Agents in Your Pocket: Controlling Coding Agents Remotely from a Phone (technical essay, Sep 2026)

Technical essay, facts as of September 2026. This space moves fast — treat product claims as a snapshot, the architecture as durable.

There is only one architecture in this entire space: the agent session lives on a machine that is not your phone, and the phone is a window onto it. Everything below is a variation on how the session is kept alive, how your phone reaches it, and how much UX you get on top. Once you internalize that, the product landscape collapses into a readable catalog.

Three ways in, by increasing convenience and decreasing generality:

1. The terminal stack — a terminal runtime (herdr, or classictmux ) +mosh + Tailscale, driven from a mobile SSH client. Works with any CLI agent (including local models), costs nothing, survives network roaming and phone sleep. What it lacks in polish — push notifications, diff review, one-tap approvals — herdr partially repays with agent-aware pane state; an afternoon of setup buys you a permanently available agent fleet.
2. First-party remotes — Claude Code Remote Control, Codex in the ChatGPT app, Cursor for iOS. Zero setup, deep integration with the vendor's agent, but locked to that vendor, and the local-session variants still require your host to stay awake.
3. Third-party bridges — Happy, Happier, Paseo, Sesori. A wrapper or daemon wraps your agent CLI and relays the session to a native mobile app with the UX terminals can't give you: push notifications when the agent needs a permission, tappable approval buttons, diffs, voice input. The busy part of the market, mostly open source and end-to-end encrypted. (Fleet runtimes like orca and herdr approach from the other side and get their own section below.)

And the actual payoff, because it's not "checking in from the couch": agents now run for tens of minutes unsupervised and stop at permission gates. Move the gate to your phone and development becomes interrupt-driven — kick off a task, pocket the phone, get buzzed when input is needed, respond from wherever you are. The desk stops being where the work happens and becomes one client among many.

Coding agents inverted the interaction model. A single prompt can launch a twenty-minute run that touches thirty files, and well-run setups no longer run one agent but a small fleet — parallel agents on separate git worktrees, subagents inside one session, scheduled loops. The human's job shifted from typing code to supervising: approving tool use, steering mid-run, reviewing diffs, unblocking stuck agents. Supervision is attention-shaped work, and attention doesn't live at a desk.

Meanwhile the agent itself cannot live on the phone. Phones sleep aggressively, mobile OSes suspend background processes, and nobody wants a frontier-model-sized workload (or their SSH keys and API credentials) in their pocket. So the runtime stays on a real computer and the phone supervises. Every solution in this essay is an answer to the same four problems:

1. Session persistence. A CLI process dies with its terminal. Close the laptop lid, drop off Wi-Fi, or lock the phone, and a vanilla session is gone. Terminal multiplexers solved this in principle decades ago —tmux keeps the session server-side and lets clients detach and reattach; app-level bridges re-solve it with daemons and relays; and herdr re-solves it agent-natively inside the terminal world itself. This is the load-bearing idea of the whole space:decouple the session from the device.
2. Transport. Phone networks are hostile to long-lived connections: IP changes every time you hop from Wi-Fi to cellular, NATs are strict, latency is high. Plain SSH over TCP drops on every IP change.mosh fixes the network half (UDP, roaming);Tailscale fixes the identity half (a stable virtual IP per device).
3. Attention. An unattended agent that hits a permission prompt and waits silently is wasted latency. Someone has to tell your phone "the agent needs you" — via hook-fired webhooks in the terminal world, or built-in push in the app world.
4. Interface. A terminal shows text; "approve this edit" wants a button, "here's the diff" wants a scrollable view. This is the gap the native-app solutions exist to fill.

Three choices, each a trade-off worth stating explicitly:

• Your desktop/laptop — simplest, uses your real environment, but the machine must stay on and awake (closing the lid at 6pm ends the experiment), and it holds your most sensitive environment.
• An always-on box — home server, Mac mini, or a cloud VM you leave running. This is the natural home for fleets and scheduled loops.
• A pay-per-use VPS — started on demand, halted after. Two hidden bonuses: it'sdisposable (worst case, the agent trashes a VM that costs $0.29/hour, not your laptop), and it forces you to spell out what credentials the agent actually gets. This "disposable = safe" posture showed up repeatedly in practitioner write-ups and is the best default for phone-driven, permissive-mode agent runs.

The session carries your code and, often, your credentials — so the relay layer is the trust question. Roughly, from most to least trusting: a vendor's cloud (first-party remotes — convenient, opaque), a third-party relay with end-to-end encryption (Happy, Happier — the relay moves ciphertext, keys live on your devices), a relay you self-host (Paseo's relay, orca's server mode — you operate the plumbing), or no relay at all (the terminal stack, where traffic rides your own WireGuard mesh). One more standard matters here: the Zed-led Agent Client Protocol (ACP) — a JSON-RPC contract between a client and a coding agent — is quietly becoming the jack that lets one mobile client drive many harnesses, which is why "supports any ACP agent" keeps appearing in bridge feature lists.

This is the universal fallback: any CLI agent — Claude Code, Codex, aider, a local Ollama model — full terminal fidelity, zero lock-in. It deserves a slow walk because every piece solves one of the four landscape problems.

The runtime: herdr first, tmux as the classic. The multiplexer idea is what makes remote agents possible at all: the session lives server-side, keeps running when you disconnect, and reattaches from any client — with windows and panes as a poor man's fleet manager. herdr ("the runtime your coding agents live on") is the agent-native version of that idea: a single background server in one Rust binary — no Electron, runs in whatever terminal you already use — that owns your agents' terminals without wrapping them. You get the full tmux job (always-on daemon, detach/attach that survives lid-close, network drops and even machine restarts, tmux-style prefix keys, mouse and keyboard as first-class citizens), plus what tmux can't retro-fit: every pane is marked working, blocked, or idle, so "which agent is stuck?" is answered at a glance instead of hunted for; agents themselves drive the runtime through a CLI and socket API — spawning panes, prompting each other, waiting until a peer is genuinely blocked; and a plugin marketplace extends panes and workflows. Prefer it when starting fresh — the muscle memory transfers. tmux (with zellij; GNU Screen as the ancestor) remains the fallback for boxes where you can't install anything and for non-agent terminal work — bolt on terminal TUIs (lazygit for staging commits, yazi for files) and the host machine becomes fully drivable from text either way.

mosh (mobile shell) fixes transport. It uses SSH once for authentication, then runs the session over UDP: the connection survives IP changes (Wi-Fi → cellular → office Wi-Fi) and sleep/wake, adapts its frame rate so ctrl-c always lands within a round trip, and its signature trick is predictive local echo — the client guesses what each keystroke does and shows it instantly, underlining guesses until the server confirms. On a phone with 200ms of latency, this is the difference between typing being usable and miserable. Limits to know: no port forwarding, interactive terminals only, and development has been slow (1.4.0 dates to 2022) — it's boring infrastructure that works. Eternal Terminal is the TCP-flavored alternative (auto-reconnect, native scrolling, tmux control mode); tssh (trzsz-ssh) is an OpenSSH-compatible client that adds a TUI host picker, remembered passwords, ZMODEM-style file transfer, and — via its tsshd companion — mosh-like UDP roaming.

Tailscale fixes identity. It's a WireGuard mesh over all your devices — laptop, server, phone, VM — where the control plane only distributes keys and traffic goes peer-to-peer (a relay only as last resort behind strict NATs). Every device gets a stable virtual IP and a MagicDNS name, so the VM is always dev.tailnet-name.ts.net from any network. tailscale ssh removes key management entirely; headscale self-hosts the control plane if you don't want the vendor; the personal tier is free for 3 users / 100 devices. Security-wise it enables the cleanest posture: no public SSH listener at all — the host is reachable only from inside your tailnet. When corporate networks block even that, Microsoft's dev tunnels provide an outbound-HTTPS relay, but it's a port forward, not a session: TCP still drops on sleep/wake.

Mobile clients. iOS: Termius, Blink Shell, Shelly. Android: Termux (a real Linux environment — you can even run small agents on-device, though realistically the phone remains a window), Termius, JuiceSSH, ConnectBot. A new breed is agent-native: Moshi is an SSH/mosh terminal built for Claude Code sessions with its own hook daemon for mobile approvals; whip is an agent-native SSH client designed for herdr from day one; rootshell rethinks the terminal for Apple platforms.

The missing piece is attention, and the community solution is a hook fired into a push service. A representative practitioner setup (written up by granda.org, Jan 2026): a pay-per-use Vultr VM reachable only via Tailscale, mosh + Termius from an iPhone, tmux auto-attach on login, six Claude Code agents on six git worktrees with hash-derived port assignments — and a PreToolUse hook on the AskUserQuestion tool that curl s a webhook to Poke, so the phone buzzes with the agent's actual question. The loop: start a 20-minute task, pocket the phone, respond to the buzz, repeat. The same slot is filled by dedicated glue tools: Tether notifies your phone when an agent needs attention, tap-to-tmux and vmux watch tmux panes and turn agent prompts into tappable phone controls that send answers back through tmux, all self-hosted, no cloud control plane. On herdr this glue tier shrinks: working/blocked/idle is native pane state, so the bolt-on watchers only have to move the message onto the phone.

Verdict — unbeatable generality, spartan interface. No diff review, no approval buttons; notifications are DIY on tmux (herdr's pane states close the awareness gap, not the approval one). Still the only option for experimental or local models, and the mental model every other solution is built on.

The harness vendors built the mobile window themselves.

Claude Code Remote Control is the most developed. Run claude remote-control (server mode), claude --remote-control on a normal session, or /rc inside an existing session; the docs surface a URL and QR code, and the Claude mobile apps or claude.ai/code attach as a second window. Key properties, straight from the docs: the session runs entirely on your machine — local filesystem, MCP servers, tools, project config all stay available, and @ autocompletes local file paths; you can type from terminal, browser, and phone interchangeably; you can send photos and files from the phone into the session; and if the laptop sleeps or the network drops, it reconnects and queues messages and permission prompts until the link recovers. Server mode is a real fleet option: --spawn worktree gives each remote session its own git worktree, default capacity 32 sessions. There's even a UX nicety — when a turn runs long, the terminal shows "Still working — check in from your phone." Constraints: subscription plans only (no API keys), api.anthropic.com only (custom base URLs and gateways are refused since v2.1.196), and the host must stay awake — the queueing survives a nap, not a shutdown. Separately, cloud sessions in the Claude app run on Anthropic's infrastructure and persist across devices; that's the "no host at all" mode, at the cost of working in Anthropic's cloud rather than your environment.

OpenAI Codex landed the same pattern: the ChatGPT mobile app reaches Codex sessions on your connected machines or in the cloud, with visibility into the host workspace, approvals, diffs, and test status. Cursor for iOS is the PR-review angle: start and monitor cloud and computer-based agents, review and merge pull requests from the phone. OpenCode takes the architectural route — a headless server (opencode serve) with interchangeable frontends (terminal TUI via opencode attach, desktop app, VS Code, browser), reachable over SSH tunnel or VPN; it's less a mobile product than a client/server split that mobile happens to benefit from.

Verdict — the lowest-friction path if you're single-vendor: minutes to set up, no relay to trust beyond the vendor. Costs: lock-in, and the local-session modes inherit the awake-host requirement (solved only by moving to the vendor's cloud sessions).

The pattern across this category: a wrapper CLI or desktop daemon owns the agent process (it spawns Claude Code/Codex/etc. with your existing credentials and subscriptions), a relay carries events between host and app, and a native app renders the session with mobile-first UX. The interesting engineering questions are where the relay lives and who can read it.

Happy is the free/open default for Claude Code and Codex (~23k stars, MIT). Install the CLI, then run happy claude instead of claude — the wrapper restarts the session in remote mode, your phone app attaches, and pressing any key on the keyboard takes control back on the desktop. End-to-end encrypted with keys on the devices, so the sync server moves ciphertext; push notifications on permission prompts and errors; voice input; a macOS desktop app; and happy acp runs any ACP-compatible agent (Gemini, OpenCode).

Happier is the continuation — built by ex-Happy contributors who wanted faster iteration — and its deltas define its pitch: a Tauri desktop app, and a much broader harness list (OpenCode, Gemini, Copilot, Kiro, Pi, Kilo, Kimi, Qwen, Augment, plus any ACP CLI behind one wrapper). It can attach to sessions you already started in a plain terminal (browse, follow, import, then hop control between terminal and app mid-run), move a live session between machines, share view-only links with teammates, and — the most interesting idea in the category — run a voice agent as a colleague: it watches all your sessions and answers routine permission prompts for you, with each action still approval-gated. A unified inbox queues everything needing attention across machines. Same E2E model, alpha maturity, both projects alive.

Paseo is the self-hosted, programmable one: "your code never leaves your machine." A local Node daemon spawns and manages agent subprocesses and streams over WebSocket; clients are Electron desktop, iOS/Android/web, and a CLI with real parity (paseo run --provider codex --worktree feature-x "...", with --host targeting a remote daemon). Connectivity is direct WebSocket or an opt-in E2E-encrypted relay that is itself self-hostable. The distinctive move is treating the daemon as orchestration infrastructure: an MCP server exposes it to other agents, a TypeScript SDK feeds issue bots and dashboards, and installable skills encode graph-engineering patterns — /paseo-handoff (plan with Claude, implement with Codex), /paseo-advisor, /paseo-committee.

Sesori (native apps + a desktop Bridge CLI) competes on breadth of harness support; WhipDesk is the maximalist outlier — a full desktop remote (screen and keyboard, not just chat) in a mobile PWA over WebRTC, with scheduled prompts and agent-stuck detection. At the thin end sit the tmux-glue tools from section 1 (vmux, Tether, tap-to-tmux, moshi-hook): no relay, no app backend, just notifications and taps into existing panes. The closed-source/paid tier — AgentsRoom (most IDE-like fleet cockpit), Cmd+Ctrl (daemon per agent, iOS/Android/web/Watch), Agents At Work (push approvals) — competes on polish; note that some "open-source" entries in this market ship open clients around a hosted, closed relay, which matters for your threat model.

Trust, concretely. E2E bridges (Happy, Happier, Paseo's relay) are the right default when a third party operates the relay — code and credentials stay encrypted end to end, though metadata (session volume, timing) is inherently visible to the relay. Self-hosting the relay or going relay-free (Tailscale) removes even that. In all cases the agent's credentials remain on the host; the phone only carries session traffic — which is exactly why the runtime-off-the-phone architecture is also the safer one.

The newest layer: multiplexers that grew up around agents, with remote control designed in rather than bolted on.

orca (Stably) is an "agentic development environment" for fleets, spanning desktop, mobile, and VPS. Its mobile app is honest about the architecture: the read-mostly companion treats your running desktop as the source of truth — close the desktop and the session drops. The stronger mode is remote Orca server: a server box owns the whole runtime (projects, worktrees, terminals, agent sessions) and your laptop and phone connect as thin clients with revocable pairing tokens — agents outlive a sleeping client, which is the property that actually matters. An intermediate mode keeps the runtime on the laptop while off selected worktrees to a beefier box over SSH. herdr (the terminal-runtime pick from section 1) belongs in this layer too: the always-on daemon means agents outlive any client, and it reattaches from any terminal, over any SSH client — whip is simply the phone client designed for it from day one, herdrm the Mac console. On the desktop side of the same trend sit cmux (a Ghostty-based macOS terminal with vertical tabs and notifications per agent) and Warp — they solve fleet visibility where orca/herdr solve fleet availability. Task-level orchestrators with web UIs (e.g. Vibe Kanban, now community-maintained after sunsetting) round out the layer, though their mobile story is a browser, not an app.

Whichever row you pick, two practices travel well. Put the runtime somewhere disposable and least-privileged — a VPS with no public SSH and only the credentials that task needs beats your laptop in permissive mode. And invest in the attention loop before the interface — a $0 setup with reliable push notifications changes how you work more than any app UI does.

The deep pattern underneath the catalog: sessions decoupled from devices, attention routed to wherever the human is. The terminal spent fifty years pinned to a desk; agents — of all things — made it pocketable again.