oh-my-term 是一个浏览器/原生客户端的远程终端：把 AI 编码智能体（Claude Code 等）跑在自己的机器上，手机或电脑随时接管会话。用户端关掉、网络断开，任务照常运行——每个会话由设备端 agent 守护，与客户端生命周期完全解耦。终端与文件载荷全程端到端加密，中继服务器只见密文。 oh-my-term is a remote terminal for browser and native clients: run AI coding agents (Claude Code et al.) on your own machines and take the sessions over from any device. Close the client, drop the network — the task keeps running, because every session is held by the on-device agent, fully decoupled from the client. Terminal and file payloads are end-to-end encrypted; the relay only ever sees ciphertext.
还没部署？先看 开始使用（三步上手）；下面按组件给出完整参考。 New here? Start with Get started (three steps); the chapters below are the full per-component references.
组件模型Components
| 名称Name | 角色Role | 形态Form | 参考Reference |
|---|---|---|---|
omts | 服务端：API、WebSocket 中继、设备注册、多节点、P2P 信令与 STUNServer: API, WebSocket relay, device registry, multi-node, P2P signaling + STUN | 单个 Rust 二进制，docker 运行Single Rust binary, run in docker | 服务端章节Server chapter |
omtc | 设备端 agent：PTY 守护、会话保持、自升级、TOFU 信任锚Device agent: PTY daemon, session persistence, self-update, TOFU anchor | 单个 Rust 二进制 + launcherSingle Rust binary + launcher | 设备端章节Device chapter |
omtn | 原生客户端壳：桌面（Windows/macOS/Linux）与移动端Native client shell: desktop (Windows/macOS/Linux) and mobile | 独立发行物Standalone distributions | 客户端手册Client manual |
omta | 页面应用：终端 UI、软键盘、文件管理（omtn 内嵌同一页面）The page app: terminal UI, soft keyboard, file manager (omtn embeds the same page) | 随 omtn 内嵌分发Shipped inside omtn | 客户端手册Client manual |
omts 与 omtc（及其共享 crates、wire 协议）以 Apache-2.0 开源；omtn 与 omta 以二进制发行物分发，从 GitHub Releases 与 Gitee 镜像下载。 omts and omtc (plus their shared crates and the wire protocol) are open source under Apache-2.0; omtn and omta ship as binary distributions from GitHub Releases and the Gitee mirror.
安全模型（要点）Security model, in brief
- 设备身份：Ed25519 密钥在设备本地生成；首次接入由用户核对 16 位十六进制 Bootstrap Commit（TOFU 锚定），此后双向验证。Device identity: Ed25519 keys are generated on the device; the first connection is pinned by verifying a 16-hex Bootstrap Commit (TOFU), then verified mutually.
- 端到端加密：终端与文件载荷用 AES-256-GCM 加密，密钥只存在于两端；中继只转发密文。E2E encryption: terminal and file payloads use AES-256-GCM with keys that never leave the two endpoints; the relay forwards ciphertext only.
- 签名更新链：
metainfo.json与产物 manifest 经 Ed25519 签名，设备核对钉住公钥的签名与 SHA-256 后才执行自升级。Signed updates:metainfo.jsonand artifact manifests are Ed25519-signed; devices verify the signature against the pinned key plus the SHA-256 before any self-update. - 密钥纪律：secrets 一律经环境变量注入进程，不进命令行（避免
/proc与docker inspect泄漏）。Secret discipline: secrets reach the process via environment bindings only, never on the command line (keeping them out of/procanddocker inspect). - 最小暴露：omts 默认只监听 loopback，公网入口收敛在反代；容器非 root、无 capability 运行。Minimal exposure: omts listens on loopback by default with the public ingress funneled through a reverse proxy; containers run non-root with no capabilities.
- 安全披露：漏洞请走开源仓的 GitHub Security Advisory（私密披露），勿开公开 issue。隐私政策与账号删除见 隐私政策 / 账号删除。Disclosure: please report vulnerabilities via the GitHub Security Advisory on the open-source repo (private disclosure), not a public issue. See Privacy / account deletion.
版本号体系Versioning
四个版本常量独立演进：PROJECT（服务端/整体列车）、CLIENT（omtc）、WEB_ASSETS（omta 页面）、PROTOCOL（wire 协议）。同一版本号不会出现两种载荷；每趟发版列车四仓统一打 v<PROJECT> tag，各组件仓的 release 用自己的版本号。
Four version constants evolve independently: PROJECT (server / the release train), CLIENT (omtc), WEB_ASSETS (the omta pages), PROTOCOL (the wire protocol). A given version number never carries two payloads; each release train tags all repos v<PROJECT>, while each component repo's release uses its own version.
下载与校验Downloads & verification
- 产物在 GitHub Releases 与 Gitee 镜像同步分发，文件名一致；下载页会自动选择更快的源。Artifacts ship to GitHub Releases and the Gitee mirror in lockstep with identical filenames; the download page auto-selects the faster source.
- 每个 release 附
SHA256SUMS.txt；下载后sha256sum -c SHA256SUMS.txt --ignore-missing核对。Every release carriesSHA256SUMS.txt; verify withsha256sum -c SHA256SUMS.txt --ignore-missingafter downloading. - omtc 的自动升级通道有独立的 Ed25519 签名链（见 设备端章节），与手工校验互不依赖。omtc's auto-update channel has its own Ed25519 signature chain (see the device chapter), independent of manual checksum verification.