<!-- https://zerolog.ch/docs/desktop · Docs / Compute -->
For graphical work

# Desktop control

An agent that works on your own computer over Tailscale and SSH. What happens there stops one move short of doing the work for you.

## Where it stops

The server prepares the command the agent wants to run and records it, and the exact command is returned to you. It does not execute it for you yet. That applies to your own computer only. Opening SSH or a drive to your own ZeroLog container from Windows runs in one click, see [Drive and SSH in one click](https://zerolog.ch/docs/connect).

**Desktop session** Ends at 02

1. 01

   ### Composed

   The agent works out the command it wants to run.
2. 02

   ### Shown

   The server returns that exact command and records the attempt.
3. 03

   ### Run

   Not done for you. Not yet.

The third compartment is drawn and left empty. That gap is the whole difference between a guided path and a hands-off one.

## What it needs

- **Account access**: The Tailscale permission on your account.
- **Your computer**: Tailscale and an SSH server, registered by its tailnet name, not an IP address.
- **Per session**: Control is granted for one tailnet session and ends with it. The host must also be approved as a tailnet target, and a /goal job cannot approve its own.
- **Actions**: Run a PowerShell command (Windows), run a shell command, fetch a file, take a screenshot. Every attempt is recorded before it runs.
- **A warning**: Anything the agent reads can try to instruct it. With desktop control on, such an instruction would run on your machine. Keep the target list short and switch it off when you are done.
- **Your account**: Scoped to your account, like everything else here.

This page is about reaching your own computer from an agent. The native ZeroLog app for your desktop is a different thing: see [ZeroLog Desktop](https://zerolog.ch/docs/zerolog-desktop).

So **guided** means what it says: the command gets worked out for you, and running it does not.

## Desktop control, step by step

Mermaid source of the diagram on this page:

```mermaid
%% Desktop control: your own computer over Tailscale and SSH. Facts from server/desktop.js, server/routes/desktop.js, server/tailnet.js.
flowchart TB
  reg["1. Register your computer<br/>by its tailnet name<br/>(Tailscale and SSH on it)"]
  en["2. Enable it for one<br/>tailnet session<br/>the host must also be<br/>approved as a target"]
  act["3. Pick an action<br/>PowerShell or shell command<br/>fetch a file, screenshot"]
  rec["The attempt is recorded<br/>before anything runs"]
  cmd["The server builds the exact<br/>SSH command and returns it"]:::hot
  stop["Nothing runs it for you yet"]
  end_["When the session ends,<br/>control ends with it"]

  reg --> en --> act --> rec --> cmd --> stop
  en --> end_

  classDef hot stroke:#8f7ac9
```