Brainwrite Mobile app (iPhone)

The Brainwrite Mobile app is a companion for Brainwrite Desktop: on your iPhone it is a window onto the Brainwrite running on your Mac (its name on the home screen is Brainwrite). Your Mac remains the only machine that runs your bots and keeps their credentials, chats and computers.

The Brainwrite iPhone app is coming soon to the App Store.

What it can do

• Discover and pair on the same LAN, connect through Tailscale, or use an optional account-provisioned HTTPS address
• List bots and rooms, read paged transcripts, send messages, and interrupt work
• Answer approvals and questions, including narrow always-allow grants
• See the newest request waiting on you as a card at the top of the chat list, and answer it there; swipe the card up to put away every request open at that moment
• Follow a working bot in a Live Activity on the Lock Screen and in the Dynamic Island
• On a phone paired as the owner or an admin, manage saved logins (add, change, delete, and choose which bots may use each) and save a login from a sign-in card. A password or 2FA key is sent only over secure HTTPS or Tailscale, never over a plain local network. 1Password stays managed on your computer.
• Delete many threads at once
• Show a bot's cards as their text version, not as interactive cards
• Search, manage tasks, react, share, and navigate message versions
• Follow resumable live updates and optionally view a bot's managed Boat cloud computer. The loopback-only VPS SSH viewer currently opens in the desktop app.

Pairing

The desktop opens a two-minute pairing window with a high-entropy QR credential and a six-digit manual fallback. Redeeming either closes the window and returns a separate per-device token stored in iOS Keychain.

The computer stores only a digest of the device token. Revoking the phone from desktop Settings invalidates future requests.

Network options

• Same trusted Wi-Fi: Bonjour discovery and direct HTTP.
• Away from home: Tailscale on both devices with the computer's MagicDNS name.
• Hosted HTTPS: sign in by email on the desktop to provision a private Cloudflare Tunnel address; the phone still pairs to that specific computer.

For hosted HTTPS, Brainwrite's account service stores only which account and computer the address belongs to, never your chats; Cloudflare passes the phone's traffic through to your Mac. Bonjour does not cross Tailscale, so that direct remote option uses manual address entry.

Pairing over secure HTTPS

The secure HTTPS address is created when you pair, not before. After you choose Pair a device in Settings → Remote access, Brainwrite shows Creating secure remote access while it sets the address up, then shows the QR code once the address is ready. On a computer that already has its address, the QR code appears at once.

If no address is free, Brainwrite says: Secure HTTPS links are temporarily full. Try again in 10 minutes, or pair on this Wi-Fi or with Tailscale. The wait it names can differ. Choose Try secure access again later, or Pair on this Wi-Fi instead to pair now over your local network. You can also pair with Tailscale.

Your computer must remain on, awake, and running Brainwrite. In Settings → Remote access, Keep this computer awake can prevent sleep while Remote access is on; it is off by default, allows the screen to turn off, and may use more battery. A sleeping or powered-off computer cannot be reached even through hosted HTTPS.

Security boundary

The companion sidecar uses a default-deny route allowlist. Provider keys, pairing administration, Local VM lifecycle, webhook secrets, team import/export, and internal peer-agent routes remain unreachable from the phone.