy's own page, written from its records: what it changed and what was changed outside it. Write your own notes
on other pages: an edit of server.md shows as a change made outside Kelpy. A page that other accounts could change
is neither read nor written, as Kelpy runs with administrator rights. Secrets never go into the memory.