shell.online 0.10 Adds Accounts and Organizations

说明与用途

shell.online v0.10 添加了账户和组织功能，支持从浏览器安全启动进程，并加密密码，确保服务无法读取终端数据。

问题

Add account and organization support to shell.online while ensuring terminal data remains unreadable by the service and infrastructure.

结果

The v0.10 release adds secure account and organization management to shell.online, enabling controlled process initiation from the browser while keeping terminal output and passwords encrypted and inaccessible to the service.

工作流

• 1. User signs up or logs in to shell.online.
• 2. On first sign‑in, the browser asks if the user wants the machine to start processes on their behalf; consent is stored per account/machine.
• 3. When a session is started from the browser, the daemon on the linked machine generates an ECDH key pair and publishes the public key.
• 4. The browser derives a shared secret, HKDF‑SHA256, and seals the browser password with AES‑256‑GCM.
• 5. The sealed envelope is sent to the accounts service; the service stores it but cannot decrypt it.
• 6. The daemon receives the sealed password, decrypts it, and starts the requested process.
• 7. Sessions are listed in the web app; organization members see each other’s sessions but only receive sealed passwords for their own view.
• 8. For terminal sharing, the CLI renders a QR code containing the share URL and the password fragment; the QR is scanned by a phone which derives the key locally, keeping the password out of the network.
• 9. The renderer optimizes ANSI output to reduce transitions for efficient rendering.

证据

The service relays an envelope it cannot open. The private key lives only as long as the daemon process, so stopping the daemon ends the ability to read anything sealed to it.

来源

The CLI now renders a QR code. The printed link stays password‑free so the two pieces can still be sent over separate channels.

来源