commandmate 0.28.0 → 0.29.1

package/.next/types/app/api/remote/pair/route.ts

@@ -0,0 +1,347 @@
+// File: /home/runner/work/CommandMate/CommandMate/src/app/api/remote/pair/route.ts
+import * as entry from '../../../../../../src/app/api/remote/pair/route.js'
+import type { NextRequest } from 'next/server.js'
+
+type TEntry = typeof import('../../../../../../src/app/api/remote/pair/route.js')
+
+type SegmentParams<T extends Object = any> = T extends Record<string, any>
+  ? { [K in keyof T]: T[K] extends string ? string | string[] | undefined : never }
+  : T
+
+// Check that the entry is a valid entry
+checkFields<Diff<{
+  GET?: Function
+  HEAD?: Function
+  OPTIONS?: Function
+  POST?: Function
+  PUT?: Function
+  DELETE?: Function
+  PATCH?: Function
+  config?: {}
+  generateStaticParams?: Function
+  revalidate?: RevalidateRange<TEntry> | false
+  dynamic?: 'auto' | 'force-dynamic' | 'error' | 'force-static'
+  dynamicParams?: boolean
+  fetchCache?: 'auto' | 'force-no-store' | 'only-no-store' | 'default-no-store' | 'default-cache' | 'only-cache' | 'force-cache'
+  preferredRegion?: 'auto' | 'global' | 'home' | string | string[]
+  runtime?: 'nodejs' | 'experimental-edge' | 'edge'
+  maxDuration?: number
+  
+}, TEntry, ''>>()
+
+type RouteContext = { params: Promise<SegmentParams> }
+// Check the prop type of the entry function
+if ('GET' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'GET'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'GET'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'GET',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'GET',
+        __return_type__: ReturnType<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('HEAD' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'HEAD'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'HEAD'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'HEAD',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'HEAD',
+        __return_type__: ReturnType<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('OPTIONS' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'OPTIONS'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'OPTIONS'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'OPTIONS',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'OPTIONS',
+        __return_type__: ReturnType<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('POST' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'POST'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'POST'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'POST',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'POST',
+        __return_type__: ReturnType<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('PUT' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'PUT'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'PUT'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'PUT',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'PUT',
+        __return_type__: ReturnType<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('DELETE' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'DELETE'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'DELETE'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'DELETE',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'DELETE',
+        __return_type__: ReturnType<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('PATCH' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'PATCH'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'PATCH'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'PATCH',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'PATCH',
+        __return_type__: ReturnType<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+}
+
+// Check the arguments and return type of the generateStaticParams function
+if ('generateStaticParams' in entry) {
+  checkFields<Diff<{ params: SegmentParams }, FirstArg<MaybeField<TEntry, 'generateStaticParams'>>, 'generateStaticParams'>>()
+  checkFields<Diff<{ __tag__: 'generateStaticParams', __return_type__: any[] | Promise<any[]> }, { __tag__: 'generateStaticParams', __return_type__: ReturnType<MaybeField<TEntry, 'generateStaticParams'>> }>>()
+}
+
+export interface PageProps {
+  params?: Promise<SegmentParams>
+  searchParams?: Promise<any>
+}
+export interface LayoutProps {
+  children?: React.ReactNode
+
+  params?: Promise<SegmentParams>
+}
+
+// =============
+// Utility types
+type RevalidateRange<T> = T extends { revalidate: any } ? NonNegative<T['revalidate']> : never
+
+// If T is unknown or any, it will be an empty {} type. Otherwise, it will be the same as Omit<T, keyof Base>.
+type OmitWithTag<T, K extends keyof any, _M> = Omit<T, K>
+type Diff<Base, T extends Base, Message extends string = ''> = 0 extends (1 & T) ? {} : OmitWithTag<T, keyof Base, Message>
+
+type FirstArg<T extends Function> = T extends (...args: [infer T, any]) => any ? unknown extends T ? any : T : never
+type SecondArg<T extends Function> = T extends (...args: [any, infer T]) => any ? unknown extends T ? any : T : never
+type MaybeField<T, K extends string> = T extends { [k in K]: infer G } ? G extends Function ? G : never : never
+
+type ParamCheck<T> = {
+  __tag__: string
+  __param_position__: string
+  __param_type__: T
+}
+
+function checkFields<_ extends { [k in keyof any]: never }>() {}
+
+// https://github.com/sindresorhus/type-fest
+type Numeric = number | bigint
+type Zero = 0 | 0n
+type Negative<T extends Numeric> = T extends Zero ? never : `${T}` extends `-${string}` ? T : never
+type NonNegative<T extends Numeric> = T extends Zero ? T : Negative<T> extends never ? T : '__invalid_negative_number__'

package/.next/types/routes.d.ts

@@ -2,7 +2,7 @@
 // Do not edit this file manually
 
 type AppRoutes = "/" | "/chat" | "/login" | "/more" | "/offline" | "/repositories" | "/review" | "/sessions" | "/skills" | "/skills/[skillId]" | "/skills/installed" | "/worktrees/[id]" | "/worktrees/[id]/files/[...path]" | "/worktrees/[id]/terminal"
-type AppRouteHandlerRoutes = "/api/app/update" | "/api/app/update-check" | "/api/assistant/conversation" | "/api/assistant/current-output" | "/api/assistant/messages" | "/api/assistant/session" | "/api/assistant/start" | "/api/assistant/terminal" | "/api/assistant/tools" | "/api/auth/login" | "/api/auth/logout" | "/api/auth/status" | "/api/capabilities" | "/api/daily-summary" | "/api/daily-summary/status" | "/api/external-apps" | "/api/external-apps/[id]" | "/api/external-apps/[id]/health" | "/api/fs/browse" | "/api/fs/recent-paths" | "/api/hooks/agent-event" | "/api/hooks/claude-done" | "/api/hooks/permission-request" | "/api/metrics/vibe" | "/api/ollama/models" | "/api/push/escalation" | "/api/push/subscriptions" | "/api/push/vapid" | "/api/repositories" | "/api/repositories/[id]" | "/api/repositories/[id]/todos" | "/api/repositories/[id]/todos/[todoId]" | "/api/repositories/clone" | "/api/repositories/clone/[jobId]" | "/api/repositories/excluded" | "/api/repositories/restore" | "/api/repositories/scan" | "/api/repositories/sync" | "/api/repositories/validate-path" | "/api/sidebar/group-order" | "/api/skills" | "/api/skills/[id]" | "/api/skills/installations" | "/api/skills/operations" | "/api/skills/reindex" | "/api/slash-commands" | "/api/tasks/[taskId]" | "/api/tasks/[taskId]/cancel" | "/api/templates" | "/api/templates/[id]" | "/api/todos" | "/api/verification/runs" | "/api/verification/runs/[runId]" | "/api/worktrees" | "/api/worktrees/[id]" | "/api/worktrees/[id]/auto-yes" | "/api/worktrees/[id]/capture" | "/api/worktrees/[id]/clear-composer" | "/api/worktrees/[id]/cli-tool" | "/api/worktrees/[id]/cmate/schedules" | "/api/worktrees/[id]/current-output" | "/api/worktrees/[id]/env" | "/api/worktrees/[id]/execution-logs" | "/api/worktrees/[id]/execution-logs/[logId]" | "/api/worktrees/[id]/files/[...path]" | "/api/worktrees/[id]/git/branch/create" | "/api/worktrees/[id]/git/branch/delete" | "/api/worktrees/[id]/git/branches" | "/api/worktrees/[id]/git/checkout" | "/api/worktrees/[id]/git/commit" | "/api/worktrees/[id]/git/diff" | "/api/worktrees/[id]/git/fetch" | "/api/worktrees/[id]/git/log" | "/api/worktrees/[id]/git/pull" | "/api/worktrees/[id]/git/push" | "/api/worktrees/[id]/git/reset" | "/api/worktrees/[id]/git/revert" | "/api/worktrees/[id]/git/show/[commitHash]" | "/api/worktrees/[id]/git/stage" | "/api/worktrees/[id]/git/staged" | "/api/worktrees/[id]/git/stash" | "/api/worktrees/[id]/git/stash/[index]" | "/api/worktrees/[id]/git/stash/apply" | "/api/worktrees/[id]/git/stash/pop" | "/api/worktrees/[id]/git/stash/push" | "/api/worktrees/[id]/git/status" | "/api/worktrees/[id]/git/unstage" | "/api/worktrees/[id]/git/working-diff" | "/api/worktrees/[id]/instances/opencode" | "/api/worktrees/[id]/interrupt" | "/api/worktrees/[id]/kill-session" | "/api/worktrees/[id]/logs" | "/api/worktrees/[id]/logs/[filename]" | "/api/worktrees/[id]/marp-render" | "/api/worktrees/[id]/memos" | "/api/worktrees/[id]/memos/[memoId]" | "/api/worktrees/[id]/messages" | "/api/worktrees/[id]/opencode/diff" | "/api/worktrees/[id]/opencode/session" | "/api/worktrees/[id]/opencode/share" | "/api/worktrees/[id]/prompt-response" | "/api/worktrees/[id]/resolve-target" | "/api/worktrees/[id]/respond" | "/api/worktrees/[id]/schedules" | "/api/worktrees/[id]/schedules/[scheduleId]" | "/api/worktrees/[id]/schedules/active" | "/api/worktrees/[id]/search" | "/api/worktrees/[id]/send" | "/api/worktrees/[id]/skills" | "/api/worktrees/[id]/skills/[skillId]/git-workflow" | "/api/worktrees/[id]/skills/[skillId]/install" | "/api/worktrees/[id]/skills/[skillId]/plan" | "/api/worktrees/[id]/skills/[skillId]/uninstall" | "/api/worktrees/[id]/skills/[skillId]/uninstall-plan" | "/api/worktrees/[id]/skills/[skillId]/update" | "/api/worktrees/[id]/skills/[skillId]/update-plan" | "/api/worktrees/[id]/slash-commands" | "/api/worktrees/[id]/special-keys" | "/api/worktrees/[id]/start-polling" | "/api/worktrees/[id]/tasks" | "/api/worktrees/[id]/terminal" | "/api/worktrees/[id]/timers" | "/api/worktrees/[id]/timers/history" | "/api/worktrees/[id]/todos" | "/api/worktrees/[id]/todos/[todoId]" | "/api/worktrees/[id]/tree" | "/api/worktrees/[id]/tree/[...path]" | "/api/worktrees/[id]/upload/[...path]" | "/api/worktrees/[id]/verify" | "/api/worktrees/[id]/verify/runs" | "/api/worktrees/[id]/verify/runs/[runId]" | "/api/worktrees/[id]/viewed" | "/proxy/[...path]"
+type AppRouteHandlerRoutes = "/api/app/update" | "/api/app/update-check" | "/api/assistant/conversation" | "/api/assistant/current-output" | "/api/assistant/messages" | "/api/assistant/session" | "/api/assistant/start" | "/api/assistant/terminal" | "/api/assistant/tools" | "/api/auth/login" | "/api/auth/logout" | "/api/auth/status" | "/api/capabilities" | "/api/daily-summary" | "/api/daily-summary/status" | "/api/external-apps" | "/api/external-apps/[id]" | "/api/external-apps/[id]/health" | "/api/fs/browse" | "/api/fs/recent-paths" | "/api/hooks/agent-event" | "/api/hooks/claude-done" | "/api/hooks/permission-request" | "/api/metrics/vibe" | "/api/ollama/models" | "/api/push/escalation" | "/api/push/subscriptions" | "/api/push/vapid" | "/api/remote/pair" | "/api/repositories" | "/api/repositories/[id]" | "/api/repositories/[id]/todos" | "/api/repositories/[id]/todos/[todoId]" | "/api/repositories/clone" | "/api/repositories/clone/[jobId]" | "/api/repositories/excluded" | "/api/repositories/restore" | "/api/repositories/scan" | "/api/repositories/sync" | "/api/repositories/validate-path" | "/api/sidebar/group-order" | "/api/skills" | "/api/skills/[id]" | "/api/skills/installations" | "/api/skills/operations" | "/api/skills/reindex" | "/api/slash-commands" | "/api/tasks/[taskId]" | "/api/tasks/[taskId]/cancel" | "/api/templates" | "/api/templates/[id]" | "/api/todos" | "/api/verification/runs" | "/api/verification/runs/[runId]" | "/api/worktrees" | "/api/worktrees/[id]" | "/api/worktrees/[id]/auto-yes" | "/api/worktrees/[id]/capture" | "/api/worktrees/[id]/clear-composer" | "/api/worktrees/[id]/cli-tool" | "/api/worktrees/[id]/cmate/schedules" | "/api/worktrees/[id]/current-output" | "/api/worktrees/[id]/env" | "/api/worktrees/[id]/execution-logs" | "/api/worktrees/[id]/execution-logs/[logId]" | "/api/worktrees/[id]/files/[...path]" | "/api/worktrees/[id]/git/branch/create" | "/api/worktrees/[id]/git/branch/delete" | "/api/worktrees/[id]/git/branches" | "/api/worktrees/[id]/git/checkout" | "/api/worktrees/[id]/git/commit" | "/api/worktrees/[id]/git/diff" | "/api/worktrees/[id]/git/fetch" | "/api/worktrees/[id]/git/log" | "/api/worktrees/[id]/git/pull" | "/api/worktrees/[id]/git/push" | "/api/worktrees/[id]/git/reset" | "/api/worktrees/[id]/git/revert" | "/api/worktrees/[id]/git/show/[commitHash]" | "/api/worktrees/[id]/git/stage" | "/api/worktrees/[id]/git/staged" | "/api/worktrees/[id]/git/stash" | "/api/worktrees/[id]/git/stash/[index]" | "/api/worktrees/[id]/git/stash/apply" | "/api/worktrees/[id]/git/stash/pop" | "/api/worktrees/[id]/git/stash/push" | "/api/worktrees/[id]/git/status" | "/api/worktrees/[id]/git/unstage" | "/api/worktrees/[id]/git/working-diff" | "/api/worktrees/[id]/instances/opencode" | "/api/worktrees/[id]/interrupt" | "/api/worktrees/[id]/kill-session" | "/api/worktrees/[id]/logs" | "/api/worktrees/[id]/logs/[filename]" | "/api/worktrees/[id]/marp-render" | "/api/worktrees/[id]/memos" | "/api/worktrees/[id]/memos/[memoId]" | "/api/worktrees/[id]/messages" | "/api/worktrees/[id]/opencode/diff" | "/api/worktrees/[id]/opencode/session" | "/api/worktrees/[id]/opencode/share" | "/api/worktrees/[id]/prompt-response" | "/api/worktrees/[id]/resolve-target" | "/api/worktrees/[id]/respond" | "/api/worktrees/[id]/schedules" | "/api/worktrees/[id]/schedules/[scheduleId]" | "/api/worktrees/[id]/schedules/active" | "/api/worktrees/[id]/search" | "/api/worktrees/[id]/send" | "/api/worktrees/[id]/skills" | "/api/worktrees/[id]/skills/[skillId]/git-workflow" | "/api/worktrees/[id]/skills/[skillId]/install" | "/api/worktrees/[id]/skills/[skillId]/plan" | "/api/worktrees/[id]/skills/[skillId]/uninstall" | "/api/worktrees/[id]/skills/[skillId]/uninstall-plan" | "/api/worktrees/[id]/skills/[skillId]/update" | "/api/worktrees/[id]/skills/[skillId]/update-plan" | "/api/worktrees/[id]/slash-commands" | "/api/worktrees/[id]/special-keys" | "/api/worktrees/[id]/start-polling" | "/api/worktrees/[id]/tasks" | "/api/worktrees/[id]/terminal" | "/api/worktrees/[id]/timers" | "/api/worktrees/[id]/timers/history" | "/api/worktrees/[id]/todos" | "/api/worktrees/[id]/todos/[todoId]" | "/api/worktrees/[id]/tree" | "/api/worktrees/[id]/tree/[...path]" | "/api/worktrees/[id]/upload/[...path]" | "/api/worktrees/[id]/verify" | "/api/worktrees/[id]/verify/runs" | "/api/worktrees/[id]/verify/runs/[runId]" | "/api/worktrees/[id]/viewed" | "/proxy/[...path]"
 type PageRoutes = never
 type LayoutRoutes = "/" | "/worktrees/[id]"
 type RedirectRoutes = never
@@ -40,6 +40,7 @@ interface ParamMap {
   "/api/push/escalation": {}
   "/api/push/subscriptions": {}
   "/api/push/vapid": {}
+  "/api/remote/pair": {}
   "/api/repositories": {}
   "/api/repositories/[id]": { "id": string; }
   "/api/repositories/[id]/todos": { "id": string; }

package/.next/types/validator.ts

@@ -425,6 +425,15 @@ type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRou
   type __Unused = __Check
 }
 
+// Validate ../../src/app/api/remote/pair/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/remote/pair">> = Specific
+  const handler = {} as typeof import("../../src/app/api/remote/pair/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
 // Validate ../../src/app/api/repositories/[id]/route.ts
 {
   type __IsExpected<Specific extends RouteHandlerConfig<"/api/repositories/[id]">> = Specific

package/README.md

@@ -366,16 +366,28 @@ Claude Code sets `CLAUDECODE=1` to prevent nesting. CommandMate removes this aut
 ### FAQ
 
 **Q: How do I use CommandMate from my phone?**
-A: CommandMate runs a web server on your PC. To access it from your phone, your phone and PC must be on the same network (Wi-Fi). Run `commandmate init` and enable external access — this sets `CM_BIND=0.0.0.0`. Then open `http://<your-PC-IP>:3000` in your phone's browser.
+A: Run `commandmate remote`. One command starts the server with authentication enabled, opens a tunnel, and prints a QR code in your terminal — scan it with your phone's camera and you are signed in. The pairing code inside that QR works **once** and expires after 10 minutes by default.
+
+```bash
+commandmate remote          # start + publish + pair (QR)
+commandmate remote status   # provider, URL, expiry, pairing state
+commandmate remote stop     # close the outside door (the server keeps running)
+```
+
+It needs [`cloudflared`](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/) installed. Because a Cloudflare Quick Tunnel puts a `https://<random>.trycloudflare.com` address on the public internet, `commandmate remote` warns you and asks before creating it; in a non-interactive shell it refuses instead of assuming yes, so pass `--yes` when you mean it. If no provider is usable it stops with a dependency error rather than falling back to something more exposed. Your `CM_BIND` setting is left alone — the server stays bound to `127.0.0.1`, and `remote` only adds a door in front of it.
+
+**If you would rather not install `cloudflared`**, you can stay inside your LAN: run `commandmate init` and enable external access — this sets `CM_BIND=0.0.0.0` — then open `http://<your-PC-IP>:3000` from a phone on the same Wi-Fi. **Be aware of what that does: it serves CommandMate with no authentication and no encryption.** Anyone on that network can open the URL and drive your repositories, terminals and agents without being asked for anything. Use it only on a network you trust, never on shared or guest Wi-Fi, and set `CM_BIND` back to `127.0.0.1` when you are done.
 
 **Q: Can I access it from outside my home network?**
-A: Yes. Use a tunneling service to securely expose your local server without opening router ports:
+A: Yes — `commandmate remote` (above) is the built-in way: the tunnel it creates is reachable from anywhere, and CommandMate answers it with token authentication on. The URL itself is public, so treat the pairing code, not the URL, as the thing that keeps other people out.
+
+If you would rather run the tunnel yourself, any of these work:
 
 - [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) — free, requires Cloudflare account
 - [ngrok](https://ngrok.com/) — free tier available, easy setup
 - [Pinggy](https://pinggy.io/) — no sign-up required, simple SSH-based tunnel
 
-Alternatively, a VPN or an authenticated reverse proxy (Basic Auth, OIDC, etc.) also works. **Do not** expose the server directly to the internet without authentication.
+Alternatively, a VPN or an authenticated reverse proxy (Basic Auth, OIDC, etc.) also works. **Do not** expose the server directly to the internet without authentication. See the [Security Guide](./docs/security-guide.md) for details.
 
 **Q: Does it work on iPhone / Android?**
 A: Yes. CommandMate's Web UI is responsive and works on any modern mobile browser (Safari, Chrome, etc.). No app install required.