Documentation
Build for VibeOS
VibeOS is an operating system that runs in the browser. Your app is one HTML document that gets a real window, a real filesystem, hosted AI and a place in the App Center on every VibeOS desktop.
Start here
Quickstart
Build, run and submit a working app in about ten minutes. Start here if you are new.
SDK reference
The complete window.vos surface: filesystem, AI, network and app metadata.
.vibe manifest
Every field of the app format, with a complete valid example to copy.
Submit & publish
The review pipeline, what reviewers check, and how updates reach users.
Hello, VibeOS
This is a complete, valid VibeOS app. There is nothing to install and nothing to import — the operating system injects window.vos into your document at runtime.
<!doctype html>
<html>
<body style="font-family:system-ui;padding:24px">
<h1 id="title">Loading…</h1>
<script>
function start() {
window.vos.app.getInfo().then(function (info) {
document.getElementById("title").textContent = "Hello from " + info.name;
});
}
// The SDK may already be there, or may arrive in a moment. Handle both.
if (window.vos) start();
else window.addEventListener("vos-ready", start, { once: true });
</script>
</body>
</html>Run it right now
Paste it into the VibeOS IDE to see it running against the live SDK, with a JavaScript console and a file explorer beside it.
How apps work
Your app runs inside a sandboxed window with no direct access to the desktop, other apps, or the network. Everything the operating system owns is reached through the SDK, and everything the SDK can do is scoped by permissions the user approved when they installed you.
- One document. All markup, CSS and JavaScript inline — no external scripts, stylesheets or fonts.
- One global.
window.vosfor files, AI, network and app info. Every method returns a Promise. - User-approved capabilities. Ask for the minimum; nothing is granted implicitly and permissions are re-checked on every call.
- Nothing to operate. No hosting, no keys, no billing — AI runs on the signed-in user's plan.
The runtime architecture page explains the bridge, the lifecycle and the trust boundary behind all of this.
Choose an app type
| .vibe app | Website app | |
|---|---|---|
| What it is | One JSON manifest with your inline HTML document | A wrapper around a URL you host |
| Hosting | None — VibeOS serves it | You host and maintain the site |
| SDK access | Full window.vos surface | None — it runs as an embedded site |
| Best for | Native-feeling tools, games, utilities, anything using files or AI | Bringing an existing web app to the desktop |
Build a .vibe app
Self-contained, no hosting, full access to the SDK. The default choice.
Build a website app
Already have a web app? Wrap the URL and it becomes a first-class window.
The SDK at a glance
| Namespace | Use it for | Requires |
|---|---|---|
| vos.fs | Reading, writing, renaming, deleting and watching files in Home or your private app folder. | read |
| vos.ai | Hosted chat completions on the user's plan — no keys, no billing. | ai: true |
| vos.net | CORS-free HTTPS requests to origins you declared. | network |
| vos.app | Your app's name, id, private folder path and granted permissions. | Nothing |
Documentation map
Runtime architecture
The sandboxed window, the message bridge, the lifecycle and the trust boundary.
Permissions
read, write, ai and network — scopes, the private sandbox, and install prompts.
Secure sandbox
What isolation guarantees VibeOS gives users, and what that means for your app.
Errors & limits
Every failure mode, the message catalogue, timeouts and size caps.
Example: To-Do app
A complete app with filesystem persistence and a downloadable template.
Example: AI chatbot
A working AI app built on vos.ai, including error and empty states.
Installing apps
How users discover, install, update and remove apps inside VibeOS.
Troubleshooting & FAQ
Blank windows, denied paths, blocked requests, rejected manifests — and fixes.
Everything is testable before you submit
The IDE runs your app against the real SDK with a console and a file explorer, so you can verify persistence, permissions and error handling without publishing anything.