Share · TDE Docs

Documentación

Exposing a session over loopback, Tailscale or a public URL.

En esta página

Overview

Web Share puts a running TDE in a browser — your phone, a tablet, someone else's laptop. tde share is the deterministic way to turn it on, read its state, fetch the URL and turn it off again, without touching the desktop UI.

This page is the command reference. For what Web Share actually is, how the browser client behaves and what a reach setting means for your network, read Web Share overview.

bash

tde share start local
tde share url
tde share stop

tde share is part of the semantic CLI, so --json and the standard envelope apply.

Commands

text

tde share start local|tailnet|public
tde share start --reach local|tailnet|public
tde share status
tde share url
tde share stop

Command	Result
`start REACH`	Starts Web Share at the given reach and returns the session, including its URL.
`status`	Returns state, reach and start time — never the URL.
`url`	Returns the owner URL. This is the only command that discloses it.
`stop`	Stops the share. Stopping an already-stopped share succeeds.

status, url and stop take no arguments at all; a stray word or flag is a usage error.

start requires a reach. Omitting it is a missing_argument error rather than a silent default. The reach can be given positionally or through the compatibility flag --reach, but not both — supplying it twice is a duplicate_option error.

Reach values

CLI value	Binds to	Who can reach it
`local`	Loopback only	Nothing outside this machine.
`tailnet`	Tailscale interface	Devices on your private tailnet.
`public`	Tailscale Funnel	Anyone on the internet with the URL.

public depends on a working Tailscale Funnel on the host. When the funnel is not available the start fails with a typed error instead of silently downgrading to a narrower reach.

The CLI exposes three of four reach modes

Web Share itself has four reach modes — loopback, LAN, Tailscale and public — and LAN is the default used by the desktop's Control panel. The deterministic CLI intentionally exposes only three, and its local maps to loopback, not LAN.

The practical consequences:

tde share start local is stricter than starting a share from the desktop with default settings. Loopback binds only to 127.0.0.1; LAN binds 0.0.0.0 and is reachable from other machines on your network.
There is no CLI value that selects LAN. To use LAN, start the share from the desktop's Control panel or set the reach there.
tde share status can therefore report "reach": "lan" — a value that tde share start will not accept as input. That is not a bug in the status output; it is the fourth mode showing through a three-value input grammar.

Reading the state

bash

tde share status
tde --json share status

Human output prints the state, or the URL when the command is url. The JSON envelope's data carries the full record:

json

{"ok":true,"message":"running","data":{"share":{"state":"running","url":null,"reach":"local","started_at":"…"}}}

url is null in status by construction — the server nulls the field before it leaves the Runtime, so it is not merely hidden in the human formatting.

The agent socket equivalent

A running desktop exposes the same four operations over its owner-only control socket, for agents driving TDE from inside:

bash

tde agent web-share start tailnet
tde agent web-share status
tde agent web-share url
tde agent web-share stop

These accept exactly the same three reach names and keep the same URL-disclosure rule: status never returns the URL, url does. See the Agent API for the transport and the rest of the verbs.