I put my AI agent on my Apple Watch, and it runs on my own computer

Last week I was across the room when my AI agent stopped and asked me a yes/no question. It needed permission to run a command. My laptop was 20 feet away.

That's when I decided the approval prompt belonged on my wrist.

Meet Flash for Apple Watch

Flash is the AI assistant I run locally. It's got chats, background agents called sparks, and team chats where those sparks talk to each other. Flash for Apple Watch puts all of it on your wrist.

It's open source: https://github.com/Natuworkguy/flash-watch

What it does

• Chats. Start a new one by speaking or with Scribble. Pick up any earlier one and read the whole conversation, with Flash's tool steps folded into a single line so it fits a tiny screen.
• Approvals. When Flash asks before doing something, Allow or Deny it from your wrist. If a turn's going the wrong way, stop it.
• Sparks. See what each background agent's doing and which ones need you. Approve what one's waiting on, run it now, pause it, or start a chat with it.
• Team chats. Read and write in your teams' chats. Reply to a message, react to it, and see every earlier version of a message a spark edited.
• Read aloud. Replies are read out in Flash's own voice when your computer's got one, or the watch's voice when it doesn't.
• A tap on the wrist when a reply finishes or a spark posts in the chat you've got open.

The part I care about most: privacy

The watch talks to Flash running on your own computer. There's no hosted backend and no account. Pairing uses an address plus a six-digit code that works once, for five minutes.

But wait, there's more: it works away from home

Wi-Fi only gets you so far. The moment you leave the house, a watch that can only see your home network is just a watch.

So there's a Reach from anywhere button, in the watch's Settings and under Watch in Flash. Tap it and:

• Your computer's tunnel turns on.
• The watch learns the tunnel's address on its own, so there's nothing to type.
• It keeps your Wi-Fi address too, and uses whichever one answers.
• When you get home, it goes back to the Wi-Fi address.

Tunnel addresses change, and that used to mean retyping them. Now the watch asks Flash for its current addresses every minute, so a new tunnel address just shows up. Your agent can ask for approval from a coffee shop, and you can answer from your wrist.

Your computer still has to be on and running Flash. The tunnel is a way to reach it, not a place your data moves to.

Setup takes about five minutes

You'll need Flash on your computer, plus a Mac with Xcode 16 or later to put the app on your watch. A free Apple ID works.

1. Add the Watch panel to Flash:

/extension install github@Natuworkguy/flash-watch

1. Let the watch reach Flash. Run flash --web --lan (or /web lan), or turn on the public link in Settings.
2. Put your team in watch/Local.xcconfig:

DEVELOPMENT_TEAM = ABCDE12345
FLASH_BUNDLE_ID = com.yourname.flash

1. With your watch on its charger and unlocked, run:

scripts/watch.sh install

1. Open Watch in Flash's sidebar, then type the address and code on your watch.
2. Away from home? Tap Reach from anywhere in the watch's Settings.

Why a watch?

Agents are getting more autonomous, and the human in the loop is now the bottleneck. A yes/no approval should take two seconds, not a walk back to your desk. The wrist is the one screen that's always with you.

Try it

Clone it, break it, and tell me what's missing. Issues and PRs are welcome.

https://github.com/Natuworkguy/flash-watch

What would you want to control from your wrist? Tell me in the comments.

Comments

[Auten]

Since tool steps fold into one line on the watch, what does an approval show before you tap Allow: the full command, or a short summary? On a 40 mm screen that summary is the whole decision.

To your question: from the Auten team (we build a tool that lets agents click and type on a real screen), the prompts I'd want on my wrist are the irreversible ones only, send, buy, delete, grant a permission, each showing the exact target ("Send to: Anna, 3 files"). Everything else can wait until I'm back at the desk.

[Nathan C.]

The question's first line is the headline, and the exact command or target shows under it in monospace, capped at 6 lines. Anything longer gets cut off, which is a real gap. A tap-to-expand view is next.
You're right about irreversible-only. Right now every approval reaches the wrist. Filtering to send, buy, delete, and permission grants, each with a fixed exact-target line like "Send to: Anna, 3 files", is the direction I want.

[Auten]

That 6-line cap is where I'd be careful: the risky part of a long command often sits at the end (a | sh, a --force, a second &&). A cheap guard: when the target is cut off, show "+N lines hidden" and keep Allow greyed out until the expand view has been opened.

How will you decide what counts as irreversible: a fixed list of tool names, or does Flash tag each action itself?

[Reid Marlow]

The physical decoupling is great for avoiding desk-tethering, but the immediate friction point with wrist prompts is alert fatigue. If an agent buzzes your watch for routine file reads or read-only queries, the muscle memory kicks in and you start tapping Allow without inspecting arguments. The interface becomes much more dependable when you tier permissions locally, letting safe inspection steps resolve silently and saving wrist taps for outbound network calls or state-mutating shell runs.