shelldeck 0.0.2__tar.gz → 0.0.3__tar.gz

{shelldeck-0.0.2 → shelldeck-0.0.3}/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to shelldeck are listed here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow [Semantic Versioning](https://semver.org/).
 
+## [0.0.3] - 2026-09-29
+
+### Added
+
+- Devices page: every signed-in browser with where it came from (this machine, network, or a share), when it signed in, last activity, and whether it is in use; revoke one or sign out all others.
+- One device at a time: other browsers stay signed in but idle; logging in on one takes over and shows the others an "In use on another device" screen.
+
+### Changed
+
+- Logging in again in the same browser replaces its old login instead of adding one.
+- Share logins are stored with their share and removed when it stops, is replaced, or the server restarts.
+
+### Fixed
+
+- Re-running the one-line installer now upgrades an existing install to the latest release.
+
 ## [0.0.2] - 2026-09-29
 
 ### Added
@@ -32,5 +48,6 @@ First public release.
 - Mandatory password with per-browser logins, idle lock, and HTTPS or SSH-tunnel remote access.
 - `sd` CLI with a startup banner, `sd search` (LLM-free code search), and one-line installers for Windows and Linux.
 
+[0.0.3]: https://github.com/codejunction/shelldeck/releases/tag/v0.0.3
 [0.0.2]: https://github.com/codejunction/shelldeck/releases/tag/v0.0.2
 [0.0.1]: https://github.com/codejunction/shelldeck/releases/tag/v0.0.1

{shelldeck-0.0.2 → shelldeck-0.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: shelldeck
-Version: 0.0.2
+Version: 0.0.3
 Summary: Project-first multi-terminal for Windows and Linux: real shells, grouped by project, in your browser
 Project-URL: Homepage, https://github.com/codejunction/shelldeck
 Project-URL: Source, https://github.com/codejunction/shelldeck
@@ -70,7 +70,7 @@ irm https://raw.githubusercontent.com/codejunction/shelldeck/main/install.ps1 |
 curl -fsSL https://raw.githubusercontent.com/codejunction/shelldeck/main/install.sh | sh
 ```
 
-The installer sets up [uv](https://docs.astral.sh/uv/) if you don't have it, then installs shelldeck with its own Python 3.12+. Already use Python tooling? Any of these work too:
+The installer sets up [uv](https://docs.astral.sh/uv/) if you don't have it, then installs shelldeck with its own Python 3.12+. Run it again to update to the latest release (or `uv tool upgrade shelldeck`); stop the server first with `sd stop` so Windows can replace `sd.exe`. Already use Python tooling? Any of these work too:
 
 ```sh
 uv tool install shelldeck      # or: pipx install shelldeck, or: pip install shelldeck
@@ -130,6 +130,7 @@ sd ~/code/api      # add a folder as a project and open a terminal in it
 ### Secure by default
 
 - **Password required.** Every browser logs in separately and locks after 30 minutes idle.
+- **One device at a time.** Any number of browsers can stay signed in, but only one uses shelldeck; logging in on another takes over and idles the rest. The **Devices** page lists every signed-in browser (where from, last active, in use or idle) and revokes any of them.
 - **Local only.** shelldeck listens on `127.0.0.1` and refuses requests from other websites.
 - **Remote use** goes over an SSH tunnel or HTTPS. See [Remote access](#remote-access).
 
@@ -226,7 +227,7 @@ sd share          # starts shelldeck if needed, prints a QR code and a link; Ctr
 - **Encrypted.** The other device talks HTTPS to Cloudflare, which relays it through cloudflared's outbound encrypted tunnel to shelldeck on `127.0.0.1`. No ports are opened.
 - **Two locks.** The random `trycloudflare.com` address alone is refused; only the printed link (a one-per-share token made on the host) lets a browser in, and then it still needs your password. A password must exist before sharing.
 - **Phones.** On touch screens a key bar adds Esc, Tab, Ctrl (applies to the next letter), arrows and `| ~ / -`; dialogs open as bottom sheets.
-- **Stopping.** Ctrl+C closes the tunnel, voids the link and signs out every browser that logged in through it. Each `sd share` gets a new address and link.
+- **Stopping.** Ctrl+C closes the tunnel, voids the link and signs out every browser that logged in through it (they also vanish from **Devices**; a server restart clears them too). Each `sd share` gets a new address and link.
 
 **HTTPS on the VM's address,** with a real certificate (Tailscale `tailscale cert`, Let's Encrypt, your reverse proxy) or a self-signed one:
 
@@ -242,6 +243,7 @@ sd serve --host 0.0.0.0 --cert cert.pem --key key.pem
 
 - **Local only.** The server binds to `127.0.0.1` and rejects HTTP and WebSocket requests whose `Host` or `Origin` isn't the app itself, so other websites can't reach your shells.
 - **Passwords** are stored as PBKDF2-SHA256 (600k iterations). A login is a random token in an `HttpOnly`, `SameSite=Strict` cookie, and only its SHA-256 is stored. After 5 wrong passwords, each further try waits longer.
+- **Devices.** Each login records where it came from (this machine, the network, or a share). Only one login is in use at a time; the others get `423` until they enter the password again. Revoke any login from the Devices page.
 - **The CLI** authenticates with a token file in the data folder, readable only by your account and rotated on every server start.
 - **Forgot the password?** On the host machine, `sd login-link` prints a one-time login URL valid for 5 minutes, and `sd reset-password` removes the password. There is deliberately no way to do either from the browser.
 - **Your data** lives in `~/.config/shelldeck/` (database, log and saved terminal history). Set `SHELLDECK_HOME` to move it.

{shelldeck-0.0.2 → shelldeck-0.0.3}/README.md

@@ -35,7 +35,7 @@ irm https://raw.githubusercontent.com/codejunction/shelldeck/main/install.ps1 |
 curl -fsSL https://raw.githubusercontent.com/codejunction/shelldeck/main/install.sh | sh
 ```
 
-The installer sets up [uv](https://docs.astral.sh/uv/) if you don't have it, then installs shelldeck with its own Python 3.12+. Already use Python tooling? Any of these work too:
+The installer sets up [uv](https://docs.astral.sh/uv/) if you don't have it, then installs shelldeck with its own Python 3.12+. Run it again to update to the latest release (or `uv tool upgrade shelldeck`); stop the server first with `sd stop` so Windows can replace `sd.exe`. Already use Python tooling? Any of these work too:
 
 ```sh
 uv tool install shelldeck      # or: pipx install shelldeck, or: pip install shelldeck
@@ -95,6 +95,7 @@ sd ~/code/api      # add a folder as a project and open a terminal in it
 ### Secure by default
 
 - **Password required.** Every browser logs in separately and locks after 30 minutes idle.
+- **One device at a time.** Any number of browsers can stay signed in, but only one uses shelldeck; logging in on another takes over and idles the rest. The **Devices** page lists every signed-in browser (where from, last active, in use or idle) and revokes any of them.
 - **Local only.** shelldeck listens on `127.0.0.1` and refuses requests from other websites.
 - **Remote use** goes over an SSH tunnel or HTTPS. See [Remote access](#remote-access).
 
@@ -191,7 +192,7 @@ sd share          # starts shelldeck if needed, prints a QR code and a link; Ctr
 - **Encrypted.** The other device talks HTTPS to Cloudflare, which relays it through cloudflared's outbound encrypted tunnel to shelldeck on `127.0.0.1`. No ports are opened.
 - **Two locks.** The random `trycloudflare.com` address alone is refused; only the printed link (a one-per-share token made on the host) lets a browser in, and then it still needs your password. A password must exist before sharing.
 - **Phones.** On touch screens a key bar adds Esc, Tab, Ctrl (applies to the next letter), arrows and `| ~ / -`; dialogs open as bottom sheets.
-- **Stopping.** Ctrl+C closes the tunnel, voids the link and signs out every browser that logged in through it. Each `sd share` gets a new address and link.
+- **Stopping.** Ctrl+C closes the tunnel, voids the link and signs out every browser that logged in through it (they also vanish from **Devices**; a server restart clears them too). Each `sd share` gets a new address and link.
 
 **HTTPS on the VM's address,** with a real certificate (Tailscale `tailscale cert`, Let's Encrypt, your reverse proxy) or a self-signed one:
 
@@ -207,6 +208,7 @@ sd serve --host 0.0.0.0 --cert cert.pem --key key.pem
 
 - **Local only.** The server binds to `127.0.0.1` and rejects HTTP and WebSocket requests whose `Host` or `Origin` isn't the app itself, so other websites can't reach your shells.
 - **Passwords** are stored as PBKDF2-SHA256 (600k iterations). A login is a random token in an `HttpOnly`, `SameSite=Strict` cookie, and only its SHA-256 is stored. After 5 wrong passwords, each further try waits longer.
+- **Devices.** Each login records where it came from (this machine, the network, or a share). Only one login is in use at a time; the others get `423` until they enter the password again. Revoke any login from the Devices page.
 - **The CLI** authenticates with a token file in the data folder, readable only by your account and rotated on every server start.
 - **Forgot the password?** On the host machine, `sd login-link` prints a one-time login URL valid for 5 minutes, and `sd reset-password` removes the password. There is deliberately no way to do either from the browser.
 - **Your data** lives in `~/.config/shelldeck/` (database, log and saved terminal history). Set `SHELLDECK_HOME` to move it.

{shelldeck-0.0.2 → shelldeck-0.0.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "shelldeck"
-version = "0.0.2"
+version = "0.0.3"
 description = "Project-first multi-terminal for Windows and Linux: real shells, grouped by project, in your browser"
 readme = "README.md"
 license = "MIT"

{shelldeck-0.0.2 → shelldeck-0.0.3}/shelldeck/auth.py

@@ -141,12 +141,21 @@ def _h(token: str) -> str:
     return hashlib.sha256(token.encode()).hexdigest()
 
 
-def new_session(client: str) -> str:
+def new_session(client: str, via: str = "local") -> str:
     token = secrets.token_urlsafe(32)
-    db.add_auth_session(_h(token), time.time(), client)
+    db.add_auth_session(_h(token), time.time(), client, via)
     return token
 
 
+def alive(h: str | None) -> bool:
+    """A session (by hash) that still exists and hasn't idled out."""
+    if not h:
+        return False
+    hit = _cache.get(h)
+    row = hit[1] if hit and time.time() - hit[0] < _CACHE_TTL else db.get_auth_session(h)
+    return bool(row) and time.time() - row["last_seen"] <= LOCK_TIMEOUT_SECONDS
+
+
 def session_hash(token: str | None) -> str | None:
     """sha256 of a live session token, else None. Idle sessions are removed here."""
     if not token:

{shelldeck-0.0.2 → shelldeck-0.0.3}/shelldeck/db.py

@@ -136,7 +136,8 @@ def init_db() -> None:
                 token_hash TEXT PRIMARY KEY,
                 created_at REAL NOT NULL,
                 last_seen REAL NOT NULL,
-                client TEXT
+                client TEXT,
+                via TEXT
             );
 
             -- command history (sessions/projects may be deleted later; keep the text)
@@ -162,6 +163,9 @@ def init_db() -> None:
         cols = {r[1] for r in conn.execute("PRAGMA table_info(sessions)")}
         if "name" not in cols:
             conn.execute("ALTER TABLE sessions ADD COLUMN name TEXT")
+        if "via" not in {r[1] for r in conn.execute("PRAGMA table_info(auth_sessions)")}:
+            conn.execute("ALTER TABLE auth_sessions ADD COLUMN via TEXT")
+        conn.execute("DELETE FROM auth_sessions WHERE via LIKE 'share:%'")  # shares end with the server
         cols = {r[1] for r in conn.execute("PRAGMA table_info(projects)")}
         if "color" not in cols:
             conn.execute("ALTER TABLE projects ADD COLUMN color INTEGER")
@@ -317,15 +321,30 @@ def list_sessions_with_project() -> list[dict]:
         return [dict(r) for r in rows]
 
 
-def add_auth_session(token_hash: str, now: float, client: str) -> None:
+def add_auth_session(token_hash: str, now: float, client: str, via: str = "local") -> None:
     with _connect() as conn:
         conn.execute(
-            "INSERT INTO auth_sessions (token_hash, created_at, last_seen, client) VALUES (?, ?, ?, ?)",
-            (token_hash, now, now, client[:200]),
+            "INSERT INTO auth_sessions (token_hash, created_at, last_seen, client, via) VALUES (?, ?, ?, ?, ?)",
+            (token_hash, now, now, client[:200], via),
         )
         conn.commit()
 
 
+def list_auth_sessions() -> list[dict]:
+    with _connect() as conn:
+        conn.row_factory = sqlite3.Row
+        return [dict(r) for r in conn.execute("SELECT * FROM auth_sessions ORDER BY last_seen DESC")]
+
+
+def delete_auth_sessions_via(via: str) -> list[str]:
+    """Delete the logins made through `via` (e.g. one share); returns their hashes."""
+    with _connect() as conn:
+        gone = [r[0] for r in conn.execute("SELECT token_hash FROM auth_sessions WHERE via = ?", (via,))]
+        conn.execute("DELETE FROM auth_sessions WHERE via = ?", (via,))
+        conn.commit()
+        return gone
+
+
 def get_auth_session(token_hash: str) -> dict | None:
     with _connect() as conn:
         conn.row_factory = sqlite3.Row

{shelldeck-0.0.2 → shelldeck-0.0.3}/shelldeck/server.py

@@ -183,6 +183,18 @@ def _who(conn) -> tuple[str, str | None] | None:
     return ("browser", h) if h else None
 
 
+# One device uses shelldeck at a time; the others stay signed in but idle until they log in again.
+_active: dict[str, str | None] = {"h": None}
+
+
+def _claim(h: str) -> bool:
+    """True when browser session `h` may act: it is the active one, or no live session is."""
+    if _active["h"] != h and auth.alive(_active["h"]):
+        return False
+    _active["h"] = h
+    return True
+
+
 def _denied() -> JSONResponse:
     return err("locked" if auth.has_password() else "setup_required", 401)
 
@@ -198,6 +210,8 @@ async def guard(request: Request, call_next):
         if not who:
             return _denied()
         request.state.session = who[1]
+        if who[1] and not _claim(who[1]):
+            return err("in_use", 423)
         if who[1] and request.method != "GET":  # polling GETs are not activity
             auth.touch(who[1])
     return await call_next(request)
@@ -234,11 +248,21 @@ async def shutdown():
 # ---------------------------------------------------------------------------
 
 
-def _login_response(request: Request, body: dict, res=None):
-    """Start a login session: cookie on `res` (JSON body by default)."""
-    token = auth.new_session(f"{_client(request)} {request.headers.get('user-agent', '')}")
+def _via(request: Request) -> str:
     if _via_share(request):
-        _share["sessions"].add(auth.session_hash(token))
+        return f"share:{_share['host']}"
+    return "local" if _is_local(request) else "network"
+
+
+async def _login_response(request: Request, body: dict, res=None):
+    """Start a login session (cookie on `res`, JSON body by default). It becomes the active device:
+    this browser's previous login is replaced and every other device goes idle."""
+    if old := auth.session_hash(request.cookies.get(auth.COOKIE)):
+        auth.end_session(old)
+    token = auth.new_session(f"{_client(request)} {request.headers.get('user-agent', '')}", _via(request))
+    h = auth.session_hash(token)
+    _active["h"] = h
+    await _close_session_sockets(lambda owner: owner != h, IN_USE)
     res = res or JSONResponse(body)
     res.set_cookie(
         auth.COOKIE, token, httponly=True, samesite="strict", path="/",
@@ -263,6 +287,7 @@ async def auth_status(request: Request):
         "has_password": auth.has_password(),
         "setup_code_required": not auth.has_password() and not _is_local(request),
         "authenticated": bool(who),
+        "in_use_elsewhere": bool(who and who[1] and who[1] != _active["h"] and auth.alive(_active["h"])),
         "idle_timeout": auth.LOCK_TIMEOUT_SECONDS,
         "min_length": auth.MIN_PASSWORD,
     }
@@ -285,7 +310,7 @@ async def auth_setup(request: Request, payload: dict):
         return err(problem)
     auth.set_password(password)
     log.info("password created from %s", _client(request))
-    return _login_response(request, {"status": "ok"})
+    return await _login_response(request, {"status": "ok"})
 
 
 @app.post("/api/auth/login")
@@ -299,7 +324,7 @@ async def auth_login(request: Request, payload: dict):
     if not ok:
         log.warning("failed login from %s", _client(request))
         return err("invalid_password", 401)
-    return _login_response(request, {"status": "ok"})
+    return await _login_response(request, {"status": "ok"})
 
 
 _login_links: dict[str, float] = {}  # one-time code -> expiry
@@ -325,7 +350,7 @@ async def share_start(request: Request, payload: dict):
         return err("invalid_host")
     await _share_stop()
     token = secrets.token_urlsafe(32)
-    _share.update(host=host, key=hashlib.sha256(token.encode()).hexdigest(), sessions=set())
+    _share.update(host=host, key=hashlib.sha256(token.encode()).hexdigest())
     log.info("sharing via %s", host)
     return {"path": f"/share/{token}"}
 
@@ -340,11 +365,11 @@ async def share_stop(request: Request):
 
 async def _share_stop() -> None:
     """Close the gate and sign out every browser that logged in through the tunnel."""
-    sessions = _share.get("sessions", set())
+    if not _share:
+        return
+    gone = db.delete_auth_sessions_via(f"share:{_share['host']}")
     _share.clear()
-    for h in sessions:
-        auth.end_session(h)
-    await _close_session_sockets(lambda owner: owner in sessions)
+    await _revoke(gone)
 
 
 @app.get("/share/{token}")
@@ -362,7 +387,7 @@ async def auth_use_link(request: Request, code: str):
     expiry = _login_links.pop(code, 0)
     if expiry < time.time() or not auth.has_password():
         return err("link_expired", 403)
-    return _login_response(request, {}, RedirectResponse("/", status_code=303))
+    return await _login_response(request, {}, RedirectResponse("/", status_code=303))
 
 
 @app.post("/api/auth/logout")
@@ -377,6 +402,44 @@ async def auth_logout(request: Request):
     return res
 
 
+@app.get("/api/devices")
+async def devices(request: Request):
+    """Browsers signed in: where from, when, and which one is in use."""
+    online: dict[str, int] = {}
+    for owner in socket_owner.values():
+        if owner:
+            online[owner] = online.get(owner, 0) + 1
+    rows = []
+    for r in db.list_auth_sessions():
+        h = r["token_hash"]
+        if not auth.alive(h):
+            continue
+        ip, _, agent = (r["client"] or "").partition(" ")
+        rows.append({
+            "id": h, "ip": ip, "agent": agent, "via": r["via"] or "local",
+            "created_at": r["created_at"], "last_seen": r["last_seen"],
+            "active": h == _active["h"], "current": h == request.state.session, "sockets": online.get(h, 0),
+        })
+    return {"devices": rows, "share": _share.get("host")}
+
+
+@app.delete("/api/devices/{device_id}")
+async def revoke_device(request: Request, device_id: str):
+    """Sign one browser out, or with id "others" every browser but this one."""
+    if device_id == "others":
+        return await _revoke([d["token_hash"] for d in db.list_auth_sessions() if d["token_hash"] != request.state.session])
+    return await _revoke([device_id])
+
+
+async def _revoke(hashes: list[str]) -> dict:
+    for h in hashes:
+        auth.end_session(h)
+        if _active["h"] == h:
+            _active["h"] = None
+    await _close_session_sockets(lambda owner: owner in hashes)
+    return {"revoked": len(hashes)}
+
+
 @app.put("/api/auth/password")
 async def auth_password(request: Request, payload: dict):
     """Change the password (logged-in browser only). Signs out every other browser."""
@@ -743,11 +806,14 @@ async def _close(ws: WebSocket, code: int = 1000) -> None:
         pass
 
 
-async def _close_session_sockets(match) -> None:
+IN_USE = 4423  # socket close code: another device took over
+
+
+async def _close_session_sockets(match, code: int = 1008) -> None:
     """Close sockets whose login (session hash; None for the CLI) matches."""
     for ws, owner in list(socket_owner.items()):
         if owner and match(owner):
-            await _close(ws, 1008)
+            await _close(ws, code)
 
 
 # ---------------------------------------------------------------------------
@@ -893,6 +959,9 @@ async def alarms_ws(ws: WebSocket):
     if not who:
         await ws.close(code=1008)
         return
+    if who[1] and not _claim(who[1]):
+        await ws.close(code=IN_USE)
+        return
     await ws.accept()
     alarm_sockets.add(ws)
     socket_owner[ws] = who[1]
@@ -914,6 +983,9 @@ async def terminal_ws(ws: WebSocket, session_id: str):
     if not who:
         await ws.close(code=1008)
         return
+    if who[1] and not _claim(who[1]):
+        await ws.close(code=IN_USE)
+        return
     login = who[1]
     session = db.get_session(session_id)
     if not session:

{shelldeck-0.0.2 → shelldeck-0.0.3}/shelldeck/static/app.css

@@ -2322,6 +2322,25 @@ textarea:focus {
   border-radius: 2px;
 }
 
+/* ------------------------------------------------------------ devices */
+
+.dev-name {
+  font-weight: 600;
+}
+
+.dev-dot {
+  display: inline-block;
+  width: 7px;
+  height: 7px;
+  margin-right: 6px;
+  border-radius: 50%;
+  background: var(--faint);
+}
+
+.dev-dot.on {
+  background: var(--ok);
+}
+
 /* ------------------------------------------------------------ phones */
 
 @media (max-width: 560px) {
@@ -2354,4 +2373,30 @@ textarea:focus {
   .hist-table .hist-actions {
     grid-column: 1 / -1;
   }
+
+  /* devices: name + button, then where from + last active */
+  .dev-table thead,
+  .dev-table td:nth-child(3) {
+    display: none;
+  }
+
+  .dev-table tr {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) auto;
+    align-items: center;
+    column-gap: 10px;
+  }
+
+  .dev-table td {
+    border: 0 !important;
+  }
+
+  .dev-table tr + tr {
+    border-top: 1px solid var(--border);
+  }
+
+  .dev-table td:nth-child(5) {
+    grid-column: 2;
+    grid-row: 1;
+  }
 }

{shelldeck-0.0.2 → shelldeck-0.0.3}/shelldeck/static/app.js

@@ -444,7 +444,7 @@ class Term {
     ws.onclose = (ev) => {
       if (this.closed) return;
       if (ev.code === 4404 || ev.code === 1000) return this.exited();
-      if (ev.code === 1008) return bus.dispatchEvent(new Event("locked")); // logging in reloads the page
+      if (ev.code === 1008 || ev.code === 4423) return bus.dispatchEvent(new Event("locked")); // logging in reloads the page
       this.status("Reconnecting…");
       const delay = Math.min(10000, 500 * 2 ** this.retry++);
       clearTimeout(this.retryTimer);
@@ -1452,12 +1452,12 @@ function toggleSidebar() {
 
 // ------------------------------------------------------------- top bar/views
 
-const VIEW_TITLES = { bookmarks: "Bookmarks", scheduler: "Scheduler", tasks: "Tasks", monitor: "Task manager", history: "Command history" };
+const VIEW_TITLES = { bookmarks: "Bookmarks", scheduler: "Scheduler", tasks: "Tasks", monitor: "Task manager", history: "Command history", devices: "Devices" };
 
 export function switchView(view) {
   if (S.view === view) return;
   S.view = view;
-  for (const v of ["terminals", "bookmarks", "scheduler", "tasks", "monitor", "history"]) $(`#view-${v}`).hidden = v !== view;
+  for (const v of ["terminals", "bookmarks", "scheduler", "tasks", "monitor", "history", "devices"]) $(`#view-${v}`).hidden = v !== view;
   for (const b of $$(".sb-link[data-view]")) b.classList.toggle("active", b.dataset.view === view && view !== "terminals");
   $("#term-actions").hidden = view !== "terminals";
   if (mobile.matches) $("#app").classList.remove("sb-mobile-open");
@@ -1603,6 +1603,7 @@ function commandPalette() {
     ["Search all terminals", "search", () => searchAllDialog(), "Ctrl+Shift+F"],
     ["Command history", "history", () => switchView("history"), "Ctrl+Alt+R"],
     ["Task manager", "activity", () => switchView("monitor"), "Ctrl+Alt+M"],
+    ["Devices", "devices", () => switchView("devices")],
     ["Open terminals", "terminal", () => switchView("terminals")],
     ["Open bookmarks", "bookmark", () => switchView("bookmarks")],
     ["Open scheduler", "clock", () => switchView("scheduler"), "Ctrl+Alt+S"],
@@ -1718,7 +1719,7 @@ let authMode = null; // "login" | "setup" while the lock screen is up
 /** Lock screen: log in, or create the first password. */
 async function showAuth(status = null) {
   status ||= await api("/api/auth/status").catch(() => ({ has_password: true }));
-  const mode = status.has_password ? "login" : "setup";
+  const mode = !status.has_password ? "setup" : status.in_use_elsewhere ? "inuse" : "login";
   if (!$("#lock").hidden && authMode === mode) return;
   authMode = mode;
   const form = $("#lock-form");
@@ -1733,6 +1734,13 @@ async function showAuth(status = null) {
       <p class="faint small">You are connecting from another machine. The setup code is printed where shelldeck runs, and saved in its data folder as <code>setup-code</code>.</p>` : ""}
       <div class="error" id="lock-error"></div>
       <button class="btn primary" type="submit">Create password</button>`
+      : mode === "inuse"
+      ? `<img src="/static/icon.svg" alt="" width="40" height="40" />
+      <h2>In use on another device</h2>
+      <p class="muted">shelldeck is used on one device at a time. Enter the password to use it here; the other device goes idle.</p>
+      <input type="password" name="password" placeholder="Password" autocomplete="current-password" required />
+      <div class="error" id="lock-error"></div>
+      <button class="btn primary" type="submit">Use here</button>`
       : `<img src="/static/icon.svg" alt="" width="40" height="40" />
       <h2>shelldeck is locked</h2>
       <input type="password" name="password" placeholder="Password" autocomplete="current-password" required />
@@ -1775,7 +1783,7 @@ function connectAlarms() {
     if (msg.type === "alarm_snapshot") msg.alarms.forEach((t) => views.showAlarm(t, false));
   };
   ws.onclose = (ev) => {
-    if (ev.code !== 1008) setTimeout(connectAlarms, 3000);
+    if (ev.code !== 1008 && ev.code !== 4423) setTimeout(connectAlarms, 3000);
   };
 }
 
@@ -1868,7 +1876,7 @@ async function init() {
   wireLock();
   views.init();
   const status = await api("/api/auth/status").catch(() => null);
-  if (!status?.authenticated) {
+  if (!status?.authenticated || status.in_use_elsewhere) {
     await finishBoot();
     return showAuth(status);
   }

shelldeck-0.0.3/shelldeck/static/devices.js

@@ -0,0 +1,76 @@
+// Devices page: every signed-in browser, which one is in use, and revoke.
+import { api, confirmDialog, esc, icon, toast, toastError } from "./ui.js";
+
+function ago(ts) {
+  const s = Math.max(0, Date.now() / 1000 - ts);
+  if (s < 60) return "just now";
+  if (s < 3600) return `${Math.floor(s / 60)} min ago`;
+  if (s < 86400) return `${Math.floor(s / 3600)} h ago`;
+  return new Date(ts * 1000).toLocaleDateString();
+}
+
+/** "Edge on Windows" from a user agent; good enough to tell your own devices apart. */
+function deviceName(ua) {
+  const browser = /Edg\//.test(ua) ? "Edge" : /OPR\//.test(ua) ? "Opera" : /Firefox\//.test(ua) ? "Firefox"
+    : /Chrome\//.test(ua) ? "Chrome" : /Safari\//.test(ua) ? "Safari" : "Browser";
+  const os = /iPhone|iPad/.test(ua) ? "iOS" : /Android/.test(ua) ? "Android" : /Windows/.test(ua) ? "Windows"
+    : /Mac OS X/.test(ua) ? "macOS" : /Linux/.test(ua) ? "Linux" : "";
+  return os ? `${browser} on ${os}` : browser;
+}
+
+function viaLabel(via) {
+  if (via.startsWith("share:")) return `Share <span class="faint">${esc(via.slice(6))}</span>`;
+  return via === "network" ? "Network" : "This machine";
+}
+
+export async function renderDevices(el) {
+  if (!el.dataset.wired) {
+    el.dataset.wired = "1";
+    el.innerHTML = `<div class="page-head">
+        <div><h1>Devices</h1><p>Browsers signed in to shelldeck. One device is in use at a time; logging in on another makes it the one in use and idles the rest until they log in again. Stopping a share signs out its devices.</p></div>
+        <button class="btn" data-dev="others">${icon("power")}Sign out other devices</button>
+      </div>
+      <p class="dev-summary muted"></p>
+      <div class="card mon-table dev-table"><table><thead><tr><th>Device</th><th>From</th><th>Signed in</th><th>Last active</th><th></th></tr></thead><tbody></tbody></table></div>`;
+    el.addEventListener("click", (e) => onClick(e, el));
+  }
+  let data;
+  try {
+    data = await api("/api/devices");
+  } catch (e) {
+    return toastError(e);
+  }
+  const n = data.devices.length;
+  el.querySelector(".dev-summary").textContent =
+    `${n} signed in · ${data.devices.filter((d) => d.active).length} in use` + (data.share ? ` · sharing via ${data.share}` : "");
+  el.querySelector("[data-dev=others]").disabled = n < 2;
+  el.querySelector("tbody").innerHTML = data.devices
+    .map(
+      (d) => `<tr>
+        <td><div class="dev-name">${esc(deviceName(d.agent))}${d.current ? ' <span class="exit ok">this device</span>' : ""}</div>
+          <div class="hist-meta">${d.active ? '<span class="dev-dot on"></span>In use' : '<span class="dev-dot"></span>Idle'}${d.sockets ? ` · ${d.sockets} connection${d.sockets > 1 ? "s" : ""}` : ""}</div></td>
+        <td>${viaLabel(d.via)}<div class="hist-meta">${esc(d.ip)}</div></td>
+        <td class="nowrap faint">${esc(ago(d.created_at))}</td>
+        <td class="nowrap faint">${esc(ago(d.last_seen))}</td>
+        <td class="nowrap"><button class="btn sm" data-dev="revoke" data-id="${esc(d.id)}" data-me="${d.current ? 1 : ""}">${d.current ? "Sign out" : "Revoke"}</button></td>
+      </tr>`,
+    )
+    .join("");
+}
+
+async function onClick(e, el) {
+  const b = e.target.closest("[data-dev]");
+  if (!b) return;
+  const me = b.dataset.me === "1";
+  const others = b.dataset.dev === "others";
+  const what = others ? "Sign out every other device?" : me ? "Sign out this device?" : "Revoke this device?";
+  if (!(await confirmDialog(`${what} It will need the password to come back.`, { ok: "Sign out", danger: true }))) return;
+  try {
+    const r = await api(`/api/devices/${others ? "others" : encodeURIComponent(b.dataset.id)}`, { method: "DELETE" });
+    if (me) return location.reload();
+    toast(`${r.revoked} device${r.revoked === 1 ? "" : "s"} signed out`);
+  } catch (err) {
+    return toastError(err);
+  }
+  renderDevices(el);
+}

{shelldeck-0.0.2 → shelldeck-0.0.3}/shelldeck/static/index.html

@@ -47,6 +47,7 @@
           <button class="sb-link" data-action="view" data-view="tasks"><i data-icon="kanban"></i>Tasks</button>
           <button class="sb-link" data-action="view" data-view="history"><i data-icon="history"></i>History</button>
           <button class="sb-link" data-action="view" data-view="monitor"><i data-icon="activity"></i>Task manager</button>
+          <button class="sb-link" data-action="view" data-view="devices"><i data-icon="devices"></i>Devices</button>
           <div class="sb-row">
             <button class="sb-link" data-action="settings"><i data-icon="settings"></i>Settings</button>
             <span id="conn" class="conn" title="Server connection"></span>
@@ -88,6 +89,7 @@
         <section id="view-tasks" class="view page" hidden></section>
         <section id="view-monitor" class="view page" hidden></section>
         <section id="view-history" class="view page" hidden></section>
+        <section id="view-devices" class="view page" hidden></section>
         <div id="keybar" aria-label="Terminal keys">
           <button data-key="esc">Esc</button><button data-key="tab">Tab</button><button data-key="ctrl" aria-pressed="false">Ctrl</button>
           <button data-key="left" aria-label="Left">&larr;</button><button data-key="up" aria-label="Up">&uarr;</button><button data-key="down" aria-label="Down">&darr;</button><button data-key="right" aria-label="Right">&rarr;</button>

{shelldeck-0.0.2 → shelldeck-0.0.3}/shelldeck/static/ui.js

@@ -22,6 +22,7 @@ export async function api(path, { method = "GET", body } = {}) {
     /* empty body */
   }
   if (res.status === 401 && (data?.error === "locked" || data?.error === "setup_required")) bus.dispatchEvent(new Event("locked"));
+  if (res.status === 423) bus.dispatchEvent(new Event("locked")); // another device is in use
   if (!res.ok) {
     const e = new Error(data?.error || `HTTP ${res.status}`);
     e.data = data;
@@ -98,6 +99,7 @@ const P = {
   external: '<path d="M15 3h6v6M10 14 21 3M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/>',
   pencil: '<path d="M12 20h9M16.5 3.5a2.12 2.12 0 0 1 3 3L7 19l-4 1 1-4Z"/>',
   trash: '<path d="M3 6h18M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/>',
+  devices: '<rect x="2" y="4" width="14" height="10" rx="1.5"/><path d="M5 18h8"/><rect x="17" y="8" width="5" height="12" rx="1"/>',
   lock: '<rect x="3" y="11" width="18" height="11" rx="2"/><path d="M7 11V7a5 5 0 0 1 10 0v4"/>',
   up: '<path d="M12 19V5M5 12l7-7 7 7"/>',
   clipboard: '<rect x="8" y="2" width="8" height="4" rx="1"/><path d="M16 4h2a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2h2"/>',

{shelldeck-0.0.2 → shelldeck-0.0.3}/shelldeck/static/views.js

@@ -1,6 +1,7 @@
 import { S, TERMINAL_THEMES, applySettings, findSession, newTerminal, orderedProjects, palette, refreshProjects, shellLabel } from "./app.js";
 import { renderMonitor } from "./monitor.js";
 import { renderHistory } from "./history.js";
+import { renderDevices } from "./devices.js";
 import { $, $$, api, authError, confirmDialog, dialog, esc, fmtTime, fromLocalInput, hydrateIcons, icon, toLocalInput, toast, toastError, withEyes } from "./ui.js";
 
 let bookmarks = [];
@@ -12,7 +13,7 @@ export function init() {}
 export function show(view, el) {
   current = view;
   clearInterval(pollTimer);
-  const render = { bookmarks: renderBookmarks, scheduler: renderScheduler, tasks: renderTasks, monitor: renderMonitor, history: renderHistory }[view];
+  const render = { bookmarks: renderBookmarks, scheduler: renderScheduler, tasks: renderTasks, monitor: renderMonitor, history: renderHistory, devices: renderDevices }[view];
   render(el);
   if (!["bookmarks", "monitor", "history"].includes(view)) { // monitor refreshes from its own 2s poller
     pollTimer = setInterval(() => {

{shelldeck-0.0.2 → shelldeck-0.0.3}/tests/test_shelldeck.py

@@ -23,6 +23,7 @@ def client(tmp_path, monkeypatch):
 def browser(tmp_path, monkeypatch):
     """A client with no CLI token: it must log in like a browser."""
     auth._failures.clear()
+    monkeypatch.setitem(server._active, "h", None)
     monkeypatch.setenv("SHELLDECK_HOME", str(tmp_path))
     monkeypatch.setattr(server, "ALLOWED_HOSTS", {"testserver"})
     with TestClient(server.app) as c:
@@ -394,9 +395,49 @@ def test_share_gate_needs_link_then_password(browser):
     login = r.headers["set-cookie"].split(";")[0]
     authed = {**tunnel, "cookie": f"{gate['cookie']}; {login}"}
     assert b.get("/api/projects", headers=authed).status_code == 200
+    vias = {d["via"] for d in b.get("/api/devices", headers=authed).json()["devices"]}
+    assert vias == {"local", "share:" + tunnel["host"]}
 
     # stopping closes the gate and signs out tunnel logins
     assert b.delete("/api/share", headers=cli).status_code == 200
     assert b.get("/", headers=authed).status_code == 403
     auth._cache.clear()
     assert b.get("/api/projects", headers={"cookie": login}).status_code == 401
+
+
+def test_devices_one_active_takeover_and_revoke(browser, tmp_path):
+    a = browser
+    a.post("/api/auth/setup", json={"password": "longenough", "confirm": "longenough"})
+    sid = a.post("/api/sessions", json={"cwd": str(tmp_path)}).json()["id"]
+    c = TestClient(server.app)
+    assert c.post("/api/auth/login", json={"password": "longenough"}).status_code == 200
+
+    # c logged in last, so c is in use and a is idle (API 423, sockets closed with 4423)
+    assert c.get("/api/projects").status_code == 200
+    assert a.get("/api/projects").status_code == 423
+    assert a.get("/api/auth/status").json()["in_use_elsewhere"] is True
+    with pytest.raises(WebSocketDisconnect) as ex, a.websocket_connect(f"/ws/{sid}"):
+        pass
+    assert ex.value.code == server.IN_USE
+    devs = c.get("/api/devices").json()["devices"]
+    assert len(devs) == 2 and [d["current"] for d in devs if d["active"]] == [True]
+
+    # a takes over with the password; its old login is replaced, not duplicated
+    assert a.post("/api/auth/login", json={"password": "longenough"}).status_code == 200
+    assert a.get("/api/projects").status_code == 200 and c.get("/api/projects").status_code == 423
+    assert len(a.get("/api/devices").json()["devices"]) == 2
+
+    # a revokes c; c is signed out
+    other = next(d["id"] for d in a.get("/api/devices").json()["devices"] if not d["current"])
+    assert a.delete(f"/api/devices/{other}").json() == {"revoked": 1}
+    assert c.get("/api/projects").status_code == 401
+    assert [d["current"] for d in a.get("/api/devices").json()["devices"]] == [True]
+
+    # "others" keeps this browser; once the active one logs out, an idle one may act again
+    c.post("/api/auth/login", json={"password": "longenough"})
+    assert c.delete("/api/devices/others").json() == {"revoked": 1}
+    assert a.get("/api/projects").status_code == 401
+    d = TestClient(server.app)
+    d.post("/api/auth/login", json={"password": "longenough"})
+    d.post("/api/auth/logout")
+    assert c.get("/api/projects").status_code == 200