Termexo v0.10.0

Remote access reaches past the local network: the desktop dials out to a relay you host yourself, and a phone or another computer opens the full workbench from anywhere — no public IP, no port forward — while the relay carries terminals it cannot read.

Relay

• The relay is a single cross-platform binary with its own admin console, in termexo-relay (v0.10.2: Linux, macOS and Windows on x64 and arm64, plus a container image).
• Settings → Remote access has a section for it: give it the relay's address, join with an enrolment code or an account on the relay, and the relay's address sits beside the LAN ones in the address list, QR code and all.
• A relay with a self-signed certificate is joined by its fingerprint. When the address starts with https:// the form asks for the SHA-256 the relay prints at startup — colons or not — and the desktop trusts that one certificate and no other, for the tunnel as well.
• A join that cannot connect says why: an untrusted certificate, a certificate that does not match the fingerprint, or an https address for a relay that is not serving HTTPS.
• A relay can hang off another relay, to any depth. An office relay behind NAT publishes its desktops on a public one, and the desktop lists every address it can be reached at and which relay each goes through.
• A device can require a relay sign-in before anyone reaches it — a gate on the relay's side, separate from the desktop's own access token.

End-to-end encryption

• The /ws handshake between the browser and the desktop is now v2. The access token is never sent: it proves itself and keys the session, and every frame after that is sealed with AES-256-GCM under a key of its own per direction. A 2.68 MB capture taken between a relay and a browser holds no token, no workspace name and no path, while the same browser renders all of them. A LAN page served over HTTPS gets this too.
• When the desktop requires the sealed handshake and the page was opened over plain HTTP, the browser sends no part of the token and tells you to open it over HTTPS.

OpenCode

• The provider allowance panel shows the ChatGPT Codex and OpenCode Go subscriptions connected through OpenCode, with their five-hour, weekly and monthly windows and reset times. Every figure is read from the service's own internal usage endpoint and treated as undocumented data. Thanks to @wuyh410 (#24).