docs: document secure Mac control path - #1246
Conversation
Document how a laptop attaches to a server-resident Firstmate and reaches its loopback-only web tools without publishing anything. - docs/remote-access.md (operator-current) owns the Mac-side SSH config entry, the attach command, the Lavish forward, the reusable forward pattern, the forwarding-safety classification, and troubleshooting. - docs/verification/remote-access.md (maintainer-verification) records the reusable client-side evidence: config expansion, a forward reaching a loopback-only service, and ExitOnForwardFailure behavior against a busy local port, all against an ephemeral loopback SSH server. - Classify both surfaces, add the owner pointer, and route them from README. The tool's own CLI already prints current session URLs, so no wrapper script is added for that lookup.
…local control surface
…ed focused checks
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e2635f2764
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Host shadowbyte-agent | ||
| HostName <server-host>.<tailnet>.ts.net | ||
| User <server-user> | ||
| ForwardAgent no |
There was a problem hiding this comment.
Captain, on the documented host-OpenSSH path, this minimal file omits IdentityFile while -F selects it as the alternative per-user configuration file, so a key configured only in the normal ~/.ssh/config is ignored. If that key has a non-default filename and is not loaded into the agent, the attach can work while this tunnel fails authentication despite the public key already being installed; include an identity placeholder or explicitly require -i/agent loading.
Useful? React with 👍 / 👎.
1 participant
Summary
firstmate, and supervised-crewmate restrictions.Validation
ExitOnForwardFailurebehavior.Safety