Show HN: Beam – Pairing machines with passkeys; replace SSH&VPN's with Tailcat

Run shells, commands and agents across the machines you own. beam connects your laptop, workstation and headless boxes with one passkey. Open a remote shell, run a build on another machine, or queue a durable message until it comes online. A single Go binary provides the daemon and CLI, with no SSH keys to manage or Tailscale account required. Built on Tailcat from Tailscale. Pair beam with tmux to keep an agent running on your workstation and attach from your laptop when you need it. The session, working directory and processes stay on the remote machine; beam gets you there. beam is part of notaharness, a project making small, reusable components for working with agents. The orchestra plugin is one way to use it: orchestra gives each agent a tmux session and a git worktree, with conventions for reporting to a supervising conversation. beam mandates no agent, orchestrator or program. Use it with those conventions, your own scripts, or an interactive shell. Pairing and privacy The Cloudflare worker at beam.n10.is is free for anyone to use for pairing their machines, for as long as its 10 GB D1 database has capacity. It serves the passkey ceremony page and an encrypted, append-only directory. Your machines' directory entries are encrypted with keys derived from your passkey. The worker stores ciphertext it cannot read. Shells, commands and messages travel between your machines over encrypted tunnels; the directory worker does not carry them. The trust model describes what the service can see and what you trust during a pairing ceremony. Install and quick start The implementation is a prototype. Install the npm package on each machine (macOS or Linux, arm64 or x64): npm install -g @notaharness/beam You also need a passkey with the WebAuthn PRF extension, which the browser, operating system and passkey provider must all support, and a browser with X25519 in Web Crypto: for example Apple Passwords with Safari on iOS 18.4 or later, or Firefox 139 or later on the desktop. The approval page says when the browser lacks X25519. A passkey without PRF fails the command with prf-unsupported, which lists what vendors document. On the first machine, create your fleet and its passkey: beam init --label laptop On the second, join using the same passkey: beam join --label buildbox After joining, compare the fleet xxxx xxxx xxxx xxxx fingerprint in the output with beam status on the first machine. They must match. If they differ, run beam fleet reset on the joining machine. The commands open a browser when the machine has one, and print the ceremony URL, with a QR code above it on a terminal. On a headless machine, scan the code with your phone and approve there; the result comes back through beam.n10.is, sealed to a key only the daemon holds. Anyone who scans the code can answer it too, so show it only where you alone can see it, and approve only a page that names the machine you are enrolling. The daemon starts when needed; beam peers shows whether the machines have connected. From the laptop: beam peers beam connect buildbox beam exec buildbox -- uname -a beam msg send buildbox --topic jobs 'ready' On buildbox, beam msg listen --topic jobs laptop receives messages from the laptop. Messages are queued durably when they cannot be delivered immediately. With tmux installed on buildbox, start or reattach an agent's session there: beam connect buildbox -- tmux new-session -A -s agents Run your agent inside that session. Detach from tmux and reconnect with the same command; the session stays on buildbox. See the CLI for grants, revocation, queue inspection and the other commands. Technical gist Each machine keeps a WireGuard node key; 128 bits of its hash form its peerId. The fleet's passkey signs membership entries and revocations directly as WebAuthn assertions. A get ceremony also evaluates the passkey's PRF, from which the daemon derives the directory encryption key and read token. Entries go into the worker's encrypted, append-only directory, read at join and daemon start. tailcat supplies NAT traversal and DERP relay without Tailscale's control plane: each machine runs a Server with its node key and dials through Clients with ephemeral keys. On first contact, the receiver verifies the signed entry and proof of possession of the node key it names, then admits and pins the peer. No directory request is needed per connection. TCP streams inside the tunnels carry pty, exec and durable msg envelopes; a local socket exposes them to the CLI and other programs. Revocations propagate over live peer connections and through the directory to machines that were offline. Documents Read in order. Each file owns one concern and cross-references the others. Report vulnerabilities privately: SECURITY.md. MIT, in LICENSE.