# Tade Away: the control room, on a phone you paired > Agents run for hours, and nobody should have to sit with them. Tade Away puts the control room on a phone you paired, served by the Tade window itself. Published 2026-10-14 · by The Tade project · tagged away, agents, safety. Published at https://tade.sh/blog/tade-away-the-control-room-on-a-phone-you-paired/ — part of https://tade.sh/blog/. --- An agent that runs for three hours spends most of them not needing you, and then one minute needing you badly: it wants to run `npm i stripe@15`, and it waits. That minute is the reason people stay at the laptop, and it is a poor reason. **Tade Away is the control room above your agents, from a phone or another machine you paired at it.** The window on your own machine serves it, to devices you let in one at a time, and to nobody else. Inside Tade it is called the away view, which is what the panels below say. It is on Tade's `main` and not in `tade-sh` 0.1.1, which is what npm installs today and was packed on 2 October. Until a release carries it, the way to it is the `source` rows at the foot of [Install](/#install). ## Why it exists A run that takes the afternoon is ordinary now, and what it needs from a person is small and badly timed: an approval, a sentence of direction, a yes to work that arrived from outside. None of it needs a keyboard. Until now, all of it needed you at one. The usual answers are both worse than the problem. Leaving the lid open and walking back to look is a person polling. An SSH session and tmux on a phone put ANSI rows on a 390-pixel screen, and that is a terminal you can type anything into, from anywhere, as you. So Tade Away is a page and not a terminal, and it is built round one question: *is anything waiting for me*. Nothing on it types into an agent. What you say goes through Tade, and what you do is one of a short list of acts the page names. ## What it is ![Tade's away view on a laptop and then a phone: the overview with what needs you and its presses, the agent waiting on npm i stripe@15 with Allow and Deny and its screen, two plans with their steps, the morning's spend against each plan's limits, and three phones](/images/away-page.svg) It opens on every project at once: what needs you, what is working, what is queued, how the checks stand, what the morning cost and the plan limit that runs out first. Under that is the work that wants somebody, with the presses that device was granted right on the card — *Allow*, *Deny*, *Done*, *Set aside*, *Tell*. Down the side is each project's agents and its queue, hung as a tree of what waits on what, and Tade is docked at the foot. An agent's page opens on what it is doing now, with its checks, branch, spend and plan beside it. On a phone the same pages sit behind a tab bar, and the middle of the bar raises the conversation with Tade. The picture is not a screenshot. Tade draws it the way it draws its own window: the page's own code, run over a made-up morning, with the page's own stylesheets, laid out by the browser you are reading this in. What it is not is a cloud dashboard. There is no account, no relay and no tunnel. The listener is in the window's own process, so close Tade and nothing is listening, and a bookmark tapped then is the browser's own connection error rather than an empty control room. A sleeping laptop serves nothing either, and the page says so instead of going blank: > Unreachable since 11:07. The machine may be asleep, or Tade may be closed. > What is below is the last thing this device was told — not what is > happening now. ## How it works ### A device is let in at the machine > **A screen from Tade — `away-a-device-asking`.** The away view in the window with a phone asking to pair: a card at the top saying what it calls itself, where it came from, that a yes grants full access and any of it can be unticked in its row, the minute it has as a bar, and Approve and Refuse with their keys — then the code to scan. > > A phone at the door: what it calls itself, where it came from, that a yes > grants full access and any of it can be unticked, the minute it has, and the > same `a` and `d` that answer a tool call. The window draws a code. The phone scans it, names itself and asks, and the answer is a keypress at the machine — `a` or `d`, the same keys that allow or deny what an agent asks. The code carries a ticket that lasts ninety seconds and is spent the moment it is presented, so a replay finds nothing; the ticket is in the code's fragment, so a typed address cannot pair at all. On a computer, the link under the code does what scanning does. The line at the foot of that panel is the one nobody wants to write: *an agent on this machine could pair itself*. Agents run as you and nothing sandboxes them. What stands against it is that the panel lists every device there is, every act is journalled under the device that took it, and *Disconnect everything* needs no network. ### What each device may do is decided per device > **A screen from Tade — `away-acting-granted`.** The away view with acting on: every device, whether it is connected now, where it paired from and when, what it reads, and a box per thing it may do, ticked where it was granted, with the foot saying in one clause what the box under the pointer grants. > > Three devices: whether each is connected now, where it paired from and when, > what it reads, and a box per thing it may do, ticked where it was granted. **A yes is full access, and the card says so before you press it**: every project, everything the page can read and everything it can do. Each row then takes back what you did not mean, a box at a time — answer and steer, stop agents, close projects, talk to Tade, change settings, see screens, read settings — and *full access* turns the lot on or off at once. Two devices are two decisions: the kitchen screen can read names and counts while your phone answers agents. With every box empty a device still reads the names of your projects, the names and states of their tasks, the counts, and how fresh it all is. That is enough to answer the question the page exists for, which is the test of whether it is the right floor. Granted, a device can answer what an agent is waiting on, tell a running agent something, hold, release or reorder queued work, set a task aside or pick it back up, write a note, add a line to what a task's agent is told, mark work finished with two presses, and approve a request a rule here already allowed. With boxes of their own it can stop or reopen an agent — never start a new one — and close or reopen a project. That is twelve acts, each naming its target and the state it expects, and the window checks that state again at the moment of acting. What no device can do in any configuration: change who can reach Tade or what a device may do, read a credential, run a command, start an agent that never ran, push, merge, overrule a check or publish a workflow. Those are not switches that happen to be off. **There is no route for any of them.** ### The live view The page is live: one stream from the window, advanced on its own beat of about two seconds, and the header says `live · as of 14:00:04` so nobody has to guess how old a number is. With nobody looking, the beat builds nothing. An agent's screen is its own grant — *see screens* — and it is the last lines of that agent's terminal, read only while somebody has the page open. Machine paths, the keys Tade holds and anything shaped like a credential are taken out of it. Anything else an agent printed is not, which is why the box is there. ### Talking to Tade A device granted it can talk to Tade from the same page, and the window says what that means in one paragraph rather than leaving it to be guessed: > A message from a paired device reaches the same conversation you type into, > and is never your own words: it cannot authorise a setting change, however it > is phrased, and nothing it says reaches a line you said. While Tade answers one, its tools are narrowed in code to reading that device's own view of your work plus the few acts it was granted, and every other tool it holds is refused — including the harness's own shell. A closed list is what makes free text to a model safe, and a paragraph asking the model to behave is not. The device's words stay in the transcript at the machine, marked as that device's. ### Notifications Put on a phone's home screen, the page can be told when something wants you. Every notification goes through the push service that phone's browser chose — Apple's, Google's, Mozilla's — which sees that something was sent, when and how big, and cannot read it: it is encrypted to a key the browser keeps. One thing wanting you is named, as in *api-v2 wants your answer*, when the device may read titles and *Get work names in them* is on, which it is by default. Several are a count and never a list of names. Turn that setting off and every notification is a count. They are sent by the window on its own beat, so a closed window or a sleeping machine sends nothing, and **nothing is caught up**: a window that comes back says what is true now rather than six things about last night. The protocol is tested against a stand-in for the push service. Delivery to a real phone is a manual check, and nothing in the repository records it being done yet. ## The security model, in plain words - **Nothing is served unless you turn it on.** The switch is off until you press it, and off means no listener at all. On, the listener lives in the window and answers this machine alone until you choose otherwise. - **A session belongs to the host it was made on.** The address a device paired at is compared byte for byte, so the same machine under another name, or on another port, is a new pairing rather than a session that wandered over. - **Acting needs this machine or an https name you trusted.** That is asked again at every act. A plain-HTTP address on your wifi reads and nothing more, whatever was granted — a phone granted everything and carried onto somebody else's network does nothing until it is back. No forwarded header is ever read: a proxy is trusted by being named, never by what it writes. - **Every act is journalled under its device.** The refused ones too, and every turn of a conversation, so *who did this* always has an answer that is not *the owner*. ## How to try it **Turn it on.** Settings › Away view › *Serve the away view*. It applies as you press it, and the code appears under the switch. The strip at the foot of the window says `remote off` until then and `remote 1` once a device has a page open, and pressing it brings you back to this switch. > **A screen from Tade — `settings-away-on`.** The away view in Settings, turned on from its own switch: the code to scan and the link to open on this machine under it, the devices, then who may reach it, the port, and what a paired device may do. > > The switch, on: the code and the link to open on this machine under it, the > devices, then who may reach it, the port and the trusted hostnames. `tade web on` writes the same setting from a shell, and says it takes effect the next time Tade starts — the window does not watch its config file, so the switch is the quicker of the two. The rest of the shell's half reads: ```sh tade web # what is on, where it listens, who is paired tade web devices # every device, and what it may read tade web revoke --all # disconnect every one of them; needs no network ``` **Scan the code.** Name the device on its own screen, then press `a` at the machine. On this machine, open the link under the code instead. At home, *Who can reach it: lan* puts the page on your wifi — in plain HTTP, which anybody on that wifi can read, and so read-only whatever else is on. **Take it with you over Tailscale.** This is the way to reach it from somewhere else, and it is a smaller surface than `lan`: ```sh tailscale serve localhost:7654 ``` That gives the phone https on your tailnet while Tade keeps listening on this machine alone. Put the tailnet name in Settings › Away view › *Trusted hostnames* — Tade answers only its own addresses and the names listed there, and an https name listed there is the only origin off this machine that may act. The code then points at that name, so scan it again and the phone pairs there, with a session bound to the address it will keep using. ## What moved since the switches post [The away view, and the switches in front of it](/blog/the-away-view-and-the-switches-in-front-of-it/) is the long version of every setting, and it is true as of 12 October. Three things have moved since. A yes at pairing grants everything and the rows take it back, where it used to grant reading and nothing else. The switches under the first are on and apply as they change, each still nothing to a device until that device is granted it. And there are twelve acts, not eight: stopping and reopening an agent and closing and reopening a project each arrived with a box of their own. What has not moved is the shape. The window serves it, a person at the machine lets each device in, and the list of what a device may do is a closed one.