Skip to content
- Identity. Each agent and each bridge installation has its own Ed25519 key, created on
first run. Machines are identified by the key’s fingerprint.
- Pairing uses SPAKE2 with the one-time code, bound to both TLS keys, so a man in the
middle is detected even if they know the code.
- Connections are mutual TLS 1.3. The bridge accepts only the agent key it paired with and
refuses the connection with “the node’s identity has changed” otherwise. The agent rejects
any bridge not in its trust list before running anything.
- Revocation.
jump-agent bridges revoke applies to the bridge’s next connection. To end a
session that is already open, restart the agent.
- Audit. The agent logs every request with the bridge’s address, name and fingerprint.
- Not yet: limits on what a paired bridge may do (Phase 2), and OS keychain storage for
private keys (Phase 2). Keys are files readable only by their owner. A paired bridge can
take screenshots, and click and type in apps on its nodes, without the node’s user being
told, so don’t pair nodes whose screens show what that bridge’s users shouldn’t see. Text
typed through
type_text or set_value is logged as its length only.
