Found a fun thing to do: Re-route calls to $a685 to a custom parser in prodos. This is the prodos syntax check routine, so if you replace the contents of the keyboard buffer with something else before resuming the command, you can essentially extend the recognized commands almost indefinitely.
Here's my proof of concept stub in the JACE code to do this, though right now I just print out the intercepted command it can be used for much more interesting things later:
new RAMListener(RAMEvent.TYPE.READ, RAMEvent.SCOPE.ADDRESS, RAMEvent.VALUE.ANY) {
@Override
protected void doConfig() {setScopeStart(0x0a685);}
@Override
protected void doEvent(RAMEvent e) {
if (getCpu().getProgramCounter() != getScopeStart()) return;
String in = "";
for (int i=0x0200; i < 0x0300; i++) {
char c = (char) (getMemory().read(i, false) & 0x07f);
if (c == 0x0d) break;
in += c;
}
System.err.println("Intercepted command: "+in);
}