Loft

Your machines, from anywhere. Direct E2E peer sessions; the server only introduces peers.

Sign in

Paste a session token instead

Desktop restart forgets its bearer: rotating or clearing here never locks the account; re-sign-in mints a fresh session.

Devices

Presence is online / asleep / offline. Windows hosts carry a Windows badge; iPhone Safari → Windows shell is the release-blocker path.

Terminal

Browser terminal uses the same frame.v1/Open framing as the CLI over a WebRTC DataChannel. Payloads chunk to pc.sctp.maxMessageSize.

No session selected.

Progressive enhancement: xterm.js 5.5.0 attaches when the CDN loads (typed input, auto-fit with resize reporting); otherwise this plain terminal keeps working (never a dead button).

Desktop

Native H.264 <video> when the host reports native (agents report still-PNG-only today, so this falls back automatically). Screenshot PNG always works, even if video fails.

Files

File bytes travel device-to-device over the existing E2E session, never through the control plane. Peek previews the first 8 KiB as text; downloads/uploads cap at 32 MiB (browser memory bound). POSIX remotes (cat/head); full outbox TTL ships in Phase 9.

Link a device

On the new machine run loft join <server>, then approve its 6-character code here. Expired codes need a fresh join.

Tunnel presets

Browsers cannot bind loopback listeners, so presets copy the CLI command (--install persists via serve). First Windows listen shows firewall consent copy before the OS prompt.

Approvals

Mode-gated injections park here as cards. Allow once answers one card, Always this session lifts the owning thread to full_access, Deny refuses. Polls approvals.pending every 5s for the selected device; new cards raise a system notification (blocking tier).

Sessions

Persistent windows on the selected device (sessions.list backend badge + mode). Pick one to fill the schedule/outbox session fields; the approval dot counts its pending cards.

Schedules

Box-local cron prompts (schedules.*, 5-field minute hour dom month dow). Fires pass the same permission gate as any injection.

Outbox

Session artifacts with TTL (outbox.*, non-destructive pull). Lists one session; pulls decode base64 into a download.

Docs

Pairing: loft join prints a code → approve above → host polls success. Both sides then list the device.
Revoke: device card → Revoke → confirm. Propagates everywhere in <10s; the revoked device sees relink_required with re-join instructions.
Airplane test: drop the network, presence flips, queued taps auto-connect on return. Kill-app test: work continues, reattach shows the same scrollback.
Privacy: the control plane and relay handle signaling + opaque bytes only. No keystrokes, pixels, files, or tunneled traffic are visible to the server.