PocketWorkers is not trying to move every AI worker into a browser tab. The worker should stay where the real environment lives: on the user's computer or cloud box, close to files, terminals, credentials, and local tools.
That is why the first product boundary is gateway-first.
The web app is the control plane
The web app owns accounts, team membership, pairing tokens, and the list of registered gateways. A client signs in, opens a team, and chooses a gateway by name.
The user should not need to remember an IP address, port, tunnel token, or machine-specific endpoint.
AgentGateway is the runtime authority
AgentGateway signs in with account context before exposing anything. Once paired, it is responsible for the live worker state: what agent is available, what machine is reachable, and what actions can be forwarded safely.
For the MVP, the first worker target is Codex.
FRP makes the route explicit
FRP is the network spine. A separate FRPS server runs in the cloud, and the PocketWorkers FRP worker allocates public ports, stores leases in Supabase, and makes those details available only through authenticated APIs.
The result is a small, legible path:
- User signs in.
- Gateway signs in and registers.
- Backend allocates an FRP lease.
- Client selects the gateway.
- Client receives the authorized route.
The magic is not hiding the machine. The magic is making the machine selectable.