Your terminal, as a browser tab.

Reachable from any device you own.

curl -fsSL https://flue.sh/install.sh | sh

or brew install karnstack/tap/flue

macOS · Linux · WSL. One static binary, MIT.

Why

Two apps get used all day: a terminal and a browser. The cost is switching between them. Browsers have tab groups, tab search, splits, session restore, and URL addressing. Terminals have none of it and cannot join in.

flue makes a terminal session a browser tab, so it inherits all of that for free, and makes the same live session reachable from a phone, an iPad, or another laptop.

The shape of it

A small Go daemon owns the PTYs and their scrollback. A web app renders them. Closing the tab detaches; the build keeps running. Reattach and it replays what you missed. Attach from two devices and they mirror live: typing on the phone shows up in the laptop's browser, and the phone's 40 columns don't shrink the laptop.

One static binary. No Node, no Python, no toolchain, ever. The CLI stays a handful of commands: enable, disable, status, open, plus relay setup and join. Everything after them happens in the browser.

$ flue enable

  ✓ login service installed
  ✓ daemon running on 127.0.0.1:7717
  opening http://127.0.0.1:7717

$

Reaching it from elsewhere

Remote access is opt-in and runs on infrastructure you own. One command deploys a relay Worker and the web app into your own Cloudflare account (the free tier is enough), and every machine you own shares it:

$ flue relay setup

  ✓ token verified
  ✓ worker deployed: flue-relay
  ✓ web app uploaded
  ✓ reachable at https://flue-relay.you.workers.dev
  ✓ this machine joined as laptop (laptop-9f3a)

  to add another machine, run this on it:

    flue relay join wss://flue-relay.you.workers.dev --secret …

$

Setup runs once, on one machine. The Cloudflare API token stays on it — one file only you can read, kept so updating the relay never asks for the token again, deleted whenever you want it forgotten. Every other machine runs the join line setup prints, with no token and nothing to deploy, and each browser pairs once from the QR the machine shows. The relay is new: built and working, but not yet through its release gate, so treat it as ready to try rather than ready to rely on.

Everything that crosses the relay is end-to-end encrypted with Noise IK, the daemon's key pinned at pairing, so the Worker forwards ciphertext it holds no key for.

The whole picture

Three places, all yours. The daemon owns the terminals, the relay you deployed forwards ciphertext it cannot read, and every paired browser holds the daemon's key.

Architecture of flue: on your machine, a browser tab talks to the flue daemon over a loopback websocket. The daemon and your other devices each dial outbound into a relay Worker in your own Cloudflare account; the relay forwards ciphertext it holds no key for. A Noise IK channel runs end to end from the daemon to the remote browser, with the daemon's key pinned at pairing.

There is no hosted service.

No flue account, no flue server, no billing. Every remote path runs on infrastructure you own. flue.sh is docs and downloads, never part of the data path.