npm - @midhunxavier/code-flow - Versions diffs - 0.0.0-stage → 0.1.0-preview.1 - Mend

@midhunxavier/code-flow 0.0.0-stage → 0.1.0-preview.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (284) hide show

package/LICENSE +21 -0
package/README.md +122 -2
package/bin/codeflow.mjs +8 -0
package/bin/launcher.mjs +127 -0
package/dist/remote-host.json +1 -0
package/licenses/inter.txt +92 -0
package/licenses/preact.txt +21 -0
package/licenses/signals-core.txt +21 -0
package/licenses/signals.txt +21 -0
package/licenses/typescript-notices.txt +193 -0
package/licenses/typescript.txt +55 -0
package/licenses/uqr.txt +22 -0
package/licenses/xterm-fit.txt +19 -0
package/licenses/xterm.txt +21 -0
package/package.json +34 -4
package/public/assets/browser-7XI52A6V.js +8 -0
package/public/assets/changes-EYFPASEI.js +1 -0
package/public/assets/chunk-7H3ZLTKA.js +2 -0
package/public/assets/chunk-L7TUCIYF.js +1 -0
package/public/assets/chunk-LLMQG23J.js +163 -0
package/public/assets/main-KIRM2OEK.js +1 -0
package/public/assets/settings-QJZVW22Y.js +9 -0
package/public/assets/styles-615EBB20.css +32 -0
package/public/assets/terminal-A2FI2NAX.js +62 -0
package/public/assets.json +1 -0
package/public/bundle-meta.json +1 -0
package/public/docs/.nojekyll +0 -0
package/public/docs/accessibility.html +19 -0
package/public/docs/acp-agents.html +117 -0
package/public/docs/agent-containers.html +79 -0
package/public/docs/api.html +1130 -0
package/public/docs/app.js +342 -0
package/public/docs/application-improvements.html +275 -0
package/public/docs/architecture-explorer.html +19 -0
package/public/docs/architecture.html +149 -0
package/public/docs/auto-team.html +142 -0
package/public/docs/automations.html +109 -0
package/public/docs/checkpoint-review.html +37 -0
package/public/docs/code-hosts.html +35 -0
package/public/docs/code-intelligence.html +35 -0
package/public/docs/configuration.html +346 -0
package/public/docs/context-inspection.html +23 -0
package/public/docs/coordinated-changes.html +28 -0
package/public/docs/deferred-runs.html +25 -0
package/public/docs/dependency-discovery.html +19 -0
package/public/docs/documentation.html +84 -0
package/public/docs/dynamic-teams-evaluation.html +174 -0
package/public/docs/dynamic-teams-implementation-plan.html +882 -0
package/public/docs/dynamic-teams-implementation-review-1.html +141 -0
package/public/docs/dynamic-teams-plan-review-0.html +204 -0
package/public/docs/extensions.html +42 -0
package/public/docs/external-sources.html +96 -0
package/public/docs/filesystem-policy.html +26 -0
package/public/docs/filtered-tasks.html +44 -0
package/public/docs/font-license.txt +92 -0
package/public/docs/getting-started.html +118 -0
package/public/docs/github-review-threads.html +26 -0
package/public/docs/github.html +157 -0
package/public/docs/help.html +69 -0
package/public/docs/index.html +77 -0
package/public/docs/installation.html +74 -0
package/public/docs/launch-profiles.html +48 -0
package/public/docs/maintenance.html +60 -0
package/public/docs/memory-claims.html +31 -0
package/public/docs/memory-storage.html +58 -0
package/public/docs/notifications.html +39 -0
package/public/docs/patterns.html +195 -0
package/public/docs/performance-results.html +210 -0
package/public/docs/performance.html +166 -0
package/public/docs/project-conventions.html +22 -0
package/public/docs/project-first-navigation-plan.html +587 -0
package/public/docs/project-teams-implementation-plan.html +772 -0
package/public/docs/project-teams.html +99 -0
package/public/docs/provider-compatibility.html +20 -0
package/public/docs/releasing.html +61 -0
package/public/docs/remote-workers.html +64 -0
package/public/docs/review-inbox.html +26 -0
package/public/docs/run-storage.html +23 -0
package/public/docs/runs.html +141 -0
package/public/docs/search.json +1 -0
package/public/docs/security.html +133 -0
package/public/docs/shared-projects.html +31 -0
package/public/docs/ssh-projects.html +60 -0
package/public/docs/style.css +768 -0
package/public/docs/task-reruns.html +30 -0
package/public/docs/team-collaboration.html +379 -0
package/public/docs/verification.html +22 -0
package/public/docs/vscode.html +53 -0
package/public/docs/worker-permission-verification.html +122 -0
package/public/index.html +17 -0
package/scripts/check-node.mjs +7 -0
package/scripts/codeflow.mjs +55 -0
package/scripts/pty.py +273 -0
package/src/acp-connections.js +110 -0
package/src/adapters/acp-presets.js +37 -0
package/src/adapters/acp-types.js +0 -0
package/src/adapters/acp.js +328 -0
package/src/adapters/agy-auth.js +67 -0
package/src/adapters/agy-isolation.js +223 -0
package/src/adapters/agy.js +297 -0
package/src/adapters/claude.js +220 -0
package/src/adapters/codex-app-server.js +518 -0
package/src/adapters/codex.js +299 -0
package/src/adapters/errors.js +57 -0
package/src/adapters/index.js +91 -0
package/src/adapters/managed-permissions.js +37 -0
package/src/adapters/model-discovery.js +100 -0
package/src/adapters/process.js +418 -0
package/src/adapters/team-tools.js +102 -0
package/src/adapters/types.js +0 -0
package/src/agent-container.js +155 -0
package/src/approvals.js +121 -0
package/src/architecture.js +456 -0
package/src/assets.js +44 -0
package/src/automation.js +901 -0
package/src/certificate-renewal.js +75 -0
package/src/chat-handoff.js +55 -0
package/src/checkpoint-review.js +72 -0
package/src/checks.js +303 -0
package/src/code-host-git.js +102 -0
package/src/code-hosts-api.js +99 -0
package/src/code-hosts.js +482 -0
package/src/code-intelligence-worker.mjs +452 -0
package/src/code-intelligence.js +141 -0
package/src/collab/api.js +365 -0
package/src/collab/checkpoints.js +198 -0
package/src/collab/connections.js +139 -0
package/src/collab/host-execution.js +347 -0
package/src/collab/hub-client.js +210 -0
package/src/collab/link-api.js +229 -0
package/src/collab/link.js +595 -0
package/src/collab/model.js +496 -0
package/src/collab/runner.js +1014 -0
package/src/collab/store.js +1452 -0
package/src/collab/terminals.js +361 -0
package/src/collaboration-reviews.js +116 -0
package/src/config.js +48 -0
package/src/context-budget.js +14 -0
package/src/context-inspection.js +204 -0
package/src/context.js +154 -0
package/src/conventions.js +283 -0
package/src/coordinated-api.js +247 -0
package/src/deferred-launch.js +82 -0
package/src/deferred-runs.js +515 -0
package/src/dependency-health.js +35 -0
package/src/diff.js +43 -0
package/src/docs-help.js +316 -0
package/src/doctor.js +232 -0
package/src/engine.js +4366 -0
package/src/env.js +44 -0
package/src/experience.js +50 -0
package/src/extensions.js +144 -0
package/src/filesystem-access.js +107 -0
package/src/filesystem-policy.js +238 -0
package/src/filtered-task-limits.js +93 -0
package/src/filtered-tasks-api.js +53 -0
package/src/filtered-tasks.js +576 -0
package/src/fs.js +57 -0
package/src/git.js +626 -0
package/src/github-review-threads.js +181 -0
package/src/github.js +538 -0
package/src/http.js +69 -0
package/src/improve-settings.js +38 -0
package/src/improve.js +187 -0
package/src/integrations.js +373 -0
package/src/integrity.js +259 -0
package/src/journey-api.js +77 -0
package/src/journey-replay.js +65 -0
package/src/journey-store.js +97 -0
package/src/journeys.js +60 -0
package/src/json.js +81 -0
package/src/launch-profiles.js +292 -0
package/src/learnings.js +80 -0
package/src/log.js +39 -0
package/src/maintenance.js +335 -0
package/src/memory-analysis.js +182 -0
package/src/memory-claims.js +153 -0
package/src/memory-sqlite.js +236 -0
package/src/memory.js +552 -0
package/src/merge-validation.js +58 -0
package/src/model-catalog.js +238 -0
package/src/model-research.js +91 -0
package/src/notes.js +176 -0
package/src/notifications.js +413 -0
package/src/patterns/auto-team-model.js +212 -0
package/src/patterns/auto-team.js +659 -0
package/src/patterns/council.js +199 -0
package/src/patterns/debate.js +188 -0
package/src/patterns/findings.js +141 -0
package/src/patterns/index.js +19 -0
package/src/patterns/loop.js +158 -0
package/src/patterns/pipeline.js +125 -0
package/src/patterns/prompts.js +181 -0
package/src/patterns/race.js +147 -0
package/src/patterns/schemas.js +40 -0
package/src/patterns/solo.js +49 -0
package/src/patterns/supervisor.js +235 -0
package/src/patterns/task-draft.js +29 -0
package/src/patterns/tdd.js +231 -0
package/src/patterns/team-strategies.js +67 -0
package/src/performance.js +43 -0
package/src/persistence-status.js +35 -0
package/src/phone-sessions.js +96 -0
package/src/preview-overlay.js +383 -0
package/src/preview.js +219 -0
package/src/privacy.js +23 -0
package/src/project-report.js +22 -0
package/src/project-team-model.js +178 -0
package/src/project-team-policy.js +42 -0
package/src/project-team-store.js +213 -0
package/src/project-teams-api.js +36 -0
package/src/project-teams.js +551 -0
package/src/projects.js +286 -0
package/src/provider-eligibility.js +9 -0
package/src/readiness.js +98 -0
package/src/remote-tls.js +66 -0
package/src/remote-workers/bundles.js +198 -0
package/src/remote-workers/client.js +332 -0
package/src/remote-workers/durability.js +37 -0
package/src/remote-workers/protocol.js +68 -0
package/src/remote-workers/stdio.js +138 -0
package/src/remote-workers/worker.js +304 -0
package/src/remote.js +204 -0
package/src/repo-config.js +201 -0
package/src/repo-coordination.js +732 -0
package/src/repo-tree.js +106 -0
package/src/retention-policy.js +466 -0
package/src/review-inbox.js +38 -0
package/src/routing.js +49 -0
package/src/run-analysis.js +111 -0
package/src/run-cold-store.js +231 -0
package/src/run-environment.js +15 -0
package/src/run-history.js +91 -0
package/src/run-log.js +160 -0
package/src/run-permissions.js +110 -0
package/src/run-projection.js +75 -0
package/src/run-recovery.js +53 -0
package/src/run-status.js +54 -0
package/src/serve.js +138 -0
package/src/server.js +2738 -0
package/src/shared-access.js +103 -0
package/src/shared-accounts.js +301 -0
package/src/shared-api.js +239 -0
package/src/shell.js +346 -0
package/src/ship.js +344 -0
package/src/slots.js +74 -0
package/src/snapshot.js +388 -0
package/src/source-context.js +17 -0
package/src/sse-writer.js +70 -0
package/src/ssh-projects/bootstrap.mjs +95 -0
package/src/ssh-projects/config.js +45 -0
package/src/ssh-projects/gateway.js +143 -0
package/src/ssh-projects/manager.js +320 -0
package/src/ssh-projects/team-autostart.mjs +93 -0
package/src/ssh-projects/team-remove.mjs +69 -0
package/src/ssh-projects/team-status.mjs +39 -0
package/src/ssh-projects/transport.js +116 -0
package/src/stats.js +139 -0
package/src/store.js +544 -0
package/src/stream.js +91 -0
package/src/sweeps.js +241 -0
package/src/tailscale.js +101 -0
package/src/task-draft.js +23 -0
package/src/team-evaluation.js +242 -0
package/src/team-mailbox.js +160 -0
package/src/team-memory.js +84 -0
package/src/team-rerun-graph.js +15 -0
package/src/team-reruns.js +130 -0
package/src/team-scheduler.js +121 -0
package/src/team-template-store.js +98 -0
package/src/team-templates.js +117 -0
package/src/team-tool-client.mjs +79 -0
package/src/team-tools.js +176 -0
package/src/teams.js +0 -0
package/src/templates.js +62 -0
package/src/transcript.js +134 -0
package/src/verification-integrity.js +27 -0
package/src/verification.js +183 -0
package/src/watch.js +195 -0
package/src/work-queue.js +47 -0
package/src/workflow-control.js +83 -0
package/src/workspace-api.js +207 -0
package/src/workspace-changes.js +61 -0
package/src/workspace.js +146 -0

package/public/docs/security.html ADDED Viewed

@@ -0,0 +1,133 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="description" content="Security, subscriptions and caveats — code-flow guides and reference"><title>Security, subscriptions and caveats · code-flow</title><link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAGAAAABgCAYAAADimHc4AAAbSElEQVR42u19a7Ak53nW87xfz5zbrtYSNnbwRU4UGywZE2E5GKfCerETxUlRIVRWVUBcXBJLOKU4wchA7IKzBxzsXCCxQ1JEIT9SCUXYjQMEKiQorpWILSmJpJjgtZEdZGQby7Zuez17zkx/78OP7+ue7p6eOXPO7kryiedU15mZ7pnufi/Pe/8G+OrjWX3wyp9ChBrnOvFMnPMyPo5COAbgGARSXxkXvS6DFHBcYV+J67oMJ1VAsuemBhxXwFEIpE8UQLZ27/nn0w78iTLieTAMxxHEGIk5gqKgEDAlXbEEiur9EsBSel4Q3AJQlJdBPyOIAoDDMAALh5UOg0phqRhH4NzSeOuJ7atPP45v+JoLjfsiTsBwC+Ozz4AkEbWKLn9081rZ8IgUDrv7jXR7MYRDCBi4Ae7pzE2Fri5E1XMB6hwDAMwHOtI+dT4L5c9OXWN+j5OTsPO9ZPt4AFAJUH6BtC+BeLhk/Ag8/Bb+Mh9sQCxbQveMMUAiAAOTFKw+oJu9xNtY4s1cxSEYoHGSXs/S6oI8E4kdojZvnNX7mRHW4E5FaFfnY5nIUoMZuyACK6YQotLpSZAGIAAYAG6AX4A84B4P5c/gmwa/Wmv/HrSBl4SHG4nry/fqm8ywEQLexAESPkTETBBGRzpQ6X9U58bVf2Hsea0usWtZmM0YNr5Dc26+eVzFDAIyAEaIgCBIROGrQDRgXOIuL/GPcZgPQTIQ6r+j/oftGes36Dj+8eHaffFfDMzvGS7jTYMRFDYRrYQoBDmCHAaBcFAC5GlD878mGxr73CfHe+e1Kur79MaKBAKs85pqv0bj/ebrxnVSDirCFBEgFOZQcR5xeBa+EvAtheEjuLt8B0jH+jFmZLhCGpBVbfmjunZQ4JeKFXwzz0MQHECQJwn0TNAKGD1LabWP3QuYoQVNqOpKdA356nneOJCYhripHT3XxGyD2JDWpBlqfJRRBcL4ADA6X/6s3jS4Heviom5rsRfir35E31AU/mvFkn0tz6EEENwRmoQX2nhcS7imbGM/A9TznG0D2/zfhKXuZ2dSoYe5Td6o88EK2ibwJJghcEwNTyPi6uL7R781Nt3Mt+MGBQDx8mmAZCB97V792WC4qwh4IbZRCigqqZ8ifPM9z1pQSfEiBMfOaNq0AXOUaUdta7pS7LFD3efpv8Mm3pRAi6OrUIzOxTvwbcW/XMQwczcGd+X+Cy8ZaPV/FAW+FluIAoLHTPzkkNX4LPVrQFNaey9A85lQMa+JstqJ8nv0TDiDIZPXmmwECAqF+fYQPo7jw/iW4X2V4O6dAVXA8XUP2sGLN941PGiH/RxKCEWM/VLvHY+kBUH5rOqqvxr+f4foTX9fPd6M5km1dkd1qvO8wYguEyo3mUieBgwwMPoBC9tb/nvxnH0zTqHExmzPaGcvKEd7axdufE9x0A77WZRyFJXku9pwU7+uvBa1PZfqdY+30fu8hreGF9TyhmK/JwTPCOwLbjFt8unr9Yb9anpkHvN7YrIPSSCDnUMslu0bsRa/O3mLs+nMRXB/cK/+/LJwfwGYxjA5GDXtj3vjgtEDQ7NwftqaLmCY5xmEKxCSTqQdtTEzNiLoyt8mYYboK2bbI3zUfx+H53lEi3hBDKP4vnAgDHQeUQ62JGIO/PR6P5qD99ph/yyi8wozgW0jzwa8Wp3CMDgcJkCScROwAn/RXzd6Dbj0sVm2oJjrcpIx3D8+Urh9q87B4QjuE99eHenv84TQ3bAAM9QD9pqD65rDlN3YgO55Oc0YNY5jvm9axRSmUJkk5WVYs8Ivhu9w4GO4G4YJ6RZgwNF06Uvj4h1hCdBFuBzmmiZ+RWz3jlvYJbx38wk7aIFmEHcRKNoLA2ZpHvuPk0+YkNxRQlJKIlLkGIDCGwAAb+yPCYp52D+8b+sVNsbNuADIETRDcis/v4aePmlGMyRekPiLYLwukz3QDprRhCM0UheVsFmj/iSHCGIbgPsrcVLLILf68rv9DMjqYuPiu2wZKzqDKE0Y0Ap6vA03wgzY8TlE340hxoJ24VJsQJ8GdfflPJR6YpG0W8QYgPR8nME1AL4wZa9mMiCriyHczHFKH6sj2U2vp2V8+xigGYRdlAm7lf7dHscd0h+zckhdLWBDYQRw7CB0EBolBhybtmDWG/WSWrtPL7QSN2oblMP6DGori9nNTs5jQt8x3vk/61if8/lZW995Fv1s33d5Oy6A1MjOEnJCLio6IARsXlwBABxbxAbckPlblq9hUVytzRyketu4TuXiZ0m4z7AH8yBnlpfU9Yq4g2ZwQc3hgm5tJxSfBJScLmAIyRyX7rCwvTgDXpC/RsWrGQAXooCiie+t4ke2AwsRdRHY0RzXchE3doEE35S/Pw/uOFsI2HU4GlUjSTArAOk8lg88vXhB5vFM2zGua6rZVEKtMjZxjoovoMozYaEPghaFIy0AQ4vA1axzzrNrE61IySHyKbwCT2YN0M4acCof5HixUr6HLePrO/jlmiH1e/GCFomKL8U4L5q84wxY6yniKEODSdIQYAyfxk3cxPp6byQ8rQGZS2XEquJ0bh+NoMt9B0ldRAK1gHbMO35R4z7rc/M0bIfvaJZFJwm8uhSYWxbsdzJhbXe5IM9MrTKUnGBeyyX1BTBdl2iEL1X6fQFJ36laP2O/OtLPLLJyBt+K0a4K/3XGVcxngNgRCO+JCAU4Z3gos3BykRTDohB0qdHyIvFAH/x0EnN1iZIJo+lyLA1N7veOvxsfw/p63UGycD0gYoaf39dFsBuiawG/HAscs+jmC3hl2sFbm4pVBEQHPbV6mHLBXlULRWrO4MD+FUjhhmPcfVFeAD1vnYtqlhU5L/2gXULRbiBokYwodgEz6km6qaeA3yhs1K4/J1Jq0aMvLweN44f9/4Zfx7rmti/O1ACLM1BLC0rUosS/HJtfhu/AbEehEsSqNMdMOKuYkMt85u6wgjH6uWIt3I4NOj5xgntqS2HV+pI1oS5KqMftmuVmLnqzi6ajF3l+OQv0nWp/XXxvWd7EfcpFQeVKESB8/+hv8n9j/WSBjSPlnhiQawvtbOY8yccupHtRo6tLNMCa4c1wjqGdQqlJIMQpp98TU9ydIssDw+Cj8bv9tuEvY10FNnbuFZ1rAxbKaPoOzNiNG7oTg7CHegF2WeJstaCki2ibhsroOSiXCRHFUlEGuBz/wG8b/mSSfMZFzjQvDmhlPedh/5QA7RZzF80JLZqm7jOq2EVdue9C2MzByOkuYxF8tSjKEp9WwO34Xv53HD5ZYONIXBQEd2YA5msAewik3Ro+7BGisIsE3E7FdzUkPG+CqwqsCAmkKAQOlkzLQFn62SjciRW8H3+LT2bMj7uxQDsyoNmcKk33U7aHKpTqpJrU7rST97SbbOnlMrharCZMGgkDA9MUDdPARiT+yIEPYcV+AX+Xn051lJ0N7iU353JGKp6uhJTG9I25SQllFFyCMyW1xUYue5bEZ51Sp9151jGLULfqyanaxmtjasp+PatCr7LYEIg0boHlpjw8Brc/EvGHHOJ+x9MP4bZrztSEx92eJR+XjwHuRJ5Fq+IMdtMNMbUDaJjyFrqwNdLZ7W1cGG9ja1xirIgylSbgIpjmBPKXctLnUROHk+c9rdDUpPdePZ1TUn83VX2SVgduOgfJ1n5WKTVuO/UUiM/K8RDK8Hs4vfkAfuVVX6i//9afG+ATjztObOxpPKkfDSWCFI/rrqUVvBkXU0G+RYicoItDQOPS9dSF8/rSxfM4W47gdAiGpLuA3NLNVhBbjTVlAlSEF6uBlDxzpcSsuuFG7d7YWppZzWhVhGYjWdVmNlralM7V0olmlxPSYBQNCEUKu3y0TbNPgvwvivgP+NlrTwEAjirgxN6G9WYywI7rrqVlvFmbqQu6PjAKMiIS8C+fOavPX3gKm4gKAyLAkr1CKo56Nc7JiQYo/0+tZEwSWM88TAitNBGUPlOXuyfSKmai11NEzaaRDtx0NKD67hZz0NAWqYqECAqWrRoZEJbAMIS2L2yT4Vdj0PvxwZd9HACxvk5s7E4bZjKgOK67BkttBtAhL8A4Go/1f558XE+U5zFcNgUExDQ+BY+s52g9d07WIztkQyMsE3ZC/JrYlcSrTfy03zLcVARuawXFqdvS9Bv1JyftcOz3BtjqhibgJB1QoeFB+Hhz02g/Wn7xpT+CE4zN2TlcyoxYNqmNxJygIRjPb23xf335c3zKz3FlEIBIlKVD0eFeGUdNZkJbI3Z1cJn2G9rEl0FuSaJlEA0kE5wx4UGaWUwQl5iYta6Cn8m4RL21b4z5Oxu9hta4RutkeqbcNJO8gCRsn4mUr2qwtmF/6rHfWL3jMy/CBh1Hj4dLH9Jr5H4oQAPCz2xt8dTjn8M4jDgMQOkRcoekXAkivOoEpiZhY2tOqCKUZU2ZSLpqzcjgSwMZIAQgb1ImegU9DduQhwHhFYOnhbjhSWF6ULZvLrPd/eG54O5yAgiUi1tPl7TBt26NBh9e+qEvfh1O3JI04ZIYUN2EHAiAXxyN9ckn/p80GCNQ8iz1Qkzg1AjBXEpNkg44JxxwVM307JmkridCAQaIAVCAK0DKhK8I7m2mzZL0JtH7G84rI94dvZjSiMlpGkkC5UYgouD26ZI2uH4cR7+Jd37+pdigL8KE2RBEz6JlkFz61JOPacwtBgc9xjwV6YR7Ijg8e0DKQeSMgd7qPpq5DiQjnQx41oBM8InRZgvTNYuwE3Sf2+2vJhR23drpabA2nyenT4of0woK22dLFiuvsFF5HH//syto+dm7ZIA8k7hA0GPnT+v0+LQNTYwoXXA4HEq8gWJzHqZp0NXo2mWjpVpwqNVOPZWLbRnZJrPYGzGz8bfXUYzezmvO3Gr+ZVgCUXDrTInhVa8P0d+b7MEJ2xsDBEcAMIojfuHs4zYIQowl5FGKLkUXFCV3CUkLIE82ofpr9jGmMDMXTlMVg83As6cXvEX8jsROChesI9mpGipmrAah+TmN2hvt519TEyYedL5lKtjW6QiEH1y5/bPfiBO3xHlGua8thTm9cBEDAGe2zmjLz9MQIURIDleqEbkmxE6vK8LXVwOn6inturmoM67TSk+of9JcPZLLvp7AKUjpEH43s+nEDKNde8+trXJEEAEbhLGP/gkA4PqjWpwBVW+o8TEB4FNbZwFFyBPeyzWZnGMiNl3teSXvwIMmJaWa+KxshVpGMwmqWqPvMzOf1A5TG5yZIu3N0HKBrg22oL0dytR6EDg6J7fiLYN3PPraeQbZejrjUngS7BGNAF0oL5ICPEqClKFeSVItq2p2/SrvJlTC1gANqoYHZnjSItUgTOP+FIm5QFFJszs2WtMmfYExO7xki3x18F4H89nnG6yFUnorAOAT/RfZpwHJrhj+p58XMN5OJqYymmAywWpMhGnOXdV+W6xI6e2kmfWv/KAFRt2ZDXv/wdx9fnpubbIHhiamRWzX0CSQcRsQ3nLt+meWc66Ii2iAACCu4iHfGn0RcoO8BDzDUO4VkDITKs3zbAsEyDOh6+vxLPXKYyUNHMgdSE3DrQ4VOGuFiJ1aNhbtVSEWGz6b5xmhETdk/z1ui+R1j54bvCrPXizAgCqU/nY+LsdJBAxMvk15MsL1mDQqrZjcNXM8ML3ATLYVmdA1M/J7VQuwqq7TJsPqKpCmZ0VnMYScX+HfiVFzpJ/tjEeTiSI7CCbXYDWAeA0A4O67bTE39PoXEADiKPyiI6QuReXJWEmpjCFP3o6ake9EUr3nRps9LMwpiyqCVk4iAIlxyi0H7WHYOS3X6lnniXvrT+kKdnfdm6bdYZMpbHhIVdBpYIyvyqNfC8YBG0cisG54oviwynCvg2tGjQA4PApwpyAyU7mCn0q6cyw7qRAzE5fNpEHaZ3SQuacPk83yQgPkpDXB2HC/1Uw2tBNsO1vb+YTvwstU2qgakbf2MWiMzlfXKAcirk2G+HEtGogJR28gNlgq6qcdwSFGg8fU415HpQKzXVBMBI0xLXeoGlIElMkI06vqmFI5zYW06ERiosfMzGpluawJFYRNWtay8e1I/BQ0a7ZRncq7cVrauwzp5uxaxO7RiMrzBg7Migdmh8k5ghv/9Ev+wGP4ZRefR2AMVjkFdxBOwKmYcb1aVqPWFOUReqUALqZFKl2NLccVysZbMR0rJaaqVO1x1Wal8r6aK3zM8MY4a9EhThFrStrnaYD1MZLTjJndmb7AaiknbhGOHg/lky+7s9TwpDw8z+TbIKIBkYjJDjCnKJmTczUTqtREJcFMGSZW6YpshJurTwjKy45UTZE+sTdopLgbjKiZ0e3lQXtlQM6JG9iFF7aPZ2drQRSnl70hEkSZgcHOJgg6wd0uV+M4cUo4wRiXX7oxjoPfkRdXmTQCVCZyuaA8nCl3gE7PUTMqTFesit21oaVXRjfnl6vXqtZXbDj5uS/HpBasEOydne3WIGpp7KyJ2YIPdt7fxYbJd1XmCLRU2DaDrHik6dzsctXEDQfWDT/Ji/Hpl707+tKveAzLFEJaFVQRiA5FT6LrEVRafYfukGLtmiqlNJJmVHZAnss5XjdbqjIwakRnNeE129j2LH9YE9zQXF+s9T5z/a96vqsNve+lp0xyE/ipFOS+UXvsC9rwPOUxKoGfwt959OMhlN8nlF+flmTVGAbQSxMtlRDFQMlUiYPDkldAA2LICWkDFMhUQkuVL+WlUqvYodlbopBdD0AK2UNiu18mm73uarDsSdqRHReTnSB61hK7ndRFdRnd3WRAuT0Oawcf8uYA5N6XrawamCjcqlWUn38LNLqZ8D8NxgOpouWeWE+DVMhgFCw5xCQEY1VeJAKFANJAN4gmYACiKkMaCBNTQ0JVpZwEruOU4xAIqxeNaaeLmaPT7trEVU2afQzoGuvOc/Y3zFpuG8wpMGexau7jU/GVX3MjbuP40petrKYGUuV/E8CHAH5Ib/3cKxHGr0YcvxLGF4FaBTQAUMgZQJkkg1laTyr58AGSiakMqchcTgmsK2FQgESJhBnBGCAvRFsheDVZvAhLBwI1AsoLqYuI1o5Ru66jdROknE4d9TKjsZAc2VMNUi5hq+KRMFgBXL+J2zie1Tu0SwY00hUQcfhYwD0bEb/0kk8B+BQWnKXYy+xE6zNHFfQirGnzSy+30fiIyL9uw2v+ArUJ+MjFYFKjMYNsDxVNEdX6M6tEDwQ1l0Rhw6azpUykmcetaBz++wgA18/Nl+PSVnk8etzw5VPEn7xBOHFKwMaV/qEDdbF88EMXvge68BNm/kKNz7vTMhNSd8uk+c469ZnqPcywBz3EbywUUdvxjIs5ERA1PBTi+MJv+I+98Dvm9QpdyV+z4JWl/zHi6A3EI08bHrwtAvClH7h4nYqL/4mhfLVGF9xJS9a7yo1YFlrrOIJsB1GzavN1o2x22DiR/hr75SLMow1JhDeU7z/0uzh6PODELfFZ+gkTPDM/xXLrAwXuvGmMd229YqDN+4K2roleSoBVcgnm3mA2OxmnffnZFKoDwLpol6AnSb9BYIylrzy/iFtnf0Y/9vzb5xF/76unP/cewp03jXHrAwP8+PKnSfxzLF1FMgVCoKH+X4ttjguqZQ+tJwawTkSco2laOp5WfW+10LdHLR8q4njzY5J+GOsyXH9Kz/KP+DyTbEgAc/B9uGZ0+olPAniB+yiPtli7v4dsQ1DT2LK/yFM7udlGkA2n12NEsRoiwpcd5V/Cew89vJP07ycNQD2IcewYz72bTzr5gIarAOkwa8QQWbLNJlJvjUjYplLK9RgBjbXU01IAliRfpYYHQrThUxbK78R7Dz2MwyeLnYi//xgAIC0LIJbCownrTcrEaxK6CtBbhLdu3kiZPzkMqWGpYTLcSyxfXbgNP2PBvq3cOHQ/1k8WuGexiZn9x4ATyVUx+hptOnfDOt/TJH73V3wqrEcK0muNybBjhMHdHNLaC4pI/vYwDA6X68Pf3+2gHvcdAyBiHRyUT99vYel1vn3eZWZgmKB47mJQN6HfaAe3yr3s/NgNIZirRFguYigAC++Lb7B/iiMscfhkgXt2N6hn++6H1gAcGG7/mTAYvoa+DQRjLb3513jaBZP2EjAphc/s3TQgxwSTPAiOtauLOBg8guXBt8f3hHfjCFP74T27n5LcXwy4IU3ZjcG/YUtrS5CizDiBH06XKzmBm0T4pr2YGGFzjyxWzFcOmZv/QjxQvD6+i/8tTUmucxGDexmScc9xF5SM+FEdxPbW9yBuw3OhnmxMu0iN1TZSYm1Sk2EjEFYVXLlFwNeuDq74GQXeEd9lv9aYDY64hKVBin1kfA1AXPb4nWFp+Vq/cCYqWKhSBXXTNCdrr9U5uEZRXZz0twVXZLEa4tIAMvz8yjXhPee/l483ZoMv+ccU9w8DTh0TJPJHtm8FCVljSJKsG8iBRo2n2VpSpxYESm4CtHooROERLOOd8Qf5n89fJqnff15QzrWvfECvt63yo9reYpSq2dIaUTyvNz9p47JGBJw9HKFksVqoCHDi30bih3EHn8DhkwXeeLdjY0OXi/j7RwOOZv9/q7wNRWEasRRV1AVyAQ7PDYvsNF/ldT7hbm7UgQOFwx+2If5h/AH+egvr78FlT7MX+8L1vIVx5QN6CS6Wf03bI4gI9bQSmz+fyqnlHQmJLufwYHBzl+GnDrzc/tmZ7+LpidQfKa/U5Rf7w/UENIpvteXiKp2/EEVm42uNlv7cOKtGbcwRiRB0YDU48AdYCe+Mb+fdZ66w1O8jG5Brgj+HleXT5R8Gs+vieMuFVH1GvfZsnpJKU4WgSxSdyweCM25pwJ+Iy198H2578ebEw9n7Ahx/fDTgePqNs8Gm/ootFdfp4kUHc1U+B19pgrDh10dF2jD46lIQcfdwNdyx+bb848yX2cPZ/wyo+mzG8VYNg0TWrr7YmWqS3KKg1YPBDU9hiI3y7fjXJemJ8FcW6/cfBGXXc/BB/TmO4wMhenA52zORuSU1ekRYDj4IiIb/ODiIfzRKK10ZDq8b7tl4RqV+f2jA9chDJPGvDpZCga2yBFnUk+Ak4O6MpK+uheh4NCzjPXo7/90IAG59YIA7X1viHpbP5m0UX8HeT+ptK8uXcynEarY8R7yOUtJwNfhAUMC/8VUc87fxS/XQ9J03jZ8Lt1F8BeM/AaAYLv22Av62Us+pSyCKVfNlIDp+15b4nvj3+OFny8jubzdUIu5GCA/6B0D7PghDwOEFHtaSfRCve/DncdNN44ZrqecS8fdXRezHdT0cL0fAabwWD+EIt9IyYifDc03q99+jbxmA9ZPFTkvFfPVxuZlwXAFHFb5K+K8+Fn78f4eywyDh1HjXAAAAAElFTkSuQmCC"><link rel="stylesheet" href="style.css"><script src="app.js" defer></script></head>
+<body data-page="security"><a class="skip-link" href="#content">Skip to content</a>
+<header class="topbar"><a class="brand" href="index.html"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAGAAAABgCAYAAADimHc4AAAbSElEQVR42u19a7Ak53nW87xfz5zbrtYSNnbwRU4UGywZE2E5GKfCerETxUlRIVRWVUBcXBJLOKU4wchA7IKzBxzsXCCxQ1JEIT9SCUXYjQMEKiQorpWILSmJpJjgtZEdZGQby7Zuez17zkx/78OP7+ue7p6eOXPO7kryiedU15mZ7pnufi/Pe/8G+OrjWX3wyp9ChBrnOvFMnPMyPo5COAbgGARSXxkXvS6DFHBcYV+J67oMJ1VAsuemBhxXwFEIpE8UQLZ27/nn0w78iTLieTAMxxHEGIk5gqKgEDAlXbEEiur9EsBSel4Q3AJQlJdBPyOIAoDDMAALh5UOg0phqRhH4NzSeOuJ7atPP45v+JoLjfsiTsBwC+Ozz4AkEbWKLn9081rZ8IgUDrv7jXR7MYRDCBi4Ae7pzE2Fri5E1XMB6hwDAMwHOtI+dT4L5c9OXWN+j5OTsPO9ZPt4AFAJUH6BtC+BeLhk/Ag8/Bb+Mh9sQCxbQveMMUAiAAOTFKw+oJu9xNtY4s1cxSEYoHGSXs/S6oI8E4kdojZvnNX7mRHW4E5FaFfnY5nIUoMZuyACK6YQotLpSZAGIAAYAG6AX4A84B4P5c/gmwa/Wmv/HrSBl4SHG4nry/fqm8ywEQLexAESPkTETBBGRzpQ6X9U58bVf2Hsea0usWtZmM0YNr5Dc26+eVzFDAIyAEaIgCBIROGrQDRgXOIuL/GPcZgPQTIQ6r+j/oftGes36Dj+8eHaffFfDMzvGS7jTYMRFDYRrYQoBDmCHAaBcFAC5GlD878mGxr73CfHe+e1Kur79MaKBAKs85pqv0bj/ebrxnVSDirCFBEgFOZQcR5xeBa+EvAtheEjuLt8B0jH+jFmZLhCGpBVbfmjunZQ4JeKFXwzz0MQHECQJwn0TNAKGD1LabWP3QuYoQVNqOpKdA356nneOJCYhripHT3XxGyD2JDWpBlqfJRRBcL4ADA6X/6s3jS4Heviom5rsRfir35E31AU/mvFkn0tz6EEENwRmoQX2nhcS7imbGM/A9TznG0D2/zfhKXuZ2dSoYe5Td6o88EK2ibwJJghcEwNTyPi6uL7R781Nt3Mt+MGBQDx8mmAZCB97V792WC4qwh4IbZRCigqqZ8ifPM9z1pQSfEiBMfOaNq0AXOUaUdta7pS7LFD3efpv8Mm3pRAi6OrUIzOxTvwbcW/XMQwczcGd+X+Cy8ZaPV/FAW+FluIAoLHTPzkkNX4LPVrQFNaey9A85lQMa+JstqJ8nv0TDiDIZPXmmwECAqF+fYQPo7jw/iW4X2V4O6dAVXA8XUP2sGLN941PGiH/RxKCEWM/VLvHY+kBUH5rOqqvxr+f4foTX9fPd6M5km1dkd1qvO8wYguEyo3mUieBgwwMPoBC9tb/nvxnH0zTqHExmzPaGcvKEd7axdufE9x0A77WZRyFJXku9pwU7+uvBa1PZfqdY+30fu8hreGF9TyhmK/JwTPCOwLbjFt8unr9Yb9anpkHvN7YrIPSSCDnUMslu0bsRa/O3mLs+nMRXB/cK/+/LJwfwGYxjA5GDXtj3vjgtEDQ7NwftqaLmCY5xmEKxCSTqQdtTEzNiLoyt8mYYboK2bbI3zUfx+H53lEi3hBDKP4vnAgDHQeUQ62JGIO/PR6P5qD99ph/yyi8wozgW0jzwa8Wp3CMDgcJkCScROwAn/RXzd6Dbj0sVm2oJjrcpIx3D8+Urh9q87B4QjuE99eHenv84TQ3bAAM9QD9pqD65rDlN3YgO55Oc0YNY5jvm9axRSmUJkk5WVYs8Ivhu9w4GO4G4YJ6RZgwNF06Uvj4h1hCdBFuBzmmiZ+RWz3jlvYJbx38wk7aIFmEHcRKNoLA2ZpHvuPk0+YkNxRQlJKIlLkGIDCGwAAb+yPCYp52D+8b+sVNsbNuADIETRDcis/v4aePmlGMyRekPiLYLwukz3QDprRhCM0UheVsFmj/iSHCGIbgPsrcVLLILf68rv9DMjqYuPiu2wZKzqDKE0Y0Ap6vA03wgzY8TlE340hxoJ24VJsQJ8GdfflPJR6YpG0W8QYgPR8nME1AL4wZa9mMiCriyHczHFKH6sj2U2vp2V8+xigGYRdlAm7lf7dHscd0h+zckhdLWBDYQRw7CB0EBolBhybtmDWG/WSWrtPL7QSN2oblMP6DGori9nNTs5jQt8x3vk/61if8/lZW995Fv1s33d5Oy6A1MjOEnJCLio6IARsXlwBABxbxAbckPlblq9hUVytzRyketu4TuXiZ0m4z7AH8yBnlpfU9Yq4g2ZwQc3hgm5tJxSfBJScLmAIyRyX7rCwvTgDXpC/RsWrGQAXooCiie+t4ke2AwsRdRHY0RzXchE3doEE35S/Pw/uOFsI2HU4GlUjSTArAOk8lg88vXhB5vFM2zGua6rZVEKtMjZxjoovoMozYaEPghaFIy0AQ4vA1axzzrNrE61IySHyKbwCT2YN0M4acCof5HixUr6HLePrO/jlmiH1e/GCFomKL8U4L5q84wxY6yniKEODSdIQYAyfxk3cxPp6byQ8rQGZS2XEquJ0bh+NoMt9B0ldRAK1gHbMO35R4z7rc/M0bIfvaJZFJwm8uhSYWxbsdzJhbXe5IM9MrTKUnGBeyyX1BTBdl2iEL1X6fQFJ36laP2O/OtLPLLJyBt+K0a4K/3XGVcxngNgRCO+JCAU4Z3gos3BykRTDohB0qdHyIvFAH/x0EnN1iZIJo+lyLA1N7veOvxsfw/p63UGycD0gYoaf39dFsBuiawG/HAscs+jmC3hl2sFbm4pVBEQHPbV6mHLBXlULRWrO4MD+FUjhhmPcfVFeAD1vnYtqlhU5L/2gXULRbiBokYwodgEz6km6qaeA3yhs1K4/J1Jq0aMvLweN44f9/4Zfx7rmti/O1ACLM1BLC0rUosS/HJtfhu/AbEehEsSqNMdMOKuYkMt85u6wgjH6uWIt3I4NOj5xgntqS2HV+pI1oS5KqMftmuVmLnqzi6ajF3l+OQv0nWp/XXxvWd7EfcpFQeVKESB8/+hv8n9j/WSBjSPlnhiQawvtbOY8yccupHtRo6tLNMCa4c1wjqGdQqlJIMQpp98TU9ydIssDw+Cj8bv9tuEvY10FNnbuFZ1rAxbKaPoOzNiNG7oTg7CHegF2WeJstaCki2ibhsroOSiXCRHFUlEGuBz/wG8b/mSSfMZFzjQvDmhlPedh/5QA7RZzF80JLZqm7jOq2EVdue9C2MzByOkuYxF8tSjKEp9WwO34Xv53HD5ZYONIXBQEd2YA5msAewik3Ro+7BGisIsE3E7FdzUkPG+CqwqsCAmkKAQOlkzLQFn62SjciRW8H3+LT2bMj7uxQDsyoNmcKk33U7aHKpTqpJrU7rST97SbbOnlMrharCZMGgkDA9MUDdPARiT+yIEPYcV+AX+Xn051lJ0N7iU353JGKp6uhJTG9I25SQllFFyCMyW1xUYue5bEZ51Sp9151jGLULfqyanaxmtjasp+PatCr7LYEIg0boHlpjw8Brc/EvGHHOJ+x9MP4bZrztSEx92eJR+XjwHuRJ5Fq+IMdtMNMbUDaJjyFrqwNdLZ7W1cGG9ja1xirIgylSbgIpjmBPKXctLnUROHk+c9rdDUpPdePZ1TUn83VX2SVgduOgfJ1n5WKTVuO/UUiM/K8RDK8Hs4vfkAfuVVX6i//9afG+ATjztObOxpPKkfDSWCFI/rrqUVvBkXU0G+RYicoItDQOPS9dSF8/rSxfM4W47gdAiGpLuA3NLNVhBbjTVlAlSEF6uBlDxzpcSsuuFG7d7YWppZzWhVhGYjWdVmNlralM7V0olmlxPSYBQNCEUKu3y0TbNPgvwvivgP+NlrTwEAjirgxN6G9WYywI7rrqVlvFmbqQu6PjAKMiIS8C+fOavPX3gKm4gKAyLAkr1CKo56Nc7JiQYo/0+tZEwSWM88TAitNBGUPlOXuyfSKmai11NEzaaRDtx0NKD67hZz0NAWqYqECAqWrRoZEJbAMIS2L2yT4Vdj0PvxwZd9HACxvk5s7E4bZjKgOK67BkttBtAhL8A4Go/1f558XE+U5zFcNgUExDQ+BY+s52g9d07WIztkQyMsE3ZC/JrYlcSrTfy03zLcVARuawXFqdvS9Bv1JyftcOz3BtjqhibgJB1QoeFB+Hhz02g/Wn7xpT+CE4zN2TlcyoxYNqmNxJygIRjPb23xf335c3zKz3FlEIBIlKVD0eFeGUdNZkJbI3Z1cJn2G9rEl0FuSaJlEA0kE5wx4UGaWUwQl5iYta6Cn8m4RL21b4z5Oxu9hta4RutkeqbcNJO8gCRsn4mUr2qwtmF/6rHfWL3jMy/CBh1Hj4dLH9Jr5H4oQAPCz2xt8dTjn8M4jDgMQOkRcoekXAkivOoEpiZhY2tOqCKUZU2ZSLpqzcjgSwMZIAQgb1ImegU9DduQhwHhFYOnhbjhSWF6ULZvLrPd/eG54O5yAgiUi1tPl7TBt26NBh9e+qEvfh1O3JI04ZIYUN2EHAiAXxyN9ckn/p80GCNQ8iz1Qkzg1AjBXEpNkg44JxxwVM307JmkridCAQaIAVCAK0DKhK8I7m2mzZL0JtH7G84rI94dvZjSiMlpGkkC5UYgouD26ZI2uH4cR7+Jd37+pdigL8KE2RBEz6JlkFz61JOPacwtBgc9xjwV6YR7Ijg8e0DKQeSMgd7qPpq5DiQjnQx41oBM8InRZgvTNYuwE3Sf2+2vJhR23drpabA2nyenT4of0woK22dLFiuvsFF5HH//syto+dm7ZIA8k7hA0GPnT+v0+LQNTYwoXXA4HEq8gWJzHqZp0NXo2mWjpVpwqNVOPZWLbRnZJrPYGzGz8bfXUYzezmvO3Gr+ZVgCUXDrTInhVa8P0d+b7MEJ2xsDBEcAMIojfuHs4zYIQowl5FGKLkUXFCV3CUkLIE82ofpr9jGmMDMXTlMVg83As6cXvEX8jsROChesI9mpGipmrAah+TmN2hvt519TEyYedL5lKtjW6QiEH1y5/bPfiBO3xHlGua8thTm9cBEDAGe2zmjLz9MQIURIDleqEbkmxE6vK8LXVwOn6inturmoM67TSk+of9JcPZLLvp7AKUjpEH43s+nEDKNde8+trXJEEAEbhLGP/gkA4PqjWpwBVW+o8TEB4FNbZwFFyBPeyzWZnGMiNl3teSXvwIMmJaWa+KxshVpGMwmqWqPvMzOf1A5TG5yZIu3N0HKBrg22oL0dytR6EDg6J7fiLYN3PPraeQbZejrjUngS7BGNAF0oL5ICPEqClKFeSVItq2p2/SrvJlTC1gANqoYHZnjSItUgTOP+FIm5QFFJszs2WtMmfYExO7xki3x18F4H89nnG6yFUnorAOAT/RfZpwHJrhj+p58XMN5OJqYymmAywWpMhGnOXdV+W6xI6e2kmfWv/KAFRt2ZDXv/wdx9fnpubbIHhiamRWzX0CSQcRsQ3nLt+meWc66Ii2iAACCu4iHfGn0RcoO8BDzDUO4VkDITKs3zbAsEyDOh6+vxLPXKYyUNHMgdSE3DrQ4VOGuFiJ1aNhbtVSEWGz6b5xmhETdk/z1ui+R1j54bvCrPXizAgCqU/nY+LsdJBAxMvk15MsL1mDQqrZjcNXM8ML3ATLYVmdA1M/J7VQuwqq7TJsPqKpCmZ0VnMYScX+HfiVFzpJ/tjEeTiSI7CCbXYDWAeA0A4O67bTE39PoXEADiKPyiI6QuReXJWEmpjCFP3o6ake9EUr3nRps9LMwpiyqCVk4iAIlxyi0H7WHYOS3X6lnniXvrT+kKdnfdm6bdYZMpbHhIVdBpYIyvyqNfC8YBG0cisG54oviwynCvg2tGjQA4PApwpyAyU7mCn0q6cyw7qRAzE5fNpEHaZ3SQuacPk83yQgPkpDXB2HC/1Uw2tBNsO1vb+YTvwstU2qgakbf2MWiMzlfXKAcirk2G+HEtGogJR28gNlgq6qcdwSFGg8fU415HpQKzXVBMBI0xLXeoGlIElMkI06vqmFI5zYW06ERiosfMzGpluawJFYRNWtay8e1I/BQ0a7ZRncq7cVrauwzp5uxaxO7RiMrzBg7Migdmh8k5ghv/9Ev+wGP4ZRefR2AMVjkFdxBOwKmYcb1aVqPWFOUReqUALqZFKl2NLccVysZbMR0rJaaqVO1x1Wal8r6aK3zM8MY4a9EhThFrStrnaYD1MZLTjJndmb7AaiknbhGOHg/lky+7s9TwpDw8z+TbIKIBkYjJDjCnKJmTczUTqtREJcFMGSZW6YpshJurTwjKy45UTZE+sTdopLgbjKiZ0e3lQXtlQM6JG9iFF7aPZ2drQRSnl70hEkSZgcHOJgg6wd0uV+M4cUo4wRiXX7oxjoPfkRdXmTQCVCZyuaA8nCl3gE7PUTMqTFesit21oaVXRjfnl6vXqtZXbDj5uS/HpBasEOydne3WIGpp7KyJ2YIPdt7fxYbJd1XmCLRU2DaDrHik6dzsctXEDQfWDT/Ji/Hpl707+tKveAzLFEJaFVQRiA5FT6LrEVRafYfukGLtmiqlNJJmVHZAnss5XjdbqjIwakRnNeE129j2LH9YE9zQXF+s9T5z/a96vqsNve+lp0xyE/ipFOS+UXvsC9rwPOUxKoGfwt959OMhlN8nlF+flmTVGAbQSxMtlRDFQMlUiYPDkldAA2LICWkDFMhUQkuVL+WlUqvYodlbopBdD0AK2UNiu18mm73uarDsSdqRHReTnSB61hK7ndRFdRnd3WRAuT0Oawcf8uYA5N6XrawamCjcqlWUn38LNLqZ8D8NxgOpouWeWE+DVMhgFCw5xCQEY1VeJAKFANJAN4gmYACiKkMaCBNTQ0JVpZwEruOU4xAIqxeNaaeLmaPT7trEVU2afQzoGuvOc/Y3zFpuG8wpMGexau7jU/GVX3MjbuP40petrKYGUuV/E8CHAH5Ib/3cKxHGr0YcvxLGF4FaBTQAUMgZQJkkg1laTyr58AGSiakMqchcTgmsK2FQgESJhBnBGCAvRFsheDVZvAhLBwI1AsoLqYuI1o5Ru66jdROknE4d9TKjsZAc2VMNUi5hq+KRMFgBXL+J2zie1Tu0SwY00hUQcfhYwD0bEb/0kk8B+BQWnKXYy+xE6zNHFfQirGnzSy+30fiIyL9uw2v+ArUJ+MjFYFKjMYNsDxVNEdX6M6tEDwQ1l0Rhw6azpUykmcetaBz++wgA18/Nl+PSVnk8etzw5VPEn7xBOHFKwMaV/qEDdbF88EMXvge68BNm/kKNz7vTMhNSd8uk+c469ZnqPcywBz3EbywUUdvxjIs5ERA1PBTi+MJv+I+98Dvm9QpdyV+z4JWl/zHi6A3EI08bHrwtAvClH7h4nYqL/4mhfLVGF9xJS9a7yo1YFlrrOIJsB1GzavN1o2x22DiR/hr75SLMow1JhDeU7z/0uzh6PODELfFZ+gkTPDM/xXLrAwXuvGmMd229YqDN+4K2roleSoBVcgnm3mA2OxmnffnZFKoDwLpol6AnSb9BYIylrzy/iFtnf0Y/9vzb5xF/76unP/cewp03jXHrAwP8+PKnSfxzLF1FMgVCoKH+X4ttjguqZQ+tJwawTkSco2laOp5WfW+10LdHLR8q4njzY5J+GOsyXH9Kz/KP+DyTbEgAc/B9uGZ0+olPAniB+yiPtli7v4dsQ1DT2LK/yFM7udlGkA2n12NEsRoiwpcd5V/Cew89vJP07ycNQD2IcewYz72bTzr5gIarAOkwa8QQWbLNJlJvjUjYplLK9RgBjbXU01IAliRfpYYHQrThUxbK78R7Dz2MwyeLnYi//xgAIC0LIJbCownrTcrEaxK6CtBbhLdu3kiZPzkMqWGpYTLcSyxfXbgNP2PBvq3cOHQ/1k8WuGexiZn9x4ATyVUx+hptOnfDOt/TJH73V3wqrEcK0muNybBjhMHdHNLaC4pI/vYwDA6X68Pf3+2gHvcdAyBiHRyUT99vYel1vn3eZWZgmKB47mJQN6HfaAe3yr3s/NgNIZirRFguYigAC++Lb7B/iiMscfhkgXt2N6hn++6H1gAcGG7/mTAYvoa+DQRjLb3513jaBZP2EjAphc/s3TQgxwSTPAiOtauLOBg8guXBt8f3hHfjCFP74T27n5LcXwy4IU3ZjcG/YUtrS5CizDiBH06XKzmBm0T4pr2YGGFzjyxWzFcOmZv/QjxQvD6+i/8tTUmucxGDexmScc9xF5SM+FEdxPbW9yBuw3OhnmxMu0iN1TZSYm1Sk2EjEFYVXLlFwNeuDq74GQXeEd9lv9aYDY64hKVBin1kfA1AXPb4nWFp+Vq/cCYqWKhSBXXTNCdrr9U5uEZRXZz0twVXZLEa4tIAMvz8yjXhPee/l483ZoMv+ccU9w8DTh0TJPJHtm8FCVljSJKsG8iBRo2n2VpSpxYESm4CtHooROERLOOd8Qf5n89fJqnff15QzrWvfECvt63yo9reYpSq2dIaUTyvNz9p47JGBJw9HKFksVqoCHDi30bih3EHn8DhkwXeeLdjY0OXi/j7RwOOZv9/q7wNRWEasRRV1AVyAQ7PDYvsNF/ldT7hbm7UgQOFwx+2If5h/AH+egvr78FlT7MX+8L1vIVx5QN6CS6Wf03bI4gI9bQSmz+fyqnlHQmJLufwYHBzl+GnDrzc/tmZ7+LpidQfKa/U5Rf7w/UENIpvteXiKp2/EEVm42uNlv7cOKtGbcwRiRB0YDU48AdYCe+Mb+fdZ66w1O8jG5Brgj+HleXT5R8Gs+vieMuFVH1GvfZsnpJKU4WgSxSdyweCM25pwJ+Iy198H2578ebEw9n7Ahx/fDTgePqNs8Gm/ootFdfp4kUHc1U+B19pgrDh10dF2jD46lIQcfdwNdyx+bb848yX2cPZ/wyo+mzG8VYNg0TWrr7YmWqS3KKg1YPBDU9hiI3y7fjXJemJ8FcW6/cfBGXXc/BB/TmO4wMhenA52zORuSU1ekRYDj4IiIb/ODiIfzRKK10ZDq8b7tl4RqV+f2jA9chDJPGvDpZCga2yBFnUk+Ak4O6MpK+uheh4NCzjPXo7/90IAG59YIA7X1viHpbP5m0UX8HeT+ptK8uXcynEarY8R7yOUtJwNfhAUMC/8VUc87fxS/XQ9J03jZ8Lt1F8BeM/AaAYLv22Av62Us+pSyCKVfNlIDp+15b4nvj3+OFny8jubzdUIu5GCA/6B0D7PghDwOEFHtaSfRCve/DncdNN44ZrqecS8fdXRezHdT0cL0fAabwWD+EIt9IyYifDc03q99+jbxmA9ZPFTkvFfPVxuZlwXAFHFb5K+K8+Fn78f4eywyDh1HjXAAAAAElFTkSuQmCC" width="30" height="30" alt=""><strong>Code Flow</strong><span>Docs</span></a><button class="search-trigger" id="open-search">Search documentation <kbd>⌘ K</kbd></button><div class="top-actions"><a href="https://github.com/midhunxavier/code-flow">GitHub ↗</a><button id="theme" aria-label="Change color theme">Theme</button><button id="open-help" class="primary" hidden aria-expanded="false" aria-controls="help-panel">Ask code-flow</button><button id="menu" aria-label="Toggle documentation navigation" aria-expanded="false" aria-controls="sidebar">☰</button></div></header>
+<div class="layout"><nav class="sidebar" id="sidebar" aria-label="Documentation"><section><h2>Get started</h2><a href="index.html" >Overview</a><a href="installation.html" >Install Code Flow preview</a><a href="getting-started.html" >Getting started</a><a href="patterns.html" >Team patterns</a><a href="acp-agents.html" >ACP coding agents</a><a href="help.html" >Ask code-flow</a></section><section><h2>Work with agents</h2><a href="runs.html" >Runs and workspace</a><a href="auto-team.html" >Auto team</a><a href="project-teams.html" >Project missions (preview)</a><a href="review-inbox.html" >Review inbox</a><a href="verification.html" >Verification and review</a><a href="github.html" >GitHub, review and shipping</a><a href="github-review-threads.html" >GitHub review threads</a><a href="task-reruns.html" >Selective task reruns</a><a href="deferred-runs.html" >Deferred runs</a></section><section><h2>Your workspace</h2><a href="configuration.html" >Configuration</a><a href="context-inspection.html" >Context and budgets</a><a href="project-conventions.html" >Versioned project conventions</a><a href="checkpoint-review.html" >Checkpoints and reversions</a><a href="launch-profiles.html" >Service launch profiles</a><a href="code-intelligence.html" >Code intelligence</a><a href="architecture-explorer.html" >Architecture explorer</a><a href="memory-storage.html" >Project memory</a><a href="memory-claims.html" >Semantic claim review</a><a href="coordinated-changes.html" >Coordinated changes</a></section><section><h2>Connect and collaborate</h2><a href="team-collaboration.html" >Team collaboration</a><a href="shared-projects.html" >Shared project accounts</a><a href="ssh-projects.html" >SSH projects</a><a href="remote-workers.html" >Remote agent workers</a><a href="code-hosts.html" >GitLab and Bitbucket code workflows</a><a href="external-sources.html" >Read-only external sources</a><a href="automations.html" >Automations and away mode</a><a href="notifications.html" >Outbound notifications</a></section><section><h2>Operate safely</h2><a href="security.html" aria-current="page">Security, subscriptions and caveats</a><a href="filesystem-policy.html" >Project filesystem policy</a><a href="agent-containers.html" >Agent containers</a><a href="filtered-tasks.html" >Filtered Docker tasks</a><a href="dependency-discovery.html" >Dependency discovery</a><a href="maintenance.html" >Backup and maintenance</a></section><section><h2>Build and extend</h2><a href="architecture.html" >Architecture and development</a><a href="api.html" >Local API and command-line client</a><a href="extensions.html" >Provider and workflow extensions</a><a href="provider-compatibility.html" >Provider compatibility</a><a href="accessibility.html" >Accessibility acceptance</a><a href="performance.html" >Performance</a><a href="run-storage.html" >Run storage</a><a href="documentation.html" >Documentation and GitHub Pages</a><a href="releasing.html" >Preparing a preview release</a><a href="vscode.html" >Code Flow for VS Code</a></section><section><h2>Engineering records</h2><a href="application-improvements.html" >Application improvement program</a><a href="project-first-navigation-plan.html" >Project navigation review and implementation plan</a><a href="dynamic-teams-evaluation.html" >Dynamic teams: implementation evidence and rollout decision</a><a href="dynamic-teams-implementation-plan.html" >Dynamic teams, workflows, messaging, and memory</a><a href="dynamic-teams-implementation-review-1.html" >Review 1: the dynamic teams implementation</a><a href="worker-permission-verification.html" >Live worker permission verification</a><a href="dynamic-teams-plan-review-0.html" >Review 0: Dynamic teams implementation plan</a><a href="project-teams-implementation-plan.html" >Standing project teams implementation plan</a><a href="performance-results.html" >Measured performance: 19 October 2026</a></section><a class="app-link" id="back-app" hidden href="/">← Back to app</a></nav>
+<main id="content" tabindex="-1"><div class="breadcrumb">Documentation <span>/</span> Operate safely</div><article><h1 id="security-subscriptions-and-caveats">Security, subscriptions and caveats</h1>
+<p>Before starting work, decide whether you trust the repository, which agent permissions it needs, and where its checks should run. Read the boundaries below before enabling remote access or Full access.</p>
+<h2 id="how-code-flow-uses-your-subscriptions">How code-flow uses your subscriptions</h2>
+<p>code-flow does not read agent login files. Each adapter launches the vendor&#39;s <strong>official, unmodified CLI</strong> in headless mode, and that CLI uses its own login. Explicit external integrations and notification destinations use server-side environment credential references; those variables are stripped from child processes and filtered from exports:</p>
+<div class="table-scroll" tabindex="0"><table>
+<thead>
+<tr>
+<th>Agent</th>
+<th>Command used</th>
+<th>Login</th>
+<th>Sandbox / permissions</th>
+</tr>
+</thead>
+<tbody><tr>
+<td>Claude Code</td>
+<td><code>claude -p --output-format stream-json</code></td>
+<td>Pro/Max (or API key) via <code>claude</code></td>
+<td>read: edit tools disabled, git read-only commands allowed (never with <code>--output</code>, which writes anywhere, or <code>--no-index</code>, which reads anywhere) · write: <code>acceptEdits</code> + an allow-list of build/test commands (<code>bypassPermissions</code> with Full access)</td>
+</tr>
+<tr>
+<td>Codex</td>
+<td><code>codex app-server</code> (JSON-RPC over stdio: <code>thread/start</code> or <code>thread/resume</code>, <code>turn/start</code>, <code>turn/steer</code>); <code>codex exec --json</code> / <code>codex exec resume</code> when app-server isn&#39;t available</td>
+<td>ChatGPT plan (or API key) via <code>codex login</code></td>
+<td>Codex sandbox: <code>read-only</code> / <code>workspace-write</code> (<code>danger-full-access</code> with Full access); optional one-action approval inbox on supported app-server turns</td>
+</tr>
+<tr>
+<td>Antigravity</td>
+<td><code>agy -p --output-format stream-json</code></td>
+<td>Google AI Pro/Ultra via an interactive <code>agy</code> login</td>
+<td><code>--sandbox</code> (verified: blocks writes outside the worktree; dropped in write steps with Full access) + <code>--dangerously-skip-permissions</code> (see <a href="#caveats">caveats</a>)</td>
+</tr>
+</tbody></table>
+</div><p><strong>Read-only is enforced by code-flow itself, for every agent.</strong> Before a read-only step (plan, review, judge, debate) code-flow snapshots its worktree: the commit, uncommitted changes and untracked files. Afterwards it puts back anything the step changed, including commits, and logs a warning. A side chat&#39;s <strong>Ask</strong> is the exception: you may be working in that worktree at the same time, so what changed is named in a warning and left in place.</p>
+<p>This is the boundary each vendor draws for personal use. Don&#39;t extend code-flow to read or reuse the CLIs&#39; OAuth tokens; Anthropic and Google both prohibit that, and Google has suspended accounts for it. If you ever turn this into a product for other people, each user must sign in with their own account, and Anthropic&#39;s terms then require API keys for products.</p>
+<blockquote>
+<p>Gemini CLI stopped serving Google AI Pro/Ultra/free personal accounts on 2026-06-18. <code>agy</code> is the CLI that serves those plans now.</p>
+</blockquote>
+<h2 id="the-server">The server</h2>
+<ul>
+<li>It listens on <code>127.0.0.1</code> only, checks the Host and Origin headers, and wants a session cookie or Bearer token on every API call (see <a href="getting-started.html#signing-in">signing in</a>).</li>
+<li>The first browser to open code-flow signs in without the link only when it connects directly from this machine, and only until a browser has signed in (that way, with the link, or with its cookie) or code-flow has started an agent, a check or an app. After that, a program here can&#39;t get a session by asking for the page. A tunnel (ngrok, cloudflared) forwarding to the port can rewrite the Host header to <code>localhost</code>, so a request carrying forwarding headers (<code>X-Forwarded-For</code>, <code>Forwarded</code>…) never signs in that way.</li>
+<li>code-flow&#39;s pages are never shown inside another page (<code>X-Frame-Options: DENY</code>, <code>frame-ancestors &#39;none&#39;</code>), so a page elsewhere can&#39;t lay them under a decoy and have you click. The side panel&#39;s Browser frames your app through its preview, on a port of its own, never code-flow itself.</li>
+<li>Choosing <strong>Wi-Fi · local network</strong> under <strong>Remote access</strong> exposes the phone view and webhooks on your local network. Configure HTTPS through <strong>Set up secure remote access</strong>, using a Tailscale certificate or an imported certificate/key pair. Legacy <code>CODEFLOW_TLS_CERT</code> and <code>CODEFLOW_TLS_KEY</code> overrides are also supported. Saved keys have owner-only permissions; setup is local-owner-only, validates identity and dates, and revokes pairing when replacing certificates. Invalid or expired saved certificates disable the listener without an HTTP fallback. Full phone control on Wi-Fi requires HTTPS; <code>CODEFLOW_ALLOW_INSECURE_PHONE_CONTROL=1</code> is an explicit development exception. See <a href="automations.html#phone-view">Automations</a>.</li>
+<li><strong>Tailscale · access anywhere</strong> binds the remote listener only to the IPv4 address reported by the local Tailscale client. Read-only links can use HTTP inside Tailscale&#39;s encrypted connection. Full control still requires HTTPS: Tailscale does not stop browsers from sending non-Secure cookies to other HTTP services on the same IP. Non-Tailscale source addresses and this computer&#39;s own connections are refused. Missing/disconnected Tailscale and bind errors never fall back to a LAN listener. Code-flow reads Tailscale status and requests a certificate during secure-access setup. It subsequently renews that saved Tailscale certificate automatically for the same verified computer name; renewal never changes the host identity or enables full control. It does not configure the tailnet or enable public access. Switching transports rotates access tokens and invalidates paired sessions; switching to Wi-Fi without TLS disables full control. See <a href="automations.html#remote-access-with-tailscale">Tailscale setup</a>.</li>
+<li>That network listener refuses connections from this computer itself, from loopback or any of its own addresses. Programs here, the agents code-flow runs among them, can read <code>~/.codeflow</code>, phone secrets included; through the network listener they could otherwise sign in with full control and run commands outside their sandboxes. (Binding it to the Wi-Fi addresses alone wouldn&#39;t stop that: a program here can connect to those too.)</li>
+<li><strong>Full control from remote devices</strong> signs in with a separate pairing link that expires after ten minutes, including across restarts. Pairing creates a separate 30-day session for each device; only token hashes are stored, TLS cookies are Secure, and individual devices can be revoked. <strong>New link</strong> and disabling remote/full control rotate the generation and invalidate earlier sessions. Cross-origin requests are refused. Paired devices have the owner&#39;s full control; this is not a shared-project roles system. See <a href="automations.html#full-control-from-your-phone">Full control from your phone</a>.</li>
+<li>Webhooks: each automation has its own secret (a Bearer token, or GitHub&#39;s signature). Secrets live in <code>~/.codeflow</code> (webhook secrets in <code>triggers.json</code>), which programs running as you can read, the agents included. So text a webhook sends (<code>details</code>) reaches the agents fenced as information, not instructions, and its run&#39;s reviews aren&#39;t learned as lessons. A GitHub delivery sent again is ignored, whatever its delivery id (the signature doesn&#39;t cover the id), and webhooks start a limited number of runs an hour. See <a href="automations.html#webhooks">Webhooks</a>.</li>
+<li>The Browser&#39;s <strong>Snapshot</strong> loads pages in a headless Chrome on this computer, so it refuses addresses on this computer and link-local ones (where cloud machines keep their metadata service), checking every address a name resolves to. What the page asks for as it loads, redirects included, is checked the same way. The exception is a local app at its <code>http://localhost:&lt;port&gt;</code> address, as the Browser shows it, never code-flow&#39;s own port. Private network addresses are fine. Not covered: WebSockets, requests from workers, and a name that resolves differently a moment later (DNS rebinding).</li>
+</ul>
+<h2 id="running-the-agents-code">Running the agents&#39; code</h2>
+<p>Composer Improve uses an empty private Git repository for Quick mode and a bounded
+committed snapshot for repository mode. It copies no source Git history, remotes,
+hooks, working-copy drafts or executable provider configuration. Cleanup removes
+only that private directory and never resets the source checkout. Native Safe/read
+permissions remain a CLI boundary rather than an OS filesystem sandbox; filesystem
+restrictions block Improve entirely. See <a href="getting-started.html#your-first-run">Improve setup and limits</a>.
+App-managed subprocesses use absolute PATH entries, including explicit environment
+overrides. On macOS/Linux, an absent or unusable PATH falls back to <code>/usr/bin:/bin</code>
+so repository-owned tools cannot be selected through the current directory.</p>
+<p>Local shared-project accounts grant scoped viewer, reviewer, contributor and
+maintainer access through closed shared review and team-board API surfaces. Roles alone do not delegate execution or the owner&#39;s phone capability. Separately, the owner can grant per-project host execution to individual contributors through the <a href="team-collaboration.html#let-teammates-run-tasks-on-the-host">host queue</a>. Its dedicated routes accept only task identity and revision, use owner-selected CLIs and limits, and enforce queue ownership and live grants. This is trusted host execution, not an OS sandbox; agents and repository checks retain the host&#39;s available authority. Generic owner shell APIs remain unavailable. A separate, default-off <a href="team-collaboration.html#give-trusted-teammates-an-interactive-terminal">terminal grant</a> permits individual contributors to open their own interactive shell as the host OS user. Project grants determine the starting folder, not a filesystem boundary. Shell users can reach host files, credentials and other processes; only grant this to trusted people. The app enforces session ownership, bounded input/output, live revocation and a 30-minute keyboard idle timeout. Closing a session does not undo changes or reliably stop detached processes.
+Browser sessions expire and revoke immediately. Shared-review projections omit raw transcripts, private context and
+host paths; explicitly granted terminals return raw output to their creator and can reveal those details. See <a href="shared-projects.html">shared projects</a>.</p>
+<p><a href="team-collaboration.html">Team collaboration</a> adds a per-machine runner credential
+bound to a shared account. It is shown once, stored only as a hash on the team
+server, reaches only the team routes and is revoked there in one step; the
+owner&#39;s own token is matched before a bearer is read as a runner credential, and
+the files that hold credentials on a linked computer (<code>team-connections/</code> and legacy <code>team-link.json</code>) are
+left out of backups like the other credential stores. The team server never
+reaches into a teammate&#39;s machine: every connection is outbound from that
+machine, to the exact address its owner entered (a redirect or an untrusted
+certificate is refused), and execution starts only from each computer&#39;s own
+code-flow, with that person&#39;s own CLI logins, in a worktree there. Progress,
+checkpoints and discussion are the only things that travel; transcripts, local
+paths and copied secret files stay where the run is, and the reasons published
+for failed, stopped or lost attempts have local paths replaced by <code>&lt;local path&gt;</code>.
+Teammates&#39; comments never enter a prompt; an instruction they send to an agent
+reaches it only after the task&#39;s owner, or a maintainer of its project (the team
+server&#39;s owner is one everywhere), approves it, and then as a message to the run
+attributed to its author; a hand-over checkpoint&#39;s context arrives fenced as
+information, not instructions.</p>
+<p>Custom <a href="filesystem-policy.html">filesystem policies</a> enforce application reads,
+writes and filtered diffs, and pause ordinary code execution globally where its
+backend cannot enforce those rules. Saved restrictions are checked before
+trusted extension code is imported. <a href="extensions.html">Extensions</a> are explicit,
+version/hash-pinned owner-trusted server code with full process authority, not
+untrusted sandboxed plugins.</p>
+<p><a href="remote-workers.html">SSH workers</a> use provisioned targets, strict host keys,
+worker-local credentials and durable private receipts. A disconnected accepted
+turn is uncertain; reconnecting does not execute it again. <a href="code-hosts.html">GitLab/Bitbucket
+code workflows</a> require prepared agent containers for fetched PR
+code and use exact-ref Git leases for publication. Provider-native approval
+policy and PR closure cannot be transacted atomically with a Git push; unknown
+policies and unsupported queues fail closed.</p>
+<p>A check runs the agents&#39; code (tests, scripts) on your machine, outside Codex&#39;s and agy&#39;s sandboxes, as your CI would. With <strong>Full access</strong> the agents themselves run without a sandbox too (see <a href="configuration.html#what-agents-may-do-while-building">What agents may do</a>). Use code-flow on repos and tasks you trust, or run checks in Docker (<a href="automations.html#isolation">isolation</a>), or code-flow itself inside a container or VM.</p>
+<p>Text from issues, PRs, comments and CI logs is treated as untrusted, and runs started from people outside the repo are locked down. Dependabot&#39;s PR descriptions and CI logs are fenced as untrusted text too, and so are code scanning messages, which quote the code they flag. <strong>▶ Run app</strong> on a locked-down run asks before it starts that code on your machine. See <a href="github.html#untrusted-text">Untrusted text</a>.</p>
+<p>Files copied into worktrees from your checkout (<code>copy</code>, e.g. <code>.env</code>) never go into the agents&#39; commits, and neither do new files named like secrets. They&#39;re never copied through a symlink an agent left in the worktree. See <a href="configuration.html#per-repo-config">Per-repo config</a>.</p>
+<h2 id="your-checkout-and-the-worktrees">Your checkout and the worktrees</h2>
+<p>A broken worktree is never mistaken for your checkout. Worktrees live inside your repository (<code>.worktrees/&lt;run&gt;/&lt;name&gt;</code>), and the <code>.git</code> file that ties each one to it is a file in the worktree that any agent can change. Without it, git run in the worktree would find your checkout instead. So code-flow guards its own git:</p>
+<ul>
+<li>code-flow&#39;s git in a worktree never reads the worktree&#39;s <code>.git</code>. It&#39;s told the worktree&#39;s git folder (<code>GIT_DIR</code>, <code>GIT_WORK_TREE</code>), which it finds from your repository&#39;s side: the folder in your repository&#39;s git folder that names the worktree. That holds for everything code-flow runs there, reads included: the Files panel, diffs, status, the test-integrity checks, snapshots. So an agent that points <code>.git</code> at a git folder of its own can&#39;t bring in its config, whose filter, textconv or external diff code-flow would otherwise run outside the agent&#39;s sandbox just by looking.</li>
+<li>Before it changes a worktree (undoing a read-only step, putting back test files, committing, merging, resetting a scratch checkout, removing it, or starting an agent there), code-flow also checks that the worktree&#39;s <code>.git</code> is still the file git wrote: it points to the worktree&#39;s own folder in your repository&#39;s git folder, and that folder points back. Before anything that moves a branch (undoing commits, committing, merging), the worktree must be on its run&#39;s branch. If any of that fails, the step fails and the run log says what&#39;s wrong (&quot;its .git is missing&quot;, &quot;it&#39;s on another branch…&quot;). Nothing in the worktree or your checkout is changed. Remove the run&#39;s worktree, or put its <code>.git</code> back, before running it again. The git that then makes the change uses the git folder that was checked, so a <code>.git</code> rewritten in between changes nothing.</li>
+<li>code-flow&#39;s git never looks above the folder it runs in (<code>GIT_CEILING_DIRECTORIES</code>), so a worktree without <code>.git</code> is an error, not your checkout.</li>
+<li>code-flow&#39;s git runs without <code>core.fsmonitor</code> and without hooks, whatever a config file says. Your own hooks still run where you&#39;d expect them: when code-flow merges a result into your checkout, and when it pushes (Git LFS uploads its files in <code>pre-push</code>).</li>
+<li>code-flow&#39;s diffs never run an external diff program or a textconv filter (<code>--no-ext-diff --no-textconv</code>), and a snapshot saves untracked files as they are, without clean filters.</li>
+<li>Not covered: submodules. To tell whether a submodule has changes, git runs itself in the submodule&#39;s folder, and that git goes by the <code>.git</code> there, which an agent can rewrite too. In a worktree with submodules (or a git repository an agent made inside it and code-flow committed), <code>git status</code> and <code>git add</code> can still run a filter that the agent&#39;s config names. Run untrusted tasks on repositories with submodules in a container or VM.</li>
+</ul>
+<h2 id="caveats">Caveats</h2>
+<ul>
+<li><strong>agy permissions</strong> (tested with agy 1.3.5): when headless agy hits a tool it isn&#39;t allowed to use, it doesn&#39;t work around it. The turn ends with an empty answer, which code-flow reports as a failed step that names the denied action. That&#39;s why code-flow passes <code>--dangerously-skip-permissions</code> together with <code>--sandbox</code> by default. The sandbox confines writes to the worktree, and code-flow reverts any changes made during read-only steps. Older agy versions printed nothing when piped; code-flow reports that as an error too.</li>
+<li>Native permission requests are declined by default. Interactive Codex app-server runs can explicitly enable the one-action approval inbox. Requests expire, are scoped to the active run/step/thread/turn and worktree, and cannot grant session-wide permission or policy amendments. Read-only work cannot gain file writes. Unattended and locked-down source runs never wait for native approvals. Other transports keep their existing denial behavior. Team questions remain separate from tool permissions.</li>
+<li><strong>Mid-turn notes are Codex-only, and app-server is experimental.</strong> Mid-turn delivery needs <code>codex app-server</code>, which Codex labels experimental (written against codex-cli 0.162). If the installed Codex lacks it, or speaks a protocol this client doesn&#39;t, code-flow falls back to <code>codex exec</code> and logs that once. It then sticks with exec until the server restarts, so restart code-flow after upgrading Codex. A note is marked delivered as soon as Codex accepts it into the turn. If Codex rejects it (the turn just ended), it goes to the next turn instead. A note for &quot;anyone&quot; goes to a running Codex turn, not to whoever starts next.</li>
+<li>Claude&#39;s write mode can run allow-listed commands such as <code>npm</code>, <code>node</code> and <code>make</code>, and those can run arbitrary project scripts. Only run it on repos you trust. Codex is additionally confined by its own sandbox.</li>
+<li>agy needs <code>--dangerously-skip-permissions</code> for read-only steps too, so for agy the snapshot-and-restore is what enforces read-only. A side chat&#39;s <strong>Ask</strong> isn&#39;t restored, so what agy changes there stays, and the next <strong>Change</strong> commits it: ask Claude or Codex when that matters. Changes to gitignored files during a read-only step aren&#39;t detected.</li>
+<li>The test-integrity checks catch the common ways to game a check, not every one. A flagged result is a prompt to look, and an unflagged one isn&#39;t proof.</li>
+</ul>
+<p>Auto team&#39;s <a href="auto-team.html#three-memory-scopes">memory boundary</a> keeps source trust separate from execution permissions. Agent messages cannot authorize actions. Private memory is isolated in context assembly and APIs, not from fully trusted local processes. Untrusted/unknown project-memory proposals require explicit revision approval; source provenance follows derived memories. Deleting a memory removes it from retrieval; entries written with it in context keep their own text and inherit its provenance. Deletion does not touch source run transcripts, provider conversations or backups.</p>
+<p>Auto team live collaboration uses a separate loopback bridge and an expiring capability for a single run/member/attempt. The general API token is never delegated. Credentials are kept in mode-0600 temporary files, revoked after the turn and excluded from prompts, logs and arguments. Members run as the same user, so a member with a shell could read another member&#39;s credential in the brief window before the bridge client deletes it; such a capability is scoped to that member&#39;s attempt, never to the application token or to you. Claude turns receive the bridge with <code>--strict-mcp-config</code>, so your own and the repository&#39;s MCP servers are not loaded in Auto team turns. Every mutation rechecks the active assignment and uses runtime-derived provenance. Collaboration does not widen the CLI&#39;s existing filesystem or network permissions. Native nested agents are disabled for supported Claude/Codex team turns; unsupported capabilities stay explicit. See <a href="auto-team.html#adapter-capabilities">Auto team</a>.</p>
+<h2 id="documentation-assistant">Documentation assistant</h2>
+<p>The local documentation assistant uses the owner&#39;s installed built-in CLI in a disposable empty Git directory with read-only, Safe adapter settings. It receives bounded documentation excerpts and the question/conversation supplied by the browser. Code Flow does not copy a project, run transcript or credential file into the help directory. Provider-level configuration and hooks still belong to the CLI trust boundary; the “do not use tools” prompt is not an OS isolation mechanism.</p>
+<p>The endpoint inherits owner authentication, origin validation and the global filesystem-policy pause. Shared accounts and runner credentials cannot invoke it. Answers render as text and source links are selected from known guide IDs. GitHub Pages hosts static guides only and never probes localhost for an assistant. Read <a href="help.html">Ask code-flow</a> for retention, quota, cancellation and limits.</p>
+<hr>
+<p><a href="index.html">Documentation library</a> · <a href="getting-started.html">Getting started</a> · <a href="help.html">Ask code-flow</a></p>
+</article><footer><a href="https://github.com/midhunxavier/code-flow/blob/main/docs/security.md">Edit this page on GitHub ↗</a><span>code-flow · 0.1.0-preview.1 · <a href="font-license.txt">Font license</a></span></footer><nav class="pagination" aria-label="Adjacent guides"><a href="notifications.html"><small>← Previous</small>Outbound notifications</a><a href="filesystem-policy.html"><small>Next →</small>Project filesystem policy</a></nav></main>
+<aside class="on-page" aria-label="On this page"><strong>On this page</strong><a class="depth-2" href="#how-code-flow-uses-your-subscriptions">How code-flow uses your subscriptions</a><a class="depth-2" href="#the-server">The server</a><a class="depth-2" href="#running-the-agents-code">Running the agents&#39; code</a><a class="depth-2" href="#your-checkout-and-the-worktrees">Your checkout and the worktrees</a><a class="depth-2" href="#caveats">Caveats</a><a class="depth-2" href="#documentation-assistant">Documentation assistant</a></aside>
+<aside id="help-panel" hidden aria-labelledby="help-title"><div class="chat-heading"><div><span class="eyebrow">Your AI companion</span><h2 id="help-title">Ask code-flow</h2></div><button id="close-help" aria-label="Close AI companion">✕</button></div><div class="chat-toolbar"><span>Grounded in your docs</span><button id="new-chat">New chat</button></div><div id="help-messages" role="log" aria-label="Help conversation" aria-live="polite"><div id="chat-welcome"><span class="chat-mark" aria-hidden="true">✦</span><h3>What would you like to do?</h3><p>Let’s find your next step. Ask about setup, workflows or something that’s unclear.</p><div class="suggestions"><button type="button" data-question="How do I start my first run?">Start my first run ↗</button><button type="button" data-question="What should I do when a check fails?">Understand a failed check ↗</button></div></div></div><p id="help-status" role="status">Checking your installed CLIs…</p><button id="retry-help" hidden>Retry connection</button><form id="help-form" hidden><label class="sr-only" for="question">Your question</label><textarea id="question" rows="3" maxlength="4000" placeholder="Ask a question…" required></textarea><div class="composer-controls"><label class="sr-only" for="help-agent">Use your CLI</label><select id="help-agent"></select><button type="button" id="stop-help" hidden>Stop</button><button class="primary" id="send-help" aria-label="Send message">Send ↗</button></div><small>Uses your CLI login and quota. Shift + Enter for a new line.</small></form><a id="help-guide" href="help.html">About your local companion →</a></aside></div>
+<dialog id="search-dialog" aria-labelledby="search-title"><div class="dialog-title"><h2 id="search-title">Search documentation</h2><button data-close="search-dialog" aria-label="Close search">✕</button></div><label class="sr-only" for="search">Search all guides</label><input id="search" type="search" placeholder="Search workflows, settings, troubleshooting…" autocomplete="off"><div id="search-results" aria-live="polite"></div></dialog>
+</body></html>

package/public/docs/shared-projects.html ADDED Viewed

@@ -0,0 +1,31 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="description" content="Shared project accounts — code-flow guides and reference"><title>Shared project accounts · code-flow</title><link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAGAAAABgCAYAAADimHc4AAAbSElEQVR42u19a7Ak53nW87xfz5zbrtYSNnbwRU4UGywZE2E5GKfCerETxUlRIVRWVUBcXBJLOKU4wchA7IKzBxzsXCCxQ1JEIT9SCUXYjQMEKiQorpWILSmJpJjgtZEdZGQby7Zuez17zkx/78OP7+ue7p6eOXPO7kryiedU15mZ7pnufi/Pe/8G+OrjWX3wyp9ChBrnOvFMnPMyPo5COAbgGARSXxkXvS6DFHBcYV+J67oMJ1VAsuemBhxXwFEIpE8UQLZ27/nn0w78iTLieTAMxxHEGIk5gqKgEDAlXbEEiur9EsBSel4Q3AJQlJdBPyOIAoDDMAALh5UOg0phqRhH4NzSeOuJ7atPP45v+JoLjfsiTsBwC+Ozz4AkEbWKLn9081rZ8IgUDrv7jXR7MYRDCBi4Ae7pzE2Fri5E1XMB6hwDAMwHOtI+dT4L5c9OXWN+j5OTsPO9ZPt4AFAJUH6BtC+BeLhk/Ag8/Bb+Mh9sQCxbQveMMUAiAAOTFKw+oJu9xNtY4s1cxSEYoHGSXs/S6oI8E4kdojZvnNX7mRHW4E5FaFfnY5nIUoMZuyACK6YQotLpSZAGIAAYAG6AX4A84B4P5c/gmwa/Wmv/HrSBl4SHG4nry/fqm8ywEQLexAESPkTETBBGRzpQ6X9U58bVf2Hsea0usWtZmM0YNr5Dc26+eVzFDAIyAEaIgCBIROGrQDRgXOIuL/GPcZgPQTIQ6r+j/oftGes36Dj+8eHaffFfDMzvGS7jTYMRFDYRrYQoBDmCHAaBcFAC5GlD878mGxr73CfHe+e1Kur79MaKBAKs85pqv0bj/ebrxnVSDirCFBEgFOZQcR5xeBa+EvAtheEjuLt8B0jH+jFmZLhCGpBVbfmjunZQ4JeKFXwzz0MQHECQJwn0TNAKGD1LabWP3QuYoQVNqOpKdA356nneOJCYhripHT3XxGyD2JDWpBlqfJRRBcL4ADA6X/6s3jS4Heviom5rsRfir35E31AU/mvFkn0tz6EEENwRmoQX2nhcS7imbGM/A9TznG0D2/zfhKXuZ2dSoYe5Td6o88EK2ibwJJghcEwNTyPi6uL7R781Nt3Mt+MGBQDx8mmAZCB97V792WC4qwh4IbZRCigqqZ8ifPM9z1pQSfEiBMfOaNq0AXOUaUdta7pS7LFD3efpv8Mm3pRAi6OrUIzOxTvwbcW/XMQwczcGd+X+Cy8ZaPV/FAW+FluIAoLHTPzkkNX4LPVrQFNaey9A85lQMa+JstqJ8nv0TDiDIZPXmmwECAqF+fYQPo7jw/iW4X2V4O6dAVXA8XUP2sGLN941PGiH/RxKCEWM/VLvHY+kBUH5rOqqvxr+f4foTX9fPd6M5km1dkd1qvO8wYguEyo3mUieBgwwMPoBC9tb/nvxnH0zTqHExmzPaGcvKEd7axdufE9x0A77WZRyFJXku9pwU7+uvBa1PZfqdY+30fu8hreGF9TyhmK/JwTPCOwLbjFt8unr9Yb9anpkHvN7YrIPSSCDnUMslu0bsRa/O3mLs+nMRXB/cK/+/LJwfwGYxjA5GDXtj3vjgtEDQ7NwftqaLmCY5xmEKxCSTqQdtTEzNiLoyt8mYYboK2bbI3zUfx+H53lEi3hBDKP4vnAgDHQeUQ62JGIO/PR6P5qD99ph/yyi8wozgW0jzwa8Wp3CMDgcJkCScROwAn/RXzd6Dbj0sVm2oJjrcpIx3D8+Urh9q87B4QjuE99eHenv84TQ3bAAM9QD9pqD65rDlN3YgO55Oc0YNY5jvm9axRSmUJkk5WVYs8Ivhu9w4GO4G4YJ6RZgwNF06Uvj4h1hCdBFuBzmmiZ+RWz3jlvYJbx38wk7aIFmEHcRKNoLA2ZpHvuPk0+YkNxRQlJKIlLkGIDCGwAAb+yPCYp52D+8b+sVNsbNuADIETRDcis/v4aePmlGMyRekPiLYLwukz3QDprRhCM0UheVsFmj/iSHCGIbgPsrcVLLILf68rv9DMjqYuPiu2wZKzqDKE0Y0Ap6vA03wgzY8TlE340hxoJ24VJsQJ8GdfflPJR6YpG0W8QYgPR8nME1AL4wZa9mMiCriyHczHFKH6sj2U2vp2V8+xigGYRdlAm7lf7dHscd0h+zckhdLWBDYQRw7CB0EBolBhybtmDWG/WSWrtPL7QSN2oblMP6DGori9nNTs5jQt8x3vk/61if8/lZW995Fv1s33d5Oy6A1MjOEnJCLio6IARsXlwBABxbxAbckPlblq9hUVytzRyketu4TuXiZ0m4z7AH8yBnlpfU9Yq4g2ZwQc3hgm5tJxSfBJScLmAIyRyX7rCwvTgDXpC/RsWrGQAXooCiie+t4ke2AwsRdRHY0RzXchE3doEE35S/Pw/uOFsI2HU4GlUjSTArAOk8lg88vXhB5vFM2zGua6rZVEKtMjZxjoovoMozYaEPghaFIy0AQ4vA1axzzrNrE61IySHyKbwCT2YN0M4acCof5HixUr6HLePrO/jlmiH1e/GCFomKL8U4L5q84wxY6yniKEODSdIQYAyfxk3cxPp6byQ8rQGZS2XEquJ0bh+NoMt9B0ldRAK1gHbMO35R4z7rc/M0bIfvaJZFJwm8uhSYWxbsdzJhbXe5IM9MrTKUnGBeyyX1BTBdl2iEL1X6fQFJ36laP2O/OtLPLLJyBt+K0a4K/3XGVcxngNgRCO+JCAU4Z3gos3BykRTDohB0qdHyIvFAH/x0EnN1iZIJo+lyLA1N7veOvxsfw/p63UGycD0gYoaf39dFsBuiawG/HAscs+jmC3hl2sFbm4pVBEQHPbV6mHLBXlULRWrO4MD+FUjhhmPcfVFeAD1vnYtqlhU5L/2gXULRbiBokYwodgEz6km6qaeA3yhs1K4/J1Jq0aMvLweN44f9/4Zfx7rmti/O1ACLM1BLC0rUosS/HJtfhu/AbEehEsSqNMdMOKuYkMt85u6wgjH6uWIt3I4NOj5xgntqS2HV+pI1oS5KqMftmuVmLnqzi6ajF3l+OQv0nWp/XXxvWd7EfcpFQeVKESB8/+hv8n9j/WSBjSPlnhiQawvtbOY8yccupHtRo6tLNMCa4c1wjqGdQqlJIMQpp98TU9ydIssDw+Cj8bv9tuEvY10FNnbuFZ1rAxbKaPoOzNiNG7oTg7CHegF2WeJstaCki2ibhsroOSiXCRHFUlEGuBz/wG8b/mSSfMZFzjQvDmhlPedh/5QA7RZzF80JLZqm7jOq2EVdue9C2MzByOkuYxF8tSjKEp9WwO34Xv53HD5ZYONIXBQEd2YA5msAewik3Ro+7BGisIsE3E7FdzUkPG+CqwqsCAmkKAQOlkzLQFn62SjciRW8H3+LT2bMj7uxQDsyoNmcKk33U7aHKpTqpJrU7rST97SbbOnlMrharCZMGgkDA9MUDdPARiT+yIEPYcV+AX+Xn051lJ0N7iU353JGKp6uhJTG9I25SQllFFyCMyW1xUYue5bEZ51Sp9151jGLULfqyanaxmtjasp+PatCr7LYEIg0boHlpjw8Brc/EvGHHOJ+x9MP4bZrztSEx92eJR+XjwHuRJ5Fq+IMdtMNMbUDaJjyFrqwNdLZ7W1cGG9ja1xirIgylSbgIpjmBPKXctLnUROHk+c9rdDUpPdePZ1TUn83VX2SVgduOgfJ1n5WKTVuO/UUiM/K8RDK8Hs4vfkAfuVVX6i//9afG+ATjztObOxpPKkfDSWCFI/rrqUVvBkXU0G+RYicoItDQOPS9dSF8/rSxfM4W47gdAiGpLuA3NLNVhBbjTVlAlSEF6uBlDxzpcSsuuFG7d7YWppZzWhVhGYjWdVmNlralM7V0olmlxPSYBQNCEUKu3y0TbNPgvwvivgP+NlrTwEAjirgxN6G9WYywI7rrqVlvFmbqQu6PjAKMiIS8C+fOavPX3gKm4gKAyLAkr1CKo56Nc7JiQYo/0+tZEwSWM88TAitNBGUPlOXuyfSKmai11NEzaaRDtx0NKD67hZz0NAWqYqECAqWrRoZEJbAMIS2L2yT4Vdj0PvxwZd9HACxvk5s7E4bZjKgOK67BkttBtAhL8A4Go/1f558XE+U5zFcNgUExDQ+BY+s52g9d07WIztkQyMsE3ZC/JrYlcSrTfy03zLcVARuawXFqdvS9Bv1JyftcOz3BtjqhibgJB1QoeFB+Hhz02g/Wn7xpT+CE4zN2TlcyoxYNqmNxJygIRjPb23xf335c3zKz3FlEIBIlKVD0eFeGUdNZkJbI3Z1cJn2G9rEl0FuSaJlEA0kE5wx4UGaWUwQl5iYta6Cn8m4RL21b4z5Oxu9hta4RutkeqbcNJO8gCRsn4mUr2qwtmF/6rHfWL3jMy/CBh1Hj4dLH9Jr5H4oQAPCz2xt8dTjn8M4jDgMQOkRcoekXAkivOoEpiZhY2tOqCKUZU2ZSLpqzcjgSwMZIAQgb1ImegU9DduQhwHhFYOnhbjhSWF6ULZvLrPd/eG54O5yAgiUi1tPl7TBt26NBh9e+qEvfh1O3JI04ZIYUN2EHAiAXxyN9ckn/p80GCNQ8iz1Qkzg1AjBXEpNkg44JxxwVM307JmkridCAQaIAVCAK0DKhK8I7m2mzZL0JtH7G84rI94dvZjSiMlpGkkC5UYgouD26ZI2uH4cR7+Jd37+pdigL8KE2RBEz6JlkFz61JOPacwtBgc9xjwV6YR7Ijg8e0DKQeSMgd7qPpq5DiQjnQx41oBM8InRZgvTNYuwE3Sf2+2vJhR23drpabA2nyenT4of0woK22dLFiuvsFF5HH//syto+dm7ZIA8k7hA0GPnT+v0+LQNTYwoXXA4HEq8gWJzHqZp0NXo2mWjpVpwqNVOPZWLbRnZJrPYGzGz8bfXUYzezmvO3Gr+ZVgCUXDrTInhVa8P0d+b7MEJ2xsDBEcAMIojfuHs4zYIQowl5FGKLkUXFCV3CUkLIE82ofpr9jGmMDMXTlMVg83As6cXvEX8jsROChesI9mpGipmrAah+TmN2hvt519TEyYedL5lKtjW6QiEH1y5/bPfiBO3xHlGua8thTm9cBEDAGe2zmjLz9MQIURIDleqEbkmxE6vK8LXVwOn6inturmoM67TSk+of9JcPZLLvp7AKUjpEH43s+nEDKNde8+trXJEEAEbhLGP/gkA4PqjWpwBVW+o8TEB4FNbZwFFyBPeyzWZnGMiNl3teSXvwIMmJaWa+KxshVpGMwmqWqPvMzOf1A5TG5yZIu3N0HKBrg22oL0dytR6EDg6J7fiLYN3PPraeQbZejrjUngS7BGNAF0oL5ICPEqClKFeSVItq2p2/SrvJlTC1gANqoYHZnjSItUgTOP+FIm5QFFJszs2WtMmfYExO7xki3x18F4H89nnG6yFUnorAOAT/RfZpwHJrhj+p58XMN5OJqYymmAywWpMhGnOXdV+W6xI6e2kmfWv/KAFRt2ZDXv/wdx9fnpubbIHhiamRWzX0CSQcRsQ3nLt+meWc66Ii2iAACCu4iHfGn0RcoO8BDzDUO4VkDITKs3zbAsEyDOh6+vxLPXKYyUNHMgdSE3DrQ4VOGuFiJ1aNhbtVSEWGz6b5xmhETdk/z1ui+R1j54bvCrPXizAgCqU/nY+LsdJBAxMvk15MsL1mDQqrZjcNXM8ML3ATLYVmdA1M/J7VQuwqq7TJsPqKpCmZ0VnMYScX+HfiVFzpJ/tjEeTiSI7CCbXYDWAeA0A4O67bTE39PoXEADiKPyiI6QuReXJWEmpjCFP3o6ake9EUr3nRps9LMwpiyqCVk4iAIlxyi0H7WHYOS3X6lnniXvrT+kKdnfdm6bdYZMpbHhIVdBpYIyvyqNfC8YBG0cisG54oviwynCvg2tGjQA4PApwpyAyU7mCn0q6cyw7qRAzE5fNpEHaZ3SQuacPk83yQgPkpDXB2HC/1Uw2tBNsO1vb+YTvwstU2qgakbf2MWiMzlfXKAcirk2G+HEtGogJR28gNlgq6qcdwSFGg8fU415HpQKzXVBMBI0xLXeoGlIElMkI06vqmFI5zYW06ERiosfMzGpluawJFYRNWtay8e1I/BQ0a7ZRncq7cVrauwzp5uxaxO7RiMrzBg7Migdmh8k5ghv/9Ev+wGP4ZRefR2AMVjkFdxBOwKmYcb1aVqPWFOUReqUALqZFKl2NLccVysZbMR0rJaaqVO1x1Wal8r6aK3zM8MY4a9EhThFrStrnaYD1MZLTjJndmb7AaiknbhGOHg/lky+7s9TwpDw8z+TbIKIBkYjJDjCnKJmTczUTqtREJcFMGSZW6YpshJurTwjKy45UTZE+sTdopLgbjKiZ0e3lQXtlQM6JG9iFF7aPZ2drQRSnl70hEkSZgcHOJgg6wd0uV+M4cUo4wRiXX7oxjoPfkRdXmTQCVCZyuaA8nCl3gE7PUTMqTFesit21oaVXRjfnl6vXqtZXbDj5uS/HpBasEOydne3WIGpp7KyJ2YIPdt7fxYbJd1XmCLRU2DaDrHik6dzsctXEDQfWDT/Ji/Hpl707+tKveAzLFEJaFVQRiA5FT6LrEVRafYfukGLtmiqlNJJmVHZAnss5XjdbqjIwakRnNeE129j2LH9YE9zQXF+s9T5z/a96vqsNve+lp0xyE/ipFOS+UXvsC9rwPOUxKoGfwt959OMhlN8nlF+flmTVGAbQSxMtlRDFQMlUiYPDkldAA2LICWkDFMhUQkuVL+WlUqvYodlbopBdD0AK2UNiu18mm73uarDsSdqRHReTnSB61hK7ndRFdRnd3WRAuT0Oawcf8uYA5N6XrawamCjcqlWUn38LNLqZ8D8NxgOpouWeWE+DVMhgFCw5xCQEY1VeJAKFANJAN4gmYACiKkMaCBNTQ0JVpZwEruOU4xAIqxeNaaeLmaPT7trEVU2afQzoGuvOc/Y3zFpuG8wpMGexau7jU/GVX3MjbuP40petrKYGUuV/E8CHAH5Ib/3cKxHGr0YcvxLGF4FaBTQAUMgZQJkkg1laTyr58AGSiakMqchcTgmsK2FQgESJhBnBGCAvRFsheDVZvAhLBwI1AsoLqYuI1o5Ru66jdROknE4d9TKjsZAc2VMNUi5hq+KRMFgBXL+J2zie1Tu0SwY00hUQcfhYwD0bEb/0kk8B+BQWnKXYy+xE6zNHFfQirGnzSy+30fiIyL9uw2v+ArUJ+MjFYFKjMYNsDxVNEdX6M6tEDwQ1l0Rhw6azpUykmcetaBz++wgA18/Nl+PSVnk8etzw5VPEn7xBOHFKwMaV/qEDdbF88EMXvge68BNm/kKNz7vTMhNSd8uk+c469ZnqPcywBz3EbywUUdvxjIs5ERA1PBTi+MJv+I+98Dvm9QpdyV+z4JWl/zHi6A3EI08bHrwtAvClH7h4nYqL/4mhfLVGF9xJS9a7yo1YFlrrOIJsB1GzavN1o2x22DiR/hr75SLMow1JhDeU7z/0uzh6PODELfFZ+gkTPDM/xXLrAwXuvGmMd229YqDN+4K2roleSoBVcgnm3mA2OxmnffnZFKoDwLpol6AnSb9BYIylrzy/iFtnf0Y/9vzb5xF/76unP/cewp03jXHrAwP8+PKnSfxzLF1FMgVCoKH+X4ttjguqZQ+tJwawTkSco2laOp5WfW+10LdHLR8q4njzY5J+GOsyXH9Kz/KP+DyTbEgAc/B9uGZ0+olPAniB+yiPtli7v4dsQ1DT2LK/yFM7udlGkA2n12NEsRoiwpcd5V/Cew89vJP07ycNQD2IcewYz72bTzr5gIarAOkwa8QQWbLNJlJvjUjYplLK9RgBjbXU01IAliRfpYYHQrThUxbK78R7Dz2MwyeLnYi//xgAIC0LIJbCownrTcrEaxK6CtBbhLdu3kiZPzkMqWGpYTLcSyxfXbgNP2PBvq3cOHQ/1k8WuGexiZn9x4ATyVUx+hptOnfDOt/TJH73V3wqrEcK0muNybBjhMHdHNLaC4pI/vYwDA6X68Pf3+2gHvcdAyBiHRyUT99vYel1vn3eZWZgmKB47mJQN6HfaAe3yr3s/NgNIZirRFguYigAC++Lb7B/iiMscfhkgXt2N6hn++6H1gAcGG7/mTAYvoa+DQRjLb3513jaBZP2EjAphc/s3TQgxwSTPAiOtauLOBg8guXBt8f3hHfjCFP74T27n5LcXwy4IU3ZjcG/YUtrS5CizDiBH06XKzmBm0T4pr2YGGFzjyxWzFcOmZv/QjxQvD6+i/8tTUmucxGDexmScc9xF5SM+FEdxPbW9yBuw3OhnmxMu0iN1TZSYm1Sk2EjEFYVXLlFwNeuDq74GQXeEd9lv9aYDY64hKVBin1kfA1AXPb4nWFp+Vq/cCYqWKhSBXXTNCdrr9U5uEZRXZz0twVXZLEa4tIAMvz8yjXhPee/l483ZoMv+ccU9w8DTh0TJPJHtm8FCVljSJKsG8iBRo2n2VpSpxYESm4CtHooROERLOOd8Qf5n89fJqnff15QzrWvfECvt63yo9reYpSq2dIaUTyvNz9p47JGBJw9HKFksVqoCHDi30bih3EHn8DhkwXeeLdjY0OXi/j7RwOOZv9/q7wNRWEasRRV1AVyAQ7PDYvsNF/ldT7hbm7UgQOFwx+2If5h/AH+egvr78FlT7MX+8L1vIVx5QN6CS6Wf03bI4gI9bQSmz+fyqnlHQmJLufwYHBzl+GnDrzc/tmZ7+LpidQfKa/U5Rf7w/UENIpvteXiKp2/EEVm42uNlv7cOKtGbcwRiRB0YDU48AdYCe+Mb+fdZ66w1O8jG5Brgj+HleXT5R8Gs+vieMuFVH1GvfZsnpJKU4WgSxSdyweCM25pwJ+Iy198H2578ebEw9n7Ahx/fDTgePqNs8Gm/ootFdfp4kUHc1U+B19pgrDh10dF2jD46lIQcfdwNdyx+bb848yX2cPZ/wyo+mzG8VYNg0TWrr7YmWqS3KKg1YPBDU9hiI3y7fjXJemJ8FcW6/cfBGXXc/BB/TmO4wMhenA52zORuSU1ekRYDj4IiIb/ODiIfzRKK10ZDq8b7tl4RqV+f2jA9chDJPGvDpZCga2yBFnUk+Ak4O6MpK+uheh4NCzjPXo7/90IAG59YIA7X1viHpbP5m0UX8HeT+ptK8uXcynEarY8R7yOUtJwNfhAUMC/8VUc87fxS/XQ9J03jZ8Lt1F8BeM/AaAYLv22Av62Us+pSyCKVfNlIDp+15b4nvj3+OFny8jubzdUIu5GCA/6B0D7PghDwOEFHtaSfRCve/DncdNN44ZrqecS8fdXRezHdT0cL0fAabwWD+EIt9IyYifDc03q99+jbxmA9ZPFTkvFfPVxuZlwXAFHFb5K+K8+Fn78f4eywyDh1HjXAAAAAElFTkSuQmCC"><link rel="stylesheet" href="style.css"><script src="app.js" defer></script></head>
+<body data-page="shared-projects"><a class="skip-link" href="#content">Skip to content</a>
+<header class="topbar"><a class="brand" href="index.html"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAGAAAABgCAYAAADimHc4AAAbSElEQVR42u19a7Ak53nW87xfz5zbrtYSNnbwRU4UGywZE2E5GKfCerETxUlRIVRWVUBcXBJLOKU4wchA7IKzBxzsXCCxQ1JEIT9SCUXYjQMEKiQorpWILSmJpJjgtZEdZGQby7Zuez17zkx/78OP7+ue7p6eOXPO7kryiedU15mZ7pnufi/Pe/8G+OrjWX3wyp9ChBrnOvFMnPMyPo5COAbgGARSXxkXvS6DFHBcYV+J67oMJ1VAsuemBhxXwFEIpE8UQLZ27/nn0w78iTLieTAMxxHEGIk5gqKgEDAlXbEEiur9EsBSel4Q3AJQlJdBPyOIAoDDMAALh5UOg0phqRhH4NzSeOuJ7atPP45v+JoLjfsiTsBwC+Ozz4AkEbWKLn9081rZ8IgUDrv7jXR7MYRDCBi4Ae7pzE2Fri5E1XMB6hwDAMwHOtI+dT4L5c9OXWN+j5OTsPO9ZPt4AFAJUH6BtC+BeLhk/Ag8/Bb+Mh9sQCxbQveMMUAiAAOTFKw+oJu9xNtY4s1cxSEYoHGSXs/S6oI8E4kdojZvnNX7mRHW4E5FaFfnY5nIUoMZuyACK6YQotLpSZAGIAAYAG6AX4A84B4P5c/gmwa/Wmv/HrSBl4SHG4nry/fqm8ywEQLexAESPkTETBBGRzpQ6X9U58bVf2Hsea0usWtZmM0YNr5Dc26+eVzFDAIyAEaIgCBIROGrQDRgXOIuL/GPcZgPQTIQ6r+j/oftGes36Dj+8eHaffFfDMzvGS7jTYMRFDYRrYQoBDmCHAaBcFAC5GlD878mGxr73CfHe+e1Kur79MaKBAKs85pqv0bj/ebrxnVSDirCFBEgFOZQcR5xeBa+EvAtheEjuLt8B0jH+jFmZLhCGpBVbfmjunZQ4JeKFXwzz0MQHECQJwn0TNAKGD1LabWP3QuYoQVNqOpKdA356nneOJCYhripHT3XxGyD2JDWpBlqfJRRBcL4ADA6X/6s3jS4Heviom5rsRfir35E31AU/mvFkn0tz6EEENwRmoQX2nhcS7imbGM/A9TznG0D2/zfhKXuZ2dSoYe5Td6o88EK2ibwJJghcEwNTyPi6uL7R781Nt3Mt+MGBQDx8mmAZCB97V792WC4qwh4IbZRCigqqZ8ifPM9z1pQSfEiBMfOaNq0AXOUaUdta7pS7LFD3efpv8Mm3pRAi6OrUIzOxTvwbcW/XMQwczcGd+X+Cy8ZaPV/FAW+FluIAoLHTPzkkNX4LPVrQFNaey9A85lQMa+JstqJ8nv0TDiDIZPXmmwECAqF+fYQPo7jw/iW4X2V4O6dAVXA8XUP2sGLN941PGiH/RxKCEWM/VLvHY+kBUH5rOqqvxr+f4foTX9fPd6M5km1dkd1qvO8wYguEyo3mUieBgwwMPoBC9tb/nvxnH0zTqHExmzPaGcvKEd7axdufE9x0A77WZRyFJXku9pwU7+uvBa1PZfqdY+30fu8hreGF9TyhmK/JwTPCOwLbjFt8unr9Yb9anpkHvN7YrIPSSCDnUMslu0bsRa/O3mLs+nMRXB/cK/+/LJwfwGYxjA5GDXtj3vjgtEDQ7NwftqaLmCY5xmEKxCSTqQdtTEzNiLoyt8mYYboK2bbI3zUfx+H53lEi3hBDKP4vnAgDHQeUQ62JGIO/PR6P5qD99ph/yyi8wozgW0jzwa8Wp3CMDgcJkCScROwAn/RXzd6Dbj0sVm2oJjrcpIx3D8+Urh9q87B4QjuE99eHenv84TQ3bAAM9QD9pqD65rDlN3YgO55Oc0YNY5jvm9axRSmUJkk5WVYs8Ivhu9w4GO4G4YJ6RZgwNF06Uvj4h1hCdBFuBzmmiZ+RWz3jlvYJbx38wk7aIFmEHcRKNoLA2ZpHvuPk0+YkNxRQlJKIlLkGIDCGwAAb+yPCYp52D+8b+sVNsbNuADIETRDcis/v4aePmlGMyRekPiLYLwukz3QDprRhCM0UheVsFmj/iSHCGIbgPsrcVLLILf68rv9DMjqYuPiu2wZKzqDKE0Y0Ap6vA03wgzY8TlE340hxoJ24VJsQJ8GdfflPJR6YpG0W8QYgPR8nME1AL4wZa9mMiCriyHczHFKH6sj2U2vp2V8+xigGYRdlAm7lf7dHscd0h+zckhdLWBDYQRw7CB0EBolBhybtmDWG/WSWrtPL7QSN2oblMP6DGori9nNTs5jQt8x3vk/61if8/lZW995Fv1s33d5Oy6A1MjOEnJCLio6IARsXlwBABxbxAbckPlblq9hUVytzRyketu4TuXiZ0m4z7AH8yBnlpfU9Yq4g2ZwQc3hgm5tJxSfBJScLmAIyRyX7rCwvTgDXpC/RsWrGQAXooCiie+t4ke2AwsRdRHY0RzXchE3doEE35S/Pw/uOFsI2HU4GlUjSTArAOk8lg88vXhB5vFM2zGua6rZVEKtMjZxjoovoMozYaEPghaFIy0AQ4vA1axzzrNrE61IySHyKbwCT2YN0M4acCof5HixUr6HLePrO/jlmiH1e/GCFomKL8U4L5q84wxY6yniKEODSdIQYAyfxk3cxPp6byQ8rQGZS2XEquJ0bh+NoMt9B0ldRAK1gHbMO35R4z7rc/M0bIfvaJZFJwm8uhSYWxbsdzJhbXe5IM9MrTKUnGBeyyX1BTBdl2iEL1X6fQFJ36laP2O/OtLPLLJyBt+K0a4K/3XGVcxngNgRCO+JCAU4Z3gos3BykRTDohB0qdHyIvFAH/x0EnN1iZIJo+lyLA1N7veOvxsfw/p63UGycD0gYoaf39dFsBuiawG/HAscs+jmC3hl2sFbm4pVBEQHPbV6mHLBXlULRWrO4MD+FUjhhmPcfVFeAD1vnYtqlhU5L/2gXULRbiBokYwodgEz6km6qaeA3yhs1K4/J1Jq0aMvLweN44f9/4Zfx7rmti/O1ACLM1BLC0rUosS/HJtfhu/AbEehEsSqNMdMOKuYkMt85u6wgjH6uWIt3I4NOj5xgntqS2HV+pI1oS5KqMftmuVmLnqzi6ajF3l+OQv0nWp/XXxvWd7EfcpFQeVKESB8/+hv8n9j/WSBjSPlnhiQawvtbOY8yccupHtRo6tLNMCa4c1wjqGdQqlJIMQpp98TU9ydIssDw+Cj8bv9tuEvY10FNnbuFZ1rAxbKaPoOzNiNG7oTg7CHegF2WeJstaCki2ibhsroOSiXCRHFUlEGuBz/wG8b/mSSfMZFzjQvDmhlPedh/5QA7RZzF80JLZqm7jOq2EVdue9C2MzByOkuYxF8tSjKEp9WwO34Xv53HD5ZYONIXBQEd2YA5msAewik3Ro+7BGisIsE3E7FdzUkPG+CqwqsCAmkKAQOlkzLQFn62SjciRW8H3+LT2bMj7uxQDsyoNmcKk33U7aHKpTqpJrU7rST97SbbOnlMrharCZMGgkDA9MUDdPARiT+yIEPYcV+AX+Xn051lJ0N7iU353JGKp6uhJTG9I25SQllFFyCMyW1xUYue5bEZ51Sp9151jGLULfqyanaxmtjasp+PatCr7LYEIg0boHlpjw8Brc/EvGHHOJ+x9MP4bZrztSEx92eJR+XjwHuRJ5Fq+IMdtMNMbUDaJjyFrqwNdLZ7W1cGG9ja1xirIgylSbgIpjmBPKXctLnUROHk+c9rdDUpPdePZ1TUn83VX2SVgduOgfJ1n5WKTVuO/UUiM/K8RDK8Hs4vfkAfuVVX6i//9afG+ATjztObOxpPKkfDSWCFI/rrqUVvBkXU0G+RYicoItDQOPS9dSF8/rSxfM4W47gdAiGpLuA3NLNVhBbjTVlAlSEF6uBlDxzpcSsuuFG7d7YWppZzWhVhGYjWdVmNlralM7V0olmlxPSYBQNCEUKu3y0TbNPgvwvivgP+NlrTwEAjirgxN6G9WYywI7rrqVlvFmbqQu6PjAKMiIS8C+fOavPX3gKm4gKAyLAkr1CKo56Nc7JiQYo/0+tZEwSWM88TAitNBGUPlOXuyfSKmai11NEzaaRDtx0NKD67hZz0NAWqYqECAqWrRoZEJbAMIS2L2yT4Vdj0PvxwZd9HACxvk5s7E4bZjKgOK67BkttBtAhL8A4Go/1f558XE+U5zFcNgUExDQ+BY+s52g9d07WIztkQyMsE3ZC/JrYlcSrTfy03zLcVARuawXFqdvS9Bv1JyftcOz3BtjqhibgJB1QoeFB+Hhz02g/Wn7xpT+CE4zN2TlcyoxYNqmNxJygIRjPb23xf335c3zKz3FlEIBIlKVD0eFeGUdNZkJbI3Z1cJn2G9rEl0FuSaJlEA0kE5wx4UGaWUwQl5iYta6Cn8m4RL21b4z5Oxu9hta4RutkeqbcNJO8gCRsn4mUr2qwtmF/6rHfWL3jMy/CBh1Hj4dLH9Jr5H4oQAPCz2xt8dTjn8M4jDgMQOkRcoekXAkivOoEpiZhY2tOqCKUZU2ZSLpqzcjgSwMZIAQgb1ImegU9DduQhwHhFYOnhbjhSWF6ULZvLrPd/eG54O5yAgiUi1tPl7TBt26NBh9e+qEvfh1O3JI04ZIYUN2EHAiAXxyN9ckn/p80GCNQ8iz1Qkzg1AjBXEpNkg44JxxwVM307JmkridCAQaIAVCAK0DKhK8I7m2mzZL0JtH7G84rI94dvZjSiMlpGkkC5UYgouD26ZI2uH4cR7+Jd37+pdigL8KE2RBEz6JlkFz61JOPacwtBgc9xjwV6YR7Ijg8e0DKQeSMgd7qPpq5DiQjnQx41oBM8InRZgvTNYuwE3Sf2+2vJhR23drpabA2nyenT4of0woK22dLFiuvsFF5HH//syto+dm7ZIA8k7hA0GPnT+v0+LQNTYwoXXA4HEq8gWJzHqZp0NXo2mWjpVpwqNVOPZWLbRnZJrPYGzGz8bfXUYzezmvO3Gr+ZVgCUXDrTInhVa8P0d+b7MEJ2xsDBEcAMIojfuHs4zYIQowl5FGKLkUXFCV3CUkLIE82ofpr9jGmMDMXTlMVg83As6cXvEX8jsROChesI9mpGipmrAah+TmN2hvt519TEyYedL5lKtjW6QiEH1y5/bPfiBO3xHlGua8thTm9cBEDAGe2zmjLz9MQIURIDleqEbkmxE6vK8LXVwOn6inturmoM67TSk+of9JcPZLLvp7AKUjpEH43s+nEDKNde8+trXJEEAEbhLGP/gkA4PqjWpwBVW+o8TEB4FNbZwFFyBPeyzWZnGMiNl3teSXvwIMmJaWa+KxshVpGMwmqWqPvMzOf1A5TG5yZIu3N0HKBrg22oL0dytR6EDg6J7fiLYN3PPraeQbZejrjUngS7BGNAF0oL5ICPEqClKFeSVItq2p2/SrvJlTC1gANqoYHZnjSItUgTOP+FIm5QFFJszs2WtMmfYExO7xki3x18F4H89nnG6yFUnorAOAT/RfZpwHJrhj+p58XMN5OJqYymmAywWpMhGnOXdV+W6xI6e2kmfWv/KAFRt2ZDXv/wdx9fnpubbIHhiamRWzX0CSQcRsQ3nLt+meWc66Ii2iAACCu4iHfGn0RcoO8BDzDUO4VkDITKs3zbAsEyDOh6+vxLPXKYyUNHMgdSE3DrQ4VOGuFiJ1aNhbtVSEWGz6b5xmhETdk/z1ui+R1j54bvCrPXizAgCqU/nY+LsdJBAxMvk15MsL1mDQqrZjcNXM8ML3ATLYVmdA1M/J7VQuwqq7TJsPqKpCmZ0VnMYScX+HfiVFzpJ/tjEeTiSI7CCbXYDWAeA0A4O67bTE39PoXEADiKPyiI6QuReXJWEmpjCFP3o6ake9EUr3nRps9LMwpiyqCVk4iAIlxyi0H7WHYOS3X6lnniXvrT+kKdnfdm6bdYZMpbHhIVdBpYIyvyqNfC8YBG0cisG54oviwynCvg2tGjQA4PApwpyAyU7mCn0q6cyw7qRAzE5fNpEHaZ3SQuacPk83yQgPkpDXB2HC/1Uw2tBNsO1vb+YTvwstU2qgakbf2MWiMzlfXKAcirk2G+HEtGogJR28gNlgq6qcdwSFGg8fU415HpQKzXVBMBI0xLXeoGlIElMkI06vqmFI5zYW06ERiosfMzGpluawJFYRNWtay8e1I/BQ0a7ZRncq7cVrauwzp5uxaxO7RiMrzBg7Migdmh8k5ghv/9Ev+wGP4ZRefR2AMVjkFdxBOwKmYcb1aVqPWFOUReqUALqZFKl2NLccVysZbMR0rJaaqVO1x1Wal8r6aK3zM8MY4a9EhThFrStrnaYD1MZLTjJndmb7AaiknbhGOHg/lky+7s9TwpDw8z+TbIKIBkYjJDjCnKJmTczUTqtREJcFMGSZW6YpshJurTwjKy45UTZE+sTdopLgbjKiZ0e3lQXtlQM6JG9iFF7aPZ2drQRSnl70hEkSZgcHOJgg6wd0uV+M4cUo4wRiXX7oxjoPfkRdXmTQCVCZyuaA8nCl3gE7PUTMqTFesit21oaVXRjfnl6vXqtZXbDj5uS/HpBasEOydne3WIGpp7KyJ2YIPdt7fxYbJd1XmCLRU2DaDrHik6dzsctXEDQfWDT/Ji/Hpl707+tKveAzLFEJaFVQRiA5FT6LrEVRafYfukGLtmiqlNJJmVHZAnss5XjdbqjIwakRnNeE129j2LH9YE9zQXF+s9T5z/a96vqsNve+lp0xyE/ipFOS+UXvsC9rwPOUxKoGfwt959OMhlN8nlF+flmTVGAbQSxMtlRDFQMlUiYPDkldAA2LICWkDFMhUQkuVL+WlUqvYodlbopBdD0AK2UNiu18mm73uarDsSdqRHReTnSB61hK7ndRFdRnd3WRAuT0Oawcf8uYA5N6XrawamCjcqlWUn38LNLqZ8D8NxgOpouWeWE+DVMhgFCw5xCQEY1VeJAKFANJAN4gmYACiKkMaCBNTQ0JVpZwEruOU4xAIqxeNaaeLmaPT7trEVU2afQzoGuvOc/Y3zFpuG8wpMGexau7jU/GVX3MjbuP40petrKYGUuV/E8CHAH5Ib/3cKxHGr0YcvxLGF4FaBTQAUMgZQJkkg1laTyr58AGSiakMqchcTgmsK2FQgESJhBnBGCAvRFsheDVZvAhLBwI1AsoLqYuI1o5Ru66jdROknE4d9TKjsZAc2VMNUi5hq+KRMFgBXL+J2zie1Tu0SwY00hUQcfhYwD0bEb/0kk8B+BQWnKXYy+xE6zNHFfQirGnzSy+30fiIyL9uw2v+ArUJ+MjFYFKjMYNsDxVNEdX6M6tEDwQ1l0Rhw6azpUykmcetaBz++wgA18/Nl+PSVnk8etzw5VPEn7xBOHFKwMaV/qEDdbF88EMXvge68BNm/kKNz7vTMhNSd8uk+c469ZnqPcywBz3EbywUUdvxjIs5ERA1PBTi+MJv+I+98Dvm9QpdyV+z4JWl/zHi6A3EI08bHrwtAvClH7h4nYqL/4mhfLVGF9xJS9a7yo1YFlrrOIJsB1GzavN1o2x22DiR/hr75SLMow1JhDeU7z/0uzh6PODELfFZ+gkTPDM/xXLrAwXuvGmMd229YqDN+4K2roleSoBVcgnm3mA2OxmnffnZFKoDwLpol6AnSb9BYIylrzy/iFtnf0Y/9vzb5xF/76unP/cewp03jXHrAwP8+PKnSfxzLF1FMgVCoKH+X4ttjguqZQ+tJwawTkSco2laOp5WfW+10LdHLR8q4njzY5J+GOsyXH9Kz/KP+DyTbEgAc/B9uGZ0+olPAniB+yiPtli7v4dsQ1DT2LK/yFM7udlGkA2n12NEsRoiwpcd5V/Cew89vJP07ycNQD2IcewYz72bTzr5gIarAOkwa8QQWbLNJlJvjUjYplLK9RgBjbXU01IAliRfpYYHQrThUxbK78R7Dz2MwyeLnYi//xgAIC0LIJbCownrTcrEaxK6CtBbhLdu3kiZPzkMqWGpYTLcSyxfXbgNP2PBvq3cOHQ/1k8WuGexiZn9x4ATyVUx+hptOnfDOt/TJH73V3wqrEcK0muNybBjhMHdHNLaC4pI/vYwDA6X68Pf3+2gHvcdAyBiHRyUT99vYel1vn3eZWZgmKB47mJQN6HfaAe3yr3s/NgNIZirRFguYigAC++Lb7B/iiMscfhkgXt2N6hn++6H1gAcGG7/mTAYvoa+DQRjLb3513jaBZP2EjAphc/s3TQgxwSTPAiOtauLOBg8guXBt8f3hHfjCFP74T27n5LcXwy4IU3ZjcG/YUtrS5CizDiBH06XKzmBm0T4pr2YGGFzjyxWzFcOmZv/QjxQvD6+i/8tTUmucxGDexmScc9xF5SM+FEdxPbW9yBuw3OhnmxMu0iN1TZSYm1Sk2EjEFYVXLlFwNeuDq74GQXeEd9lv9aYDY64hKVBin1kfA1AXPb4nWFp+Vq/cCYqWKhSBXXTNCdrr9U5uEZRXZz0twVXZLEa4tIAMvz8yjXhPee/l483ZoMv+ccU9w8DTh0TJPJHtm8FCVljSJKsG8iBRo2n2VpSpxYESm4CtHooROERLOOd8Qf5n89fJqnff15QzrWvfECvt63yo9reYpSq2dIaUTyvNz9p47JGBJw9HKFksVqoCHDi30bih3EHn8DhkwXeeLdjY0OXi/j7RwOOZv9/q7wNRWEasRRV1AVyAQ7PDYvsNF/ldT7hbm7UgQOFwx+2If5h/AH+egvr78FlT7MX+8L1vIVx5QN6CS6Wf03bI4gI9bQSmz+fyqnlHQmJLufwYHBzl+GnDrzc/tmZ7+LpidQfKa/U5Rf7w/UENIpvteXiKp2/EEVm42uNlv7cOKtGbcwRiRB0YDU48AdYCe+Mb+fdZ66w1O8jG5Brgj+HleXT5R8Gs+vieMuFVH1GvfZsnpJKU4WgSxSdyweCM25pwJ+Iy198H2578ebEw9n7Ahx/fDTgePqNs8Gm/ootFdfp4kUHc1U+B19pgrDh10dF2jD46lIQcfdwNdyx+bb848yX2cPZ/wyo+mzG8VYNg0TWrr7YmWqS3KKg1YPBDU9hiI3y7fjXJemJ8FcW6/cfBGXXc/BB/TmO4wMhenA52zORuSU1ekRYDj4IiIb/ODiIfzRKK10ZDq8b7tl4RqV+f2jA9chDJPGvDpZCga2yBFnUk+Ak4O6MpK+uheh4NCzjPXo7/90IAG59YIA7X1viHpbP5m0UX8HeT+ptK8uXcynEarY8R7yOUtJwNfhAUMC/8VUc87fxS/XQ9J03jZ8Lt1F8BeM/AaAYLv22Av62Us+pSyCKVfNlIDp+15b4nvj3+OFny8jubzdUIu5GCA/6B0D7PghDwOEFHtaSfRCve/DncdNN44ZrqecS8fdXRezHdT0cL0fAabwWD+EIt9IyYifDc03q99+jbxmA9ZPFTkvFfPVxuZlwXAFHFb5K+K8+Fn78f4eywyDh1HjXAAAAAElFTkSuQmCC" width="30" height="30" alt=""><strong>Code Flow</strong><span>Docs</span></a><button class="search-trigger" id="open-search">Search documentation <kbd>⌘ K</kbd></button><div class="top-actions"><a href="https://github.com/midhunxavier/code-flow">GitHub ↗</a><button id="theme" aria-label="Change color theme">Theme</button><button id="open-help" class="primary" hidden aria-expanded="false" aria-controls="help-panel">Ask code-flow</button><button id="menu" aria-label="Toggle documentation navigation" aria-expanded="false" aria-controls="sidebar">☰</button></div></header>
+<div class="layout"><nav class="sidebar" id="sidebar" aria-label="Documentation"><section><h2>Get started</h2><a href="index.html" >Overview</a><a href="installation.html" >Install Code Flow preview</a><a href="getting-started.html" >Getting started</a><a href="patterns.html" >Team patterns</a><a href="acp-agents.html" >ACP coding agents</a><a href="help.html" >Ask code-flow</a></section><section><h2>Work with agents</h2><a href="runs.html" >Runs and workspace</a><a href="auto-team.html" >Auto team</a><a href="project-teams.html" >Project missions (preview)</a><a href="review-inbox.html" >Review inbox</a><a href="verification.html" >Verification and review</a><a href="github.html" >GitHub, review and shipping</a><a href="github-review-threads.html" >GitHub review threads</a><a href="task-reruns.html" >Selective task reruns</a><a href="deferred-runs.html" >Deferred runs</a></section><section><h2>Your workspace</h2><a href="configuration.html" >Configuration</a><a href="context-inspection.html" >Context and budgets</a><a href="project-conventions.html" >Versioned project conventions</a><a href="checkpoint-review.html" >Checkpoints and reversions</a><a href="launch-profiles.html" >Service launch profiles</a><a href="code-intelligence.html" >Code intelligence</a><a href="architecture-explorer.html" >Architecture explorer</a><a href="memory-storage.html" >Project memory</a><a href="memory-claims.html" >Semantic claim review</a><a href="coordinated-changes.html" >Coordinated changes</a></section><section><h2>Connect and collaborate</h2><a href="team-collaboration.html" >Team collaboration</a><a href="shared-projects.html" aria-current="page">Shared project accounts</a><a href="ssh-projects.html" >SSH projects</a><a href="remote-workers.html" >Remote agent workers</a><a href="code-hosts.html" >GitLab and Bitbucket code workflows</a><a href="external-sources.html" >Read-only external sources</a><a href="automations.html" >Automations and away mode</a><a href="notifications.html" >Outbound notifications</a></section><section><h2>Operate safely</h2><a href="security.html" >Security, subscriptions and caveats</a><a href="filesystem-policy.html" >Project filesystem policy</a><a href="agent-containers.html" >Agent containers</a><a href="filtered-tasks.html" >Filtered Docker tasks</a><a href="dependency-discovery.html" >Dependency discovery</a><a href="maintenance.html" >Backup and maintenance</a></section><section><h2>Build and extend</h2><a href="architecture.html" >Architecture and development</a><a href="api.html" >Local API and command-line client</a><a href="extensions.html" >Provider and workflow extensions</a><a href="provider-compatibility.html" >Provider compatibility</a><a href="accessibility.html" >Accessibility acceptance</a><a href="performance.html" >Performance</a><a href="run-storage.html" >Run storage</a><a href="documentation.html" >Documentation and GitHub Pages</a><a href="releasing.html" >Preparing a preview release</a><a href="vscode.html" >Code Flow for VS Code</a></section><section><h2>Engineering records</h2><a href="application-improvements.html" >Application improvement program</a><a href="project-first-navigation-plan.html" >Project navigation review and implementation plan</a><a href="dynamic-teams-evaluation.html" >Dynamic teams: implementation evidence and rollout decision</a><a href="dynamic-teams-implementation-plan.html" >Dynamic teams, workflows, messaging, and memory</a><a href="dynamic-teams-implementation-review-1.html" >Review 1: the dynamic teams implementation</a><a href="worker-permission-verification.html" >Live worker permission verification</a><a href="dynamic-teams-plan-review-0.html" >Review 0: Dynamic teams implementation plan</a><a href="project-teams-implementation-plan.html" >Standing project teams implementation plan</a><a href="performance-results.html" >Measured performance: 19 October 2026</a></section><a class="app-link" id="back-app" hidden href="/">← Back to app</a></nav>
+<main id="content" tabindex="-1"><div class="breadcrumb">Documentation <span>/</span> Connect and collaborate</div><article><h1 id="shared-project-accounts">Shared project accounts</h1>
+<p>Create a local account and grant roles only for the projects that person should see. Review the role table before allowing contributions or maintenance, and revoke access when it is no longer needed.</p>
+<h2 id="share-review-access">Share review access</h2>
+<p>The server owner can create local accounts and assign one of four project roles; each role includes everything the roles before it may do. A <strong>viewer</strong> reads project run results, safe verification metadata, changed-file diffs and sanitized result exports. A <strong>reviewer</strong> also records human file-review coverage and comments in a separate thread anchored to the exact result commit. A <strong>contributor</strong> also owns tasks on the project&#39;s team board and runs them on their own computer with their own agents. A <strong>maintainer</strong> also assigns any task owner, defines a project&#39;s repository keys, deletes board tasks and checkpoints, revokes runners, cancels hand-overs and approves instructions to agents; accounts and roles stay with the owner. The contributor and maintainer capabilities are described in <a href="team-collaboration.html">Team collaboration</a>. The owner reads and replies to comments through <strong>Changes → Human collaboration comments</strong> on the normal run page. Comments are collaboration records: they never enter an agent&#39;s prompt or resume work.</p>
+<p>The owner retains administration and generic run controls. Project roles alone do not allow users to start or resume arbitrary runs on this server, approve agent/tool requests, send agent notes, run checks/setup/services, change repository files, choose Docker images or authentication volumes, use terminals, merge/push/post to GitHub, edit private memory/conventions, configure integrations, manage accounts or inspect global filesystem/settings/quotas. Project assignment is not an operating-system sandbox. An explicit owner grant under Settings → Connections → Share access → People allows a contributor to queue their own team tasks on the host through the dedicated <a href="team-collaboration.html#let-teammates-run-tasks-on-the-host">host execution queue</a>. This delegates host execution authority to trusted teammates; it does not provide an operating-system sandbox. Generic run and shell APIs remain owner-only. A separate <a href="team-collaboration.html#give-trusted-teammates-an-interactive-terminal">interactive terminal grant</a> lets a trusted contributor open their own shell on the host. That shell has the host OS user’s authority, including file changes and access outside the project; the review API restrictions do not sandbox terminal commands.</p>
+<p>The review dashboard uses independent bootstrap requests so shared users do not load the normal composer&#39;s global health/configuration APIs. Lists, searches, cursors, attention items, run events, reconnect snapshots and exports must be filtered by current project membership on the server. Unauthorized object identities are answered as unavailable. The dashboard holds one board/review event stream for the tab it shows (<code>/api/events</code> on Results, <code>/api/team/events</code> on Board), reloads on its frames and loads the bell&#39;s unread count once with the page, keeping it live only while the Board tab is shown; it sends no periodic request of its own, so an idle dashboard does not renew its session by polling. An open interactive terminal has its own authenticated output stream. Removing a repository from a project removes shared access to its runs. An ambiguous legacy run without an explicit project is not shared automatically.</p>
+<p>Shared review projections omit local paths, run commands, environment/volume configuration, raw agent tool events/logs, session identifiers, capability receipts, context/manifests, notes, memory and private conventions. Result summaries and final output are project-visible and have recognized secret patterns redacted; arbitrary sensitive prose cannot be detected reliably. Credential files and rename sources are omitted from shared diffs and coverage. Coverage describes only shared-reviewable files and reports omitted files requiring owner review. Parent/continuation references are included only when that related run is also authorized. Private conventions drafts are owner-only even when a user is assigned to their project.</p>
+<p>Shared results bound task text to 24 KiB, summaries to 32 KiB and errors to 4 KiB of UTF-8. Only the latest 200 steps are included, with 8 KiB final-output and 4 KiB error previews per step. Truncation and omitted-step counts are explicit in the API and dashboard. Exports retain these same safe preview limits. Raw transcripts are not shared exports.</p>
+<h2 id="authentication-and-storage">Authentication and storage</h2>
+<p>Accounts live in private <code>CODEFLOW_HOME/shared-accounts.json</code>; the server never returns password hashes or session hashes. Passwords require at least 15 characters and at most 1024 UTF-8 bytes, without normalization or truncation. Built-in scrypt uses a fresh 16-byte salt, a 32-byte key and parameters <code>N=131072, r=8, p=1</code>. Verification compares keys in constant time and performs a dummy derivation for unknown accounts. At most two password derivations run concurrently; a full queue is refused. Login attempts have bounded global, socket-address and username rate limits.</p>
+<p>Sessions use 32 random bytes and store only SHA-256 hashes. They expire after 12 hours or 30 minutes idle; each account retains at most eight sessions. Role/display-name/enabled/password changes and owner revocation invalidate every session for the account. Session activity extends idle time in memory; a restart can expire a session earlier than its last activity. Revoked identities must lose open streams immediately. Corrupt or symbolic account storage disables shared authentication without overwriting the file; the owner&#39;s printed recovery-token link remains available.</p>
+<p>Network sign-in and authenticated shared requests require actual HTTPS, independently of the phone development override. Cookies are HttpOnly and SameSite=Strict, Secure on HTTPS. The server validates Host/Origin and mutation request type. Shared cookies are distinct from owner and phone sessions. An explicit valid owner bearer credential on the local listener takes precedence; otherwise a valid shared cookie takes precedence. The network listener refuses local owner bearer credentials and recovery links; use its separate phone pairing or shared sign-in. Shared sign-in clears the owner browser cookie, and an explicit local owner recovery link clears the shared cookie. Account creation disables first-browser owner claiming.</p>
+<p>Backup and restore omit account/session stores, including older archives. Recreate accounts and assign project roles deliberately after restoring. Human collaboration comments can be retained with application data but convey no authentication authority.</p>
+<h2 id="api-and-enforcement-contract">API and enforcement contract</h2>
+<p><code>POST /api/auth/login {username,password}</code> sets the session cookie. <code>GET /api/auth/self</code> returns only the current public identity; <code>POST /api/auth/logout</code> revokes the current session. Owner administration uses <code>GET/POST /api/accounts</code>, <code>PUT /api/accounts/:id</code> and <code>POST /api/accounts/:id/revoke-sessions</code>. Every mutation carries the exact current account-state <code>revision</code>; stale updates fail with 409 while preserving the existing state. Project IDs must be validated against the current project store before assigning roles.</p>
+<p>Run collaboration uses <code>GET /api/runs/:id/collaboration</code> and, for reviewers and higher roles, <code>POST /api/runs/:id/collaboration {branch,expectedHead,text}</code>. The server authenticates the actor and resolves an owned result branch; the store rejects a changed commit. Comments are bounded to 4000 characters and 200 entries per run, with immutable author/time/commit metadata. File reviews use the existing revision-guarded <code>POST /api/runs/:id/review-coverage</code> with authenticated actor audit. User-supplied actor fields never grant identity.</p>
+<p><code>canonicalSharedPath</code> checks the original request target before URL normalization, accepts the versioned <code>/api/v1</code> alias, and rejects encoded separators, double encoding, dot segments, empty segments and extra ambiguous suffixes. <code>sharedRoutePolicy</code> allows only explicitly enumerated method/path pairs; unknown routes default to owner-only. Global authorization must run before all API/workspace handlers, and resource authorization must precede Git/filesystem operations. Public pairing/webhook routes retain separate secret capabilities and do not inherit a shared user&#39;s project roles.</p>
+<p>The account, access-policy and comment-store tests cover hash-only storage, modes, exact revisions, role escalation refusal, revocation, expiry, bounded login work, malformed paths/aliases, cross-project membership, projection privacy and durable commit-anchored comments. End-to-end server/browser tests are required before exposing the shared routes.</p>
+<p>The password parameters and authorization model follow the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html">OWASP Password Storage Cheat Sheet</a>, <a href="https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html">Authorization Cheat Sheet</a> and <a href="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html">Session Management Cheat Sheet</a>.</p>
+<hr>
+<p><a href="index.html">Documentation library</a> · <a href="getting-started.html">Getting started</a> · <a href="help.html">Ask code-flow</a></p>
+</article><footer><a href="https://github.com/midhunxavier/code-flow/blob/main/docs/shared-projects.md">Edit this page on GitHub ↗</a><span>code-flow · 0.1.0-preview.1 · <a href="font-license.txt">Font license</a></span></footer><nav class="pagination" aria-label="Adjacent guides"><a href="team-collaboration.html"><small>← Previous</small>Team collaboration</a><a href="ssh-projects.html"><small>Next →</small>SSH projects</a></nav></main>
+<aside class="on-page" aria-label="On this page"><strong>On this page</strong><a class="depth-2" href="#share-review-access">Share review access</a><a class="depth-2" href="#authentication-and-storage">Authentication and storage</a><a class="depth-2" href="#api-and-enforcement-contract">API and enforcement contract</a></aside>
+<aside id="help-panel" hidden aria-labelledby="help-title"><div class="chat-heading"><div><span class="eyebrow">Your AI companion</span><h2 id="help-title">Ask code-flow</h2></div><button id="close-help" aria-label="Close AI companion">✕</button></div><div class="chat-toolbar"><span>Grounded in your docs</span><button id="new-chat">New chat</button></div><div id="help-messages" role="log" aria-label="Help conversation" aria-live="polite"><div id="chat-welcome"><span class="chat-mark" aria-hidden="true">✦</span><h3>What would you like to do?</h3><p>Let’s find your next step. Ask about setup, workflows or something that’s unclear.</p><div class="suggestions"><button type="button" data-question="How do I start my first run?">Start my first run ↗</button><button type="button" data-question="What should I do when a check fails?">Understand a failed check ↗</button></div></div></div><p id="help-status" role="status">Checking your installed CLIs…</p><button id="retry-help" hidden>Retry connection</button><form id="help-form" hidden><label class="sr-only" for="question">Your question</label><textarea id="question" rows="3" maxlength="4000" placeholder="Ask a question…" required></textarea><div class="composer-controls"><label class="sr-only" for="help-agent">Use your CLI</label><select id="help-agent"></select><button type="button" id="stop-help" hidden>Stop</button><button class="primary" id="send-help" aria-label="Send message">Send ↗</button></div><small>Uses your CLI login and quota. Shift + Enter for a new line.</small></form><a id="help-guide" href="help.html">About your local companion →</a></aside></div>
+<dialog id="search-dialog" aria-labelledby="search-title"><div class="dialog-title"><h2 id="search-title">Search documentation</h2><button data-close="search-dialog" aria-label="Close search">✕</button></div><label class="sr-only" for="search">Search all guides</label><input id="search" type="search" placeholder="Search workflows, settings, troubleshooting…" autocomplete="off"><div id="search-results" aria-live="polite"></div></dialog>
+</body></html>

package/public/docs/ssh-projects.html ADDED Viewed

@@ -0,0 +1,60 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="description" content="SSH projects — code-flow guides and reference"><title>SSH projects · code-flow</title><link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAGAAAABgCAYAAADimHc4AAAbSElEQVR42u19a7Ak53nW87xfz5zbrtYSNnbwRU4UGywZE2E5GKfCerETxUlRIVRWVUBcXBJLOKU4wchA7IKzBxzsXCCxQ1JEIT9SCUXYjQMEKiQorpWILSmJpJjgtZEdZGQby7Zuez17zkx/78OP7+ue7p6eOXPO7kryiedU15mZ7pnufi/Pe/8G+OrjWX3wyp9ChBrnOvFMnPMyPo5COAbgGARSXxkXvS6DFHBcYV+J67oMJ1VAsuemBhxXwFEIpE8UQLZ27/nn0w78iTLieTAMxxHEGIk5gqKgEDAlXbEEiur9EsBSel4Q3AJQlJdBPyOIAoDDMAALh5UOg0phqRhH4NzSeOuJ7atPP45v+JoLjfsiTsBwC+Ozz4AkEbWKLn9081rZ8IgUDrv7jXR7MYRDCBi4Ae7pzE2Fri5E1XMB6hwDAMwHOtI+dT4L5c9OXWN+j5OTsPO9ZPt4AFAJUH6BtC+BeLhk/Ag8/Bb+Mh9sQCxbQveMMUAiAAOTFKw+oJu9xNtY4s1cxSEYoHGSXs/S6oI8E4kdojZvnNX7mRHW4E5FaFfnY5nIUoMZuyACK6YQotLpSZAGIAAYAG6AX4A84B4P5c/gmwa/Wmv/HrSBl4SHG4nry/fqm8ywEQLexAESPkTETBBGRzpQ6X9U58bVf2Hsea0usWtZmM0YNr5Dc26+eVzFDAIyAEaIgCBIROGrQDRgXOIuL/GPcZgPQTIQ6r+j/oftGes36Dj+8eHaffFfDMzvGS7jTYMRFDYRrYQoBDmCHAaBcFAC5GlD878mGxr73CfHe+e1Kur79MaKBAKs85pqv0bj/ebrxnVSDirCFBEgFOZQcR5xeBa+EvAtheEjuLt8B0jH+jFmZLhCGpBVbfmjunZQ4JeKFXwzz0MQHECQJwn0TNAKGD1LabWP3QuYoQVNqOpKdA356nneOJCYhripHT3XxGyD2JDWpBlqfJRRBcL4ADA6X/6s3jS4Heviom5rsRfir35E31AU/mvFkn0tz6EEENwRmoQX2nhcS7imbGM/A9TznG0D2/zfhKXuZ2dSoYe5Td6o88EK2ibwJJghcEwNTyPi6uL7R781Nt3Mt+MGBQDx8mmAZCB97V792WC4qwh4IbZRCigqqZ8ifPM9z1pQSfEiBMfOaNq0AXOUaUdta7pS7LFD3efpv8Mm3pRAi6OrUIzOxTvwbcW/XMQwczcGd+X+Cy8ZaPV/FAW+FluIAoLHTPzkkNX4LPVrQFNaey9A85lQMa+JstqJ8nv0TDiDIZPXmmwECAqF+fYQPo7jw/iW4X2V4O6dAVXA8XUP2sGLN941PGiH/RxKCEWM/VLvHY+kBUH5rOqqvxr+f4foTX9fPd6M5km1dkd1qvO8wYguEyo3mUieBgwwMPoBC9tb/nvxnH0zTqHExmzPaGcvKEd7axdufE9x0A77WZRyFJXku9pwU7+uvBa1PZfqdY+30fu8hreGF9TyhmK/JwTPCOwLbjFt8unr9Yb9anpkHvN7YrIPSSCDnUMslu0bsRa/O3mLs+nMRXB/cK/+/LJwfwGYxjA5GDXtj3vjgtEDQ7NwftqaLmCY5xmEKxCSTqQdtTEzNiLoyt8mYYboK2bbI3zUfx+H53lEi3hBDKP4vnAgDHQeUQ62JGIO/PR6P5qD99ph/yyi8wozgW0jzwa8Wp3CMDgcJkCScROwAn/RXzd6Dbj0sVm2oJjrcpIx3D8+Urh9q87B4QjuE99eHenv84TQ3bAAM9QD9pqD65rDlN3YgO55Oc0YNY5jvm9axRSmUJkk5WVYs8Ivhu9w4GO4G4YJ6RZgwNF06Uvj4h1hCdBFuBzmmiZ+RWz3jlvYJbx38wk7aIFmEHcRKNoLA2ZpHvuPk0+YkNxRQlJKIlLkGIDCGwAAb+yPCYp52D+8b+sVNsbNuADIETRDcis/v4aePmlGMyRekPiLYLwukz3QDprRhCM0UheVsFmj/iSHCGIbgPsrcVLLILf68rv9DMjqYuPiu2wZKzqDKE0Y0Ap6vA03wgzY8TlE340hxoJ24VJsQJ8GdfflPJR6YpG0W8QYgPR8nME1AL4wZa9mMiCriyHczHFKH6sj2U2vp2V8+xigGYRdlAm7lf7dHscd0h+zckhdLWBDYQRw7CB0EBolBhybtmDWG/WSWrtPL7QSN2oblMP6DGori9nNTs5jQt8x3vk/61if8/lZW995Fv1s33d5Oy6A1MjOEnJCLio6IARsXlwBABxbxAbckPlblq9hUVytzRyketu4TuXiZ0m4z7AH8yBnlpfU9Yq4g2ZwQc3hgm5tJxSfBJScLmAIyRyX7rCwvTgDXpC/RsWrGQAXooCiie+t4ke2AwsRdRHY0RzXchE3doEE35S/Pw/uOFsI2HU4GlUjSTArAOk8lg88vXhB5vFM2zGua6rZVEKtMjZxjoovoMozYaEPghaFIy0AQ4vA1axzzrNrE61IySHyKbwCT2YN0M4acCof5HixUr6HLePrO/jlmiH1e/GCFomKL8U4L5q84wxY6yniKEODSdIQYAyfxk3cxPp6byQ8rQGZS2XEquJ0bh+NoMt9B0ldRAK1gHbMO35R4z7rc/M0bIfvaJZFJwm8uhSYWxbsdzJhbXe5IM9MrTKUnGBeyyX1BTBdl2iEL1X6fQFJ36laP2O/OtLPLLJyBt+K0a4K/3XGVcxngNgRCO+JCAU4Z3gos3BykRTDohB0qdHyIvFAH/x0EnN1iZIJo+lyLA1N7veOvxsfw/p63UGycD0gYoaf39dFsBuiawG/HAscs+jmC3hl2sFbm4pVBEQHPbV6mHLBXlULRWrO4MD+FUjhhmPcfVFeAD1vnYtqlhU5L/2gXULRbiBokYwodgEz6km6qaeA3yhs1K4/J1Jq0aMvLweN44f9/4Zfx7rmti/O1ACLM1BLC0rUosS/HJtfhu/AbEehEsSqNMdMOKuYkMt85u6wgjH6uWIt3I4NOj5xgntqS2HV+pI1oS5KqMftmuVmLnqzi6ajF3l+OQv0nWp/XXxvWd7EfcpFQeVKESB8/+hv8n9j/WSBjSPlnhiQawvtbOY8yccupHtRo6tLNMCa4c1wjqGdQqlJIMQpp98TU9ydIssDw+Cj8bv9tuEvY10FNnbuFZ1rAxbKaPoOzNiNG7oTg7CHegF2WeJstaCki2ibhsroOSiXCRHFUlEGuBz/wG8b/mSSfMZFzjQvDmhlPedh/5QA7RZzF80JLZqm7jOq2EVdue9C2MzByOkuYxF8tSjKEp9WwO34Xv53HD5ZYONIXBQEd2YA5msAewik3Ro+7BGisIsE3E7FdzUkPG+CqwqsCAmkKAQOlkzLQFn62SjciRW8H3+LT2bMj7uxQDsyoNmcKk33U7aHKpTqpJrU7rST97SbbOnlMrharCZMGgkDA9MUDdPARiT+yIEPYcV+AX+Xn051lJ0N7iU353JGKp6uhJTG9I25SQllFFyCMyW1xUYue5bEZ51Sp9151jGLULfqyanaxmtjasp+PatCr7LYEIg0boHlpjw8Brc/EvGHHOJ+x9MP4bZrztSEx92eJR+XjwHuRJ5Fq+IMdtMNMbUDaJjyFrqwNdLZ7W1cGG9ja1xirIgylSbgIpjmBPKXctLnUROHk+c9rdDUpPdePZ1TUn83VX2SVgduOgfJ1n5WKTVuO/UUiM/K8RDK8Hs4vfkAfuVVX6i//9afG+ATjztObOxpPKkfDSWCFI/rrqUVvBkXU0G+RYicoItDQOPS9dSF8/rSxfM4W47gdAiGpLuA3NLNVhBbjTVlAlSEF6uBlDxzpcSsuuFG7d7YWppZzWhVhGYjWdVmNlralM7V0olmlxPSYBQNCEUKu3y0TbNPgvwvivgP+NlrTwEAjirgxN6G9WYywI7rrqVlvFmbqQu6PjAKMiIS8C+fOavPX3gKm4gKAyLAkr1CKo56Nc7JiQYo/0+tZEwSWM88TAitNBGUPlOXuyfSKmai11NEzaaRDtx0NKD67hZz0NAWqYqECAqWrRoZEJbAMIS2L2yT4Vdj0PvxwZd9HACxvk5s7E4bZjKgOK67BkttBtAhL8A4Go/1f558XE+U5zFcNgUExDQ+BY+s52g9d07WIztkQyMsE3ZC/JrYlcSrTfy03zLcVARuawXFqdvS9Bv1JyftcOz3BtjqhibgJB1QoeFB+Hhz02g/Wn7xpT+CE4zN2TlcyoxYNqmNxJygIRjPb23xf335c3zKz3FlEIBIlKVD0eFeGUdNZkJbI3Z1cJn2G9rEl0FuSaJlEA0kE5wx4UGaWUwQl5iYta6Cn8m4RL21b4z5Oxu9hta4RutkeqbcNJO8gCRsn4mUr2qwtmF/6rHfWL3jMy/CBh1Hj4dLH9Jr5H4oQAPCz2xt8dTjn8M4jDgMQOkRcoekXAkivOoEpiZhY2tOqCKUZU2ZSLpqzcjgSwMZIAQgb1ImegU9DduQhwHhFYOnhbjhSWF6ULZvLrPd/eG54O5yAgiUi1tPl7TBt26NBh9e+qEvfh1O3JI04ZIYUN2EHAiAXxyN9ckn/p80GCNQ8iz1Qkzg1AjBXEpNkg44JxxwVM307JmkridCAQaIAVCAK0DKhK8I7m2mzZL0JtH7G84rI94dvZjSiMlpGkkC5UYgouD26ZI2uH4cR7+Jd37+pdigL8KE2RBEz6JlkFz61JOPacwtBgc9xjwV6YR7Ijg8e0DKQeSMgd7qPpq5DiQjnQx41oBM8InRZgvTNYuwE3Sf2+2vJhR23drpabA2nyenT4of0woK22dLFiuvsFF5HH//syto+dm7ZIA8k7hA0GPnT+v0+LQNTYwoXXA4HEq8gWJzHqZp0NXo2mWjpVpwqNVOPZWLbRnZJrPYGzGz8bfXUYzezmvO3Gr+ZVgCUXDrTInhVa8P0d+b7MEJ2xsDBEcAMIojfuHs4zYIQowl5FGKLkUXFCV3CUkLIE82ofpr9jGmMDMXTlMVg83As6cXvEX8jsROChesI9mpGipmrAah+TmN2hvt519TEyYedL5lKtjW6QiEH1y5/bPfiBO3xHlGua8thTm9cBEDAGe2zmjLz9MQIURIDleqEbkmxE6vK8LXVwOn6inturmoM67TSk+of9JcPZLLvp7AKUjpEH43s+nEDKNde8+trXJEEAEbhLGP/gkA4PqjWpwBVW+o8TEB4FNbZwFFyBPeyzWZnGMiNl3teSXvwIMmJaWa+KxshVpGMwmqWqPvMzOf1A5TG5yZIu3N0HKBrg22oL0dytR6EDg6J7fiLYN3PPraeQbZejrjUngS7BGNAF0oL5ICPEqClKFeSVItq2p2/SrvJlTC1gANqoYHZnjSItUgTOP+FIm5QFFJszs2WtMmfYExO7xki3x18F4H89nnG6yFUnorAOAT/RfZpwHJrhj+p58XMN5OJqYymmAywWpMhGnOXdV+W6xI6e2kmfWv/KAFRt2ZDXv/wdx9fnpubbIHhiamRWzX0CSQcRsQ3nLt+meWc66Ii2iAACCu4iHfGn0RcoO8BDzDUO4VkDITKs3zbAsEyDOh6+vxLPXKYyUNHMgdSE3DrQ4VOGuFiJ1aNhbtVSEWGz6b5xmhETdk/z1ui+R1j54bvCrPXizAgCqU/nY+LsdJBAxMvk15MsL1mDQqrZjcNXM8ML3ATLYVmdA1M/J7VQuwqq7TJsPqKpCmZ0VnMYScX+HfiVFzpJ/tjEeTiSI7CCbXYDWAeA0A4O67bTE39PoXEADiKPyiI6QuReXJWEmpjCFP3o6ake9EUr3nRps9LMwpiyqCVk4iAIlxyi0H7WHYOS3X6lnniXvrT+kKdnfdm6bdYZMpbHhIVdBpYIyvyqNfC8YBG0cisG54oviwynCvg2tGjQA4PApwpyAyU7mCn0q6cyw7qRAzE5fNpEHaZ3SQuacPk83yQgPkpDXB2HC/1Uw2tBNsO1vb+YTvwstU2qgakbf2MWiMzlfXKAcirk2G+HEtGogJR28gNlgq6qcdwSFGg8fU415HpQKzXVBMBI0xLXeoGlIElMkI06vqmFI5zYW06ERiosfMzGpluawJFYRNWtay8e1I/BQ0a7ZRncq7cVrauwzp5uxaxO7RiMrzBg7Migdmh8k5ghv/9Ev+wGP4ZRefR2AMVjkFdxBOwKmYcb1aVqPWFOUReqUALqZFKl2NLccVysZbMR0rJaaqVO1x1Wal8r6aK3zM8MY4a9EhThFrStrnaYD1MZLTjJndmb7AaiknbhGOHg/lky+7s9TwpDw8z+TbIKIBkYjJDjCnKJmTczUTqtREJcFMGSZW6YpshJurTwjKy45UTZE+sTdopLgbjKiZ0e3lQXtlQM6JG9iFF7aPZ2drQRSnl70hEkSZgcHOJgg6wd0uV+M4cUo4wRiXX7oxjoPfkRdXmTQCVCZyuaA8nCl3gE7PUTMqTFesit21oaVXRjfnl6vXqtZXbDj5uS/HpBasEOydne3WIGpp7KyJ2YIPdt7fxYbJd1XmCLRU2DaDrHik6dzsctXEDQfWDT/Ji/Hpl707+tKveAzLFEJaFVQRiA5FT6LrEVRafYfukGLtmiqlNJJmVHZAnss5XjdbqjIwakRnNeE129j2LH9YE9zQXF+s9T5z/a96vqsNve+lp0xyE/ipFOS+UXvsC9rwPOUxKoGfwt959OMhlN8nlF+flmTVGAbQSxMtlRDFQMlUiYPDkldAA2LICWkDFMhUQkuVL+WlUqvYodlbopBdD0AK2UNiu18mm73uarDsSdqRHReTnSB61hK7ndRFdRnd3WRAuT0Oawcf8uYA5N6XrawamCjcqlWUn38LNLqZ8D8NxgOpouWeWE+DVMhgFCw5xCQEY1VeJAKFANJAN4gmYACiKkMaCBNTQ0JVpZwEruOU4xAIqxeNaaeLmaPT7trEVU2afQzoGuvOc/Y3zFpuG8wpMGexau7jU/GVX3MjbuP40petrKYGUuV/E8CHAH5Ib/3cKxHGr0YcvxLGF4FaBTQAUMgZQJkkg1laTyr58AGSiakMqchcTgmsK2FQgESJhBnBGCAvRFsheDVZvAhLBwI1AsoLqYuI1o5Ru66jdROknE4d9TKjsZAc2VMNUi5hq+KRMFgBXL+J2zie1Tu0SwY00hUQcfhYwD0bEb/0kk8B+BQWnKXYy+xE6zNHFfQirGnzSy+30fiIyL9uw2v+ArUJ+MjFYFKjMYNsDxVNEdX6M6tEDwQ1l0Rhw6azpUykmcetaBz++wgA18/Nl+PSVnk8etzw5VPEn7xBOHFKwMaV/qEDdbF88EMXvge68BNm/kKNz7vTMhNSd8uk+c469ZnqPcywBz3EbywUUdvxjIs5ERA1PBTi+MJv+I+98Dvm9QpdyV+z4JWl/zHi6A3EI08bHrwtAvClH7h4nYqL/4mhfLVGF9xJS9a7yo1YFlrrOIJsB1GzavN1o2x22DiR/hr75SLMow1JhDeU7z/0uzh6PODELfFZ+gkTPDM/xXLrAwXuvGmMd229YqDN+4K2roleSoBVcgnm3mA2OxmnffnZFKoDwLpol6AnSb9BYIylrzy/iFtnf0Y/9vzb5xF/76unP/cewp03jXHrAwP8+PKnSfxzLF1FMgVCoKH+X4ttjguqZQ+tJwawTkSco2laOp5WfW+10LdHLR8q4njzY5J+GOsyXH9Kz/KP+DyTbEgAc/B9uGZ0+olPAniB+yiPtli7v4dsQ1DT2LK/yFM7udlGkA2n12NEsRoiwpcd5V/Cew89vJP07ycNQD2IcewYz72bTzr5gIarAOkwa8QQWbLNJlJvjUjYplLK9RgBjbXU01IAliRfpYYHQrThUxbK78R7Dz2MwyeLnYi//xgAIC0LIJbCownrTcrEaxK6CtBbhLdu3kiZPzkMqWGpYTLcSyxfXbgNP2PBvq3cOHQ/1k8WuGexiZn9x4ATyVUx+hptOnfDOt/TJH73V3wqrEcK0muNybBjhMHdHNLaC4pI/vYwDA6X68Pf3+2gHvcdAyBiHRyUT99vYel1vn3eZWZgmKB47mJQN6HfaAe3yr3s/NgNIZirRFguYigAC++Lb7B/iiMscfhkgXt2N6hn++6H1gAcGG7/mTAYvoa+DQRjLb3513jaBZP2EjAphc/s3TQgxwSTPAiOtauLOBg8guXBt8f3hHfjCFP74T27n5LcXwy4IU3ZjcG/YUtrS5CizDiBH06XKzmBm0T4pr2YGGFzjyxWzFcOmZv/QjxQvD6+i/8tTUmucxGDexmScc9xF5SM+FEdxPbW9yBuw3OhnmxMu0iN1TZSYm1Sk2EjEFYVXLlFwNeuDq74GQXeEd9lv9aYDY64hKVBin1kfA1AXPb4nWFp+Vq/cCYqWKhSBXXTNCdrr9U5uEZRXZz0twVXZLEa4tIAMvz8yjXhPee/l483ZoMv+ccU9w8DTh0TJPJHtm8FCVljSJKsG8iBRo2n2VpSpxYESm4CtHooROERLOOd8Qf5n89fJqnff15QzrWvfECvt63yo9reYpSq2dIaUTyvNz9p47JGBJw9HKFksVqoCHDi30bih3EHn8DhkwXeeLdjY0OXi/j7RwOOZv9/q7wNRWEasRRV1AVyAQ7PDYvsNF/ldT7hbm7UgQOFwx+2If5h/AH+egvr78FlT7MX+8L1vIVx5QN6CS6Wf03bI4gI9bQSmz+fyqnlHQmJLufwYHBzl+GnDrzc/tmZ7+LpidQfKa/U5Rf7w/UENIpvteXiKp2/EEVm42uNlv7cOKtGbcwRiRB0YDU48AdYCe+Mb+fdZ66w1O8jG5Brgj+HleXT5R8Gs+vieMuFVH1GvfZsnpJKU4WgSxSdyweCM25pwJ+Iy198H2578ebEw9n7Ahx/fDTgePqNs8Gm/ootFdfp4kUHc1U+B19pgrDh10dF2jD46lIQcfdwNdyx+bb848yX2cPZ/wyo+mzG8VYNg0TWrr7YmWqS3KKg1YPBDU9hiI3y7fjXJemJ8FcW6/cfBGXXc/BB/TmO4wMhenA52zORuSU1ekRYDj4IiIb/ODiIfzRKK10ZDq8b7tl4RqV+f2jA9chDJPGvDpZCga2yBFnUk+Ak4O6MpK+uheh4NCzjPXo7/90IAG59YIA7X1viHpbP5m0UX8HeT+ptK8uXcynEarY8R7yOUtJwNfhAUMC/8VUc87fxS/XQ9J03jZ8Lt1F8BeM/AaAYLv22Av62Us+pSyCKVfNlIDp+15b4nvj3+OFny8jubzdUIu5GCA/6B0D7PghDwOEFHtaSfRCve/DncdNN44ZrqecS8fdXRezHdT0cL0fAabwWD+EIt9IyYifDc03q99+jbxmA9ZPFTkvFfPVxuZlwXAFHFb5K+K8+Fn78f4eywyDh1HjXAAAAAElFTkSuQmCC"><link rel="stylesheet" href="style.css"><script src="app.js" defer></script></head>
+<body data-page="ssh-projects"><a class="skip-link" href="#content">Skip to content</a>
+<header class="topbar"><a class="brand" href="index.html"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAGAAAABgCAYAAADimHc4AAAbSElEQVR42u19a7Ak53nW87xfz5zbrtYSNnbwRU4UGywZE2E5GKfCerETxUlRIVRWVUBcXBJLOKU4wchA7IKzBxzsXCCxQ1JEIT9SCUXYjQMEKiQorpWILSmJpJjgtZEdZGQby7Zuez17zkx/78OP7+ue7p6eOXPO7kryiedU15mZ7pnufi/Pe/8G+OrjWX3wyp9ChBrnOvFMnPMyPo5COAbgGARSXxkXvS6DFHBcYV+J67oMJ1VAsuemBhxXwFEIpE8UQLZ27/nn0w78iTLieTAMxxHEGIk5gqKgEDAlXbEEiur9EsBSel4Q3AJQlJdBPyOIAoDDMAALh5UOg0phqRhH4NzSeOuJ7atPP45v+JoLjfsiTsBwC+Ozz4AkEbWKLn9081rZ8IgUDrv7jXR7MYRDCBi4Ae7pzE2Fri5E1XMB6hwDAMwHOtI+dT4L5c9OXWN+j5OTsPO9ZPt4AFAJUH6BtC+BeLhk/Ag8/Bb+Mh9sQCxbQveMMUAiAAOTFKw+oJu9xNtY4s1cxSEYoHGSXs/S6oI8E4kdojZvnNX7mRHW4E5FaFfnY5nIUoMZuyACK6YQotLpSZAGIAAYAG6AX4A84B4P5c/gmwa/Wmv/HrSBl4SHG4nry/fqm8ywEQLexAESPkTETBBGRzpQ6X9U58bVf2Hsea0usWtZmM0YNr5Dc26+eVzFDAIyAEaIgCBIROGrQDRgXOIuL/GPcZgPQTIQ6r+j/oftGes36Dj+8eHaffFfDMzvGS7jTYMRFDYRrYQoBDmCHAaBcFAC5GlD878mGxr73CfHe+e1Kur79MaKBAKs85pqv0bj/ebrxnVSDirCFBEgFOZQcR5xeBa+EvAtheEjuLt8B0jH+jFmZLhCGpBVbfmjunZQ4JeKFXwzz0MQHECQJwn0TNAKGD1LabWP3QuYoQVNqOpKdA356nneOJCYhripHT3XxGyD2JDWpBlqfJRRBcL4ADA6X/6s3jS4Heviom5rsRfir35E31AU/mvFkn0tz6EEENwRmoQX2nhcS7imbGM/A9TznG0D2/zfhKXuZ2dSoYe5Td6o88EK2ibwJJghcEwNTyPi6uL7R781Nt3Mt+MGBQDx8mmAZCB97V792WC4qwh4IbZRCigqqZ8ifPM9z1pQSfEiBMfOaNq0AXOUaUdta7pS7LFD3efpv8Mm3pRAi6OrUIzOxTvwbcW/XMQwczcGd+X+Cy8ZaPV/FAW+FluIAoLHTPzkkNX4LPVrQFNaey9A85lQMa+JstqJ8nv0TDiDIZPXmmwECAqF+fYQPo7jw/iW4X2V4O6dAVXA8XUP2sGLN941PGiH/RxKCEWM/VLvHY+kBUH5rOqqvxr+f4foTX9fPd6M5km1dkd1qvO8wYguEyo3mUieBgwwMPoBC9tb/nvxnH0zTqHExmzPaGcvKEd7axdufE9x0A77WZRyFJXku9pwU7+uvBa1PZfqdY+30fu8hreGF9TyhmK/JwTPCOwLbjFt8unr9Yb9anpkHvN7YrIPSSCDnUMslu0bsRa/O3mLs+nMRXB/cK/+/LJwfwGYxjA5GDXtj3vjgtEDQ7NwftqaLmCY5xmEKxCSTqQdtTEzNiLoyt8mYYboK2bbI3zUfx+H53lEi3hBDKP4vnAgDHQeUQ62JGIO/PR6P5qD99ph/yyi8wozgW0jzwa8Wp3CMDgcJkCScROwAn/RXzd6Dbj0sVm2oJjrcpIx3D8+Urh9q87B4QjuE99eHenv84TQ3bAAM9QD9pqD65rDlN3YgO55Oc0YNY5jvm9axRSmUJkk5WVYs8Ivhu9w4GO4G4YJ6RZgwNF06Uvj4h1hCdBFuBzmmiZ+RWz3jlvYJbx38wk7aIFmEHcRKNoLA2ZpHvuPk0+YkNxRQlJKIlLkGIDCGwAAb+yPCYp52D+8b+sVNsbNuADIETRDcis/v4aePmlGMyRekPiLYLwukz3QDprRhCM0UheVsFmj/iSHCGIbgPsrcVLLILf68rv9DMjqYuPiu2wZKzqDKE0Y0Ap6vA03wgzY8TlE340hxoJ24VJsQJ8GdfflPJR6YpG0W8QYgPR8nME1AL4wZa9mMiCriyHczHFKH6sj2U2vp2V8+xigGYRdlAm7lf7dHscd0h+zckhdLWBDYQRw7CB0EBolBhybtmDWG/WSWrtPL7QSN2oblMP6DGori9nNTs5jQt8x3vk/61if8/lZW995Fv1s33d5Oy6A1MjOEnJCLio6IARsXlwBABxbxAbckPlblq9hUVytzRyketu4TuXiZ0m4z7AH8yBnlpfU9Yq4g2ZwQc3hgm5tJxSfBJScLmAIyRyX7rCwvTgDXpC/RsWrGQAXooCiie+t4ke2AwsRdRHY0RzXchE3doEE35S/Pw/uOFsI2HU4GlUjSTArAOk8lg88vXhB5vFM2zGua6rZVEKtMjZxjoovoMozYaEPghaFIy0AQ4vA1axzzrNrE61IySHyKbwCT2YN0M4acCof5HixUr6HLePrO/jlmiH1e/GCFomKL8U4L5q84wxY6yniKEODSdIQYAyfxk3cxPp6byQ8rQGZS2XEquJ0bh+NoMt9B0ldRAK1gHbMO35R4z7rc/M0bIfvaJZFJwm8uhSYWxbsdzJhbXe5IM9MrTKUnGBeyyX1BTBdl2iEL1X6fQFJ36laP2O/OtLPLLJyBt+K0a4K/3XGVcxngNgRCO+JCAU4Z3gos3BykRTDohB0qdHyIvFAH/x0EnN1iZIJo+lyLA1N7veOvxsfw/p63UGycD0gYoaf39dFsBuiawG/HAscs+jmC3hl2sFbm4pVBEQHPbV6mHLBXlULRWrO4MD+FUjhhmPcfVFeAD1vnYtqlhU5L/2gXULRbiBokYwodgEz6km6qaeA3yhs1K4/J1Jq0aMvLweN44f9/4Zfx7rmti/O1ACLM1BLC0rUosS/HJtfhu/AbEehEsSqNMdMOKuYkMt85u6wgjH6uWIt3I4NOj5xgntqS2HV+pI1oS5KqMftmuVmLnqzi6ajF3l+OQv0nWp/XXxvWd7EfcpFQeVKESB8/+hv8n9j/WSBjSPlnhiQawvtbOY8yccupHtRo6tLNMCa4c1wjqGdQqlJIMQpp98TU9ydIssDw+Cj8bv9tuEvY10FNnbuFZ1rAxbKaPoOzNiNG7oTg7CHegF2WeJstaCki2ibhsroOSiXCRHFUlEGuBz/wG8b/mSSfMZFzjQvDmhlPedh/5QA7RZzF80JLZqm7jOq2EVdue9C2MzByOkuYxF8tSjKEp9WwO34Xv53HD5ZYONIXBQEd2YA5msAewik3Ro+7BGisIsE3E7FdzUkPG+CqwqsCAmkKAQOlkzLQFn62SjciRW8H3+LT2bMj7uxQDsyoNmcKk33U7aHKpTqpJrU7rST97SbbOnlMrharCZMGgkDA9MUDdPARiT+yIEPYcV+AX+Xn051lJ0N7iU353JGKp6uhJTG9I25SQllFFyCMyW1xUYue5bEZ51Sp9151jGLULfqyanaxmtjasp+PatCr7LYEIg0boHlpjw8Brc/EvGHHOJ+x9MP4bZrztSEx92eJR+XjwHuRJ5Fq+IMdtMNMbUDaJjyFrqwNdLZ7W1cGG9ja1xirIgylSbgIpjmBPKXctLnUROHk+c9rdDUpPdePZ1TUn83VX2SVgduOgfJ1n5WKTVuO/UUiM/K8RDK8Hs4vfkAfuVVX6i//9afG+ATjztObOxpPKkfDSWCFI/rrqUVvBkXU0G+RYicoItDQOPS9dSF8/rSxfM4W47gdAiGpLuA3NLNVhBbjTVlAlSEF6uBlDxzpcSsuuFG7d7YWppZzWhVhGYjWdVmNlralM7V0olmlxPSYBQNCEUKu3y0TbNPgvwvivgP+NlrTwEAjirgxN6G9WYywI7rrqVlvFmbqQu6PjAKMiIS8C+fOavPX3gKm4gKAyLAkr1CKo56Nc7JiQYo/0+tZEwSWM88TAitNBGUPlOXuyfSKmai11NEzaaRDtx0NKD67hZz0NAWqYqECAqWrRoZEJbAMIS2L2yT4Vdj0PvxwZd9HACxvk5s7E4bZjKgOK67BkttBtAhL8A4Go/1f558XE+U5zFcNgUExDQ+BY+s52g9d07WIztkQyMsE3ZC/JrYlcSrTfy03zLcVARuawXFqdvS9Bv1JyftcOz3BtjqhibgJB1QoeFB+Hhz02g/Wn7xpT+CE4zN2TlcyoxYNqmNxJygIRjPb23xf335c3zKz3FlEIBIlKVD0eFeGUdNZkJbI3Z1cJn2G9rEl0FuSaJlEA0kE5wx4UGaWUwQl5iYta6Cn8m4RL21b4z5Oxu9hta4RutkeqbcNJO8gCRsn4mUr2qwtmF/6rHfWL3jMy/CBh1Hj4dLH9Jr5H4oQAPCz2xt8dTjn8M4jDgMQOkRcoekXAkivOoEpiZhY2tOqCKUZU2ZSLpqzcjgSwMZIAQgb1ImegU9DduQhwHhFYOnhbjhSWF6ULZvLrPd/eG54O5yAgiUi1tPl7TBt26NBh9e+qEvfh1O3JI04ZIYUN2EHAiAXxyN9ckn/p80GCNQ8iz1Qkzg1AjBXEpNkg44JxxwVM307JmkridCAQaIAVCAK0DKhK8I7m2mzZL0JtH7G84rI94dvZjSiMlpGkkC5UYgouD26ZI2uH4cR7+Jd37+pdigL8KE2RBEz6JlkFz61JOPacwtBgc9xjwV6YR7Ijg8e0DKQeSMgd7qPpq5DiQjnQx41oBM8InRZgvTNYuwE3Sf2+2vJhR23drpabA2nyenT4of0woK22dLFiuvsFF5HH//syto+dm7ZIA8k7hA0GPnT+v0+LQNTYwoXXA4HEq8gWJzHqZp0NXo2mWjpVpwqNVOPZWLbRnZJrPYGzGz8bfXUYzezmvO3Gr+ZVgCUXDrTInhVa8P0d+b7MEJ2xsDBEcAMIojfuHs4zYIQowl5FGKLkUXFCV3CUkLIE82ofpr9jGmMDMXTlMVg83As6cXvEX8jsROChesI9mpGipmrAah+TmN2hvt519TEyYedL5lKtjW6QiEH1y5/bPfiBO3xHlGua8thTm9cBEDAGe2zmjLz9MQIURIDleqEbkmxE6vK8LXVwOn6inturmoM67TSk+of9JcPZLLvp7AKUjpEH43s+nEDKNde8+trXJEEAEbhLGP/gkA4PqjWpwBVW+o8TEB4FNbZwFFyBPeyzWZnGMiNl3teSXvwIMmJaWa+KxshVpGMwmqWqPvMzOf1A5TG5yZIu3N0HKBrg22oL0dytR6EDg6J7fiLYN3PPraeQbZejrjUngS7BGNAF0oL5ICPEqClKFeSVItq2p2/SrvJlTC1gANqoYHZnjSItUgTOP+FIm5QFFJszs2WtMmfYExO7xki3x18F4H89nnG6yFUnorAOAT/RfZpwHJrhj+p58XMN5OJqYymmAywWpMhGnOXdV+W6xI6e2kmfWv/KAFRt2ZDXv/wdx9fnpubbIHhiamRWzX0CSQcRsQ3nLt+meWc66Ii2iAACCu4iHfGn0RcoO8BDzDUO4VkDITKs3zbAsEyDOh6+vxLPXKYyUNHMgdSE3DrQ4VOGuFiJ1aNhbtVSEWGz6b5xmhETdk/z1ui+R1j54bvCrPXizAgCqU/nY+LsdJBAxMvk15MsL1mDQqrZjcNXM8ML3ATLYVmdA1M/J7VQuwqq7TJsPqKpCmZ0VnMYScX+HfiVFzpJ/tjEeTiSI7CCbXYDWAeA0A4O67bTE39PoXEADiKPyiI6QuReXJWEmpjCFP3o6ake9EUr3nRps9LMwpiyqCVk4iAIlxyi0H7WHYOS3X6lnniXvrT+kKdnfdm6bdYZMpbHhIVdBpYIyvyqNfC8YBG0cisG54oviwynCvg2tGjQA4PApwpyAyU7mCn0q6cyw7qRAzE5fNpEHaZ3SQuacPk83yQgPkpDXB2HC/1Uw2tBNsO1vb+YTvwstU2qgakbf2MWiMzlfXKAcirk2G+HEtGogJR28gNlgq6qcdwSFGg8fU415HpQKzXVBMBI0xLXeoGlIElMkI06vqmFI5zYW06ERiosfMzGpluawJFYRNWtay8e1I/BQ0a7ZRncq7cVrauwzp5uxaxO7RiMrzBg7Migdmh8k5ghv/9Ev+wGP4ZRefR2AMVjkFdxBOwKmYcb1aVqPWFOUReqUALqZFKl2NLccVysZbMR0rJaaqVO1x1Wal8r6aK3zM8MY4a9EhThFrStrnaYD1MZLTjJndmb7AaiknbhGOHg/lky+7s9TwpDw8z+TbIKIBkYjJDjCnKJmTczUTqtREJcFMGSZW6YpshJurTwjKy45UTZE+sTdopLgbjKiZ0e3lQXtlQM6JG9iFF7aPZ2drQRSnl70hEkSZgcHOJgg6wd0uV+M4cUo4wRiXX7oxjoPfkRdXmTQCVCZyuaA8nCl3gE7PUTMqTFesit21oaVXRjfnl6vXqtZXbDj5uS/HpBasEOydne3WIGpp7KyJ2YIPdt7fxYbJd1XmCLRU2DaDrHik6dzsctXEDQfWDT/Ji/Hpl707+tKveAzLFEJaFVQRiA5FT6LrEVRafYfukGLtmiqlNJJmVHZAnss5XjdbqjIwakRnNeE129j2LH9YE9zQXF+s9T5z/a96vqsNve+lp0xyE/ipFOS+UXvsC9rwPOUxKoGfwt959OMhlN8nlF+flmTVGAbQSxMtlRDFQMlUiYPDkldAA2LICWkDFMhUQkuVL+WlUqvYodlbopBdD0AK2UNiu18mm73uarDsSdqRHReTnSB61hK7ndRFdRnd3WRAuT0Oawcf8uYA5N6XrawamCjcqlWUn38LNLqZ8D8NxgOpouWeWE+DVMhgFCw5xCQEY1VeJAKFANJAN4gmYACiKkMaCBNTQ0JVpZwEruOU4xAIqxeNaaeLmaPT7trEVU2afQzoGuvOc/Y3zFpuG8wpMGexau7jU/GVX3MjbuP40petrKYGUuV/E8CHAH5Ib/3cKxHGr0YcvxLGF4FaBTQAUMgZQJkkg1laTyr58AGSiakMqchcTgmsK2FQgESJhBnBGCAvRFsheDVZvAhLBwI1AsoLqYuI1o5Ru66jdROknE4d9TKjsZAc2VMNUi5hq+KRMFgBXL+J2zie1Tu0SwY00hUQcfhYwD0bEb/0kk8B+BQWnKXYy+xE6zNHFfQirGnzSy+30fiIyL9uw2v+ArUJ+MjFYFKjMYNsDxVNEdX6M6tEDwQ1l0Rhw6azpUykmcetaBz++wgA18/Nl+PSVnk8etzw5VPEn7xBOHFKwMaV/qEDdbF88EMXvge68BNm/kKNz7vTMhNSd8uk+c469ZnqPcywBz3EbywUUdvxjIs5ERA1PBTi+MJv+I+98Dvm9QpdyV+z4JWl/zHi6A3EI08bHrwtAvClH7h4nYqL/4mhfLVGF9xJS9a7yo1YFlrrOIJsB1GzavN1o2x22DiR/hr75SLMow1JhDeU7z/0uzh6PODELfFZ+gkTPDM/xXLrAwXuvGmMd229YqDN+4K2roleSoBVcgnm3mA2OxmnffnZFKoDwLpol6AnSb9BYIylrzy/iFtnf0Y/9vzb5xF/76unP/cewp03jXHrAwP8+PKnSfxzLF1FMgVCoKH+X4ttjguqZQ+tJwawTkSco2laOp5WfW+10LdHLR8q4njzY5J+GOsyXH9Kz/KP+DyTbEgAc/B9uGZ0+olPAniB+yiPtli7v4dsQ1DT2LK/yFM7udlGkA2n12NEsRoiwpcd5V/Cew89vJP07ycNQD2IcewYz72bTzr5gIarAOkwa8QQWbLNJlJvjUjYplLK9RgBjbXU01IAliRfpYYHQrThUxbK78R7Dz2MwyeLnYi//xgAIC0LIJbCownrTcrEaxK6CtBbhLdu3kiZPzkMqWGpYTLcSyxfXbgNP2PBvq3cOHQ/1k8WuGexiZn9x4ATyVUx+hptOnfDOt/TJH73V3wqrEcK0muNybBjhMHdHNLaC4pI/vYwDA6X68Pf3+2gHvcdAyBiHRyUT99vYel1vn3eZWZgmKB47mJQN6HfaAe3yr3s/NgNIZirRFguYigAC++Lb7B/iiMscfhkgXt2N6hn++6H1gAcGG7/mTAYvoa+DQRjLb3513jaBZP2EjAphc/s3TQgxwSTPAiOtauLOBg8guXBt8f3hHfjCFP74T27n5LcXwy4IU3ZjcG/YUtrS5CizDiBH06XKzmBm0T4pr2YGGFzjyxWzFcOmZv/QjxQvD6+i/8tTUmucxGDexmScc9xF5SM+FEdxPbW9yBuw3OhnmxMu0iN1TZSYm1Sk2EjEFYVXLlFwNeuDq74GQXeEd9lv9aYDY64hKVBin1kfA1AXPb4nWFp+Vq/cCYqWKhSBXXTNCdrr9U5uEZRXZz0twVXZLEa4tIAMvz8yjXhPee/l483ZoMv+ccU9w8DTh0TJPJHtm8FCVljSJKsG8iBRo2n2VpSpxYESm4CtHooROERLOOd8Qf5n89fJqnff15QzrWvfECvt63yo9reYpSq2dIaUTyvNz9p47JGBJw9HKFksVqoCHDi30bih3EHn8DhkwXeeLdjY0OXi/j7RwOOZv9/q7wNRWEasRRV1AVyAQ7PDYvsNF/ldT7hbm7UgQOFwx+2If5h/AH+egvr78FlT7MX+8L1vIVx5QN6CS6Wf03bI4gI9bQSmz+fyqnlHQmJLufwYHBzl+GnDrzc/tmZ7+LpidQfKa/U5Rf7w/UENIpvteXiKp2/EEVm42uNlv7cOKtGbcwRiRB0YDU48AdYCe+Mb+fdZ66w1O8jG5Brgj+HleXT5R8Gs+vieMuFVH1GvfZsnpJKU4WgSxSdyweCM25pwJ+Iy198H2578ebEw9n7Ahx/fDTgePqNs8Gm/ootFdfp4kUHc1U+B19pgrDh10dF2jD46lIQcfdwNdyx+bb848yX2cPZ/wyo+mzG8VYNg0TWrr7YmWqS3KKg1YPBDU9hiI3y7fjXJemJ8FcW6/cfBGXXc/BB/TmO4wMhenA52zORuSU1ekRYDj4IiIb/ODiIfzRKK10ZDq8b7tl4RqV+f2jA9chDJPGvDpZCga2yBFnUk+Ak4O6MpK+uheh4NCzjPXo7/90IAG59YIA7X1viHpbP5m0UX8HeT+ptK8uXcynEarY8R7yOUtJwNfhAUMC/8VUc87fxS/XQ9J03jZ8Lt1F8BeM/AaAYLv22Av62Us+pSyCKVfNlIDp+15b4nvj3+OFny8jubzdUIu5GCA/6B0D7PghDwOEFHtaSfRCve/DncdNN44ZrqecS8fdXRezHdT0cL0fAabwWD+EIt9IyYifDc03q99+jbxmA9ZPFTkvFfPVxuZlwXAFHFb5K+K8+Fn78f4eywyDh1HjXAAAAAElFTkSuQmCC" width="30" height="30" alt=""><strong>Code Flow</strong><span>Docs</span></a><button class="search-trigger" id="open-search">Search documentation <kbd>⌘ K</kbd></button><div class="top-actions"><a href="https://github.com/midhunxavier/code-flow">GitHub ↗</a><button id="theme" aria-label="Change color theme">Theme</button><button id="open-help" class="primary" hidden aria-expanded="false" aria-controls="help-panel">Ask code-flow</button><button id="menu" aria-label="Toggle documentation navigation" aria-expanded="false" aria-controls="sidebar">☰</button></div></header>
+<div class="layout"><nav class="sidebar" id="sidebar" aria-label="Documentation"><section><h2>Get started</h2><a href="index.html" >Overview</a><a href="installation.html" >Install Code Flow preview</a><a href="getting-started.html" >Getting started</a><a href="patterns.html" >Team patterns</a><a href="acp-agents.html" >ACP coding agents</a><a href="help.html" >Ask code-flow</a></section><section><h2>Work with agents</h2><a href="runs.html" >Runs and workspace</a><a href="auto-team.html" >Auto team</a><a href="project-teams.html" >Project missions (preview)</a><a href="review-inbox.html" >Review inbox</a><a href="verification.html" >Verification and review</a><a href="github.html" >GitHub, review and shipping</a><a href="github-review-threads.html" >GitHub review threads</a><a href="task-reruns.html" >Selective task reruns</a><a href="deferred-runs.html" >Deferred runs</a></section><section><h2>Your workspace</h2><a href="configuration.html" >Configuration</a><a href="context-inspection.html" >Context and budgets</a><a href="project-conventions.html" >Versioned project conventions</a><a href="checkpoint-review.html" >Checkpoints and reversions</a><a href="launch-profiles.html" >Service launch profiles</a><a href="code-intelligence.html" >Code intelligence</a><a href="architecture-explorer.html" >Architecture explorer</a><a href="memory-storage.html" >Project memory</a><a href="memory-claims.html" >Semantic claim review</a><a href="coordinated-changes.html" >Coordinated changes</a></section><section><h2>Connect and collaborate</h2><a href="team-collaboration.html" >Team collaboration</a><a href="shared-projects.html" >Shared project accounts</a><a href="ssh-projects.html" aria-current="page">SSH projects</a><a href="remote-workers.html" >Remote agent workers</a><a href="code-hosts.html" >GitLab and Bitbucket code workflows</a><a href="external-sources.html" >Read-only external sources</a><a href="automations.html" >Automations and away mode</a><a href="notifications.html" >Outbound notifications</a></section><section><h2>Operate safely</h2><a href="security.html" >Security, subscriptions and caveats</a><a href="filesystem-policy.html" >Project filesystem policy</a><a href="agent-containers.html" >Agent containers</a><a href="filtered-tasks.html" >Filtered Docker tasks</a><a href="dependency-discovery.html" >Dependency discovery</a><a href="maintenance.html" >Backup and maintenance</a></section><section><h2>Build and extend</h2><a href="architecture.html" >Architecture and development</a><a href="api.html" >Local API and command-line client</a><a href="extensions.html" >Provider and workflow extensions</a><a href="provider-compatibility.html" >Provider compatibility</a><a href="accessibility.html" >Accessibility acceptance</a><a href="performance.html" >Performance</a><a href="run-storage.html" >Run storage</a><a href="documentation.html" >Documentation and GitHub Pages</a><a href="releasing.html" >Preparing a preview release</a><a href="vscode.html" >Code Flow for VS Code</a></section><section><h2>Engineering records</h2><a href="application-improvements.html" >Application improvement program</a><a href="project-first-navigation-plan.html" >Project navigation review and implementation plan</a><a href="dynamic-teams-evaluation.html" >Dynamic teams: implementation evidence and rollout decision</a><a href="dynamic-teams-implementation-plan.html" >Dynamic teams, workflows, messaging, and memory</a><a href="dynamic-teams-implementation-review-1.html" >Review 1: the dynamic teams implementation</a><a href="worker-permission-verification.html" >Live worker permission verification</a><a href="dynamic-teams-plan-review-0.html" >Review 0: Dynamic teams implementation plan</a><a href="project-teams-implementation-plan.html" >Standing project teams implementation plan</a><a href="performance-results.html" >Measured performance: 19 October 2026</a></section><a class="app-link" id="back-app" hidden href="/">← Back to app</a></nav>
+<main id="content" tabindex="-1"><div class="breadcrumb">Documentation <span>/</span> Connect and collaborate</div><article><h1 id="ssh-projects">SSH projects</h1>
+<p>Add a connection in Settings → Connections → Work on another computer, connect to the host and select a repository there. The remote workspace has its own execution environment and installed CLIs.</p>
+<h2 id="open-a-remote-workspace">Open a remote workspace</h2>
+<p>Open an existing repository on a Linux or macOS server and use the complete code-flow workspace there. File browsing and editing, Git, agent sessions, approvals, terminals, worktrees, setup, builds, verification, and development servers all run on that server. Local and connected remote projects appear together in the sidebar. Click a project to work on its computer; the top bar shows the computer name. Everything stays on the main app address, with remote projects under <code>/computer/&lt;saved-host-id&gt;/</code>.</p>
+<h2 id="connect">Connect</h2>
+<ol>
+<li><p>Install Node.js 22.13 or newer and Git on the server. Install and sign in to the agent CLIs you want to use on that server. Python 3 enables interactive terminals; Chrome/Chromium on the server enables snapshots. The server must allow SSH TCP forwarding to its loopback interface.</p>
+</li>
+<li><p>Configure keys, ports, jump hosts and hostnames in your normal <code>~/.ssh/config</code>, for example:</p>
+<pre><code class="language-sshconfig">Host devbox
+  HostName server.example.com
+  User developer
+  IdentityFile ~/.ssh/id_ed25519
+  Port 22
+</code></pre>
+</li>
+<li><p>Run <code>ssh devbox</code> in a terminal once to verify its host key and authentication. Check that <code>node --version</code> and <code>git --version</code> work in the remote login shell. Unlock passphrase-protected keys in your local SSH agent. Password prompts are not supported in the app.</p>
+</li>
+<li><p>Start code-flow with <code>npm start</code>. The normal <code>npm run build</code> builds both the UI and portable remote backend. For an existing development server, run <code>npm run build:host</code> after code changes.</p>
+</li>
+<li><p>Open <strong>Settings → Connections → Work on another computer</strong> (or <strong>This computer → Manage connections…</strong> in the top bar). Select an alias or enter <code>user@hostname</code> and name it. Optionally enter an <strong>SSH port</strong> and an <strong>Identity file</strong> path on your computer, such as <code>~/.ssh/id_ed25519</code>. Leave them blank to inherit your SSH config. Choose <strong>Save connection</strong> to keep the definition for later or <strong>Connect and open</strong> to start the remote workspace.</p>
+</li>
+<li><p>The folder picker now browses the server. Choose a Git repository and use the app normally. Agent availability and login status refer to the server.</p>
+</li>
+</ol>
+<p>Connecting installs the application backend, without npm installation or administrator privileges, into <code>~/.codeflow/ssh-host/releases/&lt;version&gt;</code> on the server. Its projects, runs, settings and logs live in <code>~/.codeflow/ssh-host/state</code>. Local provider credentials, repositories, SSH agents and environment variables are not copied. Credentials and tools must be set up independently on the server.</p>
+<h2 id="reconnect-and-stop">Reconnect and stop</h2>
+<p>The remote backend is detached from SSH. Closing the page, disconnecting, removing a saved connection, or stopping the local app leaves remote work running. Reopen the saved connection to restore projects and runs. Reloading a remote project restores its connection automatically. You can also reopen it from <strong>Settings → Connections → Work on another computer</strong>. Reconnecting does not resubmit actions. After a connection loss during a mutation, inspect the run or files before repeating the action.</p>
+<p>Saved connections, including optional ports and key paths, survive local app restarts. Key contents are never stored by code-flow. If opening a newly saved connection fails, it stays in the list so you can retry with <strong>Open</strong> after resolving SSH authentication. Remove and re-add a connection to change its definition. The backend and work survive SSH interruptions, but not a server reboot or an administrator terminating the process. On backend restart, existing code-flow recovery marks interrupted work for explicit resumption. A backend that still has a live PID but fails its authenticated health check is not automatically replaced.</p>
+<p><strong>Disconnect</strong> closes only the SSH channels and preview forwards. <strong>Stop backend</strong> stops an idle backend and is refused while runs, terminals or development services are active. Finish work and close these first. Scheduled work also stops with the backend. On the next connection, the current application build is installed. A running backend is reused during client upgrades so active work is not interrupted; stop it when idle to update it.</p>
+<h2 id="remote-development-previews">Remote development previews</h2>
+<p>In the side panel&#39;s Browser, enter the development server&#39;s <code>http://localhost:&lt;port&gt;</code> URL. Code-flow forwards that remote port over SSH and shows it on an isolated local preview origin, including hot reload WebSockets. Remote app cookies are separate from code-flow&#39;s session cookies. Arbitrary external browsing and screenshots continue to use the remote backend&#39;s existing capabilities. A remote localhost URL copied directly into a separate local browser tab is not automatically forwarded; use the app&#39;s Browser preview.</p>
+<h2 id="connection-boundaries">Connection boundaries</h2>
+<p>The app uses OpenSSH and your existing config, including ProxyJump. It enforces known host keys, noninteractive authentication, no agent or X11 forwarding, no configured port forwarding, and no local SSH commands. SSH command arguments never include project paths or prompts. Both the local app and remote backend bind only to loopback. Backend authentication cannot be claimed by the first browser, and its private token stays between the local gateway and the remote backend.</p>
+<p>All projects use the local app’s owner session and trusted UI. Requests under <code>/computer/&lt;saved-host-id&gt;/api/</code> are routed over that computer’s SSH connection; they never fall back to the local backend. Drafts, event streams and popped-out panels are scoped to their computer. Remote API responses are sandboxed and cannot execute scripts on the app origin. Local cookies, bearer tokens and forwarding headers are removed before requests cross SSH; remote response cookies cannot overwrite local sessions. Remote previews retain the existing preview isolation and the remote filesystem-policy gate.</p>
+<p>Only the local app owner can manage SSH connections. Shared-account and phone sessions cannot create SSH connections. Up to eight connections can be open and 32 definitions saved. Connections use the remote OS account&#39;s authority, so only connect to accounts and servers you trust.</p>
+<h2 id="troubleshooting">Troubleshooting</h2>
+<ul>
+<li><strong>Host key or authentication failed:</strong> run the exact alias with <code>ssh</code> in a terminal and resolve the error there. The app never accepts unknown fingerprints automatically.</li>
+<li><strong>Node not found:</strong> put Node.js 22.13+ on the remote login shell&#39;s PATH. No Node runtime is downloaded automatically.</li>
+<li><strong>Connection refused / forwarding prohibited:</strong> check the server&#39;s <code>AllowTcpForwarding</code>/<code>PermitOpen</code> settings and <code>~/.codeflow/ssh-host/host.log</code>.</li>
+<li><strong>Backend still running but unavailable:</strong> inspect the log and process before stopping it. The app avoids restarting a process that might still be doing work.</li>
+<li><strong>Another host setup is running:</strong> wait for it to finish. If setup crashed, verify no bootstrap process remains before removing <code>~/.codeflow/ssh-host/bootstrap.lock</code>.</li>
+<li><strong>Remote agent unavailable:</strong> install and sign in to its official CLI on the server. The app&#39;s health dialog shows that server&#39;s tools.</li>
+</ul>
+<p>This feature differs from <a href="remote-workers.html">SSH workers</a>: workers transfer individual agent turns and their commits. SSH projects keep the complete project and application backend on the server.</p>
+<h2 id="validation">Validation</h2>
+<p><code>npx tsx --test test/ssh-projects.test.ts</code> runs the packaged backend in a separate host home using an injected SSH transport. Browser coverage is in <code>test/e2e/ssh-projects.e2e.ts</code>. Run <code>CODEFLOW_TEST_LOOPBACK_SSH=1 npx tsx --test test/ssh-projects-ssh.test.ts</code> for the real OpenSSH acceptance test. It uses temporary keys, known hosts and an unprivileged loopback SSH daemon, and never edits personal SSH configuration.</p>
+<hr>
+<p><a href="index.html">Documentation library</a> · <a href="getting-started.html">Getting started</a> · <a href="help.html">Ask code-flow</a></p>
+</article><footer><a href="https://github.com/midhunxavier/code-flow/blob/main/docs/ssh-projects.md">Edit this page on GitHub ↗</a><span>code-flow · 0.1.0-preview.1 · <a href="font-license.txt">Font license</a></span></footer><nav class="pagination" aria-label="Adjacent guides"><a href="shared-projects.html"><small>← Previous</small>Shared project accounts</a><a href="remote-workers.html"><small>Next →</small>Remote agent workers</a></nav></main>
+<aside class="on-page" aria-label="On this page"><strong>On this page</strong><a class="depth-2" href="#open-a-remote-workspace">Open a remote workspace</a><a class="depth-2" href="#connect">Connect</a><a class="depth-2" href="#reconnect-and-stop">Reconnect and stop</a><a class="depth-2" href="#remote-development-previews">Remote development previews</a><a class="depth-2" href="#connection-boundaries">Connection boundaries</a><a class="depth-2" href="#troubleshooting">Troubleshooting</a><a class="depth-2" href="#validation">Validation</a></aside>
+<aside id="help-panel" hidden aria-labelledby="help-title"><div class="chat-heading"><div><span class="eyebrow">Your AI companion</span><h2 id="help-title">Ask code-flow</h2></div><button id="close-help" aria-label="Close AI companion">✕</button></div><div class="chat-toolbar"><span>Grounded in your docs</span><button id="new-chat">New chat</button></div><div id="help-messages" role="log" aria-label="Help conversation" aria-live="polite"><div id="chat-welcome"><span class="chat-mark" aria-hidden="true">✦</span><h3>What would you like to do?</h3><p>Let’s find your next step. Ask about setup, workflows or something that’s unclear.</p><div class="suggestions"><button type="button" data-question="How do I start my first run?">Start my first run ↗</button><button type="button" data-question="What should I do when a check fails?">Understand a failed check ↗</button></div></div></div><p id="help-status" role="status">Checking your installed CLIs…</p><button id="retry-help" hidden>Retry connection</button><form id="help-form" hidden><label class="sr-only" for="question">Your question</label><textarea id="question" rows="3" maxlength="4000" placeholder="Ask a question…" required></textarea><div class="composer-controls"><label class="sr-only" for="help-agent">Use your CLI</label><select id="help-agent"></select><button type="button" id="stop-help" hidden>Stop</button><button class="primary" id="send-help" aria-label="Send message">Send ↗</button></div><small>Uses your CLI login and quota. Shift + Enter for a new line.</small></form><a id="help-guide" href="help.html">About your local companion →</a></aside></div>
+<dialog id="search-dialog" aria-labelledby="search-title"><div class="dialog-title"><h2 id="search-title">Search documentation</h2><button data-close="search-dialog" aria-label="Close search">✕</button></div><label class="sr-only" for="search">Search all guides</label><input id="search" type="search" placeholder="Search workflows, settings, troubleshooting…" autocomplete="off"><div id="search-results" aria-live="polite"></div></dialog>
+</body></html>