privatae-bastion/docs/console.md

Local console

privatae-bastion ui opens a page served by the running daemon on 127.0.0.1 and reachable from nowhere else. It works with no Host connected.

Who it opens for. The account the bastion runs as signs in with that account's own key: on an install for one account, that account; installed for the whole machine, the machine's administrator (sudo -H privatae-bastion ui). On Linux and macOS the whole-machine bastion also opens for one more account, the machine's owner, recorded by the installer on your own computer (the account that ran it through sudo; never on a shared machine) or by hand with sudo -H privatae-bastion approvals-owner --account <name>. Run there, ui asks the bastion over its local socket, which learns the asking account from the kernel, and gets a one-use link to a limited session (consolelane.go). Any other account is refused. A limited session shows everything and does everything that takes your code or only narrows reach. What widens reach and takes no code stays with the administrator, and the page shows their command in its place: connecting a Host, setting up or replacing your code, choosing the Host in charge, proposing a folder or checking a path, approving the approval device's requests, and the disk map, which, read as root, names files in every account's home. One account may have 16 links waiting to be opened. A Host's requests can be answered there with that Host's code, and wrong codes are throttled there as yours are.

• Agents (the home page): every AI agent running here and what it is doing. For Claude Code, the session's name and title, whether it is waiting for you and on what, and its permission mode, read from Claude Code's own session files; for every agent, its folder and git branch, how long it has run, who started it, what it is running now, and the tool servers it started. Flags: permission prompts off, not marked as yours, the stopping rule would stop it. Until your code is set up and a baseline is recorded, the page starts with the steps to do that. Each agent has its own page: its MCP tool servers and their problems, whether it is yours, the stopping rule's verdict, how the bastion knows what it is, Stop this session and This one is mine.
• Waiting for you: what is asked of this machine (a stop another agent asked for, with who asked) and what your Hosts ask, each answered with a code. Deny needs no code.
• Activity: what happened here, newest first: stops, your approvals, what each Host did, Hosts connected or removed, marks, capabilities switched off.
• This machine: the bastion's state and the Hosts it serves; scheduled jobs that start an agent; MCP tool servers on this machine and their problems; changes since your baseline (compare, or record a new one); Write report, one Markdown file with no model in it; what this machine has given away (where you switch a Host's capabilities off); the disk map.
• Settings: your code (an authenticator app, set up with a QR), the Hosts connected and what each may do, connecting one, the Host in charge on a shared machine, and the owner name.

Your code. Stopping an agent, marking one as yours, answering what is asked of this machine, recording a baseline, releasing a Host from quarantine and setting the owner name take a code from your authenticator, typed on the page: anything that can drive your browser can press a button, and cannot read your phone. Taking access away (disconnecting a Host, switching a capability off, denying) needs no code. The code only keeps agents out when the bastion is installed for the whole machine: installed in your own account, an agent running as you can read the secret behind it, and the console says so on every page.

On Windows a tray icon shows a one-line state. Run as you, it opens what is waiting for your approval, the console and your context page, and can stop the bastion. Beside the system service it opens approvals only.