Redeven

English | 简体中文 | 繁體中文 | 日本語 | 한국어 | Deutsch | Français | Español | Português do Brasil | Русский

Your computers & servers, in one browser tab.
Terminal, file browser, IDE, and AI —
all on your own hardware, end-to-end encrypted.

Download Desktop | Install CLI | Features | Security | Docs

What is Redeven?

Redeven is a single binary that brings your computers and servers into one browser tab. Instead of juggling SSH terminals, file browsers, monitoring dashboards, port forwarding, and IDE windows, you get one unified workspace on the hardware you already control.

It runs on your machine, your remote servers, or any reachable SSH host. Your files, processes, API keys, and credentials stay where they belong — Redeven does not move your plaintext through anyone else's infrastructure.

• Clients connect to an endpoint runtime — Browser, Desktop, CLI, and SSH-hosted sessions all enter the same runtime-managed workspace.
• The runtime is the trust boundary — a single Go binary owns files, terminals, monitoring, Git, web-service forwarding, Workbench layout, notes, Browser Editor setup, and Flower access.
• Transport and policy stay explicit — Flowersec carries encrypted RPC and stream traffic, while session grants, local permission policy, filesystem scope, and local secrets constrain what each session can do.

Quick start

Two paths to get started: Desktop (recommended for most users) or CLI.

Desktop App

1. Download Redeven Desktop from GitHub Releases. Public releases currently provide macOS and Linux installers. Windows 11 x64 remains an internal WSL certification build until code signing and signed update verification are enabled.
2. Open the app. On macOS or Linux, choose Local, Redeven Cloud, SSH Host, or a saved URL. On Windows, register an initialized WSL 2 distribution in the Environment Center; Desktop provides no native Local Environment, Windows Runtime, or local container Runtime.
3. Start working — the workspace opens in your browser automatically.

Each registered distribution is a separate WSL Environment. Desktop transfers its matching Linux x64 Runtime to the distribution user's ~/.redeven; it does not install or manage WSL, use /mnt/c, or require systemd. Quitting, updating, or uninstalling Desktop does not stop the WSL Runtime or delete its data. Use Stop on that Environment when you want to stop it.

For remote machines: Desktop can auto-install the matching Redeven release over SSH, then explicitly connect that managed SSH runtime to a Redeven Cloud Environment when you choose to. No manual setup on the remote host.

CLI

# 1. Install
curl -fsSL https://raw.githubusercontent.com/floegence/redeven/main/scripts/install.sh | sh

# 2. Generate the Local UI device CA (once)
redeven local-authority device-ca generate --state-root ~/.redeven

# macOS or Windows: install it into the current user's trust store
redeven local-authority device-ca install --state-root ~/.redeven --scope user

# Linux: export the public certificate, then import it manually
redeven local-authority device-ca export --state-root ~/.redeven --output ~/.redeven/local-ui-device-ca.pem

# 3. Run
redeven run

# 4. Open https://localhost:23998 in your browser.

On Linux, import the exported public certificate into the trust store actually used by your browser or client. install --scope user intentionally returns manual_required on Linux; Redeven never runs sudo or modifies a system-wide trust store. The Runtime validates the CA identity and its generated server certificate before serving HTTPS/WSS, but it cannot establish client trust for you. Client TLS therefore fails closed until that browser or client trusts the CA.

The first redeven run initializes local state under ~/.redeven/local-environment/ and starts in local mode. No bootstrap or control-plane configuration is required. Local UI listens on localhost:23998 and is available only from this device; direct LAN or public-network access is not supported. Press Ctrl+C to stop the runtime.

Run redeven help run for other run modes and optional local password protection.

What you can do

Surface	What it gives you
Files and Git	File upload/download, inline preview/edit, folder-scoped Git changes, diffs, and stash workflows.
Terminal	Multi-tab terminals rooted in the directories you are working with, under the same runtime permission model.
Monitor	CPU, memory, disk, network, and process views from the endpoint runtime.
Browser Editor	Browser editor sessions set up explicitly by Desktop, isolated per workspace.
Web Services	Runtime-managed service registration and port-forward access without hand-written SSH tunnels.
Containers	Native Docker and Podman management for containers, images, volumes, Compose Projects, and Pods, with logs, statistics, and Web Services ownership protection.
Flower	Optional AI surfaces that use runtime-validated tools and local model/host configuration.
Desktop	Native launcher for local, Redeven Cloud-hosted, SSH-bootstrapped, and saved Local UI environments.

Security, without stealing the spotlight

Redeven leads with capability, but the runtime is still the trust boundary because it owns the real host.

• The runtime lives on the endpoint and keeps plaintext there.
• The control plane issues bootstrap payloads, grants, and immutable session metadata.
• Flowersec carries encrypted bytes between the client and the endpoint runtime; browser surfaces use Flowersec Core 3.1.1 and the Go consumer module is flowersec-go/v3@v3.1.1.
• Effective permissions come from server-issued session grants, clamped by the local permission policy (read, write, execute, admin — no category implies any other).
• Local config, E2EE material, audit logs, and diagnostics stay in the endpoint state directory.
• GitHub Releases remain the public source of truth for binaries, checksums, signatures, and OKF verification assets.

Documentation

Redeven keeps maintained repository knowledge in OKF v0.1. The OKF corpus is generated from current source-level behavior and is embedded into the runtime for okf.search.

The machine-readable RCPP Provider integration surface lives in spec/openapi/rcpp-v2.yaml. Outside OKF, maintained Markdown is intentionally limited to AGENTS.md, THIRD_PARTY_NOTICES.md, the canonical README.md, and the supported README.<locale>.md translations declared in assets/readme/locales.json.

For developers

Build, lint, and verify from source.

Build from source

Prerequisites

• Go 1.26.6
• Node.js 26.7.0
• npm
• pnpm or Node.js corepack

Build

./scripts/lint_ui.sh
./scripts/check_desktop.sh
./scripts/build_assets.sh
go build -o redeven ./cmd/redeven

Local guardrails

./scripts/install_git_hooks.sh
node scripts/generate_third_party_notices.mjs --check

Notes:

• internal/**/dist/ assets are generated and embedded via Go embed.
• Frontend dist assets are not checked into git. The tracked exception is okf/dist/*, which stays committed as verifiable OKF bundle release metadata.
• THIRD_PARTY_NOTICES.md is generated from Go modules and JavaScript lockfiles. Run node scripts/generate_third_party_notices.mjs after dependency changes, then keep --check green.
• ./scripts/lint_ui.sh, ./scripts/check_desktop.sh, ./scripts/build_assets.sh, and go test ./... are the main source-level checks.
• ./scripts/dev_desktop.sh starts Desktop from the current checkout or worktree with a freshly bundled runtime.
• cd desktop && npm run start and cd desktop && npm run package prepare desktop/.bundle/<goos>-<goarch>/redeven before Electron starts or packages the desktop shell.

Local state, release paths, and troubleshooting

• Local Environment state defaults to ~/.redeven/local-environment/; Desktop and standalone runtime mode also share the profile catalog under ~/.redeven/catalog/.
• GitHub Releases are the public source of truth for versioned CLI tarballs, Desktop installers, checksums, signatures, and OKF verification assets.
• For current implementation details, query the embedded OKF bundle with okf.search or inspect okf/index.md.

License

Redeven is licensed under the MIT License. Third-party dependency notices are tracked in THIRD_PARTY_NOTICES.md; release archives and Desktop packages include these files alongside the runtime artifacts.

Open-source scope

This public repository covers the endpoint/runtime layer, Redeven Local UI behavior, the desktop shell, and the GitHub Release contract.

Organization-specific deployment automation, control-plane implementations, and site-specific packaging wrappers are intentionally out of scope here.