Sharing

Share one session with a specific person, a team or anyone with a link, without giving access to the whole machine. On a team machine, the team’s members already have every session, by their role.

The machine’s owner shares a session from Share session… in the session menu, or on a phone from Share session… in the sheet (☰). When a pane wants someone else, Share on its card in the swarm, or on its notification, opens that pane with the same picker for its session. From there:

With a person: enter their Arugula control username, check that their device fingerprint matches what they see, and choose Share with. Pick watches or drives. Turn on with history to include what was there before; without it, they see from now on.
- Someone you’re not in a team with is asked first: they see {you} wants to share a session on {machine} with you, with Accept and Decline. Until they accept, the machine isn’t listed for them and its notifications don’t reach them. Teammates aren’t asked.
Share and notify: add a note, then choose Share and notify instead of Share. They get access and a notification (only they are notified): “{you} brought you into {session}: {note}”, which opens at the session’s first pane. The dialog says whether it reached them: notified; will be notified (someone outside your teams is asked to accept first, and the machine tries again for a day); or wasn’t notified, and why.
With a team: Share with everyone in {team}, as members come and go. Each member gets the role you picked.
With a read-only link (on a page through Arugula control): Make a read-only link. Anyone with the link watches the whole session, from now on, for an hour; no account needed. The link’s key is only in the link, so control never sees it. For a link to one pane on your tailnet, see Read-only links to one pane.
Removing access: Remove beside a person, a team or someone with a link. Their view of the session closes within a second.

On your own machine, people you share with still can’t type in its panes until you let them: they choose Share › Ask the owner to let me drive it in the pane’s menu, and you pick how long, from 10 minutes to 2 hours. Share › Stop trusting {name} in the pane’s menu takes it back.

Sharing warns about panes that look like they show a secret, and offers to make them private. Share › Private (only you see it) in a pane’s menu keeps one on your screen alone, whatever is shared.

From a terminal

arugula invite and arugula access do the same from a shell.

arugula invite sam@example.com --note "the flaky test"   # share this session, notify them alone
arugula invite bea --role editor --drive 30 --pane %4    # may also type in %4 for 30 minutes
arugula access                                           # who can reach which sessions
arugula access grant SESSION WHO ROLE                    # ROLE: viewer, editor or owner
arugula access revoke SESSION WHO
arugula access log                                       # what was granted, and invites

arugula invite WHO shares a session (this pane’s, or --session S) with someone who watches (--role editor for someone who drives; it never lowers a role someone already has), and notifies only them, opening at the pane. --history shares what’s already there too. WHO can be a Tailscale login, someone you’ve already shared with, or (if the machine is joined to Arugula control) a teammate’s name. For anyone else, check their fingerprint: share once from the web, or pass --root DEVICE with their account’s first device, which prints the fingerprint to check with them and goes on after you confirm (--yes once checked).

It prints whether they were notified: sent, pending (they haven’t accepted this machine yet; it goes out when they do, for a day) or unreachable, and why.

When an agent wants to bring someone in

An agent can ask to invite someone (MCP’s invite_person), but it can’t share anything itself. An invite block opens beside the agent with a card, “…wants to bring Sam (editor) into api-work at pane %3: …”, and you alone get a notification. Only the session’s owner answers it, from the card, the notification, the swarm or the CLI: Invite sends it as you, with the role and note as you leave them; Decline tells the agent, with a reason if you give one. Unanswered, it’s dropped after a day.

Taking turns at the keyboard

When several people have a pane open, one of them drives it at a time: the pane shows who (✎ and their name), and only their typing reaches it. From the pane menu’s Share:

Take control (from {name}), or Ask for control, which asks them;
Let go of control when you’re done;
Pair mode (everyone types) lets everyone type at once.

The pane shows who else has it open, and the top bar shows everyone in the session: click someone to follow what they’re looking at. When two people have a pane open at different sizes, typing takes over the size only once the pane’s owner has been idle for 3 seconds; focusing a pane never does.

Over a tailnet

Without Arugula control, the same sharing works between Tailscale logins.

In Share session…, enter their tailnet login (them@example.com). Share and notify (or arugula invite them@example.com) notifies them only if they’ve turned on notifications on this machine before; someone shared with for the first time sees it once they connect.
They have to reach the machine too. If they’re not on your tailnet, share the machine with them in Tailscale’s admin console (node sharing); they open https://{machine}.{tailnet}.ts.net.
Only the machine’s owner (its Tailscale login, or --owner) gets everything else.

Read-only links to one pane

Share › Share read-only link… in a pane’s menu, or arugula share %N --ttl 2h, gives a /share/… link that shows that pane live (its screen and scrollback, then its output) and nothing else: no typing and no other panes. Anyone on your tailnet who can reach the machine may open it, never a tagged node, Funnel or the internet. Links last an hour by default and a week at most. arugula shares lists them, and arugula shares revoke ID cuts off anyone watching.

Next steps

Teams: share whole machines with a team.
Guest SSH: bring in someone who has only OpenSSH, to one pane.
Agents: who may answer an agent.