Casual RAS (Casual Remote Access System) is a white-label, embeddable remote-access platform. Software vendors embed it to add secure screen viewing, a remote pointer, remote keyboard/mouse control, multi-user collaboration, and approved support actions natively — without sending users to a separate branded remote-desktop product. A shared Rust core, peer-to-peer over iroh/QUIC (encrypted, NAT-traversing, relay fallback).
Apache-2.0. Alpha — the security core and feature set are implemented at the code level and CI-green; on-device verification, signed installers, and the SDK extraction are still in progress. Builds currently ship unsigned in the OS sense (Gatekeeper / SmartScreen will warn on first launch).
Vendors add secure screen viewing, remote control, collaboration, and approved support actions inside their own application, under their own brand — not a separate remote-desktop product users get bounced to. Casual RAS is the platform, not a standalone app.
A shared Rust core drives a unified desktop app that plays both roles — Share (the controlled machine) and Connect (the technician/support side). SDKs extracted from that proven core are a later deliverable, so the surface is validated by a real consumer first.
Sessions ride an encrypted, NAT-traversing QUIC link with relay fallback — direct where the network allows, relayed where it must. Transport encryption authenticates the peer’s identity; it does not grant authority — that is the host’s job.
A single decision rule runs through the whole system: Security → Latency → UX. When two conflict, the higher one wins — consent, grant validation, and capability checks are never skipped to shave milliseconds or smooth onboarding.
The security model is the point, and it is honest about its scope: it makes access consent-gated and host-controlled. It does not claim to stop a determined attacker or a coached user from acting on their own machine.
A controller requests; it never self-authorizes. The local user is the final owner of the machine — a connecting peer is held in the handshake, seeing no pixels, until the user clicks Allow. Deny, or silence, refuses fail-closed.
After consent the host issues a short-lived, signed PASETO v4.public session grant bound to host, controller, and endpoint identities. Expired or endpoint-mismatched grants are rejected — the transport is a pipe, authorization is the host’s.
Every privileged action is a named, fine-grained capability, enforced host-side on every message — never trusting the controller’s claimed scope. Unknown capabilities are denied, never defaulted-on.
Active remote control is always visible and recording is always disclosed — white-labeling may not hide these. An emergency Stop overrides everything (grant, lease, in-flight input) and takes effect within the target time locally.
Security-sensitive events are recorded to a per-session, append-only SHA-256 hash chain signed by the host identity — tamper- evident and authentic. The journal is content-free by construction: no pixels, keystrokes, clipboard bytes, or paths.
Private keys, grant contents, clipboard data, typed text, file contents, and screen pixels are structurally kept out of logs and crash dumps — revealed only at the OS boundary where they’re actually used.
The Connect (controller) role decodes and views a shared screen on macOS, Linux, and Windows — it only decodes, so it runs everywhere. Includes viewer-side annotation and a remote pointer.
The Share (host) role captures and encodes. macOS uses hardware- accelerated ScreenCaptureKit + VideoToolbox; the Linux and Windows capture paths are implemented on a software encoder. Windows share is CI-compile-gated — see status below.
OS-level input injection is implemented on all three platforms (macOS CGEvent, Linux XTEST, Windows SendInput), each behind a control lease and per-message capability gate. One active OS-input controller at a time by default.
Clipboard sync (set-never-paste), a signed-catalogue file transfer that structurally rejects path traversal, and in-session chat — each with the payload kept out of logs. File browsing anywhere is deliberately not supported; transfers land in a host-chosen sandbox.
Output audio (Opus over QUIC datagrams, live-only, never recorded, always disclosed) and a dedicated cursor-shape channel keep the session feeling native without inflating the video path.
Multi-monitor enumeration with a HiDPI-aware render model, plus hardened session reconnection: a WiFi/NAT blip re-dials the same authenticated peer and re-validates the grant through the unchanged validator, rather than dropping the session.
We’d rather be accurate than impressive. Here is exactly where things stand — no over-claiming.
The security core and the feature set above are built and CI-green, with unit, property, fuzz, and loopback tests. The design is platform-abstracted and the invariants are enforced structurally, not just by policy.
On-device verification on Linux and Windows, OS code-signed and notarized installers, and the SDK extraction — the actual embeddable product — are in progress. Windows share/control is CI-compile-gated only (no test hardware yet), so it is not verified on a real Windows machine.
This is not a finished product and does not claim to be. The security design is consent-gated and security-first at alpha maturity — it makes access explicit and auditable. It is not a guarantee against attack, and it does not detect or prevent misuse by an authorized session.