Nodes
A node is a machine you add to a workspace. A scene pinned to it runs its computer there: your laptop, a Raspberry Pi in the lab, a server in your own rack, a Windows PC in the office. By default scenes run on machines we operate; a node is how a workspace brings its own.
One command adds a machine
On the machine, run the installer: curl -fsSL https://daslab.run/node | sh on Linux and macOS, irm https://daslab.run/node.ps1 | iex in PowerShell on Windows. It prints a pairing code. Open daslab.run/pair on your phone, type the code, pick the workspace and what the machine may do. The node connects outward to Daslab; nothing opens on your side, no port, no DNS record, no firewall rule. Within seconds it appears in the workspace as a tile. daslab node leave takes it out again.
One machine can sit in several workspaces: pair it again and pick another. It gets a tile in each, with its own choices in each.
Three things describe a node
Every node's tile says three things, and the agent reads the same tile.
| On the tile | What it says | Who decides |
|---|---|---|
| Offers | what the machine has | the machine, by looking at itself |
| May | what it may be asked to do | you, when you pair it |
| Publishes | what on its network and disk the workspace may reach | you, on the machine |
A tool appears in a scene when the machine offers it and may use it. What the machine publishes is the whole of what the workspace reaches through it.
The tile says what the machine offers
The processor architecture, how much it can run at once, whether it reaches a local network and which one, the address its traffic leaves from, the devices plugged into it, a GPU if it has one, whether it can take live video, a screen it drives, a browser it can run, and on Windows the desktop of whoever is signed in. A scene running on a node knows it can reach nas.local because the node says so, and knows when it cannot.
What it may do is chosen when you pair it
The pair page asks what the machine may be asked to do: run commands and move files, take in camera streams, show pages on its screen, read plant equipment, see its screen, work its screen. The machine keeps the answer and refuses anything outside it itself, so nothing on our side can widen it later. A box next to a payroll database can be set up with no shell at all. Pairing again changes the answer.
Seeing and working the screen are never on unless you tick them, and a machine paired before these choices existed has neither.
It reaches what you publish from it
Nothing on the machine's network or disk is reachable from the workspace until you publish it, by name, on the machine:
daslab node publish hrmi 192.168.1.20:1433
daslab node publish quotes /mnt/nas/quotesThe workspace sees what is published. Only the machine can add to it, and daslab node unpublish takes it away.
A service is a name for an address on the machine's network. A scene reaches it as hrmi.office-vm.daslab: a database driver or a web request connects through the node, which dials that address and nothing else. The bytes pass through unread, the database's own encryption included.
A folder is a name for a directory the machine reads: a local folder, or a share it has mounted. Add it to a scene as a cell, Folder on a machine, and the agent lists and reads its files by address, acme/sales:quotes/2026/January/quote.xlsx, as it reads any cell's files. It is live: each read goes to the machine and gets the file as it is now, and nothing is copied or kept. A PDF reads as its text and a workbook as its sheets. Each read records the fingerprint of the bytes it saw, so the trace says exactly which version of a file the agent read. A folder is read-only, a read carries up to 10 MiB, and a path that leaves the folder, by .. or by a symlink, is refused by the machine.
Pinning a scene to a node is linking it
Drag the node tile into a scene and that scene's computer runs on the machine from the next job on. A scene without a pinned node runs on the workspace's own nodes if it has any, and on our machines otherwise. Where a computer ran is recorded with every run, and minutes on your own node are not metered.
Some things only a node can do
Reach the machines on your local network. Make requests from your own address rather than a datacenter's. Read the files on the share in your office. Talk to hardware plugged into the node: a camera, a serial port, an arm. Run next to a GPU you own. Take a camera's live video in on your own network. Keep a scene's work inside your building.
A browser can run on the machine
A browser cell can run on one of your machines instead of in the cloud. It browses from that machine's network and address, keeps its logins there, and you watch it or take over from the scene. Pick the machine in the browser's settings: the ones you paired that may run commands. It uses the Chromium or Chrome already on the machine, and on most machines fetches one where none is.
A screen it drives can show a page
A Linux machine with a kiosk set up (daslab node display install: Chromium full screen on its display) can show a scene's page on a wall or a counter, reload it, and say what the screen shows with a screenshot. The page stays up across reboots.
Live video can come in on the machine
A machine with ffmpeg on it says so on its tile, and a camera in the scene can then publish into that machine instead of a cloud region. The scene hands you a short address on your own network, rtmp://192.168.1.23:1935/live/…, for the glasses, the phone, OBS or a Pi to publish to, and the machine forwards the stream into the camera's session. Live video, scrubbing back, and asking what the camera saw all work as before. What changes is that the first hop never leaves the building, and that a publisher types a short local address rather than a long one belonging to a region on the other side of the world.
The same capability can publish the machine's own screen into a scene, so the desktop shows up live and can be asked about. On macOS that needs Screen Recording granted to the node, in System Settings under Privacy & Security; until it is, the stream connects but stays black. A publisher has to be on the same network as the machine. A camera out in the world still publishes to a region.
A Windows machine can be worked through its screen
With See its screen ticked, a scene pinned to a Windows machine sees the signed-in desktop live and reads its apps through their controls: the window, its buttons, its fields and what they hold. With Work its screen ticked too, it clicks, types and uses those apps as the person signed in. Each action waits for approval unless the scene allows it, and one that sends, deletes, buys or touches a password manager has to be confirmed explicitly on top. While the agent works, an orange border runs around the screen. The person at the machine wins: touch the mouse or the keyboard and the agent pauses. The owner can watch the screen and take it over from the machine's page.
A node on a plant network can read its machines
A scene pinned to a node can read the industrial equipment that node reaches, and only read it. Over OPC UA it browses a server's address space, reads the value, status and timestamp of named nodes, and records every change to them over a window of up to five minutes; security None or Basic256Sha256 with a username both work, and a server with security on has to trust the node's client certificate once, as it would any client. Over Modbus it reads holding and input registers, coils and discrete inputs, over TCP or on a serial line plugged into the node, and decodes register words as 16- or 32-bit integers or floats in either word order, with a scale. There is no write, no method call and no Modbus write function among these tools: a write to a PLC can move equipment. A password is never typed to the agent; the tool takes the name of a scene secret that holds it.
Who may use a node
A node is a tile, so it sits in a layer like everything else. A node you add lands locked: the whole workspace sees it, and only you can pin scenes to it until you open the lock or name people. Add it to your private layer and only your own runs can use it. A node serves the workspace it was added to and no other.
A node that is away makes its scenes wait
When a machine is off or offline, the scenes pinned to it say so and wait. Their computers are not moved to our machines: a scene that was pinned to a machine on your network stays on it. A folder on it says the machine is away until it is back.
What's next
- Sandbox: what a scene's computer is.
- Layers: locks, and who sees what.
- Your machines: guides for a Raspberry Pi, a Mac mini, a Jetson, an ESP32.
- Run your own: keys, machines and name.
Updated 2026-10-18