Operate

Security

JoyMux is local-first. Use this page to evaluate the guarantee, not to reconstruct how it is implemented.

What runs locally

The daemon and CLI run as your user on your machine. Default install is ~/.local — no sudo.

There is no public remote-control plane. JoyMux does not expose a public network listener that lets someone else drive your agents. Local clients on this machine talk to the local daemon.

What data leaves the machine

Product execution evidence stays under ~/.joymux unless you export it. This website sends billing email to JoyPay at checkout, plus first-party funnel events (page and CTA) with no machine IDs. We do not scrape ~/.joymux.

Child environment values are not written into session records or logs. Command arguments, metadata, and process output can still contain secrets because the execution record preserves what actually ran. Treat ~/.joymux like other sensitive execution logs.

Optional JOYMUX_REDACT patterns apply to derived views you hand to a model. They do not rewrite the complete execution record. That split is intentional: keep evidence exact; redact what you send.

Permissions required

JoyMux executes the processes you authorize. It is not a sandbox and does not claim isolation from the rest of your account.

Working directories must already exist and be directories. Direct process execution is the default; shell parsing happens only when the caller sets shell: true, and that fact is recorded in session metadata.

Request-provided environment names can be restricted with the comma-separated JOYMUX_ENV_ALLOW allowlist.

Uninstall

joymux uninstall stops the daemon and removes the user service. Durable state under ~/.joymux is kept unless you pass --delete-state. Then delete ~/.local/bin/joymux. See uninstall.

Limitations (stated)

• Not a sandbox, syscall isolator, user-namespace isolator, or remote authentication system.
• Resource limits in v1 are declarations only (enforced: false). Observed usage is best-effort. Do not treat those fields as confinement.
• No disk quota. You are responsible for disk space and for protecting ~/.joymux.
• After a daemon restart, resume is from durable evidence. Live terminal reattach is not always claimed.
• Secrets that child processes print are preserved in the execution record.

Related: authorization, operations, privacy.