Browser → blind relay → agent terminal, passkey-authenticated, E2E encrypted.
(Project: Miranda. Binaries: mir client, mir-agent, mir-signal relay.
Go module path stays github.com/srcful/terminal-relay/go — internal, not the
brand. See docs/naming.md.)
- The relay never sees plaintext. Only
owner_id,machine_id, metadata. - Go and JS crypto MUST stay byte-identical —
testdata/vectors are the gate. After changing any handshake/derivation code, runcd go && go test ./...andcd web && npm test; if vectors legitimately change, regenerate withUPDATE_VECTORS=1 go test ./internal/noise/ -run TestInteropVectorsStable. - Owner identity derives from the passkey
prfoutput; never store the owner private key — re-derive it per device.
go/—mir-agent,mir-signal, themirclient, sharedinternal/packages.web/— browser client (vanilla JS + xterm.js).docs/superpowers/{specs,plans}/— design + plans.