{"slug": "open-session", "title": "Open Session", "summary": "Open Session, a self-hosted agent-infrastructure server from Tellah, lets users run coding sessions through the Pi engine in git worktrees or isolated sandboxes, with support for multiple Codex and Claude subscriptions and model APIs. The server, which runs on Linux, macOS, or WSL2, can be installed via a curl command and includes a web UI plus Slack, Linear, Plain, and GitHub agents. The installer verifies release archives against SHA-256 sidecars and GitHub keyless build provenance, and the recommended setup adds Tailscale, Caddy, and lego for HTTPS or custom domains.", "body_md": "Self-hosted agent-infrastructure server: a web UI plus Slack, Linear, Plain, and GitHub agents, driving coding sessions through the Pi engine in git worktrees on your own box, or in isolated sandboxes. Supports multiple Codex and Claude subscriptions and model APIs.\n\n*More: pull-request review, diffs, automations, mobile →*\n\nRun this on Linux, macOS, or inside WSL2 on Windows. The server does not run\ndirectly from PowerShell; follow the\n[Windows WSL2 setup](/tellahq/opensession/blob/main/docs/setup/install.md#windows-run-the-server-in-wsl2)\nfirst.\n\n```\ncurl -fsSL https://raw.githubusercontent.com/tellahq/opensession/main/install.sh | bash\n```\n\nThe recommended install also adds Tailscale, Caddy and the lego certificate helper so the private app can use HTTPS or a friendly custom domain.\n\n```\ncurl -fsSL https://raw.githubusercontent.com/tellahq/opensession/main/install.sh | bash -s -- --tailscale --caddy\n```\n\nFor public ingress through Cloudflare Tunnel instead of Tailscale, `--cloudflare`\n\ninstalls\n`cloudflared`\n\n. Finish configuring either option under Settings → Domains and\ningress.\n\n```\ncurl -fsSL https://raw.githubusercontent.com/tellahq/opensession/main/install.sh | bash -s -- --cloudflare\n```\n\nAlready installed Open Session? You do not need to reinstall it. Follow [Add\nTailscale after a normal\ninstall](/tellahq/opensession/blob/main/docs/setup/install.md#add-tailscale-after-a-normal-install).\n\nOn a fresh box this downloads the compiled release for your OS and\narchitecture, unpacks it under `~/.opensession`\n\n, installs the `claude`\n\nCLI,\nputs an `opensession`\n\ncommand on your `PATH`\n\n, writes a default configuration,\nand installs and starts a per-user service (a LaunchAgent on macOS, a `systemd --user`\n\nunit on Linux). No questions. The last line it prints is a local URL,\nby default [http://127.0.0.1:3850](http://127.0.0.1:3850). Budget 5 to 15 minutes, mostly unattended\ndownload.\n\nOpen the URL, add a model account in Workspace → Providers, pick a repo, write\na prompt, and create the session. A turn that actually runs is the proof the\ninstall works, not a health check. Connect your GitHub account later from\nSettings → Connections. Configure Slack, Linear, Plain, GitHub agent intake,\nand other integrations under Settings → Integrations; see\n[docs/setup/github.md](/tellahq/opensession/blob/main/docs/setup/github.md).\n\nCheck on it any time:\n\n```\nopensession doctor     # verify the install and report engine readiness\nopensession status     # is the service up?\nopensession update     # upgrade in place, health-gated\nopensession --help     # everything else\n```\n\nThe installer and updater verify each Open Session release archive against its published SHA-256 sidecar before extracting it. GitHub also signs keyless build provenance for every release archive, DMG, and ZIP. To verify a manually downloaded artifact:\n\n```\ngh attestation verify ./opensession-linux-x64.tar.gz --repo tellahq/opensession\nsha256sum --check ./opensession-linux-x64.tar.gz.sha256\n```\n\nUse `shasum -a 256 -c`\n\ninstead of `sha256sum --check`\n\non macOS.\n\nOr install from a source checkout instead. This is the path for self-development (sessions that modify Open Session itself) and for contributing:\n\n```\ngit clone https://github.com/tellahq/opensession.git\ncd opensession && bun install\nbun run setup                             # interactive onboarding\n```\n\n`bun run setup`\n\nruns the interactive onboarding wizard, writes the\nconfiguration, and offers to install and start a user service. For unattended\ndefaults, run `bun scripts/cli.ts onboard --defaults`\n\n. Run\n`bun scripts/cli.ts --help`\n\nfor CLI commands. Options such as `--source`\n\n,\n`--dir`\n\n, `--channel`\n\n, `--tailscale`\n\n, and `--no-engine`\n\nbelong to `install.sh`\n\n;\nrun `bash install.sh --help`\n\nfor the complete installer list. A source checkout\nrequires Bun and git.\n\nLetting the agent improve Open Session itself? Clone your fork, not this repo. Self-sessions commit and push to\n\n`origin`\n\n, and`deploy_self`\n\nadvances the pinned runtime to a descendant commit from it. Pointed at`tellahq/opensession`\n\n, every push is rejected. Fork, clone the fork, and keep us as an`upstream`\n\nremote. Config-only use (your repos, your integrations) needs no fork.\n\nAuthentication is available, and it is opt-in. By default, Open Session trusts everyone who can reach the address it binds to. GitHub sign-in can restrict access to configured team members. Keep the server on Tailscale, a private network, or behind an SSH tunnel even when sign-in is enabled. See the\n\n[trust model]and[networking.md].\n\n[CONCEPTS.md](/tellahq/opensession/blob/main/CONCEPTS.md)— projects, workspaces, chats, automations, goals[docs/setup/](/tellahq/opensession/blob/main/docs/setup/README.md)— overview, requirements, trust model[docs/setup/install.md](/tellahq/opensession/blob/main/docs/setup/install.md)— bare box → running service[docs/setup/ec2.md](/tellahq/opensession/blob/main/docs/setup/ec2.md)— provisioning a clean EC2 box[docs/setup/networking.md](/tellahq/opensession/blob/main/docs/setup/networking.md)— private team access, public callbacks, domains, and TLS[CLIENTS.md](/tellahq/opensession/blob/main/CLIENTS.md)— web UI, PWA, desktop shell, native app, extension[docs/worktrees.md](/tellahq/opensession/blob/main/docs/worktrees.md)— how sessions map to git worktrees, and where the disk goes[docs/repo-lifecycle.md](/tellahq/opensession/blob/main/docs/repo-lifecycle.md)— the`.agents/`\n\nlifecycle scripts a repo commits so sessions provision and boot it themselves[docs/extending.md](/tellahq/opensession/blob/main/docs/extending.md)— adding tools, recipes, integrations and providers[docs/security-model.md](/tellahq/opensession/blob/main/docs/security-model.md)— least-privilege automations, per-user MCP/GitHub scoping, self-management boundaries[docs/self-hosting-sandboxes.md](/tellahq/opensession/blob/main/docs/self-hosting-sandboxes.md)— certified Docker, Daytona, Box, Modal, and local Firecracker MicroVM sandboxes; implemented E2B and AWS Lambda MicroVM adapters remain unavailable until live-certified[docs/instance-configuration.md](/tellahq/opensession/blob/main/docs/instance-configuration.md)— repos, identity, branding, integrations, deployment policy\n\nOne server, five front ends — only the web UI is required, and everything else\ntalks to the same instance. [CLIENTS.md](/tellahq/opensession/blob/main/CLIENTS.md) has the full tour.\n\n| Client | Where |\n|---|---|\n| Web UI | served by the server itself — start here |\n| PWA | the web UI on your phone's home screen (iOS push notifications require the installed PWA and an HTTPS origin) |\n| macOS desktop shell (Electron) |\n`packages/clients/mac/` |\n\n`packages/clients/ios/`\n\n`packages/clients/chrome/`\n\nEverything company-specific is instance configuration, not source — branding,\nthe agent's name and persona, your repositories, integrations, automations\n([docs/instance-configuration.md](/tellahq/opensession/blob/main/docs/instance-configuration.md)). Point a\nstock install at your config and it becomes your company's agent server. No\nfork needed for that.\n\nForking is welcome — recommended, even — when you want to change what it *is*,\nnot just whose it is: strip the integrations you'll never use, rebrand the\nclient apps to your own bundle ids, hard-code opinions we left configurable.\nIt's MIT, so you owe nothing but the license notice.\n\nProduct code lives under `packages/`\n\n:\n\n`packages/core/opensession-server/`\n\n— Bun server, web client, runner host`packages/core/protocol/`\n\n— shared wire and record contracts`packages/clients/`\n\n— Chrome, native Swift, Electron, and website clients\n\nRepository-level scripts, deployment files, documentation, the workspace manifest, and the lockfile stay at the root.\n\nWe take contributions as human-written text, not code — see\n[CONTRIBUTING.md](/tellahq/opensession/blob/main/CONTRIBUTING.md). Open a\n[GitHub issue](https://github.com/tellahq/opensession/issues) describing the\nchange you'd like — a prompt or suggestion in plain language is exactly the\nright shape — and if we're aligned we'll handle the implementation. Report\nvulnerabilities privately — see [SECURITY.md](/tellahq/opensession/blob/main/SECURITY.md), not a public\nissue.\n\n[MIT License](/tellahq/opensession/blob/main/LICENSE). Use it, fork it, run it commercially, build on\nit — the only obligation is keeping the copyright and permission notice.\nContributions are accepted under the same license.", "url": "https://wpnews.pro/news/open-session", "canonical_source": "https://github.com/tellahq/opensession", "published_at": "2026-08-28 02:08:24+00:00", "updated_at": "2026-08-28 02:48:27.253931+00:00", "lang": "en", "topics": ["ai-infrastructure", "ai-agents", "developer-tools"], "entities": ["Open Session", "Tellah", "Pi", "Codex", "Claude", "Slack", "Linear", "Plain"], "alternates": {"html": "https://wpnews.pro/news/open-session", "markdown": "https://wpnews.pro/news/open-session.md", "text": "https://wpnews.pro/news/open-session.txt", "jsonld": "https://wpnews.pro/news/open-session.jsonld"}}