shell: keyword redirection + post-filter flags (ADR 0002)

Implement the shell experience redesign: one canonical grammar for every
command — 'cmd args [USE src] [TIL marker] [filters...] [output kw dst]'.

- Keyword redirection (uppercase-only, aliases valid, fully reserved):
  WRITING/WRITE overwrite, TO append, USE/USING input source,
  TIL/UNTIL heredoc/terminator (exact full-line marker).  > >> < << are
  removed; '>' is plain text.
- Post-filter stages applied left to right over a line stream, each
  repeatable: -h N (head kills the upstream), -t N (tail holds a
  rolling window, flushes at EOF/^C), -g PAT (smart-case literal
  substring), -p (screenful pager, terminal only).  A file sink
  replaces the screen; -p is a no-op with one.
- C-style quoting: "..." groups and literalizes, \x escapes one char;
  quoted/escaped text is never an operator, never split.
- Input consumers: cat/hexdump, path-less only (stdin until ^D,
  USE f, TIL m heredoc, USE f TIL m truncation).  Other commands
  reject input keywords; paths + input keyword is a syntax error.
- ^D is EOF everywhere and never powers off; poweroff/exit are the
  only shutdown verbs.
- help rewritten; test-disk.sh and sendkeys.py use the keyword syntax.

Verified in QEMU: 26 grammar checks on fresh and reused disks, disk
round trip, pager pacing, -h stopping /dev/mem at N lines, ^C flushing
a -t window.  Two bugs found during verification and fixed:
1. WRITING over an existing file wrote after stale NUL padding —
   fs::size() is stale after set_len(0); the sink writes at offset 0
   after truncation.
2. USE f TIL m leaked the post-marker remainder — the final
   partial-line emit ran after the marker break; guarded with a
   stopped flag.

1 files changed, 1133 insertions, 325 deletions

diff --git a/shell/src/lib.rs b/shell/src/lib.rs
index 9644f01..bc43faf 100644
--- a/shell/src/lib.rs
+++ b/shell/src/lib.rs
@@ -1,10 +1,32 @@
 #![no_std]
 
-extern crate alloc;
+//! Command shell — reads from PS/2 keyboard, writes to GOP + serial.
+//!
+//! One canonical grammar for every command (ADR 0002):
+//!
+//! ```text
+//! cmd args [USE src] [TIL marker] [filters…] [output kw dst]
+//! ```
+//!
+//! - **Keywords** (uppercase-only, reserved operators): `WRITING`/`WRITE`
+//!   overwrite a file, `TO` appends, `USE`/`USING` names an input source,
+//!   `TIL`/`UNTIL` ends input at an exact full-line marker.
+//! - **Filters** are trailing flags applied left to right as stages over a
+//!   line stream: `-h N` (first N lines, then kill the upstream),
+//!   `-t N` (hold back a rolling window of the last N lines, emit only at
+//!   end of stream), `-g PAT` (smart-case literal substring), `-p` (pause
+//!   at each screenful).  Each may repeat.
+//! - **Quoting** (`"..."` groups + literalizes, `\x` escapes one char)
+//!   makes quoted/escaped text literal — never an operator, never split.
+//! - `>` and friends are gone; `>` is ordinary text.
+//! - ^D is EOF everywhere and never powers off; `poweroff`/`exit` are the
+//!   only shutdown verbs.
 
-use alloc::string::ToString;
+extern crate alloc;
 
-/// Minimal command shell — reads from PS/2 keyboard, writes to GOP + serial.
+use alloc::collections::VecDeque;
+use alloc::string::{String, ToString};
+use alloc::vec::Vec;
 use rsnix::tty::{self, LineInput};
 use rsnix::{gop_print, gop_println, serial_print, serial_println};
 
@@ -30,137 +52,683 @@ pub fn run() -> ! {
         // Read one line from keyboard (tty canonical mode)
         match tty::read_line() {
             LineInput::Interrupted => continue, // ^C — fresh prompt
-            LineInput::Eof => {
-                // ^D on an empty line: EOF, exit the shell.
-                cmd_poweroff();
-            }
+            LineInput::Eof => continue, // ^D on an empty line — fresh prompt (no poweroff)
             LineInput::Line(line) => {
-                // Parse and execute
                 let trimmed = line.trim();
                 if trimmed.is_empty() {
                     continue;
                 }
+                execute(trimmed);
+            }
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Diagnostics go straight to terminal + serial, never through the filter
+// pipeline and never into a file sink.
+// ---------------------------------------------------------------------------
+
+fn term_err(msg: &str) {
+    gop_println!("{}", msg);
+    serial_println!("{}", msg);
+}
 
-                let (cmd, args) = split_first_word(trimmed);
+// ---------------------------------------------------------------------------
+// Parsing
+// ---------------------------------------------------------------------------
+
+/// One lexical token: its text plus whether any quoting/escaping was used
+/// (a token containing quoted/escaped text is never an operator or flag).
+struct Token {
+    text: String,
+    literal: bool,
+}
 
-                match cmd {
-                    "help" => cmd_help(),
-                    "echo" => cmd_echo(args),
-                    "clear" => cmd_clear(),
-                    "halt" => cmd_halt(),
-                    "poweroff" | "exit" => cmd_poweroff(),
-                    "hello" => {
-                        gop_println!("World!");
-                        serial_println!("World!");
+/// Split a command line into words, handling `"..."` groups and `\x`
+/// escapes.  Quotes are delimiters, not content; escapes prevent splitting
+/// and literalize one character (`\"` → `"`, `\ ` → space).
+fn tokenize(s: &str) -> Result<Vec<Token>, &'static str> {
+    let mut toks: Vec<Token> = Vec::new();
+    let mut cur = String::new();
+    let mut cur_literal = false;
+    let mut in_quote = false;
+    let mut chars = s.chars();
+    while let Some(c) = chars.next() {
+        match c {
+            '"' => {
+                cur_literal = true;
+                in_quote = !in_quote;
+            }
+            '\\' => {
+                cur_literal = true;
+                match chars.next() {
+                    Some(e) => cur.push(e),
+                    None => cur.push('\\'), // trailing backslash: literal
+                }
+            }
+            c if c.is_whitespace() && !in_quote => {
+                if !cur.is_empty() {
+                    toks.push(Token {
+                        text: core::mem::take(&mut cur),
+                        literal: cur_literal,
+                    });
+                    cur_literal = false;
+                }
+            }
+            c => cur.push(c),
+        }
+    }
+    if in_quote {
+        return Err("unterminated quote");
+    }
+    if !cur.is_empty() {
+        toks.push(Token {
+            text: cur,
+            literal: cur_literal,
+        });
+    }
+    Ok(toks)
+}
+
+fn is_keyword(s: &str) -> bool {
+    matches!(s, "WRITING" | "WRITE" | "TO" | "USE" | "USING" | "TIL" | "UNTIL")
+}
+
+/// How the command's input is fed.  Only `cat`/`hexdump`, and only when
+/// path-less, may carry an input keyword.
+#[derive(Clone)]
+enum Input {
+    None,
+    /// `USE f` — read from a file.
+    Use(String),
+    /// `TIL m` — read from the keyboard until an exact line equals `m`.
+    Til(String),
+    /// `USE f TIL m` — read `f` until an exact line equals `m`.
+    UseTil(String, String),
+}
+
+impl Input {
+    fn present(&self) -> bool {
+        !matches!(self, Input::None)
+    }
+}
+
+/// A post-filter stage.  Applied left to right over the line stream.
+#[derive(Clone)]
+enum Filter {
+    Head(usize),
+    Tail(usize),
+    Grep(String),
+    Pause,
+}
+
+/// Output destination.
+#[derive(Clone)]
+enum Sink {
+    Write(String),
+    Append(String),
+}
+
+struct Parsed {
+    cmd: String,
+    args: Vec<String>,
+    input: Input,
+    filters: Vec<Filter>,
+    output: Option<Sink>,
+}
+
+/// Parse one command line into the canonical grammar.  Errors are the
+/// syntax-error message to show the user.
+fn parse(s: &str) -> Result<Parsed, String> {
+    let toks = tokenize(s).map_err(|e| e.to_string())?;
+    if toks.is_empty() {
+        return Err("empty command".into());
+    }
+    let cmd = toks[0].text.clone();
+
+    let mut i = 1;
+    let mut args: Vec<String> = Vec::new();
+    
+    let mut filters: Vec<Filter> = Vec::new();
+    let mut output: Option<Sink> = None;
+    let mut trailing = false; // a filter flag or output keyword has been seen
+    let mut src: Option<String> = None;
+    let mut til: Option<String> = None;
+    let mut til_seen = false;
+
+    while i < toks.len() {
+        let t = &toks[i];
+        let text = t.text.as_str();
+
+        if !t.literal {
+            match text {
+                "USE" | "USING" => {
+                    if trailing {
+                        return Err("USE must come before the filters".into());
+                    }
+                    if src.is_some() || til_seen {
+                        return Err("duplicate input keyword".into());
                     }
-                    "info" => cmd_info(),
-                    "mem" => cmd_mem(),
-                    "mmap" => cmd_mmap(),
-                    "stress" => cmd_stress(args),
-                    "date" => cmd_date(),
-                    "pci" => cmd_pci(),
-                    "ls" => cmd_ls(args),
-                    "cat" => cmd_cat(args),
-                    "hexdump" => cmd_hexdump(args),
-                    "mkdir" => cmd_mkdir(args),
-                    "touch" => cmd_touch(args),
-                    "rm" => cmd_rm(args),
-                    "edit" => cmd_edit(args),
-                    _ => {
-                        gop_println!("unknown command: {}", cmd);
-                        serial_println!("unknown command: {}", cmd);
+                    i += 1;
+                    let path = toks.get(i).ok_or("USE needs a source path")?;
+                    if !path.literal && is_keyword(&path.text) {
+                        return Err("USE needs a source path".into());
                     }
+                    src = Some(path.text.clone());
+                    i += 1;
+                    continue;
                 }
+                "TIL" | "UNTIL" => {
+                    if trailing {
+                        return Err("TIL must come before the filters".into());
+                    }
+                    if til_seen {
+                        return Err("duplicate TIL".into());
+                    }
+                    i += 1;
+                    let m = toks.get(i).ok_or("TIL needs a marker")?;
+                    if !m.literal && is_keyword(&m.text) {
+                        return Err("TIL needs a marker".into());
+                    }
+                    til = Some(m.text.clone());
+                    til_seen = true;
+                    i += 1;
+                    continue;
+                }
+                "WRITING" | "WRITE" | "TO" => {
+                    if output.is_some() {
+                        return Err("duplicate output keyword".into());
+                    }
+                    i += 1;
+                    let dst = toks.get(i).ok_or("output keyword needs a destination")?;
+                    if !dst.literal && is_keyword(&dst.text) {
+                        return Err("output keyword needs a destination".into());
+                    }
+                    output = Some(if text == "TO" {
+                        Sink::Append(dst.text.clone())
+                    } else {
+                        Sink::Write(dst.text.clone())
+                    });
+                    trailing = true;
+                    i += 1;
+                    continue;
+                }
+                "-h" | "-t" => {
+                    trailing = true;
+                    i += 1;
+                    let n = toks.get(i).ok_or("flag needs a count")?;
+                    let n: usize = n.text.parse().map_err(|_| "count must be a number ≥ 1")?;
+                    if n < 1 {
+                        return Err("count must be ≥ 1".into());
+                    }
+                    filters.push(if text == "-h" {
+                        Filter::Head(n)
+                    } else {
+                        Filter::Tail(n)
+                    });
+                    i += 1;
+                    continue;
+                }
+                "-g" => {
+                    trailing = true;
+                    i += 1;
+                    let pat = toks.get(i).ok_or("-g needs a pattern")?;
+                    filters.push(Filter::Grep(pat.text.clone()));
+                    i += 1;
+                    continue;
+                }
+                "-p" => {
+                    trailing = true;
+                    filters.push(Filter::Pause);
+                    i += 1;
+                    continue;
+                }
+                _ => {}
             }
         }
+
+        // Ordinary token.  Once the trailing region has started (a filter
+        // flag or the output keyword), stray arguments are syntax errors.
+        if trailing {
+            return Err(alloc::format!("unexpected argument '{}'", text));
+        }
+        args.push(text.to_string());
+        i += 1;
     }
+
+    let input = match (src, til) {
+        (Some(s), Some(t)) => Input::UseTil(s, t),
+        (Some(s), None) => Input::Use(s),
+        (None, Some(t)) => Input::Til(t),
+        (None, None) => Input::None,
+    };
+
+    Ok(Parsed {
+        cmd,
+        args,
+        input,
+        filters,
+        output,
+    })
 }
 
 // ---------------------------------------------------------------------------
-// Line input is handled by the tty line discipline (rsnix::tty).
+// Filter pipeline + output sink
 // ---------------------------------------------------------------------------
 
-/// Split a command line into the first word and the rest.
-fn split_first_word(s: &str) -> (&str, &str) {
-    let s = s.trim_start();
-    if let Some(i) = s.find(char::is_whitespace) {
-        (&s[..i], s[i..].trim_start())
+/// Per-stage mutable state.
+enum StageState {
+    /// Lines still allowed through before the upstream is killed.
+    Head(usize),
+    /// Rolling window of the last N lines.
+    Tail(VecDeque<String>),
+    Grep,
+    Pause { shown: usize, screen: usize },
+}
+
+/// Where the filtered line stream ends up.
+enum OutSink {
+    Term,
+    File {
+        path: String,
+        h: Option<usize>,
+        pos: u64,
+        overwrite: bool,
+    },
+}
+
+/// Smart-case literal substring match: case-insensitive unless the pattern
+/// contains an uppercase letter.
+fn smart_match(pat: &str, line: &str) -> bool {
+    if pat.chars().any(|c| c.is_uppercase()) {
+        line.contains(pat)
     } else {
-        (s, "")
+        let lp = pat.to_ascii_lowercase();
+        let ll = line.to_ascii_lowercase();
+        ll.contains(&lp)
     }
 }
 
-// ---------------------------------------------------------------------------
-// Built-in commands
-// ---------------------------------------------------------------------------
+/// Pager pause: terminal only, waits for a keypress; ^C aborts the stream.
+fn pager_wait() -> bool {
+    gop_print!("\n— more —");
+    match tty::read_byte() {
+        0x03 => {
+            // ^C — abort the stream (stream-abort role).
+            gop_println!();
+            false
+        }
+        _ => {
+            // Any key continues; swallow queued tail bytes (e.g. the
+            // rest of an arrow-key escape sequence).
+            while tty::try_read_byte().is_some() {}
+            true
+        }
+    }
+}
 
-fn cmd_help() {
-    gop_println!("available commands:");
-    gop_println!("  help     — show this message");
-    gop_println!("  echo     — echo arguments");
-    gop_println!("  clear    — clear screen");
-    gop_println!("  hello    — print 'World!'");
-    gop_println!("  info     — show system info");
-    gop_println!("  mem      — show memory info");
-    gop_println!("  mmap     — dump the UEFI memory map");
-    gop_println!("  stress   — stress-test heap/page allocators");
-    gop_println!("  date     — show current date/time (RTC)");
-    gop_println!("  pci      — list PCI devices");
-    gop_println!("  ls       — list a directory");
-    gop_println!("  cat      — print files (e.g. cat /dev/rtc)");
-    gop_println!("  hexdump  — hex-dump a file (e.g. hexdump /dev/mem)");
-    gop_println!("  mkdir    — create a directory");
-    gop_println!("  touch    — create an empty file");
-    gop_println!("  rm       — remove a file or empty dir");
-    gop_println!("  edit     — full-screen editor (^S save, ^X exit, ^W search)");
-    gop_println!("            echo > /dev/null, > file, >> file");
-    gop_println!("  halt     — halt the system (hlt loop)");
-    gop_println!("  poweroff — shut down via ACPI (ResetSystem)");
-    gop_println!("  exit     — alias for poweroff");
-    serial_println!("available commands:");
-    serial_println!(
-        "  help, echo, clear, hello, info, mem, mmap, stress, date, pci, ls, cat, hexdump, mkdir, touch, rm, edit, halt, poweroff, exit"
-    );
+/// The filter chain plus the output sink.  Producers push one line at a
+/// time; `line()` returns false when the upstream must stop (head limit or
+/// pager ^C).  At end of stream call `end()` to flush held-back tails.
+struct Pipeline {
+    stages: Vec<(Filter, StageState)>,
+    sink: OutSink,
 }
 
-fn cmd_echo(args: &str) {
-    // Redirection: `text > path` (overwrite) or `text >> path` (append).
-    if let Some(idx) = args.find('>') {
-        let append = args[idx..].starts_with(">>");
-        let text = &args[..idx];
-        let path = args[idx + 1 + append as usize..].trim();
-        let path = path.split_whitespace().next().unwrap_or("");
-        if !path.is_empty() {
-            let content = alloc::format!("{}\n", text.trim_end());
-            let result = rsnix::fs::ensure_file(path).and_then(|h| {
-                if append {
-                    rsnix::fs::write(h, content.as_bytes(), rsnix::fs::size(h)).map(|_| ())
-                } else {
+impl Pipeline {
+    fn new(filters: &[Filter], output: &Option<Sink>) -> Self {
+        let file_sink = output.is_some();
+        let mut stages: Vec<(Filter, StageState)> = Vec::new();
+        for f in filters {
+            // With a file sink the pager is a no-op.
+            if file_sink && matches!(f, Filter::Pause) {
+                continue;
+            }
+            let st = match f {
+                Filter::Head(n) => StageState::Head(*n),
+                Filter::Tail(n) => StageState::Tail(VecDeque::with_capacity(*n)),
+                Filter::Grep(_) => StageState::Grep,
+                Filter::Pause => StageState::Pause {
+                    shown: 0,
+                    screen: rsnix::vt::size().0.saturating_sub(1).max(1),
+                },
+            };
+            stages.push((f.clone(), st));
+        }
+        let sink = match output {
+            Some(Sink::Write(p)) => OutSink::File {
+                path: p.clone(),
+                h: None,
+                pos: 0,
+                overwrite: true,
+            },
+            Some(Sink::Append(p)) => OutSink::File {
+                path: p.clone(),
+                h: None,
+                pos: 0,
+                overwrite: false,
+            },
+            None => OutSink::Term,
+        };
+        Pipeline { stages, sink }
+    }
+
+    /// Push one line through the stages.  Returns false when the producer
+    /// must stop (head killed the stream, or ^C at the pager).
+    fn line(&mut self, l: &str) -> bool {
+        self.push_through(0, l)
+    }
+
+    /// Run one line through the stages starting at `start`, delivering to
+    /// the sink.  `start` lets `finish()` replay a drained tail window
+    /// through only the stages after it.
+    fn push_through(&mut self, start: usize, l: &str) -> bool {
+        let mut cur = alloc::vec![l.to_string()];
+        for (i, (f, st)) in self.stages.iter_mut().enumerate() {
+            if i < start {
+                continue;
+            }
+            let mut out = Vec::new();
+            match f {
+                Filter::Head(_) => {
+                    let StageState::Head(rem) = st else {
+                        unreachable!("stage state does not match filter")
+                    };
+                    if *rem == 0 {
+                        // Head limit reached: kill the upstream.  The line
+                        // that would have overflowed is dropped.
+                        return false;
+                    }
+                    for l in cur.drain(..) {
+                        *rem -= 1;
+                        out.push(l);
+                    }
+                }
+                Filter::Tail(n) => {
+                    let StageState::Tail(buf) = st else {
+                        unreachable!("stage state does not match filter")
+                    };
+                    for l in cur.drain(..) {
+                        if buf.len() == *n {
+                            buf.pop_front();
+                        }
+                        buf.push_back(l);
+                    }
+                    // Held back — nothing reaches the downstream yet.
+                    return true;
+                }
+                Filter::Grep(pat) => {
+                    let StageState::Grep = st else {
+                        unreachable!("stage state does not match filter")
+                    };
+                    for l in cur.drain(..) {
+                        if smart_match(pat, &l) {
+                            out.push(l);
+                        }
+                    }
+                }
+                Filter::Pause => {
+                    let StageState::Pause { shown, screen } = st else {
+                        unreachable!("stage state does not match filter")
+                    };
+                    for l in cur.drain(..) {
+                        if *shown > 0 && *shown % *screen == 0
+                            && !pager_wait() {
+                                return false;
+                            }
+                        *shown += 1;
+                        out.push(l);
+                    }
+                }
+            }
+            cur = out;
+        }
+        for l in &cur {
+            self.emit(l);
+        }
+        true
+    }
+
+    /// Flush held-back tail windows through the remaining stages.  Called
+    /// at end of stream: EOF, ^C, or after a head kill.
+    fn finish(&mut self) {
+        loop {
+            let mut any = false;
+            for i in 0..self.stages.len() {
+                let drained: Vec<String> = match &mut self.stages[i] {
+                    (Filter::Tail(_), StageState::Tail(buf)) if !buf.is_empty() => {
+                        buf.drain(..).collect()
+                    }
+                    _ => continue,
+                };
+                any = true;
+                for l in drained {
+                    self.push_through(i + 1, &l);
+                }
+            }
+            if !any {
+                break;
+            }
+        }
+    }
+
+    /// End of stream: flush tails, done.  File writes are synchronous.
+    fn end(&mut self) {
+        self.finish();
+    }
+
+    fn emit(&mut self, l: &str) {
+        match &self.sink {
+            OutSink::Term => {
+                gop_println!("{}", l);
+                serial_println!("{}", l);
+            }
+            OutSink::File { .. } => {}
+        }
+        if let OutSink::File { h: None, .. } = &self.sink {
+            self.open_sink();
+        }
+        if let OutSink::File { h: Some(h), pos, .. } = &mut self.sink {
+            let mut bytes = l.as_bytes().to_vec();
+            bytes.push(b'\n');
+            if let Ok(n) = rsnix::fs::write(*h, &bytes, *pos) {
+                *pos += n as u64;
+            }
+        }
+    }
+
+    /// Lazily open the file sink on first output (a command that emits
+    /// nothing touches no file).  WRITING truncates and writes from offset
+    /// 0 (the node's cached size is stale after truncation); TO appends at
+    /// the file's current size.
+    fn open_sink(&mut self) {
+        let (path, overwrite) = match &self.sink {
+            OutSink::File { path, overwrite, .. } => (path.clone(), *overwrite),
+            _ => return,
+        };
+        match rsnix::fs::ensure_file(&path) {
+            Ok(h) => {
+                let pos = if overwrite {
                     let _ = rsnix::fs::set_len(h, 0);
-                    rsnix::fs::write(h, content.as_bytes(), 0).map(|_| ())
+                    0
+                } else {
+                    rsnix::fs::size(h)
+                };
+                self.sink = OutSink::File {
+                    path,
+                    h: Some(h),
+                    pos,
+                    overwrite,
+                };
+            }
+            Err(()) => {
+                term_err(&alloc::format!("cannot write '{}'", path));
+                self.sink = OutSink::Term;
+            }
+        }
+    }
+}
+
+/// Emit every line of a pre-built multi-line string (interior blank lines
+/// preserved; a trailing newline does not produce an extra empty line).
+fn emit_string(pipe: &mut Pipeline, s: &str) {
+    let mut rest = s;
+    loop {
+        match rest.find('\n') {
+            Some(idx) => {
+                if !pipe.line(&rest[..idx]) {
+                    return;
                 }
-            });
-            match result {
-                Ok(()) => {}
-                Err(()) => {
-                    gop_println!("echo: cannot write '{}'", path);
-                    serial_println!("echo: cannot write '{}'", path);
+                rest = &rest[idx + 1..];
+            }
+            None => {
+                if !rest.is_empty() {
+                    let _ = pipe.line(rest);
                 }
+                return;
             }
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Execution
+// ---------------------------------------------------------------------------
+
+/// Commands that may consume an input stream (`USE`/`TIL`).
+fn accepts_input(cmd: &str) -> bool {
+    matches!(cmd, "cat" | "hexdump")
+}
+
+fn execute(s: &str) {
+    let parsed = match parse(s) {
+        Ok(p) => p,
+        Err(e) => {
+            term_err(&e);
+            return;
+        }
+    };
+    let cmd = parsed.cmd.as_str();
+
+    if parsed.input.present() {
+        if !accepts_input(cmd) {
+            term_err(&alloc::format!("{}: does not accept input", cmd));
+            return;
+        }
+        if !parsed.args.is_empty() {
+            term_err(&alloc::format!(
+                "{}: input keyword with path arguments is ambiguous",
+                cmd
+            ));
             return;
         }
     }
-    gop_println!("{}", args);
-    serial_println!("{}", args);
+
+    match cmd {
+        "help" => cmd_help(&parsed),
+        "echo" => cmd_echo(&parsed),
+        "clear" => cmd_clear(),
+        "halt" => cmd_halt(),
+        "poweroff" | "exit" => cmd_poweroff(),
+        "hello" => cmd_hello(&parsed),
+        "info" => cmd_info(&parsed),
+        "mem" => cmd_mem(&parsed),
+        "mmap" => cmd_mmap(&parsed),
+        "stress" => cmd_stress(&parsed),
+        "date" => cmd_date(&parsed),
+        "pci" => cmd_pci(&parsed),
+        "ls" => cmd_ls(&parsed),
+        "cat" => cmd_cat(&parsed),
+        "hexdump" => cmd_hexdump(&parsed),
+        "mkdir" => cmd_mkdir(&parsed),
+        "touch" => cmd_touch(&parsed),
+        "rm" => cmd_rm(&parsed),
+        "edit" => cmd_edit(&parsed),
+        _ => term_err(&alloc::format!("unknown command: {}", cmd)),
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Built-in commands
+// ---------------------------------------------------------------------------
+
+fn cmd_help(_p: &Parsed) {
+    let mut pipe = Pipeline::new(&_p.filters, &_p.output);
+    let text = "available commands:
+  help     — show this message
+  echo     — echo arguments
+  clear    — clear screen
+  hello    — print 'World!'
+  info     — show system info
+  mem      — show memory info
+  mmap     — dump the UEFI memory map
+  stress   — stress-test heap/page allocators
+  date     — show current date/time (RTC)
+  pci      — list PCI devices
+  ls       — list a directory
+  cat      — print files (cat USE a TO b copies a→b; cat TIL END is a heredoc)
+  hexdump  — hex-dump a file or input stream
+  mkdir    — create a directory
+  touch    — create an empty file
+  rm       — remove a file or empty dir
+  edit     — full-screen editor (^S save, ^X exit, ^W search)
+  halt     — halt the system (hlt loop)
+  poweroff — shut down via ACPI (ResetSystem)
+  exit     — alias for poweroff
+
+redirection keywords (uppercase, after args):
+  USE/USING <src>     read command input from a file (cat/hexdump only)
+  TIL/UNTIL <marker>  read input until an exact marker line (heredoc)
+  WRITING/WRITE <dst> write output to a file (overwrite)
+  TO <dst>            append output to a file
+  a file sink replaces the screen; > >> < << are gone (> is plain text)
+
+post-filter flags (trailing, applied left to right):
+  -h N    first N lines (kills the command after N)
+  -t N    last N lines (shows nothing until the stream ends; ^C flushes)
+  -g PAT  smart-case literal substring match (repeatable)
+  -p      pause at each screenful (more-style; ^C aborts)
+
+quoting: \"...\" groups text; \\x escapes one char.  Quoted text is never
+an operator: echo \"WRITING\" prints WRITING.
+^D = EOF; ^C cancels a line or aborts a stream.  poweroff/exit shut down.";
+    emit_string(&mut pipe, text);
+    pipe.end();
+}
+
+fn cmd_echo(p: &Parsed) {
+    let mut pipe = Pipeline::new(&p.filters, &p.output);
+    let line = p.args.join(" ");
+    let _ = pipe.line(&line);
+    pipe.end();
+}
+
+fn cmd_hello(p: &Parsed) {
+    let mut pipe = Pipeline::new(&p.filters, &p.output);
+    let _ = pipe.line("World!");
+    pipe.end();
+}
+
+fn cmd_clear() {
+    rsnix::gop::clear_screen();
+}
+
+fn cmd_info(p: &Parsed) {
+    let mut pipe = Pipeline::new(&p.filters, &p.output);
+    let mut s = String::from("rs-dos v");
+    s.push_str(env!("CARGO_PKG_VERSION"));
+    s.push_str(" — rsnix kernel");
+    let _ = pipe.line(&s);
+    let _ = pipe.line("arch: x86_64, freestanding, no userspace");
+    pipe.end();
 }
 
-fn cmd_ls(args: &str) {
-    let path = args.split_whitespace().next().unwrap_or("/");
-    let mut out = alloc::string::String::new();
+fn cmd_ls(p: &Parsed) {
+    let path = p.args.first().map(|s| s.as_str()).unwrap_or("/");
+    let mut pipe = Pipeline::new(&p.filters, &p.output);
     match rsnix::fs::resolve(path) {
-        None => {
-            out.push_str(&alloc::format!("ls: {}: no such file or directory\n", path));
-        }
+        None => term_err(&alloc::format!("ls: {}: no such file or directory", path)),
         Some(h) => {
             let list = if rsnix::fs::kind(h) == rsnix::fs::FileType::Dir {
                 rsnix::fs::children(h)
@@ -172,208 +740,476 @@ fn cmd_ls(args: &str) {
                 )]
             };
             for (name, kind, size) in list {
-                match kind {
-                    rsnix::fs::FileType::Dir => out.push_str(&alloc::format!("{}/\n", name)),
-                    rsnix::fs::FileType::Char => out.push_str(&alloc::format!("{}@\n", name)),
-                    rsnix::fs::FileType::Regular => {
-                        out.push_str(&alloc::format!("{}  {} B\n", name, size))
+                let l = match kind {
+                    rsnix::fs::FileType::Dir => alloc::format!("{}/", name),
+                    rsnix::fs::FileType::Char => alloc::format!("{}@", name),
+                    rsnix::fs::FileType::Regular => alloc::format!("{}  {} B", name, size),
+                };
+                if !pipe.line(&l) {
+                    break;
+                }
+            }
+        }
+    }
+    pipe.end();
+}
+
+// ---------------------------------------------------------------------------
+// cat — file and stream consumers
+// ---------------------------------------------------------------------------
+
+fn cmd_cat(p: &Parsed) {
+    let mut pipe = Pipeline::new(&p.filters, &p.output);
+    match &p.input {
+        Input::None => {
+            if p.args.is_empty() {
+                // Path-less `cat` with no input keyword reads the keyboard
+                // until ^D.
+                cat_stdin(&mut pipe);
+            } else {
+                for path in &p.args {
+                    if !cat_file(&mut pipe, path) {
+                        break;
                     }
                 }
             }
         }
+        Input::Use(path) => {
+            cat_file(&mut pipe, path);
+        }
+        Input::Til(marker) => {
+            cat_stdin_until(&mut pipe, marker);
+        }
+        Input::UseTil(path, marker) => {
+            cat_file_until(&mut pipe, path, marker);
+        }
     }
-    gop_print!("{}", out);
-    serial_print!("{}", out);
+    pipe.end();
 }
 
-fn cmd_cat(args: &str) {
-    let paths: alloc::vec::Vec<&str> = args.split_whitespace().collect();
-    if paths.is_empty() {
-        gop_println!("usage: cat <path> [path...]");
-        serial_println!("usage: cat <path> [path...]");
-        return;
+fn cat_stdin(pipe: &mut Pipeline) -> bool {
+    loop {
+        match tty::read_line() {
+            LineInput::Line(l) => {
+                if !pipe.line(l.as_str()) {
+                    return false;
+                }
+            }
+            LineInput::Interrupted => return false, // ^C aborts the stream
+            LineInput::Eof => return true, // ^D = EOF
+        }
+    }
+}
+
+fn cat_stdin_until(pipe: &mut Pipeline, marker: &str) -> bool {
+    loop {
+        match tty::read_line() {
+            LineInput::Line(l) => {
+                // Marker line is not part of the input.
+                if l.as_str() == marker {
+                    return true;
+                }
+                if !pipe.line(l.as_str()) {
+                    return false;
+                }
+            }
+            LineInput::Interrupted => return false,
+            LineInput::Eof => return true,
+        }
     }
+}
+
+fn cat_file(pipe: &mut Pipeline, path: &str) -> bool {
+    let h = match rsnix::fs::resolve(path) {
+        Some(h) => h,
+        None => {
+            term_err(&alloc::format!("cat: {}: no such file", path));
+            return true; // keep going with the remaining paths
+        }
+    };
     let mut buf = [0u8; 512];
-    for p in paths {
-        match rsnix::fs::resolve(p) {
-            None => {
-                let msg = alloc::format!("cat: {}: no such file\n", p);
-                gop_print!("{}", msg);
-                serial_print!("{}", msg);
+    let mut pos = 0u64;
+    let mut pending = String::new();
+    loop {
+        if tty::interrupt_pressed() {
+            return false; // ^C aborts everything
+        }
+        match rsnix::fs::read(h, &mut buf, pos) {
+            Ok(0) | Err(_) => break,
+            Ok(n) => {
+                pos += n as u64;
+                pending.push_str(&String::from_utf8_lossy(&buf[..n]));
+                while let Some(idx) = pending.find('\n') {
+                    let line: String = pending.drain(..=idx).collect();
+                    let line = line.trim_end_matches('\n');
+                    if !pipe.line(line) {
+                        return false;
+                    }
+                }
             }
-            Some(h) => {
-                let mut pos = 0u64;
-                loop {
-                    if rsnix::tty::interrupt_pressed() {
-                        gop_println!("^C");
-                        serial_println!("^C");
-                        return;
+        }
+    }
+    if !pending.is_empty() && !pipe.line(&pending) {
+        return false;
+    }
+    true
+}
+
+fn cat_file_until(pipe: &mut Pipeline, path: &str, marker: &str) -> bool {
+    let h = match rsnix::fs::resolve(path) {
+        Some(h) => h,
+        None => {
+            term_err(&alloc::format!("cat: {}: no such file", path));
+            return true;
+        }
+    };
+    let mut buf = [0u8; 512];
+    let mut pos = 0u64;
+    let mut pending = String::new();
+    let mut stopped = false;
+    'outer: loop {
+        if tty::interrupt_pressed() {
+            return false;
+        }
+        match rsnix::fs::read(h, &mut buf, pos) {
+            Ok(0) | Err(_) => break,
+            Ok(n) => {
+                pos += n as u64;
+                pending.push_str(&String::from_utf8_lossy(&buf[..n]));
+                while let Some(idx) = pending.find('\n') {
+                    let line: String = pending.drain(..=idx).collect();
+                    let line = line.trim_end_matches('\n');
+                    // Marker line and everything after is discarded.
+                    if line == marker {
+                        stopped = true;
+                        break 'outer;
                     }
-                    match rsnix::fs::read(h, &mut buf, pos) {
-                        Ok(0) | Err(_) => break,
-                        Ok(n) => {
-                            let chunk = core::str::from_utf8(&buf[..n]).unwrap_or("?");
-                            gop_print!("{}", chunk);
-                            serial_print!("{}", chunk);
-                            pos += n as u64;
-                        }
+                    if !pipe.line(line) {
+                        return false;
                     }
                 }
             }
         }
     }
+    if !stopped && !pending.is_empty() && pending != marker && !pipe.line(&pending) {
+        return false;
+    }
+    true
 }
 
-fn cmd_hexdump(args: &str) {
-    let path = args.split_whitespace().next().unwrap_or("");
-    if path.is_empty() {
-        gop_println!("usage: hexdump <path>");
-        serial_println!("usage: hexdump <path>");
-        return;
+// ---------------------------------------------------------------------------
+// hexdump — hex-dump files and input streams
+// ---------------------------------------------------------------------------
+
+struct HexCtx<'a> {
+    pipe: &'a mut Pipeline,
+    pos: u64,
+    row: [u8; 16],
+    row_len: usize,
+    alive: bool,
+}
+
+fn format_row(addr: u64, row: &[u8; 16]) -> String {
+    let mut out = String::new();
+    use core::fmt::Write as _;
+    let _ = core::write!(out, "{:08x}  ", addr);
+    for &b in row {
+        let _ = core::write!(out, "{:02x} ", b);
+    }
+    out.push_str(" |");
+    for &b in row {
+        out.push(if b.is_ascii_graphic() || b == b' ' {
+            b as char
+        } else {
+            '.'
+        });
+    }
+    out.push('|');
+    out
+}
+
+fn format_partial(addr: u64, row: &[u8]) -> String {
+    let mut out = String::new();
+    use core::fmt::Write as _;
+    let _ = core::write!(out, "{:08x}  ", addr);
+    for i in 0..16 {
+        if i < row.len() {
+            let _ = core::write!(out, "{:02x} ", row[i]);
+        } else {
+            out.push_str("   ");
+        }
+    }
+    out.push_str(" |");
+    for &b in row {
+        out.push(if b.is_ascii_graphic() || b == b' ' {
+            b as char
+        } else {
+            '.'
+        });
+    }
+    out.push('|');
+    out
+}
+
+impl HexCtx<'_> {
+    fn feed(&mut self, data: &[u8]) {
+        if !self.alive {
+            return;
+        }
+        for &b in data {
+            self.row[self.row_len] = b;
+            self.row_len += 1;
+            if self.row_len == 16 {
+                let line = format_row(self.pos, &self.row);
+                self.alive = self.pipe.line(&line);
+                self.pos += 16;
+                self.row_len = 0;
+                if !self.alive {
+                    return;
+                }
+            }
+        }
     }
+
+    /// Emit the trailing partial row, if any.
+    fn flush(&mut self) {
+        if self.alive && self.row_len > 0 {
+            let line = format_partial(self.pos, &self.row[..self.row_len]);
+            let _ = self.pipe.line(&line);
+        }
+    }
+}
+
+fn cmd_hexdump(p: &Parsed) {
+    let mut pipe = Pipeline::new(&p.filters, &p.output);
+    match &p.input {
+        Input::None => {
+            if p.args.is_empty() {
+                hexdump_stdin(&mut pipe);
+            } else {
+                for path in &p.args {
+                    if !hexdump_file(&mut pipe, path) {
+                        break;
+                    }
+                }
+            }
+        }
+        Input::Use(path) => {
+            hexdump_file(&mut pipe, path);
+        }
+        Input::Til(marker) => {
+            hexdump_stdin_until(&mut pipe, marker);
+        }
+        Input::UseTil(path, marker) => {
+            hexdump_file_until(&mut pipe, path, marker);
+        }
+    }
+    pipe.end();
+}
+
+fn hexdump_file(pipe: &mut Pipeline, path: &str) -> bool {
     let h = match rsnix::fs::resolve(path) {
         Some(h) => h,
         None => {
-            gop_println!("hexdump: {}: no such file", path);
-            serial_println!("hexdump: {}: no such file", path);
-            return;
+            term_err(&alloc::format!("hexdump: {}: no such file", path));
+            return true;
         }
     };
+    let mut ctx = HexCtx {
+        pipe,
+        pos: 0,
+        row: [0u8; 16],
+        row_len: 0,
+        alive: true,
+    };
     let mut buf = [0u8; 512];
     let mut pos = 0u64;
     loop {
-        if rsnix::tty::interrupt_pressed() {
-            gop_println!("^C");
-            serial_println!("^C");
-            return;
+        if tty::interrupt_pressed() {
+            ctx.flush();
+            return false;
         }
-        let n = match rsnix::fs::read(h, &mut buf, pos) {
+        match rsnix::fs::read(h, &mut buf, pos) {
             Ok(0) | Err(_) => break,
-            Ok(n) => n,
-        };
-        let mut out = alloc::string::String::new();
-        use core::fmt::Write as _;
-        for i in (0..n).step_by(16) {
-            let _ = core::write!(out, "{:08x}  ", pos + i as u64);
-            for j in 0..16 {
-                if i + j < n {
-                    let _ = core::write!(out, "{:02x} ", buf[i + j]);
-                } else {
-                    out.push_str("   ");
+            Ok(n) => {
+                pos += n as u64;
+                ctx.feed(&buf[..n]);
+                if !ctx.alive {
+                    break;
                 }
             }
-            out.push_str(" |");
-            for j in 0..16 {
-                if i + j >= n {
+        }
+    }
+    ctx.flush();
+    ctx.alive
+}
+
+fn hexdump_stdin(pipe: &mut Pipeline) {
+    let mut ctx = HexCtx {
+        pipe,
+        pos: 0,
+        row: [0u8; 16],
+        row_len: 0,
+        alive: true,
+    };
+    loop {
+        match tty::read_line() {
+            LineInput::Line(l) => {
+                ctx.feed(l.as_str().as_bytes());
+                if !ctx.alive {
+                    break;
+                }
+                ctx.feed(b"\n");
+                if !ctx.alive {
                     break;
                 }
-                let b = buf[i + j];
-                out.push(if b.is_ascii_graphic() || b == b' ' {
-                    b as char
-                } else {
-                    '.'
-                });
             }
-            out.push_str("|\n");
+            LineInput::Interrupted => break,
+            LineInput::Eof => break,
         }
-        gop_print!("{}", out);
-        serial_print!("{}", out);
-        pos += n as u64;
     }
+    ctx.flush();
 }
 
-// ---------------------------------------------------------------------------
-// edit — run the built-in editor (rsdosedit) on a file
-// ---------------------------------------------------------------------------
+fn hexdump_stdin_until(pipe: &mut Pipeline, marker: &str) {
+    let mut ctx = HexCtx {
+        pipe,
+        pos: 0,
+        row: [0u8; 16],
+        row_len: 0,
+        alive: true,
+    };
+    loop {
+        match tty::read_line() {
+            LineInput::Line(l) => {
+                if l.as_str() == marker {
+                    break;
+                }
+                ctx.feed(l.as_str().as_bytes());
+                if !ctx.alive {
+                    break;
+                }
+                ctx.feed(b"\n");
+                if !ctx.alive {
+                    break;
+                }
+            }
+            LineInput::Interrupted => break,
+            LineInput::Eof => break,
+        }
+    }
+    ctx.flush();
+}
 
-fn cmd_edit(args: &str) {
-    let path = args.trim();
-    if path.is_empty() {
-        gop_println!("usage: edit <path>");
-        serial_println!("usage: edit <path>");
-        return;
+fn hexdump_file_until(pipe: &mut Pipeline, path: &str, marker: &str) {
+    let h = match rsnix::fs::resolve(path) {
+        Some(h) => h,
+        None => {
+            term_err(&alloc::format!("hexdump: {}: no such file", path));
+            return;
+        }
+    };
+    let mut ctx = HexCtx {
+        pipe,
+        pos: 0,
+        row: [0u8; 16],
+        row_len: 0,
+        alive: true,
+    };
+    let mut buf = [0u8; 512];
+    let mut pos = 0u64;
+    let mut pending = String::new();
+    let mut stopped = false;
+    'outer: loop {
+        if tty::interrupt_pressed() {
+            break;
+        }
+        match rsnix::fs::read(h, &mut buf, pos) {
+            Ok(0) | Err(_) => break,
+            Ok(n) => {
+                pos += n as u64;
+                pending.push_str(&String::from_utf8_lossy(&buf[..n]));
+                while let Some(idx) = pending.find('\n') {
+                    let line: String = pending.drain(..=idx).collect();
+                    let line = line.trim_end_matches('\n');
+                    if line == marker {
+                        stopped = true;
+                        break 'outer;
+                    }
+                    ctx.feed(line.as_bytes());
+                    ctx.feed(b"\n");
+                    if !ctx.alive {
+                        break 'outer;
+                    }
+                }
+            }
+        }
     }
-    if rsnix::fs::ensure_file(path).is_err() {
-        gop_println!("edit: cannot create {}", path);
-        serial_println!("edit: cannot create {}", path);
-        return;
+    if ctx.alive && !stopped && !pending.is_empty() && pending != marker {
+        ctx.feed(pending.as_bytes());
     }
-    rsnix::gop::clear_screen();
-    rsdosedit::run(path);
-    rsnix::gop::clear_screen();
+    ctx.flush();
 }
 
-fn cmd_mkdir(args: &str) {
-    let path = args.split_whitespace().next().unwrap_or("");
+// ---------------------------------------------------------------------------
+// Other commands
+// ---------------------------------------------------------------------------
+
+fn cmd_mkdir(p: &Parsed) {
+    let path = p.args.first().map(|s| s.as_str()).unwrap_or("");
     if path.is_empty() {
-        gop_println!("usage: mkdir <path>");
-        serial_println!("usage: mkdir <path>");
+        term_err("usage: mkdir <path>");
         return;
     }
     match rsnix::fs::mkdir(path) {
         Ok(()) => {}
-        Err(()) => {
-            gop_println!("mkdir: cannot create directory '{}'", path);
-            serial_println!("mkdir: cannot create directory '{}'", path);
-        }
+        Err(()) => term_err(&alloc::format!("mkdir: cannot create directory '{}'", path)),
     }
 }
 
-fn cmd_touch(args: &str) {
-    let path = args.split_whitespace().next().unwrap_or("");
+fn cmd_touch(p: &Parsed) {
+    let path = p.args.first().map(|s| s.as_str()).unwrap_or("");
     if path.is_empty() {
-        gop_println!("usage: touch <path>");
-        serial_println!("usage: touch <path>");
+        term_err("usage: touch <path>");
         return;
     }
     match rsnix::fs::touch(path) {
         Ok(()) => {}
-        Err(()) => {
-            gop_println!("touch: cannot create '{}'", path);
-            serial_println!("touch: cannot create '{}'", path);
-        }
+        Err(()) => term_err(&alloc::format!("touch: cannot create '{}'", path)),
     }
 }
 
-fn cmd_rm(args: &str) {
-    let path = args.split_whitespace().next().unwrap_or("");
+fn cmd_rm(p: &Parsed) {
+    let path = p.args.first().map(|s| s.as_str()).unwrap_or("");
     if path.is_empty() {
-        gop_println!("usage: rm <path>");
-        serial_println!("usage: rm <path>");
+        term_err("usage: rm <path>");
         return;
     }
     match rsnix::fs::remove_path(path) {
         Ok(()) => {}
-        Err(()) => {
-            gop_println!(
-                "rm: cannot remove '{}' (missing, dir not empty, or busy)",
-                path
-            );
-            serial_println!(
-                "rm: cannot remove '{}' (missing, dir not empty, or busy)",
-                path
-            );
-        }
+        Err(()) => term_err(&alloc::format!(
+            "rm: cannot remove '{}' (missing, dir not empty, or busy)",
+            path
+        )),
     }
 }
 
-fn cmd_clear() {
+fn cmd_edit(p: &Parsed) {
+    let path = p.args.first().map(|s| s.as_str()).unwrap_or("");
+    if path.is_empty() {
+        term_err("usage: edit <path>");
+        return;
+    }
+    if rsnix::fs::ensure_file(path).is_err() {
+        term_err(&alloc::format!("edit: cannot create {}", path));
+        return;
+    }
+    rsnix::gop::clear_screen();
+    rsdosedit::run(path);
     rsnix::gop::clear_screen();
 }
 
-fn cmd_info() {
-    // Test that the global allocator works: build a String on the heap
-    let mut s = alloc::string::String::from("rs-dos v");
-    s.push_str(env!("CARGO_PKG_VERSION"));
-    s.push_str(" — rsnix kernel");
-    gop_println!("{}", s);
-    gop_println!("arch: x86_64, freestanding, no userspace");
-    serial_println!("{}", s);
-    serial_println!("arch: x86_64, freestanding, no userspace");
-    // String is freed (dropped) when this scope ends — tests dealloc too
-}
-
-fn cmd_mem() {
+fn cmd_mem(p: &Parsed) {
     let (map, key) = rsnix::memory::get_map();
 
     let mut total_kb = 0u64;
@@ -402,98 +1238,76 @@ fn cmd_mem() {
         }
     }
 
-    // Build a big heap string with format! to test the allocator
-    let mut out = alloc::string::String::new();
-    use alloc::fmt::Write;
-    let _ = writeln!(out, "memory map (key=0x{:x}, {} entries)", key, map.len());
-    let _ = writeln!(
-        out,
+    let h = rsnix::memory::heap_stats();
+    let ps = rsnix::memory::page_stats();
+
+    let mut pipe = Pipeline::new(&p.filters, &p.output);
+    let _ = pipe.line(&alloc::format!("memory map (key=0x{:x}, {} entries)", key, map.len()));
+    let _ = pipe.line(&alloc::format!(
         "  usable    {:4} MB   Conventional",
         conventional_kb / 1024
-    );
-    let _ = writeln!(
-        out,
+    ));
+    let _ = pipe.line(&alloc::format!(
         "  boot code {:4} MB   BootServicesCode",
         boot_code_kb / 1024
-    );
-    let _ = writeln!(
-        out,
+    ));
+    let _ = pipe.line(&alloc::format!(
         "  boot data {:4} MB   BootServicesData",
         boot_data_kb / 1024
-    );
-    let _ = writeln!(
-        out,
+    ));
+    let _ = pipe.line(&alloc::format!(
         "  loader    {:4} MB   LoaderCode + LoaderData",
         loader_kb / 1024
-    );
-    let _ = writeln!(
-        out,
+    ));
+    let _ = pipe.line(&alloc::format!(
         "  runtime   {:4} MB   RuntimeServices",
         runtime_kb / 1024
-    );
-    let _ = writeln!(out, "  ACPI      {:4} MB", acpi_kb / 1024);
-    let _ = writeln!(out, "  MMIO      {:4} MB", mmio_kb / 1024);
-    let _ = writeln!(out, "  reserved  {:4} MB", reserved_kb / 1024);
-    let _ = writeln!(
-        out,
+    ));
+    let _ = pipe.line(&alloc::format!("  ACPI      {:4} MB", acpi_kb / 1024));
+    let _ = pipe.line(&alloc::format!("  MMIO      {:4} MB", mmio_kb / 1024));
+    let _ = pipe.line(&alloc::format!("  reserved  {:4} MB", reserved_kb / 1024));
+    let _ = pipe.line(&alloc::format!(
         "  raw total {:4} MB   (incl. PCIe MMIO)",
         total_kb / 1024
-    );
-
-    // Heap (free-list allocator with coalescing)
-    let h = rsnix::memory::heap_stats();
-    let _ = writeln!(out, "heap:");
-    let _ = writeln!(
-        out,
+    ));
+    let _ = pipe.line("heap:");
+    let _ = pipe.line(&alloc::format!(
         "  range    {:#x}..{:#x}  {} KB total",
         h.heap_start,
         h.heap_end,
         h.heap_size / 1024
-    );
-    let _ = writeln!(
-        out,
+    ));
+    let _ = pipe.line(&alloc::format!(
         "  free     {} KB in {} block(s), allocated {} KB",
         h.free_bytes / 1024,
         h.free_blocks,
         h.heap_size.saturating_sub(h.free_bytes) / 1024
-    );
-
-    // Physical pages (bitmap allocator)
-    let ps = rsnix::memory::page_stats();
-    let _ = writeln!(out, "pages:");
-    let _ = writeln!(
-        out,
+    ));
+    let _ = pipe.line("pages:");
+    let _ = pipe.line(&alloc::format!(
         "  span     base {:#x}, {} MB covered",
         ps.base_page * rsnix::memory::PAGE_SIZE,
         ps.span_bytes / 1024 / 1024
-    );
-    let _ = writeln!(
-        out,
+    ));
+    let _ = pipe.line(&alloc::format!(
         "  free     {} pages ({} MB), {} used",
         ps.free_pages,
         ps.free_pages * rsnix::memory::PAGE_SIZE / 1024 / 1024,
         ps.used_pages
-    );
-
-    gop_print!("{}", out);
-    serial_print!("{}", out);
+    ));
+    pipe.end();
 }
 
 // ---------------------------------------------------------------------------
 // mmap — dump every entry of the UEFI memory map with type names
 // ---------------------------------------------------------------------------
-fn cmd_mmap() {
+fn cmd_mmap(p: &Parsed) {
     let (map, key) = rsnix::memory::get_map();
-    let mut out = alloc::string::String::new();
-    use alloc::fmt::Write;
-    let _ = writeln!(out, "memory map (key=0x{:x}, {} entries):", key, map.len());
-    let _ = writeln!(
-        out,
-        "  #  type              start           pages      size"
-    );
+    let mut pipe = Pipeline::new(&p.filters, &p.output);
+    let _ = pipe.line(&alloc::format!("memory map (key=0x{:x}, {} entries):", key, map.len()));
+    let _ = pipe.line("  #  type              start           pages      size");
     for (i, d) in map.iter().enumerate() {
-        let _ = writeln!(
-            out,
+        let l = alloc::format!(
             "  {:>2} {:<16} {:#014x} {:>9} {:>8} KB",
             i,
             rsnix::uefi::memory_type_name(d.kind),
@@ -501,9 +1315,11 @@ fn cmd_mmap() {
             d.number_of_pages,
             d.number_of_pages * 4
         );
+        if !pipe.line(&l) {
+            break;
+        }
     }
-    gop_print!("{}", out);
-    serial_print!("{}", out);
+    pipe.end();
 }
 
 // ---------------------------------------------------------------------------
@@ -511,28 +1327,24 @@ fn cmd_mmap() {
 // Pushes the heap past its base region so growth into the page allocator
 // is exercised; also verifies a clean return to the free-list after.
 // ---------------------------------------------------------------------------
-fn cmd_stress(args: &str) {
-    let mut it = args.split_whitespace();
+fn cmd_stress(p: &Parsed) {
+    let mut it = p.args.iter();
     let chunks: usize = match it.next().and_then(|s| s.parse().ok()) {
         Some(n) if (1..=64).contains(&n) => n,
         _ => {
-            gop_println!("usage: stress <chunks(1-64)> <kb>");
-            serial_println!("usage: stress <chunks(1-64)> <kb>");
+            term_err("usage: stress <chunks(1-64)> <kb>");
             return;
         }
     };
     let kb: usize = match it.next().and_then(|s| s.parse().ok()) {
         Some(n) if n > 0 && n <= 1024 * 1024 => n,
         _ => {
-            gop_println!("usage: stress <chunks> <kb>");
-            serial_println!("usage: stress <chunks> <kb>");
+            term_err("usage: stress <chunks> <kb>");
             return;
         }
     };
 
-    let mut out = alloc::string::String::new();
-    use alloc::fmt::Write;
-
+    let mut pipe = Pipeline::new(&p.filters, &p.output);
     let mut allocated = 0usize;
     {
         let mut blocks: [Option<alloc::vec::Vec<u8>>; 64] = core::array::from_fn(|_| None);
@@ -545,39 +1357,34 @@ fn cmd_stress(args: &str) {
                     allocated += 1;
                 }
                 Err(_) => {
-                    let _ = writeln!(out, "  block {}: out of memory, stopping", i);
+                    let _ = pipe.line(&alloc::format!("  block {}: out of memory, stopping", i));
                     break;
                 }
             }
         }
         let h = rsnix::memory::heap_stats();
         let ps = rsnix::memory::page_stats();
-        let _ = writeln!(
-            out,
+        let _ = pipe.line(&alloc::format!(
             "  held {} x {} KB = {} KB",
             allocated,
             kb,
             allocated * kb
-        );
-        let _ = writeln!(
-            out,
+        ));
+        let _ = pipe.line(&alloc::format!(
             "  heap free {} KB ({} blocks), pages free {} MB",
             h.free_bytes / 1024,
             h.free_blocks,
             ps.free_pages * 4 / 1024
-        );
+        ));
         // blocks dropped here → everything freed
     }
     let h = rsnix::memory::heap_stats();
-    let _ = writeln!(
-        out,
+    let _ = pipe.line(&alloc::format!(
         "  freed: heap free {} KB in {} blocks",
         h.free_bytes / 1024,
         h.free_blocks
-    );
-
-    gop_print!("{}", out);
-    serial_print!("{}", out);
+    ));
+    pipe.end();
 }
 
 fn cmd_halt() -> ! {
@@ -586,8 +1393,9 @@ fn cmd_halt() -> ! {
     rsnix::power::halt()
 }
 
-fn cmd_date() {
+fn cmd_date(p: &Parsed) {
     let t = rsnix::rtc::now();
+    let mut pipe = Pipeline::new(&p.filters, &p.output);
     let line = alloc::format!(
         "{}-{:02}-{:02} {:02}:{:02}:{:02}",
         t.year,
@@ -597,19 +1405,17 @@ fn cmd_date() {
         t.minute,
         t.second
     );
-    gop_println!("{}", line);
-    serial_println!("{}", line);
+    let _ = pipe.line(&line);
+    pipe.end();
 }
 
-fn cmd_pci() {
+fn cmd_pci(p: &Parsed) {
     let devices = rsnix::pci::probe();
-    let mut out = alloc::string::String::new();
-    use alloc::fmt::Write;
-    let _ = writeln!(out, "pci: {} device(s)", devices.len());
-    let _ = writeln!(out, "  bus dev fn  class              vendor:device");
+    let mut pipe = Pipeline::new(&p.filters, &p.output);
+    let _ = pipe.line(&alloc::format!("pci: {} device(s)", devices.len()));
+    let _ = pipe.line("  bus dev fn  class              vendor:device");
     for d in &devices {
-        let _ = writeln!(
-            out,
+        let l = alloc::format!(
             "  {:02x}:{:02x}.{}  {:<16} {:04x}:{:04x}",
             d.bus,
             d.device,
@@ -618,9 +1424,11 @@ fn cmd_pci() {
             d.vendor,
             d.device_id
         );
+        if !pipe.line(&l) {
+            break;
+        }
     }
-    gop_print!("{}", out);
-    serial_print!("{}", out);
+    pipe.end();
 }
 
 fn cmd_poweroff() -> ! {