Phone web harness

The web harness turns the running desktop app into a small web server your phone or tablet can open — it isn't a hosted service, and it isn't reachable unless the Mac is awake with Skein running. Turn it on from Settings → Web harness.

Turn on the web harness

Open Settings → Web harness. A Trusted networks only warning is shown first: "The harness assumes you're on a trusted home wifi network. Don't enable it on coffee shop, conference, or other untrusted networks." Flip Enable web harness — "Off by default. Enable to start the harness, then choose LAN and/or remote access below." — and the rest of the page appears: the LAN URL, remote access, and paired devices.

Pair a device on your network

With the harness on, the page shows the current LAN URL with a copy button next to it, and an Allow LAN access switch: "When off, the harness binds to 127.0.0.1 only — useless to a phone but harmless." Turn it on so a phone elsewhere on the network can reach the URL.

Click Add device to open Pair a new device: "Scan the QR code with your phone's camera. The phone will open a pairing page; once it asks for confirmation, verify the PIN matches and click Confirm here." Scanning it opens the pairing page on the phone, which asks for a Device name (placeholder "Alex's iPhone") and a Continue button. The desktop then shows the device's name and a PIN; check it matches what the phone displays, then click Confirm (or Deny to reject the request).

Paired devices are listed under Paired devices, each tagged LAN or Remote, with when it was paired and, once seen again, when it was last seen. Click the trash icon on a row and confirm Revoke to cut it off — the confirmation reads "This immediately revokes the device's access. It must be paired again to reconnect." for a LAN device, or "This immediately disconnects the device and un-enrolls it. It must be set up again from your home network to reconnect." for a remote one.

Allow remote access

Under Allow remote access — "Reach this Mac's harness from outside your local network, end-to-end encrypted over a peer-to-peer connection. Only enrolled devices can connect." — flip the switch to start it. While it's coming up the panel shows an amber dot and "Starting secure connection…"; once ready, a green dot and Connected appear next to a copyable identifier for this desktop.

A device is enrolled for remote use from the phone itself, while it's still on the LAN (a fresh device can't be set up remotely — it has to already be paired). Open the phone's Settings tab and, under Remote access — "Reach this desktop from anywhere — not just your home wifi. Set it up on this phone, then it works over cellular too." — tap Enable remote access. A Finish setup on this device link appears; tapping it opens Skein's hosted remote shell at skein.buildqube.com/remote/, which completes enrollment there and hands the phone its own remote credential. "The link expires in about a minute — tap "Enable remote access" again if it does."

Back on the desktop, Live connections lists every remotely-connected device with when it connected and a Disconnect button (tooltip: "Disconnects now; the device can reconnect."). Under Reset remote identity — "Un-enrolls every remote device. Local network access is unaffected." — click Reset identity to confirm ("This disconnects and un-enrolls every remote device. Each one must be set up again from your home network.") before wiping every remote enrollment at once. It's the recovery step after a suspected compromise; LAN-paired devices are unaffected.

What you can do from the phone

Opening the harness on a phone shows three bottom tabs: Home, Browse, and Settings. Home is the same Command Center as the desktop's — tap a workspace to open it. Browse lists your domains, then a domain's projects; opening a project shows its main checkout row and its workspaces, with a New workspace button that opens the same dialog described in Getting started → Create a workspace. Settings shows whether this device is paired and a destructive Forget this device button that clears its local credential.

Opening a workspace (or a project's main checkout) shows a row of tabs — Chats, Terminals, PR, and Issue for a workspace, or Chats, Terminals, and Scripts for the main checkout, which has no PR or issue of its own. Chats and Terminals each have a + New chat / + New terminal button that creates a pane and opens it. PR mirrors the review panel from GitHub & PR inbox, and Issue mirrors the linked tracker issue from Issue trackers. Scripts lists your Global scripts, then the project's own scripts below them — tapping one opens the same run dialog as the desktop, with an argument field per {{placeholder}} (see Scripts → Run a script in a workspace).

At tablet width, the bottom tabs give way to a persistent sidebar listing Command Center, Browse, Awaiting review, and Settings, with your domains, projects, and workspaces underneath — so the open chat or terminal can sit next to it instead of taking over the whole screen.

Security notes

Pairing requires physical access to the desktop: a QR code scan plus a PIN that has to match on both screens. From then on, a device's token is trusted for every request without further confirmation, so revoking a device you don't recognize — from Paired devices on the desktop — is the way to cut it off, not a prompt on each action. The desktop only ever stores a SHA-256 hash of a device's token, never the token itself, so it can't be recovered from the database even by someone with access to it.

LAN access is plain HTTP, scoped to your local network — the warning at the top of the settings page is the whole threat model: don't enable it on untrusted wifi. Remote access is end-to-end encrypted between your desktop and the enrolled device; traffic may pass through iroh relay servers along the way, but a relay can't read it. A device can only be enrolled for remote access from a session already paired on the LAN — it can't be added while away from the desktop. As the Allow remote access panel states, any enrolled device has full control of Skein, so Reset identity under Reset remote identity is there as a recovery step, not a routine one.