shell.online 0.10 Adds Accounts and Organizations

Description and use

shell.online v0.10 adds accounts and organizations, enabling secure browser‑initiated process execution and password encryption so the service cannot read terminal data.

Problem

Add account and organization support to shell.online while ensuring terminal data remains unreadable by the service and infrastructure.

Outcome

The v0.10 release adds secure account and organization management to shell.online, enabling controlled process initiation from the browser while keeping terminal output and passwords encrypted and inaccessible to the service.

Workflow

• 1. User signs up or logs in to shell.online.
• 2. On first sign‑in, the browser asks if the user wants the machine to start processes on their behalf; consent is stored per account/machine.
• 3. When a session is started from the browser, the daemon on the linked machine generates an ECDH key pair and publishes the public key.
• 4. The browser derives a shared secret, HKDF‑SHA256, and seals the browser password with AES‑256‑GCM.
• 5. The sealed envelope is sent to the accounts service; the service stores it but cannot decrypt it.
• 6. The daemon receives the sealed password, decrypts it, and starts the requested process.
• 7. Sessions are listed in the web app; organization members see each other’s sessions but only receive sealed passwords for their own view.
• 8. For terminal sharing, the CLI renders a QR code containing the share URL and the password fragment; the QR is scanned by a phone which derives the key locally, keeping the password out of the network.
• 9. The renderer optimizes ANSI output to reduce transitions for efficient rendering.

Evidence

The service relays an envelope it cannot open. The private key lives only as long as the daemon process, so stopping the daemon ends the ability to read anything sealed to it.

Source

The CLI now renders a QR code. The printed link stays password‑free so the two pieces can still be sent over separate channels.

Source