Tri-Tier Real-Time Topology
How CodePilot Remote secures, routes, and executes agent permissions across your desktop workstation, local gateway, and mobile device.
Desktop Agent
Python 3.14+- • Terminal Output Watcher
- • Provider Regex Parsers (Claude / Gemini)
- • Async WebSocket Client
- • Automated Stdin Relay ('y' / 'n')
FastAPI Gateway
Uvicorn + aiosqlite- • REST API & WebSockets Routing
- • JWT Cryptographic Verification
- • 6-Digit Transient Pairing Engine
- • Persistent SQLite Audit History
Mobile App
Flutter 3.44- • Real-Time Permission Push UI
- • 1-Tap Approve / Deny Actions
- • Multi-Session Timeline View
- • Risk-Based Notification Rules
PERMISSION LIFECYCLE SEQUENCE
Agent Prompts Permission in stdout
Desktop Parser forwards via WebSocket
Mobile Companion receives alert
User taps Approve / Deny
Decision injected into Agent stdin
Engineered for Frictionless AI Supervision
Instant Mobile Decisions
Never stall an AI workflow while away from your keyboard. Review file diffs, terminal commands, and API payloads on your phone and approve with one tap.
Concurrent Agent Manager
Create, switch, rename, and supervise multiple active coding sessions (Claude Code, Gemini CLI, Aider) simultaneously from a unified mobile dashboard.
Session State Resume
Closed the terminal or restarted your PC? Reconstruct active sessions from stored metadata seamlessly without losing context or historical state.
Persistent Timeline Log
Full offline audit trails stored in lightweight SQLite databases. Review all past file modifications, executions, tests, and security approvals.
Transient Cryptography
Link mobile and desktop securely in seconds using 6-digit one-time pairing codes. Signed JWT tokens guarantee authenticated peer-to-peer routing.
Real-Time WebSockets
Full-duplex WebSocket channels provide sub-15ms message dispatch and synchronized terminal frame streaming across local LAN or remote proxies.
Live In-Browser CodePilot Simulator
Experience the complete CodePilot Remote workflow directly in your browser: generate a pairing code, link the companion phone, and approve an AI tool request.
Unpaired Device
Generate a pairing code on your desktop, then enter it here.
Sahir-Workstation-01
Active Session: Claude Code (Python API)
Write File: src/auth.py
Tool: FileEditTool
Lines: +42, -18
Standard CLI Administration
| Command | Example | Description |
|---|---|---|
| start [provider] | codepilot start claude | Launches background FastAPI gateway and attaches terminal watcher to Claude, Gemini, or generic AI process. |
| pair | codepilot pair | Generates a cryptographically signed 6-digit transient code to bond a new mobile device. |
| unpair | codepilot unpair | Revokes active mobile binding mappings in SQLite and cleans local credentials. |
| status | codepilot status | Pings the local gateway daemon and reports real-time socket connections and session state. |
Download CodePilot Remote
Pre-compiled standalone binaries for Windows workstations and Android mobile devices. No Python installation required to run the standalone executable!
CodePilot Standalone Setup
Bundles the Python desktop agent, FastAPI gateway, and runtime dependencies in a standalone executable.
Download Windows Setup (.exe)CodePilot Mobile APK
Companion Flutter mobile app to review permission prompts, inspect live output, and control active agent sessions.
Download Android APKGitHub Source Repository
Clone the repository, inspect test suites, contribute providers, or run customized builds on Linux/macOS.
View on GitHubSecurity & Hardening by Default
JWT Connection Handshakes
All WebSocket handshakes validate tokens signed with local cryptographic secrets. Unsigned packets are rejected immediately.
SQL Injection Prevention
All database queries are fully parameterized via `aiosqlite` abstractions to eliminate SQL injection vectors.
Automatic Log Redaction
Middleware masks authentication tokens, credentials, and API keys (`token=[REDACTED]`) before emitting log frames.
Sliding Window Rate Limits
Defends against brute-force pairing and replay attacks via nonce tracking within a sliding 5-minute validity window.