server

cmd/teachatty-server. Listens on port 7347, keeps rooms in memory, relays each message to the other members of the room.

client

cmd/teachatty. In a terminal, it opens the full screen: messages on top, input box at the bottom. In a pipe (command | teachatty), it sends each line and exits.

room

Any name. Joining a room that doesn't exist creates it; when the last member leaves, it stops existing. The exception is local, the default room: it starts with the server and exists as long as it runs. Anyone who doesn't pick a room lands there.

alias

The name in front of your messages: daniel: hi. Defaults to your system user. Not verified.

message

One line of text. It only goes to whoever is in the room at that moment: there's no history.

Install

Packages for Debian/Ubuntu (.deb) and Fedora/RHEL (.rpm), for amd64 and arm64, plus Linux and macOS tarballs and checksums.txt, are at teachatty.com/downloads. The latest names always point to the newest release, currently v0.1.0 (changelog). The packages include man pages: man teachatty and man teachatty-server.

The client (teachatty), what everyone needs:

# Debian, Ubuntu, Mint
curl -LO https://teachatty.com/downloads/teachatty_latest_amd64.deb
sudo apt install ./teachatty_latest_amd64.deb

# Fedora, RHEL, Rocky, Alma
sudo dnf install https://teachatty.com/downloads/teachatty-latest.x86_64.rpm

# anywhere with Go 1.26+
go install github.com/daniel-cmdline/teachatty/cmd/teachatty@latest

The server (teachatty-server), only to host your own rooms. The packages also install the systemd service (see as a service):

# Debian, Ubuntu, Mint
curl -LO https://teachatty.com/downloads/teachatty-server_latest_amd64.deb
sudo apt install ./teachatty-server_latest_amd64.deb

# Fedora, RHEL, Rocky, Alma
sudo dnf install https://teachatty.com/downloads/teachatty-server-latest.x86_64.rpm

# anywhere with Go 1.26+
go install github.com/daniel-cmdline/teachatty/cmd/teachatty-server@latest

Try the public server

A public teachatty server runs at teachatty.com. Without a port, the client uses 7347. With no --room, you land in local, the lobby everyone shares. To meet friends, make up a room name and send them the same command: the room appears when the first person joins. Rooms have no passwords yet, so pick a name that's hard to guess. Pipe mode is turned off on the public server (--no-pipes).

teachatty --server teachatty.com
teachatty --server teachatty.com --room tea-with-friends

Run from source

git clone https://github.com/daniel-cmdline/teachatty.git
cd teachatty

# server
go run ./cmd/teachatty-server
# teachatty-server listening on :7347 · default room: local · TLS · fingerprint SHA256:...

# client, in another terminal: no flags, joins the local room
go run ./cmd/teachatty
# * trusting new server localhost:7347 (fingerprint SHA256:...), saved in ~/.config/teachatty/known_servers

# help, on both
go run ./cmd/teachatty -h
go run ./cmd/teachatty-server -h

Another machine on the network

Point the client at the server's address and make sure port 7347 is open in its firewall:

go run ./cmd/teachatty --server 192.168.0.10:7347

To use another port, or listen on a single interface, the server has --addr. The client points at the same address with --server:

go run ./cmd/teachatty-server --addr :9000
go run ./cmd/teachatty --server 192.168.0.10:9000

Install or build the binaries

The folders are named after the binaries, so go install and go build produce teachatty and teachatty-server:

go install github.com/daniel-cmdline/teachatty/cmd/teachatty@latest
go install github.com/daniel-cmdline/teachatty/cmd/teachatty-server@latest

# or, from a clone
go build ./cmd/teachatty
go build ./cmd/teachatty-server

./teachatty-server
./teachatty --room dev --alias daniel

Run the server as a service

The easiest way is the teachatty-server package: it installs the binary, a hardened systemd unit, the teachatty system user and the certbot hook. Flags go in /etc/default/teachatty-server, which upgrades never overwrite:

curl -LO https://teachatty.com/downloads/teachatty-server_latest_amd64.deb
sudo apt install ./teachatty-server_latest_amd64.deb
# or: sudo dnf install https://teachatty.com/downloads/teachatty-server-latest.x86_64.rpm

# with a domain: Let's Encrypt, then point TEACHATTY_SERVER_ARGS at the copied files
sudo certbot certonly --standalone -d chat.example.com \
  --deploy-hook /usr/share/teachatty-server/teachatty-deploy-hook.sh
sudoedit /etc/default/teachatty-server

sudo systemctl enable --now teachatty-server
journalctl -u teachatty-server -f      # logs, including the fingerprint

Without the package, the repo ships the same unit and hook in contrib/. The server then starts on boot, restarts if it crashes, logs to the journal and runs as its own unprivileged user.

# 1. a system user for the server, and the binary
sudo useradd --system --home /var/lib/teachatty --shell /usr/sbin/nologin teachatty
go install github.com/daniel-cmdline/teachatty/cmd/teachatty-server@latest
sudo install -m 0755 ~/go/bin/teachatty-server /usr/local/bin/

# 2. the service (from contrib/systemd/)
sudo cp contrib/systemd/teachatty-server.service /etc/systemd/system/

# 3a. with a domain: Let's Encrypt + the deploy hook (from contrib/certbot/)
sudo install -D -m 0755 contrib/certbot/teachatty-deploy-hook.sh /usr/local/lib/teachatty/teachatty-deploy-hook.sh
sudo certbot certonly --standalone -d chat.example.com \
  --deploy-hook /usr/local/lib/teachatty/teachatty-deploy-hook.sh

# 3b. without a domain: edit the service and switch to the plain ExecStart line
#     (self-signed certificate, created on first start)

# 4. start it, now and on every boot
sudo systemctl daemon-reload
sudo systemctl enable --now teachatty-server
journalctl -u teachatty-server -f      # logs, including the fingerprint

the hook

Let's Encrypt's privkey.pem is readable only by root. After every renewal, certbot runs the hook as root, and it copies the certificate and key into /var/lib/teachatty/tls/, owned by the teachatty user: the key first, then the certificate, so the server never loads a mismatched pair. The server notices the new files and reloads them by itself, so renewals don't disconnect anyone.

the unit

Restarts on failure, keeps its files in /var/lib/teachatty (StateDirectory, with XDG_CONFIG_HOME=/var/lib), and is locked down: no capabilities at all (port 7347 is above 1024), a read-only system (ProtectSystem=strict), no access to home directories, a private /tmp, no new privileges, only network sockets.

ports

7347/TCP for teachatty. For certbot --standalone, port 80 must be reachable while the certificate is issued and renewed.

Flags

Keys

Behavior

your message

Shows on your screen as alias: text, written by the client itself. The server doesn't echo a message back to its sender.

input box

Shows type a message… while empty. Grows from 1 to 5 lines with the text and breaks lines at any character. Above 5 lines, it scrolls inside.

mentions

When someone writes @yourname (whole word, any case), the message shows in amber and bold, and the terminal bell rings: a terminal in another tab or window gets your attention. email@yourname.com doesn't count.

joining

A welcome banner with the teacup: the server and room, how the connection is secured (TLS version and the start of the fingerprint), and the keys. The first-use trust notice, if any, comes right after it.

message area

The title is room · alias, in amber; borders are mint, on your terminal's own background. Each message starts with the time it arrived (15:38, gray). Each alias has a fixed color, the same on every client; yours is bold on the messages you sent. Long lines wrap between words. No mouse: selecting and copying text works like in any terminal.

no terminal

If stdin isn't a terminal, the client goes into pipe mode instead of opening the screen.

Output and exit codes

In full screen, the terminal is always restored before the message appears.

Pipe mode

When stdin isn't a terminal, the client doesn't open the screen. It sends the input to the room, echoes each line to your terminal (like tee) and exits when the input ends.

make 2>&1 | teachatty --room ops              # the build output goes to the room
uptime | teachatty --room ops                  # one line, then exit
tail -f /var/log/app.log | teachatty --room ops   # streams until Ctrl+C

batched

Lines that arrive within 100 ms of each other go out as one multi-line message (up to 64 KB), shown with the alias on the first line only. A 5,000-line build log is a single message; slow output (a line every few hundred ms) still goes out line by line, with no visible delay.

echo

Every line also shows in your terminal, empty ones included. Empty lines aren't sent to the room.

size

Up to 1 MB per line, the server's limit. A bigger line is refused: the pipe stops and exits with code 1, saying message too big.

the room

What others send while the pipe runs isn't shown; it's read and discarded.

never opens the screen

Safe in scripts, CI and cron: nobody needs to press Ctrl+C at the end.

no history

If nobody is in the room, the lines are lost.

servers that say no

The client declares pipe mode when it connects (mode=pipe in the URL). A server started with --no-pipes refuses it, and the client exits with the server's reason.

Flags

Busy port or bad address: the server exits with the error (address already in use, missing port in address) and code 1, without announcing anything first.

Endpoint

GET /ws?room=<room>&alias=<alias>[&mode=pipe]   upgrade to WebSocket, over TLS (wss://) by default

room

Room name. Any text. Doesn't exist → it's created. Missing or empty → room local.

alias

Name of whoever connects. Any text, even empty. Not validated, and doesn't need to be unique.

mode

pipe when the client runs in pipe mode, absent otherwise. Only read by --no-pipes.

origin

Refuses any request with an Origin header (403). Browsers always send one on WebSocket connections and the teachatty client never does, so web pages can't connect to the server behind a user's back.

Messages

client → server

A text frame with the bare message: hi.

server → client

A text frame with the alias in front: daniel: hi. Goes to every member of the room except the sender.

size

Up to 1 MB per message (maxMessage). Above that, the server answers with close 1009 (message too big) and closes only that connection; the room carries on.

rate

Each connection may send 5 messages a second, with bursts of 20, and 256 KB a second. Above that, the server reads that connection more slowly: nothing is dropped and nobody is disconnected, the sender is just slowed down (TCP backpressure).

history

None. A room is a list of connections; it doesn't store messages.

Room lifecycle

join

If the room isn't in the map, it's created, and the connection becomes a member.

leave

When the connection ends, it leaves the room. An empty room is removed from the map, except local.

default room

local is already in the map when the server starts and is never removed. It's where anyone who doesn't ask for a room goes.

state

Everything in memory. Restarting the server disconnects everyone and wipes all rooms.

Terminal output

Prints teachatty-server listening on :7347 · default room: local · TLS · fingerprint SHA256:... on startup (only after the port is open) and logs upgrade errors with log. If the port is busy or the address is invalid, it exits with that error.

1. The server makes its own certificate

   On first start, the server generates a self-signed certificate (ECDSA P-256, valid for 10 years) in ~/.config/teachatty/: server.crt and server.key, the key readable only by its owner. It reuses them on every start and prints the fingerprint: SHA256: + the hash of the public key.

2. The client trusts it the first time

   The first connection to a server (as written in --server) saves its fingerprint in ~/.config/teachatty/known_servers and shows * trusting new server ..., in gray in the chat, or on stderr in pipe mode. It doesn't ask: a question would block pipes and cron.

3. And refuses it if it changes

   From then on, only that fingerprint is accepted. A different one means someone is intercepting, or the server's certificate was regenerated: the client refuses to connect and shows both fingerprints. If the change is legitimate, delete that server's line in known_servers.

what it protects

Everyone on the network reading the chat (Wireshark, a compromised switch), and impersonation of a server you've already connected to.

what it doesn't

The very first connection: if it's intercepted, the client trusts the interceptor. Comparing the fingerprint the client shows with the one the server prints closes that gap.

regenerating

Deleting server.crt and server.key makes the server generate a new certificate, and every client will refuse it until they remove the old line from known_servers.

without TLS

--no-tls on both sides goes back to plain ws://. For testing only.

your own certificate

On a real domain, pass --tls-cert and --tls-key (Let's Encrypt's fullchain.pem and privkey.pem, or your company CA's). The client checks every certificate against the machine's trusted authorities first, like a browser: if it verifies for that hostname, it's accepted with no pinning, so renewals with a new key keep working. The server reloads the files when they change, so certbot renewals need no restart.

common mistakes

Two mistakes work at first and break at the first renewal, ~60 days later, so teachatty warns about both right away. Using cert.pem instead of fullchain.pem: without the intermediate certificate the chain doesn't verify; the server warns at startup. Connecting by IP instead of the domain name: the certificate is only valid for the name; the client warns on first use. Also, Let's Encrypt's privkey.pem is readable only by root: use the certbot hook from contrib/ (run as a service), which copies it for the server.

company CA

A certificate from a private company CA only verifies on machines where that CA is installed. Elsewhere it falls back to trust on first use, and each renewal with a new key would trip the "identity changed" check.

code

All of it lives in internal/tlstrust, standard library only (crypto/tls, crypto/x509). The binaries call tlstrust.Server(certFile, keyFile, warn) and tlstrust.Client(server, notice).

Repository layout

cmd/teachatty-server/main.go       server: /ws handler, rooms map
cmd/teachatty-server/room.go       Room: join, leave, broadcast
cmd/teachatty-server/main_test.go  tests (go test ./...)
cmd/teachatty/main.go              client: flags, connection, receiving
cmd/teachatty/pipe.go              client: pipe mode
internal/ui/ui.go                the client's screen (tview)
internal/tlstrust/               TLS: certificate, trust on first use
internal/version/                --version
contrib/                         systemd unit and certbot hook
docs/                            this site and this documentation
roadmap.md                       next steps and decisions
features.md                      log of what shipped

The path of a message

Daniel and Mateus are in room dev. Daniel types hi and presses Enter. The animated, step-by-step version is on the site.

1. Key by key

   Daniel's terminal is in raw mode. tcell hands each key to tview's event loop, and the text sits in the input box. On Enter, the client calls send, shows daniel: hi on its own screen and clears the box (client internals).

2. Masked frame

   WriteMessage builds a masked text frame and the kernel sends it over the TCP socket (anatomy of a frame).

3. Daniel's goroutine on the server wakes up

   It was blocked in ReadMessage. It receives hi and builds daniel: hi (server internals).

4. Broadcast in the room

   It locks only room dev's mutex and writes to each member except Daniel himself (locks).

5. Mateus's receiving goroutine wakes up

   It calls screen.Print, which queues the line for tview. The event loop writes the message and redraws, without touching what Mateus is typing.

From flags to URL

Users never type a URL. The client builds it from the flags, and the server reads the parameters from it.

teachatty \
  --room dev \
  --alias daniel

wss://localhost:7347
  /ws?alias=daniel
     &room=dev

r.URL.Query()
  .Get("room")  // dev
r.URL.Query()
  .Get("alias") // daniel

The conversation on the wire

GET /ws?alias=daniel&room=dev HTTP/1.1
Host: localhost:7347
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
Sec-WebSocket-Version: 13

HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=

The Sec-WebSocket-Accept proof

Memory

The code

// writeWait is how long one member gets to take a message. A member that doesn't read
// (a laptop that went to sleep, a network that dropped without closing the connection, a
// teachatty pipe suspended with Ctrl+Z, a badly written client) fills its network buffers and then
// blocks every write to it; without a limit, broadcast would wait forever while holding
// the room's lock, and the whole room would freeze. A var, not a const, so the tests can
// shorten it.
var writeWait = 5 * time.Second

// Room has its own mutex: one room broadcasting doesn't block the others
type Room struct {
	mu      sync.Mutex
	members map[*websocket.Conn]string // connection -> alias
}

func (r *Room) join(conn *websocket.Conn, alias string) {
	r.mu.Lock()
	defer r.mu.Unlock()
	r.members[conn] = alias
}

// leave removes the connection and reports whether the room is now empty
func (r *Room) leave(conn *websocket.Conn) (empty bool) {
	r.mu.Lock()
	defer r.mu.Unlock()
	delete(r.members, conn)
	return len(r.members) == 0
}

func (r *Room) broadcast(myOwnConn *websocket.Conn, msg []byte) {
	r.mu.Lock()
	defer r.mu.Unlock()
	for c := range r.members {
		if c == myOwnConn {
			continue
		}
		c.SetWriteDeadline(time.Now().Add(writeWait))
		if err := c.WriteMessage(websocket.TextMessage, msg); err != nil {
			// too slow or already gone: drop it so the room keeps going. Closing the
			// connection also wakes its own goroutine (blocked in ReadMessage), which then
			// leaves the room the normal way; deleting it here (allowed while ranging over
			// a map) stops the next broadcasts from waiting on it again.
			delete(r.members, c)
			c.Close()
		}
	}
}

func handleWS(w http.ResponseWriter, r *http.Request) {
	// --no-pipes: the teachatty client declares pipe mode in the URL. A courtesy rule, not
	// a security boundary: a client that doesn't declare it isn't stopped (the rate limit
	// is what holds back abuse); it keeps teammates' build logs out of a chat room.
	if noPipes && r.URL.Query().Get("mode") == "pipe" {
		http.Error(w, "this server doesn't accept pipe mode (it was started with --no-pipes)", http.StatusForbidden)
		return
	}

	// one IP can't hold more than --max-per-ip connections (see limits.go)
	release, ok := acquireIP(r)
	if !ok {
		http.Error(w, "too many connections from your address", http.StatusTooManyRequests)
		return
	}
	defer release()

	conn, err := upgrader.Upgrade(w, r, nil)
	if err != nil {
		log.Println(err)
		return
	}
	defer conn.Close()

	// a message over the limit: ReadMessage returns an error, gorilla answers with
	// close 1009 ("message too big") and this connection leaves the loop and the room like any other
	conn.SetReadLimit(maxMessage)

	// no room in the URL (old client, another program): goes to the default room
	name := cmp.Or(r.URL.Query().Get("room"), defaultRoom)
	alias := r.URL.Query().Get("alias")

	// joining a room that doesn't exist creates it
	mu.Lock()
	room := rooms[name]
	if room == nil {
		room = &Room{members: map[*websocket.Conn]string{}}
		rooms[name] = room
	}
	room.join(conn, alias)
	mu.Unlock()

	msgs, bytes := limiters()
	for {
		_, msg, err := conn.ReadMessage()
		if err != nil {
			break
		}
		// over its budget, this connection waits here before the next read: nothing is
		// dropped, the sender is just slowed down (see limits.go)
		if msgs.Wait(r.Context()) != nil || bytes.WaitN(r.Context(), len(msg)) != nil {
			break
		}
		// relay the message to the others in the same room
		room.broadcast(conn, []byte(alias+": "+string(msg)))
	}

	// leave the room; an empty room stops existing, except the default one
	mu.Lock()
	if room.leave(conn) && name != defaultRoom {
		delete(rooms, name)
	}
	mu.Unlock()
}

Why joining and leaving use the global lock: the ghost room

Measured result

1. The connection ends

   The person presses Ctrl+C, closes the terminal or the network drops. The client restores the terminal and closes the socket (client internals).

2. ReadMessage returns an error

   That person's goroutine on the server, blocked in ReadMessage, wakes up with an error. The break leaves the loop.

3. leave and, if needed, delete

   Under the global lock: room.leave(conn) removes the connection from members and reports whether the room is now empty. If it is, and it isn't local, delete(rooms, name) removes the room.

4. defer conn.Close()

   The handler returns, and the defer scheduled right after the upgrade closes the connection on the server side.

5. The goroutine ends

   It only existed to run that handler. Its stack, a few KB, is freed.

┌──────────── dev · mateus ────────────┐
│daniel: hi                            │
│mateus: hey, how's it going?          │
│daniel: the deploy is up              │
│                                      │
└──────────────────────────────────────┘
╔══════════════════════════════════════╗
║looking at the logs no█               ║
╚══════════════════════════════════════╝

Why typing no longer gets overwritten

The client's goroutines

Following the end

The growing input box

_, _, width, _ := input.GetInnerRect()
lines := uniseg.StringWidth(input.GetText())/width + 1
layout.ResizeItem(input, min(lines, 5)+2, 0)
if lines <= 5 {
	input.SetOffset(0, 0)
}

Exiting without breaking the terminal

Colors per alias

Pipe mode internals

teachatty's look

The code

// stdin is not a terminal (command | teachatty): pipe mode, no screen
pipeMode := !term.IsTerminal(int(os.Stdin.Fd()))

// build wss://SERVER/ws?room=...&alias=... from the flags (ws:// with --no-tls)
// dereference the pointer to get the string
scheme := "wss"
if *noTLS {
	scheme = "ws"
}
query := url.Values{"room": {*room}, "alias": {*alias}}
// pipe mode says so, so a server started with --no-pipes can refuse it
if pipeMode {
	query.Set("mode", "pipe")
}
u := url.URL{
	Scheme:   scheme,
	Host:     host,
	Path:     "/ws",
	RawQuery: query.Encode(),
}

// TLS trust (trusted on first use, then pinned) lives in internal/tlstrust.
// A notice like "trusting new server ..." goes into a buffer and is shown below,
// once we know whether it goes to the screen or to stderr.
var notice bytes.Buffer
dialer := *websocket.DefaultDialer
if !*noTLS {
	cfg, err := tlstrust.Client(host, &notice)
	if err != nil {
		log.Fatal(err)
	}
	dialer.TLSClientConfig = cfg
}
conn, resp, err := dialer.Dial(u.String(), nil)
if err != nil {
	// the server refuses some connections on purpose, before the WebSocket handshake
	// (403: pipes not allowed; 429: too many connections from your IP), and says why
	// in the response body: show that reason instead of a generic "bad handshake"
	if resp != nil && (resp.StatusCode == http.StatusForbidden || resp.StatusCode == http.StatusTooManyRequests) {
		reason, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
		log.Fatal("the server refused the connection: ", strings.TrimSpace(string(reason)))
	}
	log.Fatal(tlstrust.DialHint(err, !*noTLS))
}
defer conn.Close()

if pipeMode {
	os.Stderr.Write(notice.Bytes())
	pipe(conn)
	return
}

// the screen calls this on every Enter; only the screen's goroutine writes to the
// connection, so gorilla's one-writer-per-connection rule still holds
screen := ui.New(*room, *alias, func(text string) {
	conn.WriteMessage(websocket.TextMessage, []byte(text))
})
// the welcome banner: where you are, how the connection is secured, the keys
security := "not encrypted (--no-tls)"
if tc, ok := conn.NetConn().(*tls.Conn); ok {
	state := tc.ConnectionState()
	security = "encrypted · " + tls.VersionName(state.Version)
	if len(state.PeerCertificates) > 0 {
		fp := tlstrust.Fingerprint(state.PeerCertificates[0])
		security += " · " + fp[:min(len(fp), 19)] + "…"
	}
}
screen.Welcome(
	"teachatty · "+host+" · room "+*room,
	security,
	"Enter send · PgUp/PgDn scroll · Ctrl+C quit",
	"mention someone with @name to ring their bell",
)
if notice.Len() > 0 {
	screen.Notice(strings.TrimSpace(notice.String()))
}

// empty channel to signal that the connection dropped; the receiving goroutine closes it
closed := make(chan struct{})
var readErr error // why it dropped; written before close(closed), read after

// receive messages in parallel while you type
go func() {
	for {
		_, msg, err := conn.ReadMessage()
		if err != nil {
			// log.Fatal can't be used here: it exits without restoring the terminal.
			// Tell main and close the screen; main is the one that exits.
			readErr = err
			close(closed)
			screen.Stop()
			return
		}
		screen.Print(string(msg))
	}
}()

// Run owns the terminal until Ctrl+C or until the connection drops
if err := screen.Run(); err != nil {
	log.Fatal(err)
}

// the terminal is back to normal; now it's safe to report that the connection dropped
select {
case <-closed:
	log.Fatal("connection closed: ", readErr)
default:
}

// aliasColor picks the color from a hash of the alias: the same alias always gets the
// same color, on any client, without the server knowing anything about colors.
func aliasColor(alias string) string {
	h := fnv.New32a()
	h.Write([]byte(alias))
	return palette[h.Sum32()%uint32(len(palette))]
}

// format builds the line with the alias colored. With colors on, tview interprets
// tags like "[red]" in the text, so everything from outside goes through tview.Escape:
// without it, anyone could send "[red]" and change your screen.
// mine = a message you sent yourself: alias in bold, in the normal text color.
func format(alias, text string, mine bool) string {
	style := "[" + aliasColor(alias) + "]"
	if mine {
		style = "[::b]"
	}
	return style + tview.Escape(alias) + "[-::-]: " + tview.Escape(text)
}

// inside New: the Enter key
case tcell.KeyEnter:
	// Enter sends instead of inserting a newline
	text := input.GetText()
	if strings.TrimSpace(text) != "" {
		send(text)
		// your own message shows up like everyone else's: "alias: text"
		fmt.Fprintln(u.messages, format(alias, text, true))
	}
	input.SetText("", false)
	return nil

// Print shows a received line. Safe to call from another goroutine:
// QueueUpdateDraw hands the change to the screen's goroutine, which redraws.
func (u *UI) Print(line string) {
	// the server sends "alias: text" as a single string; the alias is whatever comes
	// before the first ": ". Without ": ", the whole line is shown uncolored.
	out := tview.Escape(line)
	if alias, text, ok := strings.Cut(line, ": "); ok {
		out = format(alias, text, false)
	}
	u.app.QueueUpdateDraw(func() {
		fmt.Fprintln(u.messages, out)
	})
}

// batching in pipe mode: how long to wait for more lines after the first one, and the
// largest batch. 100 ms is unnoticeable for a human reading the room; 64 KB keeps each
// message far below the server's 1 MB limit.
const (
	batchWait = 100 * time.Millisecond
	batchMax  = 64 << 10
)

// pipe is the screenless mode (command | teachatty): it sends each stdin line to the room,
// echoes the line to the terminal (like tee) and exits when the input ends.
// It never opens the screen on purpose: in a script or cron there's nobody to press Ctrl+C.
func pipe(conn *websocket.Conn) {
	// the room's messages keep arriving and must be read, even if not shown.
	// Without this, the network buffers fill up and the server's broadcast stalls the
	// whole room waiting on us. This goroutine is the only reader; pipe is the only writer.
	// readErr records why reading stopped. It is written before close(done), so whoever
	// sees done closed also sees the right value (same guarantee as "closed" in main.go).
	done := make(chan struct{})
	var readErr error
	// closing is set right before we send our own close frame at the end, so the reader
	// can tell "we're finishing" from "the connection dropped while we wait for input"
	var closing atomic.Bool
	go func() {
		for {
			if _, _, err := conn.ReadMessage(); err != nil {
				readErr = err
				close(done)
				// dropped while main may be blocked waiting for the next input line (a quiet
				// tail -f, or after being suspended and dropped by the server): exit now
				// instead of hanging until a line arrives. No screen here, nothing to restore.
				if !closing.Load() {
					log.Fatal("connection closed: ", err)
				}
				return
			}
		}
	}()
	// the connection dropped or the server refused something (e.g. a line over the limit,
	// close 1009): writes still "work" because they go to a buffer, so the reader is what tells us
	dropped := func() {
		log.Fatal("connection closed: ", readErr)
	}

	// send writes one message, reporting the real reason if the connection is gone
	send := func(text string) {
		select {
		case <-done:
			dropped()
		default:
		}
		if err := conn.WriteMessage(websocket.TextMessage, []byte(text)); err != nil {
			// the real reason usually arrives through the reader (e.g. close 1009, line
			// too big); wait for it briefly before showing the write error
			select {
			case <-done:
				dropped()
			case <-time.After(time.Second):
				log.Fatal("connection closed: ", err)
			}
		}
	}

	// stdin is read in its own goroutine, so the loop below can wait for "the next line
	// or a short pause, whichever comes first". ReadString has no line length limit
	// (bufio.Scanner gives up at 64 KB).
	lines := make(chan string)
	go func() {
		r := bufio.NewReader(os.Stdin)
		for {
			line, err := r.ReadString('\n')
			if line != "" {
				lines <- strings.TrimRight(line, "\r\n")
			}
			if err != nil {
				if err != io.EOF {
					log.Fatal("error reading input: ", err)
				}
				close(lines)
				return
			}
		}
	}()

	// batching: lines that arrive within batchWait of the first one go out together, as
	// one multi-line message of up to batchMax bytes. A 5,000-line build log becomes a
	// handful of messages instead of flooding the room (and the server's rate limit).
	var batch []string
	size := 0
	flush := func() {
		if len(batch) > 0 {
			send(strings.Join(batch, "\n"))
			batch, size = nil, 0
		}
	}
	timer := time.NewTimer(batchWait)
	timer.Stop()
	for open := true; open; {
		select {
		case line, ok := <-lines:
			if !ok {
				open = false
				break
			}
			fmt.Println(line) // echo: you still see the command's output
			if strings.TrimSpace(line) == "" {
				continue // an empty line is echoed, but not sent to the room
			}
			if size > 0 && size+len(line) > batchMax {
				flush()
			}
			if len(batch) == 0 {
				timer.Reset(batchWait)
			}
			batch = append(batch, line)
			size += len(line) + 1
		case <-timer.C:
			flush()
		}
	}
	flush()

	// close properly: send the close frame and wait for the server to answer (then the
	// reader goroutine ends and closes done). Exiting without this can lose the last lines.
	closing.Store(true)
	conn.WriteMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, ""))
	select {
	case <-done:
		// a normal closure (1000) is the answer to our close; anything else is a problem
		if !websocket.IsCloseError(readErr, websocket.CloseNormalClosure) {
			dropped()
		}
	case <-time.After(2 * time.Second):
	}
}

1. In your package manager

   Signed apt and dnf repositories, the AUR and Homebrew, so updates come with apt upgrade. Then the official Fedora and Debian repositories, and Ubuntu with them.

2. Access control

   A server-wide token or password-protected rooms, decided after the release. TLS is in place, so a secret travels encrypted; the server stores only a salted hash.

3. Message history

   SQLite with modernc.org/sqlite. Needed for pipe mode to keep logs and for persistent rooms.