Glossary

Term	Meaning
Agent	The small program inside your network that dials out to the edge and forwards only what its host allows
Allow-list	The agent’s HG_ALLOW (web hostnames) and HG_ALLOW_TCP (TCP services), set on its host. Also called its ceiling
Base role	A member’s role over the whole workspace: Owner, Admin, Member, Billing, Auditor or No workspace role
Ceiling	The most an agent will ever forward. The console can choose within it, never widen it
CNAME target	The name you point shared hostnames at: <short name>.edge.houseguest.dev on the hosted service, edge.<your domain> when self-hosting
Console	The web app where members run everything: console.houseguest.dev
Edge	The public server that holds the agents’ connections, gets certificates and checks every request. Houseguest™’s, or your own when self-hosting
Email code	A 6-digit code sent by email to confirm a sign-in. Valid 10 minutes
Grant	A role given to a person or a group, over the workspace, a share group or one preview
Group	A set of people. Its grants apply to every member
Houseguest address	An address such as app.acme.houseguest.page that the edge maps to one internal hostname. Needs no DNS from you
Internal DNS	An agent setting (HG_UPSTREAM=dns) that looks up each hostname’s internal address in your network’s DNS, instead of one fixed address
Invite	A single-use link for one email address
Join token	A single-use token, valid for an hour, that lets a new agent register its key with your workspace
Landing hostname	Where viewers land when they open a preview; chosen in Viewers land on
Micro agent	The small agent inside houseguest share that serves one terminal share from your computer
Monitors	Requests from uptime checkers, recognised by their user agent, listed on their own and left out of every count
Member	A person with a console account in your workspace. Also the base role that opens previews and runs its own
Open path	A hostname/path that passes without sign-in, such as a health check
Parent domain	The domain all of a preview’s hostnames share. One sign-in covers it
Permission	One thing a role allows, such as Extend previews
Preview	Access to one or more hostnames and TCP services, for named people, for a set time
Request log	The record of each request to a preview: time, person, method, hostname, path, decision. The console’s Request log page lists it across the previews you can see
Scope	Where a grant applies: the whole workspace, a share group or one preview
Seat	Taken by a member who holds any permission beyond viewing and billing
Second sign-in step	A passkey or authenticator app after the email code
Share group	A set of previews on which roles can be granted, to delegate them
Sharer	Anyone who opens previews; usually the Member role
Short name	Your workspace’s short identifier, part of your CNAME target and Houseguest addresses
Standing access	A preview with a list of addresses or @domain entries and one link for everyone
Terminal share	A preview of a port on your own computer, opened with houseguest share
TCP service	A name:port an agent forwards to an internal address, such as SSH or a database
Verified domain	A domain your workspace proved with a DNS TXT record. Covers itself and every name under it
Viewer	A person given access to a preview. Has no account
Wildcard entry	*.domain in HG_ALLOW: any one name directly under the domain, once turned on in the console
Workspace	One customer account: its agents, previews, domains, members and settings