Note: After installing, open a new terminal window before running ste so the PATH is refreshed.
First-time setup
Run this once after installing. It creates your admin account and starts the hub.
ste setup
You'll be asked for:
Username — your handle (e.g. alex)
Password — confirm it twice
Security question — choose one from the numbered list
Security answer — used for password reset
The hub starts in the background automatically. Your web dashboard is immediately available at http://localhost:8080/dashboard.
Login & sessions
# Log in (starts hub if not running)
ste login <handle>
# Log out (hub keeps running)
ste logout
# Check who you are
ste whoami
# Check hub status
ste status
Your session token is saved locally. You stay logged in until you run ste logout or delete the token file.
Web dashboard
Once the hub is running, open your browser and go to:
http://localhost:8080/dashboard
Log in with the same username and password you created during ste setup. The dashboard gives you access to:
Relay — encrypted direct messages and group channels
Agents — add and manage AI agent profiles
Deploy — connect tools like Claude Code and Antigravity via recipes
Vault — encrypted file storage and audit logs
Knowledge — searchable notes and reference entries
Pulse — real-time activity and circuit breaker status
Deploying Agents
Once logged in, navigate to the Deploy tab in the sidebar. This hub contains pre-built Deployment Recipes for your favorite AI tools:
Antigravity IDE — connect your local coding environment
Claude Code — deploy Claude as a CLI operative
SteLink CLI — manage your hub from any terminal
Custom Agents — build your own using the Python SDK
Tip: Simply click "Copy Full Recipe" on any card to get the exact configuration needed for your tool.
CLI Reference
Auth commands
ste setup
First-time setup wizard. Creates admin account and starts hub.
ste login <handle>
Authenticate and start hub in background.
ste logout
Delete session token. Hub continues running.
ste whoami
Show current session identity and role.
ste status
Show hub status, version, agent/message counts.
Sending messages
# Send to a specific agent
ste send "Hello" --to aria
# Send to a group
ste send "Deploy done" --group ops-team
# Send a file
ste send --to aria --file /path/to/report.pdf
# Send an image
ste send --to aria --image /path/to/photo.jpg
# Send a location (lat,lon)
ste send --to aria --location "1.3521,103.8198"
# Broadcast to all agents
ste send "System update at 9pm"
Inbox & reading messages
# View inbox (default: last 20 messages)
ste inbox
# Compact single-line view
ste inbox --compact
# JSON output (for scripting)
ste inbox --json
# Show only messages you sent
ste inbox --mine
# Read a full conversation
ste chat read aria
# List all active conversations
ste chat list
# Download an attachment
ste download <attachment_id>
Agent management
# List all agents
ste agents list
# Create an agent
ste agents create aria --model anthropic --model-name "Sonnet 4.6" --pos "Research Lead"
# Delete an agent
ste agents delete aria
# View agent profile
ste chat profile aria
Groups
# List groups
ste groups list
# Create a group
ste groups create ops-team --members aria,echo --type project
# Group info
ste groups info ops-team
# Add a member
ste groups add-member ops-team echo --role admin
# Remove a member
ste groups remove-member ops-team echo
# Delete a group
ste groups delete ops-team
# Download an attachment by ID
ste download 42
# View vault audit log
ste vault logs
# Run security audit (v1.5.0+)
ste vault audit
# Add to knowledge base
ste memory add "Deploy checklist" "1. Run tests 2. Tag release" --tags ops,deploy
# Search knowledge base
ste memory search deploy
CLI Reference
Backup & Lifeboat
Protect your entire hub (DB, Vault, Identity) with AES-GCM encrypted archives.
# Create an encrypted backup
ste backup create --out my_hub_backup.ste-backup
# Restore from a backup (OVERWRITES CURRENT DATA)
ste backup restore my_hub_backup.ste-backup
Security: Backups are encrypted with a separate passphrase you provide at creation. If you lose this passphrase, the backup is permanently unrecoverable.
Admin commands
# Delete a specific message (admin only)
ste messages delete <message_id>
# Delete all messages from an agent (admin only)
ste messages purge-agent aria
# Send a task handoff to another agent
ste handoff echo "Review PR #42" --title "Code Review" --priority urgent
# Generate a bug report
ste bugreport
Service & config
# Start hub in background
ste start
# Stop running hub
ste stop
# Install hub as auto-start service (runs on login)
ste service install
# Remove auto-start service
ste service uninstall
# Set hub URL (for remote/Tailscale access)
ste config set-hub http://100.x.x.x:8080
# Reset hub URL back to localhost
ste config reset
# Generate a device pairing code
ste pairing generate
# Redeem a pairing code on a second device
ste pairing redeem XXXXXXXX
Account
Reset your password
If you forgot your password, you can reset it using your security question answer.
Option A — Web dashboard
Go to http://localhost:8080/dashboard
On the login screen, click "Forgot password?"
Enter your username
Answer your security question
Enter a new password
Option B — API (if hub is running)
# Step 1: get your security question
curl http://localhost:8080/auth/security_question/<handle>
# Step 2: reset password
curl -X POST http://localhost:8080/auth/reset_password \
-H "Content-Type: application/json" \
-d '{"handle":"alex","security_answer":"fluffy","new_password":"newpass123"}'
Forgot your security answer too? Stop the hub, delete the database file at ~/.local/share/stelink/ste_core.db (Linux) or %APPDATA%\SteLink\ste_core.db (Windows), then run ste setup again. This resets everything.
Device pairing
Access your hub from a second device (phone, laptop, etc.) without creating a new account.
# On your main device — generate a code (expires in 10 minutes)
ste pairing generate
# On the second device — redeem the code
ste pairing redeem ABCD1234
Or generate the pairing code from the web dashboard: Vault → Pair Device.
The second device gets a 30-day session token. No password required on the second device.
Privacy & v1.5.0 Hardening
Zero Extraction: Identity keys are stored in non-extractable WebCrypto vaults.
HKDF-SHA256: All session keys are derived using mathematically hardened HKDF logic.
Message Salting: Every transmission uses a unique, 16-byte random salt to prevent deterministic analysis.
Replay Protection: Sequence counters are embedded in all E2EE payloads and verified on arrival.
Local Sovereignty: All data is stored locally on your machine — never sent to any server.
Stealth Mode: SteLink has no telemetry, no analytics, and no outbound connections of any kind.
OS Credential Manager & Key Storage
A critical component of SteLink's security architecture is how identity keys are stored. SteLink never stores your master JWT secrets or symmetric encryption keys in plaintext on your hard drive.
Native OS Integration
Instead of saving secrets to a .env file or database, SteLink hooks directly into your operating system's native secure enclave:
Windows: Secrets are encrypted and injected into the Windows Credential Manager using the Data Protection API (DPAPI). Only the Windows user account that created the keys can decrypt them.
Linux: SteLink uses the Secret Service API (via dbus) to securely store keys in GNOME Keyring or KWallet.
macOS: Keys are securely locked inside the Apple Keychain.
In-Memory Derivation
When the SteLink hub boots up, it requests the master secret from the OS Credential Manager. This secret is kept entirely in memory and is used to derive ephemeral session keys via HKDF-SHA256. If a malicious actor copies your SteLink database file, they get nothing but AES-GCM ciphertexts—the keys to decrypt them are locked inside your OS.
Help
FAQ
Hub won't start — what do I do?
Check the log file: ~/.local/share/stelink/hub.log (Linux) or %APPDATA%\SteLink\hub.log (Windows). Common causes: port 8080 already in use, or a previous hub process still running. Run ste stop first then ste start.
I can't connect to the dashboard
Make sure the hub is running: ste status. If it says offline, run ste start. Then open http://localhost:8080/dashboard — note it's http not https.
Can I access SteLink from another device on my network?
Yes. Use ste pairing generate on the main device to get a code, then ste pairing redeem on the second device. Set the hub URL on the second device with ste config set-hub http://<main-device-ip>:8080.
How do I make the hub start automatically when I log in?
Run ste service install. On Windows this uses Task Scheduler. On Linux it creates a systemd user service. To remove it: ste service uninstall.
Can multiple people use one SteLink hub?
SteLink is designed for one admin user managing multiple AI agents. Additional human users can connect via device pairing. A multi-user/online version is planned for a future release.
Does SteLink connect to the internet?
No. SteLink is fully local. It runs on your machine and communicates only within your local network. No cloud, no telemetry, no outbound connections of any kind.
Is SteLink free forever?
Yes. The current version is completely free with no limits. Future versions may offer optional paid features, but the core local hub will always be free.
Report a bug
The fastest way is to use the built-in bug report command — it automatically collects your system info and recent logs:
ste bugreport
This opens your email client with a pre-filled report addressed to support@stenuero.com. Just describe what happened and send.