Files

The Daemon’s State

~/.local/state/pocketty/
├── daemon.key      the daemon's X25519 key for sealing notifications
├── daemon.lock     held while a daemon runs, so only one runs per user
├── devices/        one file per paired phone: its grant and public seal key
└── requests/       code setup requests that wait for approval

The folder follows XDG_STATE_HOME, and POCKETTY_STATE_DIR overrides it. See Environment.

The daemon and the CLI share state only through these files, in versioned formats. So an old daemon and a new CLI can run side by side for a moment during an update.

SSH Files

File	Who writes it	When
~/.ssh/authorized_keys	The daemon, or the setup command	When you add a phone. Each key is added once.
/etc/ssh/ssh_host_*_key.pub	Your SSH server	The daemon only reads them, to send them during code setup.

Uploads

~/.cache/pocketty/uploads/

Files you attach or paste in the App. Only your user can read them, and files older than seven days are deleted on the next upload. See Files and Images.

Services

The install script sets up the service:

System	Service	Log
macOS	~/Library/LaunchAgents/app.pocketty.daemon.plist	~/Library/Logs/pocketty.log
Linux	~/.config/systemd/user/pocketty.service	journalctl --user -u pocketty

On macOS, the script puts the app in ~/.local/share/pocketty/pocketty.app and links ~/.local/bin/pocketty to it. The service file names the app, so Login Items show pocketty.

The script writes the service file again each time it runs. It sets PATH to the one your shell had when you ran it, so the daemon finds the same herdr and Tailscale that you do.

With Homebrew, brew services names the service sh.brew.pocketty (homebrew.mxcl.pocketty before Homebrew 6), and the log goes to $(brew --prefix)/var/log/pocketty.log.

If a second daemon starts for the same user, it waits until the first one stops.

On the Phone

The App keeps your hosts and settings in its own storage, and your keys in the Keychain or the Secure Enclave. Nothing is synced by pocketty.