Local tunnel
The client initiates the connection and the agent exposes no public port.
Minimal exposureSet boundaries before adding capability
A clear split between control and SSH data planes
Connections remain direct end to end; the cloud accepts only classified, explicitly allowed data.
Connections and host safety
Important changes stay visible and unfamiliar resources are never modified automatically.
Host key confirmation
A changed host key requires explicit confirmation.
Visible failurePreserve user work
Remote SSH, tmux, and user processes are never ended without authorization.
Keep contextCloud data classification
Unknown fields are rejected and sensitive material does not enter the cloud in plaintext.
Non-sensitive allowlist
Only explicitly allowed preferences and model metadata can sync.
Default denyClient-side encryption
The server stores ciphertext envelopes and key-wrapper metadata only.
Zero knowledgeRedacted records
Passwords, tokens, cookies, ciphertext bodies, and SSH details stay out of logs.
Minimum record