Scope must be visible
Browser and native screen sessions in this release are one-way video viewing only. Native keyboard/mouse control, clipboard access, shell/SSH, unattended access, directories, NAS and system audio remain unavailable. A call or selected-file transfer does not expand screen-session permissions. Business branding changes presentation, not access rights or who may consent.
Browser sharing
The sharing browser invites one exact enrolled handle, reviews the joined browser and fingerprint, and explicitly chooses a screen/window through the browser's own dialog. No screen capture should start before that choice. Invitations expire after at most five minutes and screen sessions after at most ten. Keep the viewing/sharing browser tab visible; hiding it ends its session. The Stop button remains available across navigation.
Native sharing
Run the agent as your normal desktop user, not as root or a hidden service. Pair its public signing-key fingerprint through an existing signed-in browser. The agent keeps its private key encrypted locally with a separate user-chosen passphrase. Each session creates a new in-memory Can Opener seed. Share the private viewing link and current six-digit code with the named viewer only. The clear code is encrypted to the agent; correct verification is followed by a separate local yes/no prompt showing the viewer fingerprint. Capture starts only after local approval.
The agent must install a working global Escape handler before offering a native session. Physical Escape, local Stop, closing the host window, viewer Stop, expiry, revoked keys, failed peer state or loss of confirmed authorization ends local capture. Public routing and operating-system restrictions can prevent a connection. Windows desktop and Linux X11 are the initial targets; macOS needs local Screen Recording/Input Monitoring permissions, and Wayland/headless hosting is not supported in this beta.
Your responsibility
Review which monitor/window is visible. Close sensitive windows and notifications first. Do not share the passphrase or private signing key; neither is needed by your viewer. A viewer may record the screen despite the one-way design. Use PEZ4 only with authorization and respect immediate withdrawal. The app cannot promise that every operating system delivers a physical hotkey under all circumstances; perform the physical Escape acceptance test on your machine before trusting a session.