trqsh 0.2.1

trqsh puts a public HTTPS URL in front of anything on your machine — a dev server, a webhook receiver, a game server, a raw TCP/UDP listener — in one command. It's a QUIC-first tunnel (real HTTP/3, not a rebrand of TCP) with a proper interactive console, live traffic inspection, real Let's Encrypt TLS, and a fully open-source stack you can self-host end to end. This package installs the signed trqsh CLI binary for your platform: a thin wrapper around a small Go binary, verified by SHA-256 on every install.

pip install trqsh
# or, isolated:
pipx install trqsh

trqsh login        # sign in through your browser
trqsh http 3000    # → a public HTTPS URL for localhost:3000

Why trqsh

• QUIC-first, TCP fallback — built on HTTP/3's transport from the ground up, not HTTP/1.1 with a marketing label; falls back automatically where UDP is blocked.
• Every protocol — http, tcp, and udp tunnels, not just HTTP.
• A real console, not a log spinner — /pin traffic, /pin status, and friends keep live panels on screen while you keep working, with command history, autocomplete, and a scrolling transcript. See below.
• Remote control from your phone — /qr pairs the console to a scanned QR: watch the live transcript and tunnels, or type commands back, from anywhere.
• Real TLS — Let's Encrypt via CertMagic, not a self-signed cert with a browser warning.
• Background tunnels (-d) that outlive your terminal, reserved subdomains, custom domains, and a live request inspector.
• Signed, verifiable releases — every download is checksummed and the checksum file itself is cosign-signed in CI (see Security below).
• Fully open source (Apache-2.0) — read every line, self-host the whole edge + control plane instead of trusting a black box.

The console

Bare trqsh (or trqsh http 3000) opens an interactive, slash-command console — type / to browse everything it can do, pin live panels above the prompt, and keep an eye on traffic without leaving the terminal:

Commands

Run /help inside the console for the full, current list.

Security

Every release archive ships with a checksums.txt that this package verifies before it ever execs the binary. The checksum file itself is keyless-signed with cosign via GitHub Actions' OIDC token — no key to leak, no key to trust blindly:

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/uzcreator/trqsh/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

How it works

The console script trqsh calls trqsh.ensure_binary(), which detects your OS (darwin/linux/windows) and CPU (amd64/arm64), downloads trqsh_<version>_<os>_<arch>.<ext> from https://github.com/uzcreator/trqshcli/releases, verifies its SHA-256 against checksums.txt, caches the binary under ~/.cache/trqsh/<version>/, and execs it. Pure standard library — no runtime dependencies.

Troubleshooting: "'trqsh' is not recognized" on Windows

pip install trqsh without admin rights (the common case) installs the trqsh.exe launcher into a per-user Scripts folder that isn't always on PATH. Every trqsh invocation checks for this and fixes it automatically — but pip has no post-install hook, so the very first invocation can't (if PATH is broken, that first trqsh can't run at all to fix it). Run it once via the Python launcher, which is always on PATH:

python -m trqsh version
# then open a new terminal — bare `trqsh` now works

Environment overrides

Uninstall

trqsh uninstall        # remove local data (config, key, cache) + stop tunnels
pip uninstall trqsh    # then remove the package itself

Run trqsh uninstall first: pip uninstall drops the package but leaves your saved key, control token, logs, and the cached binary under ~/.cache/trqsh/ behind — trqsh uninstall clears those and stops any background daemon. Add -y to skip the confirmation.

Links

Website · Source · CLI releases · Issues

Author

trqsh is created and maintained by Otabek Hamroqulov — GitHub @Hamroqulovv. Licensed Apache-2.0.