Crates
The workspace’s crates live in crates/<name>/. Every crate inherits the workspace lints with
[lints] workspace = true, which sets unsafe_code = "forbid". The exception is the isolated crate
tealhand-ffi (see docs/unsafe.md). Its
initContext JNI hook runs once, guarded by a std::sync::Once (a second call does nothing), is called from
Application.onCreate before the bridge starts, and keeps the application context, never an Activity.
Crates
Section titled “Crates”| Crate | Job | Licence | unsafe |
Status |
|---|---|---|---|---|
tealhand-actions |
The one action list: ids, parameters, risk, card text, palette search, the planner’s JSON Schema, the origin and presence rules | Apache-2.0 | forbid | Built |
tealhand-proto |
Envelope, framing (read_frame, write_frame, 64 KiB cap), ALPNs, capability version, message bodies, error and close codes |
Apache-2.0 | forbid | Built |
tealhand-identity |
EndpointKey and HwKey, the signed roster and RosterStore, SignedCommand and Verifier, the QR, check code and the connection state machines. No networking, no signing |
Apache-2.0 | forbid | Built |
tealhand-mesh |
The iroh endpoint per relay choice, the roster gate, the connection door, per-source rate limits, connect with key pinning |
Apache-2.0 | forbid | Built |
tealhand-sysinfo |
CPU, GPU (NVML), memory, battery, uptime and the task list, through sysinfo and nvml-wrapper. Read only |
Apache-2.0 | forbid | Built |
tealhand-host |
Tealhand Host, library and tealhand-host binary (run, connect, unpair, remote off, share, downloads, ssh, commands, mcp, and a sample systemd unit in packaging/): ctl/1, files/1, connecting a phone, rules engine, notice, journal, power calls, commands from the owner’s other computers, the computer’s own client (open_peers), and the read-only MCP endpoint for AI apps (mcp/) |
Apache-2.0 | forbid | Built |
tealhand-files |
Shared folders, the path jail, the files/1 server, the downloader with its address rule, and the phone’s file client |
Apache-2.0 | forbid | Built |
tealhand-ssh |
ssh/1, SSH access: the terminal over iroh (SSH on one checked stream, a PTY on the Host), saved commands run detached with their output kept, and the phone’s client |
Apache-2.0 | forbid | Built |
tealhand-core |
The phone’s client logic: connecting, cards, sign requests, links, roster duties, files, uploads, downloads, the playback proxy, planner client. In computer mode, a computer’s own client for the owner’s other computers | Apache-2.0 | forbid | Built |
tealhand-ffi |
flutter_rust_bridge glue over tealhand-core, and iroh’s Android JNI hook |
Apache-2.0 | isolated: deny, two #[allow(unsafe_code)] items in android.rs (the no_mangle JNI export and one block that calls iroh’s hook), each with a // SAFETY: comment, and one file-level allow on the generated file |
Built (the bridge) |
tealhand-relay |
Tealhand Relay: iroh-relay with roster access control, the roster upload and fingerprint |
AGPL-3.0-only | forbid | Built |
tealhand-e2e |
Tests only: the real phone core against the real Host | Apache-2.0 | forbid | Built |
tealhand-planner |
Tealhand Planner: POST /v1/plan over a local Ollama, constrained output, no storage |
Apache-2.0 | forbid | Built |
tealhand-power |
The helper that only sleeps, shuts down and checks for other signed-in users | Apache-2.0 | forbid | Next milestone |
| App | Job | Status |
|---|---|---|
apps/mobile |
Tealhand, the phone app (Flutter, Android first) | Built: Home (Chat like a messenger with chat commands, or Classic; the computer picker in the top row), the Inbox with notices, Devices, cards, connecting, Power and rules, Files (with Downloads), the share sheet, the terminal with saved commands (SSH access), Settings |
apps/desktop |
Tealhand on a computer (Tauri 2, Windows and Linux), embedding tealhand-host |
Built from source: status, devices, the owner’s other computers (Status, Power, Files, Terminal), activity, the Ctrl+K palette, Settings (shared folders, SSH access, saved commands, AI apps), the 60-second notice. No installer yet |
Planned crates
Section titled “Planned crates”Outside the workspace
Section titled “Outside the workspace”fuzz/: its own Cargo workspace (the root excludes it) with fuzz targets for every parser of bytes from another device. It needs the nightly compiler and Linux. See Build from source.scripts/geiger-check.sh: theunsafegate CI runs.
Licences
Section titled “Licences”The apps, the core and Tealhand Host are Apache-2.0. Tealhand Relay is AGPL-3.0-only. Dependencies must have
permissive licences, checked by cargo deny; the only copyleft exceptions are listed per crate in deny.toml
(the relay’s own AGPL, and a few unmodified MPL-2.0 dependencies).