mintOps embeds tailcat, Tailscale’s “Tailscale without Tailscale.” tailcat uses only Tailscale’s data plane (WireGuard tunnels, DERP relays, NAT hole punching) and none of its control plane (accounts, coordination server). Run tailcat serve 22 on a server once, and mintOps can SSH into it without a public IP or port forwarding.

• No account, no coordination serverThere is no Tailscale account, no coordination server, and no separate VPN app. You connect with the tc… address the server prints, or a name published as a DNS TXT record.
• Starts relayed, upgrades to directThe connection is bootstrapped through a DERP relay and automatically upgrades to a direct path once NAT traversal succeeds. The session tab shows the path and latency, e.g. relay · 79 ms → direct · 0.3 ms.
• Client identity keysGenerate an identity key in Settings or import one from the tailcat CLI. Put its public key in the server’s --allow list to admit only your devices. Without a key, each connection uses a one-time identity.
• Quick connectType tailcat ssh [email protected] in the sidebar prompt to connect immediately. If no saved connection matches, the connection sheet opens pre-filled. Authenticate with a password, an SSH key, or None (for no-auth-ssh servers).
• macOS: command-line toolThe Mac build bundles the tailcat CLI. Link it once from Settings and use tailcat ssh, tailcat ping, and tailcat serve in Terminal. Keys created in the app can be exported for the CLI.
• Connection logSettings → Tailcat → Connection Log shows DNS resolution, relay handshakes, and the switch to a direct path.

tailcat genkey --key=default --fixed-region   # a server key whose address survives restarts
tailcat serve 22                              # expose the local sshd through the tunnel

Everything else, including the file browser and web browser, works the same over a Tailcat tunnel.

herdr is “a runtime where coding agents live”: a terminal multiplexer (background server + CLI) that runs agents such as Claude Code inside tabs and split panes within a workspace. Right after connecting, mintOps checks whether herdr is installed on the server and, if so, enters a dedicated herdr mode instead of a plain shell. Rather than scrolling a tmux screen on a small phone, workspaces, tabs, panes, and agents all become native UI.

• Auto-detect, auto-startAfter login, mintOps looks for herdr (including Homebrew, cargo, and local bin paths). If the server process is not running, it starts herdr server for you. Nothing to configure.
• Workspace sidebarWorkspaces on the server appear as a native list with the focused one selected. Below it, a pinned agent list shows each agent’s state (idle / working / blocked); tap one to jump to its pane.
• Tabs and split panes, faithfullyA workspace’s tabs show up in a native tab bar where you can create, close, and switch them. herdr’s BSP split layout arrives as cell-based rectangles and is mapped proportionally to the screen, so the pane structure you built on the server is reproduced exactly.
• Every pane is a real terminalEach pane attaches to a herdr terminal session over its own SSH channel. Frames from the server are rendered by SwiftTerm, and keystrokes and resizes are sent back. Inside a pane it is simply a full terminal.
• Prompt input barSend prompts to an agent from an input bar at the bottom of the screen instead of the terminal keyboard. Much easier for long instructions on a phone.
• Zoom on iPad and Mac, pager on iPhoneiPad and Mac switch between the full layout and a single zoomed pane. iPhone always shows one pane large and lets you swipe between panes.

SSH connect ──▶ command -v herdr ──▶ (found) enter herdr mode
  ├─ workspace / tab / pane / agent lists  ← herdr CLI (JSON over SSH exec)
  ├─ pane layout  ← herdr pane layout → mapped proportionally into SwiftUI
  └─ pane terminal ← herdr terminal session control <pane> (frames ↔ input/resize)

When you give an agent a task, the result is a set of file changes on the server. You should not have to type git status, git diff, and cat in a narrow terminal and scroll through colorless text to see them. Tap the folder button on the right of the tab strip in herdr mode and the workspace turns into a file browser. It is read-only, installs nothing on the server, and never runs a command that modifies your files.

• Per workspace, git-awareThe root is the git repository that contains the focused pane’s working directory. If it is not a git repository, that directory itself is shown.
• Changed-file listIn a git repository you see the difference between the working tree and HEAD (staged + unstaged + untracked) with M / A / D / R / ? badges. Each row has “Diff” and “View” buttons.
• Colored diffsDiffs are rendered with diff2html and syntax-highlighted. iPad and Mac switch between side-by-side and unified; iPhone uses unified.
• The right viewer for each fileMarkdown is rendered; HTML is opened in a web view together with the images, CSS, and JS it references; source code gets syntax highlighting and line numbers; images get a pinch-to-zoom preview; PDFs open in a PDF viewer. Markdown and HTML can be switched to a raw view.
• Directory tree and filename searchOutside a git repository you get a collapsible tree, and typing part of a filename finds matches recursively across subdirectories. Hidden files are included.
• Safe size limitsA size limit (100 MB by default, adjustable in Settings) applies to each file, image, and HTML resource so a huge file never freezes the app. The download cache is cleared when the session ends.

Terminal streams stay alive while you browse files. Switching back to the terminal is instant.

When an agent builds a web app, the result is a dev server running on the remote host (pnpm dev, next dev, python -m http.server…). Normally you would hunt for the port in terminal output, set up ssh -L forwarding in another terminal, and open a browser. On a phone that is practically impossible. In mintOps it is a single tap on the globe button in the tab strip.

• Automatic server discoverymintOps finds processes started under the workspace directory that are listening on TCP ports. It uses only /proc on Linux and lsof on macOS, so nothing is installed on the server.
• HTTP onlyEach discovered port gets a real HTTP request, and only the ones that answer become tabs. Databases, Redis, and other non-HTTP ports are left out.
• One tab per portSeveral servers mean several tabs you can switch between. Each tab shows the process name and port.
• SSH port forwarding, handled for youA 127.0.0.1 port on your device is connected to the remote port over an SSH direct-tcpip channel. The same port number is tried first, so hard-coded references like localhost:5173 (HMR websockets, for example) keep working. Listeners bind to loopback only and are never exposed on the LAN.
• A live tab listWhile the screen is visible the workspace is rescanned every 5 seconds. New servers get tabs, dead ones are removed, and a short grace period keeps tabs from flickering when a dev server restarts.
• Back · forward · reloadFollow in-page links inside the WKWebView. Cookies and login state persist across tabs and reloads within a session and are discarded when it ends. On the Mac you can attach Safari Web Inspector.

Globe button ──▶ list listening ports + process cwd on the server (/proc or lsof)
             ──▶ probe each port for HTTP from the device over direct-tcpip (3 s)
             ──▶ local listener on 127.0.0.1:<port> ↔ SSH channel ↔ remote port
             ──▶ open a WKWebView tab · rescan every 5 s