Good thingsGood things
keep shipping.keep shipping.

CLI 0.2.6 — trqsh.uz

• Uses https://api.trqsh.uz for account and OAuth device sign-in. Sign-in is GitHub or Google only, at https://app.trqsh.uz.
• Connects to trqsh.uz:4443 with QUIC and TCP fallback; tunnel URLs are https://<name>.trqsh.uz.
• Migrates the previous tunnel.trqsh.uz hosted defaults automatically while preserving custom endpoints, explicit overrides, API keys and saved tunnels.
• Homepage and docs links point at https://trqsh.uz, dashboard links at https://app.trqsh.uz, and release downloads at trqsh-tunnel/trqshcli.
• Windows has a PowerShell installer: irm https://trqsh.uz/install.ps1 | iex.
• npm (@trqsh-uz/trqsh), PyPI (trqsh) and Go module names are unchanged.

Update with trqsh update, your package manager, or the installers at https://trqsh.uz/docs/installation.

CLI 0.2.5

• Replace cached native binaries older than the npm/PyPI package; preserve newer self-updates and honor explicit version pins.
• Detect a Windows global npm command shadowed by another trqsh installation and report the conflicting launcher with instructions to switch.
• Restart older CLI daemons when opening an updated console, so login and tunnel connections use the new agent. Authenticate before stopping an agent; desktop-owned agents are left to their owning app.
• Migrate saved hosted defaults https://api.trqsh.uz and trqsh.uz:4443 to https://tunnel.trqsh.uz and wss://tunnel.trqsh.uz/_trqsh/agent. Custom endpoints, explicit overrides, credentials and saved tunnels remain.
• Correct the console's base-domain display for WebSocket server URLs.

npm install -g @trqsh-uz/trqsh@0.2.5 --foreground-scripts
python -m pip install --upgrade trqsh==0.2.5

Choose one package manager for the global trqsh command. If switching from pip to npm, remove the old Python launcher with python -m pip uninstall trqsh. Installing locally with npm does not update a global command.

This package release contains CLI downloads and npm/PyPI wrappers. Public tunnel URLs still require wildcard DNS/TLS and ingress for *.tunnel.trqsh.uz.

CLI 0.2.4

• Connect through Cloudflare HTTP tunnels with authenticated WebSocket + yamux transport, using normal HTTPS on port 443.
• Default API: https://tunnel.trqsh.uz.
• Default agent endpoint: wss://tunnel.trqsh.uz/_trqsh/agent.
• Direct QUIC/TCP endpoints remain available through --server host:port.
• Download and self-update URLs now use trqsh-tunnel/trqshcli; signature verification recognizes the new source owner and CLI package release tags.

This release contains native CLI archives, checksums/signature, and npm/PyPI wrappers. The server must enable TRQSH_WEBSOCKET_ADDR behind the HTTPS proxy. Public tunnel URLs still require wildcard DNS, TLS, and ingress routing for *.tunnel.trqsh.uz; an HTTPS control-plane hostname alone does not configure it.

npm install -g @trqsh-uz/trqsh@0.2.4
python -m pip install --upgrade trqsh==0.2.4

Changelog

• 89cf0c7 Merge pull request #35 from algorithco/feat/public-urls-ui-20261009
• 7c9c094 Merge pull request #36 from algorithco/codex/uncommitted-changes-20261011
• 8e83fae chore(deploy): move persistent local frontends to dedicated ports
• 4637127 chore(release): bump npm and PyPI wrappers to 0.2.3
• 2951a01 docs(api): align published contracts and validate source copies in CI
• 42b157a feat(cli): add onboarding and refresh the interactive console
• 456044e feat(packaging): improve verified installation and terminal feedback
• f11393f feat(site): refresh CLI marketing, downloads, and documentation views
• 4e0306c fix(agent): preserve reconnect state and invalidate logged-out sessions
• 38f756c fix(api): register remote streams before signaling readiness
• 8c6fb97 fix(api): retain the admin cookie security annotation at its setter
• ea5ff3d fix(auth): isolate sessions and protect dashboard and admin login
• dcb6a35 fix(billing): make webhook and usage collection retries idempotent
• ba07667 fix(ci): handle Go test errors and remove unused helpers
• 0377a8f fix(edge): confine recovered usage files to the spool directory
• 63cacc4 fix(edge): enforce route ownership and persist retryable usage
• 1648cd0 fix(site): use abort signals for hero effect cancellation
• c1e4026 test(auth): verify and document environment-specific cookie security
• eb6a3ba test(packaging): assert missing binary without a separate existence check

The CLI now uses https://trqsh.uz for its public API and device login by default.

• Keep QR remote sessions alive beyond the REST timeout and register streams before reporting readiness.
• Download npm/PyPI binaries from the canonical algorithco/trqshcli release repository.
• Verify checksum signatures from the current tagged release workflow while retaining support for historical signatures from the previous repository owner.

Install or upgrade:

pip install --upgrade trqsh==0.2.2

Archives are available for Windows, macOS and Linux on amd64/arm64, with Debian/RPM packages for Linux. Verify downloads against checksums.txt and its Sigstore bundle.

For clients through 0.2.1, upgrade through npm, PyPI or a downloaded archive: their self-updater still expects the previous repository owner's signing identity.

Source: v0.2.2 · changes.

Changelog

• ab1c6c5 chore(release): bump npm/PyPI packaging to v0.2.1
• 3a66330 feat(cli): Ctrl+A selects the whole input, GUI-style
• 75f435a feat(cli): verify the Sigstore/cosign bundle before self-update installs it
• c368a1c fix(cli): keep the welcome banner after /clear
• 79f0ac4 fix(npm): auto-fix PATH when npm's global bin dir is missing from it
• e989431 fix(pypi): self-heal PATH on Windows so trqsh survives a --user install
• b565cdf fix(release): sign checksums.txt with the Sigstore-standard bundle format
• b384666 test(cli): update TestReplFlow for the /clear welcome-banner fix

Changelog

• a0aab18 chore(desktop): Empty-component consistency, focus-visible states, stale Wails-era comment cleanup
• 4dea7d5 chore(release): bump npm/PyPI packaging to v0.2.0, document /qr in both READMEs
• 08ca769 ci(release): add workflow_dispatch as a manual retry path
• 7602a9b deploy(compose): drive the control API entirely from deploy/.env
• 57f4c4b deploy(env): complete + document every operator var in the .env examples
• d91f01c docs(api): document geo, regions, and history endpoints in OpenAPI
• 6e3c4ca docs(api): document the /qr remote-control pairing endpoints
• a19fa89 docs(deploy): note the single-.env model + admin/geo toggles in PRODUCTION.md
• fc13800 docs(desktop): add redesign + embedded-terminal implementation plan
• a1aa97d docs(desktop): close out the progress log — CI green on all 3 OSes
• 84a8854 feat(agent): daemon-side /remote/* endpoints for /qr pairing
• 5c1c9ad feat(api): add the /qr remote-control pairing relay
• 06ac00d feat(api): admin dashboard read APIs (stats, users, orgs, tunnels)
• f93f6f4 feat(api): admin dashboard store layer (fleet stats + directories)
• 61cde71 feat(api): expose /v1/geo + /v1/regions location endpoints
• b8f2a64 feat(api): tunnel history + usage-series handlers
• 1baf6b9 feat(api): tunnel-session history storage + report-tunnel RPC
• 7937d55 feat(api): upgrade approve.<base> console into a full admin dashboard
• 7f1e3fb feat(api): wire history + admin dashboard routes
• 3b2cfcb feat(dashboard): qr.<base> live viewer for /qr remote-control pairing
• 3c1c92b feat(desktop): PTY session backend via portable-pty
• b5315e7 feat(desktop): channel-strip redesign for the Tunnels screen
• 45fd18a feat(desktop): replace sidebar+card shell with activity rail, status bar, console-panel
• 46f782c feat(desktop): skeleton loading states for Account/Billing/Domains/Keys
• aa15f05 feat(desktop): wire the terminal panel into the activity rail and Ctrl+backtick
• 91a75e8 feat(desktop): xterm-based terminal panel with multi-session tabs
• a7c1bbe feat(edge): report tunnel open/close events for history
• 7e46b23 feat(edge): route qr.<base> to the dashboard upstream
• 55d9990 feat(geo): add IP->country resolver chain + edge region catalog
• 7ef22d8 feat(tui): repurpose /qr into phone pairing, with a laptop-only allow-list
• e21151e fix(agent): close two /qr pairing races found by a real end-to-end test
• 5c460e6 fix(cli): discard fmt.Fprint* return values to satisfy errcheck
• 53cc195 fix(cli): make /update check the CLI's own release train
• 1380ab6 fix(cli): make TestRemoveBinaryCacheSelf assert per-OS removal timing
• 65ade5e fix(cli): wait for the daemon to fully exit before deleting its log
• 270ed55 fix(desktop): align @tauri-apps/api/cli with the Rust tauri crate version
• 004586c refactor(desktop): extract InlineAlert, replace duplicated error-banner markup
• 3d7e58c style(desktop): align Inspector spacing to the console-panel system
• cb8ac3d style(desktop): declare deliberate radius + monospace token system
• bce45d3 style(desktop): restyle Domains/Keys/Billing/Account/Settings onto console panels

Changelog

• 8ebd52e feat(cli): branded, grouped help screen and version block
• cf7bbef feat(cli): interactive slash-command console (TUI)
• 84c9efa feat(cli): make the interactive console the only interface
• 95419d4 feat(cli/tui): a real color palette and a mascot with life
• 10570e8 feat(cli/tui): add /qr, /copy and /requests
• 48f268a feat(cli/tui): add a mascot and a three-column welcome banner
• b2ac52c feat(cli/tui): add the rest of the CLI as slash commands
• 141f1dc feat(cli/tui): grow the input box downward instead of scrolling sideways
• 9b5279f feat(cli/tui): make command results look designed, not plain
• 8eb3a0e feat(cli/tui): make the welcome banner and pinned panels width-responsive
• 1548f64 feat(cli/tui): redesign the console — boxed panels, welcome banner, history
• eed5082 feat(cli/tui): welcome shows your account and sits above the pins
• 8915630 feat(cli/ui): add terminal styling package (color, icons, spinner)
• 9a0e3d2 feat(packaging): rewrite npm/PyPI READMEs with real feature tour + visuals
• 76f831d fix(cli/tui): align the traffic method column and space stacked pins
• 930e6ab fix(cli/tui): raise the control-client timeout to 20s
• 7e47c8c refactor(cli): delete the dead plain-command code
• e8e8be2 refactor(cli): route background-tunnel and auth output through ui
• c1fb2a4 refactor(cli): route foreground/status/config output through ui
• 7a20eac style(cli/tui): drop the input-box background, keep just its border
• b07c6cb style(cli/tui): make panel and input backgrounds more visible

Changelog

• 918a3a3 deploy(edge): enable HTTP/3 ingress in the Helm edge DaemonSet
• 1b9ef99 deploy(edge): enable HTTP/3 ingress in the production compose stack
• 6d486f4 deploy(edge): open UDP 443 on the edge cloud firewall for HTTP/3
• 3c76678 docs(npm): correct the uninstall note — npm rm already removes the vendored binary
• c860f40 feat(ci): add standalone pypi-publish workflow, mirroring npm-publish
• 568c79d feat(cli): add --version/-v flag to the root command
• e58101c feat(edge): add TRQSH_H3_ADVERTISE_PORT for h3 behind a port map
• 94b487a feat(edge): add optional HTTP/3 (QUIC) ingress to beat HTTP/1.1 head-of-line blocking
• e95a7ac feat(edge): advertise HTTP/3 via Alt-Svc so browsers upgrade off HTTP/1.1
• a9bc35c feat(edge): serve HTTP/2 on the TCP ingress (opt-in via TRQSH_ENABLE_H2)
• afb1efb fix(cli): actually finish removing the pypi cache dir on trqsh uninstall
• 5259aee fix(edge): clamp unknown request length to 0 in HTTP usage accounting
• 0c72d22 fix(release): pin release.target_commitish so cross-repo publish can't hit an empty-repo 422 again

Changelog

• 214b159 feat(release): move CLI releases to their own repo, uzcreator/trqshcli
• ebca82d fix(ci): skip web/site drift check when the control API is unreachable

Changelog

• 7ad24dd chore(deps): bump next, postcss, sharp, js-yaml, and golang.org/x/{crypto,text,net}
• 25d7f37 feat(cli): implement real self-update for trqsh update
• 72b662d feat(ops): add container HEALTHCHECK to all 5 images
• 8937218 feat(release): keyless-sign checksums.txt with cosign/Sigstore
• f09e7c3 fix(ci): build golangci-lint from source, not a possibly-stale prebuilt release
• c11ba6c fix(ci): fix golangci-lint (56 errcheck/staticcheck) and a flaky race test
• 9a7e8de fix(cli): correct stale ~/.trqsh-uz config path in help text and docs
• b069fb8 fix(cli): reject non-http(s) URLs in openBrowser
• 4ef3e8a fix(cli): stop printing every error two or three times
• b75b4fd fix(deploy): add pod securityContext hardening to the Helm chart
• 655511b fix(deploy): fix Terraform CI failures — fmt alignment + cloudflare_load_balancer schema
• 0b2aced fix(deploy): harden Terraform — firewall, SSH keys, k8s auto-upgrade, bucket versioning
• 8cccbde fix(deploy): make the releases Spaces bucket private, document per-object ACL
• 03c9719 fix(install): resolve latest version dynamically instead of a hardcoded pin
• f8a3495 fix(npm): stop interpolating paths into a PowerShell -Command string
• 19ab170 fix(pypi): validate archive member paths before extracting (zip-slip)
• 457a707 fix(release): stamp Commit and BuildDate ldflags in goreleaser
• 7cea3e0 fix(security): resolve gosec + CodeQL log-injection findings
• a8d37e1 fix(server): send WWW-Authenticate so --basic-auth tunnels prompt in-browser
• 8d84d2a fix(web): CodeQL findings — temp file, sanitization, unvalidated fetches

Changelog

• 83c9592 chore(release): bump CLI wrapper packages to 0.1.5
• f8c084d chore(site): point desktop downloads at v0.3.1
• b63b030 docs(pypi): enrich the PyPI README — hook, badges, a Why trqsh section
• ba0ef0c fix(dashboard): add favicon (was missing, browser showed a generic icon)

Unsigned preview build. Windows SmartScreen may warn 'unknown publisher' — click More info then Run anyway. macOS: right-click → Open the first time.

Unsigned preview build. Windows SmartScreen may warn 'unknown publisher' — click More info then Run anyway. macOS: right-click → Open the first time.

Fixes: New-tunnel form input focus (Name/subdomain/basic-auth), working update check + on-launch update banner, background system tray (close hides to tray, tunnels keep running), inspector Clear now clears history, tunnel uptime survives reload, and the installer now stops the running agent so updates don't fail with a file-in-use error. Unsigned preview build — Windows SmartScreen may warn 'unknown publisher': click More info, then Run anyway. macOS: right-click the app, then Open the first time.

Unsigned preview build. Windows SmartScreen may warn 'unknown publisher' — click More info then Run anyway. macOS: right-click → Open the first time.

Unsigned preview build. Windows SmartScreen may warn 'unknown publisher' — click More info then Run anyway.

Changelog

• 1a8c622 docs(packaging): document uninstall, fix npm package name, bump to 0.1.4
• cfc2daf feat(cli): add uninstall command to clear local data

Changelog

• e237584 chore(ci): remove the unused Helm deploy.yml workflow
• 0eae605 chore(deploy): wire TRQSH_ADMIN_USER/PASSWORD into the api service
• 3312a31 chore(site): stop tracking the web/site TypeScript build cache
• e58c901 ci(gui): GOWORK=off so go build uses the gui module
• 595334a ci(gui): build the Go binary directly (go build -H windowsgui), skip wails3 task
• ca204e7 ci(gui): wails3 alpha.11 build takes no -tags/-clean flags
• a0ece8c ci: add manual gui-build workflow (Windows, unsigned)
• 301c839 docs(packaging): document new CLI commands, credit maintainer, bump to 0.1.3
• eee40ce feat(api): add an unauthenticated public plan catalog endpoint
• 83095ab feat(api): distributed rate limiting, Redis-backed OAuth/device login, /metrics
• c44234c feat(cli): browser login, account commands, and background tunnels
• ac15af3 feat(deploy): harden production deploy, add observability, prep multi-server infra
• a15cc35 feat(desktop): bundle the agent sidecar from a trqsh-uz/cli release
• fe8fb29 feat(desktop): native Tauri v2 app + agent daemon mode + cross-OS CI
• 1986e3a feat(desktop): operator-console redesign + Billing screen
• b85fa0c feat(desktop): real update check + on-launch update banner; fix New-tunnel dialog focus
• 1ec9218 feat(server): real cross-edge forwarding, shared Redis TLS storage, pooled proxy
• 5fbdf4c feat(site): 3D hero + carousel redesign, custom cursor, header cleanup
• 9244a0f feat(site): fetch pricing + OpenAPI over HTTP instead of local backend files
• 67c3e16 feat(site): point desktop downloads at v0.2.3
• fb9b154 feat(site): wire desktop downloads to the v0.2.0 Tauri installers
• 2e2d5fa feat: desktop control panel + OAuth, plan-expiry fix, manual upgrades
• 25de402 fix(api): include the rest of the previous commit's config/device-store changes
• 2bdd157 fix(api): restrict the admin console to approve.<base> in production
• 3b01ae7 fix(desktop): background tray, working inspector clear, persistent uptime, boot splash
• 9e38be0 fix(desktop): live traffic refresh, stop inspector with tunnel, app.trqsh.uz links
• 48c0393 fix(desktop): spawn the agent via std::process next to the app exe
• 5682259 fix(desktop): stop the agent before install/uninstall so updates don't fail
• b4bd253 fix(gui): port Wails shell to v3 alpha2.117 manager API
• 21c68d4 gui: bump wails/v3 alpha.11 -> alpha2.117 to match the code's API
• 7a1e007 gui: commit tidied go.mod + go.sum (full Wails v3 dep tree)
• cf0c19b perf(agent): pool local forwarding, stream bodies, weld upgrades, tune QUIC
• a587c8d release: fill scoop v0.1.2 windows SHA256 hashes
• 80eb1ab release: split downloads repo into cli + gui; site GUI-first

Changelog

• 10799f6 feat(api): OAuth callback sets shared session cookies and redirects to the dashboard
• bfca0b6 feat(auth): store OAuth avatar, harden CSRF state + domain-scoped logout, show avatar
• 7a10059 feat(dashboard): adopt the site's trqsh dark brand + add a responsive mobile nav
• 60557ee feat(edge): reverse-proxy app+api reserved hosts; deploy dashboard at app.trqsh.uz
• f428499 feat(npm): scope package as @trqsh-uz/trqsh + standalone publish workflow
• ae7b2db feat(site): editorial type system for trqsh.uz (Instrument Serif + Onest + JetBrains Mono)
• 385bc46 fix(api): read GitHub primary email from /user/emails when the profile hides it
• 5fb5c9c fix(dashboard): add public/ dir so the Docker build can COPY it
• 5041283 fix(dashboard): drop stray pnpm-workspace.yaml so pnpm 9 builds standalone
• 56d2154 fix(dashboard): use pnpm 9 so dependency build scripts (sharp) run
• ad7ccdb fix(edge): force HTTPS on reserved hosts; point the CLI at the prod edge
• 3021dc2 fix(site): CLI-first download page (drop GUI, add npm/pip, point at downloads release)
• 4136609 fix(site): robust hero z-layering, mobile height, animated hero text + typewriter logo
• 8cd6891 redesign(site): 3D tunnel hero, shorter layout, wordmark logo, system fonts
• 1398adf release: prep v0.1.2 packaging + real version stamp

Changelog

• ea06996 fix(release): split CLI/edge archives; bump to v0.1.1