Control your laptop's AI coding sessions from your phone — securely, self-hosted, end-to-end encrypted.
You kicked off a long agentic coding session (Claude Code, Codex, Cursor CLI…) and stepped out. The agent hits a permission prompt and sits there, blocked, until you get back.
awaykit fixes that. Your laptop keeps working while you're away:
- 📱 See the live session stream on your phone
- 🔔 Get a push notification the moment the agent needs input
- ✅ Tap to approve/deny permission prompts as structured cards — no tiny terminal
- 💬 Send follow-up prompts to steer the agent
- 🛑 Kill a runaway session with one tap
| SSH + tmux | Remote desktop | awaykit | |
|---|---|---|---|
| Mobile UX | ❌ tiny terminal | ❌ heavyweight | ✅ purpose-built cards |
| Push on agent prompts | ❌ | ❌ | ✅ |
| Attack surface | ✅ agent session only | ||
| Self-hosted / no vendor cloud | ✅ | depends | ✅ |
| E2E encrypted | ✅ | depends | ✅ |
- Self-hosted. No accounts, no vendor cloud holding your code.
- End-to-end encrypted. Pairing via QR-code key exchange (like WhatsApp Web). If a relay is used for push notifications, it only ever sees ciphertext.
- Scoped by design. The phone can interact with the agent session — not an arbitrary shell. Approve, deny, prompt, kill. That's it (full terminal is an explicit opt-in, off by default).
See docs/SECURITY.md for the threat model.
┌─────────────┐ E2E-encrypted channel ┌──────────────┐
│ Phone app │◄────────────────────────►│ Laptop daemon │
│ (app/) │ (WireGuard/Tailscale │ (daemon/) │
│ │ or WebRTC + optional │ │ │
│ approval │ ciphertext-only │ ▼ │
│ cards, │ relay for push) │ agent session│
│ live stream │ │ (Claude Code,│
└─────────────┘ ┌────────┐ │ Codex, …) │
│ relay/ │ └──────────────┘
│ (opt.) │
└────────┘
daemon/— runs on your laptop; attaches to the agent session (hooks/PTY), exposes an encrypted control channel.app/— mobile client; session stream, approval cards, quick prompts.relay/— optional, self-hostable; forwards ciphertext + wakes your phone with push notifications. Never sees plaintext.
Approve — and steer — your Claude Code sessions from your phone on an end-to-end encrypted channel that only your paired phone can use — on your Wi-Fi, over a VPN, or from anywhere via the zero-knowledge relay.
npm install && npm start # prints a pairing QRScan the QR with your phone, wire up the hook, and every Bash/Write/Edit
the agent tries pops up as a tap-to-approve card — decrypted on your device.
It's a conversation, not just a gate: Deny with a typed note and Claude
reads it as feedback ("don't run that — do X instead"); when the agent finishes
a turn, a "what next?" card lets you send the next instruction so it keeps
going while you're out.
Full walkthrough: docs/QUICKSTART.md.
Away from home? Two paths — a VPN, or the zero-knowledge relay (no VPN, no open ports; it forwards sealed blobs it cannot read): docs/REMOTE.md. Deploy the relay free in one click:
🔒 The channel is encrypted + authenticated (NaCl secretbox) with per-session forward secrecy (X25519 ephemeral keys) — only your paired phone can connect, and leaking the long-term key can't decrypt past sessions. On plain-HTTP LAN it doesn't stop an active on-path attacker; running over a VPN (Tailscale/ WireGuard) closes that gap. Honest threat model: SECURITY.md.
🔔 Push notifications. Over an HTTPS connection (the relay or a tunnel), open the app, tap the status pill → Enable notifications, and your phone buzzes the moment the agent needs you — even with the app closed. The daemon sends the push outbound itself; the payload is end-to-end encrypted to your device (RFC 8291), so the relay and the push service only ever forward ciphertext.
💬 Live chat (v0.9). Beyond approving — drive a session from your phone. The app has two modes you switch between freely: 🛡️ Approvals (the gate — cards only, the default) and 💬 Chat. In Chat you ＋ New a session in a project you allow-listed, then talk to your agent: the reply streams in token by token, you send follow-ups any time, tool calls still pop up as approval cards inline in the conversation, and you can interrupt or end a turn. It's off by default — opt in on the laptop:
AWAYKIT_CHAT=1 AWAYKIT_PROJECTS="/path/to/repo" npm startChat sessions gate every tool through your phone with zero extra hook setup (the daemon injects its own hook config), never skip permissions, and audit every message. Full design + security model: docs/LIVE-CHAT.md.
awaykit isn't tied to Claude Code — the daemon is agent-neutral, and each agent plugs in with a tiny adapter:
| Agent | From your phone |
|---|---|
| Claude Code · Codex CLI · Cursor CLI · Gemini CLI · OpenCode | approve / deny / steer |
| Aider | notify only (it has no approval hook) |
| anything else | awaykit-ask "Deploy?" && ./deploy.sh — gate any command |
Per-agent setup + how to add your own (~30 lines): daemon/src/adapters/README.md.
The daemon has a small lifecycle CLI so you never have to hunt for a stray
process or hit an EADDRINUSE crash. Run these from the repo root:
| Command | What it does |
|---|---|
npm start |
Start the daemon (prints the pairing QR). If one is already running, it just reports the status instead of crashing. |
npm run status |
Is it up? How many phones are connected? Any approvals waiting? |
npm run stop |
Cleanly shut it down. |
npm run restart |
Stop the running daemon and start a fresh one — handy after pulling code. |
- Re-pair (mint a new key + QR) with
npm start -- --pair. - Run a second instance on another port with
AWAYKIT_PORT=4600 npm start. - The controls talk to the daemon over loopback (
/health,/shutdown), so there are no PID files and it works the same on macOS, Linux, and Windows.
On the phone, tap the status pill (top-right) for connection controls:
Reconnect now, Disconnect, and Unpair this device. The stream also
auto-reconnects on its own — so a laptop-side npm run restart reconnects your
phone automatically, no re-scan needed (the pairing key persists).
🚧 Early development.
- ✅ Milestone 0 — hook → daemon → phone approval card → approve/deny unblocks the agent (LAN).
- ✅ v0.1 — QR pairing + end-to-end encrypted, authenticated channel (only your paired phone connects).
- ✅ v0.2 — forward secrecy: per-session X25519 ephemeral keys, so leaking the long-term key can't decrypt past sessions.
- ✅ v0.3 — remote access: use it from any network over a VPN; auto-detects the VPN address for pairing.
- ✅ v0.4 — chat steering: Deny carries your typed note to Claude as feedback; "turn finished — what next?" cards keep the agent going with your instructions.
- ✅ v0.5 — zero-knowledge relay: remote access from anywhere with no VPN and no open ports — a self-hostable relay forwards sealed blobs it cannot read.
- ✅ v0.6 — push notifications: your phone buzzes even when the app is closed. Works over HTTPS (relay/tunnel); the payload is E2E-encrypted (RFC 8291), so the relay and push service see only ciphertext.
- ✅ v0.7 — optional self-signed HTTPS on the LAN (
AWAYKIT_TLS=1): app-shell + channel integrity vs an active on-path attacker, with a verifiable SHA-256 fingerprint; also unlocks LAN push without the relay. - ✅ v0.8 — agent-agnostic adapters: approve/deny from your phone with Codex CLI, Cursor CLI, Gemini CLI, and OpenCode too, plus
awaykit-askto gate any command in any tool. - ✅ v0.9 — live chat: start and drive a Claude Code session from your phone — stream the reply token by token, send follow-ups, approve tools inline, interrupt, kill. Off by default; opt in with
AWAYKIT_CHAT=1+ anAWAYKIT_PROJECTSallow-list. See docs/LIVE-CHAT.md. - ✅ v0.10 — mission control: the phone shows what actually happened, not just that something ran — the agent's final response on every turn-end card, permanent tool-result lines ("▶ npm test → 5 passing", "✏️ Edited daemon.js"), a model·project·state header — and ↩ Continue: adopt a session that finished on your laptop as a phone chat with its full context (
--resume). - ⏭️ Next: v1.0 — audited security model, reproducible builds; more chat drivers + opt-in PTY attach.
Star/watch the repo to follow along.
- Milestone 0 — end-to-end approve/deny loop over LAN (hook + daemon + web client)
- v0.1 — QR pairing + encrypted, authenticated channel (NaCl secretbox)
- v0.2 — forward secrecy (per-session X25519 ephemeral keys)
- v0.3 — remote access from any network over a VPN (Tailscale/WireGuard)
- v0.4 — chat steering (deny with instructions; continue-on-stop with your next prompt)
- v0.5 — zero-knowledge relay (remote without a VPN, ciphertext only)
- v0.6 — push notifications (wake the phone even with the app closed, over HTTPS)
- v0.7 — integrity vs an active on-path attacker: optional self-signed HTTPS on LAN (
AWAYKIT_TLS) - v0.8 — agent-agnostic adapters (Codex, Cursor, Gemini CLI, OpenCode;
awaykit-askfor anything else) - v0.9 — live chat: start & drive agent sessions from the phone (stream, steer, approve inline, interrupt)
- v0.10 — mission control: final responses + tool results on the phone; ↩ Continue a finished laptop session
- v1.0 — audited security model, reproducible builds; more chat drivers + opt-in PTY attach
PRs and issues welcome — see CONTRIBUTING.md.