Remote Shell Guide

SSH-like remote access using amesh device identity. No SSH keys, no authorized_keys, instant revocation.

Install

Two binaries: amesh for the controller (your laptop), amesh-agent for the server.

Your laptop (controller)
brew install ameshdev/tap/amesh
Server (target)
brew install ameshdev/tap/amesh

Setup

Three steps: pair the devices (if not already), grant shell access, start the agent.

1. Pair devices (skip if already paired)

# On the target (server)
amesh listen

# On the controller (your laptop)
amesh invite 482916

2. Grant shell permission

# On the target — grant shell access to the controller
amesh grant am_3d9f1a2e --shell

# Verify
amesh list
# Shows: am_3d9f1a2e  alice-macbook  [controller] [shell]  added 2026-04-03

Shell access is opt-in. Pairing for HTTP API auth does not automatically grant shell access.

3. Start the agent

# On the target (server) — start the agent daemon
amesh-agent agent start

# Or with options
amesh-agent agent start --relay wss://relay.authmesh.dev/ws --idle-timeout 60

Note the binary name: controller commands run through amesh; the agent daemon runs through amesh-agent. They are separate packages (@authmesh/cli and @authmesh/agent), but brew install ameshdev/tap/amesh installs both.

Platform Support

The amesh-agent daemon ships as a prebuilt binary on all supported platforms — no runtime install needed.

PlatformInstall viaNotes
macOS (arm64)Homebrew · npm · tarballApple Silicon; uses Secure Enclave when signed
macOS (x64)Homebrew · npm · tarballIntel macs; falls back to Keychain
Linux (x64)Homebrew · npm · tarball · .debMost cloud VMs; uses TPM 2.0 when available
Linux (arm64)Homebrew · npm · tarballRaspberry Pi 4/5 on 64-bit Pi OS, Ampere, Graviton
Linux (armv7, 32-bit)Bun wrapper onlyRaspberry Pi 3 and earlier — see note below

Linux armv7 (Raspberry Pi 3 and earlier): Bun does not ship for 32-bit ARM. If you must run the agent on these devices, install Bun manually (if a third-party build is available for your arch) and run as bun $(which amesh-agent) agent start. Everything else (Pi 4/5 on 64-bit Pi OS, all modern ARM servers) is supported out of the box.

Usage

Interactive shell

$ amesh shell prod-api
  Connecting to prod-api (am_7f2e8a1b)...
  Connected. Shell session started.

user@prod-api:~$ whoami
user
user@prod-api:~$ exit
  Session closed (exit code 0, duration 2m 14s).

Single command

$ amesh shell prod-api -c "df -h"
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        50G   12G   35G  26% /

Security Model

End-to-end encrypted
ChaCha20-Poly1305 with per-session ephemeral ECDH keys. The relay forwards opaque blobs — it cannot read shell content.
Perfect forward secrecy
Each shell session generates new ephemeral P-256 keys. Compromising a session key does not affect past or future sessions.
Device-ID-bound session keys
Session keys are derived via HKDF with both device IDs baked in. A session key is only valid between the two intended parties.
Explicit shell permission
Pairing for API auth does not grant shell access. Shell requires amesh grant --shell.
No root by default
The agent refuses to run as root unless --allow-root is passed. The spawned shell inherits the agent's user permissions.

Environment Variables

AUTH_MESH_DIR
Directory for identity and keys Default: ~/.amesh/
AUTH_MESH_PASSPHRASE
Supply the encrypted-file backend passphrase at runtime — preferred for production so the secret never touches disk Default: optional
AMESH_PASSPHRASE_FILE
Relocate the persisted passphrase file (default ~/.amesh/.passphrase, mode 0400) Default: optional
AMESH_RELAY_URL
WebSocket relay URL Default: wss://relay.authmesh.dev/ws

Troubleshooting

"Shell access not granted for this device"
The controller is paired but doesn't have shell permission. Run amesh grant <device-id> --shell on the target.
"Handshake failed" / connection timeout
The agent is not running on the target. Start it with amesh-agent agent start and verify the relay is reachable from both sides.
"The agent daemon requires Bun runtime for PTY support" (armv7 only)
You're on an unsupported architecture (typically Raspberry Pi 3 or earlier, 32-bit Pi OS). The postinstall couldn't find a prebuilt binary for your arch and fell back to the JS entry, which needs Bun for PTY. If a Bun build exists for your arch, install it and run as bun $(which amesh-agent) agent start. On supported architectures (macOS arm64/x64, Linux x64/arm64) this error should not appear — if it does, see the Troubleshooting page for the full diagnostic flow.
"Refusing to run as root"
The agent defaults to non-root. Use --allow-root if you understand the risk (grants root shells to all controllers).