diff --git a/cmd/zrok/accessPrivate.go b/cmd/zrok/accessPrivate.go
index b940026d..00c686cf 100644
--- a/cmd/zrok/accessPrivate.go
+++ b/cmd/zrok/accessPrivate.go
@@ -238,7 +238,7 @@ func (cmd *accessPrivateCommand) accessLocal(args []string, root env_core.Root)
 	signal.Notify(c, os.Interrupt, os.Kill, syscall.SIGHUP, syscall.SIGTERM, syscall.SIGKILL, syscall.SIGQUIT)
 	go func() {
 		<-c
-		cmd.destroy(accessResp.Payload.FrontendToken, root.Environment().ZitiIdentity, shrToken, zrok, auth)
+		cmd.shutdown(accessResp.Payload.FrontendToken, root.Environment().ZitiIdentity, shrToken, zrok, auth)
 		os.Exit(0)
 	}()
 
@@ -300,7 +300,7 @@ func (cmd *accessPrivateCommand) accessLocal(args []string, root env_core.Root)
 		}
 
 		close(requests)
-		cmd.destroy(accessResp.Payload.FrontendToken, root.Environment().ZitiIdentity, shrToken, zrok, auth)
+		cmd.shutdown(accessResp.Payload.FrontendToken, root.Environment().ZitiIdentity, shrToken, zrok, auth)
 	}
 }
 
@@ -314,7 +314,7 @@ func (cmd *accessPrivateCommand) error(err error) {
 	panic(err)
 }
 
-func (cmd *accessPrivateCommand) destroy(frontendName, envZId, shrToken string, zrok *rest_client_zrok.Zrok, auth runtime.ClientAuthInfoWriter) {
+func (cmd *accessPrivateCommand) shutdown(frontendName, envZId, shrToken string, zrok *rest_client_zrok.Zrok, auth runtime.ClientAuthInfoWriter) {
 	logrus.Infof("shutting down '%v'", shrToken)
 	req := share.NewUnaccessParams()
 	req.Body = &rest_model_zrok.UnaccessRequest{
diff --git a/cmd/zrok/sharePrivate.go b/cmd/zrok/sharePrivate.go
index 1fa4976c..a4ed38fe 100644
--- a/cmd/zrok/sharePrivate.go
+++ b/cmd/zrok/sharePrivate.go
@@ -18,6 +18,7 @@ import (
 	"github.com/openziti/zrok/environment/env_core"
 	"github.com/openziti/zrok/sdk/golang/sdk"
 	"github.com/openziti/zrok/tui"
+	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"net"
@@ -71,10 +72,7 @@ func newSharePrivateCommand() *sharePrivateCommand {
 func (cmd *sharePrivateCommand) run(_ *cobra.Command, args []string) {
 	root, err := environment.LoadRoot()
 	if err != nil {
-		if !panicInstead {
-			tui.Error("error loading environment", err)
-		}
-		panic(err)
+		cmd.error("error loading environment", err)
 	}
 
 	if !root.IsEnabled() {
@@ -105,51 +103,48 @@ func (cmd *sharePrivateCommand) shareLocal(args []string, root env_core.Root) {
 	switch cmd.backendMode {
 	case "proxy":
 		if len(args) != 1 {
-			tui.Error("the 'proxy' backend mode expects a <target>", nil)
+			cmd.error("unable to create share", errors.New("the 'proxy' backend mode expects a <target>"))
 		}
 		v, err := parseUrl(args[0])
 		if err != nil {
-			if !panicInstead {
-				tui.Error("invalid target endpoint URL", err)
-			}
-			panic(err)
+			cmd.error("invalid target endpoint URL", err)
 		}
 		target = v
 
 	case "web":
 		if len(args) != 1 {
-			tui.Error("the 'web' backend mode expects a <target>", nil)
+			cmd.error("unable to create share", errors.New("the 'web' backend mode expects a <target>"))
 		}
 		target = args[0]
 
 	case "tcpTunnel":
 		if len(args) != 1 {
-			tui.Error("the 'tcpTunnel' backend mode expects a <target>", nil)
+			cmd.error("unable to create share", errors.New("the 'tcpTunnel' backend mode expects a <target>"))
 		}
 		target = args[0]
 
 	case "udpTunnel":
 		if len(args) != 1 {
-			tui.Error("the 'udpTunnel' backend mode expects a <target>", nil)
+			cmd.error("unable to create share", errors.New("the 'udpTunnel' backend mode expects a <target>"))
 		}
 		target = args[0]
 
 	case "caddy":
 		if len(args) != 1 {
-			tui.Error("the 'caddy' backend mode expects a <target>", nil)
+			cmd.error("unable to create share", errors.New("the 'caddy' backend mode expects a <target>"))
 		}
 		target = args[0]
 		cmd.headless = true
 
 	case "drive":
 		if len(args) != 1 {
-			tui.Error("the 'drive' backend mode expects a <target>", nil)
+			cmd.error("unable to create share", errors.New("the 'drive' backend mode expects a <target>"))
 		}
 		target = args[0]
 
 	case "socks":
 		if len(args) != 0 {
-			tui.Error("the 'socks' backend mode does not expect <target>", nil)
+			cmd.error("unable to create share", errors.New("the 'socks' backend mode expects a <target>"))
 		}
 		target = "socks"
 
@@ -157,7 +152,7 @@ func (cmd *sharePrivateCommand) shareLocal(args []string, root env_core.Root) {
 		if len(args) == 1 {
 			_, _, err := net.ParseCIDR(args[0])
 			if err != nil {
-				tui.Error("the 'vpn' backend expect valid CIDR <target>", err)
+				cmd.error("unable to create share", errors.New("the 'vpn' backend mode expects a valid CIDR <target>"))
 			}
 			target = args[0]
 		} else {
@@ -165,27 +160,21 @@ func (cmd *sharePrivateCommand) shareLocal(args []string, root env_core.Root) {
 		}
 
 	default:
-		tui.Error(fmt.Sprintf("invalid backend mode '%v'; expected {proxy, web, tcpTunnel, udpTunnel, caddy, drive}", cmd.backendMode), nil)
+		cmd.error("unable to create share", fmt.Errorf("invalid backend mode '%v'; expected {proxy, web, tcpTunnel, udpTunnel, caddy, drive}", cmd.backendMode))
 	}
 
 	root, err := environment.LoadRoot()
 	if err != nil {
-		if !panicInstead {
-			tui.Error("unable to load environment", err)
-		}
-		panic(err)
+		cmd.error("unable to load environment", err)
 	}
 
 	if !root.IsEnabled() {
-		tui.Error("unable to load environment; did you 'zrok enable'?", nil)
+		cmd.error("unable to create share", errors.New("unable to load environment; did you 'zrok enable'?"))
 	}
 
 	zif, err := root.ZitiIdentityNamed(root.EnvironmentIdentityName())
 	if err != nil {
-		if !panicInstead {
-			tui.Error("unable to load ziti identity configuration", err)
-		}
-		panic(err)
+		cmd.error("unable to load ziti identity configuration", err)
 	}
 
 	req := &sdk.ShareRequest{
@@ -199,21 +188,7 @@ func (cmd *sharePrivateCommand) shareLocal(args []string, root env_core.Root) {
 	}
 	shr, err := sdk.CreateShare(root, req)
 	if err != nil {
-		if !panicInstead {
-			tui.Error("unable to create share", err)
-		}
-		panic(err)
-	}
-
-	if cmd.subordinate {
-		data := make(map[string]interface{})
-		data["token"] = shr.Token
-		data["frontend_endpoints"] = shr.FrontendEndpoints
-		jsonData, err := json.Marshal(data)
-		if err != nil {
-			panic(err)
-		}
-		fmt.Println(string(jsonData))
+		cmd.error("unable to create share", err)
 	}
 
 	shareDescription := fmt.Sprintf("access your share with: %v", tui.Code.Render(fmt.Sprintf("zrok access private %v", shr.Token)))
@@ -244,10 +219,7 @@ func (cmd *sharePrivateCommand) shareLocal(args []string, root env_core.Root) {
 
 		be, err := proxy.NewBackend(cfg)
 		if err != nil {
-			if !panicInstead {
-				tui.Error("error creating proxy backend", err)
-			}
-			panic(err)
+			cmd.error("unable to create 'proxy' backend", err)
 		}
 
 		go func() {
@@ -266,10 +238,7 @@ func (cmd *sharePrivateCommand) shareLocal(args []string, root env_core.Root) {
 
 		be, err := proxy.NewCaddyWebBackend(cfg)
 		if err != nil {
-			if !panicInstead {
-				tui.Error("error creating web backend", err)
-			}
-			panic(err)
+			cmd.error("unable to create 'web' backend", err)
 		}
 
 		go func() {
@@ -288,10 +257,7 @@ func (cmd *sharePrivateCommand) shareLocal(args []string, root env_core.Root) {
 
 		be, err := tcpTunnel.NewBackend(cfg)
 		if err != nil {
-			if !panicInstead {
-				tui.Error("error creating tcpTunnel backend", err)
-			}
-			panic(err)
+			cmd.error("unable to create 'tcpTunnel' backend", err)
 		}
 
 		go func() {
@@ -310,10 +276,7 @@ func (cmd *sharePrivateCommand) shareLocal(args []string, root env_core.Root) {
 
 		be, err := udpTunnel.NewBackend(cfg)
 		if err != nil {
-			if !panicInstead {
-				tui.Error("error creating udpTunnel backend", err)
-			}
-			panic(err)
+			cmd.error("unable to create 'udpTunnel' backend", err)
 		}
 
 		go func() {
@@ -332,10 +295,7 @@ func (cmd *sharePrivateCommand) shareLocal(args []string, root env_core.Root) {
 		be, err := proxy.NewCaddyfileBackend(cfg)
 		if err != nil {
 			cmd.shutdown(root, shr)
-			if !panicInstead {
-				tui.Error("error creating caddy backend", err)
-			}
-			panic(err)
+			cmd.error("unable to create 'caddy' backend", err)
 		}
 
 		go func() {
@@ -354,10 +314,7 @@ func (cmd *sharePrivateCommand) shareLocal(args []string, root env_core.Root) {
 
 		be, err := drive.NewBackend(cfg)
 		if err != nil {
-			if !panicInstead {
-				tui.Error("error creating drive backend", err)
-			}
-			panic(err)
+			cmd.error("unable to create 'drive' backend", err)
 		}
 
 		go func() {
@@ -375,10 +332,7 @@ func (cmd *sharePrivateCommand) shareLocal(args []string, root env_core.Root) {
 
 		be, err := socks.NewBackend(cfg)
 		if err != nil {
-			if !panicInstead {
-				tui.Error("error creating socks backend", err)
-			}
-			panic(err)
+			cmd.error("unable to create 'socks' backend", err)
 		}
 
 		go func() {
@@ -397,10 +351,7 @@ func (cmd *sharePrivateCommand) shareLocal(args []string, root env_core.Root) {
 
 		be, err := vpn.NewBackend(cfg)
 		if err != nil {
-			if !panicInstead {
-				tui.Error("error creating VPN backend", err)
-			}
-			panic(err)
+			cmd.error("unable to create 'vpn' backend", err)
 		}
 
 		go func() {
@@ -410,10 +361,22 @@ func (cmd *sharePrivateCommand) shareLocal(args []string, root env_core.Root) {
 		}()
 
 	default:
-		tui.Error("invalid backend mode", nil)
+		cmd.error("unable to create share", errors.New("invalid backend mode"))
 	}
 
-	if cmd.headless {
+	if cmd.subordinate {
+		data := make(map[string]interface{})
+		data["message"] = "boot"
+		data["token"] = shr.Token
+		data["frontend_endpoints"] = shr.FrontendEndpoints
+		jsonData, err := json.Marshal(data)
+		if err != nil {
+			cmd.error("unable to create share", err)
+		}
+		fmt.Println(string(jsonData))
+	}
+
+	if cmd.headless && !cmd.subordinate {
 		logrus.Infof("allow other to access your share with the following command:\nzrok access private %v", shr.Token)
 		for {
 			select {
@@ -427,6 +390,7 @@ func (cmd *sharePrivateCommand) shareLocal(args []string, root env_core.Root) {
 			select {
 			case req := <-requests:
 				data := make(map[string]interface{})
+				data["message"] = "access"
 				data["remote_address"] = req.RemoteAddr
 				data["method"] = req.Method
 				data["path"] = req.Path
@@ -461,6 +425,16 @@ func (cmd *sharePrivateCommand) shareLocal(args []string, root env_core.Root) {
 	}
 }
 
+func (cmd *sharePrivateCommand) error(msg string, err error) {
+	if cmd.subordinate {
+		subordinateError(errors.Wrap(err, msg))
+	}
+	if !panicInstead {
+		tui.Error(msg, err)
+	}
+	panic(errors.Wrap(err, msg))
+}
+
 func (cmd *sharePrivateCommand) shutdown(root env_core.Root, shr *sdk.Share) {
 	logrus.Debugf("shutting down '%v'", shr.Token)
 	if err := sdk.DeleteShare(root, shr); err != nil {
diff --git a/cmd/zrok/sharePublic.go b/cmd/zrok/sharePublic.go
index 761478e2..f9f101d5 100644
--- a/cmd/zrok/sharePublic.go
+++ b/cmd/zrok/sharePublic.go
@@ -15,6 +15,7 @@ import (
 	"github.com/openziti/zrok/environment/env_core"
 	"github.com/openziti/zrok/sdk/golang/sdk"
 	"github.com/openziti/zrok/tui"
+	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"os"
@@ -86,10 +87,7 @@ func newSharePublicCommand() *sharePublicCommand {
 func (cmd *sharePublicCommand) run(_ *cobra.Command, args []string) {
 	root, err := environment.LoadRoot()
 	if err != nil {
-		if !panicInstead {
-			tui.Error("error loading environment", err)
-		}
-		panic(err)
+		cmd.error("error loading environment", err)
 	}
 
 	if !root.IsEnabled() {
@@ -121,10 +119,7 @@ func (cmd *sharePublicCommand) shareLocal(args []string, root env_core.Root) {
 	case "proxy":
 		v, err := parseUrl(args[0])
 		if err != nil {
-			if !panicInstead {
-				tui.Error("invalid target endpoint URL", err)
-			}
-			panic(err)
+			cmd.error("invalid target endpoint URL", err)
 		}
 		target = v
 
@@ -139,15 +134,12 @@ func (cmd *sharePublicCommand) shareLocal(args []string, root env_core.Root) {
 		target = args[0]
 
 	default:
-		tui.Error(fmt.Sprintf("invalid backend mode '%v'; expected {proxy, web, caddy, drive}", cmd.backendMode), nil)
+		cmd.error("unable to create share", fmt.Errorf("invalid backend mode '%v'; expected {proxy, web, caddy, drive}", cmd.backendMode))
 	}
 
 	zif, err := root.ZitiIdentityNamed(root.EnvironmentIdentityName())
 	if err != nil {
-		if !panicInstead {
-			tui.Error("unable to access ziti identity file", err)
-		}
-		panic(err)
+		cmd.error("unable to access ziti identity file", err)
 	}
 
 	req := &sdk.ShareRequest{
@@ -169,30 +161,13 @@ func (cmd *sharePublicCommand) shareLocal(args []string, root env_core.Root) {
 		for _, g := range cmd.oauthEmailAddressPatterns {
 			_, err := glob.Compile(g)
 			if err != nil {
-				if !panicInstead {
-					tui.Error(fmt.Sprintf("unable to create share, invalid oauth email glob (%v)", g), err)
-				}
-				panic(err)
+				cmd.error(fmt.Sprintf("unable to create share, invalid oauth email glob (%v)", g), err)
 			}
 		}
 	}
 	shr, err := sdk.CreateShare(root, req)
 	if err != nil {
-		if !panicInstead {
-			tui.Error("unable to create share", err)
-		}
-		panic(err)
-	}
-
-	if cmd.subordinate {
-		data := make(map[string]interface{})
-		data["token"] = shr.Token
-		data["frontend_endpoints"] = shr.FrontendEndpoints
-		jsonData, err := json.Marshal(data)
-		if err != nil {
-			panic(err)
-		}
-		fmt.Println(string(jsonData))
+		cmd.error("unable to create share", err)
 	}
 
 	mdl := newShareModel(shr.Token, shr.FrontendEndpoints, sdk.PublicShareMode, sdk.BackendMode(cmd.backendMode))
@@ -222,10 +197,7 @@ func (cmd *sharePublicCommand) shareLocal(args []string, root env_core.Root) {
 
 		be, err := proxy.NewBackend(cfg)
 		if err != nil {
-			if !panicInstead {
-				tui.Error("error creating proxy backend", err)
-			}
-			panic(err)
+			cmd.error("unable to create proxy backend", err)
 		}
 
 		go func() {
@@ -244,10 +216,7 @@ func (cmd *sharePublicCommand) shareLocal(args []string, root env_core.Root) {
 
 		be, err := proxy.NewCaddyWebBackend(cfg)
 		if err != nil {
-			if !panicInstead {
-				tui.Error("unable to create web backend", err)
-			}
-			panic(err)
+			cmd.error("unable to create web backend", err)
 		}
 
 		go func() {
@@ -266,10 +235,7 @@ func (cmd *sharePublicCommand) shareLocal(args []string, root env_core.Root) {
 		be, err := proxy.NewCaddyfileBackend(cfg)
 		if err != nil {
 			cmd.shutdown(root, shr)
-			if !panicInstead {
-				tui.Error("unable to create caddy backend", err)
-			}
-			panic(err)
+			cmd.error("unable to create caddy backend", err)
 		}
 
 		go func() {
@@ -288,10 +254,7 @@ func (cmd *sharePublicCommand) shareLocal(args []string, root env_core.Root) {
 
 		be, err := drive.NewBackend(cfg)
 		if err != nil {
-			if !panicInstead {
-				tui.Error("error creating drive backend", err)
-			}
-			panic(err)
+			cmd.error("unable to create drive backend", err)
 		}
 
 		go func() {
@@ -304,7 +267,19 @@ func (cmd *sharePublicCommand) shareLocal(args []string, root env_core.Root) {
 		tui.Error("invalid backend mode", nil)
 	}
 
-	if cmd.headless {
+	if cmd.subordinate {
+		data := make(map[string]interface{})
+		data["message"] = "boot"
+		data["token"] = shr.Token
+		data["frontend_endpoints"] = shr.FrontendEndpoints
+		jsonData, err := json.Marshal(data)
+		if err != nil {
+			cmd.error("unable to marshal", err)
+		}
+		fmt.Println(string(jsonData))
+	}
+
+	if cmd.headless && !cmd.subordinate {
 		logrus.Infof("access your zrok share at the following endpoints:\n %v", strings.Join(shr.FrontendEndpoints, "\n"))
 		for {
 			select {
@@ -318,6 +293,7 @@ func (cmd *sharePublicCommand) shareLocal(args []string, root env_core.Root) {
 			select {
 			case req := <-requests:
 				data := make(map[string]interface{})
+				data["message"] = "access"
 				data["remote_address"] = req.RemoteAddr
 				data["method"] = req.Method
 				data["path"] = req.Path
@@ -352,6 +328,16 @@ func (cmd *sharePublicCommand) shareLocal(args []string, root env_core.Root) {
 	}
 }
 
+func (cmd *sharePublicCommand) error(msg string, err error) {
+	if cmd.subordinate {
+		subordinateError(errors.Wrap(err, msg))
+	}
+	if !panicInstead {
+		tui.Error(msg, err)
+	}
+	panic(errors.Wrap(err, msg))
+}
+
 func (cmd *sharePublicCommand) shutdown(root env_core.Root, shr *sdk.Share) {
 	logrus.Debugf("shutting down '%v'", shr.Token)
 	if err := sdk.DeleteShare(root, shr); err != nil {