trqsh 0.2.0

trqsh puts a public HTTPS URL in front of anything on your machine — a dev server, a webhook receiver, a game server, a raw TCP/UDP listener — in one command. It's a QUIC-first tunnel (real HTTP/3, not a rebrand of TCP) with a proper interactive console, live traffic inspection, real Let's Encrypt TLS, and a fully open-source stack you can self-host end to end. This package installs the signed trqsh CLI binary for your platform: a thin wrapper around a small Go binary, verified by SHA-256 on every install.

pip install trqsh
# or, isolated:
pipx install trqsh

trqsh login        # sign in through your browser
trqsh http 3000    # → a public HTTPS URL for localhost:3000

Why trqsh

• QUIC-first, TCP fallback — built on HTTP/3's transport from the ground up, not HTTP/1.1 with a marketing label; falls back automatically where UDP is blocked.
• Every protocol — http, tcp, and udp tunnels, not just HTTP.
• A real console, not a log spinner — /pin traffic, /pin status, and friends keep live panels on screen while you keep working, with command history, autocomplete, and a scrolling transcript. See below.
• Remote control from your phone — /qr pairs the console to a scanned QR: watch the live transcript and tunnels, or type commands back, from anywhere.
• Real TLS — Let's Encrypt via CertMagic, not a self-signed cert with a browser warning.
• Background tunnels (-d) that outlive your terminal, reserved subdomains, custom domains, and a live request inspector.
• Signed, verifiable releases — every download is checksummed and the checksum file itself is cosign-signed in CI (see Security below).
• Fully open source (Apache-2.0) — read every line, self-host the whole edge + control plane instead of trusting a black box.

The console

Bare trqsh (or trqsh http 3000) opens an interactive, slash-command console — type / to browse everything it can do, pin live panels above the prompt, and keep an eye on traffic without leaving the terminal:

Commands

Run /help inside the console for the full, current list.

Security

Every release archive ships with a checksums.txt that this package verifies before it ever execs the binary. The checksum file itself is keyless-signed with cosign via GitHub Actions' OIDC token — no key to leak, no key to trust blindly:

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/uzcreator/trqsh/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

How it works

The console script trqsh calls trqsh.ensure_binary(), which detects your OS (darwin/linux/windows) and CPU (amd64/arm64), downloads trqsh_<version>_<os>_<arch>.<ext> from https://github.com/uzcreator/trqshcli/releases, verifies its SHA-256 against checksums.txt, caches the binary under ~/.cache/trqsh/<version>/, and execs it. Pure standard library — no runtime dependencies.

Environment overrides

Uninstall

trqsh uninstall        # remove local data (config, key, cache) + stop tunnels
pip uninstall trqsh    # then remove the package itself

Run trqsh uninstall first: pip uninstall drops the package but leaves your saved key, control token, logs, and the cached binary under ~/.cache/trqsh/ behind — trqsh uninstall clears those and stops any background daemon. Add -y to skip the confirmation.

Links

Website · Source · CLI releases · Issues

Author

trqsh is created and maintained by Otabek Hamroqulov — GitHub @Hamroqulovv. Licensed Apache-2.0.