Paired cloud integration

Browser SSH through Kerrigan

Pair once to trust the relay endpoint. Open two outbound WebSockets only when an authorized operator requests a shell.

Browser SSH setup through a paired Kerrigan controller Pairing provisions trusted terminal URLs. The cloud authorizes a session and issues separate grants; browser and Kerrigan connect to its relay, then Kerrigan opens an SSH PTY on the DevKit and reports ready. 01 PAIRING — authenticated profile provisioning Pairing response: terminal.websocket_urls Persist exact allowed WSS URLs 02 ON DEMAND — one session for one selected DevKit Request DevKit terminal Authorize operator; issue separate grants devices.ssh.open + controller grant Session + client grant WSS connection + client grant Outbound WSS + controller grant Validate profile, login and device; reserve SSH authentication + PTY PTY ready ready (sequence 1) ready → browser acknowledges Browser Operator terminal Cloud service Pairing + session API Session relay WSS endpoint Kerrigan Controller DevKit SSH server Time flows downward · Solid: request / ready · Dashed: response · Open arrow: command dispatch

The browser and controller may attach in either order. The relay validates each one-use grant and pairs only peers from the same session; browser grants also require an allowed Origin.

After ready, input, output, resize events and acknowledgements travel through the relay. Kerrigan owns the SSH connection and PTY. On revocation, expiry or disconnect, close both WebSockets; Kerrigan closes SSH and releases the device.