Anyone who works on Cisco or Huawei routers/switches over SSH knows an AI assistant like Claude Code or Codex should never touch the device directly — no access, no risk of a wrong command hitting a production box. But it can be a genuinely useful second pair of eyes if it can see what you type and respond in real time, without ever running anything itself.
terminal-router is the SysLinuxOS package built for exactly that: it records your terminal session to a file an AI assistant can follow live, while you stay the only one actually typing commands on the device.
How it works
The workflow is simple: you open an SSH session to the router in one pane, the assistant tails ~/.claude-logs/latest in another. You type, it reads and suggests, you decide what to run. The log never leaves the machine.
Under the hood it relies on tmux: each pane is piped to a logger script that writes a timestamped file, with an always-current latest symlink pointing at the newest pane.
Two ways to enable it
Since 1.0.4, terminal-router offers two distinct modes:
terminal-router install — every terminal
Adds a marked block to ~/.bashrc (or ~/.zshrc) and to ~/.tmux.conf: from then on, every interactive terminal you open automatically enters a logged tmux session. Convenient if you work on network devices often and want logging always on, but it does touch your shell configuration — it stays active across reboots until you explicitly run terminal-router remove.
terminal-router launch — one session, zero config changes
The new option for when you want to log just that one session, without touching Terminator, GNOME Terminal, or any other terminal you already have open. terminal-router launch starts a self-contained tmux session with pipe-pane hooks scoped to that session only (no -g flag): when it ends, the hooks vanish with it, and nothing is ever written to ~/.bashrc, ~/.zshrc, or ~/.tmux.conf.
One implementation detail worth sharing: chaining pipe-pane right after new-session in a single tmux invocation turns out to be unreliable — verified empirically on tmux 3.5a, the pipe silently never attaches to that first pane. The fix sets the hooks on the session first, then swaps the initial (never logged) window for a new one created after the hooks exist, which does get captured correctly.
Installation
terminal-router ships through the official SysLinuxOS Tools APT repository. If you haven’t added it yet:
curl -fsSL https://fconidi.github.io/SysLinuxOS-Tools/client/install-repo.sh | sudo bash
Then install the package like any other:
sudo apt update sudo apt install terminal-router
Installing the package enables nothing by itself — each user has to explicitly choose install or launch and accept the security notice once.
Commands
| Command | What it does |
|---|---|
terminal-router install |
Enables logging for every terminal (hooks in bashrc/zshrc + tmux.conf) |
terminal-router launch |
Logs a single session only, no config file edits |
terminal-router status |
Shows what’s active, log disk usage, and whether an AI assistant is available |
terminal-router tail |
Follows the newest pane log live |
terminal-router remove |
Removes the hooks (with automatic backups) and optionally deletes the logs |
terminal-router menu |
Interactive menu, also used by the applications-menu entry |
Inside a logged pane, two shell functions help around sensitive moments:
logpause # suspends logging for this pane logresume # resumes it, into a new file
New in 1.0.5: AI assistant check
Logging a session only matters if something actually reads it. As of this version, install, launch, and status check whether claude or codex is available on PATH, and warn — without blocking anything — if neither is found:
$ terminal-router status ... AI assistant found (claude codex)
Note for Codex-via-nvm setups: it’s only detected if the shell running the check has already loaded nvm into its environment.
Security: what ends up in the log (and what doesn’t)
The log captures everything printed on screen. It does not capture passwords typed at an interactive prompt (sudo, SSH password authentication) — the terminal never echoes them, so tmux never sees them either.
What can end up in the log, because it’s visible on screen:
- passwords passed as plaintext arguments (e.g.
mysql -pXXX) - tokens in HTTP headers (e.g.
curl -H "Authorization: Bearer ...") - the output of
caton a.envfile or a private key
Mitigations already in place: log directory at 0700, files at 0600, automatic rotation after 30 days, plus the logpause/logresume pair for the moments you need to work quietly.
Version history
- 1.0.3 — fixed a bug that left APT locked while using the CLI wrapper
- 1.0.4 — new
launchcommand: a non-invasive single session, no bashrc/tmux.conf edits - 1.0.5 — automatic detection of claude/codex, with a warning when no AI assistant is around to read the log
Useful links
- APT repository: fconidi.github.io/SysLinuxOS-Tools
- Source code on GitHub (also useful outside SysLinuxOS, to build the .deb on any Debian/Ubuntu): github.com/fconidi/terminal-router
- Run
man terminal-routerafter installing for the full documentation
Terminal-router AI assistants (Claude Code, Codex) on Cisco/Huawei routers
