Reliable architecture: dev machine runs OpenCode, phone is the remote.

The recommended architecture

Keep execution close to the real workspace while making approvals and follow-up work available away from the desk:

iPhone (KKCode)  →  private VPN or authenticated HTTPS route  →  OpenCode server on your computer  →  project files, tools, providers, and sessions

This is the same shape that mature remote development tools use. The phone is a thin client; the machine is the source of truth.

Set it up

1. Install OpenCode on the dev machine — curl -fsSL https://opencode.ai/install | bash or npm install -g opencode-ai. Update to a current release before debugging older endpoints.
2. Start the server with a unique username and a strong password. Bind it to 127.0.0.1 when you plan to use a tunnel or reverse proxy; bind it to 0.0.0.0 only on a trusted LAN.
3. Pick a network path from the Remote access guide. Tailscale is the default when only your own devices need access.
4. Test the API endpoint with curl -u user:password https://your-host/global/health from the same network your phone will use. Do not assume that a browser-rendered page is the API base — if the root displays a web UI, enter the API base URL, often the same address with /api.
5. Open KKCode and fill in the connection screen — server URL, username, password. Credentials are encrypted and stored locally on your device.
6. Pick a project from the workspace list. KKCode remembers the selection for the next launch.

Good mobile workflows

• Check whether a long task is still progressing.
• Answer a permission or product question.
• Review the changed-file summary before accepting completion.
• Send a short follow-up or dictate it with voice input.
• Inspect a specific file in the project.
• Switch or archive sessions while keeping each thread focused.

Use the desktop when a change requires broad code navigation, prolonged terminal interaction, complex conflict resolution, or detailed visual review.

Security boundaries

Your phone can become a route to source code and terminal access on your dev machine. Read the security model before treating the setup as production-ready:

• Always keep OpenCode authentication enabled — Tailscale, Cloudflare Tunnel, or HTTPS alone do not replace it.
• Prefer loopback plus a tunnel or a private VPN over a public IP and router port forwarding.
• Treat the phone as holding credentials to your dev machine. Enable device encryption and a strong screen lock.
• Rotate the OpenCode password if a device is lost, transferred, or compromised.