Encrypted signals first. Agent when needed.

Getting started

1. Create a pipe in the iOS app.
2. Open pipe setup and choose Send signals.
3. Copy the DSN into your shell or CI secret store.
4. Send your first encrypted signal with nerve send.

Send signals

Signals are the safe default. A sender DSN can post encrypted messages into one pipe only. It cannot read history or execute commands.

go install github.com/nerve-ink/nerve-cli/cmd/nerve@latest
export NERVE_DSN="nerve://TOKEN:[email protected]"
echo "deploy failed" | nerve send

GitHub Actions

Store the DSN as a repository or environment secret, then notify from a workflow step.

- name: Notify Nerve
  if: always()
  env:
    NERVE_DSN: ${{ secrets.NERVE_DSN }}
  run: |
    go install github.com/nerve-ink/nerve-cli/cmd/nerve@latest
    echo "backend deploy ${{ job.status }}" | nerve send --severity standard

Run agent

The agent connects infrastructure you control for signed, bounded actions. Treat the token like host access. Prefer a dedicated user, least privilege, and runbook-style commands.

go install github.com/nerve-ink/nerve-agent@latest
nerve-agent -server api.nerve.ink:443 -token TOKEN

Security model

• The relay routes encrypted envelopes and should not receive plaintext payloads.
• Sender DSNs can send into one pipe only and cannot read or execute.
• Agent tokens connect a controlled machine; command execution still requires signed command payloads from the iOS identity.
• Nerve is not SSH, a PTY, or a native iOS terminal.

Troubleshooting