Share a Space

Let someone in your team watch or use one of your Spaces through the relay, and reach a Space from your other computers.

Sharing is for teams. You can share a Space with the people in your own team, one at a time or the whole team. A viewer ("Can view") joins with their own named cursor and watches. An editor ("Can edit") can also use the Space. They open it from their own app or terminal as relay:<machine>.

To share from the app, press Share in the Space's toolbar, enter the email address or account ID of someone in your team, and choose Can view or Can edit. The same list shows who has access and who is connected. Cua Spaces asks you to confirm first: Touch ID or your login password on a Mac, Windows Hello or your account password on Windows, and your password through polkit on Linux.

You can share with one teammate at a time, or with the whole team at once. See People and teams.

From a terminal:

cua spaces share local:studio bob@example.com                 # viewer
cua spaces share local:studio bob@example.com --role editor   # change the role
cua spaces share local:studio team:acme --role viewer         # the whole team, to watch
cua spaces shares local:studio                                # who, and who is connected
cua spaces unshare local:studio bob@example.com               # at once
cua spaces unshare local:studio --all                         # nobody; leaves the relay

People and teams#

• One person. Type their email or account ID. They must be a member of your team: if they are not, you see "Alex isn't in your team. Invite them to your team first." You choose Can view or Can edit for each person.
• A whole team. Every member of the team, and their agents, can open the Space, as Can view (watch only) or Can edit. Only an owner or admin of a team on the Teams plan can do this, and only for a Space they own. See Share a Space with the team.
• No team. Free and Pro accounts without a team cannot share. The command fails with "Sharing is for teams. Start a team to share this Space."

What each role can do#

The Space's own cua-spacesd enforces the role, not the caller. A refused call fails with PermissionDenied (view-only share: <who> cannot call <method>).

A whole-team share has the same two roles, Can view and Can edit. To change it, share with the team again with the other role.

How it works#

Sharing uses the same relay and allowlist as an added computer:

• A host (relay:<id> from cua host setup) is shared directly.
• Any other Space is published on the relay on its first share. The owner's account registers a computer for it, and the Space's own driver dials out over WSS, so no inbound port opens.
• The relay keeps two lists per computer: allow (editors) and viewers.
• Invitees need a verified email or account ID and an added computer.
• Removing someone, or changing their role, cuts their open streams at once.
• Team membership comes from your team in your Cua account, not from the relay. The Cua account service checks it when you share and again each time someone opens the Space, and the relay enforces the answer. If someone leaves your team, they lose access to what you shared with them. If a team is deleted, its shares stop.
• A team share works differently. The Space goes on the team's list of computers, and each time someone opens it, the relay checks with the Cua account service that they are still in the team and that their computer is approved.

let shares = ada
    .share_space(&info.id, "bob@example.com", ShareRole::Viewer)
    .await
    .unwrap();

The SDK call in other languages is space.share(who, role), with space.unshare(who) and space.shares(). The MCP tools are share_space, unshare_space and space_shares.

Confirmation#

Sharing asks you first:

• Through cua daemon (the app, cua mcp, agents), with Touch ID or your login password. An agent can ask to share a Space; only you can allow it.
• The cua CLI without a daemon asks on the terminal. Pass --yes to confirm up front.

Removing someone needs no confirmation.

Reach a Space from your other computers#

To reach a Space from your phone or another computer without sharing it with anyone, publish it on the relay:

cua spaces relay-register local:studio      # prints relay:<machine>
cua spaces relay-unregister local:studio

let reg = ada.relay_register(&info.id).await.unwrap();

Only your account's added computers reach it until you share it. The MCP tools are relay_register_space and relay_unregister_space.

Audit#

• cua spaces shares lists who has access now.
• The owner's share log (~/.cua/shares-audit.jsonl, hash-chained) records every share, removal, attach and detach.
• The relay's audit log (cua devices audit) records viewer_added, share_added, share_removed and each shared access.
• The Space's access log records every relay caller, including refused view-only calls (refused ProcessService (view-only share)).

Limits#

• You can share with a person in your team or with the whole team, as Can view or Can edit.
• Presence cursors travel on the relay stream, not QUIC datagrams, so remote cursors update a little less often than on your own network.
• A Space that is released (for example a paused persistent agent in your cloud) leaves the relay. Share it again after it is created again.