@volter-ai-dev/supercode-remote-access

Optional remote-access lifecycle for Supercode-powered frontends. The package exposes a loopback web origin through one of three transports and reports a UI-ready, provider-neutral snapshot:

• a configured stable @volter/tunnel relay;
• a zero-account Cloudflare Quick Tunnel;
• an already-authenticated ngrok installation.

It does not serve an application or choose cookies, passcodes, HTTP routes, or WebSocket policy. The host product owns those surfaces. The package does provide the security-sensitive reusable primitives underneath them: digest-only single-use pairing grants, bounded expiring device-session tokens, and browser-safe validation for device snapshots and pairing handoffs. This keeps Supercode's session glue independent from HTTP frameworks while preventing each frontend from reimplementing replay and expiry rules.

Browser bundles import validation helpers only from @volter-ai-dev/supercode-remote-access/client; that entry point has no process, filesystem, or tunnel-provider imports.

import { createRemoteAccessController } from "@volter-ai-dev/supercode-remote-access";

const remote = createRemoteAccessController({
  localOrigin: "http://127.0.0.1:43123",
  publicPath: "/",
  tunnelId: "my-supercode-ui",
});

remote.subscribe((snapshot) => renderRemoteAccess(snapshot));
await remote.configure({ enabled: true, provider: "auto" });

Automatic mode prefers the stable relay, then Cloudflare, then ngrok. Temporary providers never initiate sign-in or configuration flows. Logs contain provider process output and are written with user-only permissions under ~/.supercode/logs by default.