// The security
End-to-end encrypted, by design
Sending control of your dev machine to your phone is only a good idea if the channel is airtight. So it is.
Approval boxes arrive as structured data, so the Approve and Reject buttons on your phone mean exactly what they show. They are not guesses scraped from raw terminal output.
Blind relay — your Mac and your phone both connect outward, which works behind NAT, and the relay only ever moves ciphertext. It cannot read your sessions.
Apple CryptoKit — X25519 key exchange at pairing, HKDF-SHA256 session keys, ChaCha20-Poly1305 on every frame, replay protection.
Fingerprint pairing — a QR scan or paste, confirmed by a six-digit code you check on both devices, so nothing can wedge itself in the middle.
Streams only — terminal output crosses the wire. Your files never do.
