SBX OS - CyberMind-FR/secubox-deb GitHub Wiki

SBX OS — the Hall as an installable app 🧭

EN | FR | 🟣 MIND | package secubox-sbxos

SBX OS is the playable face of the Hall: a web application served at /sbxos/ on the Hall origin, installable as a PWA on a phone, tablet or desktop. Instead of a wall of modules it offers five Spaces, each with a guide, and opens places rather than applications. The classic Hall stays untouched next to it.

What you see

Space	Guide	Contents (from the Space manifest)
Hall	Lexie	access, ZIA, mood, forums, BBS, mail and messaging, activity, accounts, almanac
Atelier (workshop)	Néo	dev watch, depot, content, cloud and Nextcloud, torrent, voice studio, metablogizer, surf viewer
Sécurité	Actor	security, actors, radar, guardian, DPI, IPv6 guardian, vault
Média	Lyrión	radio, PeerTube, Lyrion, podcaster, PhotoPrism, YouTube SaaS, Billets, MetaNews, social relay, Freebox TV, voice
Maison (home)	Zia	Zigbee devices

Rail on the side to switch Space (arrow keys work), a palette with Ctrl+K to jump anywhere, a settings panel and an activity feed.
Widgets in the Spaces: each Space ends with a Widgets section showing the Hall cardlets of its modules, framed (one column on a phone). The same cardlets as in the Hall, see Cartes-du-Hall.
Voice: a microphone button in the palette; common commands run on the browser side without ZIA, recognition happens on the box. See ZIA-Hall.
Old ?ecran= links still work: cinema, radio and billets map to Média, cloud to Atelier.

Who decides what

Two sources, kept apart on purpose:

Source	Decides	Where
The box (manifest)	what is available to you	`GET /api/v1/webos/sbxos/manifeste`
The browser (Hall)	what is shown: order, favourites, hidden modules, theme	local to the device, nothing leaves it

The manifest by role

The box computes the manifest for the caller:

Caller	Gets
administrator (real admin session)	every module of every Space
signed-in person (`user`)	the modules a person may open
guest, or any client outside the LAN	only public modules (radio, billets, PeerTube, MetaNews), with no inventory of the box

LAN-only modules are hidden outside the LAN; the LAN verdict comes from nginx, never from the client. A device is never an administrator. The manifest also carries the domain, the legacy screen map and capabilities (voix, diffuser: people only). The declarative source is espaces.toml in secubox-webos.

The guides

Lexie is the face and the voice, ZIA the only brain (see ZIA-Hall); Néo, Actor, Lyrión and Zia guide the other Spaces. The Security Space is backed by Actor Intelligence (ThreatMesh, WAF).

Install on a device

Open https://hall.<your-domain>/sbxos/ and use the browser's « Install » action. The PWA id is /sbxos/; the shell is cached so the app opens with no network, the manifest is fetched network-first, nothing else (no API call, no other origin) is cached.

Android app: PLAN

Status: planned, not delivered. Today SBX OS is the PWA above.

The plan is a native Android wrapper around the same app, built with Capacitor, sharing the manifest and the Spaces, and displaying the same widgets. It would sit next to the non-root Toolbox companion app (Android-ToolBox), which does not require root; an in-app VPN and certificate handling are deferred. Nothing in this section is a shipped feature.