Part II

Using FrontierStack Mobile

The five tabs you live in day to day — your fleet, its services, a shell, the AI Administrator, and everything else under More.

Chapter 5

Using the App: Fleet, Services, Shell & AI

Once your phone is paired, the app is a full remote for the desktop. This chapter walks through the five tabs — what each shows and what it lets you do.

FrontierStack for iPhone and iPad is a full remote for the FrontierStack app on your Mac. Its main screen is a row of five tabs — Fleet, Services, Shell, AI and More. Each is a window onto something the Mac already does, sent to your phone over the secure, signed connection you set up when you paired. This chapter covers all five; Settings and the lock screen are in the next chapter, and pairing itself is in Pairing your device.

Two ideas run through every tab. First, the Mac is the brain: your phone shows and steers what the Mac sees and does, so when the Mac is offline the tabs go quiet. Second, what you are allowed to do depends on this device's permission level, which you set on the Mac — and the most powerful things (a raw shell, letting the AI make changes) need extra grants, described where they come up.

5.1Fleet — your servers and devices

The Fleet tab is home. At the top, Phone & Fleet keeps two independent facts apart: the route this phone is using to reach the Mac, and the Fleet site the Mac currently uses to scope monitoring and devices. Below it are two groups: your servers and your pinned devices.

The Servers section lists every pinned server — the local Mac is just the first row, so you drive it exactly like any other. Each row carries a status dot:

Dot	Meaning
Green	Up — reachable and healthy.
Amber triangle	Degraded — reachable but something needs attention.
Red	Down — the Mac can't reach it right now.
Hollow	Unknown — not yet probed.

Tap a server to open it. Its detail screen gives you the same host-level controls as the desktop:

Services — start, stop, restart or reload each detected service.
Reboot, Run Diagnostics (a plain-language "what's wrong right now") and View Logs.
Open Web UI in the built-in browser, and Open Shell (jumps to a shell bound to this server).
Remote Tools — ping, traceroute, listening ports, a web check and a log tail, run on the server itself.
Fleet Run — one operation across every server at once (see More, below).

Below the servers, your pinned devices appear in collapsible sections by kind — routers, switches, printers, NAS, smart-home and so on — each with an online/offline dot and a menu to open its web UI, check its status, or power-cycle it (where a plug or KVM is linked on the Mac).

screenshot to be added

Figure 5.1. The Fleet tab: a location banner, a Servers list with the Mac first and a status dot on each row, and collapsible device sections below.Capture: capture: Fleet tab connected, two or three servers each with a green/amber dot, one collapsible device group expanded

NoteFleet is a live mirror, not a cache. A red dot or an "offline" state means the phone (or the Mac) genuinely can't reach that host right now — check that the Mac is running and that you are on the same Wi-Fi, the same Tailnet, or that a Cloudflare tunnel is up.

5.2Services — live state, independent of the Mac's sidebar

Service state and controls live on the Operations tab, which shows what is actually running right now and lets you start, stop, restart and reload what your device is permitted to touch.

This app is independent of the Mac's sidebar. Whatever you have hidden from the sidebar on the desktop — to keep that window tidy — is still reachable here. The two interfaces are for different situations: at your desk you curate what you look at all day; on the road you want to reach whatever has broken. Nothing you do on the phone changes what the Mac shows, and nothing hidden on the Mac is withheld from the phone.

NoteEarlier versions let the phone edit the Mac's sidebar. That was removed: it made the phone's usefulness depend on a cosmetic desktop preference, which is exactly the wrong coupling when you are away from the Mac and something is down.

5.3Shell — a real command line

The Shell tab opens a command-line on the Mac or any linked server. Pick the target from the bar at the top — This Mac or any server — then type commands and read their output. Servers log in automatically using the key and credentials already stored on your Mac; a sudo command uses the server's saved sudo password. None of those credentials ever travel to your phone — the Mac runs the command and streams the output back.

Under More → Scripts you'll find your saved scripts and the built-in maintenance presets, synced from the Mac; tap one to run it and watch the output stream in.

Direct SSH — when the Mac is offline. The shell above is routed through the Mac. On a server's page you can also tap Enable direct SSH (while the Mac is online) to install this device's own SSH key on that server; after that, SSH (direct) opens a real terminal straight from the phone to the server — even when the Mac is offline or on another network — as long as you can reach the server's network (same Wi-Fi or over Tailscale). The phone's SSH key is generated on and never leaves the phone, and the Mac's own key and passwords are never copied to it. Revoking or unpairing the device removes its key from your servers.

SecurityThe shell is the most powerful thing the app can do, so it is gated tightly. This device must be at Full control with "Allow remote shell" switched on for it in the Mac's Paired Devices pane, the Mac must be unlocked, and every request is signed. Without that explicit grant the shell stays off — "Full control" alone is not enough.

NoteThe shell is line-oriented with a working directory that persists across commands (so cd sticks). It runs ordinary commands and scripts; full-screen terminal programs like top or vim aren't supported.

5.4AI — chat with the Administrator

The AI tab is a multi-turn conversation with the same AI Administrator that runs on your Mac. Ask about your servers, services or devices in plain language; as it works it shows the tools it runs and their results inline, so you can see how it reached an answer.

By default the assistant is read-only — it can look but not change. Switch on "Allow changes" (top-right) to let it act: restart a service, flush DNS, and so on. The conversation history — including any tool results, which can contain secrets — stays on the Mac; your phone only sees the rendered replies. Everything the AI does here still runs on the Mac and obeys the same guards as on the desktop; a chat from the phone can be turned off entirely per device with the Mac's Allow AI Administrator switch, and it always requires the app unlocked and this device signed. Conversations you have from the phone are saved into the Mac's AI Administrator history, so you can pick them back up there.

NoteIf a change is refused with “needs approval”. By default FrontierStack asks you to confirm each external change in the app on the Mac — which you obviously can't do while holding the phone. Approve this device once instead: on the Mac, Paired Devices ▸ your device ▸ “Allow AI changes without asking me here”. That waives only the confirmation prompt: the device still needs a permission level that allows tools, the Mac still has to be unlocked, Allow changes still has to be on for that conversation, and if you require a password for external changes that is still enforced.

A green shield to the left of each reply means the answer was protected: before anything left your Mac for the AI model, FrontierStack scrubbed secrets (keys, tokens, passwords) from the tool results — tap the shield to read what that means. You can select and copy both your questions and the replies (press and hold, or use the Copy action) to paste an answer elsewhere. And when you have a server selected, the assistant answers about that machine — the query still runs on your Mac, but "how long has it been up?" or "what's listening?" is scoped to the device you picked, not the Mac.

screenshot to be added

Figure 5.2. The AI tab mid-conversation: a question, the assistant's reply with a green protection shield beside it, and an inline "ran read_logs" tool line, with the Allow changes toggle in the top-right.Capture: capture: AI chat showing one exchange with the green shield, a visible tool action and the Allow changes toggle

5.5More — alerts, locations and the rest

The More tab gathers everything that doesn't need its own tab.

5.5.1Queue Operations

Queue Operations mirrors the Mac's read-only queue dashboard. Pull to refresh health for RabbitMQ, Kafka, NATS/JetStream, Redpanda, AWS SQS, Azure Service Bus, Google Pub/Sub, Celery, Redis Streams, Pulsar and RocketMQ. It shows backlog, consumers, lag and dead-letter totals without downloading message bodies. Configure credentials and thresholds on the Mac; the phone receives only the signed, sanitised health summary.

5.5.2Alerts

Alerts is the inbox of server alerts — a service down, a disk filling, a certificate expiring — raised by the Mac and its agents. Tap Enable push notifications so they reach you even when the app is closed. Push needs the Mac (or its relay) online to send.

SecurityYour phone never registers itself with the push server directly. When you enable notifications it hands its push token to the paired Mac over the signed connection; the Mac signs the registration with the key from its active licence and registers it for you. So revoking the phone on the Mac — or unpairing here — also stops its push notifications, even while the phone is offline.

5.5.3Checks — watchdogs and a maintenance pause

Checks is the manager for the Mac's Service Guardian: every service being guarded, whether each is healthy, and which have Keep Alive or Auto Recover switched on. It is the phone-side view of the pane described in Chapter 11 of the desktop manual.

Its useful trick is the pause. Before working on a machine, pause all checks — or just one service — for anything from 15 minutes to a day. While paused, the Mac stops health-checking and stops restarting that service, so your maintenance doesn't fight the watchdog or set off alerts.

Disk repair is protected automatically: while Disk Utility First Aid or a filesystem repair tool is running, automatic recovery pauses without changing its settings. Maintenance-timeout counters are cleared, and recovery waits 60 seconds after repair finishes before starting fresh. The Checks screen shows this safety hold.

TipPausing is deliberately not the same as switching a watchdog off. Nothing is disabled and no setting is lost: the check resumes by itself, exactly as configured, when the window ends. You can also resume early. That is the whole point — you cannot forget to turn protection back on.

5.5.4Phone connection & Fleet sites

Phone & Fleet Sites separates three things that the old “Location” label could make look like one: how this iPhone reaches the Mac, the site the Mac matches from its own network, and the Fleet site currently used to scope monitoring and devices. The phone's physical position and network do not select the Fleet site.

Choose Follow Mac's detected site to let the Fleet context follow the Mac. Pin another Fleet site when you deliberately want to view or operate that site's context. Pinning does not change the phone's route to the Mac and does not make a remote private network reachable; opening devices at that site still needs an existing route such as Tailscale or a VPN.

5.5.5Fleet Run, Shared & web UIs

Fleet Run runs one operation across every server at once — update packages, restart a service, check disk or uptime — and shows the per-host results. Shared lists the temporary Debug Shares the Mac has opened (a localhost dev site exposed via a tunnel), which you can open or stop; opening a new one needs Full control and "Allow changes" on the Mac. Web UIs & Bookmarks opens the admin pages of your routers, NAS and cameras in a built-in browser that trusts self-signed LAN certificates, plus any addresses you bookmark on the phone.

Note"Reachable" means your phone is on the device's network — true on the same Wi-Fi, and often true away from home over Tailscale (for example through a subnet router). If a device page won't load it is almost always a reachability problem, not the app: the browser already trusts the certificate.

Finally, More holds Settings and Help — covered next.

FrontierStack User Manual · Version 1.0.0 · Chapter 5