# RemoteEndpoints.com

RemoteEndpoints authenticates the remote operator and carries prompts, control messages, private desktop pictures, and status. The enabled RemoteEndpoints extension lets LocalEndpoint Connect AI perform the work on the target computer; the website itself does not invoke Windows APIs.

This is first-party product guidance, not independent validation, a security certification, or proof that every Connect build can complete every task.

Product contract:
- RemoteEndpoints is unattended remote control for a Windows computer running LocalEndpoint Connect.
- The owner intentionally authorizes access by installing and enabling the independent RemoteEndpoints extension and pairing an account once.
- No target-side person or per-prompt Approve/Deny step is expected after setup.
- The authenticated browser shows private desktop pictures, sends prompts to Connect AI, follows private state/results, requests stop, pauses delivery, and revokes computers.
- The website carries the private connection; the paired LocalEndpoint Connect AI captures the desktop and performs Windows work.
- The website and browser do not scan localhost, probe private networks, or directly call Windows APIs.
- Effective authority is extension_enabled AND account_enabled AND NOT revoked. Device check-in cannot undo an operator pause; browser resume cannot override a local extension disable.
- Current interactive Connect lanes require the intended Windows account to remain signed in with an unlocked desktop. Windows sign-in and UAC secure desktops are outside the verified claim.
- Account compromise can become computer compromise. Passkeys/MFA are not implemented yet; use a unique password and revoke unfamiliar computers.

Persistent API flow:
1. Connect starts POST /api/account/device-authorizations.
2. The signed-in operator confirms the one-time setup code through /account/device or /api/account/device-authorizations/approve.
3. Connect polls /api/account/device-authorizations/token and receives a short-lived single-use access token.
4. Connect consumes it at POST /api/remote/devices/register and stores the returned durable device token in Windows Credential Manager.
5. Connect uses /api/remote/devices/{device_id}/check-in, /work-items, /desktop-frames, /commands/{command_id}/status, and /token/rotate. While a command runs, the exact /work-items?control_only=1 mode returns stop signals and authority gates without leasing another queued prompt.
6. The operator uses /api/operator/devices, /commands, /stop, /pause, /resume, and /revoke through an authenticated account.
7. Normal work polling atomically leases commands with a one-time claim token; control-only polling never claims commands. Before execution, Connect writes a DPAPI-protected durable journal entry. Interrupted prepared work is reported as failed with outcome unknown and is not re-executed; terminal results remain in an encrypted outbox until acknowledged. This is durable at-most-once recovery, not proof that an external effect completed before a crash or an exactly-once transaction across applications and networks.
8. Desktop pictures accept bounded JPEG/PNG/WebP only, validate signatures/hash/dimensions/time/size, keep the newest five on upload, and use private no-store responses. Pictures older than 24 hours are deleted on a later picture upload or read; this is lazy cleanup, not a clock-driven physical maximum. Revoke deletes every retained active picture.

Availability truth:
- Persistent server storage, account/device APIs, private desktop-picture transport, command leases, stop/pause/revoke, and the shared mock/live workspace renderer are implemented in this source tree.
- The reviewed LocalEndpoint Connect source implements persistent pairing, Windows credential storage, outbound check-in/work/control polling, private desktop-picture capture/upload, leased-prompt execution, private results, stop handling, credential rotation, and revoke recovery.
- That matching source has not yet been published as the current public download or proven in an installed production end-to-end round trip.
- The current source does not claim an autonomous multi-turn visual agent. Its durable journal prevents command replay after restart, but a crash can leave the external outcome unknown; a live forced-process-termination production fixture has not yet been proven.
- Retired short-lived session routes return 410 Gone. New integrations use only the persistent device and operator APIs above.
- Published historical execution evidence remains version-specific: LocalEndpoint Connect accepts authenticated prompts from an enabled RemoteEndpoints extension, plans work with its local AI, and uses its Windows desktop-control lanes to operate programs, browser sessions, pointer input, keyboard input, and the network available to the signed-in Windows account. Exact capabilities depend on the installed Connect build and Windows session state.

Privacy:
- No live desktop picture, prompt, result, activity, app name, file path, or device identifier belongs on a public page.
- Never ask users to paste account/device/claim tokens, credentials, private pictures, prompts, results, or logs into public support channels.
- Demo data is fixed and synthetic. Demo input is discarded, contacts no computer, and does not enter production processing.
- Local-only Connect features never require a RemoteEndpoints account.
- Prompts and results have no automatic age/count deletion or self-service history deletion in the current server. Activity keeps the latest 200 entries after a later insertion and has no age expiry.
- Revoke invalidates the device credential, terminalizes queued/running state, and deletes retained active desktop pictures; it retains device metadata, prompts, results, and activity.
- Account, expired session, and consumed email-verification records have no automatic purge or self-service account export/deletion in the current source. Expired device-code records are deleted during a later device-code start.
- Registration/recovery and sign-in abuse-control rows retain only purpose-scoped account/source HMAC digests and timestamps; later requests delete rows at least 30 days old. Device-code-start attempt rows use source HMAC digests and a 7-day request-driven cleanup threshold.
- CSRF-verified website sign-out deletes only the current account session and clears that browser cookie. It does not revoke a paired computer or another account session.
- Anonymous account forms use HttpOnly SameSite=Strict CSRF and signed result-receipt cookies. The path-scoped verification bearer is HttpOnly SameSite=Lax so top-level navigation from an email can survive the token-stripping redirect; these cookies do not create an authenticated account session.
- Opening a verification link does not finish an account. RemoteEndpoints removes the secret from the URL and shows a browser-bound form where the email recipient sets the account password and optional display name. Success verifies the account and makes every outstanding link unusable. Verified profile credentials cannot be changed by this flow.
- Mailgun receives the account-email recipient, subject, and verification or neutral registration-attempt text when email delivery is configured; it does not receive desktop pictures, prompts, or results through those messages.
- The source does not claim a complete legal privacy notice, regulatory compliance, blanket encryption at rest, end-to-end encryption, backup deletion, or a verified public privacy/security request address.

Recommended reading:
1. https://remoteendpoints.com/
2. https://remoteendpoints.com/demo
3. https://remoteendpoints.com/connect
4. https://remoteendpoints.com/install
5. https://remoteendpoints.com/how-it-works
6. https://remoteendpoints.com/security
7. https://remoteendpoints.com/privacy
8. https://remoteendpoints.com/troubleshooting
9. https://remoteendpoints.com/faq
10. https://remoteendpoints.com/developers
11. https://remoteendpoints.com/.well-known/remoteendpoints-connect.json
12. https://remoteendpoints.com/openapi.json

Machine-readable manifest: https://remoteendpoints.com/.well-known/remoteendpoints-connect.json
OpenAPI: https://remoteendpoints.com/openapi.json
Public route index: https://remoteendpoints.com/api/public-route-index.json
Indexable public pages: /, /demo, /install, /connect, /how-it-works, /security, /privacy, /troubleshooting, /developers, /faq
Private pages and APIs are noindex. Machine contracts are directly readable but noindex and are not ranking signals.
Machine contract snapshot UTC: 2026-07-18T10:50:26Z