Skip to main content

​
Remote Web UI

Your Avibe runs on your machine. You don’t sit in front of it 24/7. You’re on a plane. At a café. Holding someone else’s borrowed laptop. The bot just pinged you that a job needs attention — and the control panel is back home. 
vibe remote
One command. Your local Web UI becomes reachable from any browser on Earth — through a secure avibe.bot tunnel.
  • 🌍 Your own you-app.avibe.bot — 30-second sign-in, your slug for life
  • 🔒 Fail-closed at every join — auth, routing, host checks default to “deny”
  • 📱 Mobile-aware UI — thumb-friendly layout, designed for borrowed screens
  • ⏱ 24-hour sessions — cookie auto-renews mid-session, no sudden logouts
No VPN. No port forwarding. No “wait what’s my IP again.” No public webhooks pointed at your laptop. Your data plane stays on your machine; avibe.bot is just the control-plane handshake.

​
What it does

vibe remote guides you through:
  • avibe.bot sign-in.
  • Pairing your local Avibe instance.
  • Creating a secure tunnel to your local Web UI.
  • Opening the Web UI from another device.

​
What it does not do

It does not move your coding agent into the cloud. Your codebase, agent process, credentials, and working directory stay on your local machine. The remote URL is for Web UI access.

​
The trust model

avibe.bot is the control plane, not the data plane — the front door, not the house. It does two narrow jobs: prove it’s you, and open a tunnel. It never sees or stores your code, your keys, or your agent’s work. 
your phone ──> avibe.bot (identity only) ──────────> sign-in
your phone ──> Cloudflare tunnel ──> your machine's Web UI (your data)
  • Identity via OIDC + RS256. Sign-in uses standard OpenID Connect (PKCE) with RS256-signed tokens. avibe.bot publishes a JWKS, so your local Avibe verifies a session’s signature on its own — it doesn’t have to phone home on every request.
  • Cloudflare Tunnel, run locally. cloudflared runs on your machine and dials out. Browser traffic reaches your Web UI through that tunnel; it does not proxy through avibe.bot’s servers, and no inbound ports are opened on your machine.
  • Fail-closed at every join. Auth, routing, and host checks all default to deny. A misconfiguration locks you out — it doesn’t quietly expose your machine.
→ The same stance, end to end: Local-first · Design Philosophy

​
Who can sign in

Remote access is a private workspace, not a team gateway. Only the email addresses you authorize can sign in to your public URL — bind the ones you trust, and nobody else gets in, even with the link. No team seats, no role matrix: just you and the people you explicitly invite.

​
When to use it

Use vibe remote when:
  • You want to configure Avibe from your phone.
  • Avibe is running on a remote development box.
  • You need to check the dashboard away from the machine running the agent.
For normal chat-based control, you can keep using Slack, Discord, Telegram, WeChat, or Lark directly.

​
Pairing and the tunnel

Pairing happens once per instance:
  1. Sign in at avibe.bot and create a remote-access bot.
  2. Copy the one-time pairing key (vrp_…).
  3. Paste it into vibe remote, or pass it directly: vibe remote pair <key>.
After pairing, manage the tunnel with vibe remote status, vibe remote start, and vibe remote stop. The tunnel itself is run locally by cloudflared; the public URL only proxies traffic into your local Web UI.

​
Sign-in sessions

The public URL is protected by an avibe.bot sign-in. After you sign in on a device:
  • The session lasts about 24 hours.
  • Activity past the half-life slides the session forward, so an active browser rarely needs to sign in again.
  • Sign out from a device with the dashboard’s sign-out action; the tunnel itself keeps running for other devices and for future sign-ins.
If a device reports the session as expired, sign in again at the public URL.

​
Stopping remote access

vibe remote stop shuts down the cloudflared tunnel but keeps the pairing config so you can resume later with vibe remote start. Running vibe remote again with a new pairing key replaces the configuration.