Tools on every server
Tunnels. Local, remote and proxy (SOCKS5 + HTTP on one port here, traffic leaving from the server) forwards riding the SSH login Vigia already has, saved per server and started when the shell is up; "on connect" opens them by themselves. A list of what a tunnel could reach on this server (what listens on loopback, judged), templates for the things people tunnel to with their ports and whether they open in a browser, start · stop · open · copy · forget, and in words what a bind host means for coworkers sharing it (only this computer, one interface, the VPN, every network). SHARED ON YOUR NETWORK: with Announce it on that network ticked, a tunnel bound to the office Wi-Fi is announced by mDNS/Bonjour as _lens-tunnel._tcp (and as _http._tcp when the far end speaks HTTP, so Safari's and Chrome's Bonjour lists see it as a plain web service); any other Vigia on the same network lists it with the address ready to copy or open. Never announced wider than its bind.
HTTP Tunnel (Browse through this server). One switch and this computer's browsers leave the internet from the box — its address, its network, its DNS. Underneath: the proxy tunnel plus the computer's system proxy pointed at it while on; off with the shell, the setting restored the moment it goes (and on next launch if Vigia died with it on). One switch per computer: on for server B turns off for A and says so. A second door that never depends on the system: a browser window Vigia opens (Chrome, Edge or Brave, its own profile, --proxy-server at the tunnel). A lookup box asks a name on the box and here and shows both answers.
Run Template. A flow from the Flows chair walked on THIS box. Pick one and it says first what is about to happen: its steps as configured, every one as root through the shell already open, whether it reboots the server or changes SSH and the firewall, and what the box remembers of an earlier run (read from /var/lib/lens/runs/ on the server), with Continue at the step after. The run owns the whole screen; Hide keeps it going, Cancel stops after the step that is on now.
Browse files. The server one pane full width, riding the live shell's login as ordinary commands — nothing installed on the far side. Downloads and uploads through the system's own open/save panels; reads fall back to root on their own ("read as root"), changes as root through the saved password. Right-click a text file → Edit opens a code editor beside the pane (syntax colours guessed from the name, correctable); saving writes the bytes back with the mode and owner the file had, and says when a save had to become root to keep the owner. A permissions dialog in the order a person asks: what can I do here, who else and what (classic bits and the ACL as one list, the acl tools installed from here when missing), who owns it and how far it reaches. Bulk delete in one call; compress a selection into an archive on the box, extract one, or download a folder as an archive.
Buckets. References to files on ANY server, this computer or a repository, gathered with right-click → Add to a bucket into named buckets in a side panel — the same panel the Files chair has — and dropped onto another server's folder: Vigia relays them box to box through this computer over the two sessions already open, nothing on disk. A saved bucket is the recipe (server ids, folders, names), never the files and never a credential.
Backups (plans on the box). The box is the record: every plan is two files on it and a cron line, the runner lives there too, so a backup at 3 am needs nothing from this computer. The screen reads every plan on the box as a card — what · when · keep · where · last run — with findings worst first and the fix beside each, Run now, the last run's log, Pause/Resume, Edit, Forget, and Bring back (what every destination holds for this plan, newest first; picked, pulled, opened with the key on this computer and placed where its kind's Put back looks). What: a folder or a website, made here; a database, made on its engine's Backups tab and shown here too. Mailbox plans are not here yet — a mailbox is backed up from the Mail tool. Where: the repositories under Files › Repositories, set up on this box as rclone remotes (root-only, scoped at the store). Encryption before the push with age: the operator's backup public key on the box, the secret half sealed under your key on this computer, so what a store receives is unreadable without the key. Mail from the box on failure through Setup › Notifications.
Themis AI on one server. The AI sysadmin, inside Vigia, with nothing installed: she reads through curated probes and a leashed read-only shell over the session already open, and proposes, never changes. Tabs: Ask Themis (a conversation), Security report, Health, Forensics (a window from an hour to thirty days), On this box, Settings. The report, the health check and the investigation each run on their own, beside each other and beside the conversation, and keep running when you switch tabs or servers. Each is kept on the box in /var/lib/lens/reports — twenty of each kind, listed on its own tab, the newest compared with by the next — and saved as a PDF from a button; On this box lists them all, and Delete Reports takes them off again, nothing else touched. Proposals come one at a time with Run / Show me / No — the row says in words what Run does and why, Show me prints the exact script — and Vigia never answers as Themis after a Run. A report is confirmed before it is spent because it is the operator's own account at their own provider. Answers render as a document — headings, lists, commands — never as raw text from a model. A sheet beside the page lets a container's logs, a finding or a NOC wire be asked about where it was seen; beside a terminal she reads the screen and lays one command on the prompt — a read by itself, a change only on Type it — and Enter is yours.