Remote access

The tunnel lets a browser or phone anywhere open the app’s page on your computer, with its sandboxes and chats, without opening ports or a VPN. Everything between the paired browser and your computer is end-to-end encrypted: the tunnel only relays it and cannot read it.

The hosted tunnel is https://tunnels.codeflower.app; you can also run your own.

Pair a phone or browser

On your computer, run:
Terminal window
```
codeflower tunnel pair
```
or, in the app’s window under Server, use Remote access → Pair a browser or phone.
The first time, sign this computer in. It asks whether the tunnel should pass only through EU datacenters (saved as tunnel.eu_only in config.yaml), then shows a code and opens the tunnel’s approval page. Sign in there with GitHub (two-factor authentication required), Google, or a passkey, check the code and the computer’s name, and approve.
Open the pairing link on the phone or browser: scan the QR code, or open the printed link. It works once, for 10 minutes. Sign in to the tunnel there with the same account, check that the key fingerprint matches the one your computer printed, and name the device.
The page opens: your sandboxes and their chats, as in the app’s window. Add it to your home screen to get back to it.

Pairing also starts the app in the background on your computer if it is not running, to keep the tunnel connected. codeflower run and interactive print a tunnel link to their chat (with a QR code) when this computer is signed in; --no-tunnel keeps a sandbox off the tunnel.

Several computers

Pair the same browser with each of your computers: run codeflower tunnel pair on each and open its link. From then on, any of their links shows the sandboxes of all of them, in one page:

The sidebar lists the sandboxes under a heading per computer. Chats from different computers open side by side in the tabs, and Focus keeps them all in one list, in the order they need you.
Server shows one computer at a time; choose which on top.
The page comes from one of your computers. As it opens, it moves once to the computer running the newest code flower, keeping where you were, because a newer page can use older apps. To stay on the computer whose link you opened, tick Keep … ’s page at the bottom of the sidebar. The house icon in the sidebar marks the computer the page comes from.
A computer that is off, asleep or not answering stays listed, greyed, with its open chats; they come back when it does. Focus’s next skips its chats meanwhile.
If the computer the page comes from stops, the page offers to open from another one.
Only computers that are paired with this browser and on the tunnel account you are signed in with show up. A computer running an older code flower than the page can use shows a note to update it.

The page keeps the code it loaded from each computer in the browser, so opening it again only asks your computer for the page itself.

What a paired browser can do

It can use your sandboxes’ chats, which means running code in them, and stop sandboxes. It cannot add sandboxes by address, quit the app, or change remote access. Two settings in config.yaml change this:

tunnel.manage: true: paired browsers may also start sandboxes and browse folders.
tunnel.hardened: true: each browser is limited to the sandboxes you choose when pairing it, and on Linux (kernel 6.7 or newer) the part of the app that talks to the tunnel runs as a separate, confined process. With it, codeflower tunnel pair SANDBOX… names the sandboxes.

Each computer applies its own settings to its own sandboxes, also when the page comes from another computer.

Managing it

Command	Does
`codeflower tunnel status`	the connection, this computer’s key, paired browsers, sandboxes
`codeflower tunnel devices`	lists paired browsers
`codeflower tunnel revoke DEVICE`	unpairs one (by name, or the start of its fingerprint); its open pages close at once
`codeflower tunnel off` / `on`	turns remote access off at once (pairings are kept) and on again
`codeflower tunnel rotate`	gives this computer a new key: every browser must pair again
`codeflower tunnel logout`	signs this computer out and forgets all pairings
`codeflower tunnel verify`	checks the code the tunnel serves to browsers against the hashes built into the app

The app’s Remote access card does the same: pair, list and Unpair browsers, Sign out. These work only on the computer itself, never through the tunnel. On the tunnel’s account page you see your computers and can revoke one.

Good to know

Private browsing windows do not work: the page needs a service worker, which they do not allow.
Signing in again (tunnel login) replaces this computer’s connection: browsers must pair again.
Each computer signs in separately. With a home folder shared between machines (a cluster), use it from the machine that signed in.
At least one paired computer must be on, with the app running, for the page to load; each computer’s sandboxes show while it is.

How the encryption works, and what the tunnel’s operator can see: Security model.