Set up and pair

Set up each computer once, then pair the Tatu app (get the app) or another terminal.

Inside Tatu, run:

/remote setup My Mac
/remote pair

The name after /remote setup is optional; without it, Tatu uses the hostname. Setup connects this session and makes later sessions connect automatically.

Pair a device

/remote pair shows a QR code valid for 60 seconds. The panel renews the code up to ten times while it stays open. Below it is the same invitation as a tatu://pair?... line. Press c to copy it.

The invitation holds a key that only the device and your computer have; the relay never gets it. As the last step of pairing the device proves it saw the invitation, and only then does your computer write it down as a device it trusts. From then on the device and the computer talk in encrypted boxes the relay cannot open.

In the app, choose Scan the QR code or Paste the invitation. Opening an invitation link asks Pair with <machine>? and names the relay before you confirm. A link never pairs by itself. Only confirm an invitation you just requested on your computer.

For a terminal, follow Another computer’s agents.

Invite a device that is not next to you

A /remote pair code lasts 60 seconds and pairs one device. For someone who will pair later, or for more than one device, make an invitation from a terminal on the computer. It needs no open session:

tatu remote invite -ttl 30d -uses 3 -label "tester"

It prints the tatu://pair?... line, and -qr also draws it as a QR code for a terminal with a dark background. The person pastes it in the app under Paste the invitation. The invitation pairs only while tatu daemon, or a Tatu session on that computer, is connected.

Make the invitation on the computer that the device will pair with: its key is kept in ~/.tatu/remote/invites.json there. An invitation made by an older Tatu has no key and is refused with a message that says to make a new one; close it with -cancel and make another.

Option	What it does
-ttl	How long the invitation can be used: 36h, 90m or 7d. Default 7d; the most is 30d.
-uses	How many devices can pair with it. Default 1; the most is 10.
-label	A name that shows in the list.
-qr	Also draw the invitation as a QR code.

If the limits are lower than what you asked for, the command says what you got. A computer has at most five open invitations; a sixth replaces the oldest.

tatu remote invites                # id, valid until, uses left, label
tatu remote invite -cancel <id>    # close one invitation; `all` closes every one
tatu remote devices                # paired devices and their short IDs
tatu remote revoke <id>            # unpair a device and cut off its access

They run in a plain terminal, so they suit a computer you reach over SSH. They exit with 2 and say what to do when the computer has no relay set up or has not started Tatu yet.

Closing an invitation does not unpair anyone

-cancel stops the next device from pairing, on your computer as well as at the relay. Devices that already used the invitation stay paired until you run tatu remote revoke <id>. Treat the line like a password while it is open: anyone who has it can pair.

Check or remove devices

• /remote status shows whether the session is connected, connecting or failed, with the reason when available.
• /remote devices lists paired devices and their short IDs. A device marked not trusted by this computer was paired before the encrypted channel: it has to pair again.
• /remote revoke <id> removes the device with that ID and cuts off its access. Your computer takes it out of its own list first, so it stops being let in even if the relay does not do its part.

Get the ID from /remote devices; you do not need to type the full key.

After updating from a version without the encrypted channel

Devices paired before are not carried over. Pair each one again with /remote pair, then remove the old entry with /remote revoke <id>.

Set TATU_REMOTE_E2E=0, or "e2e": false in ~/.tatu/remote/config.json, to go back to the old way, in the clear, for a device whose app is older. The relay can then read everything, and so can anyone who runs it. Use it only while you update.

Keep your computer’s identity

Keep ~/.tatu/remote/identity.json private and do not delete or replace it. All sessions on this computer share it. Losing it means pairing every device again. A damaged identity produces an error rather than being silently replaced. If you set TATU_HOME, the file is under that folder instead of ~/.tatu.

Notifications

The app receives push notifications when a question waits for you, a run finishes, or a run stops on an error or a limit. Interrupting a run sends no notification. A notification says Tatu on and your computer’s name, then what happened; it does not carry the session’s title, which stays encrypted. Tapping it opens the session.

On macOS, Tatu suppresses push if you used the keyboard or mouse in the last two minutes. To send notifications even then, start Tatu with:

TATU_REMOTE_PUSH_ALWAYS=1 tatu

Push notifications on Android have not been tried on a device.

See also

• Another computer’s agents
• The app
• Privacy: what leaves your machine