# Marketing claim ledger

Every factual product claim in the site HTML, `llms.txt`, and structured data maps to a row here. No metrics, testimonials, customers, download counts, or capabilities are invented.

**Source of truth:** historical file:line references below were recorded at `c5910e8`. The September 7, 2026 reconciliation checked changes against `602c524`, including optional Druk editing and repository-based support. Historical references are not a claim that the older commit is the current product head. Comparison rows cite each competitor's own public site, fetched on 2026-08-06.

**Screenshot provenance:** both site screenshots were captured fresh on 2026-08-06 against the app in its explicit demo mode (no daemon attached). The app renders its own `MOCK` badge and a "Daemon unavailable; explicit demo mode active" banner in both captures, and the captions on the site say so. No retouching, no composites presented as captures.

## Product claims

| Page claim | Evidence | Guardrail |
| --- | --- | --- |
| Helioterm is local-first browser access to durable tmux-backed terminal and AI-agent sessions. | `README.md:3`; `docs/architecture.md:3` | Use the README sentence near-verbatim for the main description. |
| Sessions survive closing the browser; the browser is a client, tmux is the durability layer. | `docs/architecture.md:20` ("The browser is a terminal client and dashboard. tmux is the durability layer."); `docs/adr/004-pty-durability-model.md:7`; `docs/testing.md:137` | "Reattach from any device" means any paired, signed-in device (`docs/security.md:134-135`), not device magic. |
| The protocol detects agent sessions and types them as claude, codex, opencode, openclaw, shell, or unknown. | `packages/protocol/src/domain.ts:91`; `packages/protocol/src/agents.ts:18-37`; `apps/web-next/src/components/dashboard-model.ts:137` | Name the four agent kinds exactly; everything else is "shell" or "unknown". These are detected session types, not integrations or partnerships. |
| Agent sessions waiting for input or approval are flagged; the dashboard shows which agent needs attention. | `packages/protocol/src/agents.ts:45-51,86` (`needsInputPatterns`, returns `"needs_input"`); `apps/web-next/src/components/surface-tabs.tsx:130` ("Needs attention"); `apps/web-next/src/components/dashboard-model.ts:166-167` (workspace rollup) | The UI string is "Needs attention"; the illustration on the site uses it verbatim and is labelled as an illustration, not a screenshot. |
| WinSCP-style file explorer: browse, create folders, rename, delete, jailed to the workspace. | `docs/superpowers/specs/2026-07-24-file-browser-design.md:10` ("WinSCP-register explorer in miniature"); `apps/daemon/src/http.ts:414,425,435` (`/api/files/rename`, `/api/files/mkdir`, `/api/files/delete`); `apps/daemon/src/files.ts:193` (jail check on delete) | "Create" means folders (`mkdir`). Never claim file creation or upload. |
| File viewing is read-only: code, markdown, and git viewers with a 512 KiB cap. | `apps/web-next/src/components/code-viewer.tsx:128` ("Files stay read-only and are capped at 512 KiB."); `apps/daemon/src/files.ts:4` (`defaultFileReadLimit = 512 * 1024`); `apps/web-next/src/components/git-view.tsx:109` ("Git access is read-only") | Built-in viewers remain read-only. The optional, separately installed Druk editor can modify files in a managed terminal tab; see `README.md` and `apps/daemon/src/druk-editor.ts`. It is not bundled or downloaded. |
| Installable PWA with standalone display. | `apps/web-next/app/manifest.ts:11` (`display: "standalone"`) | No offline claim; no service worker exists. |
| Built and tested for mobile browsers; automated checks emulate Pixel 7, iPhone 13, and iPad Mini. | `playwright.config.ts:32,37,42` (`devices["Pixel 7"]`, `devices["iPhone 13"]`, `devices["iPad Mini"]`) | Emulated evidence only. Say "built and tested for mobile browsers", never "tested on devices"; real-device checks are an open release gate. |
| Touch quick keys (Ctrl, Esc, Tab, arrows) on touch screens; off by default on desktop. | `apps/web-next/app/globals.css:1062-1070`; `apps/web-next/src/components/theme-picker.tsx:17` | |
| The daemon accepts literal IPv4 `127.0.0.1` only; no LAN, wildcard, or public bind flag exists; wrong values fail before startup. | `docs/security.md:7,11`; `docs/install.md:57` | Phrase as "no flag exists", not "impossible to misconfigure". |
| Browser login sets an opaque, HttpOnly, SameSite=Strict cookie; the browser never holds a JWT; tokens never in URLs or web storage. | `docs/architecture.md:131`; `docs/security.md:129-130` ("Browser login does not return or store that token.") | HS256 JWT signing still exists for the non-browser automation path (`packages/auth/src/index.ts:131`), so scope the claim to browser sessions. |
| Terminal WebSockets start with a short-lived, single-use (one-time) attach ticket. | `docs/architecture.md:48,72`; `docs/API.md:247` | |
| Revoking a device invalidates its attach tickets and closes its live sockets. | `docs/security.md:139-141,231`; `docs/architecture.md:80` | |
| Workspace child processes get a minimal environment; daemon tokens and auth secrets are not inherited. | `docs/security.md:236-238`; `packages/tmux-adapter/src/env.ts:5` (`internalEnvPrefixes = ["CMUX_WEB_", "HELIOTERM_"]`); `apps/daemon/src/live-transport.test.ts:327` | |
| A 38-file security test suite. | `package.json:33` (`test:security` enumerates exactly 38 distinct existing test files, verified by parsing the script) | Exact count re-verified at this commit. Do not round up. |
| Pinned OSV-Scanner and gitleaks; CycloneDX SBOM and in-toto provenance per release build. | `docs/security.md:272` ("OSV Scanner 2.3.8 and gitleaks 8.30.1 by version/hash"); `docs/packaging.md:49-51`; `docs/testing.md:403` | |
| Tailscale Serve is the recommended private remote path; the daemon stays on loopback; traffic is encrypted in transit over your tailnet. | `README.md:33-42`; `docs/security.md:53-54`; `docs/tailscale.md` | Tailscale provides the transport encryption. Say "encrypted in transit over your tailnet"; NEVER "we encrypt". |
| App auth still applies behind Tailscale Serve; tailnet membership and Tailscale identity headers never create a session. | `docs/tailscale.md:17` | |
| Tailscale Funnel is public internet exposure and is warning-gated behind an explicitly dangerous flag. | `README.md:42`; `docs/security.md:59-61` | |
| `--allow-tailscale-hosts` allow-lists this machine's exact MagicDNS hostname, never a `*.ts.net` wildcard. | `docs/tailscale.md:37` | |
| Several computers means a daemon per machine, each reached at its own tailnet name; no cross-machine pane. | `docs/architecture.md:6` ("Users run the tool on their own machine"); `docs/tailscale.md:37` ("this machine's exact MagicDNS hostname"); owner-approved phrasing for the site | Single-machine architecture is documented; the multi-machine sentence states the deployment reality. NEVER claim multiple computers in one pane, and NEVER claim UI layout syncs across devices (sessions reattach; layout prefs stay per-device). |
| One controller and up to seven read-only observers, enforced server-side; takeover is an audited action; handover does not restart the process. | `apps/daemon/src/resource-budgets.ts:37` (`controllers: 1, observers: 7`); `docs/architecture.md:74`; `docs/security.md:228-229` | Keep "does not restart" phrased as a property of tmux-backed sessions. |
| App-created tmux sessions are stamped `@helioterm_managed`; kill and rename refuse unmarked sessions; `helioterm tmux migrate-legacy --dry-run` adopts older sessions. | `packages/tmux-adapter/src/adapter.ts:182,1162,1194,1257`; `README.md:52` | |
| Default address is `http://127.0.0.1:4020`. | `packages/cli/src/cli.ts:58` (`defaultPort = 4020`); `README.md:20`; `apps/daemon/src/index.ts:98` | The demo screenshots show port 4399 because the capture server ran there; the site never claims 4399. |
| From-source install commands (`corepack enable`, `pnpm install`, `pnpm build`, `CMUXD_REMOTE_PATH=... CMUX_WEB_AUTH_TOKEN=... pnpm helioterm serve`). | `README.md:11-18` | Copy commands verbatim; do not invent a curl installer. |
| Tarball-style CLI install (`pnpm --filter helioterm build`, `npm pack ./packages/cli`, `npm install -g ./helioterm-0.1.0.tgz`, `helioterm doctor`). | `README.md:22-31` | |
| CLI command set: `serve`, `doctor`, `--version`, `tailscale status`, `tailscale setup`, `tmux migrate-legacy --dry-run`. | `README.md:44-52` (and `helioterm --version` at `README.md:28`) | |
| First run creates a local signing secret; `CMUX_WEB_AUTH_TOKEN` is a bootstrap login secret; auth state lives under `~/.cmux-web` (`CMUX_WEB_STATE_DIR` overrides). | `docs/install.md:24-28`; `.env.example:38-40` | Call it a "signing secret", not a browser JWT; browser sessions stay opaque. |
| Live terminal data flows through an external `cmuxd-remote` sidecar, separately installed, pinned by path, not bundled; without it, terminal attach returns 503 while UI and control plane still work. | `docs/install.md:45-46`; `docs/current-architecture-map.md:85-86`; `apps/daemon/src/http.ts:695` | Never imply CMUX code ships inside Helioterm; CMUX's own license terms apply. |
| v0.1 has no transcript capture or persistence; renderer scrollback is memory-only; no service worker is registered. | `docs/adr/006-transcript-scope.md:12`; `docs/security.md:190`; `docs/current-architecture-map.md:101` | Grounds the privacy-page statement that the browser app does not persist or cache terminal output. |
| Requirements: Node 22.12+ within 22.x (22.12 needs `NODE_OPTIONS=--experimental-sqlite`) or 24.x; pnpm 10.15+ via Corepack; tmux 3.x; Tailscale CLI optional. | `docs/install.md:7-11` | |
| The v0.1 candidate is an npm/global CLI for macOS; Linux, Docker, and standalone binaries are later tracks. | `docs/install.md:61`; `docs/adr/010-supported-platforms-release-scope.md:14` | Never claim Linux or Windows support today. |
| Helioterm is a private pre-release: not release-ready, publication gated on the release checklist and owner gates; no public release artifact or public source access. | `README.md:104-105`; `docs/install.md:62-63`; `docs/release-blockers.md:11-59` | Keep adjacent to every install/CTA surface. NEVER say or imply production-ready. |
| Remaining release gates: clean-machine validation, real-device mobile/TUI evidence, real Tailscale evidence, consolidated model review, external human security review, owner approval. | `README.md:104-105`; `docs/release-blockers.md:13-59` | Present as the project's own words. |
| The code is MIT licensed. | `LICENSE:1`; `package.json:6` | Pair with "no public artifact yet" so MIT is not read as "downloadable now". |
| Release builds emit a CycloneDX SBOM, in-toto provenance, checksums, and pinned scanner results; the real tarball is inspected against an explicit file allowlist. | `docs/packaging.md:49-51`; `docs/testing.md:403`; `docs/security.md:265-272` | |
| The protocol is VibeTunnel-compatible (WS v3). | `README.md:59`; `docs/architecture.md:28` | Compatibility claim only. NEVER "uses VibeTunnel" or "built on VibeTunnel"; `docs/API.md:4` notes the server contract is not complete VibeTunnel. |
| Hero tagline "Know when your agent needs you." | Grounded in the needs-input detection rows above | Replaces the earlier "Your terminal, still running." tagline from the retired demo kit. |
| This site sets no cookies and runs no analytics, forms, accounts, or payments; fonts and images are same-origin. | Enforced by the site source itself (no third-party requests present in `site/`) | Revisit `privacy.html` before ever adding any collection or third-party runtime. |
| People with source access use repository issues for ordinary support and follow `SECURITY.md` for sensitive reports. | `SECURITY.md`; `guide.html#support`; `.well-known/security.txt` | Do not publish a personal mailbox or promise public source access. If private reporting is unavailable, readers must use their existing source-access channel to the repository owner. |

## Comparison claims

All fetched 2026-08-06 from each project's own site. Cells the site leaves blank mean "not described on their site", and the compare section says exactly that. Respectful-tone rule: every row describes what the tool is good at; the "What the others do better" list is part of the page, on purpose.

| Site claim | Source | Notes |
| --- | --- | --- |
| Moshi is a native iOS and Android terminal for AI coding agents; SSH, Mosh, or ET connections direct to your machine. | https://getmoshi.app (2026-08-06) | Their words: "the baby monitor for your AI agents". |
| Moshi has an agents feed (Claude Code, Codex, OpenCode, and more), Apple Watch approvals via Live Activity, and voice input ("Talk, Don't Type"). | https://getmoshi.app (2026-08-06) | |
| Moshi's Mosh and ET connections persist across network switches and app interruptions; free to start, no account. | https://getmoshi.app (2026-08-06) | |
| Herdr is a terminal-native runtime for coding agents, Apache-2.0, on macOS, Linux, and Windows (beta). | https://herdr.dev (2026-08-06) | Site references `src/main.rs` (Rust); the site page does not state the language outright, so the compare table says "terminal-native runtime" and the win-list stays language-neutral. |
| Herdr "reads every pane and marks each agent working, blocked or idle"; detects 19 agent kinds; work survives the lid closing. | https://herdr.dev (2026-08-06) | Herdr's agent-state awareness overlaps Helioterm's needs-input detection; the win-list credits Herdr for detecting more agent kinds today. |
| Moshi integrates Herdr (deep integration with tmux, herdr, and Zellij). | https://getmoshi.app (2026-08-06) | |
| VibeTunnel proxies terminals into the browser; macOS 14+ app plus an npm package for Linux; MIT licensed; remote access "with tailscale or ngrok". | https://vibetunnel.sh (2026-08-06) | Helioterm speaks the VibeTunnel-compatible WS v3 protocol (`README.md:59`); the site states it is not built on VibeTunnel. Agent-awareness and durability cells left blank: not described on their site. |
| Mosh allows roaming, supports intermittent connectivity, survives sleep, and provides local echo; free software (GPLv3+); pairs with tmux for durable sessions. | https://mosh.org (2026-08-06) | tmux durability is the same mechanism Helioterm uses; the table says so plainly. |
| Termius is a cross-platform SSH client (macOS, Windows, Linux, iOS, Android) with encrypted vault sync, SFTP, and workspace restore. | https://termius.com (2026-08-06) | Pricing not shown in the fetched page, so the site makes no Termius pricing claim. |
| Blink Shell is a professional iOS/iPadOS terminal with SSH and Mosh; connections survive sleep; $19.99/yr after a two-week trial. | https://blink.sh (2026-08-06) | |
| "All of them ship today. Helioterm is still behind its release checklist." | The five sources above plus `docs/release-blockers.md:11-59` | The honesty centerpiece of the compare section; keep it. |

## Screenshot claims

| Site claim | Evidence | Guardrail |
| --- | --- | --- |
| Hero: "The dashboard in explicit demo mode, wearing its own MOCK badge. No daemon attached, no real sessions shown." | Capture session 2026-08-06; the app's demo mode renders the `MOCK` badge and "Daemon unavailable; explicit demo mode active" banner in-frame | Never caption demo captures as live sessions. Do not retouch. |
| Mobile: "Mobile terminal in demo mode, quick keys on." | Same capture session; quick-key row (Ctrl, Esc, Tab, arrows) visible in-frame | |
| The agents strip and the file explorer figures are labelled "an illustration ... not a screenshot". | `index.html` (`.agent-strip`, `.files-mock`, `.mock-note`) | No screenshot exists for the file explorer against a live daemon (demo mode shows an empty state), so the site ships a labelled illustration instead of a fake capture. |