This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine
What I Built
Your shell history is the ghost in your machine.
Every rm -rf you ran in frustration, every git reset --hard at 2 AM, every ssh into a server you hoped nobody noticed is still sitting in a plain text file in your home folder. Nobody reads it. I wanted to see what it says about you.
Hallows is a terminal tool in two acts. It runs on your laptop with open models, and none of your history leaves your machine.
Act I, Halloween: it judges you
It reads your history, hides your secrets, and decides which Deathly Hallow you are chasing. The three Hallows are three ways to cheat death, so each one maps to a way of using a terminal:
The Elder Wand (power):
sudo,kill -9,rm -rf,kubectl. You make the system obey.The Resurrection Stone (the past):
git reflog,git reset,git log --follow. You keep trying to bring something back.The Invisibility Cloak (stealth):
ssh,tmux,vpn,tor. You prefer to move unseen.The Master of Death: all three in balance. It should be rare.
Act II, Día de los Muertos: it remembers
hallows ofrenda builds an altar for the tools you stopped using: commands you ran at least 10 times that have not appeared in your history for more than 60 days.
Each one comes back for a night, with its last words (the last command you typed).
The moment it landed
Hallows is for fun, not psychology. It counts what you typed and has an opinion about it.
When I ran hallows scan on my own 2000 shell commands, it named me The Elder Wand (63.0% Wand, 29.6% Cloak, 7.4% Stone), and Gemma mocked my pip install habit:
"I have seen fools who attempt to wield such mundane instruments as 'pip install', yet they believe themselves worthy of the title 'Master'."
It is a joke in a spooky voice, not a horoscope, and my history has no timestamps, so it knows nothing about when I typed things. Being roasted by my own terminal still gave me chills.
TL;DR
Local: Gemma 2 2B through Ollama, Kokoro-82M / Piper for the voice. Zero bytes of your command history touch the cloud.
The first scorer was wrong: it just added up points. On a synthetic everyday-developer history (
git status,git log,git diff,grep,cat,pip install,python main.py,ls -la, repeated), the old scorer said STONE, 85.7% Stone, confidence: undeniable. With a baseline subtracted, the new scorer says STONE (72.3% Stone, 16.2% Wand, 11.6% Cloak), confidence: medium.Stability: bootstrap (300 resamples) on my four synthetic personas gave Wand 100%, Stone 100%, Cloak 100%, Master 55%. The balanced persona is the least stable, as it should be.
Gemma copies hints: on my own history the rule-based scores and Gemma were almost identical (JS divergence 0.02), and I now know why. Given a hint, Gemma 2 2B copied it exactly in 20 of 20 runs, including a deliberately wrong hint. Blind, it scored the same commands Wand in 10 of 10 runs (mean 87.5).
Demo
Demo video: [Hallows demo] https://drive.google.com/file/d/1Hw-viMbFZjVbZ28z6dijpi5KbZ-T5pqk/view?usp=sharing
![Hallows verdict screen]
Real output from my machine
~ ❯ python3 -m hallows.cli scan --speak
Reading your shell history...
Loaded 2000 commands (0 with timestamps, window: last 90 days)
Consulting Gemma (gemma2:2b) locally...
Gemma is reasoning about your soul...
Heuristic vs Gemma alignment (JS Divergence: 0.02)
The shade of Lord Voldemort peers into your history...
|
|
|
|
|
|
|
*
╭────────────────────────────── ☽ Your Verdict ☽ ──────────────────────────────╮
│ │
│ The Elder Wand │
│ You do not seek power. You demand it. │
│ │
│ This soul's fascination with power and control is evident. The │
│ incessant upgrade of the very tool they use to manipulate others │
│ reveals a hunger for domination that borders on childish obsession. │
│ │
│ Confidence: HIGH │
│ Stability: Verdict held in 74% of bootstrap resamples │
│ │
╰──────────────────────────── signal strength: 276 ────────────────────────────╯
| Elder Wand █████████████████░░░░░░░░░░░ 63.0%
○ Resurrection Stone ██░░░░░░░░░░░░░░░░░░░░░░░░░░ 7.4%
△ Invisibility Cloak ████████░░░░░░░░░░░░░░░░░░░░ 29.6%
Soul Timeline (Sticky HMM):
Commands 0–87 : The Elder Wand
Commands 88–172: The Resurrection Stone
Commands 173–361: The Elder Wand
Commands 362–434: The Resurrection Stone
Commands 435–466: The Elder Wand
Commands 467–485: The Invisibility Cloak
Commands 486–701: The Elder Wand
Commands 702–738: The Invisibility Cloak
Commands 739–1184: The Elder Wand
Commands 1185–1681: The Resurrection Stone
Commands 1682–1999: The Elder Wand
╭──────────────────────────────── he speaks... ────────────────────────────────╮
│ │
│ I have seen fools who attempt to wield such mundane instruments as │
│ 'pip install', yet they believe themselves worthy of the title 'Master'. │
│ Such arrogance is the mark of ignorance and weakness, not power. │
│ │
╰──────────────────────────────────────────────────────────────────────────────╯
Summoning the voice...
The Día de los Muertos altar
On my own history, hallows ofrenda printed "No timestamps found in your shell history", because zsh does not record timestamps unless you run setopt EXTENDED_HISTORY.
So this altar comes from simulations/ofrenda_demo.txt, a synthetic extended zsh history I generated with abandoned tools (vagrant, grunt, svn):
~ ❯ python3 -m hallows.cli ofrenda -f simulations/ofrenda_demo.txt --speak
🕯️ ── OFRENDA: ALTAR OF ABANDONED COMMANDS ── 🕯️
Remembering the tools and workflows you left behind...
╭───────────────┬──────┬────────────┬────────────┬───────────┬─────────────────╮
│ │ │ │ │ │ Last Words │
│ Ghost Command │ Uses │ First Seen │ Last Seen │ Days Gone │ (Sanitized) │
├───────────────┼──────┼────────────┼────────────┼───────────┼─────────────────┤
│ vagrant │ 12 │ 2024-05-06 │ 2024-05-06 │ 908d ago │ vagrant destroy │
│ │ │ │ │ │ -f │
│ grunt │ 11 │ 2024-05-18 │ 2024-05-18 │ 896d ago │ grunt deploy │
│ svn │ 11 │ 2024-05-29 │ 2024-05-29 │ 885d ago │ svn cleanup │
╰───────────────┴──────┴────────────┴────────────┴───────────┴─────────────────╯
Rest in peace, vagrant. You served your master well before the darkness claimed you.
Try it yourself
ollama pull gemma2:2b
git clone https://github.com/pushhpizzaaa/hallows && cd hallows
pip install -e .
hallows scan # judge your own history
hallows ofrenda # needs timestamps: setopt EXTENDED_HISTORY in zsh
hallows install-hook --frequency 5 # let it whisper after every 5 commands
python3 test_personas.py # check the built-in test personas
Code
🪄 Hallows
Your shell history reveals which Deathly Hallow your soul is chasing.
A Halloween terminal tool powered by Gemma 2B running locally via Ollama. It reads your shell history, strips all secrets, and lets a local AI deliver a Voldemort-voiced verdict on your developer psychology — no internet required, nothing leaves your machine.
Built for Hacktoberfest 2026, Week 4: Ghost in the Machine.
The Three Hallows
Hallow
Sigil
What it reveals
Command signals
The Elder Wand
|
Power. Domination. Control.
sudo, kill -9, rm -rf, chmod, docker run --privileged
The Resurrection Stone
○
Obsession with the past.
git reset, git reflog, git log, history, tail -f
The Invisibility Cloak
△
Stealth. Disappearance.
ssh, tmux, history -c, nmap, vpn, unset HISTFILE
The Master of Death
△○|
Terrifying balance of all three.
All of the above
How I Built It
Shell history (zsh / fish / bash / PowerShell)
↓
Sanitizer: hides tokens, IPs, hostnames, home paths
↓
Feature extractor: 50+ word-bounded rules, command → Wand / Stone / Cloak points
↓
stats.py: decay, baseline, probabilities, entropy, HMM timeline, bootstrap
↓
Gemma 2 2B via Ollama: reads recent commands, gives its own scores and a monologue
↓
Verdict screen, soul timeline, ofrenda
↓
Kokoro-82M + sox: spoken verdict, locally
The argument I lost with my own scorer
My first scorer added up points per command and showed percentages. It passed my four test personas (power user, git archaeologist, ghost operator, balanced developer).
Then I fed it an everyday developer history and it came out as the Resurrection Stone, because git log, git diff, and cat all score as "the past". Almost everyone would have been the Stone.
My personas are archetypes I wrote myself, so they prove the scorer handles obvious cases. They do not prove it is accurate on real people.
What improved it is in stats.py, and it is all plain math. It is better but not solved: the everyday history still leans Stone (72.3%), just with medium confidence instead of undeniable.
Time decay: a command's weight halves every 7 days:
w = 0.5^(age_days / 7). My own history had no timestamps, so decay did not apply in that run.Baseline: I subtract the points a typical developer earns per command, so ordinary git use counts as zero evidence and only unusual behaviour counts. I estimated it from 5 synthetic histories I wrote: the four personas and an everyday developer. Because the everyday history is one of the five, the everyday test above is partly circular.
Probabilities: the adjusted totals are divided by
sqrt(n)before a softmax, so a long history is not automatically more certain than a short one.Entropy: the Master of Death appears when the three probabilities are nearly equal (normalised Shannon entropy at or above 0.92).
Soul timeline: a sticky 3-state HMM decoded with Viterbi shows which Hallow you were chasing over time. It stays in a state with probability 0.95, and short flickers (under 5 commands) are merged.
Bootstrap: I resample the commands 300 times to see if the verdict survives. A verdict that flips between resamples is shown as shaky.
What Gemma does
Gemma 2 2B reads the most recent commands that carry signal (after sanitizing) and returns its own three scores, a one-line reason, and a short monologue in character.
To see what it adds, I ran it 10 times per mode on the same six Wand-heavy commands: blind, with a correct hint (70% Wand), and with a deliberately wrong hint (80% Cloak).
| Mode | Runs parsed | Mean Wand / Stone / Cloak | Verdicts |
|---|---|---|---|
| Blind | 10 / 10 | Wand 87.5 (85–95), Stone 20.0 (10–60), Cloak 16.0 (0–30) | WAND × 10 |
| Right hint (70 / 15 / 15) | 10 / 10 | 70.0 / 15.0 / 15.0, identical every run | WAND × 10 |
| Wrong hint (10 / 10 / 80) | 10 / 10 | 10.0 / 10.0 / 80.0, identical every run | CLOAK × 10 |
With a hint, Gemma returned the hint's numbers exactly in all 20 runs, even when the hint was wrong: it called commands like sudo kill -9 and sudo iptables -F 80% Cloak because I told it to. Blind, it reached Wand on its own every time, with different numbers on each run.
This is a small, easy test (six obvious Wand commands, 10 runs per mode). It shows the anchoring clearly, and says little about hard cases.
That is why the JS divergence on my own history was 0.02. The scan gives Gemma the rule scores as a hint, and Gemma copied them, so that number is copying, not agreement. In that mode its real contribution is the reasoning line and the monologue.
A 2B model is a good narrator, and it can read command sequences, but I do not claim it classifies better than the rules. Blind mode is the only place its scores are independent.
Open-source stack
| Layer | Component | License | Role |
|---|---|---|---|
| Local LLM | Gemma 2 2B (gemma2:2b) |
Gemma Terms (open-weight) | Scores, reasoning, monologue |
| Model server | Ollama | MIT | Local inference on loopback, num_ctx=2048, keep_alive=10m
|
| Voice | Kokoro-82M (bm_george) |
Apache 2.0 | Spoken verdict |
| Fallback voice | Piper | MIT | Offline TTS |
| Audio effects | sox | LGPL | Pitch, reverb, echo |
| CLI | Rich and Typer | MIT | Terminal UI |
The sanitizer and the scorer are my own code. Gemma is open-weight rather than open source, which is why the table says so.
Why Does Open Innovation Matter?
Your shell history is the most private file on your machine. It holds tokens, private IPs, internal hostnames and project names. My sanitizer hides what it can, but regex cannot promise to catch everything. Running the model locally is the safety net: whatever the sanitizer misses stays on your computer. Zero bytes of your history go to the internet.
It costs nothing. No API key, no per-request bill, no account.
You can swap the pieces. --model picks any Gemma build Ollama has. The voice has a fallback. If a closed API changed its pricing or its rules, a tool built on it would stop working. An open-weight model on your own disk keeps working.
Bugs I Caught Before They Shipped
The
torrule gave Cloak points toeditor,monitorandtutorial. It now matches whole words only (\btor\b).My baseline did nothing at first. I was subtracting a per-command average from a total over hundreds of commands, so a synthetic everyday history still came out as Stone with near-total certainty. The baseline is now scaled to the history length with
sqrt(n)damping.The sanitizer redacted
mkdir -p projects/newas a password, manglednpm i lodash@4.17.21, and leaked the last octet of10.0.0.5. It also missedssh deploy@prod-dband left project folder names like~/client-secret/untouched.The history parser merged consecutive
git stashcommands into one, so repeated behaviour was invisible.If Gemma emitted bare JSON, the speech synthesis would try to read the raw brackets out loud. Redaction tokens like
<REDACTED_SECRET>and JSON are now scrubbed before speech, so the narrator speaks plain prose.
What It Can't Do (Yet)
No dates in most shell histories: bash and default zsh do not store timestamps, so time decay and the ofrenda need zsh with
EXTENDED_HISTORY, fish, or bash withHISTTIMEFORMAT. My own history had none, which is why the altar demo uses a synthetic file.Short histories: many shells keep only the last few thousand lines, so the ofrenda may find nothing on fresh machine setups.
The baseline is small and synthetic: it was estimated from 5 histories I wrote, so it is an initial reference, not a measurement of real developers.
My tests are synthetic: the personas prove the scorer handles obvious cases, not that it is accurate on real people.
The most on-brand Cloak commands are rarely recorded: commands like
history -cusually never reach the history file.It counts commands, not intent: a sysadmin running
sudoall day is not seeking domination.Voice: it is a synthetic British male voice, not any actor's voice.
How I Built It With AI
I used Claude to review my code, plan the statistics layer and help edit this post, and Antigravity to apply and verify the fixes. I made the design calls and ran every test in my own terminal.
Prize Categories
Overall winner.
Best Use of Gemma: Gemma 2 2B runs locally through Ollama and writes the verdict reasoning and the in-character monologue. I measured how much it adds to the rule-based scoring and report the result, including where it just echoes the hint.
Disclaimer: Hallows is an open-source, non-commercial fan project inspired by Deathly Hallows lore. It is not affiliated with, endorsed by, or connected to J.K. Rowling, Warner Bros., or the Harry Potter franchise. No copyrighted text, official artwork, or actor voices were used.
Top comments (0)