核心开源 · Apache-2.0 · 端到端加密 Core open source · Apache-2.0 · E2E encrypted
把 AI 编码智能体跑在自己的机器上，手机随时接管会话。用户端关掉、网络断开，任务照常运行——端到端加密，全平台随身。 Run AI coding agents on your own machines and take sessions over from your phone. Close the client, drop the network — tasks keep running. End-to-end encrypted, native everywhere.
所有产物在 GitHub Releases 与 Gitee 镜像同步分发，附 SHA-256 校验和。 Everything ships via GitHub Releases and the Gitee mirror, with SHA-256 checksums.
真键盘，能按 · 点击设备可换前后 Real keys, pressable · click a device to swap
每个会话都跑在设备端 agent 里，与用户端生命周期完全解耦。手机锁屏、用户端退出、地铁里断网——回来时终端画面原样恢复，最近的输出都在。机器开着，任务就一直跑。 Every session runs inside the on-device agent, fully decoupled from the client. Lock your phone, quit the client, lose signal on the subway — come back and the screen is restored, recent output right where you left it. As long as the host is awake, the task keeps running.
// 架构architecture
客户端、中继、设备端 agent 三层各司其职：中继只转发密文，能直连就直连。 Client, relay and device agent each do one job: the relay only forwards ciphertext, and P2P wins whenever the network allows.
// 特性features
类 screen/tmux 的会话保持，但不需要学任何命令。设备端 agent 守护每个 PTY：用户端关掉、网络断开都不影响任务，重连自动恢复现场，最近输出随时回看。screen/tmux-style persistence, without learning any new commands. The device agent keeps every PTY alive — closing the client or dropping the network never touches the task. Reattach restores the screen; recent output stays reviewable.
Esc、Ctrl、方向键、PgUp/PgDn 都在拇指够得着的地方；长按出组合键，上滑直出符号。手机上开 TUI 也能得心应手。Esc, Ctrl, arrows and PgUp/PgDn within thumb's reach; long-press for combos, flick up for symbols. Driving a TUI from a phone finally feels natural.
Claude Code、vim、htop 的全屏界面原样呈现：alt-screen、256 色、滚动区域，一个都不丢。Claude Code, vim and htop render exactly as designed — alt-screen, 256 colors, scroll regions, nothing lost.
给会话打上 Working / Done：哪只智能体在干活、哪只已收工，列表里一眼扫完。Mark sessions Working or Done and see at a glance which agent is busy and which has finished.
手机、平板、电脑同时在线；每台设备几十个会话，侧栏随切随走，attach 状态跨设备接力。Phone, tablet and desktop stay online together. Dozens of sessions per device, one tap to switch, hand a session off mid-run.
网络条件允许时自动建立 WebRTC 直连，延迟更低；直连不成无缝回落加密中继。通道切换，会话无感。Automatic WebRTC direct when the network allows, seamless fallback to the encrypted relay. The channel switches; the session never notices.
浏览远端目录、上传下载、把文件直接粘贴进会话——不用另开 scp。Browse remote directories, upload and download, paste files straight into a session — no scp detour.
内置钉钉、飞书、GitHub 登录，配置好企业应用即可启用，自建部署也能接上公司的账号体系。DingTalk, Feishu and GitHub sign-in built in — configure your enterprise app and it just works, self-hosted deployments included.
// 安全security
omt 按零信任模型设计：服务器本身就是不可信的中继，安全建立在端到端的密码学之上，而不是对基础设施的信任。 omt assumes zero trust: the server itself is an untrusted relay. Security comes from end-to-end cryptography, not from trusting the infrastructure.
终端与文件载荷全程 AES-256-GCM 端到端加密——中继服务器只转发它读不懂的密文。Terminal and file payloads travel end-to-end encrypted with AES-256-GCM. The relay forwards ciphertext it cannot read — session content does not exist for it.
设备密钥在设备本地生成，首次接入核对 16 位校验码（Bootstrap Commit），此后双向验证，拦截冒名设备。Device keys are generated on the device; the first connection is pinned by verifying a 16-character Bootstrap Commit, then verified mutually — impostor devices are rejected.
发布物经 Ed25519 签名，设备核对钉住公钥的签名与产物哈希后才执行自升级；二进制在 GitHub 公开分发，附 SHA-256 校验和。Releases are Ed25519-signed; devices verify the signature against the pinned key and check payload hashes before any self-update. Binaries ship publicly on GitHub with SHA-256 checksums.
// 部署deploy
一条 docker compose 拉起 omts + MySQL，宿主机 nginx 反代公网入口。omts 只听 loopback，容器非 root、无 capability 运行。One docker compose file brings up omts + MySQL, with host nginx in front as the public ingress. omts listens on loopback only; containers run non-root, with no capabilities.
多节点共享 MySQL，滚动升级保留在线任务、客户端自动重连；会话与设备状态全量持久化。Multiple nodes share MySQL; rolling upgrades preserve live tasks and clients reconnect automatically. Session and device state persist in full.
omtc 是单个 Rust 二进制：从 GitHub Releases 下载、SHA-256 校验后运行，带签名自升级通道，保持自身更新。omtc is a single Rust binary: fetch it from GitHub Releases, verify the SHA-256 checksum, run. Signed self-updates keep it current.
下载客户端，把每台机器装进口袋。 Get the client and carry every machine in your pocket.
