Connect Mobile

AO's primary daemon listener is always bound to 127.0.0.1. It is unauthenticated because it is loopback-only, and its host cannot be changed. Do not expose it with HOST=0.0.0.0, a public reverse proxy, or port forwarding.

For a phone, the desktop app creates a separate listener through Connect Mobile. It is disabled by default, binds to the LAN only while enabled, requires a bearer connection password, and exposes app API routes without exposing daemon-control routes.

Pair on the same network

1. Install the AO mobile app and put the phone on the same trusted Wi-Fi as the desktop.
2. Open desktop Settings → Connect Mobile.
3. Enable mobile access.
4. In the mobile app, scan the pairing code to fill the address, port, and connection password automatically.
5. If entering details manually, copy all three values from the desktop.

The listener normally uses port 3011 and can fall back to another available port. Always use the actually displayed port. Disabling Connect Mobile closes the listener; regenerating the password disconnects existing clients.

Tailscale

For access away from the same Wi-Fi, install Tailscale on both devices and sign in to the same tailnet. Enable Connect Mobile, find the desktop's 100.x address with tailscale ip -4, then enter that address, the displayed mobile port, and the connection password in the mobile app. Leave TLS disabled.

Do not use tailscale serve to expose the primary loopback daemon. The native app should connect to the authenticated mobile listener.

Security model

• The mobile listener uses plaintext HTTP by design and is intended for a trusted home network or private tailnet.
• Every REST and terminal connection requires the rotating password.
• Repeated failed authentication is locked out per source.
• /shutdown, telemetry controls, and mobile-control routes remain loopback-only.
• Mobile settings are persisted in a mode-0600 file under ~/.ao/mobile/config.json. The rotating password is stored there so the desktop can redisplay it; authentication comparisons use its in-memory hash.

Anyone who can observe traffic on an untrusted network may read the password and session traffic. Turn Connect Mobile off when it is not needed, and do not expose its port to the public internet.

What mobile supports

The Expo/React Native app is a native control surface over the same daemon resources as desktop. New mobile sessions prefer Chat when a compatible installed harness is available; Terminal UI remains an explicit compatibility choice.

Mobile supports structured Chat, Terminal UI, session creation, the same capability-gated Chat/TUI handoff, approvals and structured input, changed files, model/provider controls, compaction and rollback, voice dictation, attachments, and a session-scoped worktree shell.