Most remote-support tools ask the customer to lower their guard
A customer hits a wall installing your product or hits a bug only their environment reproduces. To help, you need a shell on their box. The usual options are all painful: open an inbound SSH port (their security team says no), set up a VPN (their IT team needs a week), use TeamViewer (it's a desktop, not a terminal). You end up emailing strace logs back and forth for three days.
share terminal works the other direction. Your customer is the one running the CLI; their machine initiates the connection outbound to our signaling server. There's no listener on their box, no inbound firewall change, no port forward, no VPN. They paste the pairing code into their next message, you claim it in your browser, and you're in.
A real support call, end-to-end
- 01
Customer installs the CLI once
A one-line `npm install -g share-terminal`. It sits idle until they run it — no daemon, no listening socket, nothing for an internal scanner to find.
- 02
When the bug fires, they run one command
On a screen-share or in a ticket, you ask them: `share-terminal start --public`. The CLI prints a 6-digit pairing code. They send it to you.
- 03
You claim from your browser
Open shareterminal.cloud, sign in with your Google account, type the code. Before the connection forms, the CLI announces *your* identity to the customer — they see your email and name and can abort if anything looks off.
- 04
Drive the shell, fix, exit
Run `strace`, tail logs, edit a config, restart a service. When you close the tab, the CLI exits and the customer's machine is back to its pre-session state. No artifact is left on their box.
What this gives the customer's security team
No inbound exposure
The customer's machine initiates all connections outbound. No port is opened. Internet scanners and CIDR sweeps find nothing.
No persistent credential
No SSH key is exchanged. No VPN profile is provisioned. After the session ends, there is nothing for them to revoke.
Terminal data is end-to-end encrypted
OUTPUT and INPUT frames flow over a DTLS-encrypted WebRTC DataChannel directly between the two machines. The signaling server handles handshake, not bytes — there is no recording to subpoena.
Identity-visible claim
Before any bytes flow, the CLI announces who claimed the code — Google email, name, and source IP — in the customer's own terminal. They can ctrl-C if it isn't the engineer they expected.
Short-lived everything
Pairing codes expire in 2 minutes if unclaimed. Session tokens expire in 15 minutes. Nothing is long-lived enough to be re-used after the call.
Where this doesn't fit
share terminal is for interactive, time-bounded support. It is not a remote-administration channel. If you need unattended access to a customer\'s host for hours or days — running playbooks, pushing configuration — a proper management plane (Ansible-pull, an agent, a provisioning service) is the right answer. Pairing codes expire in two minutes; sessions die when the tab closes. That's a feature for support, but a wall for automation.
It also isn't a substitute for an in-product debug mode. If the diagnostic information you keep needing is the same three commands, ship them as a `your-product diagnose` flag. Use share terminal for the cases the diagnose command can't capture.
Starter: a pinned support runbook
Drop these steps into your support docs so customers can run them without thinking.
- 01
One-time setup. Install the CLI on the customer's machine. It sits idle — no daemon, no open port, nothing listening.
npm install -g share-terminal - 02
When help is needed, sign in once with the Google account your vendor recognizes. The CLI stores a refresh token locally; you won't be asked again.
share-terminal login - 03
Start a public session and share the 6-digit code with your support contact over whatever channel you already use (ticket, chat, email).
share-terminal start --public - 04
Before any bytes flow, the CLI prints the support engineer's identity — email, name, source IP. Press
Ctrl-Cif anything looks wrong.✓ pairing code 482017 · expires in 1:48 → viewer attaching · [email protected] · 203.0.113.42