Terminal & Access
Reach any machine you own, without opening a port.
Three separate, individually authorized ways into a device you own: a first-party terminal where the receiving machine creates the PTY and picks the shell; an exact-target TCP forward for a database or a service; and a SOCKS5 or HTTP CONNECT exit that routes your traffic out through a device you trust. Every one of them is a request the far machine can refuse — it re-reads its own policy file before a PTY is spawned or a socket dialled.
- 12Working today
- 1Being built
- 3Planned
The mechanism, not the metaphor.
- 01 Ask, don't connect
The client sends a typed intent naming one exact device, target or shell profile.
- 02 Grant binds target
Opening the channel consumes one operation instance bound to that device, target, epoch and expiry.
- 03 Fabric carries bytes
An authenticated channel reaches the peer with nothing listening on the public internet.
- 04 Receiver decides
The far device re-reads its own allowlist before any PTY is spawned or any socket dialled.
- 05 Receiver owns the door
It allocates the PTY or dials the socket itself. The caller holds only an opaque handle.
- 06 One owner of the end
Cancel, revoke, deny and disconnect all close socket, process group and channel exactly once.
16 capabilities, and where each one stands.
A shell, without an sshd
- Working today Receiver-owned PTY
The far device creates the terminal. You never send it a command string.
- Working today Allowlisted shell profiles
Hand over a prompt, or one named program — never both by accident.
- Working today Zero inbound port
Reach a machine whose only route in is the fabric. No public IP, no firewall rule.
- Planned Windows ConPTY
The same terminal against a Windows host.
Ports and traffic
- Working today TCP port forwarding
Reach a database or a service on another device as a local port.
- Working today SSH over the tunnel
Your own ssh, scp and Git-over-SSH keep working, unchanged.
- Working today Grants bound to an exact target
A caller cannot swap the approved target for 127.0.0.1 once the channel is open.
- Working today SOCKS5 exit
Any SOCKS5-speaking app leaves the internet through a device you trust.
- Working today HTTP CONNECT exit
The same exit, a second dialect, and the same policy answer.
- Working today Exit-side destination policy
The exit device decides what may be reached. Deny by default, reloaded live.
- Working today Honest name handling
A rule naming localhost never silently permits 127.0.0.1.
The terminal you actually use
- Working today Terminus client
One terminal, five platforms, one shared renderer.
- Working today Saved hosts and OS keychain
Secrets stored per platform. The terminal never sees a credential.
- Being built SFTP on the same client
Browse and move files without reaching for a second tool.
- Planned Tabs and split panes
Client-side presentation, owned by each app.
- Planned Session recording
Deliberately undecided. No terminal payload is recorded by default.
Numbers from tests that ran.
- Loopback-only sshd
ssh reaches a container whose sshd binds nothing but its own loopback — and the test asserts the direct route is refused first.
- 5 s
Worst case for a policy deny to end the forwards it withdrew. Asserted on a paused clock rather than waited out.
- Deny by default
Forward policy never resolves a name in order to decide, and loopback is deliberately not exempt.
- Real PTY, two nodes
A shell on one device driven from another: exit code, resize across lanes, and close, all proven end to end.
And what it is not
- Not "run an arbitrary command string". The client selects a receiver-defined profile id; the wire carries a program and its arguments.
- Not SSH, and not an sshd replacement. Standard SSH stays required for SFTP, SCP, Git-over-SSH, VS Code Remote SSH and ProxyJump.
- Not a TCP proxy with a shell bolted on. The three doors share a fabric and share no authorization contract at all.
- Not an open proxy. The grant authorizes the proxy operation, never arbitrary destinations, and a denied destination is not dialled to see what happens.
Start with the devices you already own.
Make them work
as one.
The open core is ready to explore. Build your personal device fabric with Xross.
Open-source core · Direct by design · Your devices, your fabric