See the screen of your machines

One click: Open screen

In Computers every machine of yours has an Open screen button. One click opens the live screen of that machine as a tab inside LogiShell, next to your files and sites, in the web app and in the desktop app alike. Nothing is installed for it: no VNC server, no Tailscale, no address to paste. The picture travels the same road as your terminal on that machine, directly when the machine is the one you sit at, through your LogiShell account otherwise.

• It is video, in the machine's own resolution. When LogiShell runs on that machine, the tab gets a video stream straight from it: the full screen (1920×1080 and up), up to 60 frames per second, encoded by the graphics card where there is one. Text in an editor stays sharp: on a slow network the picture drops frames first and keeps its sharpness. The stream goes directly between the two machines when the networks allow it, otherwise through a relay of Cloudflare. It is encrypted end to end, and only the person who connected the machine gets it. No Tailscale, no VNC, no second account.
• A machine without the desktop app (a server node, or an older LogiShell), and a Linux machine with GNOME on Wayland, where the app cannot film the screen without asking each time, shows its screen as a sequence of pictures instead, about 8 per second at 1280 pixels, in the same tab. Nothing to choose: the tab tries the video first and falls back by itself.
• The connection heals itself. If the network drops, the tab says "reconnecting" over the last picture and comes back on its own, usually in two or three seconds. No reload.
• Actual pixels. The button in the tab bar shows the screen one to one, so small text is never scaled; press it again to fit the window.
• It is a picture first. The mouse and keyboard stay with whoever sits at the machine until you press Control, see the next section.
• The machine shows its screen only while the tab is open. Close the tab, switch to another one, or hide the window, and the machine stops taking pictures. Come back, and the picture resumes.
• The corner of the tab says how live it is: resolution, frames per second, bitrate, the round trip in milliseconds, the road (direct, via TURN relay, or via Tailscale if you have it), the codec, and how the machine encodes (GPU or not). All of it is measured on your own road.
• The switch lives on the machine. Showing the screen is off until the person at that machine turns it on in LogiShell there: Settings, Devices, Show this machine's screen to my devices. Nothing in the browser can turn it on, and turning it off stops a picture that is already on screen. The same switch lets LOG look at the front window of that machine when you ask him.
• The machine asks. When you open the screen of a machine where showing is off, LogiShell on that machine asks whoever sits at it, Show this screen?, with one button, Allow: in the island at the top of the screen and as a notification. Your tab says it is waiting, and the picture appears by itself once they press Allow. Nobody there for two minutes, and the tab says sharing is off.
• On a Mac, permission is asked once, in our words first. The first time showing is turned on, LogiShell says that macOS is about to ask, and then macOS asks to let LogiShell record the screen. It happens right after your click, not in the middle of work when someone opens the tab.
• A machine without the app (a server node) has the same switch as a file: mkdir -p ~/.logishell && touch ~/.logishell/screen-on.
• A work machine never shows its screen to a personal account, whatever is set on it.

When the picture cannot come, the tab says why and what to press:

Video, measured on 20 October 2026 from a Windows 11 PC (RTX 4060 Ti) to a Mac on another network, Tailscale off on the Mac:

Pictures without the app, by system:

The numbers are from the machine to a viewer next to it. Through your account add the round trip of your network, which the corner of the tab shows.

Control: mouse, keyboard and clipboard over the video

Control in the bar of a video tab asks you once: *control this machine for this session? Press Start control*, and from then on your clicks, drags, right clicks, wheel and keys go to that machine through the same connection as the picture, so control is as smooth as the video.

• Click the picture to type. Keys go to the machine while the picture has focus; Shift+Esc gives the keyboard back (Esc alone goes to the machine, vim needs it). Letters arrive the way you typed them in your own layout, including any language; shortcuts such as Ctrl+C go by the physical key, and on a Mac Cmd works as Ctrl.
• Clipboard on purpose only. Send my clipboard puts your clipboard on the machine (paste there with Ctrl+V, in a terminal Shift+Insert); Copy from desk (or from machine) brings the machine's clipboard to yours. In a desk terminal, selecting text copies it. Nothing crosses without a press.
• The corner shows the input delay next to the video numbers: input RTT is the round trip to the machine over the same connection, input ack the time from your action until the machine says it happened.
• Stop control ends it; a dropped connection ends it too, and it never comes back by itself: the next session asks again.

Control works only when all of these hold, and the tab says in words which one is missing:

• it is your machine (the hub lets only the owner in);
• control is allowed on the machine itself: in LogiShell on that machine, Settings, Allow my devices to control this screen; on a server, in its own terminal, lsh desk control on (off revokes it and ends live sessions within a second);
• you approved this session with Start control;
• the machine is not in the work zone.

The machine writes every control session to its journal: who took control of which screen, when, for how long, and how many clicks, keys and clipboard transfers, never what was typed or where. On a real screen the person at the machine sees a bar Your screen is being controlled with Stop, and the Pause key stops control at once.

Where it works today: desks on any Linux machine with docker (the runner types with xdotool inside the desk). Windows machines (the runner types with SendInput), Linux machines with GNOME (the runner types through GNOME itself, over the picture stream) and Linux desktops with X11 and xdotool get it with the next desktop update; until then Control says the app there is too old and offers Control over pictures. A Mac cannot be controlled over the video yet.

Desks: a screen for a machine without one

A server has no screen. A desk gives it one: a container on that machine with its own display, a window manager, a terminal and a browser, shown in LogiShell through the same video stream as a real screen. The same thing is a sandbox: a throwaway desk for a task, which you remove when it is done.

On any Linux machine with docker and a current LogiShell runner:

lsh desk new            # a sandbox named desk-1, desk-2 ...
lsh desk new box --size 1920x1080
lsh desk ls
lsh desk open box       # the link that opens its screen in LogiShell
lsh desk rm box         # container, files and screen are gone

In Computers such a machine has a New desk button and a button per desk; each desk opens as its own screen tab. The desk named main is the screen of the machine itself, so Open screen on a server shows its desk.

• Isolated. Each desk is its own container on its own network: capped CPU (two cores) and memory (2 GB), no docker socket, no host network, none of the machine's secrets, all privileges dropped. The only thing it shares with the machine is the folder where the runner leaves the door to its screen.
• Two sandboxes per machine by default (LOGISHELL_DESK_MAX), because a server encodes video on its processor and shares its cores with other work.
• Video, not pictures. 1600×900 (or the size you ask for) at 30 frames per second, encoded on the processor, through the same direct or relayed road as a real screen.
• Fast after the first. The first desk after a runner update builds the desk image (a few minutes); every desk after it starts in about a second.
• Control included. Mouse, keyboard and clipboard work in a desk as in the section above, after lsh desk control on on that machine.

The VNC side road

A connected machine gives you terminals and agent sessions. Some work still needs the desktop itself: an installer with a window, a permission prompt, a browser that is signed in over there. This page puts the live desktop of that machine into a browser tab on your Mac or phone, and gives an agent a way to look at the same screen and press things on it.

It is built from parts that already exist (a VNC server, noVNC, Tailscale) and one installer of ours. It is a side road, and the page says where it ends: see what is not here before you put it on a machine.

What you need

Three things, and only the third is ours.

1. A machine with a desktop session and a VNC server on it. Which server depends on the system, see the table below. A server with no monitor and no graphical session has no screen to show: the page will open and stay empty. For that machine the road is the terminal, not the screen.
2. Tailscale on the machine and on every device you watch from, signed in to the same account. It is the only way in from outside.
3. Linux or WSL2 with systemd, where the installer runs. On Windows that is WSL on the same PC.

Only the first row has been run by us end to end, on one PC with Windows 11 and WSL2. The other rows are written from the documentation of those programs and wait for their first machine. If one of them does not match what you see, the page is wrong and we want to know.

Why not RDP on Windows: Windows Home cannot be an RDP host, and a road that fails on the first home PC is not a road.

On Windows, noVNC lives in WSL and reaches the VNC server through the WSL gateway. Allow incoming port 5900 in the Windows firewall from the WSL subnet only. Never forward port 5900 on your router.

Install with one command

On the Linux machine, or inside WSL, from a copy of the LogiShell repository:

sudo bash infra/remote-screen/install.sh --tailscale

The installer is four files in infra/remote-screen/. Today it runs from a checkout of the repository; it is not served from a public address yet.

What it does:

• installs git, python3 and venv through apt-get if they are missing;
• puts noVNC (pinned to a tag and a commit) and websockify into /opt/lsh-screen, in a python environment of their own, so system packages are not touched;
• starts a service, logishell-screen, that survives a reboot and listens on 127.0.0.1:6080 only;
• adds the command lsh-hands;
• with --tailscale, shows port 6080 to the devices of your own Tailscale network, and prints the address to open.

It does not install the VNC server (you did that in the step above), it does not touch the firewall, and it does not open a port to the internet.

Running it again is safe and keeps the earlier settings. Useful flags:

For a Mac, run the installer on a Linux machine in the same Tailscale network and name the Mac: --vnc-host <address of the Mac>.

When something is missing, the installer says so in words instead of failing halfway:

• No systemd. Nothing is installed. In WSL it is two lines in /etc/wsl.conf ([boot], systemd=true) and wsl --shutdown from Windows.
• --tailscale, but Tailscale is not installed or not signed in. The service is installed and works locally. Install Tailscale, run tailscale up, then run the installer with --tailscale again.
• The VNC server does not answer. The service is installed, and the last line tells you the page will stay empty until the server is on.

Open it from a Mac

Install Tailscale on the Mac and sign in with the same account. Then open:

http://<address of the machine in Tailscale>:6080/vnc.html?autoconnect=1&resize=scale

The installer prints this address at the end. It is also the output of tailscale ip -4 on the machine. The page asks for the VNC password, and then you see the desktop and can use the mouse and keyboard.

Open it from a phone

Install the Tailscale app, sign in with the same account, and open the same address in the phone browser. The on-screen keyboard and the extra keys (Ctrl, Alt, Tab, Esc) live in the side panel of noVNC.

Hands for an agent

lsh-hands is a small VNC client in one file. An agent that already has a shell on that machine (a LogiShell terminal, or ssh) uses it to look at the screen and act on it.

lsh-hands size                          # width and height of the screen in pixels
lsh-hands shot ~/shot.png --scale 2     # a frame, half size
lsh-hands click 640 360 --scale 2       # coordinates of a frame at the same scale
lsh-hands click 100 200 --button right
lsh-hands click 100 200 --double
lsh-hands move 100 200
lsh-hands scroll 640 360 3              # above zero is down
lsh-hands type "some text"
lsh-hands key ctrl+c                    # enter, alt+tab, win+d, f5 ...
lsh-hands latency                       # ms from a pointer move to the screen answering

The working order for an agent is always the same: take a frame, look at it, act once, take a frame again. Clicking twice without looking in between is how an agent ends up in the wrong window.

The VNC password comes from the environment, never from a file:

LSH_VNC_PASSWORD='<your VNC password>' lsh-hands shot ~/shot.png --scale 2

If you keep secrets in Doppler, --secret <name of the secret> at install time makes lsh-hands fetch the value at the moment of the call. Only the name is stored on the machine.

Security

• The page listens on 127.0.0.1 only. From outside the single way in is Tailscale, and only for devices signed in to your network. If your network has other people or guest devices in it, narrow its access rules to your own devices.
• A VNC password is weak protection: the classic sign-in uses the first eight characters, and the page travels over plain http. Both are acceptable inside the Tailscale tunnel and nowhere else. Do not expose the VNC port or port 6080 to the open internet, and do not forward them on a router.
• The password is not stored in a file by the installer.

What is not here

• No switch on the machine and no log. Whoever reaches the port and knows the password sees the screen and can press on it. Nothing records who pressed what.
• No work zone. LogiShell's privacy profiles do not know about this road. Do not install it on a work machine or a client's machine.
• No button in the product. The screen opens by address in a browser. The machine's card in Settings → Devices says nothing about it.
• No sound, and no smooth motion in the browser view, see below.

Speed and quality

Numbers from one machine of ours (Windows 11 with WSL2, RTX 4060 Ti), measured on 12 October 2026. They are a measurement, not a promise: your network decides yours.

Measure your own road with lsh-hands latency: six pointer moves, the time until the screen answers each, and the median.

This is enough to open a window, press a button and type a line. VNC sends pictures of the parts of the screen that changed, so anything that moves (scrolling, video, dragging a window) looks blurred and jumps. That is how the protocol works, not a setting to tune.

Two things that help before you reach for anything else:

• check tailscale status on the device you watch from. direct is the fast road; relay adds a hop through a Tailscale server;
• look at what the machine is doing. Under load the same road was three times slower for us.

When you need smooth video

For anything that moves, use a video stream next to the browser view, over the same Tailscale network: Sunshine on the machine and Moonlight on the Mac or phone. On the machine above this gave 1920x1080 at 60 frames per second, encoded as HEVC on the graphics card.

1. Install Sunshine on the machine with the desktop and set a login in its web page, which opens on the machine itself.
2. Install Moonlight on the Mac or the phone.
3. In Moonlight add the machine by its Tailscale address. Moonlight shows a PIN; type it into the Sunshine page to pair.
4. Pick the desktop in Moonlight.

Two things to know. On Windows, Sunshine runs in Windows itself, so Tailscale has to be installed in Windows as well as in WSL; on our PC both joined the network and both connected directly. And the portable build of Sunshine does not show the Windows sign-in screen or permission prompts: for those, the browser view is still the one that works.

Keep both. The browser view needs nothing installed on the watching device and is what lsh-hands talks to. The video stream is for your eyes.

Tailscale or a Cloudflare tunnel

For a screen, Tailscale is the fit: it is the shorter path and it carries the UDP that a video stream needs. A Cloudflare tunnel suits a web page you want to open from a device where you cannot install anything. If you do put the screen page behind a tunnel, put an access gate in front of it first: without one, an eight character VNC password is all that stands between the internet and your keyboard.

Tailscale's plans, as their site listed them on 12 October 2026: Personal is free. Signing in with a company domain counts as a business account, which gets a 14 day trial and then needs a plan (Standard was 8 dollars per user per month). Prices change, so read tailscale.com/pricing before you count on any of this.

Remove it

sudo bash infra/remote-screen/install.sh --uninstall

This removes the service, the lsh-hands command, /opt/lsh-screen, and the Tailscale road if the installer opened it. It leaves the VNC server alone, because you installed that.

What comes next in the product

The road LogiShell is building goes through the node you already paired, with no VNC and no second network to set up. What exists there now: one frame on request (Show screen on the machine's card in Settings → Devices) and the live picture (Open screen in Computers, described at the top of this page). Still ahead, with no date attached:

• hands for LOG, allowed by you for one session at a time;
• control of a Mac over the video.

The video stream of our own is here since 20 October 2026, and control over it since 21 October 2026: see the top of this page.

The design is written down in the repository: docs/superpowers/specs/2026-09-24-remote-control-design.md. When input and the stream are built, this side road is removed with the --uninstall command above.