Staying reachable

Reins connects your phone straight to your machine. Two things decide whether an approval reaches you: whether the phone can reach the machine at all, and whether the app is awake when the agent asks.

Reaching the machine

On the same network it works out of the box. Anywhere else, the machine has to be reachable from the phone: put both on Tailscale or a VPN; the phone picks up the new route on its next connect. The phone probes every route it has and uses whichever answers. Approvals carry on after a switch from Wi-Fi to cellular; an open terminal does not yet, and needs reopening.

reins tailnet lists the tailnet machines this host can see, which is what the pairing screen's tailnet picker shows. If you use Tailscale or a VPN, that provider is in your network path.

$ reins tailnet

When the app is asleep

A phone in a pocket is not connected: the OS suspends the app within seconds. With no phone attached, the daemon lets approvals through to your desk prompt at once, which is fail-open doing its job. Two optional things close that gap.

Stay connected (Android)

In the app, Machine, then This phone. A foreground service holds the link open in the background. The cost is a permanent quiet notification.

Wake-up push (Android today; iPhone when APNs lands)

With alerts on, when an agent asks and no phone is attached, the daemon sends one notification that says only “An agent needs you” and holds the approval for up to 45 seconds while the phone reconnects. The push carries nothing about the command; the approval itself still travels over your paired connection. A phone that does not come back costs one hold; after that, approvals pass straight through for ten minutes.

On iPhone there is no closed-app push yet. Alerts arrive while the app is open or backgrounded, and a pending approval shows on the lock screen as a Live Activity. With the app lock on, the notification and Live Activity hide the raw command.

Relay or your own Firebase

The wake-up push goes one of two ways.

• Through the Reins relay, at https://reins-push.enraio.com, which the app and the daemon use by default. The phone seals its push token into a ticket only the relay can open and gives the machine the ticket, so the machine never sees the token and needs no Firebase account. The relay stores nothing and is rate limited per phone. Turn it off with reins serve --push-relay "".
• Directly, with a Firebase project you own: put its service account key at ~/.reins/fcm-service-account.json, readable only by you. The app must also be registered with that project; email hello@enraio.com if you need this.

With neither set up, push is simply off and nothing else changes.

Check it

$ reins push list

$ reins push test

list shows each registered phone and whether it is reached through the relay or your own project. test sends the wake notification now, without waiting for an agent.

The timers

Full flag list in the CLI reference.