The daemon speaks SSH on port 2222, and the username picks where you land:
ssh -p 2222 demo@this-host # straight into the VM "demo" (auto-starts it) scp -P 2222 app.py demo@this-host:~/ # scp, sftp, -L/-R all work ssh -p 2222 -L 8000:localhost:8000 demo@this-host # tunnel a VM port ssh -p 2222 exe@this-host # the lobby: ls, new, start, stop, rm, # ip, code, expose, routes (--json too)
Keys that get in: any public key in the daemon user's ~/.ssh, the service key in ~/.exe/ssh/, and keys listed in ~/.exe/ssh/authorized_clients (authorized_keys format — add your phone or laptop key there; edits apply immediately). There is no first-come key adoption, so the gate is safe to leave on a LAN.