OpenRemote 0.4.0

A browser beside the chat, a real plugin store, and a phone that pairs by pointing a camera at the screen.

OpenRemote is one window for the agent harnesses on your computer - Claude Code, Codex, grok, pi, opencode, agy - running side by side. The daemon and the console only talk to each other on 127.0.0.1. Local chats never leave the machine, there is no telemetry, and nothing here needs an account.

This release is mostly about places to be. A chat can now open a web page next to itself, the Plugins page grew a store, and the Mobile screen can hand a chat to a phone without a sign-in of any kind.

A page next to the chat

Split a chat to the right and the pane is a real browser, not a preview of one.

• Tabs, an address bar that also searches, back and forward, and reload.
• Select this element puts the page into a picking mode: hover highlights, a click takes the element's CSS selector, its kind and its own words, and drops them into the composer as text the agent can read.
• Console menus, dialogs and the command palette always stay visible over the page, even though the page is a native view drawn above everything else.
• A page cannot start a download on its own. The attempt is listed in the console's downloads and nothing is written to your disk unless you go ask a browser that prompts.
• Talking to the page never opens a debugging port, so nothing else on the machine can attach to the built-in browser. A page that stops answering costs one failed call, not the pane - while an element pick waits as long as you need, because how long you take to choose is yours.

Pair a phone with a camera, no account

Scan the code on the Mobile screen and the phone is paired. That is the whole setup.

• The code is eight characters from an alphabet with no look-alikes, so it can be read out loud or typed by hand if the camera will not focus. It lives for five minutes, five wrong guesses burn it, and 40 bits of it are random. The socket it opens is this computer's own LAN address on one of six fixed ports, and it closes when no code is live and no phone is paired.
• The owner token never appears in the code, in the page, in an answer, or in a log line. The phone gets its own token, kept here as a SHA-256 digest in an owner-only file, and exactly one route accepts it.
• The page a phone loads has no external assets and no network off its own origin, and it can ask exactly one thing: a read-only summary of what this computer has installed and which chats are recent.
• It is plain HTTP on your own network, which both screens say out loud. The first pairing asks your firewall for permission, once.
• Pairing works while Cloud says you are signed out, because it has nothing to do with the account.

Plugins became a store

Discover lists real marketplaces, and a marketplace is Claude Code's own catalog read exactly as it is, so any catalog that works in Claude Code works here.

• One file, .claude-plugin/marketplace.json. OpenRemote's extra facts about an entry - its runtime, the powers it asks for - ride in a field Claude Code ignores.
• Catalogs are cached after the first fetch, so Discover works offline against the last refresh.
• Nothing installs from a listing. An entry resolves to a fetch, and the install still goes through the same review screen that names the runtime and spells out each power in plain words.
• MCP servers on this computer are listed where the plugins are, with the same care about what a server is allowed to do.

Three new screens

• Account shows who is signed in, what the device keys are, and what another device on the account can ask this computer to do - the honest version, not a promise.
• Mobile is both halves of the phone story in one place: pair by code, or sign in and drive a machine.
• Metrics is the console's own numbers, measured rather than estimated.

Find anything from the keyboard

• A command palette (Ctrl+K, Cmd+K on a Mac) that reaches every view, every chat and every setting.
• A shortcut sheet (Ctrl+/) listing what the keyboard can do. Both keys are rebindable.
• Settings gained a search field, so a setting can be typed instead of hunted.
• In a chat, @ suggests the files of the workspace the way the chat sees them: what git tracks, plus the untracked files it does not ignore.
• Model names carry their maker's mark, taken from the harness's own catalog. An unknown maker shows the name alone rather than a guess.

Esc closes one layer, not the whole stack

Nine dialogs used to listen for the same key, so one press closed everything - and in Manage endpoints it took a half-written rule with it. Now the top layer takes the key and the layer underneath stays open.

The app says what is wrong with the daemon

When the daemon will not start, the window shows the shell's own sentence for why, cleaned up and capped, instead of "connecting" forever. A daemon that dies at boot fails in seconds. A daemon that says nothing is reported as silent.

Stopping a chat stops everything it started

A stopped chat used to leave its helpers running. Ending it now walks the whole tree of processes it created, on Windows and elsewhere, and keeps walking even when a child has rewritten its own identity.

Cloud, told straight

• Leaving Cloud keeps the device recoverable, and a damaged identity says which part is damaged instead of pretending to be healthy.
• A dead credential stops claiming the computer is online.
• The mesh bounds what a peer can make this computer do, and a peer can no longer grow a process here without a limit.
• docs/cloud-trust-model.md is the route-by-route table: what a peer of the same account can ask, what protects you instead, and which rows the tests cannot exercise.

Hardening worth naming

• A prompt leaves the command line: it reaches the harness on stdin or a private file, so it never sits in a process list for other users to read.
• A model name that looks like a command line flag is not treated as one.
• A plugin catalog entry cannot point outside its own folder, and a marketplace URL cannot turn into extra git arguments.
• A tab's name cannot carry a direction override into the window title.
• CI now refuses a release tag whose manifests disagree, whose notes are missing, or whose Android version code does not exceed the last release - and refuses a capability file that widened a tab's scope.

Installing this

The installers are unsigned by decision, so Windows shows SmartScreen the first time: More info, then Run anyway. On macOS, right-click the app and choose Open. Android refuses an update whose version code does not exceed the one installed; this build's code is higher than the last. Linux gets an AppImage, and the machine installer for a headless computer carries a checksum file the install script refuses to ignore.

Upgrading keeps your chats, your settings and any paired phone.

Nothing is sent anywhere by this app. If you find something wrong, the issue tracker is the fastest way to tell us.