iOS Remote

Your terminal.
Your pocket.

Q: Does the relay server see my terminal output?

No. The relay is a transparent WebSocket forwarder. Encryption happens on your Mac and your iPhone. The relay forwards encrypted blobs it cannot read.

Control Chau7 from your iPhone. View tabs, send commands, approve dangerous actions from the couch. End-to-end encrypted. The relay never sees a byte. Somewhere, a sock is traveling.

Screenshot needed iPhone showing Chau7 Remote: terminal output with ANSI colors, tab list with 2-3 tabs (one MCP-controlled), quick-key bar visible.

Your Mac's terminal. On your phone. Encrypted end-to-end.

Three steps to remote sock control

Pair once. Connect forever. The encryption does the heavy lifting so you don't have to.

Pair with a code

Your Mac shows a 6-digit code. Type it on your iPhone. That's the only time you'll need it. After that, your devices recognize each other by key fingerprint.

Encrypted relay

Both devices connect to a Cloudflare relay via WebSocket. The relay forwards opaque blobs it can't read. It never decrypts, never inspects, never stores. Shiny and dumb, by design.

Full control

View terminal output, switch tabs, send commands, approve dangerous actions. Everything your Mac sees, your phone sees. With the same latency as your Wi-Fi.

Not a dashboard. A remote control.

Read output, send commands, approve dangerous operations. If you can do it at your desk, you can do it from your phone. Possibly in better lighting.

Terminal & I/O

Live outputStream terminal output in real time with optional ANSI color rendering

Send commandsType and submit commands with a terminal keyboard bar (Esc, Tab, Ctrl+C/D/Z/L, arrows)

Tab switchingView all open tabs with AI branding indicators, switch between them

MCP awarenessSee which tabs are MCP-controlled with visual AI badges

Approvals & Safety

Approval gateDangerous commands and MCP actions push to your phone for approval

NotificationsGet notified when your AI needs permission. Approve from the notification.

Approval historyLast 50 decisions with timestamps. See what you approved and when.

Protected actionsSecondary confirmation on destructive commands. Two taps, not one.

Your Lock Screen knows what your AI is doing.

Live Activities and Dynamic Island. Because checking on your AI agents should not require opening an app. Or pants.

Screenshot needed iPhone Lock Screen with Live Activity: "Claude Code - running", project name, Approve/Deny buttons. Bonus: Dynamic Island compact view showing terminal icon.

Claude is running. It needs approval. You don't even need to unlock.

Dynamic Island

Compact, expanded, and minimal views. See your AI's status at a glance without opening anything.

Lock Screen Actions

Approve or deny directly from the Lock Screen. Open the app, jump to a tab, or dismiss. One tap.

Priority-Based

Waiting for input ranks highest. Then failures, then running, then completed. The most urgent thing always shows.

Auto-Dismiss

Completed activities fade after 8 seconds. Failures stick around for 20. Nothing clutters your screen forever.

The encryption is not decorative.

Curve25519 key agreement. ChaChaPoly1305 authenticated encryption. The relay is a dumb pipe.

Pair

6-Digit Code

One-time pairing via a short code displayed on your Mac. 10-minute TTL, 5-attempt lockout. After pairing, devices remember each other by Curve25519 public key fingerprint.

Agree

X25519 + HKDF

Both devices perform X25519 key agreement and derive a per-session key via HKDF-SHA256. New session, new key. Nonces include a 4-byte prefix and monotonic sequence numbers to prevent replay.

Encrypt

ChaChaPoly1305 AEAD

Every frame after handshake is authenticated and encrypted. The relay forwards ciphertext it cannot read. If someone compromises the relay, they get opaque blobs and sequence numbers. That's it.

Store

Keychain + Machine UUID

iOS stores keys in the Secure Enclave via Keychain. macOS wraps private keys with AES-GCM derived from the machine UUID. Move the disk to another Mac, the keys are useless.

And now for something completely architectural

Three pieces. One encrypted channel. The relay is intentionally stupid.

  iPhone                    Relay                    Mac

  Chau7 Remote              Cloudflare Workers         chau7-remote agent
       │                          │                          │
       ├── WebSocket ─────────────┤                          │
       │   (encrypted frames)     ├── WebSocket ─────────────┤
       │                          │   (encrypted frames)     │
       │                          │                          ├── Unix socket
       │                          │                          │   to Chau7.app
       │                          │                          │
       │     relay sees:          │                          │
       │     opaque blobs         │                          │
       │     sequence numbers     │                          │
       │     nothing else         │                          │

Frequently asked questions

How is the connection secured?

All communication is end-to-end encrypted using Curve25519 key agreement and ChaChaPoly1305 AEAD. The relay server forwards opaque encrypted frames. It never sees your terminal data.

Does the relay server see my terminal output?

No. Encryption happens on your Mac and your iPhone. The relay is a transparent WebSocket forwarder running on Cloudflare Workers. It forwards ciphertext it cannot decrypt. By design.

Do I need to pair every time?

No. After the first pairing (6-digit code), your iPhone stores the Mac's Curve25519 public key in the Keychain. Future connections authenticate automatically via key fingerprint. No code needed.

What happens if the relay goes down?

Both the Mac agent and the iOS app reconnect automatically with exponential backoff (up to 5 attempts). Your terminal keeps running normally. You just can't see it from your phone until the relay is back.

Can I run commands from my phone?

Yes. The iOS app has a full input field and a terminal keyboard bar with Esc, Tab, Ctrl+C/D/Z/L, and arrow keys. Hold-to-send mode prevents accidental submissions, because typing on a phone near a production server deserves a safety net.

What if someone compromises the relay?

They get opaque encrypted blobs and sequence numbers. That's it. The relay never has your session keys. It's a WebSocket forwarder that happens to be very good at knowing nothing.

Does it work over cellular?

Yes. The connection goes through the Cloudflare relay, so any internet connection works. Wi-Fi, cellular, tethering, the questionable airport Wi-Fi. As long as both devices can reach the relay, you're connected.

Your terminal.Your pocket.