feat: full machine control for every agent + the OpenClaw/Hermes feature set, gated and audited

FULL CONTROL — every agent controls the host (shell, files, network), each via its
project's own supported switch: opencode OPENCODE_PERMISSION={"*":"allow"},
claude-code --dangerously-skip-permissions, OpenClaw `exec-policy preset yolo`,
Hermes unattended auto-approve, and a RUN: tool-loop the Brain drives on any
OpenAI-compatible model. CrewAI crews get a run_shell tool. Injected into every
service via full_control_env(); config: security.full_control / guardrails.

The installer now asks for root ONCE up front (sudo keep-alive on Linux/macOS,
UAC self-elevation on Windows), installs system packages + the global aios command
+ a boot service, but keeps toolchains user-owned and hands ownership back.

SECURITY (aios_sec.py) — full control + an open control plane is exactly
CVE-2026-25253, so it's paired with a real gate: loopback trusted, every other
request needs AIOS_HUB_TOKEN; CSRF closed (cross-origin always needs the token,
CORS never echoes *); DNS-rebinding closed (Host must be IP/known-local); exec
guardrails refuse rm -rf /, mkfs, dd to block devices, fork bombs, shutdown
(tokenized, not regex — catches --no-preserve-root); everything audited.

DURABLE STATE (aios_brain.py) — one SQLite db (WAL, profile-aware) backing:
  Task Brain    cron + interval + agent + shell on one scheduler, every run logged
  TaskFlow      durable multi-step flows; state commits per step, resumes on restart
  Active Memory FTS5 recall on EVERY turn + async fact extraction (learns your workflow)
  Skills        self-improving Curator writes skills/learned/*/SKILL.md after real tasks
  Audit         every command any agent ran
Old memory.json / schedules.json migrate in automatically.

TOOLS (aios_tools.py) — the one choke point for shell (guardrailed + audited),
the 28-channel catalog read from OpenClaw's own dist/channel-catalog.json, and
skill install/learn.

CLI: aios exec, channels, attach (jump into a live OpenClaw session), migrate
(import from OpenClaw), profile (isolated per-client agents), token [--rotate].

HUB: Brain now has a body (RUN: loop, capped, guarded). New endpoints /api/exec,
channels, tasks, flows, skills, audit, security. Dashboard gains Channels, Task
Brain, TaskFlow, Skills, and Control & Audit views; a fetch wrapper attaches the
token so WSL-over-IP works. Fixed a latent bug: /?token=… (and any ?query) 404'd
the dashboard because the root match didn't strip the query string.

Fixed install.ps1: it never parsed under PowerShell 5.1 -File (em-dashes decoded
as ANSI) — now pure ASCII.

Verified on Windows: guardrails (32 cases), auth gate (14 cases incl. CSRF +
rebinding), cron matcher (15 cases), FTS recall, durable flow revisions, all new
endpoints live, dashboard views render with zero console errors, exec round-trips
to the audit log, and aios start hub enforces the token end-to-end.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ZD Studios

README.md

@@ -62,8 +62,11 @@ curl -fsSL https://raw.githubusercontent.com/ZDStudios/AIOS/main/install.sh | ba
 irm https://raw.githubusercontent.com/ZDStudios/AIOS/main/install.ps1 | iex
 ```
 
-The installer clones the repo to `~/AIOS`, installs the toolchains (**uv, bun, pnpm, Node**), and runs
-`aios setup` — installing every agent's deps, building, and wiring the Control Room. Then add your key:
+The installer **asks for root once, up front** (sudo on Linux/macOS, a UAC prompt on Windows) — because
+the agents get full control of the machine and setup registers a start-on-boot service and a global
+`aios` command. It then clones the repo to `~/AIOS`, installs the toolchains (**uv, bun, pnpm, Node**)
+into your user profile, and runs `aios setup` — installing every agent's deps, building, wiring the
+Control Room, and applying the full-control exec policy. Then add your key:
 
 ```bash
 cd ~/AIOS
@@ -158,9 +161,15 @@ Plus two integrations that glue it together:
 | `aios doctor` | Diagnose tools, config, deps and ports — with the exact fix for each. |
 | `aios update [--check]` | `git pull` + reinstall changed deps + re-render. `--check` just reports if updates exist (also auto-checked on start). |
 | `aios autostart enable\|disable` | Run The AI OS on login/boot (Startup shortcut on Windows, systemd/`.bashrc` on Linux/WSL). |
+| `aios exec <cmd>` | Run a command through the agents' own **guardrailed, audited** shell. |
+| `aios channels` | List the **28 messaging channels** the gateway can bridge, and which are configured. |
+| `aios attach [args]` | Jump into a running **OpenClaw gateway session** with an external harness, mid-run. |
+| `aios migrate [--source]` | Import settings, memory, skills and keys from an existing **OpenClaw** install. |
+| `aios profile [name]` | Isolated agents per client/project — each with its own memory, tasks, and flows. |
+| `aios token [--rotate]` | Print (or rotate) the hub token that gates non-loopback access. |
 | `aios test --smoke` | Run test suites, or drive the whole stack end-to-end. |
 | `aios logs [svc]` | Tail a service log from `.aios/logs/`. |
-| `aios url` | Print the Control Room + service URLs. |
+| `aios url` | Print the Control Room + service URLs (with the token link for WSL). |
 
 **In the Control Room** (`http://127.0.0.1:8787/`) you can:
 - **Chat** with any agent (Brain, CrewAI, opencode, claude-code) or broadcast to **All**.
@@ -169,8 +178,13 @@ Plus two integrations that glue it together:
 - **Automations** — schedule prompts to run against any agent every N minutes (daily digests, checks).
 - **Log in to Claude from the dashboard** — **Settings → "1 · Log in to Claude"** runs the Claude CLI login *through the hub*: it shows the authorize link, you approve in the browser and paste the code back, all in the UI. Then **"2 · Use my Claude subscription"** routes the Brain/Team/crews through **claude-code** (no API key, no per-token cost). A live status line shows whether claude-code is up and actually authenticated. (Terminal equivalent: `aios claude-login`.)
 - **🛡️ Self-healing agents** — a watchdog in the hub health-checks every agent. If one stops responding it's **automatically restarted**; if the restart fails, a **healthy agent reads its logs and diagnoses the cause**. See the incident log in **Status → Self-healing log** (`watchdog.enabled` in `aios.config.yaml`).
+- **📡 Channels** — a grid of every messaging app OpenClaw can bridge (WhatsApp, Telegram, Discord, Slack, Signal, Matrix, Teams, iMessage, …). Paste a channel's token and it goes live on the one gateway daemon.
+- **⚙ Task Brain** — one SQLite-backed scheduler for cron jobs, interval prompts, and background shell commands. Every run is recorded; tasks survive restarts.
+- **🔀 TaskFlow** — durable multi-step flows that chain agents. State is committed after every step, so a crash or restart **resumes where it left off** instead of replaying work.
+- **🎓 Skills** — install ClawHub-style skills, and watch the **self-improving loop**: after a task that ran commands, a Curator judges whether it taught a reusable procedure and writes a `SKILL.md` every agent then mounts.
+- **🛡️ Control & Audit** — see full-control status, run a guardrailed command, and read the **audit log** of every command any agent ran on this machine.
 - **Settings** — edit provider/key/model, channel tokens, and `aios.config.yaml`; it re-renders into every agent, no terminal needed.
-- **Themes** — Light, Dark, Midnight, Slate, Rose. Chat renders markdown (headers, bullets, code blocks).
+- **Themes** — Hermes (gold), OpenClaw (coral), plus light/dark variants and a theme store. Chat renders markdown and live **OpenUI** widgets.
 
 **Auto-updates:** `aios start` now auto-runs `git pull` + reinstalls changed deps when the repo has updates (`updates.auto_update: true`). Turn it off in `aios.config.yaml`.
 
@@ -209,6 +223,20 @@ curl http://127.0.0.1:8787/v1/models         # list targets
 
 **Skills & system prompt:** 10 skills ship built-in (skill-maker, mcp-maker, web-search, web-browse, image-gen, code-review, summarize, research, data-analyst, task-scheduler) and mount into every agent. Edit the Brain/Team **system prompt** live in the hub → **Settings**.
 
+## 🖥️ Full machine control (and how it's kept safe)
+
+Every agent controls the computer The AI OS is installed on — shell, filesystem, network — through each project's own supported switch (opencode `OPENCODE_PERMISSION`, claude-code `--dangerously-skip-permissions`, OpenClaw `exec-policy preset yolo`, Hermes unattended-approval, plus a `RUN:` tool-loop the Brain drives). The installer asks for **root once, up front** to set the system pieces up in one pass. Turn it all off with `security.full_control: false`.
+
+That is deliberately the "ambient authority" posture that made **OpenClaw's CVE-2026-25253** a critical RCE — so full control is paired with a real gate, not left open:
+
+- **Loopback is trusted; everyone else needs a token.** The hub mints `AIOS_HUB_TOKEN` at setup. Binding to `0.0.0.0` (needed for WSL) is only safe because every non-loopback request must carry it — `aios url` prints the token link.
+- **CSRF is closed.** A page on the internet can reach `http://127.0.0.1:8787` from your browser, so cross-origin requests are rejected unless they carry the token, and CORS never echoes `*`.
+- **DNS-rebinding is closed.** The `Host` header must be an IP literal or a known-local name.
+- **Guardrails** still refuse the handful of commands that wreck the host rather than do the task — `rm -rf /`, `mkfs`, `dd` to a block device, fork bombs, `shutdown` (`security.guardrails: false` to disable).
+- **Everything is audited.** Every command any agent runs is written to `.aios/aios.db` and shown in **Control & Audit**.
+
+**Active Memory:** a memory sub-agent runs on **every** turn — recall is a free FTS5 query, fact-extraction is one small async call — so the agents actually learn your workflow over time instead of only reading memory at session start (`memory.active`).
+
 **On WSL?** `127.0.0.1:8787` often won't reach WSL from your Windows browser (localhost-forwarding is flaky). `aios start`/`aios url` now print your **WSL IP** URL — use that (e.g. `http://172.31.x.x:8787/`). The hub binds `0.0.0.0` so the WSL IP always works.
 
 ## ⚙️ Configuration

aios.config.example.yaml

@@ -41,6 +41,23 @@ services:
   openclaw_os:             # openclaw's own dashboard (a plugin, not an agent)
     enabled: true
 
+# Every agent controls the computer AIOS is installed on: shell, filesystem, network.
+# That is the point of an agent OS — and it is why the hub authenticates. Full control
+# plus an open control plane is exactly the bug that made OpenClaw's CVE-2026-25253
+# critical, so non-loopback and cross-origin requests must carry AIOS_HUB_TOKEN (.env).
+security:
+  full_control: true       # agents may run shell commands. false = read-only agents.
+  guardrails: true         # still refuse `rm -rf /`, mkfs, fork bombs, shutdown, dd to /dev/sd*
+  exec_timeout: 120        # seconds before a runaway command is killed
+  allowed_hosts: ""        # extra Host: values to accept, comma-separated (DNS-rebinding guard)
+
+memory:
+  active: true             # Active Memory: a memory sub-agent runs on EVERY turn.
+                           # Recall is a free FTS5 query; fact-extraction is one small
+                           # async LLM call, so it never slows the turn you're waiting on.
+
+profile: default           # isolated agents per client/project: AIOS_PROFILE=work aios start
+
 lifeos:
   mount_skills: true       # copy LifeOS skills into openclaw + hermes skill dirs
 
@@ -49,6 +66,9 @@ openui:
 
 skills:
   mount: true              # mount the bundled skills/ (skill-maker, mcp-maker, …) into agents
+  learn: true              # self-improving loop: after a task that ran commands, the Curator
+                           # judges whether it taught a reusable procedure and writes
+                           # skills/learned/<name>/SKILL.md, which every agent then mounts
 
 updates:
   check_on_start: true     # on `aios start`, check the repo for updates and notify