Reach it from a phone

Agents: claude, codex, opencode · On: phone

A phone reaches a box through the app on app.fezu.dev. Link the box to your fezu.dev account, then log in to the app on the phone. The box serves no page of its own, so no tailnet address or tunnel hostname opens VCode.

Why you would use it

The whole point of the app is driving agents from a phone. The box dials out to the VCode router, so nothing on the machine listens beyond loopback and you open no port on your router.

How to use it

1. Link the box: v-code box link on the machine (link-this-box), or the join command from Add a workstation on fezu.dev/account (add-a-workstation).
2. On the phone, open app.fezu.dev and tap Log in. Log in on fezu.dev; the site sends you back to the app (use-the-app).
3. The box's tabs open. To keep the app on the home screen, see install-on-a-phone.

What you see

The same app on the phone as on a desktop, with the tabs of every box on the account in one strip. A browser that opens the box's own address instead gets a short page that points at app.fezu.dev, and nothing else.

Options and settings

Limits and known gaps

• tailscale serve or a Cloudflare tunnel in front of the box now reaches only the pointer page, /health and the API. The API needs AUTH_TOKEN, so it is for the CLI and scripts, not for a phone.
• install.sh still installs v-code-tunnel.service once TUNNEL_TOKEN is set. cloudflared's token is on its process command line, readable by the agents VCode spawns; install.sh status redacts it from anything it prints.
• The lockout after wrong tokens trusts the client address cloudflared reports, because cloudflared is the only HTTP way in. On a machine reachable another way, a caller can fake that address.

Related

• use-the-app: the app a phone opens
• link-this-box: linking the box to the account
• trust-model-and-security-headers: who can log in, and what a login can do
• install-on-a-phone: adding the app to the home screen
• machine-name: VCODE_NAME, VCODE_URL and VCODE_PEERS