The question
How can an AI assistant help craft a response without asking someone to surrender the privacy expectations they already have when using Messages? iMessage Locker treats that trust contract as the product requirement.
What I built
The native macOS workspace combines a conversation queue, the selected conversation, and response controls. It reads the local Messages database through user-granted, read-only access. Queue refreshes contain metadata rather than message text; selecting a conversation performs a fresh, bounded read.
The store holds messages for at most one open conversation and releases that collection when the user switches. Message-derived state lasts for the session rather than becoming a second resident archive of the user’s message history.
The trust contract is the feature
When the on-device Ollama runtime is selected, iML uses a local language model to craft the response. The selected message context, generation request, and draft never have to leave the computer. An explicitly configured self-hosted model remains a separate option with a visible provider boundary.
Reading, retaining, generating, and sending are separate responsibilities. Sensitive-content policy runs before a generation request exists. Production sending through Messages is unavailable, so the user remains responsible for reviewing the draft and deciding what happens next.
Display names are presentation, not identity. Typed conversation and message identifiers keep a renamed contact from becoming a different conversation. These choices preserve the behavior of Messages rather than quietly replacing it with a parallel messaging system.
Evidence and limits
The repository contains 41 tracked Swift test files. Its documentation describes coverage for identity, ordering, sensitive holds, access policy, and generation requests. Published test totals disagree between documents, so no passing-test total is claimed here.
The current reader does not decode every Messages content representation. Attachments, reactions, cloud generation, and production sending remain outside the implemented boundary.