Remote control
Remote control exists for one situation: you are out, away from your Mac, and one of your terminals needs you. Everything about it follows from taking that seriously — including that it is on when you install Saggar, because the moment you need it is the moment you are not at the Mac to set it up.
Nothing listens on your network
Your Mac does not open a port. It dials out and holds a connection to a relay, which introduces devices only to Macs on the same account. So there is no port to forward, no certificate to accept, no VPN to run, and nothing on your network for anyone to find — and the address works the same on cellular from another country as it does from the next room.
Same-network use is not a fallback, it is out of scope. If the relay is unreachable, remote control is unavailable, even from the sofa. That trade is deliberate: the local path is what made the feature need certificates, trusted origins, and a second QR code, none of which ever served the one situation above.
Your account is the trust model
A device pairs with your Mac because it holds a live session on the same Marginal Utility account — the one Kiln and Saggar share. That is a claim a glimpsed code cannot fake, and unlike a code, it still means something when you are a hundred miles away.
It also revokes properly. Sign out on the Mac and every paired device stops working on its next request, instantly, rather than lapsing on a 30-day timer that would have expired precisely when you needed it. Grants themselves never expire on idle, for the same reason.
One setting, two answers
| Setting | What it does |
|---|---|
| On | The default. A device on your account pairs — after someone at the Mac confirms it — and gets to watch a terminal, answer its prompts, and type into it. |
| Off | The Mac stops dialling out. This is the one setting that matters: holding that connection is what carries your credential off this Mac, so off genuinely stops it. |
There is no setting that skips the confirmation, and none that skips the account check. Both run on every pairing, in that order.
Saggar → Settings → Remote control holds all of it, and onboarding offers the choice in plain words rather than burying it.
From a phone
The client is built for one-handed use away from the Mac, so a few things behave differently there than at a desk:
Waking up reconnects. A phone suspends the live stream when it locks, and often hands back a connection that is dead without saying so. Bringing the client to the front rebuilds it and refetches the fleet, rather than waiting out a retry backoff.
Stale state says so. When no heartbeat has arrived, a banner names how old the state on screen is and offers a reconnect — out of the house, an unreachable Mac is an ordinary state rather than an error.
The terminal has the keys a touch keyboard hasn't. At
drive, a row under the live terminal sends escape, tab, Ctrl-C, Ctrl-D and the arrows — enough to answer an agent's prompt, interrupt a runaway, or walk the history. Type size shrinks to fit the Mac's column count, since the pane wears the Mac's geometry rather than reflowing the shell you left open.You can speak a prompt instead of typing it. The mic beside the send row — and in the live terminal's key bar — turns a spoken sentence into a line, straightening the smart quotes and em dashes dictation insists on so a shell can read it. It always lands as a draft: nothing is sent until you press Send, or Return in the terminal. There is no auto-send, deliberately, because a misheard command that ran itself would carry your own authorization with it.
And you can hear what a session is asking. Read aloud on the focused session speaks its name, its status, and the question at the end of its transcript, with the box borders and spinners stripped out. Useful when your hands are busy and a terminal has gone amber.
Install it to the home screen. On iOS that is what makes web push available at all, and it gives the client the whole screen. More on alerts.
Both use the browser's own speech engine — the companion has no backend to send audio to, and this feature did not give it one. Where that engine runs is the browser's choice, not Saggar's, and it differs: Safari on Apple devices dictates on-device, while Chrome sends the audio to Google for transcription. If that matters for what you are about to say, use Safari, or type it. Reading aloud is local everywhere, but it is still a terminal spoken into the room you are in.
Getting a device on
Sign in on this site, then scan the QR in Settings → Remote control. That is the whole ceremony: the code is filled in for you, your account is checked, and the phone lands on the client. It is one scan, one time — see pairing for what happens underneath and what each refusal means.
What this costs
Two things, and they belong here rather than in a surprise. There is no offline path: no internet, or a relay outage, means no remote control at all. And the relay can see the bytes it carries between your phone and your Mac. It runs as a trusted first-party hop — the same operator as the account backend that already holds your identity — and the pairing QR carries your Mac's public key from the first release, so encrypting those payloads end to end later will not cost anyone a second pairing. The relay also learns which of your Macs are online, and when.
What has not changed is what a paired device is allowed to do, or the record it leaves. See security.