webmux

Access ·

Browsers exchange a short-lived ticket for a credential, SSH clients fetch a certificate; both are signed by this machine's key and nothing is kept there. webmux rotate-key on the machine revokes everything at once.

Passkey

Browser credentials last 7 days. Save this machine to a passkey and one touch refreshes them, on any browser your password manager syncs to, without a ticket. The passkey's public key is certified by this machine; the certificates live inside the passkey (largeBlob). Nothing is stored here.

SSH access

One command enrolls an SSH client: run it there within 10 minutes. It fetches a certificate for the key you connect with, through the relay, and prints what to do next. Nothing is kept here to revoke; webmux rotate-key on the machine invalidates every client.

read-only

Danger: an AI session wants to run code in this page

The AI session asks for permission to run arbitrary JavaScript inside this browser tab. Its reason:

If you allow this, that AI session can do anything this page can do, until you reload the page or revoke it:

read everything stored in this browser for webmux: your machine credentials and tickets, your ChatGPT tokens, every AI transcript, queued feedback;
type into any session on any connected machine, and create, rename or kill sessions, as you;
send anything it reads to any server on the internet;
change what you see on this page, including what other AI sessions appear to say.

This exists for debugging webmux itself. Deny unless you asked the AI to do this and you understand the risk. Every run will be shown in the transcript with its code.

I understand this gives the AI session full control of this browser tab

Feedback

Reports queue here: an AI session files one when it runs into a bug or when you ask it to, and you can write one below. Nothing is sent until you approve the whole batch; open a report's context to see exactly what would go with it.

Where approved reports go

Feedback broker URL

The broker files each report as an issue in a private repository, signing in as a GitHub App whose key lives in AWS KMS. Leave empty to only copy Markdown.

webmux

Attach to terminal sessions on your machines, from anywhere. Nothing runs on a server: your browser talks to each daemon over an encrypted iroh connection.

Refreshes access to every machine saved in your passkey, and adds ones this browser hasn't seen.

Add a machine by ticket

Get one with webmux ticket on the machine running webmux start. Tickets in the URL fragment (#t=…) never leave your browser.

Sign in with ChatGPT

Access ·

Danger: an AI session wants to run code in this page

Feedback