Glossary

This glossary defines the terms you meet in Bromure Agentic Coding's windows, in its command line, and throughout this manual. Where the app uses two names for the same thing, both appear, cross-referenced to one entry. The most important pair: the sidebar and the session screens say machine, while the settings editor, the CLI and the code say workspace (and the code also says profile) — all three mean the same isolated Linux VM. When a term has a chapter that treats it in depth, a See link follows the definition.

0–9

1Password reference — A credential stored as a pointer into 1Password (op://vault/item/field, or the {{ op://… }} form) instead of the secret itself. Bromure asks the op CLI for the real value on the Mac when the machine starts and every 2 minutes after; only the pointer is saved, and the VM only ever holds a stand-in. See Credentials & the Wire Boundary.

A

AC MCP server — The MCP server you start with bromure-ac mcp so an AI tool on your Mac (Claude Code, Claude Desktop) can list, open and configure machines through bromure_ac_* tools. It needs the automation API turned on. Not to be confused with the MCP servers built into each VM. See CLI, API & MCP.

Activity line — The collapsed summary a chat shows in place of an agent's raw tool calls, such as "3 commands · 2 files read · 1 edit". While the agent works it reads "Reading …", "Running …" or "Thinking…". Click it (Show what the agent did) to see each step. See The Chat.

Age gate — The supply-chain check that refuses package versions younger than a cutoff (2 days by default), because a freshly published release is the one most likely to come from a just-hijacked account. A request for "the latest" version quietly gets the newest version old enough to pass. See Supply-Chain Protection.

Agent — A coding assistant program that runs inside a machine: Claude Code, Codex, Grok Build, Kimi Code, or Oh My Pi. Every agent is available on every machine; you pick one per session. Which model it talks to is set in Models. See Starting a Session.

Agent session — See Session.

Agent watchdog — A protection in Guardrails › Protections that scores a session's behaviour from outside the VM — blocks, foreign credentials, tampering, new destinations, unusual volume — and, past a threshold within a minute, records a finding (Alert) or cuts the network and pauses the VM (Quarantine). See Guardrails.

Agentic browser pane — The right-hand split (⌃⌘B) showing a Chromium browser that runs in its own disposable VM. You and the agent can both use it; the agent drives it through the built-in browser MCP server. See The Embedded Browser.

Allowlist entry format — The ecosystem:name syntax (for example npm:axios, pypi:requests) used by the age-gate exemption list and the install-script allowlist; a bare name matches the package in every ecosystem. Matching ignores case. See Supply-Chain Protection.

APFS copy-on-write (CoW) clone — A file copy that starts out sharing all of its data with the original — so it is instant and takes no space — and only uses disk space as the two differ. Bromure uses it for machine system disks, checkpoints and browser disks; on a non-APFS volume it falls back to a full copy. See Concepts & Architecture.

Archived — A session you have put away. It leaves the main list for the Archived fold at the bottom of the sidebar, stays readable, and comes back as soon as you send it a message or choose Unarchive. Sessions archive themselves after 3 days (rooms and Switchboards excepted), and delegations, tasks and automation runs archive when they finish. See The Sessions Home.

Attached terminal — A plain shell tab opened in a worktree's checkout on a machine's terminal, shown nested under that worktree. See Machines.

Authorized keys — The list of SSH public keys allowed to log in to Bromure's own SSH server (file remote/authorized_keys), managed from the Remote Access window or with bromure-cli remote key add/ls/rm. Supported key types are ed25519 and ecdsa. See Remote Access & Clients.

Automation API — The optional loopback HTTP form of the control plane (default 127.0.0.1:9223), turned on in Preferences › Automation. Most control routes also require the BROMURE_DEBUG_CLAUDE environment variable. See CLI, API & MCP.

AWS resigner — The part of the proxy that recognizes requests to AWS, throws away the guest's (invalid) signature, and re-signs the request with your real AWS credentials before it leaves the Mac. If it can't re-sign, the request is refused. See Credentials & the Wire Boundary.

B

Base image — The shared, signed Ubuntu disk image (base.img) that every machine's system disk is copied from. It is installed once, during onboarding, by downloading it from dl.bromure.io or building it locally; machines never modify it. See Installation & First Run.

Bedrock (Amazon Bedrock) — Amazon's hosted-model service, available as a provider in Models. Every agent can use it: Claude Code natively, the others through Bedrock's OpenAI-compatible API. Requests are signed with the machine's AWS credentials, or a Bedrock API key. See Models & Providers.

binfmt / QEMU emulation — The Linux mechanism that lets Docker in the arm64 VM run amd64 images by emulating them. Emulated containers run slower and carry a purple "emulated" badge.

Branch session — A session that works on its own git branch, in a separate worktree off another session's folder, so its changes don't touch the original until you merge them. Start one with New Branch…; its header shows the branch name, commit count and a Merge into … button. See Branches & Review.

Branches window — The window opened by Branches on This Machine… that lists a machine's session branches, including ones no session uses any more, with Open in a Session, Review and Discard. See Branches & Review.

Bromure (Web) — The sibling browser app, in which each web session runs in a throwaway Linux + Chromium VM destroyed when the window closes (bundle ID io.bromure.app). Bromure Agentic Coding shares its code base but keeps its machines.

Bromure Agentic Coding — This product: a macOS app that runs AI coding agents in persistent, isolated Linux VMs behind a host-side proxy that keeps real credentials off the VM. The app binary is bromure-ac; the bundle ID is io.bromure.agentic-coding.

Bromure Agentic Coding Root CA — The certificate authority created on your Mac at first launch. Every VM trusts it, which lets the proxy read and rewrite the VM's HTTPS traffic; its private key never leaves the Mac, and deleting the ca/ folder makes Bromure create a new one. See Concepts & Architecture.

bromure-cli — The short name for the command-line interface, installed as a symlink in /usr/local/bin with Install Command-Line Tool… in the app menu. Under this name the binary shows only the terminal commands (vm, trace, model, remote, and others). See CLI, API & MCP.

bromure.llm — A made-up hostname (it has no real DNS record) that agents use to reach an on-device model. The proxy catches it, applies its checks and tracing, and forwards the request to the model running on the Mac. See Models & Providers.

Browser MCP server — The built-in browser MCP server every agent gets, whose 23 browser_* tools drive the machine's agentic browser. See The Embedded Browser.

Built-in MCP servers — The MCP servers Bromure adds to every VM without any setup: browser, automations, infrastructure and delegation for every agent; the task board for coding tasks; and the switchboard server for the Switchboard. Each talks to the host over its own vsock port (5830–5836). See CLI, API & MCP.

C

Chained automation — An automation with the After automation trigger, which fires when another automation finishes. The {{chain.branch}} and {{chain.automation}} variables carry details from the earlier run. See Automations.

Checkpoint — A copy-on-write snapshot of a machine's system disk or home, taken on each successful boot and kept on a ladder (the last few boots, one a day for a week, one a week for a month). Home checkpoints are what Rewind home… restores. See Advanced.

Client key — The rich client's own SSH keypair (comment bromure-ac-fatclient). Its public half must be authorized on the remote Mac, which happens automatically when you pair, or manually with bromure-cli remote key add. See Remote Access & Clients.

Close action — The per-machine choice of what closing its window does: Run in the background, Suspend, Shut down, or Ask each time. See General settings.

Cloud event stream — The activity record (model calls, tool calls, commands, credential uses, compromise events) that an enrolled Mac sends to its organization's bromure.io server. It only exists on enrolled Macs and stops for machines in Private mode. See Enterprise.

Cloudflare quick tunnel — A way to publish one web service running in a machine at a random https://….trycloudflare.com address, with no Cloudflare account; the address changes whenever the tunnel restarts. See Remote Access & Clients.

Coding task — A unit of work on the Coding Tasks board (⇧⌘T) — Backlog, Plan, In Progress, Review, Done — that an agent plans, implements and hands back for review in its own branch; once approved, the same agent lands it (merges it, or opens a pull request). See Coding Tasks.

Command palette — The ⌘K search box ("Search sessions, rooms, machines, actions…") that jumps to any session, room or machine, finds text in conversations, and runs common actions. See The Sessions Home.

Composer — The message box at the bottom of a chat. ⏎ sends, ⌥⏎ adds a new line, and you can drop or paste files onto it; while the agent works, a red Stop button (Esc) replaces send. See The Chat.

Compromise detection — Bromure's constant check for a machine's stand-in credential heading to a host it wasn't created for — the sign of an attempt to steal it. The request is blocked, the VM pauses, and an alert offers Shut down, Block, Allow or Save for Investigation. See Credentials & the Wire Boundary.

Compromised (marked) — The flag a machine gets when you answer a compromise alert with Shut down or Save for Investigation. It won't boot again until you confirm Wipe and Launch, which erases its disk and home; shared folders are not wiped. See Troubleshooting.

Consent broker — The host component that shows approval prompts — for protected credentials, guardrails and held packages — and remembers the time-limited permissions you give. Those permissions live only in memory and end with the machine's session. See Credentials & the Wire Boundary.

Control socket — The owner-only local connection (~/Library/Application Support/BromureAC/control.sock) that the CLI and a rich client use to talk to the running app. See CLI, API & MCP.

Controller overlay — The menu drawn by the Mac, not the VM, when you press the overlay keys (default Ctrl-]) while attached to a machine's terminal over SSH: tabs, worktrees, Fusion, routing, settings, reboot, suspend, and disconnect. The keys never reach the VM. See Remote Access & Clients.

Custom server — A provider in Models that points at an OpenAI-compatible model server you run yourself (vLLM, Ollama, LM Studio, llama-server). Recommended for local models on another computer or GPU. See Models & Providers.

D

Defaults — See Preferences template.

Delegate — A session another session started to do a piece of work for it. It appears under its delegator in the sidebar, with "Delegated by …". See Agents Working Together.

Delegation — One agent handing a scoped piece of work to another: it starts a fresh session (in a worktree, or on another machine), follows its progress, answers its questions, and receives its delivery. All messages pass through the host, which screens them for prompt injection. See Agents Working Together.

Delegator — The session that started a delegation. Show delegator jumps to it. See Agents Working Together.

Depi — A drop-in secure npm registry by Lupin & Holmes that serves pre-vetted packages. When enabled, Bromure sends all npm registry traffic there, adding your API key on the Mac. See Supply-Chain Protection.

Dive screen — The animated boot screen shown on a machine's stage until its terminal answers. After 30 seconds without a terminal it turns into DIVE FAILED, and a boot stopped by a disk error shows DISK ERROR. See Troubleshooting.

Drift detection — The comparison between the base-image version a machine's system disk was copied from and the one now installed. When they differ, the machine asks A newer base image is available. at its next start (Yes, upgrade / No / Remind me later). An image update never changes a machine's disk by itself. See Troubleshooting.

E

Egress firewall — The Bromure Firewall: a machine's ordered list of rules allowing or denying the connections its VM opens — by host, IP range, protocol, port and, for web traffic, HTTP method — with a default for anything unmatched. It is enforced on the Mac, where the agent can't reach it. See Sandbox Policy settings.

Enforce binaries — The strict sandbox of the OpenShell engine: a root-owned attestor in the VM names the program behind every connection, policy rules apply only to the programs they list, and the agent loses sudo and Docker. See Sandbox Policy.

Enrollment code — A six-word code (for example bromure-cli enroll --code acid-aloe-arson-bench-cat-drum) that links a Mac to an organization on bromure.io. See Enterprise.

Enrollment health — Whether the organization's server still accepts this Mac: OK, "token rejected" (enroll again), or "revoked" (an admin removed it). See Enterprise.

External engine — See Custom server.

F

Fake token — A look-alike credential (for example brm_…, sk-ant-api03-brm-…) that Bromure puts in the VM instead of your real one. It is useless on its own: only the proxy on the Mac can swap it for the real value, and only for the host it was made for. It stays the same across restarts. Also called a stand-in, placeholder or decoy. See Credentials & the Wire Boundary.

Files pane — The right-hand split (⌃⌘E) that shows the session's folder with git status, diffs and previews. Drag files out to the Finder or in to upload them. See The Chat.

Force reboot — Holding ⌥ while choosing Reboot: the machine's power is cut at once (like pulling the plug) instead of a clean shutdown, then it boots fresh. For a machine that doesn't respond. See Rebooting a machine.

Fusion — The feature in which several models answer the same question and a judge model combines their answers into one; it happens in the proxy, invisibly to the agent. See Fusion — the Multi-Model Panel.

G

Grant scope — What one Guardrails approval covers — a single Kubernetes API host, AWS as a whole, one Docker registry, one database host, or one git forge. Approving one grants nothing else. See Guardrails settings.

Grid — A view, under Virtual Machines, showing several machine terminals side by side. Add Terminal to Grid (⌘D) adds the current one. See Machines.

Guardrails — The host-side rules that limit what an agent can change through your credentials, with four modes: Off, Prompt before write, Block destructive, and Read-only. A blocked call reaches the agent as an ordinary 403 error. See Guardrails settings.

Guest sandbox — The confinement the OpenShell engine applies inside the VM, from the policy's filesystem_policy, landlock and process sections: Landlock file rules even root can't lift, a non-root account, and Enforce binaries. See Sandbox Policy.

H

Headless agent — The app running without a window (bromure-ac run --headless), still hosting machines and the control socket. CLI commands and start-at-login start it on demand. See CLI, API & MCP.

Heartbeat — A background check-in with the enrollment server every ten minutes, which keeps the Mac's "last seen" time current and renews its certificate when due. See Enterprise.

Hidden-Unicode signals — Invisible characters used to hide instructions from human readers: zero-width characters, text-direction overrides and Unicode tag characters. Bromure detects them with simple, near-certain rules. See Prompt-Injection Detection & Guardrails.

home.img (ext4 home) — The disk image holding a machine's /home/ubuntu: your projects, dotfiles, keys and agent state. It is separate from the system disk, so it survives a system-disk reset, and it can be rolled back with Rewind home…. See Advanced.

Host key fingerprint — The short fingerprint of a Mac's SSH server key, shown in the Remote Access window and by bromure-cli remote status, so someone connecting can check they reached the right Mac. See Remote Access & Clients.

Host scope — The destination a credential swap is tied to. The host must match exactly or be a subdomain, never a partial string; an empty scope means "any host, never ask". See Credentials & the Wire Boundary.

I

Image catalog — The signed list at dl.bromure.io (img-catalog.json) naming the current base image and its extra install steps. The app refuses a catalog that is unsigned, invalid or older than the one it has. See Installation & First Run.

Infrastructure MCP server — The built-in MCP server (vsock 5834) that tells agents which Kubernetes clusters and registries their machine may use, and lets them check, create and start them. See Kubernetes Clusters & Registries.

Injection score / threshold — The detector's estimate (0 to 1) that a piece of content is a prompt injection; content is flagged when the score reaches the threshold (0.5 by default). See Prompt-Injection Detection & Guardrails.

Injection screen — The compulsory prompt-injection check on an event's text (title, body, author, comments) before an event-triggered automation starts; if it fails, the run is blocked. See Automations.

Inline terminal — A small live terminal that opens inside a chat when a slash command needs a picker or menu, with Interact / Fold and Continue in Linux. See The Chat.

Install — One enrolled copy of the app on one Mac, listed on the organization's installs page with its device name, user and last-seen time. See Enterprise.

Install token — A secret issued at enrollment and kept in the macOS Keychain, used for the heartbeat and certificate renewal. If the server rejects it, the Mac must enroll again. See Enterprise.

Install-script stripping — Removing the scripts an npm package asks to run at install time (preinstall, install, postinstall, prepare) — the usual way malicious packages run code. See Supply-Chain Protection.

itemKey — The identity an event-triggered automation records for what it handled (pr:123, issue:45, commit:abc1234, linear:ENG-1), so the same pull request or issue never starts it twice. See Automations.

J

Judge — In Fusion, the model that reads the other models' answers and writes the final one. See Fusion — the Multi-Model Panel.

K

Kernel sentry — A kernel module in the VM that reports program launches, connections, privilege changes and sandbox refusals to the Mac, where the agent can't silence it, and locks the kernel once loaded. Modes Best effort and Required; modules are fetched signed from dl.bromure.io for each Ubuntu kernel. See Sandbox Policy.

Kubernetes cluster — A small k3s cluster Bromure runs on your Mac, made of sibling VMs ("nodes") listed under Virtual Machines › Kubernetes. Machines on its access list get it in ~/.kube/config. Separate from the Kubernetes credentials you can add to a machine for outside clusters. See Kubernetes Clusters & Registries.

L

Landing — Taking an approved coding task out of Review: Bromure fast-forwards a clean branch itself; otherwise the agent that wrote the change rebases, runs the checks and merges it (or opens the pull request), and Bromure verifies it in git before the card goes Done. See Coding Tasks.

Leaf certificate — An enrolled Mac's own certificate, issued by its organization and used to prove the Mac's identity when it sends activity data. It renews itself before it expires. See Enterprise.

Leak (unswapped credential) — A token in an outgoing request that Bromure did not create — probably a real secret pasted straight into the VM, bypassing the swap. Traces flag it with a short preview. See Tracing & Audit.

Leg — One model's answer inside a Fusion exchange. See Fusion — the Multi-Model Panel.

Linux pill — The toolbar button (⌥⌘U) that jumps from a session to the terminal tab behind it on its machine; there it reads Session and jumps back. Useful when an agent's terminal needs attention the chat can't show. See The Sessions Home.

Local build — Building the base image on your Mac (about 10 minutes) when downloading it isn't possible. It produces the same image. See Installation & First Run.

Lockfile-pinned install — An install whose package checksums are fixed in a lockfile (npm ci, pip --require-hashes). Bromure can't rewrite those packages without breaking the checksum, so it can only let them through or block them. See Supply-Chain Protection.

Longhorn — The distributed storage Bromure can install in a Kubernetes cluster (on by default), giving each node a data disk and the storage class bromure-longhorn. See Kubernetes Clusters & Registries.

M

Machine — The session screens' name for a workspace: one isolated, persistent Ubuntu VM with its own disks, credentials, folders and security settings. Every session runs on a machine. Machines are listed under Virtual Machines. See Machines.

Machine menu — The toolbar capsule with the current machine's name and color. It offers Settings…, Machine Details, Copy IP Address, Inspect Trace, Pop Out to Its Own Window and Reboot. See The Sessions Home.

Managed profile — A machine configuration signed and pushed by an organization, with approved tools, allowed providers and, optionally, credentials issued by the server. See Enterprise.

MCP server — A Model Context Protocol server: a program that gives an agent extra tools. You add your own per machine in the MCP pane; Bromure translates them for each agent. See MCP settings and Built-in MCP servers.

Messaging connector — A small managed machine that links Bromure to Signal, WhatsApp or Slack, so you can talk to the Switchboard from your phone. Its messaging keys stay on that machine. Opened from Workspaces › Infrastructure › Messaging Connector…. See Switchboard & Messaging.

Meta share — A read-only folder Bromure rebuilds at every boot and shares into the VM, holding that boot's stand-in credentials, proxy settings, CA certificate, guest helpers and MCP configuration. See Concepts & Architecture.

Metadata (package) — A registry's list of versions for one package. The age gate edits it so that too-new versions simply don't exist for the agent. See Supply-Chain Protection.

MITM proxy — The proxy on the Mac that sits in the middle of the VM's HTTPS traffic: it decrypts each request with the Bromure CA, checks and rewrites it (including swapping stand-in credentials for real ones), and re-encrypts it to the real server. Every security control is applied there. See Concepts & Architecture.

MLX — Apple's machine-learning framework for Apple Silicon. Bromure's on-device models are MLX models. See Models & Providers.

Model catalog — The curated list of on-device models, with download size, memory needs and tool-calling status, bundled with the app and refreshed from dl.bromure.io. See Models & Providers.

Models — Where you choose which provider and model each agent uses: Preferences › Models for every machine, and a machine's own Models pane to change it for that machine only. See Models & Providers.

Models override — A machine's own model settings, turned on with Custom model settings for this workspace. Inherit, with changes keeps the global settings and changes only what you set; Standalone ignores the global settings entirely. See Models settings.

ModernBERT (claudemd-guard) — Bromure's own classifier for poisoned instruction files, run on the Mac alongside simple rule-based checks. See Prompt-Injection Detection & Guardrails.

mTLS — Mutual TLS: both sides of a connection prove who they are with certificates. An enrolled Mac identifies itself this way, so no password travels with its data. See Enterprise.

N

NAT mode / Bridged mode — A machine's two network modes. In NAT (the default) the VM sits on Bromure's private subnet behind the Mac and only the Mac can reach it; in Bridged it appears as its own device on a real network. See Concepts & Architecture.

Native terminal — A machine's terminal tab drawn by the Mac (with the Ghostty engine) and connected to the VM's tmux, rather than a picture of the VM's screen. See Machines.

Network lineage — The chain behind one connection out of a VM — your prompt, the agent's reasoning and stated intent, the tool call, the process chain, the flow, and the host's decision — shown by double-clicking a Network row in the Security window. Needs the kernel sentry. See Security Overview & Timeline.

Nickname (@nickname) — A short, unique name you give a session with Nickname…. Other agents can ask it for help with @name, and you can address it with @name in any composer. See Agents Working Together.

O

OCSF export — Writing every security event as OCSF JSON (1.8.0, or 1.3.0 for Security Lake, Splunk and CrowdStrike), one file per day, for a SIEM — the OCSF menu in the Security window. See Security Overview & Timeline.

Oh My Pi (omp) — One of the five bundled agents. It works with several providers but only with API keys, not subscriptions. See Models & Providers.

On-device model — A model that runs on your Mac itself with MLX, one generation at a time, with nothing sent to the cloud. Listed as On-device models in Models. See Models & Providers.

Onboarding wizard — The first-run window that installs the base image and sets you up, in steps: Welcome, Install, Credentials, Choose, Models, Done. See Installation & First Run.

OpenRouter — A provider in Models that gives access to many models with one API key. Claude Code reaches it directly; other agents go through Bromure's translation. See Models & Providers.

OpenShell policy — An NVIDIA OpenShell sandbox policy (YAML, schema v1) — network rules with request inspection, plus filesystem and process sections — that a machine can use instead of the Bromure Firewall. Bromure enforces it on the Mac and in the VM. See Sandbox Policy, the Guest Sandbox & the Kernel Sentry.

Org CA — The organization's certificate authority on bromure.io, which issues each enrolled Mac's certificate. See Enterprise.

Organization boundary — The most any machine's OpenShell policy may allow, set by an organization through bromure.io or from a file on the Mac. Every policy save is checked against it. See Sandbox Policy.

OSV — The Open Source Vulnerabilities database (osv.dev), a free collection of known package vulnerabilities that Bromure checks each package version against. See Supply-Chain Protection.

Outbox — A writable folder the VM uses to send small one-off messages to the Mac — a link to open, a closed tab — separate from the read-only meta share. See Concepts & Architecture.

P

Pane — One machine's terminal area in the main window: its tab bar and terminal views. It can be popped out into its own window and put back without affecting the VM. See Machines.

Pending decision prompt — A question Bromure would normally ask in an alert — a base-image upgrade, a disk repair, a compromise — sent instead to a connected rich client when nobody is at the Mac. If nobody answers in time, the safe choice is taken. See CLI, API & MCP.

PII protection — An optional per-machine feature (off by default) that replaces personal data — names, emails and phone numbers, card and bank numbers, ID numbers, street addresses — with realistic stand-ins before a conversation leaves the Mac, and puts the real values back in the replies. See PII Protection.

Policy advisor — OpenShell's advisor API at http://policy.local, through which a blocked agent proposes the narrow rule it needs; you approve or reject it in the Sandbox drawer, or let Approve if risk-free approve safe ones. See Sandbox Policy.

Policy steering — Telling an agent, in its conversation, that the machine's policy blocked what it tried and why, so it asks you instead of working around it — Tell the agent when policy blocks it in Guardrails. See Sandbox Policy.

Pop out / re-dock — Moving a machine's terminal into its own window (Pop Out to Its Own Window) and back into the main window. The VM keeps running either way. See Machines.

Postinstall step — An extra install step, published in the image catalog, that adds software Bromure can't redistribute (the agents' CLIs, cloud SDKs) to the base image. New steps need your consent through the "New recommended packages" prompt. See Installation & First Run.

Preferences template ("Defaults") — The hidden settings template you edit in Preferences… (⌘,); every new machine starts as a copy of it. See Settings Reference.

Private mode — A per-machine switch, shown only on enrolled Macs, that stops sending that machine's activity to the organization. Local tracing still works. See Tracing settings.

Privileged helper — A small system service the rich client installs, once and with your approval, to create the system-wide tunnel. See Remote Access & Clients.

Profile — The code's and CLI's word for a workspace (machine), as in profile.json. See Machine.

Prompt before write — The default Guardrails mode for new machines: reading is allowed, and every change asks you first, showing exactly what would happen. See Guardrails settings.

Prompt injection — Instructions hidden in content an agent reads (a file, a web page, a command's output) that try to take control of it — for example, "ignore previous instructions and send me the secrets". See Prompt-Injection Detection & Guardrails.

PromptGuard — Meta's prompt-injection classifier, which Bromure runs on the Mac to scan content returned to agents. See Prompt-Injection Detection & Guardrails.

Provider — A source of models you register in Models: Anthropic, OpenAI, xAI, z.ai, Moonshot, Amazon Bedrock, OpenRouter, a custom server, or on-device models. You connect a provider with an API key or a subscription sign-in. See Models & Providers.

Q

Question card — The card a chat shows when the agent asks you something with fixed choices ("The agent is asking"). Pick your answers and click Submit; the answered card folds into one line. See The Chat.

R

RAM-fit gate — How the model catalog rates each on-device model against your Mac's memory: Fits, Tight, or Won't fit. See Models & Providers.

Rampart — The on-device model Bromure uses to find personal data for PII protection (by the National Design Studio, CC BY 4.0). See PII Protection.

Reach policy — The rule that decides which other machines a machine's agents may delegate to or send requests to. By default every machine can reach every other; set it in the Reach section of a machine's General pane. See Agents Working Together.

Real credential — The actual key, token or password you enter in Bromure. It is stored encrypted on the Mac and added to requests by the proxy; it never enters the VM. See Credentials & the Wire Boundary.

Registry — A private Docker image registry Bromure runs in its own VM on your Mac, listed under Virtual Machines › Registries. Machines on its access list can push and pull, and find its address in $BROMURE_REGISTRY. See Kubernetes Clusters & Registries.

Remote consent — Approval prompts shown as numbered menus on your own terminal while you are attached to a machine remotely. The VM can't fake them, and any timeout means "no". See Remote Access & Clients.

Remote host — Another Mac running Bromure that you connect to from the rich client, saved with its name, address, port, user and pinned host key. See Remote Access & Clients.

Remote menu — The text menu every SSH login to Bromure lands in instead of a shell, covering machines, settings, worktrees, models and traces. See Remote Access & Clients.

Request — The second kind of delegation: instead of starting a new session, an agent asks an existing one, by its @nickname, and gets its reply. See Agents Working Together.

Require approval to use — A per-credential option that makes Bromure ask you before the credential is first used in a machine's session, with time-limited approvals. See Credentials & the Wire Boundary.

Reset disk — Replacing a machine's system disk with a fresh copy of the base image. Software installed with apt is lost; the home survives. See Machines.

Review window — The window that shows a session's or task's changes as diffs — Uncommitted, All changes, Last commit or This turn — where you can comment on lines and send the comments to the agent. See Branches & Review.

Rewind home — Rolling a stopped machine's home folder back to how it was at an earlier boot, from the machine's ⋯ › Rewind home…. The current home is kept as a new point, so a rewind can be undone. See Advanced.

Rich client — A copy of Bromure that shows and controls another Mac's Bromure over SSH — its sessions, rooms, machines, terminals and settings — as if it were local. The remote Mac stays in charge. Also on iPhone, iPad and Vision Pro. See Remote Access & Clients.

Room — A group of sessions shown side by side in a grid of live chats, with its own Switchboard. Create one with New Room… or by dragging one session onto another. See Rooms.

Room Switchboard — A Switchboard that only sees the sessions in its room, shown in a dock at the bottom of the room. See Rooms.

Roster — The list of a machine's tmux windows that the VM publishes continuously; the Mac builds the terminal tab bar from it. See Machines.

Routing (Cloud / Local) — Whether a running machine's agents talk to their cloud providers or to the local model; switch it with bromure-cli vm routing. See Models & Providers.

Rules file / rogue instructions — Poisoned instruction files (CLAUDE.md, AGENTS.md, and similar) that agents load automatically and trust, often hiding their payload with invisible characters. See Prompt-Injection Detection & Guardrails.

Run record — One entry in an automation's history: whether the run launched, was skipped, failed or was blocked, with a detail line. See Automations.

S

Sandbox drawer — The panel a machine's window slides over its stage (shield button, ⌃⌘N) listing what its sandbox blocked — connections, files, package requests, advisor proposals, temporary rules — each ready to allow. See Sandbox Policy.

Sandbox engine — A machine's choice, in Settings › Sandbox Policy, between the Bromure Firewall (an allow/deny rule table) and OpenShell + Sentry (an OpenShell policy with the guest sandbox and the kernel sentry). See Sandbox Policy.

Scheduled automation — A recurring, unattended agent run tied to one machine, started by a schedule or an event (a GitHub pull request, issue or commit, a Linear issue, or another automation). Each run happens in its own git worktree. See Automations.

Secrets vault master key — The key, kept in the macOS Keychain, that encrypts every secret and captured trace Bromure stores. See Credentials & the Wire Boundary.

Security Overview — The first tab of the Security window: a recent period at a glance (Blocked, Allowed, Credential brokering, Supply chain, PII protection, and Guest sandbox when used), each machine's protections, and the latest blocks. See Security Overview & Timeline.

Security Timeline — The window (Window › Security…) listing every decision Bromure's security engines made, which you can filter and export to CSV. Always recorded; kept 90 days by default (Preferences › Tracing › Security history). See Security Overview & Timeline.

Session — One conversation with one agent, in one folder, on one machine. Sessions are the main list in the sidebar; each has a title the agent sets, a status, and a chat. A session keeps its conversation when it ends and can be picked back up with a new message. (In the CLI and the control API, "session" can also mean a machine's window — see CLI, API & MCP.) See The Sessions Home.

Session states — Where a session stands, shown on its row and as groups in the sidebar: Needs you (it is asking you something), Working, Ready (it finished its turn and waits for you), Paused (its agent isn't running, but your next message picks it up), Finished, and Archived. See The Sessions Home.

SigV4 — AWS's request-signing method. Bromure re-signs AWS requests on the Mac with your real credentials, because an AWS signature can't simply be swapped. See Credentials & the Wire Boundary.

Slash palette — The list of commands that opens when you type / in the composer: the agent's built-in commands plus the skills and commands found in your setup. See The Chat.

socket.dev — A commercial package-reputation service (you bring the key) that flags malware, typosquats and known vulnerabilities; Bromure asks it about packages before letting them through. See Supply-Chain Protection.

Sparkle — The auto-update system built into the app, behind Check for Updates…. See Installation & First Run.

Squelch — An optional per-machine feature (off by default) that cuts the noise out of command output — passing tests, download and build progress, transfer counters, repeated log lines — before the agent's model reads it, and counts the tokens it saved per session. Modelled on rtk. See Squelch — Less Noise, Fewer Tokens.

SSH front door — Bromure's own optional SSH server (not macOS's). Off by default; when on, it carries remote logins and rich-client connections. See Remote Access & Clients.

ssh-agent bridge — The SSH agent Bromure offers the VM. The VM can ask it to sign with a key but can never read the key itself. See Credentials & the Wire Boundary.

Stage — The large area to the right of the sidebar, showing what you selected: a session's chat, a room, the new-session screen, a machine's terminal, the Grid, or a board. The browser and Files panes open beside it. See The Sessions Home.

Stand-in — A realistic replacement value. For credentials, see Fake token. For PII protection, a made-up name, @example.com email, same-format phone number or test card number swapped in for the real one; the same real value always gets the same stand-in within a machine. See PII Protection.

Status dot — The small dot on a session's avatar in the sidebar that shows its state at a glance, for example whether it is working or needs you. See The Sessions Home.

Streaming indicator — A pulsing red dot in a popped-out machine window's toolbar, shown when that machine's activity is being sent to bromure.io (enrolled Macs, machines not in Private mode). See Enterprise.

Strict credential mode — Only allow credentials Bromure injects (strict mode) in Guardrails: a request carrying a credential Bromure didn't issue is blocked with the compromise alert. See Guardrails.

Subscription mode — Using an agent through your account's subscription (Claude, ChatGPT, Grok, Kimi) instead of an API key. The sign-in is kept on the Mac, which refreshes it; the VM only ever sees a stand-in key. See Models & Providers.

Suspend / saved state — Pausing a machine and saving its memory to disk (vm.state), so its next start resumes exactly where it was. If the saved state can't be restored — for example after a settings change — the machine boots fresh instead. See Troubleshooting.

Switchboard — A special Claude session that keeps track of all your other sessions: ask it what's going on, have it answer a waiting session, or start new work — from the Mac or, through the messaging connector, from your phone. It must quote your own words before acting for you. Formerly called Conductor. See Switchboard & Messaging.

Synology storage class — The Kubernetes storage class bromure-synology, which stores a cluster's volumes on a Synology NAS over iSCSI or SMB; when configured it becomes the cluster's default. See Kubernetes Clusters & Registries.

System disk — A machine's boot disk (disk.img), a copy-on-write copy of the base image. It holds software installed with apt and system settings; Reset disk replaces it while the home survives. See Concepts & Architecture.

System-wide tunnel (utun) — An optional rich-client feature that lets any program on your Mac reach a remote Mac's machines at their own addresses. It needs the privileged helper. See Remote Access & Clients.

T

Tab — One terminal tab on a machine: a tmux window inside the VM. Agent sessions run in tabs too; the Linux pill shows a session's tab. See Machines.

"To" target — The recipient chip at the start of a room's composer: the room's Switchboard, one session, or The whole room at once. Change it with Send to…. See Rooms.

TOFU (trust on first use) — How the rich client trusts a remote Mac: you confirm its key fingerprint the first time, and it is remembered. A later change raises a prominent warning. See Remote Access & Clients.

Token swap — The proxy replacing a stand-in credential in an outgoing request with the real one, only for the host the credential belongs to. See Credentials & the Wire Boundary.

Tool turn vs. text turn — In Fusion, a reply that calls tools (passed through from one model so the agent's tools run) versus a plain-text answer (which is fused). See Fusion — the Multi-Model Panel.

Tool-calling verified — A model-catalog badge saying the exact model build was tested for reliable agent tool use. See Models & Providers.

tool_result span — One piece of outside content (a file read, a web page, a command's output) returned to the agent's model; the unit the injection detector scores. See Prompt-Injection Detection & Guardrails.

Trace Inspector — The window (Window › Trace Inspector…, ⇧⌘I) for browsing recorded traffic. See Tracing & Audit.

Trace level — How much of a machine's traffic the proxy records: Off, Activity only, AI request details (the default), or Everything. See Tracing & Audit.

Trace record — One recorded request and response: host, method, path, status, sizes and timing, swap and leak reports, and, when captured, the encrypted bodies. See Tracing & Audit.

Transcript cache — The copy of each session's conversation the Mac keeps (in transcripts/ in the support folder), so a chat can be read even while its machine is off. See The Chat.

Transparent interception — The Mac steering a VM's web traffic (ports 80 and 443) into the proxy even if a program ignores the proxy settings, so the firewall, guardrails and checks apply to everything. On by default. See Guardrails settings.

U

Undo toast — The short notice that appears after you end, archive, delete or move a session, with an Undo button (⌘Z). See The Sessions Home.

Unified session window — The main Bromure window: the sidebar on the left, the stage on the right. See The Sessions Home.

Unverified package hold — When a reputation check you enabled can't give an answer for a package, Bromure pauses the download and asks you, instead of letting it through silently. See Supply-Chain Protection.

V

Version stamp (base.version) — The installed base image's version, for example 201. When it changes, machines copied from an older version offer to upgrade. See Installation & First Run.

virtiofs share — A folder shared from the Mac into the VM. Bromure uses shares for the meta share, the outbox and up to eight project folders. See Concepts & Architecture.

Virtual Machines — The sidebar section (folded by default) listing your machines, the Grid, and the Kubernetes, Registries and Messaging entries. See Machines.

VM pool / warm VM — A browser VM Bromure keeps started in advance so the agentic browser opens almost instantly. Machines themselves are not pooled. See Concepts & Architecture.

vmnet — Apple's virtual-network framework, which Bromure uses to connect machines to the network. See Concepts & Architecture.

vsock (virtio socket) — A direct channel between the Mac and a VM that needs no network. Bromure runs its internal links over it: the proxy path, the SSH agent, clipboard and files, and the built-in MCP servers. See Concepts & Architecture.

W

WebSocket transcript — A readable, in-order rendering of a traced WebSocket conversation, stored with its trace record. See Tracing & Audit.

Wire boundary — The product's central idea: everything the VM sends out passes through the proxy on the Mac, and every protection — keeping secrets, scoping credentials, checking packages, detecting injections, tracing — happens at that one point the agent can't get around. See Concepts & Architecture.

Workspace — The settings editor's and CLI's name for a machine. See Machine.

Workspace subnet — The private network your machines are on. New installs pick a random /24 inside 172.16.0.0/12, so several Macs mirrored by one rich client don't collide; change it under Preferences › Resources › Workspace subnet. See Troubleshooting.

Worktree — A second checkout of a git repository, on its own branch, in its own folder. Branch sessions, coding tasks and automation runs each work in one, so their changes stay apart until merged. On a machine's terminal, New worktree (⇧⌘G) and Merge worktree (⇧⌘M) manage them by hand. See Branches & Review.

X

X-Bromure-Rewritten / X-Bromure-Block — Response headers Bromure adds so its changes are recognizable: X-Bromure-Rewritten: supply-chain when it edited a package response, and X-Bromure-Block: supply-chain (or depi-auth) when it blocked one. See Supply-Chain Protection.