Remote control

In arcflare agent or arcflare run, type:

  Remote control on · relay connected
  key   afrc_••••••••••••••••••••••••••••X3q
  open  https://arcflare.net/remote#k=afrc_…
  or paste the key at https://arcflare.net/remote · /rc off to stop
  anyone with this key can use this session — treat it like a password

A QR code prints right above the key. Point your phone's camera at it and the session opens in the browser, from any Wi-Fi or mobile data. /rc qr shows it again; --no-qr hides it.

Or open the link on your phone, or paste the key into Remote. You see the session as it happens, including what was typed at the terminal, and anything you send goes straight to the model.

In ArcFlare Desktop, click phone in the title bar and scan the QR code. Messages from your phone run on the model loaded in the app, the replies stream back to the phone, and the conversation also shows up under phone in Chat. It uses the same key as the CLI.

  your machine                    relay (the website)                 your phone
  ────────────                    ───────────────────                 ──────────
  arcflare  ── long-poll ──────▶  /api/rc/host     ◀── long-poll ──   /remote
            ◀─ messages, approvals                  output, prompts ─▶

• Outbound only. Your machine asks the relay for messages, the way a web page would. Nothing listens on a port, so NAT, firewalls and hotel Wi-Fi don't matter.
• Replay. A browser that connects late gets the session so far, then live output.
• Reconnects. If the network drops, ArcFlare retries with backoff. If the relay restarts, it re-opens the session.

Remote control lets someone else type into a session that can run commands, so the design treats the key as a password.

• The key is 24 random bytes (192 bits), stored in ~/.arcflare/rc.json with owner-only permissions.
• It travels in an Authorization header, never in a URL the server logs. The relay files sessions under a SHA-256 of the key and never stores the key itself.
• The link carries it in the URL fragment (#k=…), which browsers never send to a server. The page removes it from the address bar as soon as it loads.
• Remote control is off until you type /rc at the terminal, and it ends with the session.
• The Remote page is excluded from search engines and remembers keys only on devices where you leave "Remember" ticked.

Approval follows whoever asked

When a message came from the browser, the agent asks the browser before running a tool, with Allow and Deny buttons. Nobody answering within five minutes counts as no. Messages typed at the terminal are approved at the terminal. Auto mode skips approval everywhere.

The relay is two API routes in this website. To run your own, deploy the site and point ArcFlare at it:

On a serverless host such as Vercel, give the relay a Redis store so every instance sees the same sessions: set UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN (or add Upstash from the Vercel marketplace, which sets KV_REST_API_URL and KV_REST_API_TOKEN). Without one, sessions live in the server's memory, which works for one long-lived Node process: next start, a container, or a VM. Sessions expire after six hours idle either way.

On a home network, the site's dev server already listens on every interface. Run npm run dev on one machine and point the others at http://that-machine:3000.

The relay can also be set per run with ARCFLARE_RELAY.