A Chat PIN Must Never Type
If a credential that opens Pippa chat can also open a terminal keyboard, you have built the model-callable write this quest keeps refusing, only now it fits in a pocket. The gateway checks the connecting device's tailnet identity and an operator-owned read/control permission. No model credential. No sibling HTTP credential. No long-lived password stored in the app as a substitute for the device. Selection of a Mac preset never connects automatically. Edits cannot redirect an existing connection's automatic reconnect into a different host.
Read permission is spectator. Control permission is the right to ask for a lease, not the lease itself. A device approved only to look cannot Take Control no matter how many times the thumb taps. That split is how you lend a glass to someone who should see a job and never type in it.
Office Is a Default, Not a Prison
Known Mac presets fill addresses. A fresh install can default to the family's office Mac. Custom endpoints stay editable. None of that is a license to print tailnet addresses in a quest, or to bake a single host into the binary as destiny. The working contract uses an office gateway. The authorized destination, the next track, is a phone that can also go direct. Today's credential is still the device, not a password you could paste into a model.