Sharing

Sharing one project or one terminal

Show a co-worker or client one thing and nothing else.

Share one project

1. Press the eye on the project's row in the sidebar, or in the terminal's header. Or choose "Share this project" or "Share this terminal" in the palette.
2. Set the options below.
3. Press Make the Link and send them the link. It comes with a QR code and a button that copies it.

They open it in a browser and install nothing. The link works once, for a day, or until the share ends if that's sooner.

Option	Default	Other choices
What they see	Fixed: only this project and anything you open in it, or only this terminal wherever you move it
They can	Look	Look and type: shows a warning, and the link can't be made until you press Let Them Type. Typing in a terminal here is typing as you
Where they are	On my network	Anywhere on the internet, see Sharing with someone who isn't on your network
Ends	1 day	1 hour, 1 week, When I end it. When time is up they're signed out

If "Open in a browser or on your phone" is off, the button reads Turn On and Make the Link and turns it on first. If the link's address opens only on this computer, the dialog says so: someone elsewhere needs Tailscale turned on, on the Hub page.

While something is shared, its sidebar row and the header of each terminal a guest sees carry a small sign: an eye where guests look, a keyboard where one can type. The same button lists who it's shared with. End signs one out at once and stops their link, and Share With Someone Else makes another link. Settings lists every guest on the Hub page.

Good to know

• You can share only what's on this computer, not a project on another machine.
• The window names the guest after what's shared: api guest, then api guest 2.

Sharing with someone who isn't on your network

A client outside your network or tailnet can't open that link. In the dialog, set Where they are to Anywhere on the internet. Then They can is Look only, and Ends is 1 hour, 1 day or 1 week: a public link always ends, a week at most.

Press Open a Public Link. It has isc hub answer to this computer's Tailscale name at its guest door (isc hub --guest-name, which restarts it and drops no paired device), makes the guest (isc hub device add --public), and opens the address (isc hub public on). Then it shows the public link and its QR code. Whoever opens the link first gets in, and it works once. Don't post it where others can read it.

• What it exposes. The address is Tailscale's, made by Tailscale Funnel on port 8443 of this computer's Tailscale name. Anyone on the internet can reach its sign-in page. Only someone with a link you made gets past it, and only to look at what you shared. Nothing of insensical's own listens on the internet.
• If it can't be opened, the dialog says why and offers the fix: How to Install, Sign In, or Turn On Funnel. If Tailscale already serves something else on port 8443, it's left as it is. If a step fails, the guest it made is removed.
• The window shows when a public link is open. A Public link open sign stands in amber in the bar, at the sidebar's foot, or over the window's corner. Press it to see what's shared, each with End.
• To close it, press the sign and then Close Public Link, or press Close on the Public link row of the Hub page. That's isc hub public off: every public guest is signed out and Tailscale no longer leads to this computer. Ending the last public guest closes it too.

Share from the command line

isc hub device add --name sam --only project:api --stays 1d
isc hub device add --name kim --only pane:12 --rights look,type --stays 1h

That device is a guest. Send them the address it prints. You can also make a guest on the page: Settings, Your devices, Add a Device, and under What it sees choose One project or One terminal. See Managing isc hub from the page. isc hub device ls shows what each device sees: everything, only project 4 (api when made) or only pane 12 (claude in api when made). --json has scope, sees and reset.

What a guest sees. With project:api, that project: its tabs and terminals, and anything you open in it later. A terminal you move out is gone from their page. With pane:12, that one terminal wherever you move it. Nothing else on this computer is listed or shown: no other project or terminal, not who else is connected, not your settings, not your home directory. They do see this computer's name. They can scroll back through everything the terminal has shown, including what was printed before you shared it.

What a guest can do. Look, and that's all unless you say --rights look,type. arrange and manage are refused with --only: a guest never opens, closes, moves or renames anything, and never changes a setting.

What a guest never gets. Notifications, the Settings screen, the list of devices, and making a device, one for their home-screen app included: on an iPhone that app needs a link of its own. A guest looking at a terminal doesn't mark it seen, so you're still notified.

WARNING

A guest who can type has your account. Someone who can type in a terminal can read your files and run anything as you, here and wherever this computer can reach, including isc to see every other terminal. --only keeps their page to one project; it doesn't confine what they type. Share typing only with someone you'd hand your keyboard to. A guest who can only look runs nothing, so for them "only this terminal" is exact.

Good to know

• A share is to the number you named. project:api is looked up when you make the device, and the share follows that project's number. Rename the project and the guest sees the new name; call another project api later and the guest doesn't move to it. If two projects are called api, isc hub device add refuses and gives their numbers: say --only project:4. A terminal is always by its number, as isc ls shows it. The project or terminal has to be open when you make the device.
• Give it an end with --stays 1h, 1d or 7d. Without it a guest stays until you remove it.
• To end it now, isc hub device rm sam. If you close the terminal or project instead, the guest has nothing left to see, and the device stays paired to nothing until it ends or you remove it.
• Pane numbers come from one counter, so a new terminal's number tells a guest roughly how many terminals you've opened in all. Never what they are.
• A share ends if insensical's saved state is lost or can't be read. Numbers start again from one, so every guest device then stops working and shows as ended in isc hub device ls. Remove it and make a new one. A device made by an earlier version of isc hub ends this way too.
• A guest's page has a bar across the top saying what they are and when the share ends. Under it is what you shared and nothing else, with no Home, Settings, bell or notifications. They see each terminal at the size and colours you have it, and can still scroll, find, copy, and change the letter size on their own screen. Leave is in the menu at the end of the bar.
• When it's over, because you closed what they saw, removed the device, or time is up, their page says so and to ask for a new link.

Share from the command line to someone outside your network. Add --public, then open the address:

isc hub device add --name sam --only project:api --stays 1d --public
isc hub public on

This puts an address on the public internet that shows that one project or terminal to whoever has the link. Read these limits first.

• It's look only. --rights look,type is refused with --public. Someone who types in a terminal is using your account, and that's never left one link away from the internet. To type together, share on your own network.
• It ends within a week. --stays is required and is 7 days at most. The link pairs one browser, for ten minutes, unless you say --uses 2 or --expires 1h. --uses any and --expires never are refused.
• Anyone can reach the sign-in page. The address shows up in public lists of certificates and gets scanned. A stranger gets the page and nothing else. Only the link gets in, and only to what you shared.
• The address is Tailscale's. isc hub public on asks your own Tailscale to open it with Funnel, at https://your-machine.your-tailnet.ts.net:8443. Nothing of insensical's own listens on the internet, and nobody of ours is in between. Your own devices don't work at that address at all: a lost phone or leaked code of yours is worth nothing there.
• Close it with one command. isc hub public off removes every public device, signs them out, and takes the address away. isc hub device rm sam ends one. When the last one ends the address stays with Tailscale until you run off. If Tailscale won't close it, off still removes the devices, says what Tailscale said, and fails, so you know to run it again.

Start isc hub with the name Tailscale gives this computer, as isc hub --guest-name desk.example.ts.net. isc hub public on tells you if it's missing, and gives the link to turn Funnel on if your tailnet doesn't allow it yet. Without Tailscale you can point a tunnel of your own at 127.0.0.1:7434, but whoever runs a tunnel that ends the encryption reads everything through it, the link included. isc hub device ls marks these devices public.

Check a public address. isc hub public status says whether the address is open and for which devices, open with nothing shared (close it with isc hub public off), closed, not known because Tailscale isn't answering, or held under a name this computer no longer has. It succeeds when the address is open and fails otherwise, so a script can ask. --json always succeeds and has state, open (null when Tailscale can't be asked), address, port, leads_to, devices (each with name and ends), record and record_without_device. isc hub status --json carries the same under door.