Everything it does, in one list.
Grouped the way the dashboard groups it. If a feature has a constraint worth knowing before you rely on it, the constraint is named here rather than left for you to find.
Projects
Every project on every machine, with what is actually running right now.
Live port checks
Every dashboard load checks every port. If the machine’s agent is online the check is batched through it; otherwise it falls back to an 800 ms TCP probe. Projects that are a URL rather than a port are checked through the tunnel.
Multi-machine projects
One project can map onto several machines, with a per-machine port and root path where they differ.
Process control
Start, stop and restart from the browser or the phone, using quick-launch commands you saved on the project.
Notes and todos
Kept on the project, so the context travels with it instead of living in your head.
Credentials
AES-256-GCM at rest. Never returned by a list endpoint — only by an explicit reveal route, behind Face ID on mobile.
Sharing
Read-only access for a teammate, with comments and an optional terminal grant. Non-owners never get edit paths.
Discovery
Scan a port range to find what is running. Scan a folder tree to find projects you never registered.
Terminals
tmux-backed, shared with your native terminal, resumable by name.
tmux-backed
Survives browser reloads, network drops and app switches.
Cowork
Your native terminal and the browser attach to the same session.
Resumable by name
Session names are deterministic, so reopening a tab attaches to the running session instead of creating a duplicate.
Recording and playback
Sessions record to chunks and replay later, purged on a retention policy you set.
Local and web, split
The registry separates sessions you started natively from ones the browser opened.
Phone terminal
A real terminal on the phone, with a key-chip bar for the keys a soft keyboard does not have.
AI sessions
Claude Code, Codex and Grok across your whole fleet, as chat.
Three vendors, one surface
Each CLI has its own transcript layout and its own scheme for escaping the working directory. All three normalise to one event type.
Every machine, one list
See which agents are working, which are waiting on you, and which are idle.
Launch mode
Start a session from your phone. Each message runs one turn and exits, so an agent restart loses nothing — the transcript is the state.
Push when it needs you
A notification fires only on the working → waiting transition, with a two-minute cooldown, and never on a first sighting.
Infrastructure
Tunnels, files, services and machine enrolment.
HTTP tunnel
Any local port, or a named vhost for PHP and static sites, on a public URL. 10 MB body cap, with styled pages for "machine offline" and "server not running".
File browser
Browse any machine’s filesystem from the dashboard.
System services
Track the services that are not projects.
Machines and API keys
Each machine enrols with an mch_ key, SHA-256 compared server-side.
Account and platform
Two-factor that is actually enforced, on web and on native.
PIN and mandatory TOTP
Two-factor is enforced at the API layer, not only in the UI. The 2FA lockout counters are separate from the PIN ones on purpose.
Browser and native sessions
One JWT, delivered as an HttpOnly cookie to browsers and as a bearer token to native clients. Page scripts can never read it.
Web push
For shares, comments, and AI sessions that are waiting on you.
PWA and mobile app
Installable web app, plus native iOS and Android builds.
Light and dark
Both contrast-measured, not one theme with the colours flipped.