Appendix — Shortcuts, Files, Ports & Environment
This appendix collects the concrete facts scattered through the rest of the manual into reference tables: keyboard shortcuts, on-disk locations, network ports, environment variables and defaults, and a guest-VM cheat sheet. Everything here is keyed to the shipping build (version 5.0.0, bundle ID io.bromure.agentic-coding, app binary bromure-ac). For the commands that read and write these, see CLI, API & MCP; for what gets created at install time, see Installation & First Run.
Placeholders used below: <uuid> is a machine's (workspace's) identifier, <id> a cluster's, registry's or run's identifier, <version> a pinned tool version, <org>--<name> a model repository, and <host-UUID> a saved remote host.
Keyboard shortcuts
Shortcuts that depend on what is on stage say so. Standard macOS shortcuts (⌘Q, ⌘H, ⌘M, ⌘C, ⌘V, …) work as usual.
Sessions and navigation
| Shortcut | Action |
|---|---|
| ⌘N | New Session… — the new-session screen. |
| ⌘K | Go to… — the command palette (sessions, rooms, machines, actions, text in conversations). ↑/↓ move, ⏎ opens. |
| ⌘1 – ⌘9 | With a session or the new-session screen on stage: jump to the 1st–9th session in the sidebar. On a machine's terminal: switch to that tab. Hold ⌘ to see the numbers in the sidebar. |
| ⌥⌘↑ / ⌥⌘↓ | Previous / next session, in sidebar order. |
| ⌘⏎ | Resume the paused or finished session on stage. On the new-session screen, Start. |
| ⌘W | With a session on stage: End session (asks "End “‹session›”?" first, then offers Undo). On a machine's terminal: close the tab. |
| ⌃⌘R | Next Room. |
| ⌥⌘U | Linux — from a session to its terminal tab on the machine, and back (the pill then reads Session). |
| ⌘Z | Undo the last end, archive, delete or move while its notice is showing. |
| ⌃⌘S | Collapse or expand the sidebar. |
| ⌃⌘B | Show or hide the agentic browser pane. |
| ⌃⌘E | Show or hide the Files pane. |
| ⌘, | Preferences… |
In a chat
| Shortcut | Action |
|---|---|
| ⏎ | Send the message (on the new-session screen: start the session). |
| ⌥⏎ | New line. |
| Esc | Stop the agent while it works. |
/ | Open the slash-command palette (↑/↓ move, ⇥ complete, ⏎ pick, Esc close). |
@ | Open the palette of sessions you can ask. |
Rooms
| Shortcut | Action |
|---|---|
| ⌃⇥ / ⌃⇧⇥ | Next / previous tab of the room, when its sessions don't fit on one page. |
| Esc | Leave a zoomed session and return to the whole room. |
Machines and terminals
| Shortcut | Action |
|---|---|
| ⇧⌘N | New Workspace… (a new machine). |
| ⌥⇧⌘N | New Workspace from My Configs… (the same menu item with ⌥ held). |
| ⇧⌘K | Connect to Remote Bromure… |
| ⌘T | New tab on the selected machine's terminal — or a new browser tab while the browser pane has keyboard focus. |
| ⌘D | Add Terminal to Grid. |
| ⇧⌘G | New worktree (on a machine's terminal). |
| ⇧⌘M | Merge worktree (on a machine's terminal). |
Boards, windows and review
| Shortcut | Action |
|---|---|
| ⇧⌘A | Automation Board. |
| ⇧⌘T | Tasks (the Coding Tasks board). |
| ⌘0 | Workspace Manager. |
| ⇧⌘I | Trace Inspector… |
| ⌘R | Refresh (Review and Branches windows). |
| ⇧⌘⏎ | Send your comments to the agent (Review window). |
On-disk locations
Everything the app owns lives under one support directory, plus a handful of files outside it and a few Keychain items. A path ending in / is a directory.
The support directory
The app's support root is ~/Library/Application Support/BromureAC/. The paths below are relative to it.
| Path | Holds |
|---|---|
base.img | The Ubuntu base image every machine clones from (24 GB logical, a few GB physical). |
efivars.bin | EFI variable store the base image boots with. |
base.version | Installed image version stamp, e.g. 201 or 201.1. |
image-state.json | Image provenance and the UUIDs of applied postinstall steps. |
img-catalog.json | Cached copy of the downloaded image catalog. |
browser-img-catalog.json | Cached catalog for the embedded browser image. |
catalog.json | Cached remote catalog of on-device models. |
base.img.partial, base.img.gz.partial, efivars.partial | Transient install files; their presence means an install is running or was interrupted. |
alpine-vmlinuz, alpine-initramfs, alpine-initramfs-shimmed | Cached Alpine netboot installer files used by the local build. |
browser/ | AC's own copy of the Ubuntu + Chromium browser image when Bromure Web's copy is absent. |
browser-profiles/<uuid>/image/profile.img | Encrypted persistent Chromium profile disk ("Stay signed in to websites"). |
ca/cert.pem, ca/key.pem | The per-install Bromure Agentic Coding Root CA (key mode 0600). Delete the ca/ directory to rotate it. |
control.sock | Owner-only (0600) Unix control socket the CLI and control plane speak HTTP over. |
profile-macs.json | Deterministic per-machine MAC bindings. |
dhcp-leases.sqlite | Persistent DHCP leases for the machines' virtual network. |
default-ssh/id_ed25519.raw, default-ssh/id_ed25519.pub | Shared default SSH keypair copied into each new machine. |
profile-template.json, profile-template.enc | The Preferences Defaults template new machines inherit. |
models.enc | The global model settings (Preferences › Models): providers, keys, per-agent choices. Encrypted. |
claude-subscription.enc, codex-subscription.enc, grok-subscription.enc, kimi-subscription.enc | Encrypted, host-owned subscription sign-ins (shared, plus per-machine overrides), 0600. |
sessions.json | Your agent sessions: title, agent, machine, folder, state, nickname, room. |
rooms.json | Your rooms. |
delegations.json | Delegations and requests between sessions. |
transcripts/ | The host's copy of each session's conversation (<session-id>.jsonl). |
tasks.json, task-transcripts/ | The Coding Tasks board and its archived transcripts. |
automations.json | Scheduled automations plus run history, next-fire times, and event-poll high-water marks. |
runs/<id>/ | Archived automation runs (record.json, transcript.jsonl). |
security-timeline/<yyyy-MM-dd>.jsonl | The Security Timeline, one file per day, kept 90 days. |
pii/<uuid>.key | Per-machine secret that keeps PII stand-ins consistent (0600). |
grid-layout.json | Grid membership. |
engine-master.key | Master secret for per-VM on-device engine keys. |
engine-spawn.json | On-device engine spawn config (models, memory budget, port). |
fake-salt.bin | Per-install salt for deriving stand-in tokens (0600). Deleting it rotates every stand-in on this Mac. |
secrets-master.key | 0600 fallback master key, used only when the Data Protection Keychain is unreachable. |
cloudflared/<version>/cloudflared | Pinned, checksum-verified cloudflared binary, with a current symlink alongside. |
ghostty/ | Generated terminal configs (base plus per-machine). |
Per-machine storage
Each machine is a self-contained directory at profiles/<uuid>/ under the support root. See Machines and Concepts & Architecture for how these are used.
Path (under profiles/<uuid>/) | Holds |
|---|---|
profile.json | Machine definition, including its security policies; socket.dev and Depi API keys are stored here host-side and never copied into the VM. Only non-default fields are written. |
secrets.enc | Encrypted machine secrets (0600). |
disk.img | System disk — an APFS copy-on-write clone of base.img. |
home.img | Sparse ext4 image holding /home/ubuntu. |
home/ | Legacy shared-folder home (machines not yet upgraded). |
checkpoints/, checkpoints/home/ | Per-boot disk and home checkpoints (the home ones are what Rewind home… lists). |
vm.state, vm.state.json | Suspended-VM RAM snapshot, and the fingerprint of the configuration it was saved with. |
tabs.json | Saved terminal tab layout, honored only when vm.state exists. |
machine-identifier.bin | Persistent VM identity (required to restore a suspended VM). |
compromised.flag | Wipe-on-next-launch marker set after a compromise. |
meta-share/ | Per-launch read-only guest config share (api_key.env, proxy.env, the CA cert, guest helpers, MCP shims and configs). |
outbox/ | Per-launch writable guest→host event share. |
agent/ (and agent/imported/), ssh/ | Per-machine SSH key material; imported keys live under agent/imported/, ssh/ is the legacy dir. |
Clusters, registries and the messaging connector
| Path (under the support root) | Holds |
|---|---|
kube/clusters.json | Every Kubernetes cluster, registry and messaging connector, with its settings and access list. |
kube/<id>/kubeconfig.yaml | A cluster's admin kubeconfig (what Copy kubeconfig copies). |
kube/<id>/setup.log | The cluster's or registry's setup and lifecycle log (its Log tab). |
kube/<id>/synology.enc | Encrypted Synology NAS credentials, when configured. |
kube/<id>/nodes/<uuid>/ | Each node's (or the registry's, or connector's) own machine directory: disk.img, a data.img data disk where used, meta-share/, and so on. |
Models and detectors
| Path (under the support root) | Holds |
|---|---|
models/<org>--<name>/ | Downloaded on-device model weights. |
models/<org>--<name>/.incomplete | In-progress or interrupted-download marker. |
Models/prompt-injection/ | PromptGuard detector assets (model.onnx, tokenizer files, optional bromure-injection.json overrides). |
Models/claudemd-guard/ | ModernBERT rules-file detector assets. |
Models/pii-rampart/ | The Rampart PII model, only when it isn't bundled in the app (development builds). |
traces/YYYY-MM-DD/<sessionID>.jsonl | Per-session trace metadata, one JSON record per line. |
traces/YYYY-MM-DD/<sessionID>/<recordID>.req.enc, .res.enc | Captured request/response bodies, encrypted (0600). |
Enrollment, remote access, and the rich client
| Path (under the support root) | Holds |
|---|---|
managed/install.json | Enrollment identity: install ID, organization slug, user, server URL, device name, enrolled-at. |
managed/leaf.crt | mTLS leaf certificate (PEM). |
managed/leaf.serial | Pointer to the Keychain entry holding the current leaf's private key. |
managed/ca.crt | Organization CA certificate (PEM). |
managed/health | Persisted enrollment health (ok / tokenRejected / revoked). |
remote/hostkey_ed25519, remote/hostkey_ed25519.pub | Embedded SSH server host key (dir mode 0700, key 0600). |
remote/authorized_keys | Public keys allowed through the SSH front door (0600). |
remote/overlay-key | Optional overlay-keychord override for the SSH remote menu. |
remote-client/id_ed25519, .pub | The rich client's SSH client keypair (comment bromure-ac-fatclient). |
remote-client/known_hosts | Trust-on-first-use pins of remote host keys. |
remote-client/hosts.json | Saved remote servers ("Recent Servers"). |
remote-client/hosts/<host-UUID>/… | Per-host mirror persistence (grid layout, automations) so a remote's state never overwrites the local one. |
Note: The
remote-client/subtree relocates withCFFIXED_USER_HOME, which is how two isolated instances can be run side by side for testing.
Outside the support directory
| Path | Holds |
|---|---|
~/Library/Logs/BromureAC/bromure-ac.log (and .log.1) | The app log: a copy of everything the app writes to standard error, with launch, exit and fatal-signal stamps. Rotated above 8 MB at launch; one previous file kept. |
~/Library/LaunchAgents/io.bromure.agentic-coding.boot.plist | Boot-at-login LaunchAgent, written when any machine enables "Start this VM at login". |
<app>/Contents/Library/LaunchDaemons/io.bromure.fatclient-tunnel.plist | Embedded privileged tunnel daemon, registered on demand. |
/var/run/io.bromure.fatclient-tunnel.sock | Privileged tunnel daemon socket (root-created, 0600, owned by the console user). |
/tmp/bromure-ac-cm-<first-12-of-host-UUID> | Per-host SSH ControlMaster socket (kept in /tmp because the support path is too long for a Unix socket). |
/tmp/bromure-repair.log | Local-inference repair-proxy debug log (only with BROMURE_REPAIR_DEBUG). |
/usr/local/bin/bromure-cli | Optional CLI symlink to the app binary, created by Install Command-Line Tool…. |
<NSTemporaryDirectory>/bromure-ac-agent-<pid>.sock | Bromure's private host-side ssh-agent socket. |
<NSTemporaryDirectory>/sessions-mirror.json, rooms-mirror.json, delegations-mirror.json | A rich client's working copy of a remote host's sessions, rooms and delegations. |
$TMPDIR/bromure/session-<uuid>.img (and -aux.img) | Ephemeral browser-VM copy-on-write clones, deleted on teardown. |
~/Library/Application Support/Bromure/ | Bromure Web's support dir; AC reads its browser image from here when present. |
Keychain items and defaults domain
Secrets that must survive with OS-level protection live in the macOS Keychain, not on disk.
| Keychain service | Account | Holds |
|---|---|---|
io.bromure.agentic-coding.master-key | v1 | The secrets-vault master key (Data Protection Keychain). |
io.bromure.agentic-coding.ssh-key-passphrases | <profileUUID>/<filename> | Passphrases for imported SSH keys. |
io.bromure.agentic-coding.managed-install | install-token, leaf-cert-key-<serial> | Enrollment bearer token and per-serial leaf private keys. |
All UserDefaults for the app live in the domain io.bromure.agentic-coding (read and written with defaults read/defaults write).
Network ports and subnets
TCP and loopback ports
Bromure Agentic Coding opens no fixed inbound ports by default. The two optional services below are off until you enable them; the rest are loopback-only and either dynamic or internal.
| Port | Purpose | Bound where |
|---|---|---|
9223 (default) | Automation HTTP API and bromure-ac mcp backend. Off by default (automation.enabled); one off from the browser product's 9222 so both apps can run side by side. Serves GET /health. | 127.0.0.1 (configurable via automation.bindAddress; non-loopback binds are unauthenticated and warned against). |
2222 (default) | Optional SSH remote-access front door. Disabled by default; configurable to any port ≥ 1024. | 0.0.0.0 by default (configurable via remoteAccess.bindAddress). |
28500–28599 | MCP OAuth callback listener (http://127.0.0.1:<port>/callback). | 127.0.0.1. |
| dynamic | On-device inference engine, allocated at first spawn to avoid colliding with Ollama/LM Studio on 11434. | 127.0.0.1 (never 0.0.0.0). |
| dynamic | Local-inference tool-call repair proxy. | 127.0.0.1. |
| ephemeral | Per-remote-host SOCKS5 forwarder used by the rich client's browser pane. | Bound 0.0.0.0 but peer-filtered to loopback plus 192.168.127.x. |
Two loopback endpoints exist inside the guest, not on the Mac: 127.0.0.1:65534 (the in-VM HTTP(S) proxy every shell exports as HTTPS_PROXY) and 127.0.0.1:11434 (where the on-host inference engine appears, over vsock).
Installation itself opens no TCP ports; the base-image build's package proxy binds an ephemeral localhost port per build.
Virtual-network subnets
| Subnet | Purpose |
|---|---|
A random /24 in 172.16.0.0/12 | The machines' network on fresh installs (gateway .1, DHCP pool .2–.254). Chosen once per install, avoiding Docker's usual 172.17–172.20 and any range the Mac is on. View, turn off or re-randomize it under Preferences › Resources › Workspace subnet. |
192.168.64.0/24 | The machines' network on installs that turned the private subnet off. Auto-relocated if the Mac's LAN already uses it. |
192.168.65.0/24–192.168.126.0/24 | Range Bromure Web instances relocate into, keeping AC and Web from colliding. |
192.168.127.0/24 | The rich client's pinned local browser-VM subnet (gateway .127.1). |
10.98.<unit>.0/30 | Point-to-point link networks used by the privileged utun tunnel daemon. |
IPv6 is not routed: recent base images disable it inside the guest, and apt runs over IPv4 only.
Host↔guest vsock ports
Host and guest communicate over virtio sockets (vsock), which have no IP address — they are numbered channels between the host (CID 2) and each guest. They are internal plumbing, listed here for diagnostics.
| vsock port | Bridge |
|---|---|
| 5800 | Shell-exec agent — powers vm exec, the control-socket exec route, and the Files pane. |
| 5010 | Loopback OAuth-callback relay (delivers OAuth redirects back into in-VM CLIs). |
| 5830 | Browser MCP server. |
| 5831 | Task-board MCP server (coding tasks only). |
| 5832 | Plan stream (coding-task planning). |
| 5833 | Automations MCP server. |
| 5834 | Infrastructure MCP server. |
| 5835 | Delegation MCP server. |
| 5836 | Switchboard MCP server (the Switchboard session only). |
| 8443 | HTTPS MITM proxy — the guest's egress. |
| 8444 | ssh-agent bridge (backs SSH_AUTH_SOCK). |
| 8445 | AWS credential_process helper. |
| 8446 | Claude subscription-token agent, and the on-host inference bridge (guest 127.0.0.1:11434). |
| 8447 | Codex/ChatGPT subscription-token agent. |
| 5000 | Browser-VM config agent (host→guest JSON config at claim). |
| 5100 | Browser-VM file transfer bridge. |
| 5200 | Browser-VM Chrome DevTools Protocol bridge (screenshots, eval). |
| 5300 / 5400 | Browser-VM link-sender / webcam. |
| 5810 | Browser-VM native-tabs bridge. |
| 5900 | Browser-VM network-trace bridge. |
Environment variables and launch arguments
These influence the app at launch. Most are for debugging, testing, or building from source; the Audience column flags who each is for. Set an environment variable before launching the binary, or pass a launch argument after it.
| Name | Effect | Audience |
|---|---|---|
-AppleLanguages "(fr)" (launch arg) | Standard macOS locale override; forces the UI language. | End user |
BROMURE_DEBUG_CLAUDE | Opens the control routes and debug endpoints on the TCP automation API, lets secrets travel through the AppleScript/MCP profile-JSON bridges, and is required for bromure-ac mcp --debug VM tools. | Power user / debugging |
BROMURE_AC_DEBUG=1 | Timestamped stderr debug for the automation engine, injection classifiers, rules scanner, and trace pipeline. | Debugging |
BROMURE_CLI_DEBUG | Verbose control-socket connection diagnostics on stderr for CLI commands. | Debugging (CLI) |
BROMURE_REPAIR_DEBUG | Local-inference repair-proxy request/response diagnostics, appended to /tmp/bromure-repair.log. | Debugging (local models) |
BROMURE_INFER_DEBUG | Per-request engine stats (slot, prefilled tokens, time to first token, tok/s) to stderr. | Debugging (local models) |
BROMURE_FATCLIENT_LOG | Unbuffered rich-client stderr logging. | Debugging (remote) |
BROMURE_ATTACH_DEBUG=<path> | Also append the rich-client log to a file. | Debugging (remote) |
BROMURE_NO_TRANSPARENT | Turns transparent interception off for every machine (the proxy still works for programs that honor the proxy settings). | Debugging |
BROMURE_INJECTION_COREML=1 | Run the injection classifiers on the CoreML/Neural Engine provider (CPU by default; CoreML uses several times the memory at identical accuracy). | Power user |
BROMURE_NO_COREML | Force-disable CoreML for the classifiers even if BROMURE_INJECTION_COREML is set. | Power user |
BROMURE_PII_BUDGET | Characters of new text per request the PII model reads before falling back to pattern rules only (default 300000). | Power user (PII) |
BROMURE_PII_MIN_SCORE | Confidence the PII model needs before swapping a value (default 0.6). | Power user (PII) |
BROMURE_PII_THREADS | CPU threads for the PII model (default: the performance cores, 2–8). | Power user (PII) |
BROMURE_TRANSCRIPT_HISTORY_BYTES | How much of a long conversation a chat loads at first (default about 24 MB); smaller values are for testing. | Testing |
BROMURE_GPU_CACHE_GB | MLX GPU buffer-cache cap in GB (default 4). | Power user (local models) |
BROMURE_KVBITS, BROMURE_KVBITS_START, BROMURE_CACHE_SLOTS, BROMURE_THINKING | On-device inference tuning: KV-cache quantization bits and threshold, KV-cache session slots, and disabling silent thinking. See Models & Providers. | Power user (local models) |
VISUAL / EDITOR | Editor used by bromure-cli workspaces edit (falls back to vi). | End user (CLI) |
BROMURE_MANAGED_URL | Override the bromure.io API base used for enrollment, heartbeat, and cert issuance. | Enterprise admin |
BROMURE_FATCLIENT_OPEN | Pure rich-client launch: skips first-run setup (no local base image needed). | Advanced / testing |
BROMURE_DEBUG_WIZARD | Opens the onboarding wizard on a given step (scan, pick, models, done) without a real install, or newworkspace to run it over an open home. | Testing / screenshots |
BROMURE_EDITOR_CATEGORY | Opens the settings editor on a given pane. | Testing / screenshots |
BROMURE_IMAGE_CATALOG_BASE | Point image downloads at a local/staging catalog; also disables catalog signature verification. Test and pipeline use only. | Test / CI |
BROMURE_INSTALL_BROWSER_IMAGE=1 | Auto-download AC's copy of the embedded browser image at launch. | Test / debug |
CODESIGN_IDENTITY | build.sh signing identity; unset falls back to ad-hoc - (no Gatekeeper, iCloud, or vmnet). | Developer (build) |
DEVELOPER_ID, APPLE_ID, TEAM_ID, APP_PASSWORD | package.sh Developer ID signing and notarization. | Developer / publisher |
DRY_RUN=1, KEEP_PREVIOUS=1, KEEP_STAGING=1 | Image publish/rehearsal pipeline switches. | Publisher |
The engine also sets internal variables for its own child processes (BROMURE_ENGINE_KEY, BROMURE_ENGINE_MASTER) and the throwaway sign-in VM sets BROMURE_AC_REGISTER; these are not meant to be set by hand.
UserDefaults keys (defaults write)
Persistent settings in the io.bromure.agentic-coding domain. Most have UI equivalents; the vm.* and developer knobs are set with defaults write while the app is not running.
| Key | Effect | Default |
|---|---|---|
automation.enabled | Turn the loopback automation HTTP API on. | false |
automation.port | Automation API port. | 9223 |
automation.bindAddress | Automation API bind address. | 127.0.0.1 |
remoteAccess.enabled | Enable the SSH remote-access front door. | false |
remoteAccess.port | SSH front-door port (≥ 1024). | 2222 |
remoteAccess.bindAddress | SSH front-door bind address. | 0.0.0.0 |
remoteAccess.passwordAuth, remoteAccess.pubkeyAuth | SSH auth methods. | both on |
ui.sessionsFirst | The sessions home. Turned off, the main window falls back to the machine-and-terminal layout. | true |
ui.beautifiedTranscript | Show agent sessions as chats rather than raw terminals. | true |
sessions.archivedExpanded | Whether the sidebar's Archived fold is open. | false |
ui.terminalBell | Let terminal bells ring (agents ring at the end of every turn). | false |
terminal.allowGraphics | Allow in-terminal image rendering from the guest. See Advanced. | false |
vmnet.useRandom172 | Put machines on a private random subnet in 172.16.0.0/12 (Preferences › Resources › Workspace subnet). | true on fresh installs |
proxy.noMitmDomains | Extra domains whose HTTPS is passed through without interception (Remote Access… › Don't intercept (no-MITM domains)). | empty |
p2p.udpRelay.enabled | Prefer the experimental UDP relay for remote connections (Preferences › Resources). | false |
vm.homeImageGB | Apparent size of a new ext4 home image, in GiB (8–1024; sparse). | 16 |
vm.mtu | Guest NIC MTU clamp — lower it on VPN hosts that black-hole downloads. | 1280 |
vm.networkMode, vm.bridgedInterface, vm.dnsServers | Browser-VM network mode, bridged interface, and DNS override. | mode NAT; others unset |
vm.extraChromeFlags, vm.chromeEnvExtra | Developer knobs appended to the browser VM's Chromium launch. | unset |
cloudflareTunnel.consented | One-time consent for exposing HTTP services via Cloudflare quick tunnels. | false |
catalog.refreshDisabled | Don't download the on-device model catalog; use the bundled and cached copies. | false |
ac.sidebarWidth.v2, ac.filePaneOpen | Persisted sidebar width and Files pane state. | app-set |
Guest-VM cheat sheet
Inside a running machine you are ubuntu, an ordinary user (sudo-capable) whose home is /home/ubuntu. The host wires up mounts and environment so package managers, agents, and Git work without any in-guest setup. See Concepts & Architecture for the mechanics.
Mount points and paths
| Path | What it is |
|---|---|
/home/ubuntu | Your home — the ext4 home.img (or a shared folder on machines not yet upgraded). |
/mnt/bromure-meta | Read-only per-launch config share: api_key.env, proxy.env, the CA cert, guest helpers, MCP shims and configs, hostname/MTU hints. |
/mnt/bromure-meta/bromure-*-mcp.py | The built-in MCP servers' stdio↔vsock shims (browser, task, automations, infra, delegation, switchboard). |
/mnt/bromure-outbox | Writable guest→host event share. |
/mnt/bromure-share-N | Shared project folders (up to 8), also symlinked into your home as ~/<basename>. |
~/.bromure/inbox/<id>/ | Files another agent sent this session with a delegation or request. |
~/.bromure/switchboard | The Switchboard's folder; its CLAUDE.md is the Switchboard's brief. |
~/.bromure/rooms/<slug> | A room Switchboard's folder. |
~/.bromure/pastes/ | Files pasted or dropped into a machine's terminal (auto-cleaned after 7 days). |
Environment set by the host
| Variable | Value / effect |
|---|---|
http_proxy, https_proxy, HTTPS_PROXY | http://127.0.0.1:65534 — the in-VM bridge that carries all guest HTTPS to the host MITM proxy. |
NO_PROXY | localhost,127.0.0.1,::1. |
SSH_AUTH_SOCK | /tmp/bromure-agent.sock — bridged over vsock to the host ssh-agent (only per-machine and explicitly imported keys are reachable; your macOS login agent is never exposed). |
| CA bundle variables | The re-signing root CA is trusted through the standard bundle variables for node, python, go, rust, curl, deno, and the AWS SDK. |
| Agent API keys | ANTHROPIC_API_KEY, OPENAI_API_KEY, XAI_API_KEY, GH_TOKEN, GITLAB_TOKEN, DIGITALOCEAN_ACCESS_TOKEN, LINEAR_API_KEY, TWILIO_ACCOUNT_SID / TWILIO_AUTH_TOKEN, the AWS variables, and any database or custom variables — all stand-in values; the host swaps in the real secret on the wire. |
| On-device and custom-server models | Claude Code sees ANTHROPIC_BASE_URL=https://bromure.llm, a per-VM ANTHROPIC_AUTH_TOKEN, the real model id in ANTHROPIC_MODEL and its size aliases, and CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1. |
| OpenRouter | Claude Code sees ANTHROPIC_BASE_URL=https://openrouter.ai/api, a stand-in ANTHROPIC_AUTH_TOKEN, an empty ANTHROPIC_API_KEY, and the chosen model ids per size. |
| Amazon Bedrock | Claude Code sees CLAUDE_CODE_USE_BEDROCK=1, AWS_REGION, and either a stand-in AWS_BEARER_TOKEN_BEDROCK (Bedrock API key) or AWS_PROFILE=default (AWS credentials). |
KIMI_CODE_OAUTH_HOST, KIMI_CODE_BASE_URL | With a Kimi subscription: point Kimi Code at Kimi's international service. |
BROMURE_REGISTRY | The address of a Bromure registry this machine has access to. |
Warning: Every credential the guest can read is a decoy. A stand-in token scoped to one host that appears in a request bound for a different host is the signature of exfiltration and trips compromise detection — it never authenticates anything.