Security
Trust model
Separate identities for people, agents and devices; permissions that only narrow; and a device that re-checks everything. Known limits are listed plainly below.
Windows Node and Android Node are in testing. They are available to try, but compatibility and reliability are still being validated. An available installer does not mean every system, phone model or operation has been verified.
- Management sessions administer an account. Agent credentials can only use their bound authorization.
- Every device request uses an Ed25519 or Android Keystore P-256 signature, timestamp and one-time nonce.
- Filesystem operations validate canonical paths and symlink boundaries again on the device.
Important limitation
Restricted process mode is a guardrail, not a sandbox. Full device trust disables command and protected-path filters.
What the control plane can see
The control plane stores exposed path names, invocation arguments, returned results, artifacts and audit metadata. It does not hold the device private key or proactively crawl the filesystem. An authorized result may still contain sensitive data.
Credential storage
Desktop device keys are stored in local configuration files (mode 0600 on Unix); desktop Keychain and keyring support is not implemented. Android Mobile Node keeps its P-256 private key in Android Keystore.
Threats and controls
| Threat | Control | Residual risk |
|---|---|---|
| Stolen access key | Access keys are hashed, expire and bind to one revocable authorization. | A copied access key remains usable until it expires or is revoked. |
| Compromised device key | Every device request uses an Ed25519 or Android Keystore P-256 signature, timestamp and one-time nonce. | A stolen private key remains valid until the device is revoked. |
| Path escape | Canonical paths, realpath, no-follow opens and descriptor identity checks are enforced locally. | Portable APIs cannot eliminate every hostile parent-directory race or hard-link alias. |
| Duplicate side effect | Stable idempotency keys and a fsynced local ledger prevent automatic duplicate execution. | A crash after the effect but before its receipt is reported as unknown_outcome. |
| Sensitive output | Protected paths, bounded output and common secret patterns are filtered in restricted mode. | Redaction is best effort and cannot prove arbitrary authorized content is safe. |
Current assurance
- Protocol schemas, policy decisions and adapter parity
- Real PostgreSQL migrations, locking, restart and account isolation
- Path traversal, symlink escape, cancellation and idempotency recovery
- macOS arm64 installation, upgrade, reconnect and uninstall
- Public HTTPS deployment, database readiness and restart recovery
- Hosted email verification and password recovery with real inbox delivery
- Selected Xiaomi/MIUI mobile capabilities; other Android models require validation
- External penetration testing and signed release provenance
- Real GitHub consent round trip
- Linux systemd and every generated cross-platform archive
- Hard filesystem, network and process isolation
Report vulnerabilities privately through the repository security policy.