Connect deliberately.

The experimental client enrolls a device, exports WireGuard configurations, and runs a managed Linux mesh interface with approved-peer refresh. NAT traversal, relay fallback, and integrated browser file transfer are not implemented. Real cross-network acceptance has not passed.

1. Verify and install

Compare the downloaded file against SHA256SUMS. On Linux run sha256sum jump2pipe-linux-amd64, then chmod +x jump2pipe-linux-amd64. On Windows use PowerShell Get-FileHash .\jump2pipe-windows-amd64.exe -Algorithm SHA256. Builds are unsigned development binaries; Windows runtime testing is pending.

2. Enroll without handing over control

Create an account, open Devices, and create an enrollment token. On Linux run ./jump2pipe-linux-amd64 enroll -name my-laptop. On Windows run .\jump2pipe-windows-amd64.exe enroll -name my-pc. Paste the token, then end input with Ctrl+D on Linux or Ctrl+Z then Enter on Windows. The token is read from stdin rather than a command-line argument. Your terminal may echo input; use a private terminal.

No software is installed automatically and no network settings are changed by enrollment. Protect the saved device.json credential file. On Windows ensure your user profile is private; POSIX file modes do not enforce Windows ACLs.

3. Approve and export

Approve the named device in the dashboard, then run jump2pipe config -out jump2pipe.conf using the downloaded filename or a renamed binary. The config contains your private key. Never send it to us or paste it into chat.

4. Managed Linux mesh (opt-in)

Install wireguard-tools and iproute2. After enrollment and approval, run sudo ./jump2pipe-linux-amd64 mesh -state /absolute/path/to/device.json. This creates a dedicated j2p0 interface and routes only approved peers’ /32 mesh addresses. It refuses to replace an existing interface or peer route. Approved peers refresh every 15 seconds. Revocation or control-plane failure stops the runner and removes its interface after the next refresh/request timeout (normally within 35 seconds). Ctrl+C removes it too. A forced kill or host crash can bypass cleanup; inspect and remove the dedicated interface with sudo ip link delete j2p0 if necessary.

This currently authorizes all IP traffic between approved same-account peers, not individual services. At least one peer needs a reachable static UDP endpoint. Only open a chosen WireGuard UDP port when preparing a coordinated real-device test. No firewall or system service is installed automatically. Last authenticated contact in the dashboard means the agent reached the API; it does not verify a WireGuard handshake.

5. Controlled Windows/static test

Install the official WireGuard client separately if you choose to proceed. Import the config only after we coordinate the test endpoint and review allowed peer addresses. The current export routes only approved peer /32 addresses, not your LAN or default internet route. A reachable static UDP endpoint is currently necessary for at least one peer. Keep the client disconnected until a test is scheduled.

6. Stop and revoke

Disconnect in WireGuard to stop traffic. Revoke the identity in the Jump2Pipe dashboard to stop control-plane access. Exported configurations on other devices must also have the peer removed manually; the managed Linux runner refreshes authorization; static exports still require manual removal.

Experimental file-agent server

For an already connected and approved WireGuard peer, run jump2pipe files-serve -root /path/to/explicit-share -allow-device PEER_DEVICE_ID. This starts a server only on your mesh address, port 8090, and checks the allowed peer against the control plane on every request. Stop with Ctrl+C. The browser file manager is pending. Protocol clients must send X-Jump2Pipe-Protocol: 1; requests with a browser Origin are rejected. Transfers are limited to 64 MiB per file and a 1 GiB process-local budget. This is a developer preview, not a production file sharing release.

Current validation

Linux CLI execution and cross-compilation can be tested on the VPS. A Windows build alone does not prove Windows runtime support. Two real devices on separate internet connections must pass explicit tests before mesh connectivity is accepted.