How it works
Hewy is an app on your Mac and iPhone, and a small program on each of your servers. Here's what each part does, and what our own servers do and don't see.
hewy.app, our server, sits off to the side: it carries sealed notifications, sealed sync between your devices, and sealed messages between your servers. It never carries your chats, files or code.
Your Mac and iPhone connect to each server over SSH, as a terminal app does, with the server's identity remembered and checked every time. Nothing goes through our servers. Each device has its own SSH key, made in its Secure Enclave, so it can't be copied off the device.
A small program in your account on the server. It holds your chats, terminals and schedules, so they keep going when your laptop closes or your phone sleeps, and any of your devices can pick them up. It never opens a network port: the app reaches it through SSH. Every release is signed with a key kept offline, and the app checks the signature before installing it. Set it up by hand →
On Linux, each agent runs inside bubblewrap. It can work on your files, but can't reach the daemon, its settings, or the API keys on the server, and you can hide the account's SSH keys from it too. You choose, per chat, whether it asks before each command (Ask), asks only for risky ones (Auto), or just works (Full).
When an agent asks to run something, your iPhone or Mac shows exactly what, and your answer is signed with a key that needs Face ID, Touch ID or your passcode. The daemon only accepts a signed answer, once, and only for what was shown.
Your server encrypts each notification for your devices before it leaves. Our push service and Apple carry only that ciphertext, and see "Open Hewy" at most.
Nothing is connected until you connect two chats, and you choose which way, what can travel and for how long. A message goes from one server to the other through an app of yours that's open, or, when none is, sealed through our relay for the receiving server alone. Each server has its own keys, which only your devices introduce to each other.
Your server list, saved passwords, API keys and snippets sync between your devices, encrypted on the device first with a key that comes from your master password, which never leaves your device. Every change is signed by the device that made it.