Termio

Evidence shows Termio runs agents in a real PTY on the user's own machine, and the design docs explicitly acknowledge the agent has full access; the previously implemented Seatbelt sandbox (default-deny for ~/.ssh, Keychain, .env, with deny rules emitted last) has been removed entirely, so the current version has no enforced isolation, hence least_privilege is only 1. On permission confirmation, the phone-side permission prompt design was shelved and the author states they run locally with --dangerously-skip-permissions, so user_confirmation is only 1. Data flow transparency: the README explains that the iPhone connects directly to termiod and SSH only reads ~/.ssh/config, but there is no systematic description of where session data, hook payloads and telemetry go, so data_flow_transparency is 1. Sensitive data handling: the design docs discuss trade-offs around Keychain and credential mounting, but none of it shipped, so sensitive_data_handling is 1. Dependency security: only docs.yml is seen using Node built-in modules, with no third-party dependency declarations or audit records, so dependency_security is 1. External effects: the CLI can spawn/close sessions, send notifications and write ~/.claude/skills, which are real side effects, but there is no unified confirmation or dry-run mechanism, so external_effects is 1. Rollback: the sandbox-removal doc gives a git revert recovery path and sessions can be recovered via detach, but there is no user-facing operation rollback, so rollback is 1. Source attribution: NOTICE and the docs clearly credit nono (Apache-2.0) as the baseline data source, so source_attribution is 2.

The README architecture diagram, CLI command table and termiod tests agree on socket names, legacy fallback and the --wait exit code 3, so self_consistency is 2. Dependency availability: installation only offers a macOS dmg and a Homebrew cask, iOS goes through TestFlight, and Windows/Android/TUI are all roadmap; the Rust client requires cargo build and no dependency list appears in the evidence, so dependency_availability is 1. Failure messages: cli_compat.py shows clear non-zero exits and diagnostics for unknown flags, invalid ratios, missing sockets and silent timeouts, so failure_messages is 2.

The README clearly targets CLI/TUI agent users and covers local, SSH VPS and iPhone scenarios, so audience_and_scenarios is 2. Capability boundaries: the docs explicitly list what is not done (live resize, cross-VM control plane, network domain allowlist, Windows/Web), so capability_boundaries is 2. Trigger precision: the CLI's distinction between spawn/run/send, treating 7-digit hex as text, and requiring a target for --no-enter are constrained by tests, so trigger_precision is 2. Environment fit: Apple Silicon + macOS 14 only (the sandbox once required macOS 26), and Linux only as a remote attach target, so environment_fit is 1.

The README is clearly sectioned and docs/design is archived by date and status, so information_architecture is 2. Install notes: dmg, brew cask, TestFlight and npx skills add are provided, so install_notes is 2. Naming stability: the CLI changed from sessions to session while keeping an alias, and the socket changed from session-control.sock to app.sock with a fallback, showing naming has changed, so naming_stability is 1. Examples and FAQ: the README has many CLI examples and a screenshot table, so examples_and_faq is 2. Known limitations: multiple design docs list known defects and reasons for shelving, so known_limitations is 2. License: LICENSE is the full MIT text, so license is 3. Versioning and changelog: the README links an external changelog, there is no CHANGELOG file in the repo, and a docs.yml comment admits the changelog once lagged twelve versions, so versioning_changelog is 1. Maintenance responsibility: the README states it is looking for long-term maintainers and the publisher identity is unverified, so maintenance_responsibility is 1.

The CLI provides machine-readable output such as --json, --wait and session read, so output_usability is 2. Marginal value: compared with tmux it offers session state, hook notifications and iPhone mirroring, so marginal_value is 2. Cost benefit: it requires a macOS-only app, rewrites each agent's hook configuration on first launch, and the security benefit drops to zero after the sandbox capability was removed, so cost_benefit is 1.

The design docs give specific commit SHAs, file line numbers and a measured version number (claude 2.1.220), so claim_traceability is 2. Cross-source corroboration: the README, design docs and cli_compat.py corroborate each other on socket paths, exit codes and command semantics, so cross_source_corroboration is 2. Fact/inference separation: the docs clearly distinguish verified facts, open questions and proposals (e.g. launchPrefix marked NOT built), so fact_inference_separation is 2.