diff --git a/build/fs/password b/build/fs/password
index 4ed5ecf..9548543 100644
--- a/build/fs/password
+++ b/build/fs/password
@@ -1,2 +1,3 @@
+system:system:system:777777
 ken:ken:ken:12
 dmr:dmr:dmr:14
diff --git a/src/other/pbsh.s b/src/other/pbsh.s
index 63ed3c0..b624612 100644
--- a/src/other/pbsh.s
+++ b/src/other/pbsh.s
@@ -37,9 +37,12 @@ maxargs=8
 
 newline:
    lac d1; sys write; prompt; 1	" output prompt
-   jms rline			" read line into ibuf
-   lac iipt
-   dac ipt
+   jms rline			" read (edited) line into lbuf
+   lac ilpt
+   dac lpt			" reset line pointer
+
+" parse new command from current input line
+" (after ';' or '&')
 newcom:
    dzm char			" clear saved char
    dzm infile			" clear input redirect file name
@@ -68,12 +71,12 @@ newarg:
 
    jms blank			" skip whitespace
    jms delim			" command sep?
-    jmp eol			"  yes
+    jmp eoc			"  yes
    sad lt			" input redirect?
-    jmp redirin
+    jmp redirin			"  yes
    sad gt			" output redirect?
-    jmp redirout
-   jmp 3f
+    jmp redirout		"  yes
+   jmp savechar			" no: save as filename
 
 redirin:			" saw <
    dac redirect			" flag redirect
@@ -87,40 +90,43 @@ redirout:			" saw >
    dac opt
    " fall
 
-newchar:
+newchar:			" loop reading a file name
    jms getc
    sad o40			" space?
     jmp eoname			"  yes
-   jms delim
-    jmp eoname
-3: jms putc			" save
+   jms delim			" no: end of line?
+    jmp eoname			"  yes
+savechar:
+   jms putc			" no: save
    isz bcount			" loop unless full
     jmp newchar
 
 " here after 8 chars: discard until terminator seen
-discard:
-   jms getc
+1: jms getc
    jms delim			" end of line?
-    jmp eoname
+    jmp 2f
    sad o40
-    jmp eoname
-   jmp discard
+    jmp 2f
+   jmp 1b
+
+2:
+   dac char			" save terminator
+   jmp full
 
 " name ended (short) with whitespace or delim
 " pad out last name to 8 with spaces
-" XXX check if ANYTHING read
 eoname:
    dac char			" save terminator
 1: lac o40
-   jms putc			" no: copy into argv
+   jms putc			" copy into argv
    isz bcount			" loop until full
     jmp 1b
-
-" saw end of name
-2: lac redirect
+full:
+   lac redirect
    sza
     jmp 2f			" last name was a redirect file, skip increment
 
+" file was not a redirection:
    lac argc			" increment argc
    tad d4
    dac argc
@@ -131,31 +137,31 @@ eoname:
 2:
    dzm redirect			" clear redirect flag
    lac nextarg
-   dac opt
+   dac opt			" set output pointer
 
-   lac char
-   jms delim
-    jmp eol
+   lac char			" get terminator
+   jms delim			" end of command?
+    jmp eoc			"  yes
 
-   lac argc
-   sad maxargwords
-    skp
-     jmp newarg
+   lac argc			" another arg
+   sad maxargwords		" full up?
+    skp				"  yes
+     jmp newarg			"   no: get another
 
-" too many args, (complain?).  for now eat rest of line 
+" too many args
 4: jms getc
    jms delim
     skp
      jmp 4b
    lac d1; sys write; toomany; ltoomany
-   jmp newline
+   jmp newline			" ignore rest of line
 
-" here at end of line
-eol:
-   sad delimchar		" save eol character
+" here at end of command
+eoc:
+   dac delimchar		" save command delimiter
    lac argc			" check for empty command line
    sna				" get anything?
-    jmp 2f			" no, go back for another
+    jmp nextcmd			" no, go back for another
 
 " check for built-in "chdir" command
    lac argv0
@@ -170,40 +176,37 @@ eol:
    sad chdirstr+2
     jmp changedir
 
-1:
-" comment these out to test "exec" w/o fork
-   sys fork
+" here to execute command (not a builtin)
+1: sys fork
     jmp parent
 
+child:				" debug symbol
    sys open; argv0; 0		" try cwd (no link required)
-   sma
-    jmp 1f
-   " jmp cmderr
+   sma				" error?
+    jmp 1f			"  no
 
-   sys unlink; exectemp		" remove old temp file, if any
-   sys link; system; argv0; exectemp
+   sys link; system; argv0; argv0
    spa
-     jmp cmderr
-   sys open; exectemp; 0
+    jmp cmderr
+   sys open; argv0; 0
    spa
-     jmp cmderr
+    jmp cmderr
    dac cmdfd
-   sys unlink; exectemp
+   sys unlink; argv0
    skp
-
 1:  dac cmdfd			" save command file descriptor
    cla				" check for input redirection
    sad infile			" input redirct?
     jmp 1f			"  no
    sys close			" close fd 0
-   sys open; infile; 0		" open redirected
-   spa sna
+   sys open; infile; 0		" open new stdin
+   spa
     jmp inerror
    cla
-1: sad outfile			" output redirec?
+1: sad outfile			" output redirect?
     jmp exec			"  no
    lac d1; sys close		" close fd 1
-   lac o17; sys creat; outfile	" open output redirect
+   lac o17; sys creat; outfile	" open new stdout
    spa
     jmp outerror
 
@@ -225,7 +228,7 @@ exec:
 
 " copied up to bootloc in high memory (below argc)
 boot:
-   sys read; userbase; userlen	" read executable in
+   sys read; userbase; userlen	" read executable in (check for non-zero ret?)
    lacq				" Get the fd back and close the file
    sys close			" close command file
    jmp userbase			" and jump to the beginning of the executable
@@ -245,31 +248,34 @@ error:				" error in child: filename pointer in AC
   lac d1; sys write; 1: 0; 4
   lac d1; sys write; qmnl; 1
   lac d2; sys close		" close executable, if any
-  sys exit
+  sys exit			" performs implicit rmes
 
 " chdir command: executed in shell process
+" takes a series of directory names to chdir to in turn
 changedir:
-" XXX check if argc == 4 (no directories) and complain??
+   lac argc
+   sad d4
+    jmp qm			" need at least one arg!
    lac argv0p
    skp
-1:  lac 0f			" increment argvp
+1:  lac 0f			" increment dir pointer
    tad d4
    dac 0f
    -4				" decrement argc
    tad argc
    dac argc
    sna				" done?
-    jmp 2f			"  yes: join parent code
+    jmp nextcmd			"  yes: join parent code
    sys chdir; 0:0
    sma				" error?
     jmp 1b			"  no: look for another directory
 
-" chdir call failed
-   lac 0b
-   dac 0f
-   lac d1; sys write; 0:0; 4
-   lac d1; sys write; qmnl; 1
-   jmp 2f			" join parent code
+
+   lac 0b			" chdir failed: get offending name
+   dac 0f			" store for write
+   lac d1; sys write; 0:0; 4	" complain
+qm:lac d1; sys write; qmnl; 1
+   jmp nextcmd			" join parent code
 
 " here in parent, child pid in AC
 parent:
@@ -290,9 +296,11 @@ parent:
     jmp newcom			"  yes: go back without wait
    lac pid			" no: get pid
    sys smes			" hang until child exits
-2: lac delimchar
+   nop
+nextcmd:
+   lac delimchar
    sad o73			" semi?
-    jmp newcom			"  yes: look for another command w/o prompt
+    jmp newcom			"  yes: look for another command on line
    jmp newline			" no: output prompt
 
 " ================
@@ -318,46 +326,70 @@ delim: 0
    isz delim			" ran the gauntlet: skip home
    jmp delim i
 
-" get character from ibuf
+" get character from lbuf
 getc: 0
-   lac ipt i		" fetch char
-   isz ipt		" increment pointer
+   lac lpt i			" fetch char from line buffer
+   isz lpt			" increment pointer
    jmp getc i
 
-" from init.s rline: read line from tty into ibuf
+" from init.s rline: read line into lbuf with editing
 " (store one character per word)
 rline: 0
-   law ibuf-1		" Store ibuf pointer in location 8
+   law lbuf-1			" pointer in location 8
    dac 8
-1:
-   cla; sys read; char; 1 " Read in one character from stdin
-   sna			" read ok?
-    jmp quit		" no
-   lac char
-   lrss 9		" Get it and shift down 9 bits
-   sad o100		" '@' (kill) character?
-     jmp rline+1	"  yes: start from scratch
-   sad o43		" '#' (erase) character?
-     jmp 2f		"  yes: handle below
-
-   dac 8 i		" Store the character in the buffer
-   sad o12		" Newline?
-     jmp rline i	"  yes: return
-   jmp 1b		" no: keep going
+1: jms readc
+    jmp quit			" EOF
+   sad o100			" '@' (kill) character?
+    jmp rline+1			"  yes: start from scratch
+   sad o43			" '#' (erase) character?
+    jmp 2f			"  yes: handle below
+   dac 8 i			" Store the character in the buffer
+   sad o12			" Newline?
+     jmp rline i		"  yes: return
+   jmp 1b			" no: keep going
 2:
-   law ibuf-1		" # handling. Do nothing if at start of the buffer
-   sad 8
-     jmp 1b		" and loop back
-   -1
-   tad 8		" Otherwise, move the pointer in location 8 back one
+   law lbuf-1			" # (erase) handling
+   sad 8			" at start?
+    jmp 1b			"  yes: noop, loop back
+   -1				" no: decrement poiner
+   tad 8
    dac 8
-   jmp 1b		" and loop back
+   jmp 1b
 
 quit:
    lac d1; sys smes	" wake up init
    sys exit
 
-" copied from cat.s:
+" copied from cat.s
+
+" was "getc"
+readc: 0
+   lac ipt			" Load the pointer to the next word in the buffer
+   sad eipt
+     jmp 1f			" We've reached the end of the buffer, so read more
+   dac 2f			" Save the pointer
+   add o400000			" Flip the msb and save into ipt
+   dac ipt
+   ral				" Move the msb into the link register
+   lac 2f i			" Load the word from the buffer
+   szl				" Skip if this is the second character in the word
+     lrss 9			" It's the first char, shift down the top character
+   and o177			" Keep the lowest 7 bits
+   sna
+     jmp readc+1		" Skip a NUL characters and read another one
+   isz readc			" give skip return
+   jmp readc i			" Return the character from the subroutine
+1:
+   cla				" Buffer is empty, read 64 chars from stdin
+   sys read; iipt+1; 64
+   sna
+     jmp readc i		" No characters read: return without skip
+   tad iipt			" Add the word count to the base of the buffer
+   dac eipt			" and store in the end buffer pointer
+   lac iipt			" Reset the ipt to the base of the buffer
+   dac ipt
+   jmp readc+1			" and loop back to get one character
+
 putc: 0
    and o177			" Keep the lowest 7 bits and save into 2f+1
    dac 2f+1
@@ -378,17 +410,22 @@ putc: 0
    jmp putc i			" No, so return (more room still in the buffer)
 
 2: 0;0				" pointer, char
+ipt: 0				" Current input buffer base
+eipt: 0				" Pointer to end of data read in input buffer
+iipt: .+1; .=.+64		" 64 word input buffer and pointer to it
+" end from cat.s
 
 " literals
 d1: 1
 d2: 2
 o4:d4: 4
+dm8: -8
 o12: 012			" newline
 o17: 017
 o40: 040			" space
 o43: 043			" #
 o46: 046			" ampersand
-o73: 046			" semi
+o73: 073			" semi
 o74:lt: 074			" <
 o76:gt: 076			" >
 o100: 0100			" @
@@ -401,9 +438,6 @@ qmnl: <? 012			" question mark, newline
 system:
    <sy>;<st>;<em>; 040040
 
-exectemp:
-   <ex>;<ec>;<te>;<mp>		" temporary link for file being exec'ed
-
 chdirstr:
    <ch>;<di>;<r 040
 
@@ -419,7 +453,7 @@ argcptr: argc
 infilep: infile
 outfilep: outfile
 
-iipt: ibuf
+ilpt: lbuf			" initial line buffer pointer
 iopt:argv0p: argv0		" initial value for nextarg, opt
 
 " ################ variables
@@ -429,9 +463,9 @@ prompt: <@ 040			" v1 prompt!
 redirect: .=.+1			" last file was a redirect (lt or gt)
 nextarg: .=.+1			" next slot in argv to fill
 bcount: .=.+1			" byte counter for current filename
-opt: .=.+1			" "output pointer" (may point to in/outfile or into argv)
+opt: .=.+1			" "output pointer" (in/outfile or into argv)
 delimchar: .=.+1		" character that terminated line
-char: .=.+1			" char that terminated word
+char: .=.+1			" char that terminated word (merge w/ delimchar?)
 
 outfile: .=.+4			" buffer for output redirect file name
 infile: .=.+4			" buffer for input redirect file name
@@ -439,17 +473,20 @@ pid: .=.+1			" "other" pid
 cmdfd: .=.+1			" fd for executable
 bootcount: .=.+1		" loop count for "boot" copy
 
-ipt: .=.+1			" input buf pointer
-ibuf:				" input line stored here, one character per word
+lpt: .=.+1			" line buf pointer
+lbuf:				" edited line, one char per word
+
+" enter addresses into namelist:
+.=017777			" last word points to argc + argv data
+argptr:
+
+.=argptr-maxargs-maxargs-maxargs-maxargs-1 " argc followed by argv
+argc: .=.+1
+argv0:				" 4 word blocks following argc
+
+" "bootstrap" (reads executable into userbase) copied JUST below argc
+.=argc-bootlen
+bootloc:
 
 userbase=010000			" user starts at 4K
-argptr=017777			" last word points to argc + argv data
-argc=argptr-maxargs-maxargs-maxargs-maxargs-1 " argc followed by argv
-
-" arguments in 4 word blocks follow argc
-argv0=argc+1
-
-" "bootstrap" (reads executable into userbase) JUST below argc
-bootloc=argc-bootlen		" location of bootstrap
-
 userlen=bootloc-userbase	" max executable
diff --git a/tools/as7 b/tools/as7
index bd449ca..c8fc3f5 100755
--- a/tools/as7
+++ b/tools/as7
@@ -196,8 +196,8 @@ usage() if ( @ARGV < 1 );
 );
 
 # Parse all the files
+print STDERR "I\n";		# like the real as
 foreach my $file (@ARGV) {
-    print STDERR "I $file\n";	# like the real as
     parse_file($file);
 }
 
@@ -206,8 +206,9 @@ $Var{'.'} = $BASE;
 $stage = 2;
 open(my $OUT, ">$output") || die "$output";
 
+print STDERR "II\n";		# like the real as
 foreach my $file (@ARGV) {
-    print STDERR "II $file\n";	# like the real as
+    print STDERR "$file\n";	# like the real as
     parse_file($file);
 }