Remote vibe coding on mobile

• Build plan → New agent — or type /execute. Cretli copies the approved plan, starts the executor, and shows a status card on the planner chat.
• One implement/fix job at a time — Build plan and fix runs stay exclusive per planner chat, while up to two review jobs can run side by side. Stop stays on Stopping until the run actually ends; retry respects the parent busy lock.
• Plan stays read-oriented — mutating tools are denied before they run on OpenCode, Cursor SDK, Qwen, CodeBuddy, OpenRouter, and DeepSeek. Codex Plan is prompt-only.
• Plans on disk — written to .cursor/plans/cretli-{chatId}.md so Build plan has a file to point at.

Plan mode is not a sandbox — keep the localhost default and read Security.

• Nest and reorder — press-and-hold to drag chats and workspace groups. Hover another chat ~0.5s to nest; drag among roots to unnest. Parent is saved on the server; custom order stays in the browser.
• See work without opening the chat — the list polls agent presence. Compact icons for disconnected, connecting, working, and needs-action. Finished jobs keep a badge until Mark as reviewed.
• Pin the desktop sidebar — the drawer sits in the left column instead of overlaying chat. Harness switch from a nested chat keeps the new chat under the same parent.

• Broadcast to every client — one terminal PTY per session, and its output plus the agent chat stream to every device connected at once.
• Join in one scan — the app shows a link and QR code pointing at your LAN URL, so a second screen pairs without typing addresses.
• You own the address — Settings stores the LAN host (CRETLI_LAN_HOST) that the link and QR point to, so it always matches your network.
• No cloud account — screens talk to your server over LAN or VPN, never through a vendor middleman.

Go beyond localhost the way you trust — read Security first.

• Talk continuously — OpenAI Realtime or Gemini Live (the cheapest long conversations), with semantic VAD and noise reduction.
• Your voice steers the app — the agent runs tools as you speak: send prompts, stop the agent, switch chats, run tasks.
• Phones actually play back — Live replies go through a hidden audio element so Chrome on mobile is not silent; Test sound uses the same output.
• Dictate or listen — push-to-talk dictation and read-aloud replies for when you'd rather not talk out loud.
• Guardrails built in — live cost estimate, warning at $2, hard cap at $5, session ends after 90 s of silence.

Microphone access needs HTTPS — npm run gen-cert issues a certificate for your LAN IP (answer the prompt), then open the site on your phone.

• One script tag — the widget pairs with your server using an installation ID; no build step.
• Page context, on your terms — the agent sees only what you grant: DOM, console, network, screenshots, even interact and navigate.
• Same chat, any harness — the widget talks to the same backends as the app: OpenCode, Codex, Qwen Code, and the rest.
• New agent on a pinned page — + starts a fresh chat and keeps the send bar, instead of reusing the URL-pinned thread.

• Full server on Android — the same npm install plus npm run start:termux; no desktop, no Docker needed.
• Code on the phone itself — open https://127.0.0.1:3011 in the phone's browser; the first run sets your access password.
• Or broadcast over Wi-Fi — npm run start:termux:lan binds the phone's LAN IP so a tablet or laptop can join the same live session.
• Stays awake — start:termux holds a CPU wake-lock when Termux:API is installed, so Android doesn't freeze the server in the background.
• Android reality — chat works well with an OpenRouter key in Settings; heavy local agents and the Cursor SDK usually aren't available on Termux.

Full walkthrough, update steps, and LAN certificate details: docs/INSTALL.md

• Default-deny allowlist — a workspace must explicitly allow each http(s)://host before Chromium can load it.
• Policy-checked navigation — every navigation and subresource redirect hop is re-checked, and credentials are stripped when a redirect crosses origins.
• Separate opt-ins — loopback (allowLocalhost) and RFC1918/ULA private ranges (allowPrivateNetwork) each need their own explicit allow; neither implies the other.
• Cretli's own origin is blocked — the configured public origin and the direct loopback URL stay denied even if allowlisted, so the panel cannot reach the control plane.
• DNS pinning is defense in depth — the default-deny resolver map is not a hard IP-level guarantee. Treat the panel as a convenience, never as a full SSRF or network boundary.

Plan and review delegations get the read-only tool subset, and input needs an explicit confirm. Details in SECURITY.md.