Pre-release v0.1 candidate for macOS

Know when your agent needs you.

Helioterm puts the terminal and AI-agent sessions on your machine in a browser tab, and flags the agent waiting for your answer. Close the browser whenever. tmux keeps everything running.

Release status See how it works
helioterm demo workspace
Helioterm dashboard in a browser: workspace tabs, terminal sidebar, file and git views in the rail, and the app's own MOCK badge showing demo mode
The dashboard in explicit demo mode, wearing its own MOCK badge. No daemon attached, no real sessions shown.

Agents in tabs

The stuck agent lights up.

Helioterm detects claude, codex, opencode, and openclaw sessions and watches their state. When an agent stops to ask permission or wait for input, its tab is flagged as needing attention. You answer when asked instead of babysitting terminals.

One glance instead of eight tab switches.

Start an agent at your desk. Later, in line at the store, open Helioterm on your phone: codex is still working, claude wants a yes before it goes on. You answer and put the phone away.

Detection lives in the protocol. Sessions are typed as claude, codex, opencode, openclaw, shell, or unknown, with waiting-for-input and needs-approval states.

An illustration of the states Helioterm reports, not a screenshot.

Close the browser. Keep the session.

Sessions do not live in your browser tab. They live in tmux on your machine, and the daemon serves the whole workspace from one local port. The browser is a window onto work that keeps going without it.

  1. Start the daemon

    One command serves the dashboard and API on your machine only. First run sets up a local login secret.

    pnpm helioterm serve

  2. Open the workspace

    Log in once in any browser. Tabs, a command palette, and quick keys sit on top of real tmux sessions.

    open http://127.0.0.1:4020

  3. Leave, then come back

    Close the tab and switch to another device while the host stays running. Reattach by opening the page again.

    tmux ls

Several devices can watch one terminal: one controller plus up to seven read-only observers, enforced server-side, with takeover as an audited action. Handing control between devices never restarts the process underneath.

More than a terminal window.

The workspace around your sessions covers the basics of checking on work from anywhere: look at files, read output, answer the agent, move on.

See your files without opening a shell.

A WinSCP-style explorer lives next to your terminals. Browse the workspace, create folders, rename things, delete what you own. Viewers for code, markdown, and git history open files up to 512 KiB.

The built-in viewers are read-only. If you configure a separately installed Druk editor, you can open workspace files in its own terminal tab.

An illustration of the explorer layout, not a screenshot.

Your phone is a real client.

Helioterm is a PWA built and tested for mobile browsers, with automated checks emulating Pixel 7, iPhone 13, and iPad Mini. Install it from the browser and you get the full workspace plus touch quick keys for Ctrl, Esc, Tab, and arrows.

Quick keys appear on touch screens and stay out of the way on desktop unless you turn them on.

Helioterm on a phone: terminal output with a quick-key row for Ctrl, Esc, Tab, and arrow keys, shown in demo mode
Mobile terminal in demo mode, quick keys on.

A browser can reach your shell. The defaults act like it.

Helioterm assumes that is dangerous and fails closed. These are shipped behaviors with tests behind them, not roadmap promises.

Loopback only

The daemon accepts literal 127.0.0.1 and nothing else. No LAN, wildcard, or public bind flag exists, and wrong values fail before startup.

Opaque browser sessions

Login sets an opaque, HttpOnly, SameSite=Strict cookie. The browser never holds a JWT, and tokens never appear in URLs or web storage.

One-time attach tickets

Every terminal WebSocket starts with a short-lived, single-use ticket. Revoking a device invalidates its tickets and closes its live sockets.

Your tmux is yours

App-created sessions carry an @helioterm_managed marker. Kill and rename refuse any session without it, so hand-made sessions stay untouched.

Secrets stay out of children

Processes launched in your workspaces get a minimal environment. The daemon's automation token and auth secrets are not inherited by child processes.

Evidence, not vibes

A 38-file security test suite, pinned OSV-Scanner and gitleaks, and a CycloneDX SBOM plus provenance statement with every release build.

Remote access is your tailnet's job.

Helioterm never opens a port to the internet. The daemon stays on localhost, and Tailscale Serve proxies it privately to your own devices, encrypted in transit over your tailnet. App login still applies on top: being on the tailnet never equals being signed in.

More than one computer? Run a daemon on each machine and reach every one at its own tailnet name. Helioterm does not merge machines into one pane, and this page will not pretend it does.

Tailscale Funnel is public internet exposure, so the setup command refuses it unless you pass an explicitly dangerous flag.

private remote access 
$ helioterm tailscale setup
# prints the command to run:
$ tailscale serve --bg http://127.0.0.1:4020
# daemon stays on loopback; only your tailnet can reach it

Compare

Where Helioterm fits, honestly.

Every tool here is good at what it is for, and all of them ship today while Helioterm is pre-release. Facts come from each project's own site, checked on August 6, 2026. A blank cell means the site does not describe it, not that the product lacks it.

Tool What it is Agent awareness Session durability How you reach it Ships today
Helioterm Browser PWA plus a daemon on your machine; no app install Detects claude, codex, opencode, openclaw; flags sessions waiting for input or approval Sessions are tmux; they survive closing the browser while the host stays running localhost, or privately over your tailnet with Tailscale Serve No. Pre-release
Moshi Native iOS and Android terminal for AI coding agents Agents feed for Claude Code, Codex, OpenCode and more; Apple Watch approvals; voice input Mosh and ET connections persist across network switches and app interruptions Direct SSH, Mosh, or ET to your machine Yes. Free to start
Herdr Terminal-native runtime for coding agents, Apache-2.0 Reads every pane and marks each agent working, blocked, or idle; 19 agent kinds Holds real terminals open; work survives the lid closing Your existing terminal and SSH; Moshi integrates it Yes. macOS, Linux, Windows beta
VibeTunnel Browser terminal; Mac app plus an npm package for Linux Remote access with Tailscale or ngrok Yes. MIT licensed
Mosh + tmux over SSH The DIY classic: two battle-tested free tools tmux keeps sessions; mosh roams networks and survives sleep An SSH-reachable machine: open port or VPN Yes. Free
Termius / Blink Shell Polished mobile SSH clients; Blink is iOS and iPadOS, Termius is cross-platform Blink keeps Mosh connections through sleep; Termius restores workspaces SSH to your machine; Mosh in Blink Yes. Blink is $19.99/yr after trial

Sources and dates for every row live in the claims ledger. Helioterm speaks the VibeTunnel-compatible WS v3 protocol; it is not built on VibeTunnel.

What the others do better.

  • Moshi is a real native app. Smoother phone keyboards, voice input, and approvals from an Apple Watch. A PWA does not match that polish.
  • Herdr is lighter if you live in the terminal. No browser involved, and it detects more agent kinds today.
  • VibeTunnel shipped first and keeps it simple. Helioterm speaks its WS v3 protocol rather than competing on maturity.
  • Mosh + tmux costs nothing and carries decades of trust. There is no new tool to audit.
  • Termius and Blink have years of mobile SSH polish, plus file transfer that goes both ways.
  • All of them ship today. Helioterm is still behind its release checklist.

Install

The real commands, ahead of the release.

These install paths are for readers who already have repository access. Publication remains gated on the release checklist. The guide explains the required local setup.

Pre-release. No public artifact exists today, and the project itself says it is not release-ready. The commands below document what early access looks like.
  • node 22.12+ in the 22.x line, or 24.x
  • pnpm 10.15+ through Corepack
  • tmux 3.x for durable workspaces
  • macos the v0.1 candidate target
  • tailscale optional, for private remote access
from source 
$ corepack enable
$ pnpm install
$ pnpm build
$ CMUXD_REMOTE_PATH=/path/to/verified/cmuxd-remote \
  CMUX_WEB_AUTH_TOKEN="$(openssl rand -hex 24)" \
  pnpm helioterm serve
# open http://127.0.0.1:4020
tarball-style CLI install 
$ pnpm --filter helioterm build
$ npm pack ./packages/cli
$ npm install -g ./helioterm-0.1.0.tgz
$ helioterm doctor
$ CMUXD_REMOTE_PATH=/path/to/verified/cmuxd-remote helioterm serve
what ships in a release 
allowlisted npm tarball  inspected file by file before publish
SBOM + provenance       CycloneDX and in-toto statements per build
pinned scanners         OSV-Scanner and gitleaks, exact versions

Reasonable questions.

What is Helioterm?

A dashboard in your browser for the terminal windows and AI coding agents running on your own computer. It runs on your machine, not in a cloud. Sessions live in tmux, a standard tool that keeps terminal programs alive in the background, so closing the browser never stops your work.

I don't really use tmux. Does that matter?

No. Helioterm creates and manages its own tmux sessions; you never have to type a tmux command. tmux is just the engine that keeps sessions running after you close the page.

Which AI agents does it recognize?

The protocol types sessions as claude, codex, opencode, openclaw, shell, or unknown, and watches for waiting-for-input and needs-approval states. When an agent stops to ask you something, its tab is flagged as needing attention.

Can I edit files with it?

The built-in code, markdown, and git viewers are read-only with a 512 KiB cap. You can optionally open a file in a separately installed Druk terminal editor. The explorer can also create folders, rename, and delete inside the workspace.

Can I install it today?

Not yet. Helioterm is a private pre-release, and publication is gated on the release checklist plus owner approval, including real-device and external security review evidence. The setup guide is available to readers who already have source access.

What does it cost?

The code is MIT licensed, and the product has no account system or hosted tier. There is no public release artifact yet, so there is nothing to buy and nothing to subscribe to.

Where does my terminal data live?

On your machine. Sessions are tmux sessions owned by a daemon that binds 127.0.0.1. In v0.1 the renderer keeps scrollback in memory only, there is no transcript store, and the app registers no service worker, so the browser app does not persist or cache terminal output.

How does remote access work?

The daemon stays on localhost and Tailscale Serve proxies the port privately to your tailnet, encrypted in transit over your tailnet. Helioterm login still applies on top: tailnet membership and Tailscale identity headers never create a session. Funnel, which is public exposure, is warning-gated rather than enabled for you.

Can I see all my computers in one place?

Not in one pane. Run a daemon on each machine and reach each one at its own tailnet name. Sessions reattach from any device; layout preferences stay per-device.

What is cmuxd-remote, and do I need it?

The live terminal data plane runs through an external cmuxd-remote sidecar that you install separately and pin by path. Helioterm does not bundle or download it, and it remains under CMUX's own license terms. Without the sidecar the daemon still serves the control plane and UI; terminal attach returns 503.

Will it touch the tmux sessions I already have?

No. App-created sessions are stamped @helioterm_managed, and kill or rename refuse any session without that marker. For adopting older sessions there is helioterm tmux migrate-legacy --dry-run.

How do I report a security issue?

Follow the private reporting instructions in the repository's SECURITY.md. Do not post a working exploit publicly. Include the affected version, your bind and auth configuration, and reproduction steps. The support guide describes the current access boundary.

A light stays on your sessions.

The release status lists what is built and what still needs verification. If you already have source access, the guide covers setup and local checks.

Release status Read the guide