Why the tunnel is outbound-only

CodeMote's job is to let a browser, or an iPhone, drive a machine you

already own. The obvious ways to do that all share one property: they make

your machine reachable. CodeMote is built around the opposite property, and

this post explains why.

The usual options, and what they cost

Open a port. Run an IDE server, forward a port on the router, put a

password on it. Now a piece of software with full access to your code and a

shell is listening on the public internet, and its security is your evening

project. Scanners find open ports in minutes; they do not get tired.

Build a VPN or a tailnet. This is the respectable version: your devices

join a private network and the IDE listens only inside it. It works well,

but it is infrastructure. Every client device needs enrolling, every guest

machine (a borrowed laptop, a locked-down work machine) is a problem, and

the setup is exactly the kind of yak-shaving you were trying to escape.

Rent a cloud workspace. Hosted IDEs solve reachability by moving your

code to their machines. That is a real trade: your repository now lives on

infrastructure you don't control, billed by the hour, and "working on my

machine" stops being true in any sense.

What CodeMote does instead

When you run npx codemote-cli start, the host makes an outbound

connection to a tunnel endpoint (a Cloudflare quick tunnel by default; the

CLI also supports longer-lived providers for hosts that run unattended).

Your machine never listens for the internet; it dials out, the way any

browser tab does.

Clients then connect to the tunnel over TLS and pair with a **single-use

pairing code** the CLI prints: paste it in the browser, or scan its QR with

the iOS app. Codes expire, and each one works once. There is no account of

your code anywhere in between: the workspace state lives on the host, and

clients are remote controls.

What this buys you

none of them matter, because nothing needs to reach in to your machine.

to leave unpatched. When the CLI isn't running, there is nothing there.

every session with it. A fresh start mints a fresh tunnel and fresh

pairing codes.

save to the machine the project lives on, git operations run there, and

credentials never leave it.

The honest fine print

The tunnel provider carries the encrypted connection, the same way any

reverse tunnel works: it is a pipe, not a workspace, and it holds no state

about your project. If your host must run unattended for days, prefer one

of the longer-lived tunnel providers (codemote start --help lists them);

the default quick tunnel is built for sessions, not for weeks.

Want the setup walkthrough? The connection guide covers

install, pairing and troubleshooting, and takes about a minute to follow.