From 2a7ad7be7a3a5208dcacf54cf731e3256e9bd1ca Mon Sep 17 00:00:00 2001 From: HughhhhCoder Date: Fri, 21 Aug 2026 12:56:45 +0800 Subject: [PATCH] docs: complete project documentation --- README.md | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/README.md b/README.md index 1845336..d887c73 100644 --- a/README.md +++ b/README.md @@ -69,6 +69,20 @@ RCC_CLAUDE_CMD=bash RCC_CLAUDE_ARGS="-l" RCC_CWD=/tmp pnpm dev:host --- +## Security and trust boundaries + +RCC is a local-control layer, not a hosted Claude service. The host daemon runs on your machine, starts the configured CLI or SDK driver with that machine's permissions, and exposes the resulting sessions to paired clients. Review the working directory, driver command, environment variables, and permission mode before using it with sensitive repositories. + +- Pairing creates a device token and key material; revoke devices you no longer trust. +- The WebSocket and REST surface is designed for encrypted client-to-host transport, but a public tunnel still makes the host reachable from the internet. +- `RCC_TUNNEL=1`/`try` is convenient for temporary access; use a named tunnel and an explicit network policy for a durable deployment. +- Treat `bypassPermissions` as a high-risk mode. RCC protects the toggle with WebAuthn when available, but the underlying Claude Code permissions still need deliberate configuration. +- Share links are optional, time-limited, revocable, and read-only; they are not a substitute for device authentication. + +RCC does not replace Claude Code's own account, provider, repository, or operating-system access controls. See the [threat model](docs/threat-model.md) and [operations guide](docs/operations.md) before exposing a host beyond loopback. + +--- + ## What's in the box ### Clients and drivers @@ -194,6 +208,22 @@ pnpm -F @rcc/web build # production web bundle pnpm dev # run host + web in parallel ``` +For a release-style verification pass, also build every workspace package and the distributable artifacts: + +```sh +pnpm -r build +pnpm build:release +``` + +The main workspaces are: + +| Package | Responsibility | +| --- | --- | +| `@rcc/host` | Local daemon, sessions, REST/WS, audit, security, plugins, and federation. | +| `@rcc/web` | Responsive PWA and desktop web client. | +| `@rcc/cli` | Node client for scripts and automation. | +| `@rcc/protocol` | Shared Zod-validated WebSocket frame types. | + Mobile verification is a hard gate on every phase: 375 px baseline, touch targets ≥ 44 px, composer follows the visual viewport, no horizontal scroll, safe-area insets respected on iOS. ---