The session is becoming the product.
AgentsDock pitches a self-hosted server that connects multiple machines and agents to desktop and mobile clients. Its public feature list includes file editing, persistent tmux attachment, full terminal access, and inline review of generated media.[1] The appeal is easy to understand: the expensive run continues in the lab while the human checks the lap from a train.
roamux draws a narrower control boundary. Its host dials out from the machine that owns the repository, credentials, shell, and model access. The project says clients send a small validated command vocabulary rather than arbitrary shell strings; it also states that agent file edits are auto-accepted while destructive shell commands are not unattended.[2] That is a design choice worth seeing, not a magic safety seal.
Mobility is a cockpit feature. Authority is a systems property.
“The code stays local” is only one plane.
Keeping repository bytes and model keys on the execution host is valuable. It does not answer who can start a session, which device currently has the wheel, what commands cross the relay, how long credentials live, whether the host can reach production, or where an approval decision is recorded.
Remote-control products should publish four maps: data cargo, command vocabulary, identity and lease state, and the stop path. A relay that carries metadata instead of files shrinks one surface. A localhost-bound runtime shrinks another. Neither decides whether the agent itself has a giant cloud token in its environment.
Multi-window means lease state, not vibes.
VS Code 1.137 says its Agent Host can connect the same agent session from multiple editor windows through the Agent Host Protocol. The same release also adds queued inter-session messages and voice steering that can route requests to active sessions.[3] Once a session has several windows, phones, or collaborators, “connected” stops being enough.
The cockpit needs an obvious answer to: who is observing, who may send intent, who may approve execution, and what happens when two clients disagree? The boring answer is a single-writer lease with visible owner, expiry, takeover history, and an out-of-band stop. Collaborative cursors are lovely. Collaborative authority without arbitration is bumper cars.
A terminal is a capability, not a personality.
AgentsDock exposes a full terminal; roamux deliberately says it does not offer an arbitrary remote shell. Those are different products and different threat models, not a winner and loser. A research workstation may genuinely need terminal attachment. A narrow review-and-approve controller may be better served by explicit verbs.
The honest UI names the capability. “Stop run,” “approve command,” “send prompt,” and “open changed file” are inspectable. “Control machine” is fog. If a shell is present, show its host, user, working directory, environment class, and recording policy before the first prompt lands.
Build the handoff before the phone app.
- Observe: stream status and outputs without granting mutation.
- Steer: accept bounded intent while execution approvals remain elsewhere.
- Execute: grant one named driver a short lease; display host and scope.
- Brake: keep stop and lease revocation available outside the agent conversation.
- Receipt: preserve driver, device, commands, approvals, changes, checks, result, and expiry.