Codeusse lets you code from your phone. But your projects, tools, and terminals live on a real machine — your laptop, a desktop, or a server back home. Codeusse Connect is the secure bridge between them.
Under the hood, Codeusse Connect is an SSH tunneling service. It uses sish, an open-source SSH-tier reverse tunneling server, to route traffic from the Codeusse mobile app back to your machine — all over an encrypted SSH connection. No port forwarding on your router, no third-party proxies inspecting your traffic. Just SSH.
How It Works
When you run npx codeusse-connect on your machine, three things happen:
- The CLI opens an SSH connection to
connect.codeusse.com:40074, Codeusse’s sish server. - It requests a reverse port forward — sish allocates a public-facing port from a small, predefined range, and starts forwarding any traffic that hits that port back through the SSH tunnel.
- The CLI displays a QR code containing the SSH address (e.g.,
ssh://connect.codeusse.com:40076). You scan it with the Codeusse app, and you’re connected.
The architecture is split into a backend and a CLI:
| Component | What It Does |
|---|---|
| Backend | Docker Compose deployment of the sish server, plus a key generation script. A single antoniomika/sish:latest container runs in host network mode, listening for SSH tunnel requests on port 40074. |
CLI (cli/) | The codeusse-connect npm package. Uses ssh2 under the hood to connect to sish, request a reverse forward, and pipe incoming TCP connections to your local SSH daemon on 127.0.0.1:22. |
The sish Setup
sish is configured for SSH-only tunneling. TCP-level forwarding is explicitly disabled, which means all traffic flows through the SSH protocol layer. No raw TCP ports are opened directly — every connection is negotiated inside an SSH channel. The server uses an ED25519 host key, and the client never sees or stores credentials for the sish server itself.
The port range is deliberately small. This isn’t a public ngrok-style gateway designed for thousands of concurrent users. It’s a focused service for Codeusse users who need a short-lived tunnel to their own machine.
Security: The Tunnel Is Not the Gate
This is the part that matters most.
A reverse SSH tunnel is a pipe, not a passport. When sish forwards a connection through the tunnel, it doesn’t authenticate the inbound client — it just routes the bytes. The real authentication happens at the end of the pipe: your local SSH server (sshd).
Here’s the full security flow:
npx codeusse-connect"] -->|"opens reverse SSH tunnel"| B[sish Server] B -->|"allocates public port"| C[Mobile Device
Codeusse App] C -->|"SSH to tunneled port"| B B -->|"forwards to 127.0.0.1:22"| D[Local SSH Daemon
sshd] D -->|"validates SSH key"| E[Authenticated Session] style A fill:#fff,stroke:#ee5a24,color:#333 style B fill:#fff,stroke:#ff6b6b,color:#333 style C fill:#fff,stroke:#ee5a24,color:#333 style D fill:#fff,stroke:#ff6b6b,color:#333 style E fill:#ee5a2415,stroke:#27ae60,color:#27ae60
npx codeusse-connect"] -->|"opens reverse SSH tunnel"| B[sish Server] B -->|"allocates public port"| C[Mobile Device
Codeusse App] C -->|"SSH to tunneled port"| B B -->|"forwards to 127.0.0.1:22"| D[Local SSH Daemon
sshd] D -->|"validates SSH key"| E[Authenticated Session] style A fill:#fff,stroke:#ee5a24,color:#333 style B fill:#fff,stroke:#ff6b6b,color:#333 style C fill:#fff,stroke:#ee5a24,color:#333 style D fill:#fff,stroke:#ff6b6b,color:#333 style E fill:#ee5a2415,stroke:#27ae60,color:#27ae60
Even if someone discovers your tunnel address — even if they connect through ssh://connect.codeusse.com:40076 — they land on your local SSH server, which demands the same credentials as any SSH login to your machine. No valid key, no access. The tunnel itself grants nothing.
This is why the CLI banner says “Only pre-setup devices can connect.” The “pre-setup” is your local SSH configuration — keys you’ve already authorized, users you’ve already created. Codeusse Connect doesn’t introduce a new authentication surface. It inherits the one you already trust.
Additionally, sish’s authorized/ keys directory infrastructure is in place for future enforcement at the server layer, should that become desirable. For now, the design consciously pushes authentication to the edge — your machine — where it belongs.
Getting Started
If you want to try Codeusse Connect, make sure your local machine has an SSH server running (check with sudo systemctl status ssh on Linux or follow our macOS SSH setup guide). Then:
npx codeusse-connectThat’s it. The CLI connects to connect.codeusse.com:40074 by default, sets up the tunnel to port 22, and shows you a QR code. Scan it from the Codeusse app, and you’re in.
You can customize the connection if you’re running your own sish instance or forwarding a different port:
| Option | Environment Variable | Default |
|---|---|---|
--host <host> | CODEUSSE_HOST | connect.codeusse.com |
--port <port> | CODEUSSE_PORT | 40074 |
--local-port <port> | CODEUSSE_LOCAL_PORT | 22 |
--username <user> | CODEUSSE_USERNAME | codeusse |
Press Ctrl+C to close the tunnel when you’re done.
Under the Hood
The CLI is built in TypeScript and published as an npm package. The core tunnel logic uses the ssh2 library under the hood, requesting a forwardIn (the programmatic equivalent of ssh -R) to pipe bidirectional TCP streams between the remote channel and your local port. Configuration pulls from both CLI flags and environment variables. QR codes are rendered in the terminal via qrcode-terminal.
On the server side, sish runs in a single Docker container with host networking. The entire backend deployment — config, compose file, and key generation — fits in about 40 lines of code across three files. No databases, no web dashboards, no session state. Just SSH.