Code Agents Web CLI

SUPERSEEDED BY DeepSeek Harness: https://github.com/deepseek-ai/deepseek-harness

Run Claude Code, Codex, Cursor Agent, pi, Grok, Qwen, Kimi, Oh My Pi, Antigravity CLI and plain shells from a browser — on your phone, on a tablet, from another machine on your network. One Node process, GitHub sign-in, real terminals, sessions that survive a reload.

npx --allow-git=all github:dnviti/code-agents-webcli

That is the whole install. Nothing compiles, nothing needs a C++ toolchain, and there is no second command.

Prefer one native window for work across machines? Download the desktop app for Linux, Windows or macOS. It is a self-contained controller for its permanent Local computer and the remote CODE AGENTS servers you save; no terminal, Node.js, separately running server, or GitHub OAuth is needed to launch the local experience.

---

What it does

• Real terminals, not just a chat box. Full pseudo-terminals over WebSocket with xterm.js — TUIs, colours, Ctrl-C, the lot.
• Or a structured conversation, when you want one. The WebUI (beta) opens most of the same agents as message bubbles, tool-call cards, diffs and permission prompts instead of a raw TUI, with a trace panel beside it and a GitHub panel that knows what a PR or issue is linked to.
• Plan first, then implement. A durable Plan mode works with every WebUI runtime, keeps numbered revisions for review, and starts implementation only when the latest one is accepted. Agents can ask single-choice, multi-choice or free-text questions in both ordinary and planning turns.
• Whatever agent you already use. Eight agent CLIs plus plain shell sessions. Each is optional; the app only ever runs what is on the host's PATH.
• Multi-user, properly isolated. GitHub OAuth, an explicit allow-list, and sessions keyed to the account that made them.
• One desktop, several servers. The installed app combines labeled local and remote sessions, keeps each server's sign-in and certificate decision isolated, and makes the target explicit before new work is created.
• Open Local computer on your phone, when you choose. The desktop app can show a one-use QR for an ephemeral LAN gateway, or guide you through private outside-LAN access with Tailscale Serve. Sharing is off after every restart.
• Sessions that outlive the tab. Reload, switch devices, come back tomorrow — the session is still there, with its scrollback.
• Scrollback that does not melt the browser. The recent tail stays live; everything older is paged in from the server a screen at a time, and exports as Markdown.
• Built for the phone it will actually be used on. On-screen terminal keys, touch scrolling, a tab sheet, and an installable PWA.
• Paste an image into the prompt. It lands in the working directory and the path is typed for you.
• Per-runtime launch profiles. Model, extra arguments, environment and capability tiers, configured in the UI.
• HTTPS everywhere, with a certificate authority the server generates itself so LAN devices get a secure context.

Screenshots

Pick a runtime — terminal or WebUI — for the folder you're in.	The WebUI: message bubbles, tool cards, a live trace panel.
Issues and pull requests, with who they're assigned to and what they're linked to.	The same conversation, built for the phone it will actually be used on.

Before you start

You need two things:

1. Node 24.16 or newer — node --version. The shared per-user database uses Node's built-in SQLite APIs.
2. A GitHub OAuth App — sign-in is GitHub-only, so the app cannot serve a login page without one. It takes a minute: how to create it.

Getting started

Run it without installing anything permanent:

npx --allow-git=all github:dnviti/code-agents-webcli

Or install it properly — needed for the background service and self-update:

npm i -g --allow-git=all github:dnviti/code-agents-webcli
cc-web

Either way, the first start asks for your public URL, your OAuth credentials and which GitHub accounts may sign in, then opens https://localhost:32352. To reach it from another device on your network, use https://<this-host>:32352 and install the local CA once from /ca.crt.

--allow-git=all is required on npm 12 and ignored by older npm, so the same command works everywhere. Set it once with npm config set allow-git all if you would rather not type it.

Full detail: Installation.

Docker

docker run -d --name code-agents-webcli \
  -p 32352:32352 \
  -v code-agents-webcli-data:/home/appuser/.code-agents-webcli \
  -e GITHUB_OAUTH_CLIENT_ID=... \
  -e GITHUB_OAUTH_CLIENT_SECRET=... \
  -e GITHUB_ALLOWED_USER_IDS=... \
  -e PUBLIC_BASE_URL=https://agents.example.com \
  ghcr.io/dnviti/code-agents-webcli:latest

The image ships the web server only — the agent CLIs are not bundled. See Running as a service.

Documentation

Guide	What is in it
Desktop app	Native downloads, the local-and-remote controller, sign-in and certificate isolation, LAN discovery, updates and troubleshooting
Open Local computer on a phone	Desktop QR pairing on a LAN, its dedicated CA, private Tailscale Serve access, revoking and troubleshooting
Installation	Every install path, platform support, uninstalling, install troubleshooting
GitHub OAuth	Creating the OAuth App, the allow-list, the installer account
Configuration	Every CLI flag and environment variable, the setup wizard, where state is stored
Runtimes and profiles	The supported agent CLIs, managed install/update lifecycle, launch profiles, models, capability tiers
Using the terminal	Scrollback and history, copy/paste, images, mobile, the PWA
HTTPS and certificates	Why HTTPS-only, the local CA, trusting it per device, using your own certificate
Running as a service	systemd, Docker and Compose, reverse proxies, ngrok
Per-user environments	Giving every signed-in user their own container, with persistent storage
Updating	The update banner, who may apply it, which installs can and cannot
Usage analytics	What the usage screens read and how the numbers are derived
Usage accounting	The durable per-user job history and dashboard: what is recorded, per-agent honesty, the API
Architecture	How the pieces fit together
Troubleshooting	Symptoms, causes, fixes

Security

Anyone you add to the allow-list can open a shell on the host as the user running the server. That is the point of the app, and it is also the whole security model — list only accounts you would give SSH to. The allow-list is not optional: an empty one denies every sign-in. See GitHub OAuth.

Development

git clone https://github.com/dnviti/code-agents-webcli.git
cd code-agents-webcli
npm install
npm run dev

npm test              # tests available on this host, with explicit skip reporting
npm run test:strict   # require every integration capability (used by CI)
npm run typecheck     # server + client
npm run verify:install # install the working tree into a clean prefix and start it

See CONTRIBUTING.md and docs/architecture.md.

Links

• Source: https://github.com/dnviti/code-agents-webcli
• Container image: ghcr.io/dnviti/code-agents-webcli
• Licence: MIT