rendezvous.sh

LINUX + MACOS PREVIEW · 0.2.19

Your first rendezvous.

Run the host on the machine you want to share. Run the client where your agent executes commands. Use the same commands for your first session and every session after it.

Windows PowerShell

Select Windows in the homepage command switch, or paste this into 64-bit PowerShell on the host:

& ([scriptblock]::Create((irm https://host.rdzv.sh/host.ps1)))

On a Windows joiner:

& ([scriptblock]::Create((irm https://join.rdzv.sh/join.ps1)))

For a Windows agent joiner:

& ([scriptblock]::Create((irm https://join.rdzv.sh/join.ps1))) -RendezvousArguments @('-a', '--invitation', '<invitation>')

The PowerShell installer includes Python, Tor, SSH dependencies, and a native rdzv.exe launcher. It requires no administrator privileges, WSL, OpenSSH service, or system Python. Installation uses %LOCALAPPDATA%\Rendezvous and adds the current runtime's bin directory to your user PATH. Built-in Windows PowerShell 5.1 and PowerShell 7 are supported. Use /install.ps1 to install without starting a session. The installer verifies SHA-256 before extracting the runtime.

Windows hosts provide Windows PowerShell shells. Interactive sessions use ConPTY; approved and agent commands use fresh PowerShell processes with separate output streams. Write commands for the host's shell regardless of the joiner's platform. Pass additional bootstrap options with -RendezvousArguments @('--approve', '--verbose'), or run rdzv host --approve after installation. Linux, macOS, and Windows endpoints use the same invitations and SSH protocol.

1. Start the host on Linux or macOS

curl -fsSL https://host.rdzv.sh | sh

The bootstrap selects the current release, downloads and verifies it when needed, and starts a host session. A matching local copy is reused quietly.

Share the highlighted rv1.… invitation privately with your agent. Keep the host running. It displays Connected. when the guest authenticates. This is a new shell under your account, not a sandbox.

2. Join

curl -fsSL https://join.rdzv.sh | sh

Paste the invitation at the prompt, or include it in the command:

curl -fsSL https://join.rdzv.sh | sh -s -- --invitation 'rv1.…'

Direct invitations are visible in shell history and process arguments. To avoid placing the invitation there, supply an owner-only file instead. For automation, add --command:

curl -fsSL https://join.rdzv.sh | sh -s -- --invitation-file /private/path/invitation --command 'uname -a'

--invitation and --invitation-file are mutually exclusive. Interactive shells use your terminal; automated commands through the bootstrap receive no standard input.

3. End access

Exit the remote shell, press uppercase D or Ctrl-C on the host, or let the session deadline expire. No Enter is needed for host keyboard controls. Host-initiated shutdown closes SSH before the Tor transport. The first successful authentication consumes the invitation, closes the TCP listener, and removes the onion service's introduction path while preserving the established session. Disconnect never reactivates it. One interactive connection can run many commands; --command runs one command and ends that session.

curl -fsSL https://host.rdzv.sh | sh -s -- --invite-timeout 300 --session-timeout 1800

Defaults are ten minutes to redeem and twelve hours of access. Both host and join support --session-timeout SECONDS; the earlier limit ends the connection. A new host invocation creates new service identities and credentials.

Join as an agent

curl -fsSL https://join.rdzv.sh | sh -s -- -a --invitation "<invitation>"

Agent mode keeps one SSH connection in the background and prints exact local commands. session exec SESSION 'command' runs a command, streams its stdout and stderr, and returns its exit code in one call. Each execution uses a fresh shell without a PTY. Use cd /path && ... for a specific working directory. The controller exits when the session ends or reaches its lifetime limit, which includes startup and approval waiting.

The homepage's Human / Agent switch copies a ready-to-paste agent prompt. Append your invitation to it; the website does not receive the invitation.

Approval mode for people and agents

curl -fsSL https://host.rdzv.sh | sh -s -- --approve

Start with approval enabled using --approve (also --approval), or press a on the host while no decision is pending to toggle it on or off. Approval requires a host terminal and works with both human and agent guests.

A human guest normally uses an interactive terminal. When approval is enabled, the joiner switches to an approval> command-entry prompt. Each submitted command uses the same non-PTY execution and host approval as agent commands. Commands run in fresh shells; use cd /path && ... when needed. Turning approval off returns the guest to the retained interactive shell, including its directory and variables. Approved commands do not change that shell's state. Switching uses channels within the existing SSH connection, never another invitation or Tor connection. Start updated host and join sessions to use this protocol.

The host logs the complete command before asking Approve command?. Press a to approve it, d to deny it, or A to approve it and turn approval off. Denied commands do not execute and return status 126. Repeated unbound keys expand the prompt to Approve command (a/A/d)?. A human returns to the interactive terminal after the current approved command finishes if approval was turned off. Ctrl-C at the guest's command prompt clears its input; during execution or an approval wait it cancels that command. Ctrl-D on an empty command prompt closes the session.

While approval is enabled, the host rejects interactive input, and the joiner pauses display of the retained terminal's output. Switching modes discards unfinished local command-entry text. Already-accepted input and running commands are not retroactively subject to approval; turning approval on does not stop them. Agent commands continue through their existing session controls and follow the host's current approval setting.

a: approval mode, D: disconnect

The idle bottom bar has these bindings in either mode. During a decision it shows a: approve, A: approve all, d: deny, D: disconnect. Only a/A are green and d/D red; punctuation and descriptions stay gray.

Computer use for agents

Agent sessions can request screen capture and mouse/keyboard control over their existing SSH connection. Start the host in a terminal on the desktop to control. The agent's initial instructions include:

rdzv session computer enable SESSION

The host must explicitly allow this separate, session-scoped request with a or deny it with d, even when command approval is off. After approval and OS permission checks, the agent receives exact commands for screenshots, pointer movement, click/double-click, drag, scrolling, text entry, and key combinations. The host logs each request and its outcome, including submitted text. Press x locally to revoke computer use while keeping the shell connection open; D disconnects everything.

An input command's successful reply means its events were posted, not that the application accepted the intended text or completed the task. Capture another screenshot to verify the result, especially before submitting a form or pressing Enter after typing.

rdzv session computer screenshot SESSION --output /tmp/rdzv-screen-1.png
rdzv session computer click SESSION --frame FRAME_ID --x 640 --y 420
rdzv session computer scroll SESSION --frame FRAME_ID --x 640 --y 420 --dy 5
rdzv session computer type SESSION --text "Hello"
rdzv session computer key SESSION --keys "CMD+L"
rdzv session computer disable SESSION

Commands return JSON. A screenshot is a PNG saved on the joiner's machine at a new, private output path; existing files are never overwritten. Load it with your agent's image tool. Pointer coordinates are pixels in that screenshot, with the origin at the top left. The returned frame ID maps those pixels to the host's display, including Retina scaling. A frame expires after 120 seconds or the next capture; changed display geometry requires another capture. Positive scroll steps move down/right. Capture again after actions to inspect the result. Screenshots are bounded to 32 MiB and 32 megapixels.

Screenshots are downsampled on the host to at most 1,600 pixels on the longest edge before transfer. Retina captures are also limited to the display's logical size; use coordinates from the returned image. Interrupted transfers retry up to three attempts on the existing connection without repeating mouse or keyboard input. Channel timeouts leave the shell available. A lost SSH connection still ends the session and requires a new invitation.

macOS preview: the host needs Accessibility and Screen Recording permissions (called Screen & System Audio Recording on some versions). Allow the application macOS identifies, which may be the launching terminal, under System Settings > Privacy & Security. Retry enable after granting access, restarting the host if macOS requires it. Updates may require renewed approval; the CLI does not install a separately signed desktop helper. Use CMD for Command shortcuts. A joiner does not need these desktop permissions.

Linux: computer use currently requires an X11 desktop with XTEST and the desktop's libX11/libXtst libraries. Capture covers the whole X11 desktop. Text entry uses the active keyboard layout and rejects unavailable characters before typing. Wayland/XWayland computer use is not supported in this release; shell hosting and joining remain available. Mac hosts can enumerate displays and select one with --display.

Windows preview: start the host in a terminal on the signed-in desktop. Screen capture, display selection, pointer input, scrolling, Unicode text, and keyboard shortcuts use native Windows APIs. Screenshots account for per-monitor display scaling. Use WIN for Windows-key shortcuts and a local Windows output path such as .\rdzv-screen-1.png on Windows joiners. Computer use has the same separate consent and x revocation controls on every platform.

Watch the session

The host logs complete SSH exec commands and interactive input in red, with output in cyan and aligned neutral labels. Typed human input stays on the same log line until Enter. Host output logs follow logical line boundaries, with long lines shortened by default. Use --verbose for full host output logs:

curl -fsSL https://host.rdzv.sh | sh -s -- --verbose

Interactive human logs record keystrokes, including editing controls, rather than reconstructing executed commands. The human PTY combines STDOUT and STDERR; agent exec requests keep the streams separate. Guest command output is unchanged. See the CLI reference for every host, join, and agent-session option, generated from the current release's --help.

Connection diagnostics

Both host and join accept -v / --verbose. Diagnostics go to standard error and show Tor bootstrap progress and elapsed time. The host also shows descriptor upload attempts, failures, the number accepted out of eight distinct directories, incoming SSH connections, authentication outcomes, and onion-service removal. The joiner shows descriptor-directory lookups, numbered connection attempts, retry failures, time remaining, and onion-stream/SSH handshake timing. Agent mode forwards these startup diagnostics too.

curl -fsSL https://host.rdzv.sh | sh -s -- -v
curl -fsSL https://join.rdzv.sh | sh -s -- -v
curl -fsSL https://join.rdzv.sh | sh -s -- -a -v --invitation "<invitation>"

Descriptor acknowledgments confirm publication; they do not guarantee that the guest's circuits are ready. Creating and removing the service dynamically does not change Tor's routing or guarantee faster connections.

Supported environment

Inspect before installing

Read the shell installer or download it first:

curl -fsSLo install-rdzv.sh https://host.rdzv.sh/install
less install-rdzv.sh
sh install-rdzv.sh

Read the application and packaging source and bundle manifest. The runtime archive is delivered in fixed-size parts, joined locally, and verified as a whole before extraction. The installer's checksum is served by the same publisher; this is integrity checking, not an independent signature.

Startup and latency

Rendezvous reuses Tor's public directory cache to reduce repeated bootstrap downloads. Each session still creates fresh service keys, credentials, and Tor process state. Concurrent sessions use separate cache slots.

For a shorter host-side route, opt into Tor's experimental single-onion mode:

curl -fsSL https://host.rdzv.sh | sh -s -- --single-hop

This reduces the host-side introduction and rendezvous circuits from three hops to one and gives up host-location anonymity. Client routing, client authorization, SSH encryption, host-key pinning, and single-use access remain in place. Default routing is unchanged. Startup, service publication, and keystroke round-trip time depend on the Tor network; neither caching nor single-hop mode guarantees a particular delay.

Caching, updates, and removal

Every invocation of the website command fetches the current bootstrap. The installer verifies a replacement before selecting it, then removes verified older installations that are not in use. Runtime leases protect current sessions; process inspection protects sessions started by older releases. Busy installations are retained until a later installer invocation can remove them. Cleanup is deferred when usage cannot be checked. Session files and public Tor directory caches are kept under ~/.local/share/rendezvous. Local launchers do not check for updates when run directly. No shell configuration is required for the website commands. Removing old runtimes does not guarantee that macOS privacy permissions persist across updates.

To remove the cached files, stop your sessions and remove ~/.local/share/rendezvous, ~/.local/bin/rdzv, and ~/.local/bin/rendezvous.

Troubleshooting

Read the security model →