Open a shell. Not a port.
Reach another computer through the fabric. The receiving device stays in control of access.
Full capability details ↓Choose a view
Connected to Home mini · Sample shell $ uname -a Home mini · Linux · Sample environment
Interactive sample · Commands produce local example output
How it works
Ask, don't connect
The client sends a typed intent naming one exact device, target or shell profile.
Grant binds target
Opening the channel consumes one operation instance bound to that device, target, epoch and expiry.
Fabric carries bytes
An authenticated channel reaches the peer with nothing listening on the public internet.
Receiver decides
The far device re-reads its own allowlist before any PTY is spawned or any socket dialled.
Receiver owns the door
It allocates the PTY or dials the socket itself. The caller holds only an opaque handle.
One owner of the end
Cancel, revoke, deny and disconnect all close socket, process group and channel exactly once.
Three separate, individually authorized ways into a device you own: a first-party terminal where the receiving machine creates the PTY and picks the shell; an exact-target TCP forward for a database or a service; and a SOCKS5 or HTTP CONNECT exit that routes your traffic out through a device you trust. Every one of them is a request the far machine can refuse — it re-reads its own policy file before a PTY is spawned or a socket dialled.
What this feature is not
- Not "run an arbitrary command string". The client selects a receiver-defined profile id; the wire carries a program and its arguments.
- Not SSH, and not an sshd replacement. Standard SSH stays required for SFTP, SCP, Git-over-SSH, VS Code Remote SSH and ProxyJump.
- Not a TCP proxy with a shell bolted on. The three doors share a fabric and share no authorization contract at all.
- Not an open proxy. The grant authorizes the proxy operation, never arbitrary destinations, and a denied destination is not dialled to see what happens.
16 capabilities, tracked in the project.
These are recorded implementation states, not public release availability. Platform and direction support vary; public releases remain unverified.
A shell, without an sshd
- Working today Receiver-owned PTY
The far device creates the terminal. You never send it a command string.
- Working today Allowlisted shell profiles
Hand over a prompt, or one named program — never both by accident.
- Working today Zero inbound port
Reach a machine whose only route in is the fabric. No public IP, no firewall rule.
- Planned Windows ConPTY
The same terminal against a Windows host.
Ports and traffic
- Working today TCP port forwarding
Reach a database or a service on another device as a local port.
- Working today SSH over the tunnel
Your own ssh, scp and Git-over-SSH keep working, unchanged.
- Working today Grants bound to an exact target
A caller cannot swap the approved target for 127.0.0.1 once the channel is open.
- Working today SOCKS5 exit
Any SOCKS5-speaking app leaves the internet through a device you trust.
- Working today HTTP CONNECT exit
The same exit, a second dialect, and the same policy answer.
- Working today Exit-side destination policy
The exit device decides what may be reached. Deny by default, reloaded live.
- Working today Honest name handling
A rule naming localhost never silently permits 127.0.0.1.
The terminal you actually use
- Working today Terminus client
One terminal, five platforms, one shared renderer.
- Working today Saved hosts and OS keychain
Secrets stored per platform. The terminal never sees a credential.
- Being built SFTP on the same client
Browse and move files without reaching for a second tool.
- Planned Tabs and split panes
Client-side presentation, owned by each app.
- Planned Session recording
Deliberately undecided. No terminal payload is recorded by default.
Start with the devices
you already own.
Make a little more room for what you do.
Find your way in.
Public downloads are being confirmed. Explore the workflows and development status to see what's taking shape.
Explore features