Endpoints and connections

An endpoint identifies one daemon. A route is one configured way to reach it. Multiple routes can belong to the same endpoint, but none may replace daemon identity verification or expand a client grant.

Choose a route

Route	Best fit	Network behavior
Local	client and daemon under the same OS user	local socket, no network service
SSH	existing trusted SSH access	bootstraps AnyTTY through SSH and remote loopback ports
Direct	controlled LAN or explicit reachable address	connects to the daemon listener directly
Cloud	discovery across networks with P2P and Relay fallback	uses enrollment, Edge, P2P negotiation, and optional Relay

Use SSH when it is already your trusted administrative path. Use Direct only where the listener and firewall boundary are understood. Cloud solves discovery and difficult-network reachability; it does not replace pairing.

Manage endpoints

anytty endpoint add
anytty endpoint list
anytty endpoint show ENDPOINT
anytty endpoint update ENDPOINT
anytty endpoint set-default ENDPOINT

add has route-specific forms for Local, SSH, Direct, and Cloud. Keep labels human-readable, but verify the daemon identity and route details rather than trusting a label alone.

Policy and multiple routes

anytty endpoint route --help
anytty endpoint policy show ENDPOINT

General route policy supports auto, direct, ssh, or cloud. Cloud path policy supports auto, p2p, relay, or smart_route, and Relay transport supports auto, udp, or tcp. Use a forced value to diagnose one path; use automatic policy only after individual routes pass.

Fallback changes the network path, not the endpoint identity or authorization. A failed pin, authentication, or grant check must remain a failure.

SSH

Verify system SSH access first, including user, key, proxy jump, and host key. The route defaults to remote loopback signaling at 127.0.0.1:41120 and ICE-TCP at 127.0.0.1:41121; both are configurable. Pin the SSH host key and investigate a mismatch before accepting any replacement.

Direct

Start or configure a Direct listener with the daemon’s --route HOST:PORT. A wildcard host enables paired-device LAN discovery and expands exposure. Restrict interfaces and firewall rules to the intended network; do not place an unaudited listener directly on the public Internet.

Cloud

Cloud uses daemon enrollment for discovery, then can attempt P2P or use Relay. The client still needs a daemon-issued grant. Use cloud status and cloud edge to inspect the local runtime, then test the Cloud route separately.

Diagnose a path

anytty endpoint test ENDPOINT --route ROUTE

Test each route directly before evaluating automatic fallback. Capture the route type, event time, endpoint identity fingerprint, and redacted error, but never include credentials or claims.

Terminal showing a demo endpoint, automatic route policy, and a successful local route test — A local demo endpoint showing its route policy and a successful reachability test.

endpoint disable keeps configuration but prevents use; enable restores it. remove deletes the registry entry and is not the same as revoking daemon access. Revoke the grant separately when retiring a client.

endpoint share transfers portable routes and policy through a one-time TLS session. It does not transfer daemon authorization. The default listener is 0.0.0.0:41130 with a 10-minute lifetime, so bind and advertise only receiver-reachable trusted addresses.