Remote access
Remote capability has three independent authorization scopes: device trust, Remote Share, and workspace authorization. Enabling one does not expand the others.
Remote-control messages travel between trusted devices over an end-to-end encrypted channel; the relay authenticates, routes, and delivers them but does not execute commands for the target CLI. Task content for a remote model is still processed by the actual provider. See Data and execution boundaries and Devices and security.
Smallest workspace authorization
When controlling another computer from the App, start the service first, then use originrouter remote setup --workspace <path> for the smallest workspace authorization.
Sharing custom provider models
Add --providers only when you need to share custom provider models. Configure their model permissions before running the command.
1. Sign in and confirm service status
Complete the installation first
Before proceeding, complete the installation and originrouter setup in CLI overview and install. That flow installs and starts the local service.
For service installation, startup, and status management, see Service and daemon.
originrouter login
originrouter service status
originrouter remote status
Run these commands in order: sign in, confirm the local service is running, then inspect remote capability status.
Use originrouter login --no-browser on a headless device.
2. Set up remote capability
Model permissions
In App Provider Control (or the Local API), first mark the models you intend to share as local enabled and turn on remote allowed.
The CLI has no standalone command for changing a model's remote permission. remote setup and remote share start only register or start models that are already authorized.
Run this from the target device's management context:
originrouter remote setup
One setup command can also select providers and a workspace:
originrouter remote setup \
--providers openai,anthropic \
--workspace /path/to/project
3. Remote Share
Remote Share exposes only remote-enabled models from selected providers.
It does not share provider credentials or grant file access.
If no eligible model exists, startup fails with an unknown-provider or no-remotely-enabled-model error. Enable the model in Provider Control and retry:
originrouter remote share start --providers openai,anthropic
originrouter remote share status
Run these commands in order: start Remote Share for the selected providers, then confirm its status.
4. Workspace authorization
originrouter remote workspace authorize /path/to/project
originrouter remote workspace list
Run these commands in order: authorize the workspace directory, then confirm the registered directory list.
A trusted controller can request directory registration:
originrouter remote workspace request /path/to/project --device <device-id>
The target CLI automatically accepts only directories that do not require interactive system permission. Agent processes cannot run request or authorize to expand their own access.
App connection
Sign in to the same account in the App, verify device identity and trust, then select the target device. See Connect the CLI from the App for interface steps.