Live Deck agent — Does / Does not

Does	Does not
CPU, RAM, disk, net byte counters	Ask for or store root / SSH passwords
HTTPS POST to api.hostcloak.com	Open a listen port or remote shell
Per-host token (shown once, hashed server-side)	Process lists, env dumps, arbitrary file reads
Opt-in Interior Assist (--interior): listen ports, sshd/firewall hints, Live Deck B failed-unit count, reboot flag	Packet capture, per-IP flows, journal dumps, or failed-unit name lists
Revoke in one click — token + interior die	Exec / shell / inbound listen (always false)
Readable stdlib Python — live /proc on your box	Canned demo metrics or opaque binary-only path

Trust pack · verify then run

Agent 0.5.0 — version-pinned URL + checksum. Prefer pin for installs; /downloads/hostcloak_agent.py always tracks latest.

1 · Download + verify (do this before any run)

# version-pinned 0.5.0
curl -fsSL -o hostcloak_agent.py https://www.hostcloak.com/downloads/0.5.0/hostcloak_agent.py
curl -fsSL -o hostcloak_agent.py.sha256 https://www.hostcloak.com/downloads/0.5.0/hostcloak_agent.py.sha256
sha256sum -c hostcloak_agent.py.sha256
# macOS: shasum -a 256 -c hostcloak_agent.py.sha256

2 · Already enrolled? One-time (env still set)

pkill -f 'python3 hostcloak_agent.py' 2>/dev/null || true
# after verify step above:
python3 hostcloak_agent.py --once --interior

3 · Keep running

python3 hostcloak_agent.py --interval 30 --interior

Latest (unpinned) mirror: /downloads/hostcloak_agent.py · checksum .sha256. New enroll in /app shows the same verify-first paste. Lost the token? Re-enroll — blocks include --interior by default.