Remote Sessions

Available on Android

Snippbot for Android is on Google Play (US-only rollout for now). iOS is planned but not available yet.

Remote sessions let you continue a conversation started on one device (e.g., your desktop) on another (e.g., your phone). The system uses a 6-layer security gate to ensure only authorized devices can join active sessions.

Hand-off from the web UI is still in development

The web UI’s Continue on another device action, which creates the transfer QR code and link, is behind a feature flag (VITE_MOBILE_SESSIONS_ENABLED, off by default), so hand-off from the web isn’t generally available yet. The CLI can’t create transfer tokens, and the phone can’t start a hand-off — it can only join one. The joining side described below is built into the app.

How it works

1. A session is created on the origin device (the desktop web UI, with the feature flag enabled)
2. A transfer token is generated (xfer_...) that expires after 2 minutes
3. The token is shared as a QR code or a snippbot:// deep link
4. The joining device (mobile) redeems the token and passes security checks
5. Both devices can view the conversation in real time

Joining a session

Deep link or QR code

Open a snippbot://session/xfer_... link on your phone — tap it in a message, or scan the origin device’s transfer QR code with your phone’s camera. The app opens directly to the join flow.

The app’s own QR scanner (on the pairing screen, Scan QR code instead) also recognizes transfer codes and routes them to the join flow.

Note

You can only join sessions on the daemon your phone is already paired with.

Security gate

When joining a session, the app passes through up to 6 security layers. Each layer is configurable in session security settings.

Layer	Check	Configurable
1. Rate limiting	Max join attempts per time window	Server-side
2. Device trust	Device must be in the daemon’s trusted device list	require_trusted_device
3. Device fingerprint	Hardware fingerprint must match a known device	require_fingerprint_match
4. TOTP verification	6-digit authenticator code required	require_totp_on_join
5. Owner approval	Session owner must approve the request	require_owner_approval
6. Token validation	Transfer token must be valid and unexpired	Always enabled

TOTP verification

When TOTP is required, you’ll see a 6-digit code entry screen:

1. Open your authenticator app (Google Authenticator, Authy, etc.)
2. Find the Snippbot entry
3. Enter the 6-digit code in the app
4. The code is verified against the daemon

Note

TOTP must be configured on the daemon first. See Settings > Security for setup instructions.

Owner approval

When owner approval is required:

1. The daemon sends a Session Join Request push notification to the owner’s phone, showing the requesting device name and platform
2. If the owner has Snippbot open on the Chat tab, an in-app approval banner appears with Approve and Deny
3. On the joining device, you’ll see a waiting screen with a countdown to the request’s expiry
4. If approved, you’re redirected to the conversation
5. If denied, or if nobody responds within 120 seconds, the join attempt fails

What approval doesn't do yet

Approve / Deny buttons on the notification itself, biometric confirmation of approvals, push for elevated tool-call approvals, owner approval of device pairing, and a full audit trail of approval decisions are not built yet. See Push Notifications.

Idle resume

When you return to a joined conversation after being idle, the app may require re-verification:

• If require_totp_on_idle_resume is enabled, you’ll be prompted for a TOTP code after the idle threshold
• The idle threshold defaults to 5 minutes and is set on the daemon (web UI chat settings)
• This prevents unauthorized use of an unattended device

Live session view

When you join a session from your phone:

• You see all messages in real time via a fan-out SSE stream
• Tool calls and agent responses stream live
• A session indicator pill shows at the top of the chat with the participant count
• Tap the pill to see all participants (device name, platform, role, and which device is the owner)

Session indicator

Active sessions show a colored pill at the top of the chat:

Color	Meaning
Green	Session active
Yellow	Less than 5 minutes until the session expires

Approval banner

When you’re the session owner and another device requests to join while Snippbot is open on the Chat tab, an approval banner slides in at the top:

• Shows the requesting device name and platform
• Approve and Deny buttons
• A countdown bar; the request expires on the daemon after 120 seconds

Security settings

Configure session security in Settings → Chat Sessions (the Chat Session Security screen).

Transfer mode

Mode	Description
Explicit Only (default, recommended)	Session owner must manually generate a transfer code
QR Code + Deep Link	Transfer via QR scan or snippbot:// deep link
Automatic	Any paired device can join any conversation

Security toggles

Setting	Default	Description
Require trusted device	On	Only trusted devices can join
Require TOTP on join	On	Authenticator code required to join
Require owner approval	On	Owner must approve each join request
Require TOTP on idle resume	On	Re-verify identity after idle timeout
Require fingerprint match	On	Verify device hardware fingerprint

Timeout and lockout

Setting	Range in app	Default	Description
Session expiry	5–1440 min	30 min	Sessions auto-expire after this duration
Max TOTP attempts	1–10	5	Device locked after this many failed codes
Lockout duration	1–120 min	15 min	How long a device stays locked

Use the + / - stepper controls to adjust these values.

Troubleshooting

”Invalid transfer token”

1. Transfer tokens expire after 2 minutes — generate a new one
2. Ensure the token starts with xfer_
3. Check that the session is still active on the origin device
4. Make sure your phone is paired with the same daemon as the origin device

TOTP code rejected

1. Verify your authenticator app’s time is synced (Settings > Time correction in most apps)
2. Use the most recent code — codes rotate every 30 seconds
3. After too many failures, your device may be locked out for the configured lockout duration

Approval timed out

1. The owner needs Snippbot open on the Chat tab to see the approval banner
2. The request expires after 120 seconds — the owner must respond within that window
3. Try again after the request expires