Rune

Rune is an encrypted terminal chat application built with Python and Textual. It provides a terminal user interface for creating or joining a two-person chat room through a relay server while keeping chat message contents end-to-end encrypted between the two clients.

The project goal is to make private peer-to-peer style messaging usable from the terminal. The relay server coordinates connections, invite codes, room pairing, and encrypted payload forwarding, but it does not receive plaintext chat messages or private keys.

Prerequisites

Rune requires:

• Python 3.13 or newer
• A terminal that can run Textual applications
• pip for normal installation
• uv for local development workflows

The application depends on Textual for the TUI, PyNaCl for client-side encryption, and cachetools for relay invite expiration behavior.

Install

Install the published package from PyPI:

pip install rune-chat

After installation, launch the client TUI with:

rune

Launch the relay server TUI with:

rune server

You can also pass server options:

rune server --host localhost --port 5001 --invite-code-ttl-seconds 300

Basic Usage

Start the relay server first:

rune server

Then start two client terminals:

rune

In the first client, connect to the relay and create a room:

/connect
/create

Share the generated invite code with the second client. In the second client:

/connect
/join

The /join command opens a modal where the invite code can be entered.

Developer Notes

Install development dependencies with uv:

uv sync --dev

Run the client in development:

make run

Run the server in development:

make server

Run the client with Textual dev tooling:

make client-dev

Run the server with Textual dev tooling:

make server-dev

Open the Textual console:

make dev-console

Run tests:

make test

Run linting:

make lint

Format code:

make format

Apply automatic lint fixes and formatting:

make fix

Build the package:

make build

Security Model

Rune uses fresh temporary PyNaCl key pairs for each chat session. Public keys are exchanged through the relay as part of invite creation and joining. Private keys remain in memory on each client and are not written to disk.

Chat messages are encrypted locally before being sent to the relay. The relay forwards only encrypted payloads containing ciphertext and nonces. It can still observe metadata such as connection timing, invite usage, payload size, and room pairing state.