RmmBroker rides the existing agent command channel and pairs exactly one dashboard viewer with one agent per session, keyed by sessionId. It owns lifecycle and audit and relays frames verbatim — with a pre-attach backlog flush so no output is lost, idle and max-duration timeouts, and tenant scoping so a viewer socket can only attach to a session its own operator opened.

Every write action must clear: • an admin role • an RMM-licensed target device • a fresh step-up re-authentication (5-minute token) • full audit. Each session and action lands as a durable, org-scoped record — rmm.shell.*, rmm.file.*, rmm.script.*, rmm.patch.*, rmm.reboot, rmm.policy.* — capturing who, which device, when, duration, and outcome.

Real PTYs where the OS provides them: forkpty on macOS, creack/pty on Go/Linux, and redirected PowerShell pipes on Windows (ConPTY is on the roadmap). Full I/O and resize stream over the brokered WebSocket session into an xterm.js console. File transfer shares the same session: list/stat plus 256KB-chunked uploads and downloads.

macOS never exposes an existing recovery key, so escrow rotates it: fdesetup changerecovery -personal, authenticated by prompting the logged-in user for their own password in a secure on-device dialog (the technician never learns it), by an admin credential, or by the current key — an optional MDM FDERecoveryKeyEscrow profile can also push keys in. Windows agents ensure a BitLocker recovery-password protector and escrow the 48-digit key. Keys are encrypted at rest with AES-256-GCM under RMM_ESCROW_SECRET; a reveal requires admin + fresh step-up and is audited. Opt-in per fleet and per device, resolved last-write-wins.

No VNC server, no macOS Screen Sharing service: the menubar helper (the user-session process, so it is the correct TCC subject) captures via ScreenCaptureKit — max 1920px wide, 12fps, JPEG q0.5 — and streams length-prefixed frames over local TCP to the daemon, which relays them to a canvas viewer in the dashboard. TCC prompts are requested natively (CGRequestScreenCaptureAccess), the user must consent on-screen before pixels flow, and view-only is a toggle. In-session extras: tech-to-client file drops over a chunked data channel (256KB chunks, up to 512MB, saved to ~/Downloads with notification) and clipboard sync.

Desired-state controls declared once and evaluated on a 15-minute pull/report cycle — the original family (firewall, disk encryption, service, package) plus the config/compliance family: browser extension block/allow/force via managed-policy files, screen lock (sysadminctl / HKLM / dconf system-locks), password policy (pwpolicy / secedit / pwquality+faillock), login banners, remote-services disable, guest and auto-login off, auto-updates, Gatekeeper/SmartScreen, and firewall hardening. Assignment precedence is device over tag over all, drift can auto-remediate, and per-control compliance rolls up fleet-wide. Where macOS won't let an agent enforce a setting, the policy generates a .mobileconfig hard-lock — CMS-signed with plain openssl (any org cert with its chain: OV/EV TLS, S/MIME, or code-signing), so it installs green as Verified; agent-only controls are omitted from the profile.

A saved script becomes an automation: scheduled fleet-, tag-, or device-wide on an interval, pulled by agents when due, executed by local runners on all three OSes, and reported back with interval de-duplication. Output markers write custom fields onto the device — [[cf:key=value]] for text, [[cfhtml:...]] for sandboxed HTML (no JS), [[cfjs:...]] for interactive content in a null-origin allow-scripts sandbox — and fields auto-create on first write. A default script library ships with the deploy as read-only starter templates every tenant can import.

One inbound pipeline normalizes everything into an OCSF-style security_events shape. Sources: on-device collectors (Windows Defender via Get-MpThreatDetection, Defender for Mac and XProtect remediation logs on macOS, ClamAV FOUND lines on Linux); polling connectors for SentinelOne (API token with verified auto-rotation), Huntress, CrowdStrike Falcon, Microsoft Defender for Endpoint, and Malwarebytes OneView (short-lived OAuth bearers, cursor advanced only after a successful poll so outages backfill); Bitdefender GravityZone via the Event Push Service (jsonRPC push to the node, authorized by a per-connector shared secret, where a poll is just a health check); and a custom ingest endpoint with per-key HMAC secrets. Events dedupe on source + vendor event id, match to a device by hostname, FQDN, or serial within the tenant, carry the vendor's own triage state so console-side resolutions clear here, and high/critical severities raise security_detection alerts through the standard notification, webhook, and ticketing channels. Credentials are AES-256-GCM at rest. Deliberately CombineRMM-only — this subsystem is not ported to Combine.

CombineRMM is a physical fork of Combine, not a toggle: separate deployment, database, session cookie, agent service identity, and branding, so it never collides with a Combine install (shared monitoring fixes are ported to both trees — with the Threats subsystem as a deliberate exception). The automated surface is 185 end-to-end tests green: rmm-e2e 86, FileVault/chat 44, security-ingest 15, vulnerability-scanner 25, support-request 9, and 6 Go agent suites — plus CMS profile-signing verification.