Reconnecting...
CTM v?
↑ Update available
⚠ Default AI provider unreachable — using a fallback.
⚠ The phone URL changed — paired phones need a one-time re-pair.
Update installed. Reload this page to use the latest CTM / Wall-E UI.
↑

### Upgrade CTM / Wall-E?

A newer create-walle release is available.

Installed v?
Available v?

The updater will run in the background and CTM will restart when the upgrade is ready.

+
Idle 0/0

# Session Overview

Loading sessions...
No active sessions.

### Session Insights

Internal

Analyze your Claude Code sessions to discover patterns, groups, and suggested skills.

Click Analyze Sessions to start. Only new or modified sessions will be processed (incremental).

Session Review
Hide tool calls
Select a user message to truncate after.
Select a session and click "Review Changes" to start a code review.
WALL-E

## Git Worktrees

Isolated working copies for parallel development. Status updates every 30s.

## Wall-E Setup

Version loading...

Configure AI, integrations, and advanced settings.

## AI Configuration

Configure CTM and Wall-E model defaults, coding-agent routes, gateways, provider access, testing, scorecards, and tier assignments from the AI Providers page.

## Provider Health

●●● 30s
Loading provider health…
▸

## Anthropic

Claude models DEFAULT
API Key sk-ant-… Claude Code CLI subscription OAuth Proxy localhost:3458 Devbox Gateway corporate VPN
API Key
Get a key at console.anthropic.com
Checking Claude Code CLI…
Checking OAuth proxy…
Forwards via your Claude Code OAuth (keychain). No API key needed; bills against your Claude.ai subscription. First request prompts the macOS keychain — click Always Allow.
Detected via locally configured Claude auth headers.
Model
▸

## OpenAI

GPT models DEFAULT
API Key sk-… Codex CLI subscription · ~7s/call
API Key
Get a key at platform.openai.com
Checking codex CLI…
Model
▸

## Google

Gemini models DEFAULT
API Key AIza… Gemini CLI auto-detected key
API Key
Get a free key at aistudio.google.com
Checking gemini CLI…
Model
▸

## Ollama

Free · local DEFAULT
Model
Checking Ollama status...
▸

## DeepSeek

V4 · 1M ctx DEFAULT
API Key
Get a key at platform.deepseek.com · prepaid only — top up first at top_up
Model
▸

## Moonshot / Kimi

K2.6 · 256K ctx DEFAULT
API Key
Get a key at platform.kimi.ai. Wall-E uses the official OpenAI-compatible endpoint.
Model

## Connected Services

Accounts and integrations that feed Wall-E's memory.

Loading...
Active Services

## AI Tool Integrations

Wall-E registers as an MCP server so your AI coding tools can access memories and knowledge.

Loading…
Manual setup instructions
Add this to JSON-based MCP configs:

    {
      "mcpServers": {
        "wall-e": {
          "type": "http",
          "url": "http://localhost:3457/mcp"
        }
      }
    }

For Codex, add this to `~/.codex/config.toml`:

    [mcp_servers."wall-e"]
    url = "http://localhost:3457/mcp"

Config file locations:
Claude Code project: `~/.claude/mcp.json`
Claude Code global: `~/.claude.json`
Codex: `~/.codex/config.toml`
Cursor: `~/.cursor/mcp.json`
Windsurf: `~/.codeium/windsurf/mcp_config.json`
Claude Desktop: `~/Library/Application Support/Claude/claude_desktop_config.json`
To undo: remove the `"wall-e"` entry from the config files above.

## Phone Access

Pick how your phone reaches this CTM — the wizard will handle the rest.

Step 1 — Choose a connection method
Other ways to connect
Step 2 — Complete setup for the selected method
Microsoft tunnel phone access Checking Microsoft Dev Tunnels...
Default browser URL
Checking Microsoft tunnel...

1. 1 Install
2. 2 Sign in
3. 3 Start

Phone URL``
Traffic inspect URL``
!
Anonymous tunnel access is still enabled Older CTM setup left anonymous Dev Tunnel connect access on this port. Reset to private so remote browsers must pass Microsoft/GitHub tunnel auth before CTM loads.
Phone availability Start the tunnel before phone access can stay available.
Keep Mac awake for phone access Prevents idle system sleep while the Microsoft tunnel is running. Display sleep is not forced on; battery use may increase.
Default mode recovers after wake, but it cannot serve the phone while the Mac is asleep.
Phone URL check Check whether the tunnel URL reaches CTM or is blocked before CTM.
No check has run yet.
Setup progress Waiting...
Open sign-in page Code: ``

Tunnel connect is open only far enough to reach CTM. CTM still requires the pairing QR, device token, route permissions, and passkey step-up.
Advanced details
Commands CTM may run

Traffic inspection
Recent requests that reached CTM through a devtunnels.ms host.
Walle Remote phone access Checking Walle Remote...
No domain, no VPN, no public port
Checking Walle Remote...
Walle mobile: ``
Walle Remote uses a typed control protocol, not a generic localhost tunnel. Session replies and approval responses are audited typed actions; restarts and network changes stay blocked until separate admin hardening is complete.
Tailscale private URL Checking Tailscale...
Recommended Tailscale setup
Checking Tailscale...
Phone setup: Install the Tailscale app on your phone, sign in to the same tailnet as this Mac, and keep the VPN connected before opening the URL.
Some managed tailnets only allow approved devices. If your phone cannot join the tailnet or resolve this URL, use Microsoft tunnel.
Phone URL: ``
Generate or renew HTTPS certificate automatically
Command CTM will run

Tailscale certificates use public Certificate Transparency logs. Use a non-sensitive machine name before running `tailscale cert`.
Cloudflare Access browser URL Checking Cloudflare automation...
Use this if you own a domain you can use with Cloudflare. Most users should use Tailscale; Cloudflare is for users who own a domain or already manage DNS there.
Why not one shared Walle URL? A single hostname such as `ctm.walle.sh` can route to only one CTM tunnel at a time. A Walle-managed URL would need a hosted Walle service that owns the domain in Cloudflare and assigns a unique subdomain to each install.
1
Install
2
API token
3
Configure
Checking Cloudflare setup...
1
Install cloudflared
A free tool from Cloudflare that creates an encrypted tunnel from your Mac to the internet — no open ports or router changes needed.
Run in Terminal
`brew install cloudflare/cloudflare/cloudflared`
No Homebrew? Install Homebrew first · or download cloudflared manually
2
Authorize with Cloudflare
Link cloudflared to your Cloudflare account. Run this command once — it opens a browser window to sign in.
Run in Terminal
`cloudflared tunnel login`
Usually only these three fields are needed. CTM discovers the Cloudflare Account ID and Zero Trust team domain, and can add the parent domain if Cloudflare does not have it yet.
Phone hostname
Choose a unique hostname under a domain you own. Example: if you own yourdomain.com, use ctm.yourdomain.com.
What this is used for: this becomes the browser URL for your phone. CTM creates the DNS record for this subdomain in your Cloudflare zone.
If the domain is not in Cloudflare yet: CTM can add the parent domain for you and show the Cloudflare nameservers. You still update those nameservers at the place where the domain was bought.
Add the parent domain to Cloudflare automatically if it is missing
No domain? Use Tailscale. A Walle-managed URL can remove this field later, but it must assign each Mac its own hostname under a Walle-controlled Cloudflare zone.
Phone URL: enter a hostname above
iPhone sign-in email
Use this exact email on your iPhone. CTM does not create a new account; Cloudflare Access allows this email and sends a one-time PIN or uses your configured identity provider.
API token one-time, never saved
A temporary Cloudflare key. CTM uses it once to create the Access app, tunnel, and DNS record, then clears this field.
Fast path: open CTM's prefilled Cloudflare token page, click `Continue to summary`, click `Create Token`, copy the generated token once, then paste it here.
Open prefilled token page Token guide
What CTM prefills: token name `CTM phone access`, Access, Tunnel, DNS, and Zone permissions, account scope `All accounts`, and zone scope `All zones` so CTM can find or add the parent domain.
Optional review: if the parent domain already exists in Cloudflare, you can restrict Zone Resources to that domain. Leave Client IP Address Filtering blank. TTL is optional. Revoke the token after CTM shows Ready.
Manual permission rows

1. `Account` / `Access: Apps and Policies` / `Edit`
2. `Account` / `Access: Organizations, Identity Providers, and Groups` / `Read`
3. `Account` / `Cloudflare Tunnel` / `Edit`
4. `Zone` / `DNS` / `Edit`
5. `Zone` / `Zone` / `Read`

Advanced Cloudflare IDs (optional)
Leave these blank unless auto-discovery fails or your token is intentionally restricted.
Team domain override
Only needed if CTM cannot read your Zero Trust organization auth domain.
Account ID override
Only needed if CTM cannot infer which Cloudflare account should own the domain.
CTM will automatically:
✓ Create a Cloudflare Access app locked to the iPhone sign-in email
✓ Add the parent domain to Cloudflare if it is missing
✓ Create an encrypted tunnel — no open ports needed
✓ Route your hostname through Cloudflare DNS
✓ Start the tunnel and keep it running (survives reboots)
✓ Generate a phone pairing QR code
✓
Cloudflare tunnel is running
``
Loading network settings...
Advanced network settings

These fields are managed automatically when you use the wizard above. Only edit if you need a custom bind address or your own TLS certificates.

Bind Address
HTTPS Certificate
HTTPS Private Key
Allowed Origins

## Pair Phone

Pair this phone once. Face ID binds the first pairing to this browser; normal phone access and CTM restart do not ask again unless you add a passkey for a new stable URL.

Phone setup
Choose an access method above to see the phone steps.
Recommended phone URL: `Resolving…`
New Phone Label
Pairing Origin
Read Respond Create Admin

## Appearance

Choose the CTM, Wall-E, and terminal theme. Provider ANSI colors are preserved inside the selected palette.

Theme
Dark stays the default. Light mode updates app chrome, panels, cards, menus, Wall-E surfaces, and terminal base colors.

## Memory Search

Vector embeddings enable semantic search — find memories by meaning, not just keywords.

Loading…
💡 Google Gemini embeddings are completely free — get an API key, then add `GOOGLE_API_KEY=...` to your `.env` file and restart.

## Data Storage

Live database folders and backup folders are now managed together from Storage & Backups. That screen previews the maintenance window, moves backup snapshots online, and supervises CTM/Wall-E restarts for live database moves.

## Status-Change Hooks

Run a shell command when a session transitions between states. Env vars: `CTM_OLD_STATE`, `CTM_NEW_STATE`, `CTM_SESSION_ID`, `CTM_PROVIDER`, `CTM_WORKTREE_PATH`, `CTM_WORKTREE_BRANCH`, `CTM_TAB_TITLE` (plus `CCMANAGER_*` aliases for migration).

Enabled globally
On Idle
On Busy
On Waiting Input
Timeout (ms)
Per-project overrides: drop a `.ctm-hooks.json` in any repo root with the same schema — project values win over these globals.
Hooks run with 10s default timeout and cannot block CTM. `sh -c` is used to interpret the command string.

## Storage & Backups

Live SQLite databases should stay on local disk. Backup folders can be changed online; live data folders use a supervised maintenance window with rollback.

### CTM Database

Task manager sessions, queues, prompts, and UI state.

Loading
Live Data Folder
Backup Folder

### Wall-E Brain

Private memory, knowledge graph, and Wall-E transcripts.

Loading
Live Data Folder
Backup Folder
Move existing backup files
Unsaved
Select a CLAUDE.md file from the sidebar to view or edit.
Files marked create don't exist yet — selecting them will create a new file.

### Permission Manager

Permissions control what Claude Code can do automatically. Rules you approve here apply across all sessions.

Manage which tools Claude Code can auto-approve.

Click Scan Sessions to discover tools used in your recent sessions, then toggle auto-approve for each.

SA
Shadow Approver
0
SA

### Shadow Approver

Shadows your approvals, learns patterns, auto-approves safe ops.

Pending 0
Learned Rules
Decisions
History Scan
🛡 Blocklist ON
Loading...
🚀 Send to New Session
Active Sessions
🔌 No active sessions
📜 Add to Queue
📋 Copy as Text
📝 Copy as Markdown
⌨ Copy Selection for CLI with image paths
Copilot Suggestion

### Prompt Editor

Create, edit, and manage your prompts with rich text formatting, image annotations, versioning, and prompt chains.

Quick start: Click + New Prompt or select an existing prompt from the sidebar.

Paste images Ctrl+V in editor Add tags Type + Enter in tag field Version history History button Send to session Send button

### Session Conversations

### Backup Manager

Daily auto-backups are created automatically. Backups older than 30 days are cleaned up (minimum 5 kept).
Version History
Prompt Sidekick
Context
Open a prompt to see detected context
Similar Prompts ▼
Open a prompt to see history
Copilot Chat ▼
Ask about your prompt history, patterns, or how to improve your prompts.
No prompt selected Prompts: -- Patterns: -- Last harvest: --
Skills

### Session Harvester

Loading preview...
Queue Builder
Session:
Mode:
Idle: s
Add saved prompts:
0 items
Add prompts or type inline items below.

### New Folder

Name Color

### New Worktree

Git worktree creates an isolated working copy on a new branch — safe to experiment without touching your current checkout.

Branch Name
Base Branch (optional)
Path: `.claude/worktrees/<name>`
Open a session in the new worktree after create
Running

### Creating worktree

Git is still checking out files. You can wait or stop the checkout safely.
Branch
-
Elapsed
0s
Quiet
0s
Starting git worktree checkout...

    Waiting for git output...

Long checkouts can happen with large repos, Git LFS, filters, or cloud-synced files. Killing stops git and CTM cleans up the partial worktree.

### Merge Worktree

Strategy
If the worktree has uncommitted changes, commit or stash them in a terminal first — merge operates on commits, not your working tree.

### Sync from main

Strategy
Pulls main's commits into this worktree's branch. If conflicts are detected, you'll get a clear message — resolve them in a terminal.

### Push & Create Pull Request

Title Description
Will run `git push -u origin <branch>` then `gh pr create`. Both run inside the worktree on your explicit click.

### Finish Worktree

### Delete Worktree

This removes the worktree files permanently. Any uncommitted changes in the worktree will be lost.
⚠ This branch has unmerged commits
Type the branch name to confirm:
Also delete the branch

### New Session

Choose Agent
Project Folder
Search paths
Session Title (optional)
Shown on the tab and sidebar. Rename later by double-clicking the session tab title.
Use Worktree Isolated branch & files for parallel work
Branch Name
Leave blank to generate a branch-safe name from the session title.

### Worktree Removed

The provider transcript is still available. Choose where CTM should restart the CLI process.