Launched this week
tabsh
Work with agents with an IDE in your browser tab
109 followers
Work with agents with an IDE in your browser tab
109 followers
Most ADEs bring the browser into the IDE. tabsh takes the opposite approach: bring coding sessions to your browser, where your work already happens. It's a small Rust daemon that puts all your sessions across projects on one Kanban board/list, with status updates via agent hooks. Use real terminals or chat panels with Claude Code, Codex, Cursor CLI, OpenCode, and more. Free, MIT-licensed, macOS/Linux.
Free
Launch Team / Built With
CloudflareYour next app belongs on Cloudflare Workers. Deploy for free
Promoted
Maker here! My ADE was the last thing I kept ⌘-Tab-ing to. Issues, PRs, docs, design, and localhost were all in the browser. Why not bring the ADE there too?
tabsh is a small Rust daemon that brings all your coding-agent sessions into one browser board, across projects. Hooks update statuses automatically, including when an agent needs your input.
Everything runs locally. No account, no server, macOS and Linux.
Free, MIT-licensed. I'd love you to give it a try and fork it and make it your own.
how does the daemon guards localhost against DNS rebinding and cross-origin requests ? does the token check also validates Origin and Host headers, or what's planned next ?
@boutar_badii
Great question. All three are checked in one guard that wraps every route.
1. Host first, unconditionally:
only localhost, tabsh.localhost, or a literal IP is accepted. Anything else gets a 403. That is the DNS rebinding defence. A domain resolving to 127.0.0.1 still sends its own name in Host, so it is rejected before anything else runs.
2. Origin, when a browser sends one:
it must exactly match http:// (the page we served) or the allowlisted hosted origin (tabsh.cc, replaceable via TABSH_ORIGINS). Anything else is a 403, even with a valid token.
3. Token, separately:
with an Origin present, a valid token is still required (401 without one). It is compared in constant time and stored 0600.
@blaise_tiong2 would a request without an origin header still require a token ? ex: curl or local processes do not usually send that header ?
@boutar_badii Yes, requests without an Origin header (e.g. curl or local processes) still require a valid token for all API endpoints, even over localhost.
I like the inversion here: instead of dragging the browser into the IDE, you bring the sessions to the browser where issues, PRs, and docs already live. A single Kanban view across projects sounds like the real win when several agents are running at once. How well do the hook-based status updates hold up when a session stalls or waits on a question, is that state obvious at a glance?
@jcbuilds When it waits on a question it will send the session to "Needs Input" stage if the hooks are setup correctly.
You will find yourself focusing more on the "Needs Input" stage as well as "Completed" stage to verify the agent's work.
Do sessions started outside tabsh show up on the board too, like a headless claude -p run from cron? The hooks fire either way I guess, and that's the session I'd most want to see since nobody is watching it
Across several projects, I'd want sessions waiting on me to be the first thing I see. Hook-based status updates seem a useful way to keep that view current.
The cross-project board is the useful inversion here. One status I'd make first-class is "stopped vs verified": a session can exit cleanly while its tests never ran, or pass and then have the tree change. If hooks can carry the verifier command, exit code, and final tree state into the card, the board becomes a review queue instead of just a session monitor.
@keesan12 That is an interesting suggestion ! I would need to see how we could incorporate your idea here. Thanks again for suggesting.