Scan to control from your phone, an app that updates itself, and a security review

A busy week. Here is everything that shipped since ArcFlare Desktop came out, in one place. The changelog has every individual change.

Scan a QR code, use it from your phone

Type /rc in a session and a QR code now prints right in the terminal. Point your phone's camera at it and the session opens in the browser, so you can read along, send messages and approve tools from the sofa, the train or another country. Your machine only makes outgoing requests, so there are no ports to open, and the key lives in the link, never on our server.

The desktop app does the same: press phone in the title bar, scan, and chat with the model on your computer. The conversation also appears in the app under phone, so you can carry on at the keyboard.

The hosted relay at arcflare.net is being switched on as this goes out. If /rc says the relay is off, try again later, or run your own with arcflare rc relay <url>.

The desktop app updates itself

ArcFlare Desktop 0.3 checks for new versions in the background, downloads them, and puts ready · restart in the title bar. On Windows and AppImage it installs in place. macOS and .deb builds aren't signed yet, so there it links you to the download instead. You can turn checking off in Settings.

Answering a security review

Someone filed a careful review of what ArcFlare can do to a machine. The summary was right: it is a local automation tool that runs with your permissions, not a sandbox. That's now written down plainly in SECURITY.md and on the Security page, and several things changed:

• arcflare update only installs from the official repository, shows the incoming commits and asks first. Installs are pinned to the exact commit it checked.
• Trusting a project's MCP config now shows every command it runs, every host it talks to, and which environment variables it would send where, e.g. sends $GITHUB_TOKEN to api.example.com, before you say yes.
• arcflare mcp logout --all deletes every saved OAuth token.

Smaller things

• `arcflare harness update` updates Codex, OpenCode, Hermes and Claude Code with their own updaters. Add --dry-run to see what it would run.
• Report a bug from the website or with arcflare report. If the site can't file it directly, you get a pre-filled GitHub issue instead, so nothing you wrote is lost.
• The website got wetter. The top of the home page is a real ripple simulation now: move over it for a wake, click for a splash. The panda at the bottom of the page comes in ASCII and liquid; drag the handle between them. If you switch on match my weather and it's below freezing where you are, the water freezes. It's off unless you turn it on, and only the temperature is kept, in your browser.
• The blog has an RSS feed.

As always: arcflare update for the CLI, and the desktop app updates itself from 0.3 on. Found something broken? Tell us.