Remote access

Remote access lets you connect to the computer running AGI Cockpit from a phone, tablet, or another computer. This guide uses the recommended Tailscale and HTTPS configuration and ends with a working task view in the PWA.

How remote access works

The computer running Cockpit becomes the connection target. The PWA in your browser operates that Cockpit. Tasks, agent processes, and working files remain on the target computer; they are not moved to the PWA.

The AGI Cockpit process and remote access must remain running on the target computer. If you run Cockpit on several computers, each one remains a separate target with its own tasks and settings.

When Cockpit runs on several PCs under the same Tailscale account, the Device filter in the Desktop task list can show task summaries from the other PCs. Selecting a row opens that device's PWA inside Desktop, where you can read the conversation, send messages, answer Asks, stop the task, or complete it. The list feed and the interactive task detail use separate connections. The task view identifies the target device; confirm it before acting. See Task list for the workflow.

What Tailscale is

Tailscale is a service that securely connects your own devices to each other. When you sign in to the same Tailscale account on your computers and phones, those devices form a private network of their own (a tailnet), and traffic between them is encrypted.

AGI Cockpit uses it so that you can reach the computer running Cockpit safely from elsewhere, such as from your phone while you are out. Cockpit is not exposed to the public internet: only your own devices in the same tailnet can connect to it.

Install Tailscale on both the target computer and the device you connect from.

• Computers (Windows, macOS, Linux)
• iPhone and iPad (App Store)
• Android (Google Play)

To open the PWA from a phone, that phone also needs Tailscale installed and signed in to the same tailnet as the target computer.

Before you begin

If you do not use Tailscale yet, install it on both the target computer and the remote device from the links above, and sign in to the same tailnet on each one.

Connect with Tailscale and HTTPS

1. Start remote access in Tailscale-only mode

1. Open Remote access in the lower-left corner of Desktop.
2. If Cockpit reports that Tailscale is stopped or needs authentication, start it or sign in from the on-screen action.
3. Select Tailscale only.
4. Confirm that Connection info shows a URL and QR code.

Tailscale-only mode rejects connections that do not come through Tailscale. Tailscale encrypts device-to-device traffic even while the displayed URL uses HTTP, but the browser still treats that page as an HTTP origin. Set up the certificate below to avoid browser warnings and support features that require HTTPS.

2. Get an HTTPS certificate

1. Select Get certificate in the Remote access panel.
2. If Cockpit shows your Tailscale account does not support getting TLS certs, open Tailscale DNS settings.
3. Enable MagicDNS in the Tailscale admin console.
4. Under HTTPS Certificates, select Enable HTTPS and review the disclosure before confirming.
5. Return to Cockpit and get the certificate again.
6. Confirm that Cockpit shows HTTPS certificate issued and a domain.

You can also open the Tailscale DNS settings directly. If you cannot change them, ask an Owner, Admin, or Network admin of the target tailnet.

Getting a certificate asks the installed Tailscale to print the certificate and private key, then saves that copy in Cockpit's data on this computer. Cockpit uses the copy for HTTPS and for expiry checks, and replaces it whenever the certificate is renewed. If HTTPS is already on and Cockpit does not yet have its own copy, starting Remote Access asks Tailscale for one before the server listens. The same step is used on macOS, Windows, and Linux, whether Tailscale came from the App Store, the standalone installer, or Homebrew. Cockpit does not read certificate files that Tailscale keeps inside another app's folders. If that copy is still missing, Remote Access says so and keeps Get certificate available while HTTPS is on, even when the server is stopped. Full Disk Access is not required.

Enabling Tailscale HTTPS records the device name and tailnet DNS name from the certificate in the public Certificate Transparency log. Rename a device before requesting its certificate if its name contains sensitive information. See Tailscale's HTTPS documentation for details.

Automatic certificate renewal

Starting HTTPS Remote Access checks the certificate, and a running server checks again every 24 hours. Waking from sleep runs an overdue check. Cockpit automatically renews a certificate with 30 days or less remaining, including an expired certificate, through Tailscale and applies it to the live TLS server. Existing connections remain open; new connections use the renewed certificate. Cockpit does not override Tailscale's reissuance timing.

A failed automatic renewal retries after six hours. When failure occurs with 14 days or less remaining, including after expiry, Cockpit shows an actionable warning with the reason and a Renew action at most once per 24 hours. Successful automatic renewals are silent. Stopping Remote Access also stops scheduled checks.

3. Turn on HTTPS and open the PWA

1. Turn on HTTPS.
2. Confirm that the connection URL now has the form https://device-name.tailnet-name.ts.net:47280.
3. Scan the QR code or open the displayed URL on the remote device.
4. If device pairing appears, enter the six-digit pairing code from the Desktop Remote access panel.

A Tailscale device owned by the same user in the same tailnet may be authenticated automatically from its Tailscale identity. A connection that Cockpit cannot authenticate automatically requires the pairing code. The code refreshes after five minutes; select Regenerate to replace it immediately.

Before pairing succeeds, Cockpit does not send task notifications, full task state, or recent folder lists to that connection, and it closes an unpaired connection after two minutes. If the connection drops while the PWA is pairing, the form keeps the entered code and reconnects. A code already submitted before the authentication reply is sent again automatically, so do not regenerate it unless it has expired or Cockpit rejects it.

The connection is ready when the PWA header shows the target machine name and Connected, and you can open Inbox, Tasks, and Autorun. The browser tab title also starts with the target as <machine name> - AGI Cockpit, making several connections distinguishable even in narrow tabs. While disconnected or before a machine name is available, it falls back to AGI Cockpit.

Supervise work in the PWA

The PWA is an operating surface for checking progress and decisions from another location. Enable remote access and configure its transport and HTTPS certificate in Desktop. Not every Desktop setting or result view is available in the PWA.

The PWA stores an in-progress message body per task in sessionStorage. Switching tasks or reloading the page or an embedded remote-task view in the same browser tab restores the draft. Drafts do not synchronize to another device and are not persistent storage beyond the browser tab session. Sending or clearing a draft removes it, and drafts for tasks that disappear are pruned after the task list has synchronized.

The task panel in task details provides context-dependent tabs for child tasks, HTML Surface, an image opened from the conversation, diff, Cockpit Browser, App Surface, terminal, skills, Fleet, Creative Studio artifacts, and Talk Room. On a wide screen it appears beside the chat; on a narrow screen it remains a bottom sheet. A wider three-column layout can keep the task navigator visible too. Changing width or orientation preserves the open tab, target, drafts, and scroll positions while the presentation switches. Cockpit Browser shows a still image of a host tab inside the task's assigned Browser Identity, refreshes it every ten seconds while visible, and provides four controls that scroll the host page. Scrolling also changes the host-side position, but the PWA does not activate links, type, or submit forms. See cockpit browser for scope, limits, and storage boundaries.

App Surface is a view-only image of the Android target or iOS Simulator already attached to the task on the host, refreshed every two seconds while visible. Attach, detach, reconnect, input, and app launch remain host operations. Skills is also view-only: it searches the project and global skills that the host discovered for the task and shows their description, argument hint, definitions, and body. See App Surface and Results and tools for operation and limits.

Project headings in the PWA task list can collapse their tasks while leaving task counts and running or unread indicators visible. This state is stored in that browser per project directory and does not sync to other devices. The HTML Surface tab marks unseen results and lets you jump to the latest one without losing older unseen history. For a task in a Fleet Run, the Fleet tab provides read-only progress, dependencies, step details, and navigation to supported node tasks. The terminal key bar has a Modifier keys menu for Ctrl+C, Ctrl+X, Ctrl+S, and Shift+Tab. See Task list, Results and tools, and Fleet for the operating details and limits.

The PWA's light or dark appearance follows the connected Desktop's mode under Appearance. It stores the last synchronized mode on the device and uses it at the next launch until the connection returns. This is not a separate choice based on the device operating system theme.

A message sent while a task is running enters the queue without stopping the current turn and is delivered automatically after the response. In Claude, Codex, Antigravity, Cursor, Qoder, and Grok Build Native UI, sending only /compact compacts the conversation context. A normal message sent during compaction is also queued. In an unsupported Native UI, /compact reports that it is unavailable instead of sending the text as a normal message.

Before adding AGI Cockpit to the home screen, turn on HTTPS in Desktop and open the https://... URL shown in Connection info. An HTTP URL is not a supported configuration for using AGI Cockpit as a PWA. After opening the HTTPS page, select Add to Home Screen from Safari's Share menu on iPhone or iPad. In Chrome on Android, open the browser menu and select Install app or Add to Home screen.

Switch between Cockpit computers

Update the connected host

From version 4.72.0, Host updates in the PWA lets an authenticated device check for and download updates to the connected Cockpit computer. This updates the host application, not just the PWA.

Installing requires a separate confirmation. Installation restarts the host and terminates every running task. Finish or safely pause important work before confirming. The PWA tracks the restart and attempts to reconnect automatically; if reconnection fails, check that the host application and remote access are running.

Automatic installation is available only on hosts that support it and after the update has downloaded. Microsoft Store installations must update through Microsoft Store; hosts requiring manual updates show the download page instead. Development builds do not support automatic installation. Only authenticated connections can request host updates.

Select the connection target in the PWA header, then Host updates. Review the running and available versions and release notes, select Check for updates, and use Download when offered. Once Ready to install appears, select Update now and review the separate restart confirmation. After reconnection, verify the running version. If the host returns without the requested version or reports an error, inspect Updater log summary before retrying.

On a supported packaged macOS host, Install when idle arms the downloaded update for the point when no task or Fleet Run is running. The screen shows the current blocking count and allows cancellation before installation starts. The schedule lasts only for the current host session. Waiting tasks and paused Fleet Runs do not block it; when installation begins, every task terminates.

Choose another computer

If several computers have remote access enabled, select the connection target in the PWA header to see other Cockpit computers discovered through Tailscale. Select Open to move to another target or Scan again to refresh the list.

Each Cockpit remains independent. Switching targets does not merge or move tasks, Autoruns, settings, or working files between computers.

Connect over local Wi-Fi

When Tailscale is unavailable and you need a temporary connection on a trusted LAN, select Allow local Wi-Fi too. Accept the risk in the confirmation, open the displayed http://local-IP:47280 URL, and enter the six-digit pairing code.

Local Wi-Fi mode cannot use HTTPS. A third party on the same Wi-Fi network may be able to read the token and task content. Do not use this mode on public Wi-Fi, a shared office network, or a network available to visitors. Do not expose it to the internet with router port forwarding.

Stay reachable after the display turns off

Turning a laptop's display off leaves nothing keeping the computer awake, so it sleeps after a short idle period and remote access becomes unreachable. Tailscale then reports the computer as offline.

Turn on Keep this computer awake in the Desktop Remote access panel to stop the computer from sleeping while idle during remote access. Display sleep is never blocked, so the screen still turns off as usual. The toggle is off by default, and a change is saved immediately without restarting the server.

Only idle sleep is prevented. Closing the lid, choosing Sleep from the Apple menu, or any other explicit sleep still puts the computer to sleep and ends remote access. Keep the lid open when you rely on this.

The computer is only kept awake while remote access is running. Turning remote access off, turning this toggle off, or quitting AGI Cockpit all release it. On battery the computer stays awake and keeps draining. Connect it to power while you rely on this, or turn remote access off when you finish.

Stop remote access

Select Off in the Desktop Remote access panel. Cockpit disconnects active sessions and returns the target to local-only use. After you enable it again, a device that is not authenticated automatically must use the new pairing code.

Cockpit also stops a running remote-access server and returns to Off if the AGI Labo sign-in or membership becomes invalid. A temporary membership-verification outage preserves a running connection and shows an action to check again instead of stopping it immediately.

Inspect and configure it from the CLI

An AI agent or terminal can inspect the current state and prerequisites:

cockpit remote-access status --verbose
cockpit remote-access tailscale status
cockpit remote-access certificate status

To configure a stopped Cockpit for Tailscale and HTTPS, get the certificate, save the configuration, and enable remote access:

cockpit remote-access certificate generate
cockpit remote-access configure --scope tailscale --https true --keep-awake true
cockpit remote-access enable

--keep-awake true|false matches the Desktop toggle. cockpit remote-access status reports the stored value as configured.keepAwake and the live assertion as runtime.keepingAwake.

cockpit remote-access certificate status reports expired, signed daysRemaining, and renewal. renewal.lastAttempt describes the latest automatic attempt, nextCheck the next check, and failed an actionable failure. Renewal history stores only non-secret reason codes. While HTTPS is running, expiry reflects the certificate successfully loaded by the TLS server rather than a newer file that failed to reload.

Configuration cannot change while the server is running. If you need to change it, confirm that active sessions may end, then run cockpit remote-access disable --confirm. CLI configuration and enablement for local-network access both require --confirm-local-network.

Operate another Cockpit from the CLI

cockpit devices, cockpit devices list, and cockpit devices all list this computer and devices on the same tailnet that answer Cockpit's health check. Each device includes the os reported by Tailscale, or null when Cockpit cannot recognize it. A device that is online in Tailscale but does not answer Cockpit is omitted from devices and reported with a reason under diagnostics.unreachable. diagnostics.notProbed counts devices that Tailscale reports as offline or without an address. cockpit devices self does not probe peers; it returns only this computer and aliases.

An alias is optional. Save one with cockpit devices alias-set <alias> <host> when useful, then add --host <host-or-alias> to supported task, autorun, accounts, fleet, and hooks commands or to ask list, ask answer, and ask close. Remote Ask creation remains unsupported. Browser, App Surface, display, settings, and other local-control families still operate only the local Cockpit.

Remote CLI requests from a computer on the same tailnet with the same Tailscale owner need no token. Other connections need a paired bearer token in AGI_COCKPIT_TASK_REMOTE_TOKEN or AGI_COCKPIT_SYNC_TOKEN. In Tailscale-only mode, Cockpit refuses connections that are neither a Tailscale peer nor loopback, even with a token. File paths and directories refer to the target computer, and remote responses include its device identity. The remote transport does not fall back to local file IPC.

Troubleshooting

Tailscale itself can be connected while Cockpit is unable to read the Tailscale CLI state. If the CLI check error persists, reinstall Tailscale and check again.

Security notes

• Use Tailscale only with HTTPS for normal remote access.
• In Tailscale access controls, allow only the people and devices that should reach Cockpit.
• The PWA can send task instructions, answer Asks, and change Autoruns. Lock connected devices and do not leave credentials on a shared device.
• Before requesting an HTTPS certificate, confirm that the device name is safe to include in a public certificate log.
• Local Wi-Fi mode is not encrypted. Limit it to a trusted network and the time you need it, then turn remote access off.

Related pages

• What is AGI Cockpit?
• Task list
• Task details
• Ask
• Autorun
• Cockpit CLI