• Status: maintained
• Last source review: 2026-08-18 at 72921f1

Treer's current security target is a personal or trusted-lab deployment. The product offers scoped coordination and a clear upgrade path; it does not yet provide strong isolation between mutually untrusted workspace members or between an Agent and the owner of its execution machine.

The local Host should remain available when a managed backend is added; the two tiers optimize for different cost and trust requirements.

The following statements are grounded in current behavior:

• Machines connect outward to the Proxy; operators do not need to publish SSH, Agent Server, or local service ports.
• A short-lived, single-use enrollment key creates a long-lived credential bound to one server and one workspace.
• Browser users authenticate, and Proxy lookups are scoped through organization membership and workspace identity.
• Passwords, enrollment secrets, and machine credentials are hashed at rest.
• The stable Host owns processes on the enrolled machine rather than moving the runtime into an opaque hosted control plane.
• Remote working directories and transfer paths are constrained to the declared workspace root.
• Linux Agent network traffic crosses a namespace and Controller policy boundary, which can support stronger egress rules later.
• Linux Agent DNS resolution uses namespace-private resolver mounts and cannot reuse the host nscd socket, so virtual-host routing is not bypassed by host name-service plugins or cached answers.
• Registered machine services describe host-network endpoints. Registration, health probing, and routing do not cause Treer to own or sandbox the external service process.
• The Proxy is open source and can be self-hosted, inspected, and replaced.
• Managed Agents can exchange their private workload credential for a 60-second, Ed25519-signed token bound to one registered service. The Proxy resolves the stable Agent, machine, workspace, and service IDs before signing.

These properties support the product phrase: local custody, scoped coordination, open control plane.

Do not describe the current system as:

• zero trust or safe for mutually untrusted tenants;
• a guarantee that Agents cannot read files outside the workspace;
• per-user isolation of Codex, Claude, or other provider subscriptions;
• end-to-end encrypted from the central control plane;
• an enterprise sandbox or microVM runtime;
• fully attributable or auditable per human user.

The current Controller launches coding agents with permission-bypass flags. The Linux wrapper isolates networking but not the host filesystem. The production policy implementation currently permits all evaluated actions. Local Controller access trusts the loopback boundary, and authorized workspace members share a broad operational surface.

Codex and Claude currently inherit the authenticated CLI state of the operating system account running the Host. Treer has no provider credential vault, credential-owner binding, per-user runtime environment, token-usage ledger, quota, or invoice model. Placing personal subscription credentials on a shared Host would therefore extend trust to that Host and its operators; workspace scoping alone does not isolate those credentials.

The Proxy can observe control messages, every requested network destination, and relayed terminal, transfer, and workspace virtual-host data. Ordinary outbound TCP payload stays between the source Controller and destination; the Proxy authorizes its route but cannot observe its payload through Treer. Browser-to-service tunneling strips cookies, authorization headers, proxy authorization, and response Set-Cookie before forwarding, but this is not end-to-end confidentiality from the Proxy.

The workload signing private key is stored in the Proxy PostgreSQL database. Its Ed25519 public key is intentionally exposed through /.well-known/jwks.json; the online verify endpoint exposes only claims already contained in a supplied valid token. Tokens are not automatically attached to HTTP or generic TCP traffic.

Durable identity data is stored in PostgreSQL. Live connections, pending commands, terminal streams, transfers, and tunnels are held in process memory. Current availability and routing assume one active Proxy instance.

Strengthen the paths that real use makes important, while keeping the trust tier explicit:

1. Emit append-only attribution and usage events before attempting billing.
2. Replace allow-all policy with reviewed defaults and auditable decisions.
3. Bind provider credentials and runtime actions to explicit owners.
4. Add filesystem/container or microVM isolation for managed workloads.
5. Add durable audit, revocation UX, quotas, and incident diagnostics.

Review this document with any change to authentication, credentials, policy, networking, path handling, process launch flags, tenancy, or product security language. Relevant source boundaries are auth.rs, policy.rs, sandbox.rs, and network.rs.