Teams

Every PocketCmd Server is a team. The first user to pair becomes its owner, and everyone else joins with an invite. Membership lives on the server you host; there is no PocketCmd account and no central directory.

Open teams from the group icon (Teams) in the home screen’s top bar, or from Teams in the desktop sidebar. The page lists every server this device is paired with. A server whose API version doesn’t match the app is marked Incompatible server, and one that no longer accepts this device is marked Needs re-pair; see Versions and compatibility.

Pairing a server and managing a team require PocketCmd Pro. Without Pro the team screens stay readable, but every change is locked. Unpairing a device and leaving a team are always available.

Roles

Role	Holds
Owner	The first paired user, until ownership is transferred. Every permission, plus the server logs, the audit feed, promoting and demoting, removing admins or their devices, and transferring ownership. There is always exactly one owner.
Admin	Every permission except Add monitoring commands, which an admin holds only when the owner grants it. No other admin permission can be edited.
Member	Exactly the permissions an admin grants.

The team home is arranged by role:

• Owner: a Needs attention list (metric requests, vault device approvals, unfinished vault key rotations, invites about to expire), the roster, invites and Governance.
• Admin: the same list without owner-only items, the full roster and invites. Metric requests appear only when the owner granted the admin Add monitoring commands.
• Member: Your devices, your access, your requests and a read-only roster. A member the owner granted Add monitoring commands also gets Needs attention with pending metric requests, and a Metric requests row into the full list.

The team must always keep at least one admin. An action that would remove the last one is refused.

Transferring ownership

The owner can hand the team to another active member: open the member’s page and choose Transfer ownership, then confirm. The new owner becomes an admin with the owner’s privileges, and you stay an admin without them, including Add monitoring commands unless the new owner grants it. Only the new owner can hand the team back, so you can’t undo the transfer yourself. On the host, pcmd transfer-ownership does the same.

Permissions

An admin sets a member’s permissions on the member’s page. Each switch takes effect when you flip it; there is no save step. Members can see their own permissions read-only.

Add monitoring commands is the exception: only the owner can grant or revoke it, on a member’s page or an admin’s. Other admins see the switch read-only (“Only the owner can grant this”).

Section	Permission	Notes
Monitoring	View metrics	Dashboard values and history
	View command definitions	See what runs on the server
	Add monitoring commands	Approve and decline metric requests, add commands with Add metric, and see every member’s requests. Only the owner grants it, to members or admins. Lets the holder run code on the server host
	Edit monitoring commands
	Remove monitoring commands	Removing an approved command stops it
Alerts	Receive alerts	Push notifications; can be limited to specific metrics
	Add alert rules
	Edit alert rules
	Remove alert rules
Invites	Manage invites	Create and revoke team invites
	Additional devices	Create invites for the member’s own other devices
Team & sync	Sync SSH keys	Sync keys into the member’s own partition
	Manage members	Rename and remove member users

Actions you aren’t allowed to take stay visible and say why they’re disabled.

Invites

Tap New invite in the team’s invite section. Choose who the invite is for, the role for a new member (Admin or Member), an optional label, and how long it stays valid: 1 hour, 24 hours (default), 3 days or 7 days.

Invite for	Who can create it
New team member	Holders of Manage invites
My other device	Holders of Additional devices, for their own devices
Second device for another member	The owner only

An invite can also be pinned to a device fingerprint. Only that exact device can redeem it; the joining device shows its full fingerprint on the join screen.

The joining device scans the QR code or opens the pocketcmd:// link. The invite code is visible only to the person who created it, and copying it goes through the secure clipboard. Expired invites can be removed from the list.

Monitoring command approvals

A custom monitoring command runs a shell command on the server host, so it goes through an approval step:

1. A member files a request with Request metric, on the Metric requests page or in Your metric requests. Nothing runs yet.
2. Someone with Add monitoring commands (the owner, or an admin or member the owner granted it) reviews it under Metric requests, where it is also listed in Needs attention. The approval dialog always shows the full command and its interval before Approve & Run. They add their own commands with Add metric, which files and approves them in one step.
3. Once approved, the server runs the command under sh -c with a stripped environment, a 10-second timeout and a 64 KB output limit, and reads the first number in its output.

Approving and declining need Add monitoring commands, and only the owner can grant it. Grant it only to people you would trust with a shell on the server host. The requester can withdraw their own request while it is still pending. Deleting an approved request stops the command. The server has no built-in metrics, so these commands are the only server metrics a dashboard can show. See Monitoring.

Team vaults

A team vault shares secret items with the members you grant access to. Items are encrypted on the device, and the server stores only ciphertext. Access levels, fingerprint verification and key rotation are described in Secrets Vault.

Your personal vault can sync through a team server and stay private: the server stores it for your own devices, and no teammate can read it. Turn this on under Server settings & sync.

Removing a member

Open the member and choose Remove. On confirmation:

• The server refuses their devices from their next request, and their outstanding invites are revoked.
• The keys of the team vaults they could read are rotated and the items re-encrypted, so they lose cryptographic access too.
• With Also delete their synced data, the server deletes the sync records their devices wrote, their push registrations and their request-log entries, and clears their display name and device names. The audit log keeps the record of their membership and its removal.

Vault rotation has limits

Only team vaults present on the device you remove the member from can be checked. If another admin granted them access to other vaults, an admin of those vaults has to rotate them. A vault that is locked on your device can’t be rotated until you unlock it; unfinished rotations stay in Needs attention until they complete.

Devices

When a device pairs or joins, the app asks for a Device name, which is how the device appears in the team’s device list. Rename a device later with Rename device on its row. You can always rename your own devices; admins and members with Manage members can rename anyone’s.

Removed devices are hidden from the lists. Show removed devices brings back the revoked and left devices with the time they were removed.

Revoke, unpair, leave

Action	Who	Effect
Revoke device	Admins and the owner, or a member for their own other devices. Only the owner can revoke an admin’s device.	Permanent. The device can’t pair again with its current identity; it needs the app reinstalled and a new invite.
Unpair from this server	Anyone, on their own device	Removes the pairing from this device. Your membership stays, and this device can re-join later with a new invite.
Leave team	Anyone except the owner and the last admin	Removes your user. All your devices lose access and your invites are revoked. Optionally delete your synced data on the way out. This device can re-join with a new invite; your other devices need the app reinstalled first.

After revoking another device, PocketCmd offers to remove that device’s Files access keys from the authorized_keys of servers you can still reach.

Logs and audit feed

Under Governance, the owner has two feeds. Both filter by date range, and tapping an entry shows the complete record with Copy JSON.

Feed	Contents
Server logs	Every API request and server event with path, status, latency, source IP and the calling device and user. The server keeps roughly the last 10,000 entries.
Audit feed	Security events: pairing, revocations, role and permission changes, ownership transfers, device renames, invites, vault grants, metric-command decisions

Only the owner can see these feeds, which include members’ IP addresses and device names.

Server settings

Server settings & sync holds the server’s name, address and fingerprint, live stats (uptime, storage, version), what to sync with this server and a Danger zone with Unpair from this server and Leave team. If the server’s address changes, Server moved? Edit address appears when the team screen can’t reach it.