dtfm

Let sandboxed AI agents run privileged commands—with your [y] approval.

Keep sudo, SSH keys, and cloud tokens (aws, gcloud, kubectl) on your machine—never inside the agent's container or VM. When the agent needs a privileged or host command, lmdtfy sends it to your terminal (dtfm), where you inspect it, press [y], and authenticate locally.

lmdtfy = Let Me Do That For You (agent sandbox)
Agent Sandbox · lmdtfy Outbound request 
$ lmdtfy exec \
    --why "Restart Nginx after updating TLS config" \
    -- sudo systemctl restart nginx
dtfm = Do That For Me (your terminal)
Your Terminal · dtfm 
──────────────────────────────────────────────────
🔔 LMDTFY Command Execution Request:
   Reason:  Restart Nginx after updating TLS config
   Command: sudo systemctl restart nginx
──────────────────────────────────────────────────
Approve execution? [y] Run  [e] Edit  [n] Reject: y
⚡ Executing: sudo systemctl restart nginx
[sudo] password for ivan: 
✅ Command succeeded (exit code 0, 142ms)
Zero-credential handoff: sudo reads your password or Touch ID directly from /dev/tty—neither dtfm nor lmdtfy ever sees your credentials.

Quickstart

Install both binaries on your workstation, then pair dtfm with lmdtfy over an E2EE Magic Link or a local/SSH Unix socket.

$ curl -fsSL https://dtfm.dev/install | sh
Agent Sandbox lmdtfy exec --relay WSS + E2EE relay.dtfm.dev (RAM only) #<key> never sent to server WSS + E2EE Your Terminal dtfm --relay

1. Start a relay session on your machine

$ dtfm --relay
Agent Magic Link:
  https://dtfm.dev/c/7a9b2c3d...#e8d7c6b5...

Zero inbound ports. The #<key> fragment stays client-side per RFC 3986.

2. Paste one line into your agent's chat

Read https://dtfm.dev/agent.md and use https://dtfm.dev/c/7a9b2c3d...#e8d7c6b5... to run privileged commands via lmdtfy.

The agent installs lmdtfy via curl -fsSL https://dtfm.dev/install | sh -s -- lmdtfy and runs lmdtfy ping.

Local / SSH VM lmdtfy exec Direct Unix Socket or ssh -R RemoteForward (zero relay) Your Terminal dtfm

1. Start the listener (or forward over SSH)

$ dtfm

# Or drive a remote VM over SSH:
$ dtfm ssh-config user@box --write && ssh user@box

Listens on /run/user/<uid>/lmdtfy.sock (Linux) or ~/.lmdtfy.sock (macOS).

2. Dispatch from the agent

$ lmdtfy ping
$ lmdtfy exec --why "Check listening TCP ports" -- sudo ss -tulpn

See docs/agent.md for full CLI flags and exit codes.

Local sudo without NOPASSWD

Gate apt, systemctl, or ufw behind [y] and your password or Touch ID.

Cloud keys stay off sandboxes

Keep gcloud, aws, kubectl, gh, and 1Password on your laptop while agents work anywhere else.

Supervised remote ops

Let agents administer a VPS over ssh while you approve or [e] edit every command before it runs.

Security & Verification

Built to keep credentials on /dev/tty, payloads encrypted end-to-end, and terminal prompts spoof-resistant.

TTY & Stdin Isolation (TIOCSPGRP)

Child stdin is bound to /dev/null; authenticators (sudo, ssh, gpg, pam_tid) receive foreground /dev/tty control directly so passwords bypass dtfm and lmdtfy.

Zero-Knowledge #fragment E2EE

Bilateral nonces + HKDF-SHA256 + AES-256-GCM (with session-ID AAD) derive keys from #<key>, which is never transmitted. dtfm-relay routes ciphertext in RAM with zero disk state.

Anti-Spoofing Terminal Prompt

Escapes ANSI/CSI sequences, highlights Trojan Source bidi/control characters, flushes pending TTY input (TCFLSH/TIOCFLUSH) before prompting, and renders multiline scripts with numbered gutters.

Verifiable Builds

Binaries are verified against SHA256SUMS by install.sh and attested in GitHub Actions:

$ gh attestation verify dtfm --repo iinozemtsev-lab/dtfm
Execution Trust Boundary dtfm is a human-in-the-loop seatbelt, not a sandbox. Approved commands run unsandboxed on your host with your local user's privileges—only pair with your own agent sessions, and always read the command and --why before pressing y.
Public Relay (relay.dtfm.dev) Provided free and as-is on a best-effort basis with zero disk logging and no uptime SLA. For production or team reliance, self-host dtfm-relay on your own VPS.