The hub

isc hub lets you use insensical from a phone, a tablet, or a laptop with nothing installed. On a phone it opens on what needs you, with each agent's question and keys to answer it, and it can notify you when you're away. On a wide screen it's the sidebar and the tab in front. Anywhere, you can open a pane, read it, scroll back, and type into it.

It's a separate program that runs only when you ask for it (you start it, join a hub, or turn it on), and a client of the daemon like the window. The daemon still listens on nothing but its socket.

Starting isc hub

The guide sets everything up one step at a time:

isc hub setup

Hub or join. Choose whether this computer is the hub, where your browsers and phones go, or joins a hub you already have. A computer that's already joined says which hub and skips to step 3. isc hub leave makes it a hub of its own again.
Reach (the hub). Choose how you'll reach this computer: Tailscale, a name of your own behind your proxy, an ssh tunnel, or this computer only. A proxy name must be https://, since a browser can't pair over plain http://.
Join (a joined computer). Paste the line from the hub and press Enter. Invite a Machine on the hub's Hub page gives it, and so does isc hub invite NAME. The guide hands it to isc hub join and nowhere else, so it stays out of your shell history and scrollback. A joined computer dials the hub, so there's no Reach step.
Keep running. Where systemd runs for your user, choose whether the hub starts after a restart. Yes is isc hub start.
Add a device. Yes opens the form that asks what to call your phone and shows the code to scan. On a joined computer, the code pairs at the hub's address.
Done. It shows the address, who's paired, and the plain commands that do the same without the guide. The summary stays on your screen. The line you pasted isn't in it.

Enter goes on, Shift+Tab goes back, and Esc leaves. Nothing changes until you choose a way in step 2 or press Enter on the line. The guide needs a terminal; in a script, use the commands below.

To start the hub yourself:

isc hub

It listens at http://127.0.0.1:7433, this machine only. --port 8000 picks another port. It runs until Ctrl+C or isc hub stop, which also stops the window starting it again. In a terminal, isc hub tells you that Ctrl+C stops it and that isc hub start keeps it running in the background, and says so when it stops.

isc hub status says whether it's running, where, and what keeps it running (systemd, launchd, the window or a terminal). If it's an older version than the installed one, it says so and that isc hub restart moves it. On a joined machine it names the hub and whether it's connected. --json adds owner (systemd, launchd, window or terminal), version and installed, and a tailscale object with state, address and serves_port; a joined machine's leaves out door, tailscale and members, and devices counts its guests. A second isc hub or start that finds one running says where and what keeps it. On a Mac, status also says the hub keeps the Mac awake while it's on power.

The hub keeps what you start it with. --name, --port, --listen, --tls-cert with --tls-key, --guest-port and --guest-name each replace the one it kept, and the next isc hub uses them, however it's started. What you leave out stays as it was. --name '' takes the names away, and so does --guest-name ''; --listen '' and --tls-cert '' --tls-key '' go back to this machine alone, unencrypted. A value it can't run with is refused, and nothing changes.

To turn it on and keep it running:

isc hub start

It takes the same options as isc hub. With systemd for your user, it switches insensical-hub.service on (writing one for the isc you ran if none is installed), and the hub comes back after you log in. On a Mac, launchd keeps it running: it comes back after you log in, and if it ends without isc hub stop. Without either, it starts the hub on its own in the background, keeps what the hub says when it fails in hub.log, and starts it again when you open the window. If the hub is already running, start says so, or, if you gave other options, starts it again with them and then keeps it running. A service file start wrote for another isc, such as a build you've since removed, is written again for this one, and one that hides the service installed with insensical is taken away. isc hub stop stops it now and turns it off: the service is switched off, launchd lets it go, and the window doesn't start it again.

To change a setting while it runs, or just to start it again:

isc hub restart --name desk.example.ts.net

It takes the same options. The hub starts again as the installed isc, on the port it has, and says what changed. The port stays held the whole time, so no connection is turned away. Your devices reconnect by themselves. If the hub can't start with what you gave, say a port something else holds, it starts again as it was, keeps its settings, and restart tells you why. start on a hub that's off does the same: it starts with the settings it kept and writes nothing new. It works however the hub was started: in a terminal, by a service or by the window. A hub from before it could start itself again is stopped and started again where it was started from.

Open it in your browser on this computer

isc hub open

This opens the hub in your default browser (xdg-open on Linux, open on a Mac), paired as the device This computer with every right. It stays signed in until you remove the device. Run it again for another address for the same device; removing the device signs out every browser paired this way.

The address works once, for 10 minutes, and only for a request from this machine that asks for 127.0.0.1, localhost or [::1]. From anywhere else it's refused and not used up, so a leaked link is no use off this computer. A port forward of yours that ends here (ssh -L) does pass, so keep the address to yourself.

--print prints the address and how long it works, and opens nothing.
--json prints {"url": …, "code": …, "until": …} and opens nothing. until is in seconds since the epoch.

A browser that opens http://127.0.0.1:7433 unpaired sees the pairing screen, which tells you to press Open in Browser under Settings > Hub in insensical. A code made there can still be typed.

Pairing a device

Pair a phone, a tablet, or a browser on another computer so it can use the hub. Nobody else can until you do. A device pairs by a code.

Pair your phone

In the window, open Settings > Hub and press Add a Device. The Hub page of the settings in isc tui has the same.
Give the device a name, say what it may do, and press Add.
On the device, point its camera at the QR code, open the code's link, or type its letters (twelve groups of five) on the page's pairing screen.

From a shell:

isc hub device add --name phone

In a terminal you can leave the name out and get the same form. Anything on the command line, such as --rights look, is where the form starts. With --name, with --json, or with no terminal, it prints the code: the link on one line and the letters on the next. --json gives url, code (the same link) and typed. --url https://desk.example.ts.net prints the address and code for a name other than this machine's own.

Icon and colour. A device has an icon (phone, tablet, laptop, desktop or browser) and a colour (blue, green, orange, purple, pink, teal, gold, grey, rust or indigo). Add a Device has an Icon row to pick both. Left alone, the icon is the one the device's browser reports and the colour comes from its name. Your choice is never replaced by a guess.

isc hub device add --name slate --icon tablet --color teal
isc hub device set slate --icon laptop
isc hub device set slate --no-icon --no-color

--no-icon and --no-color take a choice away. isc hub device ls shows both; --json has icon and color, null where none was chosen.

How many, and for how long. A code pairs one device, within 10 minutes, unless you say otherwise. In the window that's under More options.

isc hub device add --name family --uses 3 --expires 1h
isc hub device add --name desk --uses any --expires never

Flag	Value
`--uses`	A number of devices, or `any`
`--expires`	How long the code pairs: minutes, hours or days (`10m`, `1h`, `7d`), or `never`

Once the code is used up or its time is up, it pairs nothing more, and neither does a copy of its link or letters. The device that paired stays paired. Five failed tries close a code for good. isc hub device ls --json gives each device's code as open, used, closed or expired.

When a program in a pane asks. An agent in a pane could otherwise make itself a phone that types anywhere and keep it after it's gone. So when one of these runs inside an insensical pane, you're asked first:

isc hub device add, isc hub device pair-again, isc hub device set --far
isc hub open
the device step of isc hub setup

The window, or isc tui in a terminal of its own, shows the question over everything, naming the pane and its program. The command waits.

Allow, or A, lets it go on. For the first second neither choice counts, so a key meant for a pane can't allow anything.
Deny, Enter or Esc stops it. So does not answering within two minutes.
Only the window and an isc tui outside insensical's panes can answer. A program in a pane can't, and a browser never is asked.
With no window open, you're told on the desktop (a notification, and a mark on the tray icon or the menu bar), and clicking either opens the question.
If there's nothing to show or tell you, the command is refused at once and says to use Add a Device on the Hub page, or a terminal outside insensical.

Typing the code on the page. Case, spaces and dashes don't matter, and I, L and O are read as 1, 1 and 0. The field groups letters in fives and counts them. Nothing is sent until the code checks, so a typo uses nothing up.

Good to know

A browser keeps its own key. It's known by that key alone, and stays paired through restarts until you press Forget This Browser on the page or remove its device. Nothing lapses by itself.
Clearing site data loses the key, and the browser needs a new code. A browser is paired at one address: another name or port is a different browser.
A plain-HTTP address can't pair. A browser gives keys only to a page over HTTPS, or at localhost or 127.0.0.1. Use an https:// address (Tailscale gives one) or an ssh tunnel.
If another server answers later at the same address with a different key, the page says so and stops. This guards against a swapped server, not against the one that served the page.
One device can pair several browsers. isc hub device ls shows each device, what it may do, when it was last used, how its code stands, when the device ends, and its paired browsers.
Scan the Code on the page opens the camera, where the browser may use one.
A home-screen app is a browser of its own. On an iPhone, the page you add to the home screen doesn't share Safari's pairing, so Safari hands it one: press Add where the page offers the home screen, and it becomes a device of its own, named after yours, as in iPhone · home screen. It may do what yours may and ends when yours does. Its code works once, for 10 minutes, and counts among the devices added from pages. If nothing paired by then, the device is removed and Safari offers the home screen again. A guest's page doesn't hand over: a guest's app pairs by a link of its own. Your computer tells you it was added, isc hub device ls lists it beside yours, and you remove or ban each apart. If the app still asks to pair, give it a code of its own and scan with Scan the Code in the app, not the Camera app, which would open Safari and use the code up.
A paired browser opened at a link with a code says it's already paired. The code isn't used and still pairs the device it was meant for.

What a device may do

A device carries rights, the same four the daemon gives every client: look, type, arrange and manage. See Who is connected. Left alone, a device has all four.

WARNING

type, arrange or manage is enough to run programs as you, so a device with one is a key to your account on that machine. manage is the one to think about most: it can change what the server runs to tell you (notify-command). Give Can do everything, or manage, only to devices that are yours.

isc hub device add --name hallway-screen --rights look
isc hub device add --name guest --rights look,type --expires 1h --uses 2

The second code pairs up to two browsers in the next hour. Rights are set on the device: isc hub --rights look is refused.

A device with only look can read every pane and its history, and can't type, resize or change anything. The daemon refuses, so a page somebody wrote themselves gets no further. It doesn't count as you looking: a pane open in that browser still notifies you. See Who is connected. isc clients lists a browser under its device's name, as in kitchen tablet · Browser.

Make a device that ends by itself. To pair a co-worker's or client's browser for a while without having to remove it:

isc hub device add --name client --rights look --stays 1d

--stays is how long the device stays paired, counted from when you add it: minutes, hours or days (30m, 1h, 7d), or always, the default. When time is up, every browser paired as the device is signed out and the device leaves isc hub device ls. Until then the list says "ends in 40m", and --json has stays_until in seconds since the epoch, or null. --expires is only the code: a browser that paired stays paired after it expires.

Remove or re-pair a device

isc hub device rm phone removes a device at once, and every browser paired with it closes. Do this for a phone you've lost.
isc hub device pair-again phone gives a device a new code and link without removing it, for a phone you've replaced or a browser that forgot its pairing. --json is for scripts, and --expires sets how long the code works (10 minutes if left out). The device keeps its name, icon, colour, rights and how long it stays. The browser that pairs takes the place of the ones it had, which stay paired until then. The window's and isc tui's device lists (p) and the page's list have Pair Again. A guest is ended and shared again instead.

A device sees every terminal on this computer unless you make it with --only, as in the next section.

Your other machines, through this computer

Let a device reach your other machines too: the ones isc host ls lists on the computer isc hub runs on.

isc hub device add --name phone --far
isc hub device set phone --far
isc hub device set phone --no-far

The second and third give it to a device that's already paired, and take it back.

It's all of your machines or none.
isc hub reaches a machine the way the window does: your own ssh, running isc proxy there. The other machine needs isc and nothing else, and nothing new listens on it. The ssh forwards nothing, whatever your ~/.ssh/config says.
The device has the same rights there as here.
Only a device that may type can have --far. A device that only looks can't.
A guest never can. --far with --only or --public is refused, and a guest's browser isn't told you have other machines.
--no-far, removing the device, its time running out, or taking the machine out of the settings closes what the device has open there.
isc hub device ls marks these devices and your other machines.
ssh runs only while a browser has a terminal of that machine open, or a device with --far has notifications on: see Notifications on your phone.
A machine with another version of insensical can't be opened. Install the same version on both.
A machine's name must be letters, digits, -, _ and ., as isc host add takes it. Others aren't offered to a browser.

What the page shows. On such a device the page lists your other machines too:

Each machine is a heading over its projects. This computer is first, then the others in the order your settings have them. A device without --far, and a guest, see nothing about other machines.
The page connects to every machine on its own. What needs you isn't sorted by where it runs, so you don't open a machine to see it. Connecting never starts anything there.
The arrow on a heading only hides its rows. The machine stays connected and counted, and the browser remembers which you folded.
If a machine's server isn't running, its heading says so. If the device may arrange, a Start button starts the server there. Nothing else does.
Home and the counts cover every machine. Each card says which machine it's on, and an answer goes to that machine. A machine you can't reach shows its heading and why.
A terminal on another machine has a chip in its header with the machine's icon and name. No chip means this computer. What you type goes only to the terminal you're looking at.
An address names the machine. ?pane=3&at=atlas is terminal 3 on atlas. A notification about another machine's terminal opens that machine and lands on the card.
Devices, Add a Device and the settings on the page are this computer's. You can't share, make or move a project or terminal on another machine from the page.

When a machine has a problem

Out of reach. The machine's heading says so, its terminals dim, and what you type there isn't sent. This computer's terminals carry on. The page keeps trying and the machine comes back by itself.
Needs a password. ssh would ask for a password or passphrase, so nothing retries by itself. Fix it as "When the machine can't be reached" says under Other machines, over ssh, then press Try again under the machine's heading.
Another version. The page says once which side is older and stops dialling. Run isc upgrade on the older one, then isc restart-server there, then press Try again.
Not connected, "the insensical running on" your computer "is older". The daemon there is older than the hub that serves the page. Run isc restart-server on that computer.
Closed: it sent what no machine sends. That machine sent something no insensical sends, or listed more than 4,096 terminals, tabs or projects. The page closes it and shows nothing of it, so it can't pass for another of your machines. Fold it and open it again to try once more. If it says so again, don't trust that machine until you know why.
What ssh said is shown as one line of at most 300 characters. It can include your user name and the machine's address.

Managing isc hub from the page

From a phone you can do what isc hub device, isc hub push, isc notify and isc clients do. A browser paired as a device that may do everything, or at least change settings, has Settings in the menu under its letter. Other browsers aren't shown it, and the server refuses if they ask. It covers the computer isc hub runs on.

This computer shows its name, that insensical is running, and its version.
Your devices begins with Add a Device, then lists each device.
Notifications on your devices lists the browsers that asked for them. Send a Test says for each whether its push service took it.
Alerts when away sets where the server tells you when nobody is looking: ntfy (a server, a topic, and a token if your server needs one) or another web address. It has a switch for only when you're away, a test, and under More options the rest, including a command.
Connected now says what is connected and what it may do. Each row names the machine first, then what it is: arch · App, arch · Terminal. A browser is named by its device, as in kitchen tablet · Browser. Commands and programs in panes aren't listed. Disconnect ends one with all its connections, as isc disconnect does. This page's own row has no button, and neither has Hub notifications, which is how the hub tells your phone.

Nothing else of the server's settings can be changed from the page. The page is never given a token or password back, only its last few characters, and Clear takes it out. An address is shown shortened, to its host and the first part of its path, and can't be edited as shown: Change empties the field so you can type the whole address.

Add a device from the page

Press Add a Device.
Enter a name and choose what it may do: everything, look and type, or only look.
Choose how long it Stays paired: until you remove it, 1 hour, 1 day or 7 days. Under More options, set how many devices the code pairs and for how long.
Press Add. You get a code to scan and the link, which is this page's own address, so a phone on the same network or tailnet can open it.

A device you add sees every terminal on this computer unless you change What it sees to One project or One terminal and pick which. The device is then a guest: see Sharing one project or one terminal. A guest can Look or Look and type. It starts on Look, ending in 1 day. Add stays dim for Look and type until you press Let Them Type.

Limits when adding from a page:

You can't make a device that may do more than this browser may.
No more than six a minute in all, and three from one browser.
A device never stays paired longer than the browser that made it.
Everything is for devices that are yours: a device that may manage can run programs as you.

The device list. The device this page is paired as comes first, marked "this device". Each row shows what it may do (for a guest, what it sees, marked "guest"), when it was last used, how many browsers it paired, and how long its code or the device itself has left. A device that ends is gone from the list when its time is up, and a page paired as it is signed out.

Pair Again shows a new code for a device. Remove asks once and then ends it at once, like isc hub device rm. On the device this page is paired as, it signs this page out.

On these screens a choice of two shows both side by side: tap one, or use Left and Right. A choice of more opens a list: tap it or press Space, Enter or an arrow key, then pick, or press Esc to close it without choosing.

Reaching isc hub from another device

isc hub listens on this machine only, so a phone needs a way in. isc hub setup offers these ways and sets up the one you choose. Or use one you already trust.

ssh

ssh -L 7433:127.0.0.1:7433 you@this-machine

Then open http://127.0.0.1:7433 on the device that ran ssh. It pairs with a code like any other.

Tailscale

isc hub tailscale on

This starts isc hub if it isn't running, has it answer to this computer's Tailscale name, and has Tailscale serve it on port 443 of that name, to the devices on your tailnet. It prints the address, such as https://desk.example.ts.net. If no device is paired yet, it ends with isc hub device add --name phone.

It starts the hub as isc hub start does, then says what happens after a restart. With insensical-hub.service on, the service starts again when you log in, or with the computer where lingering is on. On a Mac, launchd starts it again when you log in. Without either, the window starts the hub again when you open it.

If Tailscale isn't installed, isn't signed in, or isn't answering, it says which and changes nothing. If Tailscale already serves something else on port 443, it says what and leaves it alone. The one exception is a mapping to a port that nothing answers on, such as tailscale serve 7443 typed while isc hub is on 7433: that gives a 502, so it's replaced.

Command	What it does
`isc hub tailscale on`	Sets it up, as above
`isc hub tailscale off`	Takes away the mapping `on` made, and nothing else of Tailscale's. A mapping you made by hand is left
`isc hub tailscale status`	Says whether Tailscale serves `isc hub` and at what address, or why it doesn't. Ends with 0 only when `isc hub` is served

--json always ends with 0 and has state (on, off, absent, signed out, silent, taken or mismatch), address, and serves_port. It's the same as the Tailscale switch on the Hub page of the settings, and the two see each other's work.

To do it by hand, tailscale serve 7433 gives the machine an https address inside your tailnet. Start isc hub with that name, isc hub --name desk.example.ts.net, and add the device with --url and that address.

Keep it running

isc hub start

This turns the hub on and keeps it running, and says each thing it did. With systemd for your user, it does only what's missing, in this order:

Writes insensical-hub.service to ~/.config/systemd/user/ (or under $XDG_CONFIG_HOME), running the isc you ran. A service a package installed is never written over.
Switches the service on and starts it. A hub running on its own is restarted from the service with the same settings and port.
If your user's services don't run with nobody logged in, runs loginctl enable-linger for you. If you aren't allowed to, the service is still on and it tells you to run sudo loginctl enable-linger NAME to start with the computer.

Run again with everything in place, it changes nothing and says so. The service runs a plain isc hub: the settings come from the file the hub keeps.

On a Mac, it writes ~/Library/LaunchAgents/com.insensical.hub.plist, running the isc you ran, and hands it to launchd. launchd starts the hub now, again each time you log in, and again if it ends any way but by isc hub stop, such as by crashing. A hub running on its own is started again by launchd, with the same settings and port. What the hub says goes to ~/Library/Logs/insensical/hub.log. If the window used to start your hub, the next time it does, launchd takes over.

With no one logged in to the Mac's screen, such as over ssh before anyone has, there's no session for launchd to keep the hub in. Then, as without systemd on Linux, it starts isc hub on its own in the background and remembers that you asked, so opening the window starts it again. What the hub prints on its error line is added to hub.log.

Command	What it does
`isc hub stop`	Stops the hub now and turns it off: the service is switched off, and the window doesn't start it again. A service file is left for the next `start`. On a Mac, launchd lets the hub go and the file in `~/Library/LaunchAgents` is removed. Lingering is left as it is: `loginctl disable-linger` is yours to run

A Mac goes to sleep a few seconds after its display turns off, and a Mac that's asleep can't be reached. So while isc hub runs and the Mac is on power, it keeps the Mac awake: your devices, and the hub it's joined to, still reach it with the display off. The display still sleeps. On battery, the Mac sleeps as it always does. Activity Monitor's Energy tab and pmset -g assertions show it as isc. If macOS refuses, isc hub says so as it starts and runs anyway.

Headscale, or a proxy of your own. Point it at 127.0.0.1:7433, with your own certificate. It has to speak TLS to the browser, pass the Host and Origin headers on as they came, and pass WebSockets. Start isc hub with --name and the name the browser will ask for.

A public address, for a guest. isc hub public on has Tailscale Funnel open one, to a second door that isc hub keeps at 127.0.0.1:7434 (--guest-port changes the port). That door is on this machine only, always. It's open only while a device made with --public exists, lets in only those devices, and they can only look. It answers to the names you give with --guest-name and to 127.0.0.1, not to --name's names or localhost. --guest-port can't be the port isc hub itself listens on. A key paired at one door is nobody at the other. See Sharing one project or one terminal.

What the hub accepts. isc hub answers only to names it knows are its own: this machine's addresses, localhost, and each --name you give it. Asked by any other name it gives nothing, not even the page. That keeps another site's page from reaching it under a name of that site's making.

It won't listen anywhere else without encryption. --listen 0.0.0.0 is refused unless you also give --tls-cert and --tls-key, a certificate and its key as PEM files. With those it speaks https only.

Over ssh -L, the browser's address is plain http and ssh does the encrypting. Over Tailscale, Tailscale does.
Other accounts on this machine can reach the port, where they can't reach the daemon's socket. Without a device's key they get the page and nothing else.

Running isc hub all the time

On Linux a package installs a user unit for it, which nothing turns on:

systemctl --user enable --now insensical-hub

isc hub start turns it on, writing a unit for you where none is installed. The unit runs a plain isc hub, which uses the settings the hub keeps. Change them with isc hub restart --name desk.example.ts.net, not in the unit. On a Mac, isc hub start has launchd keep it running: see Keep it running above.

Joining another machine to your hub

Another computer of yours can join the isc hub your browser goes to, and your devices then reach it at the hub's address. The joined machine doesn't listen on the network: its isc hub dials the hub. What a device and that machine say to each other is sealed for the two of them, so the hub carries it and can't read it. The exception is notifications, which the hub reads, as it reads its own, to tell your devices.

Join a machine to your hub:

On the hub, name the machine:
```
isc hub invite studio
```
It prints a line: the hub's address, then #j1. and letters. In the window, Invite a Machine on the Hub page gives the same line. It joins one machine, within ten minutes.
On the other machine, open Settings > Hub, press Join a Hub and paste the line. Or run:
```
isc hub join
```
and paste the line. It isn't shown as you paste it, and it's never an argument, so it stays out of your shell's history. From a script, give it on standard input.
Devices you'd paired at that machine's own address are removed, and so are its public links, since a joined machine has no guest door. It says how many: your devices reach it through the hub now. Guests you made there stay.
Run isc hub status there to see which hub it's joined to and whether it's connected (joined in --json: address, name, since, connected).

Give the hub an address the other machine reaches: its Tailscale name from isc hub tailscale on, or yours with --url https://desk.example.com. Over https:// the certificate must be one a public authority signed, as Tailscale's are.

Good to know:

Three wrong tries close the invite.
A hub with machines joined to it can't join another hub. Remove them first with isc hub machine rm NAME, or Remove on the Hub page.
isc hub join checks that the server at that address has the key the line names, and stops with nothing changed if it doesn't.
It starts isc hub on the joined machine if it isn't running. If that fails, the join still holds and you run isc hub yourself.
Hub-only commands are refused on a joined machine: isc hub open, invite, machine, ban, unban, tailscale on and public on. Run them on the hub, or isc hub leave to make this machine a hub of its own. status, stop, leave, rekey, device and push work as ever.
isc hub leave tells the hub, which takes the machine off its list at once, and its heading goes from your pages. If the hub can't be reached within a few seconds, the machine leaves all the same and prints the command to run on the hub: isc hub machine rm and this machine's id.

Your devices reach it. A device paired with the hub reaches every joined machine, with what it may do on the hub. There's no code to make on the joined machine. Remove a device on the hub, or change what it may do, and it's so on every joined machine at once. A guest, kept to one project or terminal of the hub, reaches no joined machine.

A joined machine doesn't pair your devices itself: isc hub device add there says to pair the device with the hub. It can still share one project or terminal of its own with a guest, by isc hub device add --only or isc hub open, and that code is at the hub's address. If the hub can't reach this machine, you're told so above the guest's code, since it won't work until it can. Either the machine isn't joined any more (the hub was given isc hub machine rm, or this machine's key changed), so join it again with isc hub invite and isc hub join; or it isn't connected right now, so check that insensical runs here and the network.

It appears on your page by itself. A page paired with the hub lists every joined machine after the hub's own heading, online or not connected. Press a heading to open it; what you type in its terminals goes to it alone. This browser lists them under Machines. A machine that's not connected stays in the list, dimmed, and returns once it dials the hub again. One taken away from the hub, or that leaves it, goes from the list.

Notifications from a joined machine. Turn on Notifications in This browser on a page paired with the hub, and a pane that waits, fails or finishes on any joined machine reaches that device, with the machine's name first in the title. The hub reads these notifications to post them. A joined machine sends only its own panes' notifications, not those of machines it reaches over ssh. Its Hub page has no notifications row: the hub tells your devices.

Add a device from another device. A device that may manage a machine can add another device by its key, from its page, with no code. The machine decides what the new device gets, and never more than the device that adds it has: no right it lacks, no later end, and your other machines only if it reaches them. The machine records who added it (isc hub device ls says "added by phone"), and each open page of a device that may manage it is told.

On the page it's Approve a Device:

On the new device, open the hub's address and press Already paired a phone? Approve from it. It shows a picture to scan, a link to copy, and three groups of four letters under This device. These hold the key the browser just made and nothing secret. Pair with a Code Instead goes back to the field.
On a device that may manage, open Settings, then Your devices, press Approve a Device, and scan the picture or paste the link. The link can't be typed. Anyone can send you a link: approve only for a device you're holding.
Under Check the Device, look at the new device. If it shows the same three groups, turn on The same as on the device; Approve stays off until you do. A key someone else made shows other groups.
Name it and choose what it may do and how long it stays. Only look is chosen first, and you're offered only what your own device may do. With machines joined to the hub, On chooses which one lets it in. If your device reaches your other machines, a switch gives the new one that too.
Press Approve. The new device's page goes on by itself.

A machine takes at most three devices an hour added this way, from all devices together. The fourth is refused: add it at the machine with isc hub device add.

isc hub device rm phone lists the devices it added and asks whether to remove them too. --with-approved removes them without asking.

Take a machine or a device away:

Command	What it does
`isc hub machine ls`	On the hub, lists the joined machines, whether each is connected now (`connected` in `--json`) and when each last dialled. `full` marks a machine that adds no more devices, which usually means it has turned bad.
`isc hub machine rm studio`	Cuts the machine off at once. It joins again only by a new invite. Its id, as `machine ls` shows it, works too.
`isc hub ban ID`	On the hub, carries nothing more for a device, by its id as `isc hub device ls --json` shows it. Each machine still lists it, and the devices it added aren't banned: run `isc hub device rm NAME --with-approved` on each machine.
`isc hub unban ID`	Lifts a ban.
`isc hub leave`	On a joined machine, leaves the hub. The hub takes it off its list at once; if the hub can't be reached, it says what to run there. Its `isc hub` listens again as a hub of its own, and each device pairs again at its own address.
`isc hub rekey`	Gives a machine a new key and id, for one whose `hub` folder may have been copied. Each device pairs again. A joined machine leaves its hub too, as `leave` does, and joins again by a new invite.

Security.

If the hub can't read members.json (a file you edited badly, or one closed to you), it says so in its log and changes nothing until it can. No ban is lifted by a file it can't read, and a hub that never read it carries nobody.
A machine joins one hub. The hub carries a device only to machines that keep it, and a stranger only to a code that's open.
The hub serves the page every device runs, so it's trusted as the page is: keep it on a computer of yours.

The hub ​

Starting isc hub ​

Pairing a device ​

What a device may do ​

Your other machines, through this computer ​

Managing isc hub from the page ​

Reaching isc hub from another device ​

Running isc hub all the time ​

Joining another machine to your hub ​