shelldeck 0.0.1__tar.gz → 0.0.3__tar.gz

shelldeck-0.0.3/CHANGELOG.md

@@ -0,0 +1,53 @@
+# Changelog
+
+All notable changes to shelldeck are listed here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow [Semantic Versioning](https://semver.org/).
+
+## [0.0.3] - 2026-09-29
+
+### Added
+
+- Devices page: every signed-in browser with where it came from (this machine, network, or a share), when it signed in, last activity, and whether it is in use; revoke one or sign out all others.
+- One device at a time: other browsers stay signed in but idle; logging in on one takes over and shows the others an "In use on another device" screen.
+
+### Changed
+
+- Logging in again in the same browser replaces its old login instead of adding one.
+- Share logins are stored with their share and removed when it stops, is replaced, or the server restarts.
+
+### Fixed
+
+- Re-running the one-line installer now upgrades an existing install to the latest release.
+
+## [0.0.2] - 2026-09-29
+
+### Added
+
+- `sd share`: reach shelldeck from another device over an HTTPS Cloudflare quick tunnel (needs `cloudflared`, no account). It prints a QR code and a one-per-share link; the tunnel address is refused without that link, and your password is still required. Ctrl+C stops sharing and signs those browsers out.
+- Phone key bar on touch screens: Esc, Tab, a sticky Ctrl, arrows and `| ~ / -`.
+
+### Changed
+
+- Touch devices use xterm's DOM renderer (WebGL came up blank on high-DPI phones).
+- History rows and the Settings dialog stack into one column on narrow screens.
+- Requests through a proxy that sets `CF-Connecting-IP` count as remote.
+- CI actions updated: checkout v7, setup-uv v7, upload-artifact v7, download-artifact v8.
+
+## [0.0.1] - 2026-09-28
+
+First public release.
+
+### Added
+
+- Projects sidebar with real shells per project: pwsh, PowerShell, cmd, Git Bash and WSL on Windows; every shell in `/etc/shells` on Linux.
+- Tiled split layout and a free-floating window layout, both persisted.
+- Shell integration (prompts, exit codes, current folder) for pwsh, PowerShell, cmd, bash, zsh and fish.
+- Session restore across restarts, reconnect with scrollback replay, and search across every terminal's output.
+- Git graph per project with branch and commit checkout.
+- Command history, bookmarks, cron scheduler, task board with reminders, and a task manager with CPU, RAM and GPU usage.
+- Clickable file paths, listening-port chips, finished-command alerts and a command palette.
+- Mandatory password with per-browser logins, idle lock, and HTTPS or SSH-tunnel remote access.
+- `sd` CLI with a startup banner, `sd search` (LLM-free code search), and one-line installers for Windows and Linux.
+
+[0.0.3]: https://github.com/codejunction/shelldeck/releases/tag/v0.0.3
+[0.0.2]: https://github.com/codejunction/shelldeck/releases/tag/v0.0.2
+[0.0.1]: https://github.com/codejunction/shelldeck/releases/tag/v0.0.1

{shelldeck-0.0.1 → shelldeck-0.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: shelldeck
-Version: 0.0.1
+Version: 0.0.3
 Summary: Project-first multi-terminal for Windows and Linux: real shells, grouped by project, in your browser
 Project-URL: Homepage, https://github.com/codejunction/shelldeck
 Project-URL: Source, https://github.com/codejunction/shelldeck
@@ -28,6 +28,7 @@ Requires-Dist: fastapi>=0.110
 Requires-Dist: psutil>=5.9
 Requires-Dist: pywinpty>=2.0; sys_platform == 'win32'
 Requires-Dist: rich>=13
+Requires-Dist: segno>=1.6
 Requires-Dist: typer>=0.12
 Requires-Dist: uvicorn[standard]>=0.29
 Description-Content-Type: text/markdown
@@ -43,7 +44,7 @@ Description-Content-Type: text/markdown
 Real shells (PowerShell, cmd, Git Bash, WSL, bash, zsh, fish) grouped by project,<br>
 in split or free-floating panes that survive restarts.
 
-[![PyPI](https://img.shields.io/pypi/v/shelldeck?color=8b5cf6&label=pypi)](https://pypi.org/project/shelldeck/)
+[![PyPI](https://img.shields.io/pypi/v/shelldeck?color=8b5cf6&cacheSeconds=3600)](https://pypi.org/project/shelldeck/)
 [![Python](https://img.shields.io/pypi/pyversions/shelldeck?color=8b5cf6)](https://pypi.org/project/shelldeck/)
 [![CI](https://github.com/codejunction/shelldeck/actions/workflows/ci.yml/badge.svg)](https://github.com/codejunction/shelldeck/actions/workflows/ci.yml)
 [![Platforms](https://img.shields.io/badge/platform-Windows%20%7C%20Linux-8b5cf6)](#install)
@@ -69,7 +70,7 @@ irm https://raw.githubusercontent.com/codejunction/shelldeck/main/install.ps1 |
 curl -fsSL https://raw.githubusercontent.com/codejunction/shelldeck/main/install.sh | sh
 ```
 
-The installer sets up [uv](https://docs.astral.sh/uv/) if you don't have it, then installs shelldeck with its own Python 3.12+. Already use Python tooling? Any of these work too:
+The installer sets up [uv](https://docs.astral.sh/uv/) if you don't have it, then installs shelldeck with its own Python 3.12+. Run it again to update to the latest release (or `uv tool upgrade shelldeck`); stop the server first with `sd stop` so Windows can replace `sd.exe`. Already use Python tooling? Any of these work too:
 
 ```sh
 uv tool install shelldeck      # or: pipx install shelldeck, or: pip install shelldeck
@@ -129,6 +130,7 @@ sd ~/code/api      # add a folder as a project and open a terminal in it
 ### Secure by default
 
 - **Password required.** Every browser logs in separately and locks after 30 minutes idle.
+- **One device at a time.** Any number of browsers can stay signed in, but only one uses shelldeck; logging in on another takes over and idles the rest. The **Devices** page lists every signed-in browser (where from, last active, in use or idle) and revokes any of them.
 - **Local only.** shelldeck listens on `127.0.0.1` and refuses requests from other websites.
 - **Remote use** goes over an SSH tunnel or HTTPS. See [Remote access](#remote-access).
 
@@ -194,6 +196,7 @@ sd schedule list|add|run|toggle|delete|logs
 sd task list|add|move|delete|alarms
 sd serve [--host H]                  run the server in the foreground
 sd stop                              stop the background server (closes all terminals)
+sd share                             share over an HTTPS Cloudflare tunnel with a QR link (needs cloudflared)
 sd login-link                        emergency: one-time login URL (host only)
 sd reset-password                    emergency: forget the password (host only)
 ```
@@ -215,6 +218,17 @@ sd serve                                  # on the VM: stays on 127.0.0.1:5455
 ssh -N -L 5455:127.0.0.1:5455 you@vm      # on your machine, then open http://127.0.0.1:5455
 ```
 
+**`sd share` (any device, no setup).** Needs [`cloudflared`](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/) (`winget install Cloudflare.cloudflared`); no Cloudflare account.
+
+```sh
+sd share          # starts shelldeck if needed, prints a QR code and a link; Ctrl+C stops sharing
+```
+
+- **Encrypted.** The other device talks HTTPS to Cloudflare, which relays it through cloudflared's outbound encrypted tunnel to shelldeck on `127.0.0.1`. No ports are opened.
+- **Two locks.** The random `trycloudflare.com` address alone is refused; only the printed link (a one-per-share token made on the host) lets a browser in, and then it still needs your password. A password must exist before sharing.
+- **Phones.** On touch screens a key bar adds Esc, Tab, Ctrl (applies to the next letter), arrows and `| ~ / -`; dialogs open as bottom sheets.
+- **Stopping.** Ctrl+C closes the tunnel, voids the link and signs out every browser that logged in through it (they also vanish from **Devices**; a server restart clears them too). Each `sd share` gets a new address and link.
+
 **HTTPS on the VM's address,** with a real certificate (Tailscale `tailscale cert`, Let's Encrypt, your reverse proxy) or a self-signed one:
 
 ```sh
@@ -229,6 +243,7 @@ sd serve --host 0.0.0.0 --cert cert.pem --key key.pem
 
 - **Local only.** The server binds to `127.0.0.1` and rejects HTTP and WebSocket requests whose `Host` or `Origin` isn't the app itself, so other websites can't reach your shells.
 - **Passwords** are stored as PBKDF2-SHA256 (600k iterations). A login is a random token in an `HttpOnly`, `SameSite=Strict` cookie, and only its SHA-256 is stored. After 5 wrong passwords, each further try waits longer.
+- **Devices.** Each login records where it came from (this machine, the network, or a share). Only one login is in use at a time; the others get `423` until they enter the password again. Revoke any login from the Devices page.
 - **The CLI** authenticates with a token file in the data folder, readable only by your account and rotated on every server start.
 - **Forgot the password?** On the host machine, `sd login-link` prints a one-time login URL valid for 5 minutes, and `sd reset-password` removes the password. There is deliberately no way to do either from the browser.
 - **Your data** lives in `~/.config/shelldeck/` (database, log and saved terminal history). Set `SHELLDECK_HOME` to move it.

{shelldeck-0.0.1 → shelldeck-0.0.3}/README.md

@@ -9,7 +9,7 @@
 Real shells (PowerShell, cmd, Git Bash, WSL, bash, zsh, fish) grouped by project,<br>
 in split or free-floating panes that survive restarts.
 
-[![PyPI](https://img.shields.io/pypi/v/shelldeck?color=8b5cf6&label=pypi)](https://pypi.org/project/shelldeck/)
+[![PyPI](https://img.shields.io/pypi/v/shelldeck?color=8b5cf6&cacheSeconds=3600)](https://pypi.org/project/shelldeck/)
 [![Python](https://img.shields.io/pypi/pyversions/shelldeck?color=8b5cf6)](https://pypi.org/project/shelldeck/)
 [![CI](https://github.com/codejunction/shelldeck/actions/workflows/ci.yml/badge.svg)](https://github.com/codejunction/shelldeck/actions/workflows/ci.yml)
 [![Platforms](https://img.shields.io/badge/platform-Windows%20%7C%20Linux-8b5cf6)](#install)
@@ -35,7 +35,7 @@ irm https://raw.githubusercontent.com/codejunction/shelldeck/main/install.ps1 |
 curl -fsSL https://raw.githubusercontent.com/codejunction/shelldeck/main/install.sh | sh
 ```
 
-The installer sets up [uv](https://docs.astral.sh/uv/) if you don't have it, then installs shelldeck with its own Python 3.12+. Already use Python tooling? Any of these work too:
+The installer sets up [uv](https://docs.astral.sh/uv/) if you don't have it, then installs shelldeck with its own Python 3.12+. Run it again to update to the latest release (or `uv tool upgrade shelldeck`); stop the server first with `sd stop` so Windows can replace `sd.exe`. Already use Python tooling? Any of these work too:
 
 ```sh
 uv tool install shelldeck      # or: pipx install shelldeck, or: pip install shelldeck
@@ -95,6 +95,7 @@ sd ~/code/api      # add a folder as a project and open a terminal in it
 ### Secure by default
 
 - **Password required.** Every browser logs in separately and locks after 30 minutes idle.
+- **One device at a time.** Any number of browsers can stay signed in, but only one uses shelldeck; logging in on another takes over and idles the rest. The **Devices** page lists every signed-in browser (where from, last active, in use or idle) and revokes any of them.
 - **Local only.** shelldeck listens on `127.0.0.1` and refuses requests from other websites.
 - **Remote use** goes over an SSH tunnel or HTTPS. See [Remote access](#remote-access).
 
@@ -160,6 +161,7 @@ sd schedule list|add|run|toggle|delete|logs
 sd task list|add|move|delete|alarms
 sd serve [--host H]                  run the server in the foreground
 sd stop                              stop the background server (closes all terminals)
+sd share                             share over an HTTPS Cloudflare tunnel with a QR link (needs cloudflared)
 sd login-link                        emergency: one-time login URL (host only)
 sd reset-password                    emergency: forget the password (host only)
 ```
@@ -181,6 +183,17 @@ sd serve                                  # on the VM: stays on 127.0.0.1:5455
 ssh -N -L 5455:127.0.0.1:5455 you@vm      # on your machine, then open http://127.0.0.1:5455
 ```
 
+**`sd share` (any device, no setup).** Needs [`cloudflared`](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/) (`winget install Cloudflare.cloudflared`); no Cloudflare account.
+
+```sh
+sd share          # starts shelldeck if needed, prints a QR code and a link; Ctrl+C stops sharing
+```
+
+- **Encrypted.** The other device talks HTTPS to Cloudflare, which relays it through cloudflared's outbound encrypted tunnel to shelldeck on `127.0.0.1`. No ports are opened.
+- **Two locks.** The random `trycloudflare.com` address alone is refused; only the printed link (a one-per-share token made on the host) lets a browser in, and then it still needs your password. A password must exist before sharing.
+- **Phones.** On touch screens a key bar adds Esc, Tab, Ctrl (applies to the next letter), arrows and `| ~ / -`; dialogs open as bottom sheets.
+- **Stopping.** Ctrl+C closes the tunnel, voids the link and signs out every browser that logged in through it (they also vanish from **Devices**; a server restart clears them too). Each `sd share` gets a new address and link.
+
 **HTTPS on the VM's address,** with a real certificate (Tailscale `tailscale cert`, Let's Encrypt, your reverse proxy) or a self-signed one:
 
 ```sh
@@ -195,6 +208,7 @@ sd serve --host 0.0.0.0 --cert cert.pem --key key.pem
 
 - **Local only.** The server binds to `127.0.0.1` and rejects HTTP and WebSocket requests whose `Host` or `Origin` isn't the app itself, so other websites can't reach your shells.
 - **Passwords** are stored as PBKDF2-SHA256 (600k iterations). A login is a random token in an `HttpOnly`, `SameSite=Strict` cookie, and only its SHA-256 is stored. After 5 wrong passwords, each further try waits longer.
+- **Devices.** Each login records where it came from (this machine, the network, or a share). Only one login is in use at a time; the others get `423` until they enter the password again. Revoke any login from the Devices page.
 - **The CLI** authenticates with a token file in the data folder, readable only by your account and rotated on every server start.
 - **Forgot the password?** On the host machine, `sd login-link` prints a one-time login URL valid for 5 minutes, and `sd reset-password` removes the password. There is deliberately no way to do either from the browser.
 - **Your data** lives in `~/.config/shelldeck/` (database, log and saved terminal history). Set `SHELLDECK_HOME` to move it.

{shelldeck-0.0.1 → shelldeck-0.0.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "shelldeck"
-version = "0.0.1"
+version = "0.0.3"
 description = "Project-first multi-terminal for Windows and Linux: real shells, grouped by project, in your browser"
 readme = "README.md"
 license = "MIT"
@@ -29,6 +29,7 @@ dependencies = [
   "rich>=13",
   "apscheduler>=3.10,<4",
   "psutil>=5.9",
+  "segno>=1.6",
 ]
 
 [project.urls]

{shelldeck-0.0.1 → shelldeck-0.0.3}/shelldeck/auth.py

@@ -141,12 +141,21 @@ def _h(token: str) -> str:
     return hashlib.sha256(token.encode()).hexdigest()
 
 
-def new_session(client: str) -> str:
+def new_session(client: str, via: str = "local") -> str:
     token = secrets.token_urlsafe(32)
-    db.add_auth_session(_h(token), time.time(), client)
+    db.add_auth_session(_h(token), time.time(), client, via)
     return token
 
 
+def alive(h: str | None) -> bool:
+    """A session (by hash) that still exists and hasn't idled out."""
+    if not h:
+        return False
+    hit = _cache.get(h)
+    row = hit[1] if hit and time.time() - hit[0] < _CACHE_TTL else db.get_auth_session(h)
+    return bool(row) and time.time() - row["last_seen"] <= LOCK_TIMEOUT_SECONDS
+
+
 def session_hash(token: str | None) -> str | None:
     """sha256 of a live session token, else None. Idle sessions are removed here."""
     if not token:

{shelldeck-0.0.1 → shelldeck-0.0.3}/shelldeck/cli.py

@@ -1,5 +1,6 @@
 import json
 import os
+import re
 import shutil
 import ssl
 import subprocess
@@ -301,6 +302,51 @@ def login_link():
     typer.echo("One use, valid for 5 minutes. Through an SSH tunnel, open it on your machine as-is.")
 
 
+def _show_share(url: str) -> None:
+    import segno
+
+    if sys.stdout.isatty():
+        segno.make(url, error="l").terminal(compact=(sys.stdout.encoding or "").lower().startswith("utf"))
+    typer.echo(f"\n  {url}\n")
+    typer.echo("  Scan or open it on the other device, then log in with your shelldeck password.")
+    typer.echo("  Without this link the tunnel URL is refused. Ctrl+C stops sharing and signs those browsers out.")
+
+
+@app.command()
+def share():
+    """Reach this shelldeck from another device: HTTPS Cloudflare quick tunnel, QR link, then your password."""
+    exe = shutil.which("cloudflared")
+    if not exe:
+        hint = "winget install Cloudflare.cloudflared" if sys.platform == "win32" else "see https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/"
+        typer.echo(f"cloudflared is not installed ({hint})", err=True)
+        raise typer.Exit(1)
+    ensure_server()
+    if not _api("/api/auth/status").get("has_password"):
+        typer.echo("Set a password first: open shelldeck on this machine (`sd`), then run `sd share` again.", err=True)
+        raise typer.Exit(1)
+    # the tunnel ends at our own loopback server, whose certificate (if any) is self-signed
+    cmd = [exe, "tunnel", "--no-autoupdate", "--url", _url()] + (["--no-tls-verify"] if _scheme() == "https" else [])
+    proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True, errors="replace")
+    host = shared = None
+    try:
+        for line in proc.stderr:  # cloudflared logs to stderr: the URL first, then each edge connection
+            if not host and (m := re.search(r"https://([a-z0-9-]+\.trycloudflare\.com)", line)):
+                host = m.group(1)
+            elif host and not shared and "Registered tunnel connection" in line:
+                shared = f"https://{host}" + _api("/api/share", "POST", {"host": host})["path"]
+                _show_share(shared)
+    except KeyboardInterrupt:
+        pass
+    finally:
+        proc.terminate()
+        if shared and _health() == "ok":
+            _api("/api/share", "DELETE")
+    if not shared:
+        typer.echo("cloudflared exited without a tunnel URL; run it by hand to see why.", err=True)
+        raise typer.Exit(1)
+    typer.echo("sharing stopped")
+
+
 @app.command()
 def stop():
     """Stop the background server (closes all terminals)."""

{shelldeck-0.0.1 → shelldeck-0.0.3}/shelldeck/db.py

@@ -136,7 +136,8 @@ def init_db() -> None:
                 token_hash TEXT PRIMARY KEY,
                 created_at REAL NOT NULL,
                 last_seen REAL NOT NULL,
-                client TEXT
+                client TEXT,
+                via TEXT
             );
 
             -- command history (sessions/projects may be deleted later; keep the text)
@@ -162,6 +163,9 @@ def init_db() -> None:
         cols = {r[1] for r in conn.execute("PRAGMA table_info(sessions)")}
         if "name" not in cols:
             conn.execute("ALTER TABLE sessions ADD COLUMN name TEXT")
+        if "via" not in {r[1] for r in conn.execute("PRAGMA table_info(auth_sessions)")}:
+            conn.execute("ALTER TABLE auth_sessions ADD COLUMN via TEXT")
+        conn.execute("DELETE FROM auth_sessions WHERE via LIKE 'share:%'")  # shares end with the server
         cols = {r[1] for r in conn.execute("PRAGMA table_info(projects)")}
         if "color" not in cols:
             conn.execute("ALTER TABLE projects ADD COLUMN color INTEGER")
@@ -317,15 +321,30 @@ def list_sessions_with_project() -> list[dict]:
         return [dict(r) for r in rows]
 
 
-def add_auth_session(token_hash: str, now: float, client: str) -> None:
+def add_auth_session(token_hash: str, now: float, client: str, via: str = "local") -> None:
     with _connect() as conn:
         conn.execute(
-            "INSERT INTO auth_sessions (token_hash, created_at, last_seen, client) VALUES (?, ?, ?, ?)",
-            (token_hash, now, now, client[:200]),
+            "INSERT INTO auth_sessions (token_hash, created_at, last_seen, client, via) VALUES (?, ?, ?, ?, ?)",
+            (token_hash, now, now, client[:200], via),
         )
         conn.commit()
 
 
+def list_auth_sessions() -> list[dict]:
+    with _connect() as conn:
+        conn.row_factory = sqlite3.Row
+        return [dict(r) for r in conn.execute("SELECT * FROM auth_sessions ORDER BY last_seen DESC")]
+
+
+def delete_auth_sessions_via(via: str) -> list[str]:
+    """Delete the logins made through `via` (e.g. one share); returns their hashes."""
+    with _connect() as conn:
+        gone = [r[0] for r in conn.execute("SELECT token_hash FROM auth_sessions WHERE via = ?", (via,))]
+        conn.execute("DELETE FROM auth_sessions WHERE via = ?", (via,))
+        conn.commit()
+        return gone
+
+
 def get_auth_session(token_hash: str) -> dict | None:
     with _connect() as conn:
         conn.row_factory = sqlite3.Row

{shelldeck-0.0.1 → shelldeck-0.0.3}/shelldeck/server.py

@@ -1,4 +1,5 @@
 import asyncio
+import hashlib
 import hmac
 import json
 import logging
@@ -67,10 +68,28 @@ def err(code: str, status: int = 400) -> JSONResponse:
     return JSONResponse({"error": code}, status_code=status)
 
 
-def _trusted(headers) -> bool:
-    """Same-origin check. Browsers always send Origin cross-site; the CLI sends none."""
+# `sd share`: the tunnel's public hostname, sha256 of its link token, and the logins made through it
+_share: dict = {}
+SHARE_COOKIE = "sd_share"
+
+
+def _share_key(token: str | None) -> bool:
+    return bool(token and _share) and hmac.compare_digest(hashlib.sha256(token.encode()).hexdigest(), _share["key"])
+
+
+def _via_share(conn) -> bool:
+    return bool(_share) and conn.headers.get("host", "").rsplit(":", 1)[0] == _share["host"]
+
+
+def _trusted(conn) -> bool:
+    """Same-origin check. Browsers always send Origin cross-site; the CLI sends none.
+    The share tunnel's host also needs the cookie its link sets (or to be opening that link)."""
+    headers = conn.headers
     host = headers.get("host", "")
-    if ALLOWED_HOSTS is not None and host.rsplit(":", 1)[0] not in ALLOWED_HOSTS:
+    if _via_share(conn):
+        if not (conn.url.path.startswith("/share/") or _share_key(conn.cookies.get(SHARE_COOKIE))):
+            return False
+    elif ALLOWED_HOSTS is not None and host.rsplit(":", 1)[0] not in ALLOWED_HOSTS:
         return False
     origin = headers.get("origin")
     return not origin or urlsplit(origin).netloc == host
@@ -152,7 +171,8 @@ def _client(conn) -> str:
 
 def _is_local(conn) -> bool:
     """A request from the host itself (not through a reverse proxy)."""
-    return _client(conn) in LOOPBACK and "x-forwarded-for" not in conn.headers
+    proxied = "x-forwarded-for" in conn.headers or "cf-connecting-ip" in conn.headers  # e.g. `sd share`
+    return _client(conn) in LOOPBACK and not proxied
 
 
 def _who(conn) -> tuple[str, str | None] | None:
@@ -163,13 +183,25 @@ def _who(conn) -> tuple[str, str | None] | None:
     return ("browser", h) if h else None
 
 
+# One device uses shelldeck at a time; the others stay signed in but idle until they log in again.
+_active: dict[str, str | None] = {"h": None}
+
+
+def _claim(h: str) -> bool:
+    """True when browser session `h` may act: it is the active one, or no live session is."""
+    if _active["h"] != h and auth.alive(_active["h"]):
+        return False
+    _active["h"] = h
+    return True
+
+
 def _denied() -> JSONResponse:
     return err("locked" if auth.has_password() else "setup_required", 401)
 
 
 @app.middleware("http")
 async def guard(request: Request, call_next):
-    if not _trusted(request.headers):
+    if not _trusted(request):
         return err("forbidden_origin", 403)
     path = request.url.path
     request.state.session = None
@@ -178,6 +210,8 @@ async def guard(request: Request, call_next):
         if not who:
             return _denied()
         request.state.session = who[1]
+        if who[1] and not _claim(who[1]):
+            return err("in_use", 423)
         if who[1] and request.method != "GET":  # polling GETs are not activity
             auth.touch(who[1])
     return await call_next(request)
@@ -214,9 +248,21 @@ async def shutdown():
 # ---------------------------------------------------------------------------
 
 
-def _login_response(request: Request, body: dict, res=None):
-    """Start a login session: cookie on `res` (JSON body by default)."""
-    token = auth.new_session(f"{_client(request)} {request.headers.get('user-agent', '')}")
+def _via(request: Request) -> str:
+    if _via_share(request):
+        return f"share:{_share['host']}"
+    return "local" if _is_local(request) else "network"
+
+
+async def _login_response(request: Request, body: dict, res=None):
+    """Start a login session (cookie on `res`, JSON body by default). It becomes the active device:
+    this browser's previous login is replaced and every other device goes idle."""
+    if old := auth.session_hash(request.cookies.get(auth.COOKIE)):
+        auth.end_session(old)
+    token = auth.new_session(f"{_client(request)} {request.headers.get('user-agent', '')}", _via(request))
+    h = auth.session_hash(token)
+    _active["h"] = h
+    await _close_session_sockets(lambda owner: owner != h, IN_USE)
     res = res or JSONResponse(body)
     res.set_cookie(
         auth.COOKIE, token, httponly=True, samesite="strict", path="/",
@@ -241,6 +287,7 @@ async def auth_status(request: Request):
         "has_password": auth.has_password(),
         "setup_code_required": not auth.has_password() and not _is_local(request),
         "authenticated": bool(who),
+        "in_use_elsewhere": bool(who and who[1] and who[1] != _active["h"] and auth.alive(_active["h"])),
         "idle_timeout": auth.LOCK_TIMEOUT_SECONDS,
         "min_length": auth.MIN_PASSWORD,
     }
@@ -263,7 +310,7 @@ async def auth_setup(request: Request, payload: dict):
         return err(problem)
     auth.set_password(password)
     log.info("password created from %s", _client(request))
-    return _login_response(request, {"status": "ok"})
+    return await _login_response(request, {"status": "ok"})
 
 
 @app.post("/api/auth/login")
@@ -277,7 +324,7 @@ async def auth_login(request: Request, payload: dict):
     if not ok:
         log.warning("failed login from %s", _client(request))
         return err("invalid_password", 401)
-    return _login_response(request, {"status": "ok"})
+    return await _login_response(request, {"status": "ok"})
 
 
 _login_links: dict[str, float] = {}  # one-time code -> expiry
@@ -293,12 +340,54 @@ async def auth_login_link(request: Request):
     return {"path": f"/api/auth/link/{code}"}
 
 
+@app.post("/api/share")
+async def share_start(request: Request, payload: dict):
+    """Host CLI only: open the gate for an `sd share` tunnel host; returns its one link."""
+    if not auth.cli_ok(request.headers.get(auth.TOKEN_HEADER)):
+        return err("host_cli_only", 403)
+    host = str(payload.get("host", "")).lower()
+    if not re.fullmatch(r"[a-z0-9-]+(\.[a-z0-9-]+)+", host):
+        return err("invalid_host")
+    await _share_stop()
+    token = secrets.token_urlsafe(32)
+    _share.update(host=host, key=hashlib.sha256(token.encode()).hexdigest())
+    log.info("sharing via %s", host)
+    return {"path": f"/share/{token}"}
+
+
+@app.delete("/api/share")
+async def share_stop(request: Request):
+    if not auth.cli_ok(request.headers.get(auth.TOKEN_HEADER)):
+        return err("host_cli_only", 403)
+    await _share_stop()
+    return {"status": "ok"}
+
+
+async def _share_stop() -> None:
+    """Close the gate and sign out every browser that logged in through the tunnel."""
+    if not _share:
+        return
+    gone = db.delete_auth_sessions_via(f"share:{_share['host']}")
+    _share.clear()
+    await _revoke(gone)
+
+
+@app.get("/share/{token}")
+async def share_open(request: Request, token: str):
+    """The QR link: sets the tunnel cookie, then the usual password login takes over."""
+    if not (_via_share(request) and _share_key(token)):
+        return err("link_expired", 403)
+    res = RedirectResponse("/", status_code=303)  # drops the token from the address bar
+    res.set_cookie(SHARE_COOKIE, token, httponly=True, samesite="lax", secure=True, path="/", max_age=24 * 3600)
+    return res
+
+
 @app.get("/api/auth/link/{code}")
 async def auth_use_link(request: Request, code: str):
     expiry = _login_links.pop(code, 0)
     if expiry < time.time() or not auth.has_password():
         return err("link_expired", 403)
-    return _login_response(request, {}, RedirectResponse("/", status_code=303))
+    return await _login_response(request, {}, RedirectResponse("/", status_code=303))
 
 
 @app.post("/api/auth/logout")
@@ -313,6 +402,44 @@ async def auth_logout(request: Request):
     return res
 
 
+@app.get("/api/devices")
+async def devices(request: Request):
+    """Browsers signed in: where from, when, and which one is in use."""
+    online: dict[str, int] = {}
+    for owner in socket_owner.values():
+        if owner:
+            online[owner] = online.get(owner, 0) + 1
+    rows = []
+    for r in db.list_auth_sessions():
+        h = r["token_hash"]
+        if not auth.alive(h):
+            continue
+        ip, _, agent = (r["client"] or "").partition(" ")
+        rows.append({
+            "id": h, "ip": ip, "agent": agent, "via": r["via"] or "local",
+            "created_at": r["created_at"], "last_seen": r["last_seen"],
+            "active": h == _active["h"], "current": h == request.state.session, "sockets": online.get(h, 0),
+        })
+    return {"devices": rows, "share": _share.get("host")}
+
+
+@app.delete("/api/devices/{device_id}")
+async def revoke_device(request: Request, device_id: str):
+    """Sign one browser out, or with id "others" every browser but this one."""
+    if device_id == "others":
+        return await _revoke([d["token_hash"] for d in db.list_auth_sessions() if d["token_hash"] != request.state.session])
+    return await _revoke([device_id])
+
+
+async def _revoke(hashes: list[str]) -> dict:
+    for h in hashes:
+        auth.end_session(h)
+        if _active["h"] == h:
+            _active["h"] = None
+    await _close_session_sockets(lambda owner: owner in hashes)
+    return {"revoked": len(hashes)}
+
+
 @app.put("/api/auth/password")
 async def auth_password(request: Request, payload: dict):
     """Change the password (logged-in browser only). Signs out every other browser."""
@@ -679,11 +806,14 @@ async def _close(ws: WebSocket, code: int = 1000) -> None:
         pass
 
 
-async def _close_session_sockets(match) -> None:
+IN_USE = 4423  # socket close code: another device took over
+
+
+async def _close_session_sockets(match, code: int = 1008) -> None:
     """Close sockets whose login (session hash; None for the CLI) matches."""
     for ws, owner in list(socket_owner.items()):
         if owner and match(owner):
-            await _close(ws, 1008)
+            await _close(ws, code)
 
 
 # ---------------------------------------------------------------------------
@@ -825,10 +955,13 @@ def _attach(session: dict, rows: int, cols: int) -> None:
 
 @app.websocket("/ws/alarms")
 async def alarms_ws(ws: WebSocket):
-    who = _who(ws) if _trusted(ws.headers) else None
+    who = _who(ws) if _trusted(ws) else None
     if not who:
         await ws.close(code=1008)
         return
+    if who[1] and not _claim(who[1]):
+        await ws.close(code=IN_USE)
+        return
     await ws.accept()
     alarm_sockets.add(ws)
     socket_owner[ws] = who[1]
@@ -846,10 +979,13 @@ async def alarms_ws(ws: WebSocket):
 
 @app.websocket("/ws/{session_id}")
 async def terminal_ws(ws: WebSocket, session_id: str):
-    who = _who(ws) if _trusted(ws.headers) else None
+    who = _who(ws) if _trusted(ws) else None
     if not who:
         await ws.close(code=1008)
         return
+    if who[1] and not _claim(who[1]):
+        await ws.close(code=IN_USE)
+        return
     login = who[1]
     session = db.get_session(session_id)
     if not session: