WristCode

An Apple Watch client for T3 Code. Browse threads across every T3 Code environment you run, reply by dictation, start new threads, and get a notification when an agent finishes. It works over the watch's own cellular connection, with no phone nearby.

Early work in progress.

How it fits together

watchOS only allows WebSockets for audio streaming apps, and T3 Code clients talk to their server over a WebSocket. So the watch talks HTTPS to a small gateway, and the gateway talks to each T3 Code server.

Apple Watch  --HTTPS-->  gateway  --WebSocket-->  T3 Code server (one per environment)
                            |
                            +--APNs-->  notifications on the watch

• gateway/ is the gateway: Bun and TypeScript, shipped as a container image.
• watch/ is the watchOS app: SwiftUI, watch only, no iPhone companion.
• docs/ holds the design notes and the T3 Code protocol reference.
• mocks/ holds static UI mocks of the watch screens.

Running the gateway

The gateway is one container with one SQLite file in /data. deploy/compose.yml is the stack on server-gib, and gateway/Containerfile builds the image. CI builds and deploys every push to main that touches gateway/.

Operators use the wristcode CLI inside the container:

# Connect a T3 Code server. Make the one-time credential on that server first:
t3 auth pairing create --scope orchestration:read --scope orchestration:operate --label "WristCode gateway"
docker exec -it wristcode-gateway wristcode host add https://t3mac.gbrown.org <credential> --label "Mac mini"

# Pair a watch: enter the printed code on the watch within 5 minutes.
docker exec -it wristcode-gateway wristcode pair

docker exec -it wristcode-gateway wristcode host list
docker exec -it wristcode-gateway wristcode device list
docker exec -it wristcode-gateway wristcode device revoke <id or name>

The gateway exchanges the credential for a 30 day T3 session limited to reading and driving threads, so the long-lived token never leaves the gateway. T3 sessions cannot be refreshed. A week before one expires, the watch gets a notification. scripts/renew-hosts.sh renews every host in one go over SSH, passing each one-time credential straight to the gateway without printing it. Edit its host list to match your machines.

For local development, run bun --watch src/main.ts in gateway/ with WRISTCODE_DB pointing at a scratch file. Without APNs settings, pushes are logged instead of sent.

License

MIT