Remote access

You often want to reach Controller away from your desk: to review a long-running session, respond to an agent that's waiting on you, or triage scheduled runs. The goal is to do that without exposing the backend to the public internet.

Why not just open a port

Controller's backend is privileged. It manages local paths, spawns agent CLIs, runs terminal sessions, and holds your API keys. Anyone who reaches it can drive your machine. Do not expose it directly to the public internet.

Recommended: Tailscale

Tailscale puts your devices on a private network. Anyone your Tailscale policy permits to reach this device can use Controller. Its API and WebSocket endpoints accept connections arriving over Tailscale, while local localhost access continues to work.

1. Install Tailscale on your Mac (or Linux host) and on your phone.

2. Sign in to the same account on both.

3. Use a short machine name. A name like macbook is far easier to type on a phone keyboard than germanescobars-macbook-pro-2. Set it in the Tailscale admin panel, or:

   sudo tailscale set --hostname=macbook

4. From your phone's browser, go to http://<shortname>:4500 — substituting the port you picked on the welcome screen (or the Vite port shown by npm run dev):

   http://macbook:4500

The app's "Listening on port N" footer has a Copy button that grabs the full local URL. Replace localhost with the device's Tailscale name on your phone.

Anyone your Tailscale policy permits to reach Controller can use its privileged API. Restrict access to devices you trust; Controller does not add a separate login for remote access.

LAN fallback

Direct LAN requests to Controller's API and WebSocket endpoints are blocked. Use Tailscale for remote access.