Why Cloud Link
Cloud Link keeps your OpenCode reachable — and quietly handles the parts that make remote work dependable: who gets in, from which device, at what address, and what else on your machine they can reach.
Your project rarely lives alone. A dev server, an API on loopback, a dashboard, a preview build — Cloud Link can publish any of them by path through the same authenticated address, next to OpenCode. New services start disabled, access is private by default, and they are served from a separate origin, so OpenCode’s web UI and credentials never mix with them. Toggle changes apply live, without restarting your tunnel.
A QR code alone is not enough to reach your machine. When a device claims the pairing, you see its name and approve it on the spot — the tunnel does not start until you do. Pairing links expire in five minutes, work exactly once, and are stored only as hashes. A leaked screenshot gets nobody in.
Each phone gets its own signed, machine-scoped credential with a device identity and an expiry, verified locally by the connector. Remote browsers get a separate random password you can regenerate from the tray, which signs out every browser without touching your phone. Your control plane never stores a per-device secret.
Your machine keeps one stable, opaque hostname across re-pairs, upgrades, and restarts. Bookmark it, script against it, and never re-learn a URL. Hostnames stay random and are never derived from your identity.
Logins, reboots, and network changes are handled without ceremony. Transient failures retry with capped backoff. A tunnel that goes quiet is replaced, and the OpenCode process is verified by socket ownership before a credential reaches it. You can see the current state in the tray, with a Retry button when something needs a human.
Optional Keep awake stops your machine from idle-sleeping while agents run or while you are remotely connected, so a long task finishes while you are in a meeting. It is battery-aware by default and never overrides a closed lid.
Launch the managed OpenCode web UI in its own window. Edit your global OpenCode configuration — MCP servers, language servers, plugins, or raw JSON — from the same place. Opt into start at login. The installers bundle everything.
Every installer carries SHA-256-pinned OpenCode v2 and cloudflared. The macOS build is signed and notarized. Nothing to install, nothing to drift, no runtimes required.
By default it starts and supervises its own OpenCode server bound to loopback. If you already run a server you trust, you can adopt it explicitly instead.
Yes. Services are private by default and require your Cloud Link credentials. Marking one public is an explicit, per-service choice.
Device credentials expire on their own, and regenerating the browser password from the tray signs out remote browsers immediately. Removing the machine retires its tunnel and DNS record.
Through a managed Cloudflare tunnel, over TLS, straight to your machine. The control plane establishes the connection and keeps metadata only — never prompts, code, or credentials.
Yes. Linux x64 and ARM64 archives with an optional systemd user service; no graphical session required.