diff --git a/clite/core.js b/clite/core.js
index 4080fbe..2a18cb8 100644
--- a/clite/core.js
+++ b/clite/core.js
@@ -10,56 +10,69 @@ var clite = {
 	},
 	events:{
 		keyup:function(e) {
-			if (e.key == 'Down' || e.key == 'ArrowDown') {
-				clite.shell.history.down();
+			try {
+				if (e.key == 'Down' || e.key == 'ArrowDown') {
+					clite.shell.history.down();
+					return false;
+				}
+				if (e.key == 'Up' || e.key == 'ArrowUp') {
+					clite.shell.history.up();
+					return false;
+				}
+				var t = clite.state.input.field.value;
+				if (e.key != 'Enter') {
+					clite.shell.history.setCurrent(t);
+					return true;
+				}
+				clite.shell.parse(t);
 				return false;
-			}
-			if (e.key == 'Up' || e.key == 'ArrowUp') {
-				clite.shell.history.up();
-				return false;
-			}
-			var t = clite.state.input.field.value;
-			if (e.key != 'Enter') {
-				clite.shell.history.setCurrent(t);
-				return true;
-			}
-			clite.shell.exec(t);
-			return false;
+			} catch(err) {return false;}
 		},
 		refocus:function(e) {
-			clite.core.genForm();
-			clite.state.input.field.focus();
+			try {
+				clite.term.genForm();
+				clite.state.input.field.focus();
+			} catch(err) {}
 		}
 	},
 	core:{
-		genForm:function() {
-			var f = document.getElementById('form');
-			if (!f)
-				f = document.createElement('form');
-			f.id = 'form';
-			f.innerHTML = '';
-			var l = document.createElement('label');
-			l.innerHTML = clite.shell.prompt.getHTML();
-			f.appendChild(l);
-			var i = document.createElement('input');
-			i.type = clite.state.input.ispass ? 'password' : 'text';
-			i.value = clite.shell.history.getCurrent();
-			f.appendChild(i);
-			clite.state.input.form = f;
-			clite.state.input.field = i;
-			var t = document.getElementById('terminal');
-			if (!t)
-				return;
-			t.appendChild(f);
-			i.onkeyup = clite.events.keyup;
-			i.onfocusout = clite.events.refocus;
-			i.onblur = clite.events.refocus;
-			f.onsubmit = function() {return false;};
+		execSafe:function(f) {
+			try{
+				f();
+			} catch(e) {
+				clite.log.write(e.message);
+				return false;
+			}
+			return true;
 		},
-		setPass:function(is) {
-			clite.state.input.ispass = !!is;
-			if (typeof clite.state.input.ispass != 'Boolean')
-				clite.state.input.ispass = false;
+		execSafeAsync:function(f) {
+			setTimeout(f,10);
+		},
+		load:{
+			script:function(name,callback) {
+				var head = document.getElementsByTagName('head')[0];
+				var script = document.createElement('script');
+				var file = '';
+				if (bios.lib.code.base != null)
+					file += bios.lib.code.base+'/';
+				file +=name+'.js';
+				script.type = 'text/javascript';
+				script.src = file;
+				script.onload = callback;
+				head.appendChild(script);
+			},
+			file:function(name,callback) {
+				if (window.location.protocol == 'file:') {
+					clite.log.write('no file: support');
+					return;
+				}
+
+				fetch(name)
+					.then(response => response.text())
+					.then((data) => {
+						callback(data)
+					});
+			}
 		}
 	},
 	init:function() {
@@ -67,9 +80,67 @@ var clite = {
 			return;
 		this.state.isinit = true;
 
+		this.core.execSafeAsync(function() {
+			clite.term.clear(false);
+			// mount core (root) filesystem using data/filesys.txt
+			// populate /dev
+			// check cookies for login
+			// if new user:
+			//  read in /usr/share/introduction and write to shell
+			// if logged in:
+			// create user session
+
+			clite.events.refocus();
+
+			clite.core.load.file('data/filesys.txt',alert);
+		});
+	}
+};
+
+clite.log = {
+	write:function(txt) {
+		// TODO: after login log to /var/log/messages instead of to shell
+		try {
+			clite.shell.writeLine(txt);
+		} catch(e) {}
+		console.log(txt);
+	}
+};
+
+clite.term = {
+	clear:function(form) {
 		document.getElementById('terminal').innerHTML = '';
-		// TODO: read in /usr/share/introduction
-		this.events.refocus();
+		if (form)
+			clite.term.genForm();
+	},
+	genForm:function() {
+		var f = document.getElementById('form');
+		if (!f)
+			f = document.createElement('form');
+		f.id = 'form';
+		f.innerHTML = '';
+		var l = document.createElement('label');
+		l.innerHTML = clite.shell.prompt.getHTML();
+		f.appendChild(l);
+		var i = document.createElement('input');
+		i.type = clite.state.input.ispass ? 'password' : 'text';
+		i.value = clite.shell.history.getCurrent();
+		f.appendChild(i);
+		clite.state.input.form = f;
+		clite.state.input.field = i;
+		var t = document.getElementById('terminal');
+		if (!t)
+			return;
+		t.appendChild(f);
+		i.onkeyup = clite.events.keyup;
+		i.onfocusout = clite.events.refocus;
+		i.onblur = clite.events.refocus;
+		f.onsubmit = function() {return false;};
+	},
+	setPass:function(is) {
+		clite.state.input.ispass = !!is;
+		if (typeof clite.state.input.ispass != 'Boolean')
+			clite.state.input.ispass = false;
 	}
 };
 
@@ -86,6 +157,9 @@ clite.shell = {
 		clite.events.refocus();
 	},
 	exec:function(txt) {
+		// TODO: actually execute the command
+	},
+	parse:function(txt) {
 		if (txt.length < 1) {
 			clite.shell.writeLine(clite.shell.prompt.getHTML());
 			return;
@@ -93,7 +167,7 @@ clite.shell = {
 		clite.shell.history.add(txt);
 		clite.shell.history.resetCurrent();
 		clite.shell.writeLine(clite.shell.prompt.getHTML()+txt);
-		// TODO: actually execute the command
+		clite.shell.exec(txt);
 	},
 	prompt:{
 		list:[],
diff --git a/data/filesys.txt b/data/filesys.txt
index 75fee00..ab2cad1 100644
--- a/data/filesys.txt
+++ b/data/filesys.txt
@@ -1,8 +1,14 @@
 # filesystem index file
-# line format: url:filepath:permissions
-# url is the server-side file path and name, relative to the data directory
+# line format: url:filepath:uid:gid:permissions
+# url is the server-side file path and name, relative to the parent of the data directory (typically the web root)
+#  if url is empty, the file is a directory
+#  if url is in a directory that does not have an entry, that directory inherits uid/gid/permissions from its parent
 # filepath is CLIte's Unix-like path, such as /usr/share/introduction
-# permissions is CLIte's Unix-like file permissions for the file, such as rwxrwxrwx
+# uid is the numeric user id of the file owner
+# gid is the numeric group id of the file owner
+# permissions is CLIte's Unix-like file permissions for the file, such as -rwxrwxrwx
 # empty lines, or lines beginning with a # are ignored
 
-intro:/usr/share/introduction:rw-rw-r--
+clite/core.js:/usr/clite/core.js:0:0:-rw-r-----
+clite/core.css:/usr/clite/web/core.css:0:0:-rw-r-----
+data/intro:/usr/share/introduction:0:0:-rw-rw-r--