safe-remote-supportlisted

# Safe Remote Support ## Current MCP Boundary MCP exposes only `rdev.sessions.*`: `create`, `connect`, `status`, `events`, `task`, `interrupt`, `artifacts`, and `close`. Legacy dotted MCP names for support sessions, invites, audits, policy, acceptance, adapters, or enrollment are retired. Use the documented `rdev ...` CLI command for those workflows; never ask an MCP client to call a retired name. Use this skill whenever a user says "connect to my machine", "remote debug", "help with this computer", or similar. --- ## CRITICAL CONNECTIVITY RULES (read before every session) ### Rule 1 — Public tunnel FIRST, LAN never assumed **The target machine may be on a completely different network. NEVER use a LAN/private-IP address as the primary endpoint.** Before creating any session: 1. Check `gateway_candidate_summary.needs_public_tunnel` from `CLI-only: rdev support-session prepare` output. 2. If `needs_public_tunnel=true` OR if no stable configured gateway exists: - Run `rdev support-session connect --start`. - Let `rdev` manage the public tunnel internally. It prefers configured stable gateways (`RDEV_HOSTED_GATEWAY_URL`, `RDEV_CLOUDFLARED_NAMED_TUNNEL_URL`, relay/mesh/VPN/SSH URLs), then evaluates Cloudflare Quick Tunnel (priority 10), managed pinned tunn3l v0.5.1 (priority 20), and localhost.run with the reviewed official host key (priority 30). Pinggy (priority 40) or another SSH provider is used only after an explicit operator allowlist and reviewed exact pin.