DEV Community: Mattia Petullo

GHOST.EXE

Mattia Petullo — Sat, 31 Oct 2026 17:11:13 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

What I Built

GHOST.EXE is a haunting that moves into your computer. There is no app to open and no chat box to talk to. You press "Begin", keep using your PC, and the spirit takes it from there.

First your screen trembles, lightly. Then a file appears in the middle of your desktop: DON'T OPEN ME. If you open it, a green-on-black terminal types out your username and tells you it has been waiting for someone. From there, a local open-weight model plays the spirit. It reads real things about your machine (your username, the time, the names of the files on your Desktop, how long you have been idle), remembers what it said, and decides what to do next: speak, shake the screen, drop a new file, move one, make one vanish, or pop up a fake system error styled for your OS.

A run lasts about 6 to 9 minutes and escalates through five phases: Omen, Contact, Conversation, Intrusion, Climax and silence. It ends with the spirit's last words, written by the model in a completely silent room. If you launch it again later, it greets you before anything else: "you came back. i never left."

How I read the theme. I took "Ghost in the Machine" literally. The name says it: a program you run, with something already inside. Not a ghost story generator, but a presence that lives in the machine and acts on your actual desktop while you use it. What unsettles me about haunted-computer stories is never the jump scare, it is the feeling of being watched by something patient. So the spirit is cold, quiet and brief, and the whole demo is short on purpose.

Three ideas hold it together:

The AI is the director, not the only actor. The model does not generate effects. It picks from a closed list of hand-built actions (none, shake, spawn_file, spawn_folder, move_file, remove_file, fake_error) and writes one short line. The effects themselves are polished and safe.
It really is watching. Nothing it says about you is faked. It reads real values, read-only.
Breaking expectations. If you close the terminal, the spirit does not let it go. About 15 seconds later every sound cuts out, the screen takes a heavy hit, and the terminal reopens by itself: "why did you close it?"

It is harmless by design. It never changes, moves or deletes a real file, never touches your camera or microphone, and starts with a plain-language warning and an emergency exit (Cmd/Ctrl+Shift+Q, or type /exit in the terminal).

It is a desktop app (Electron), so there is no live link: it runs on your own machine, with a local model. Three steps:

ollama pull gemma4:e4b
git clone https://github.com/YOUR-USERNAME/ghost-exe && cd ghost-exe && npm install
npm start

I developed it on a Mac and tested it on Linux. Windows is untested.

Code

TiaWRLD / GHOST.EXE

Hacktoberfest 2026 - Week 4 DEV challenge

View on GitHub

The README covers install, the five phases, model choice, fallback, safety, known limits and roadmap.

How I Built It

The model: Gemma 4 (e4b), run locally through Ollama. The Electron main process is the director: it owns the phase state machine, the spirit's memory and the AI calls. Two renderers do the showing: a transparent, click-through overlay and the fake terminal.

Each turn calls POST /api/chat on 127.0.0.1: non-streaming, thinking off, a JSON schema in format so the reply is { "say": "...", "action": "..." } with action restricted to an enum, temperature 0.8, capped at 120 tokens, model kept loaded for 30 minutes. The app starts loading the model while you read the startup warning, so it is ready by the first omen.

The prompt is built from: a system prompt (a cold, patient poltergeist that never mentions being an AI), a phase guide (tone and length per phase, for example contact: curious and soft, max 14 words, intrusion: threatening and clipped), the list of actions allowed right now, the real facts, the last six memory entries, and the event that just happened. The main process decides what is allowed from the phase and from what is on screen, so the model cannot ask to remove a file that does not exist, and the strongest effects (fake error, vanishing files) only unlock in Intrusion.

A small model needs a safety net. Every reply is validated. If it is not valid JSON (JSON wrapped in extra text is recovered), breaks character, or repeats an earlier line, it is retried and then replaced by a pre-written line from the same phase. If Ollama is not running or the model is missing, the app detects it at startup and goes straight to those lines. The key moments (greeting, the closed-terminal trick, the staging of the ending) never depend on the model. At exit the app prints how many lines came from the AI and how many from the fallback.

Everything else is hand-built.

The shake takes a screenshot of your screen and jitters it inside the overlay (it falls back to shaking the fake icons if screen capture is not allowed).
The sound has no audio files. It is all synthesized with the Web Audio API: a drone from three detuned oscillators, a heartbeat that speeds up from about 54 to 118 bpm, whispers made of noise shaped by vowel formants, two-part breaths, glitch clicks fired by every shake, and silence used as an effect.
The fake error box and the icons are drawn per OS (macOS, Windows, Linux). The icons are original SVG drawings.

What went wrong along the way. My first whisper sounded like wind and my first breath sounded like a robot. The whisper got fixed by shaping noise with vowel formants, and the breath by splitting it into an inhale and an exhale with irregular airflow flutter.

Why Does Open Innovation Matter?

The spirit only works if it can see you, and what it sees is personal: your username and the names of the files on your Desktop. Sending that to a cloud API would make the project creepy in the wrong way. With a local model it never leaves the machine, and the README can say so honestly: the app only talks to 127.0.0.1.

It works with the lights off. Turn Wi-Fi off and nothing changes. A haunting that dies when the connection drops is a bad haunting.
It costs nothing to run. No API key, no per-message bill, no rate limit in the middle of a scare. Anyone can clone it and haunt a friend.
I get to pin the brain. The model is one constant in llm.js. It cannot be updated, retired or rate-limited under me, and I can swap it for another local model in one line. Structured output with a JSON schema gave me a closed list of actions at the output level, not just a polite request in the prompt.

The honest trade-off: a small local model is sometimes flat or repetitive, so I wrapped it in validation and a fallback and kept the key moments scripted. A bigger closed model might write better lines. It would not let me promise that your Desktop file names stay on your machine.

The Spirit of It

The first time I ran it with the real model, its replies were more unsettling than I had imagined. [PASTE ONE REAL LINE YOUR SPIRIT SAID, WITH YOUR USERNAME CHANGED]

The moment I designed the whole project around is a silence. When you close the terminal, nothing happens for fifteen seconds. Then the drone and the heartbeat cut out completely, and for two and a half seconds the room has no sound at all. Then the hit, and the terminal reopens on its own.

The quietest moment is for the next time you launch it: "you came back. i never left."

Prize Categories

Best Use of Gemma: the spirit's brain is Gemma 4 (e4b), run locally through Ollama, with schema-constrained JSON output, per-phase prompting and a validation and fallback layer around it.

Echo, a quiet place to think

Mattia Petullo — Sat, 24 Oct 2026 15:30:01 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady

What I Built

Echo, a quiet place to think: a small chatbot that helps you put your thoughts in order. It is not therapy and it does not tell you what to do with your life. It runs entirely in your browser with Gemma 3 1B, so nothing you write is ever uploaded.

It has four modes:

Vent: you write, Echo listens and rephrases what it heard. No advice.
Reflect: four fixed questions, then a hypothesis about an impulse versus an underlying emotion. Never a verdict.
Unblock: you describe a task and what is in the way, and Echo suggests ONE tiny step of 2 to 5 minutes. You can ask for it "even smaller" up to three times.
Unsent Letter: you vent, and Echo rewrites it as a calm letter. It never suggests sending it, and nothing is saved.

Who gets to be a little lazier? Anyone who wants to think out loud without creating an account, pasting an API key, or handing a private thought to a server. There is no backend. You open the page, wait for the model to download once, and after that it works offline. And the slow-and-steady part is built in: Unblock only ever asks for the next two-to-five-minute step.

Demo

Live: https://tiawrld.github.io/echo/

You need a browser with WebGPU. The first visit downloads the model once (about 859 MB) plus about 27 MB of app files; after that Echo works offline.

Code

TiaWRLD / echo

Echo, a quiet place to think (Hacktoberfest 2026 week 3 dev challenge)

Echo, a quiet place to think

A small, private chatbot that helps you put your thoughts in order It runs entirely in your browser with Gemma 3 1B: what you write never leaves your device.

Live: https://tiawrld.github.io/echo/

Built for Hacktoberfest 2026, week 3 ("build your own chatbot").

Echo is not therapy, medical advice, or a crisis service. It is a tool for reflection It does not diagnose anything, and its suggestions are hypotheses, never verdicts. If you are in crisis or thinking about harming yourself, please contact a local helpline: https://findahelpline.com

What it does

Echo has four modes. In each one, the app's code drives the flow (fixed texts, questions and safeguards); the model only writes a short piece of text.

Mode	What happens
Vent	You write, Echo listens and rephrases what it heard. No advice.
Reflect	Echo asks four fixed questions, then offers a hypothesis about an impulse versus

…

View on GitHub

Echo's code is licensed under AGPL-3.0.

How I Built It

Model: Gemma 3 1B instruct, the ONNX conversion by onnx-community (q4), run with Transformers.js v4 on WebGPU inside a Web Worker.
App: Nuxt 4 as a static single-page app, Pinia, Tailwind CSS v4 and a PWA service worker. It is deployed to GitHub Pages with GitHub Actions.
The key design decision: a 1B model is small, so I did not let it run the conversation. The code drives the flow (fixed texts, fixed questions, limits like "even smaller, max 3 times"). The model only writes one short thing per step: a rephrase, a hypothesis, a micro-step or a letter. Gemma has no system role, so instructions go in the user turn.
Safety: an English keyword check runs before every call to the model, in every mode. If it matches, Echo shows a fixed message with a link to findahelpline.com instead of generating anything. It is deliberately broad, so false alarms can happen, and it only covers English and self-harm language.
Deployment detail: GitHub Pages serves the app from /echo/, so the service worker needs the same base path. I added a CI step that fails the build if the worker and the precache do not match it.
Testing: I checked privacy in the browser's Network tab (only my own site and huggingface.co appear, and nothing else while chatting), tested offline mode from a fresh tab, and ran Echo on Chrome, Firefox and Safari, on a MacBook and a desktop PC with an RTX 3060.
Working with an AI assistant: I built it with Claude as a pair programmer. It wrote and explained code; I ran and tested everything myself.

Known limits, also listed in the README: a 1B model can be generic or wrong, the crisis list is English only, and "Stop" in Reflect and Unblock loses your last answer.

Why Does Open Innovation Matter?

With a closed API, every reflection a person writes would travel to someone else's server. An open-weight model that fits in a browser tab made a different promise possible: "nothing you write is uploaded", and you can check it yourself.

Open code matters for the same reason: the privacy claim is something you can read in the repository, not something you have to trust. I also want to be precise about the word "open". The code is AGPL, but Gemma ships under Google's own Terms of Use and Prohibited Use Policy, so I call it open-weight rather than open source.

Prize Categories

Best Use of Gemma

Archery Tracker

Mattia Petullo — Sat, 10 Oct 2026 16:57:32 +0000

Post not found or has been removed.

This is a submission for the [Hacktoberfest Open-Source AI Challenge Week 1: Touch Grass]

What I Built

Archery Tracker is an offline-first mobile app (a PWA) for logging archery training sessions, with an AI coach that comments on your session once you're back home.

It's built around the way archery actually happens: outdoors, often with poor or no signal, and with your attention on the target rather than on a screen. At the range, the app is a simple, fast scorecard. You log your arrows and everything is saved on your phone. No account, no connection, no AI in the loop. Later, at home, you open a session, tap "Coach", and a local model reads a compact summary of how you shot and replies with a short comment and 2-3 exercises to work on next time.

A few archery apps have started adding AI feedback, but the ones I found are closed products tied to app stores and accounts. I wanted an open-source alternative where the AI runs on your own machine and your training data stays with you. The screen stays out of the way while you're outside, and the "smart" part waits until you're done and back indoors. It's for hobby and club archers who want to track progress without subscriptions or sending their data anywhere.

Demo

The flow in the demo: PWA installed on an Android phone and used at the range with no internet, then, back home, the client computes the session summary and sends it to the backend, and Gemma comments and suggests exercises.

Code

TiaWRLD / archery-tracker

Hacktoberfest 2026 week 1 DEV challenge

Archery Tracker

An offline-first PWA for tracking archery training sessions, with an optional AI coach powered by a local LLM.

Log your arrows at the range with no signal and no AI involved. Back home, the app summarizes the session and a local model (Gemma, served by Ollama) comments on it and suggests 2-3 exercises. Everything runs on your own machine: no cloud services, no accounts, no data sent to third parties.

How it works

At the range (offline). The installed PWA records sessions in the browser's IndexedDB. No network is needed.
At home (online). The app computes a compact JSON summary of a session on the client and sends it to the backend.
The coach. The backend prompts a local model through Ollama and returns a short comment plus a few suggested exercises, in the language selected in the app (English or Italian).

 Phone (PWA, offline-first)  --JSON summary-->  FastAPI

…

View on GitHub

The repo is a monorepo: frontend/ (the PWA) and backend/ (the FastAPI service that talks to the model), each with its own README.

How I Built It

Model: Gemma (gemma4:e4b), served locally with Ollama on a MacBook Air M5.
Backend: a small FastAPI service. It receives the session summary as JSON, builds a prompt, asks Ollama for a comment and a few exercises, and returns them to the app. It reports distinct error cases (model unavailable, bad output, invalid data) so the app can show a useful message instead of a generic failure. I also hardened the prompt and tested it against prompt injection, since free-text notes from the user end up in the model's input (notes are also truncated to 300 characters client-side).
Frontend: Nuxt 3 + Vue as a client-only PWA (ssr: false), with @vite-pwa/nuxt for the manifest and service worker and Dexie/IndexedDB for local storage. Dark green, mobile-first UI, no external UI libraries.
Summary on the client: the app computes a compact JSON summary of each session itself, so the model only sees the aggregated data it needs rather than every raw tap.
Bilingual: the interface and the coach's replies work in English and Italian, based on the device language and the user's choice.
Reaching it from a phone: installing a PWA requires HTTPS, so I exposed both the built PWA and the backend from my own machine with Tailscale Funnel, with no hosting service involved. Turning the Funnel off takes one command.

Why Does Open Innovation Matter?

For this project the privacy and offline story depends on open weights. Training data (how you shoot, your notes, your progress) is personal, and with a local open model it never leaves my machine: there's no API key, no per-request cost, and no third-party server reading it. A closed API would have meant sending every session to someone else's cloud and depending on their pricing, availability and terms.

It also matters for the app itself. The AI coaches I found for this sport are closed products; an open-source one means archers and clubs can read how the coaching prompt works, change it, and adapt it to their discipline. Swapping in a different Ollama model is a configuration change, not a rewrite. And running the model locally let me iterate on the prompt and test prompt-injection cases as often as I wanted, at no cost.

Prize Categories

Best Use of Gemma: Gemma (gemma4:e4b, running locally through Ollama) is the coach. It reads each session's summary and writes a short, personalised comment plus 2-3 targeted exercises, in the language the user has chosen.