@smartmemory/compose 0.2.46-beta → 0.2.48-beta

package/README.md

@@ -133,6 +133,23 @@ compose tracker sync     # reconcile op-log against remote provider
 
 See [docs/configuration.md](docs/configuration.md) for the full `tracker` config reference.
 
+## Remote access (mobile PWA from anywhere)
+
+The mobile cockpit at `/m` can be reached from outside localhost — bring your own tunnel, compose handles auth and pairing:
+
+```bash
+npm run build                                  # remote serves the built PWA from the API server
+COMPOSE_REMOTE_AUTH=enabled compose start --host=0.0.0.0
+compose remote pair --public-host=https://your-tunnel-host   # prints a QR — scan it with your phone
+compose remote status                          # bind, devices, tunnel reachability
+```
+
+How it works: binding beyond `127.0.0.1` refuses to start unless `COMPOSE_REMOTE_AUTH=enabled` is set. In remote mode every request needs a credential — there is deliberately **no IP-based trust** (tunnel daemons connect from loopback). Phones pair once via QR (5-minute single-use code) and stay authenticated for 30 days through rotating refresh tokens + 15-minute access JWTs; reuse of a rotated refresh token revokes the device. Devices are listable and revocable (`compose remote list|revoke`, or the cockpit's "Pair mobile" modal). Only port 4001 needs to be exposed — agent-server traffic is proxied through it.
+
+Tunnel layer is yours: Tailscale (serve/funnel), Cloudflare Tunnel, or a reverse proxy on your own VPS+domain all work — the last is the most reliable from restrictive networks (e.g. mainland China, where `trycloudflare.com`/ngrok domains are commonly blocked; plain TLS on 443 to an unremarkable domain travels best). Pair the device *before* traveling: pairing needs a live round-trip, while an already-paired phone only needs refresh.
+
+`compose remote rotate-secret --yes` invalidates every paired device (post-leak hammer).
+
 ## Documentation
 
 Topic-scoped reference:

package/bin/compose.js

@@ -109,6 +109,7 @@ if (!cmd || cmd === '--help' || cmd === '-h') {
   console.log('')
   console.log('Commands:')
   console.log('  start     Start the compose app (UI + API) for this project')
+  console.log('  remote    Manage remote access: pair, list, revoke, status')
   console.log('  new       Kickoff a product (research, brainstorm, roadmap, scaffold)')
   console.log('  import    Scan existing project and generate structured analysis')
   console.log('  feature   Add a single feature (folder, design seed, ROADMAP entry)')
@@ -2345,16 +2346,49 @@ if (cmd === 'build') {
     process.exit(1)
   }
 
+  // --host=<addr> forwards COMPOSE_HOST to the supervisor → api-server child.
+  // supervisor.js already threads COMPOSE_HOST to api-server only; agent-server
+  // stays 127.0.0.1 always (see supervisor.js ~line 146).
+  const hostFlagIdx = args.findIndex((a) => a.startsWith('--host='))
+  const startEnv = { ...process.env, COMPOSE_TARGET: targetRoot }
+  if (hostFlagIdx !== -1) {
+    startEnv.COMPOSE_HOST = args[hostFlagIdx].slice('--host='.length)
+  }
+
   const child = spawn('node', [join(PACKAGE_ROOT, 'server', 'supervisor.js')], {
     stdio: 'inherit',
     cwd: PACKAGE_ROOT,
-    env: { ...process.env, COMPOSE_TARGET: targetRoot },
+    env: startEnv,
   })
   child.on('error', (err) => {
     console.error(`Failed to start compose: ${err.message}`)
     process.exit(1)
   })
   child.on('exit', (code) => process.exit(code ?? 0))
+} else if (cmd === 'remote') {
+  // ---------------------------------------------------------------------------
+  // compose remote — remote access management (COMP-MOBILE-REMOTE S03)
+  // ---------------------------------------------------------------------------
+  const { runRemoteCommand } = await import('../lib/cli-remote.js')
+  const { root: remoteCwd } = resolveCwdWithWorkspace(args)
+
+  await runRemoteCommand(args, {
+    port: resolvePort(),
+    token: process.env.COMPOSE_API_TOKEN,
+    cwd: remoteCwd,
+    lines: { push: (l) => console.log(l) },
+    // qr and poll use defaults (qrcode-terminal + setTimeout)
+  }).catch((err) => {
+    // Errors already printed to output; only exit non-zero
+    if (
+      err.message !== 'COMPOSE_API_TOKEN not set' &&
+      err.message !== '--yes required' &&
+      err.message !== 'Missing device-id'
+    ) {
+      console.error(`remote: ${err.message}`)
+    }
+    process.exit(1)
+  })
 } else if (cmd === 'ideabox') {
   // ---------------------------------------------------------------------------
   // compose ideabox — idea management CLI