Helmline

Context: The Agent Keeps Working After the User Leaves the Desk

Self-hosted AI agents can read files, run tools, and continue long tasks on a Mac or VPS. Their usual interface, however, disappears when the user steps away. A smaller chat window does not solve the real mobile problem: understanding what is running, deciding when intervention is needed, and returning to the right context without moving the production runtime onto the phone.

Helmline became a native iPhone control surface for that gap. It brings together sessions, streamed execution, approvals, capture, automation control, and system-level status while the compute, files, models, credentials, and long-running work stay on infrastructure the user controls.

Product Decision: Bring Your Own Service

I chose a bring-your-own-service model instead of hosting user accounts, models, or agent data. A user connects Helmline to a compatible Hermes Gateway they operate on a Mac or VPS. The Gateway remains the source of truth, and the phone remains a client for input, inspection, and confirmation.

This boundary keeps ownership understandable. Helmline does not need an account, and the developer does not become the custodian of the user’s runtime. It also avoids creating a second execution authority on iPhone: if a stream is interrupted, the client reconnects and reconciles with Gateway state rather than inventing a local result.

System Architecture: Clear Responsibility at Every Layer

The iPhone connects over authenticated HTTPS, including private-network deployments such as Tailscale. Each Gateway profile keeps its endpoint, Keychain credential, sessions, drafts, and notification routing separate. Multiple Mac and VPS environments can therefore coexist without sharing operational context.

The host owns execution. Helmline presents the minimum information needed to follow and control it. Streamed events support immediate feedback, while durable Gateway state resolves interruptions and reconnects.

Core Workflow: Six Mobile Responsibilities

The product narrative follows the order in which mobile control becomes useful: find the right Session, follow Execution, resolve Approvals, Capture new input, switch between Multiple Gateways, and keep Native Status visible outside the app.

These are the same privacy-safe Focus assets prepared for the App Store. They use synthetic launch-planning content and contain no production Gateway address, key, account, device identifier, or private conversation.

Human Factors: Reduce the Cost of Checking In

The mobile experience is built around short, interruption-heavy moments. The goal is not to expose every runtime detail at once, but to preserve awareness, control, and a reliable path to deeper inspection.

Security and Privacy: Preserve User Control

Gateway credentials are stored in the iOS Keychain and scoped to explicit connection profiles. Helmline does not expose a production runtime publicly, and switching Gateways does not merge credentials or sessions. Sensitive approvals and protected control paths use a second confirmation through Face ID or the device passcode.

Helmline is free, has no Helmline account, contains no advertising, and has no in-app purchases. Its published App Privacy position is that the developer does not collect data. User content is sent only to the Gateway the user selects; the practices of that Gateway and its configured providers remain the user’s responsibility.

Native iOS Integration: Follow Work Beyond the Main Screen

Share Extension turns text, links, images, and audio into agent input. If immediate delivery is unavailable, the share outbox preserves the item for later routing. Voice capture supports short input and longer recordings, while background audio and transfer paths keep capture useful beyond a foreground-only demo.

Widget and Live Activity surfaces expose task state at the system level. Deep links return to the relevant app context, while native text selection keeps long agent output usable as working material instead of a sealed transcript.

Engineering Depth: Stateful Control Across Process Boundaries

The core engineering work sits in state coordination rather than isolated screens. SwiftUI views consume streamed execution, durable session state, local drafts, approval records, background events, and multiple connection identities. Reconnect behavior treats transient streams as feedback and the Gateway as the authority for final state.

Local persistence covers profile metadata, share outbox items, recordings, drafts, and activity state. Keychain storage remains separate from ordinary preferences. Multi-instance routing carries Gateway identity through sessions, notifications, deep links, widgets, and background delivery so one host cannot silently inherit another host’s context.

Productization: From Private Control Tool to Deliverable iOS Product

Productization meant more than stabilizing the main workflow. The project received an independent name and visual identity, English and Simplified Chinese localization, a complete six-screen storefront narrative, privacy policies, support and marketing metadata, content-rights attribution, age-rating and encryption decisions, and an isolated review path for Apple.

The delivery chain also included App Store bundle and extension configuration, privacy manifests, archive verification, signed distribution export, App Store Connect validation, and the Version 1.0 Build 5 submission. The release is configured for manual publication after approval.

Validation: Evidence Matched to the Claim

Validation was split by what each layer can honestly prove. Source and archive checks establish the product graph, versioning, privacy manifests, signing boundaries, extensions, localization, and release configuration. Storefront audits establish image dimensions and fixture safety. App Store status is kept separate from technical validation.

Current Status: App Review Pending

Helmline Version 1.0, Build 1.0.0 (5), has been submitted to Apple App Review and is currently waiting for review. It is not yet approved, publicly listed, or available for download. If Apple approves the submission, release remains a separate manual action.

The website will only change to an availability claim after the public App Store page or App Store Connect provides fresh evidence that the app has been approved and manually released.