Bodega Remote

You message a bot you made yourself, in a chat app you already use. Bodega on your computer receives the message, runs it exactly as if you had typed it at the desk (same agent, same models, same approvals), and sends the answer back. Nothing runs in the chat app and Bodega does not run a server of its own in the path.

This build contains the core and the Telegram, Discord and Slack connectors: pairing, the sender check, approval cards, the commands, the privacy and air-gap protections, and the Settings → Connections → Bodega Remote page. Everything is off until you turn it on.

If you do not want a third party in the middle, use the Bodega app for iPhone and iPad instead. It talks only to your computer, on your own network. A chat channel is the opposite on exactly that point.

With a chat channel on, your messages, Bodega's replies, tool descriptions and approval requests pass through Discord's, Telegram's or Slack's servers, under their terms. Bodega removes anything that looks like a credential before sending, turns off link previews, and never sends file contents or screenshots unless you ask for them. Bodega does not run a server of its own in the path. Nothing is sent while Air-gap is on.

Honest limit: the credential check is pattern-based. A secret with no recognisable shape (a plain password) is not caught, the same limit the shell tool has. Turn on two-factor sign-in for the chat account itself: a chat channel is only as safe as that account.

1. Open Settings → Connections → Bodega Remote. Press the switch; read the disclosure and confirm it. This is stored.
2. Make a bot in the chat app (for Telegram, the BotFather chat; steps below) and paste its token into the platform's row. The token is sent once, stored encrypted, and never shown again, not here and not in Settings export.
3. Pair your phone. Telegram: once Telegram shows Connected, press Get pairing link, then open it on your phone, or scan the QR with your phone's camera app (the scanner inside Telegram itself only reads login codes, so it does nothing here), and tap Start in the chat. To pair again (a new account, or after you unpaired): Revoke the old account under Who can use it, then make a new link; logging out of Telegram does not unpair you. If the chat says the link was used or has expired, make a new one. Discord: press Get install link, add the bot to a private server that only you are in, then send the bot the pairing code shown. Slack: save both tokens (steps below), then message the app from its Messages tab; it replies with a pairing code. Or just message the bot from your own account: it replies with a pairing code. A link or code works once and expires in 10 minutes. Saving a token turns that chat app on; Bodega Remote starts every chat app that has a token unless you switched it off with its own switch.
4. Back in Settings → Connections → Bodega Remote → Who can use it, check the sender (a request from a link says so; otherwise check the code matches what the chat shows) and press Allow. A link only asks to pair; it never pairs anyone by itself. A pairing can only be confirmed on the computer (here, or with the bodega remote pair command). Typing the code in the chat does nothing.

One person, one account per chat app. You can pair your Telegram account and your Discord account: message the bot on the second app, then confirm that code on the computer too. Every account is confirmed here, never in the chat, and each appears under Who can use it with its own Revoke. On a chat app where you are already paired, the bot ignores everyone else: a stranger who messages it gets no reply and no code. Revoking one account leaves your others paired.

Pairing is checked against your user id, never the chat. Because of that, adding the bot to a group does not let the group's members in. A sender not seen for 90 days is suspended until you confirm again. Revoke stops them at once, including a run that is mid-reply.

1. In Telegram, open a chat with @BotFather (the official account, with the blue check).
2. Send /newbot. Choose a display name, then a username that ends in bot.
3. BotFather sends a token that looks like 123456789:AA.... Paste it into the Telegram row in Settings → Connections → Bodega Remote and press Save.
4. Turn Bodega Remote on, open your new bot in Telegram and send it any message. Confirm the pairing code on the computer.

Bodega asks Telegram for new messages (long polling); it opens no port and needs no public address. Replies use Telegram's own formatting (bold, italic, code and code blocks, lists, headings as bold lines); a link is shown as its text followed by the address, and link previews are always switched off. If Telegram refuses a formatted message, Bodega sends it again as plain text. In a private chat only you can use the bot. In a group the bot answers only you, only when you @mention it, only if you set Groups and servers to read-only, and it cannot run tools that change anything there. Edited messages are ignored, and messages sent while Bodega was off are not run when it starts. A photo can be sent to the bot (up to your inbound size limit, never above Telegram's 20 MB download cap). If the token leaks, send /revoke to BotFather and paste the new token. Telegram can see everything sent through its bot, as described above.

Steps as the Discord Developer Portal reads in October 2026; Discord moves things, so go by the names.

1. Open discord.com/developers/applications, choose New Application and name it.
2. Bot tab → Reset Token → copy it into Settings → Connections → Bodega Remote → Discord. Discord shows it once.
3. Leave the three Privileged Gateway Intents off. Bodega asks for none: direct messages and @mentions reach a bot without the Message Content intent.
4. Installation (or OAuth2 → URL Generator): scope bot, open the link and add the bot to a server. Discord only lets a bot message you if you share a server, so make a private server with only you and the bot. For direct messages the bot needs no permissions; for Read-only groups also give it View Channels, Send Messages and Read Message History.
5. In Discord, server menu → Privacy Settings → allow direct messages from server members.
6. Turn Bodega Remote on and send the bot a direct message. It answers with a pairing code; confirm it on the computer.

Approval cards use Discord buttons. Replies are sent with link previews off and with @everyone, @here and role pings disabled, so text the model writes cannot ping anyone. Discord limits a message to 2,000 characters (longer replies are split) and limits how fast a message can be edited, so the live 'Working' message updates about once a second and Bodega waits if Discord asks it to slow down. If the token is wrong, or Discord refuses the connection, the computer shows one notice and Bodega does not keep retrying. Paste a corrected token in Settings and Bodega reconnects with it; if you changed something in the Developer Portal instead, turn Bodega Remote off and on. While it is still connecting, Settings says "Connecting to Discord..." and shows Connected only once Discord confirms the session. If your direct message gets no answer, check that you share a server with the bot and that direct messages from server members are allowed.

Slack needs a workspace you control (a free one of your own is fine) and two tokens. Steps as api.slack.com reads in October 2026; Slack moves things, so go by the names.

1. Open api.slack.com/apps → Create New App → From scratch, and pick your workspace.
2. Socket Mode: turn it on and create an App-level token with the connections:write scope. It starts with xapp-. Paste it into the App-level token box under the Slack row in Settings → Connections → Bodega Remote.
3. OAuth & Permissions → Bot Token Scopes: add chat:write, im:history, im:read, users:read, files:read, files:write and app_mentions:read (Slack requires that last one for the app_mention event in step 4; Bodega still ignores channels unless Groups and servers is read-only). Install to Workspace, then paste the Bot User OAuth Token (xoxb-) into the Slack token box.
4. Event Subscriptions: turn it on and subscribe the bot to message.im, app_home_opened and app_mention. Interactivity & Shortcuts: turn it on (no URL is needed with Socket Mode). App Home: tick "Allow users to send Slash commands and messages from the messages tab".
5. Slash Commands: create /bodega. Slack treats any message that starts with / as its own command, so in Slack you type the commands as /bodega status, /bodega new code, /bodega model and so on.
6. Turn Bodega Remote on, open the app in Slack, Messages tab, and send it anything. It answers with a pairing code; confirm it on the computer.

Bodega connects to Slack over Socket Mode: it opens the connection itself, so there is no public address and no port to open. Approval cards are Slack buttons (Allow / Deny, then a red Confirm and Cancel on the same message for anything destructive), and every press is checked against your Slack user id. Replies go out with link and media previews off, and text the model writes cannot mention @channel, @here or anyone else. Slack messages are cut at 3,000 characters (longer replies are split), and Bodega waits when Slack asks it to slow down. Each session gets its own thread in the app's Messages tab (a Session: ... line with the replies underneath); approval cards and questions stay at the top level so you cannot miss them, and replying inside an older session's thread switches back to that session. The app's Home tab is your dashboard, for your paired account only: the session, approvals waiting (with the same Allow and Deny buttons) and buttons for Status, Sessions, Model, Agent, Effort, Harness, Mode and Setup, which answer in the Messages tab. Anyone else who opens Home sees only the command list. /bodega model (and the other pickers) with no argument shows a private drop-down. If either token is wrong, of the wrong kind or revoked, the computer shows one notice and Bodega does not keep retrying; paste the corrected token. If Settings says "No App-level token", step 2 is missing. Slack can see everything sent through the app, as described above.

Messages already come styled like the app: a purple bar on Discord and Slack cards, bold titles and folded step lists on Telegram, and the same words everywhere (Needs you, Allow, Deny, Done). The bot's picture and name are the one part only you can set, on the platform. Use this picture, the Bodega mark on purple (512 by 512 pixels, PNG): drag it onto your desktop to save it, or straight into the upload box.

1. Telegram: in @BotFather send /setuserpic, pick your bot and send the picture. Optional: /setdescription and /setabouttext. Bodega fills the / command menu itself when it connects.
2. Discord: Developer Portal → your application → Bot: set the icon to the picture and the username to Bodega. General Information → App Icon takes the same picture.
3. Slack: api.slack.com/apps → your app → Basic Information → Display Information: upload the picture as the app icon, name it Bodega, and set the background colour to #7936FC.

Steps as the three sites read in October 2026; go by the names if they move.

Send /new and tap a button: Code in <your last project>, New project... (then reply with a name) or Chat only. Or send /new chat for a Chat Mode session (no project), or /projects to see your recent and pinned projects with numbers and then /new code 2 (or /new code <name>) for a Code Mode session in that project. /project <name or number> switches the session this chat is on to another project, and turns a Chat session into a Code session. A path typed in chat is never accepted. To start a brand-new project folder from chat, set Projects folder for chat in Settings → Connections → Bodega Remote, then send /new code new <folder name> (or /project new <folder name> for the session you are in): the folder is made directly inside that one folder and nowhere else.

Then just write. While Bodega works the chat shows one status message that updates about once a second: Working · 6s, the step it is on (Running commands), the earlier steps folded underneath, and the session header. It never shows the answer as it is typed. When it finishes the status becomes Done · 4s · 3 tools and the answer arrives as a new message, split to fit the app's limit, with a small footer such as 2 files · Verification: pass · Sonnet 5.5 · 4s (files changed and the verification result appear when the run had them). In a Code session that changed files the answer also has a Show changes button, which sends the same thing as /diff. A message sent while a turn runs is queued. Bodega knows you are talking to it from a chat app: it does not ask a list of setup questions first, and if it needs a project it tells you to use /projects, /new code <project> or /project <name>.

A change you make with a command takes effect on the next message; a run in progress is not rewritten. /model only chooses among models of providers you have already set up (it cannot add a key, an address or a download). /help <command> explains one command in more detail.

/diff and /file need a Code session (a Chat session has no project). The path for /file is relative to the project folder: absolute paths, .. and links that lead outside the project are refused, and so are files under .git, .ssh, .aws, .kube, .docker or .gnupg, files whose name says they hold credentials (.env, private keys and certificates, .npmrc, .netrc, .pgpass, kubeconfig, Terraform state and variables, anything named secret or credential), binary files and files over 1 MB. The list is a list: a password in an ordinarily named file is not recognised. Before anything is sent, text shaped like a key or token is replaced with [REDACTED]; a plain password has no recognisable shape and is not caught, so do not send a file you know holds one. If the session's project is in the Air-Gap Vault, or Air-gap is on, nothing is sent. Every file sent or refused is in the Activity log.

/fleet stop, /loops run and /loops stop first show a card with Confirm (or Run now) and Cancel; nothing happens until you tap it, and the card stops working after ten minutes. A loop run from chat follows the same rules as Run now on the computer: Loops must be on in Settings, and the spend cap and the limit on loops running at once apply; if the computer refuses, the card says why. Creating or editing loops, and applying or discarding a fleet run, stay on the computer.

Voice notes: send a voice message (Telegram or Discord) and Bodega transcribes it with the speech-to-text set up on the computer (Settings, General, Voice input), shows what it heard as Heard: "...", and runs it as if you had typed it. A voice note is never read as a command and never answers an approval card. If speech-to-text is off, the reply says which setting to turn on and nothing is transcribed. With a cloud speech-to-text provider (OpenAI, or a whisper server on another machine), the audio goes to that provider, as it does on the computer; while Air-gap covers the session, only a whisper server on this computer is used, otherwise the voice note is refused.

/continue binds this chat to the session you were just in at the desk (not one that was made from chat) and follows it. While following, a turn you start at the desk appears in the chat as a quoted line (Desktop: ...), a status line and the answer, all without a phone notification; approval cards post whichever device started the turn, and the first decision wins. Following is off until you turn it on with /continue or /follow on; /follow off stops it, and /unfollow leaves the chat bound to nothing (the next message then gets three buttons instead of a hint). /sessions lists your five latest sessions as buttons with their state (Working, Needs you, Idle 12m); tapping one binds this chat to it without turning following on. If you archive the session on the computer, the chat gets one line and is unbound. /status shows when the last message came and from where (from Desktop, 2 min ago).

Continue on phone. Once Bodega Remote is set up, the top of a chat (and of the Agent panel in Code Mode) has a Continue on phone button. It sends a card to every connected chat app: the session's title, its header (mode, project, model, permission), Opened at the desk. Tap Follow to continue here. and one Follow button. Nothing changes in the chat until you tap Follow; the tap binds that chat to the session and turns following on, the same as /continue. The button stays usable for an hour after it arrives. When it cannot send, the button is greyed out and hovering it says why: Bodega Remote is off, Air-gap is on, the session's project is vaulted, setup is not finished, no chat app is paired yet, or your paired app is not connected right now. A vaulted session is never sent, not even its title. If no bot token is currently saved, the button is not shown at all.

Which sessions came from your phone. A session you drove from a chat app carries a small Telegram, Discord or Slack label in the chat list, the Code Mode sessions drawer, the Runs list and at the top of the session. While a chat follows the session (after Follow, /continue or /follow on), the top also reads Followed from Telegram; a chat that is only bound shows the label but not that line. Revoking a chat app removes what its binding showed. After you /unfollow, the label stays if you sent the session a message from that app (it then names the app the last such message came from) and goes away if you only watched. Opening the session at the desk is just opening it: there is nothing to take over, and you can type on either side.

From the CLI: there is no bodega remote continue command yet; from the terminal, send /continue from the phone instead, which picks up the session you were last in.

Every status line and answer starts with a header built from the session itself, never from what the model wrote: Code · MyProject · Sonnet 5.5 · Ask · ctx 38k/128k (Chat or Code, the project name or the agent, the model, the mode, and how full the model's window is). If someone changes the mode, model, project or agent at the desk, the chat gets one quiet line (Mode is now Act (changed on Desktop)); a change you make from the chat is not announced back to you. Runs on a cloud model add the cost to the footer (Sonnet 5.5 · 4s · $0.03); cloud spend is recorded after a run finishes, so the footer may say cost pending, and a model on this computer never shows a cost.

/usage shows the session's tokens in and out, its cost so far, and today's and this month's totals, from the same record the desktop's usage and spending pages read. /context shows how much of the window is used and which parts take the most space (names and token counts only, never their text), with a hint when it is nearly full. Both only read; neither shows a key, an address or a path.

/model, /agent, /effort, /harness and /mode with nothing after them open a keyboard that edits itself as you tap: /model shows only providers you have already set up, then their models ten at a time (More, Back), and marks the current one. Act is not offered unless Allow /mode act from chat is on. Every choice goes through the same checks as typing the command, so the change is logged and, when it widens what the session may do, shown on the computer. After a choice you can tap Save as default for new chat sessions: it saves your model and thinking effort as the computer's defaults (the same ones Settings sets) and your agent and harness as defaults for chats you start from a chat app. It writes those four settings and nothing else. /setup goes through agent, model, effort and harness in turn.

Discord: type / in a server you share with the bot to get the same commands as slash commands with autocomplete for models, agents, harnesses, projects and sessions (a vaulted session shows as A vaulted session, a vaulted project is not listed, and nothing is suggested while Air-gap is on). They work only for your paired account, run in your direct messages with the bot, and tell you so privately. /model, /agent, /effort, /harness or /mode with nothing after it opens a private drop-down right there (only you see it); the choice applies to the session your direct message is on and offers Save as default for new chat sessions. The other pickers are buttons in your direct message. Telegram shows the commands in its own / menu.

While Bodega works, the status line has a Stop button; when it finishes, the answer has a Retry button that sends the same message again as a new turn. An answer too long for one message arrives as its first part plus one file, answer.md, with the whole text (the footer says Full answer attached); if the run fails or the connection drops, what was written so far is kept as partial-answer.md. Errors say what went wrong and what to do: a bold Stopped: <cause> line (for example Stopped: model not reachable), one sentence, and Retry; when the cause is the model there is also Pick a model, which opens the same picker as /model. After the computer restarts, each chat gets one line (Bodega is back online (restarted 14:02). 1 approval expired with the restart.).

Notifications: messages that need you (approval cards, answers to what you sent, errors) notify you. Status lines are edited, which does not notify. Turns started at the desk and change lines arrive silently. /quiet on makes your own answers silent too and hides desk turns; approval cards always notify, because an unanswered approval is a stuck run. /quiet 23:00-07:00 does the same every day inside that window.

How chat looks (Settings → Connections → Bodega Remote): Progress line chooses what the Working line shows; Activity and tool list adds a collapsed list of the tools used under the finished line (Telegram: tap the quote to open it; Discord: tap the hidden text), names only, never arguments, paths or output. Remove the progress line when done deletes the Working line once the answer has arrived (with no answer the line stays as the summary). Post an unanswered approval again after (default 30 minutes, 0 = never): an approval nobody answered is posted once more so your phone notifies again, and the old card points to the new one; nothing is ever approved or denied by time. Discord: a thread per session (off by default): each session's replies go to its own PRIVATE thread in one channel of your server (paste the channel id). You and the server's moderators (anyone with Manage Threads) can read it, so use a server with only you in it. The bot needs Create Private Threads and Send Messages in Threads there; if it cannot open a private thread, replies stay in your direct message and it says so once (it never opens a public one). Approvals, questions and menus always stay in your direct message, and you keep typing there. bodega remote doctor warns when the Discord bot is in more than one server.

When the agent needs your OK, a Needs you card appears that reads like the one on the computer ("Write hello.py", "Run python hello.py", "Edit src/x.ts (+3 −1)"), with how risky it is, what the run has changed so far and whether verification ran, and Allow / Deny buttons (the app's own words; Allow is green on Discord and Slack). One tap decides it, just like Ask mode at the computer. It goes through the same check as the buttons on the computer: whoever answers first wins, and the other place shows who answered. Nothing in chat ever approves anything by itself, and a lost connection, an outage, or turning Air-gap on never counts as a rejection; the request just stays waiting on the computer.

• Destructive requests (deleting files, rm, git push, installing packages, writing outside the project, and anything Bodega itself marks dangerous) need a second tap: Allow turns the same card into Needs you · destructive with a red Confirm button that names the action (Confirm delete, Confirm run) and Cancel, and you have 60 seconds to tap it. It is never typed, and tapping Allow again does nothing new.
• Replying instead of tapping: while a card is open you can send yes, approve, allow or ok (or no, deny, reject, cancel) on its own. Any other message gets "Waiting for your OK on the card above" and is sent after you answer. Replies never decide anything in a group.
• The time on a decided card ("Allowed · 12:49") is your computer's local time.
• Permission to operate other apps (desktop control) is never offered in chat. You get "Waiting for consent on the computer".
• Every approval from chat also shows up on the computer ("Approved from Telegram").

From chat you can change how a session runs: mode (including Act), thinking effort, model, harness and agent. Every such change is logged under Activity on the settings page, and a change that widens what the session may do (to Act, a different model, an outside harness, an agent) also raises a notice on the computer.

Switching to Act from chat is off by default. If you turn on Allow /mode act from chat (on the computer or with the CLI only), /mode act works, and Act then behaves exactly as it does at the desk: Bodega runs shell commands and other tools without asking you. Only prompts that are forced stay (a hook, an always-approve tool such as opening a pull request, a risky call the decision model holds). Think before enabling it for a chat account you do not fully trust.

Never from chat, whatever you type: settings, the air-gap switch, keys and tokens, MCP servers, model downloads, raw shell commands, pairing, and anything that decides what a project's own settings file may control.

By default the bot ignores every message that is not a direct message. If you switch Groups and servers to Read-only, you (and only you) can ask a question in a group by mentioning the bot. It answers in the group, can read and search but cannot change or run anything, and approval cards are never posted there. Group members' messages are never treated as instructions.

With Air-gap on, Bodega Remote is unavailable: the switch is disabled, nothing connects, and turning Air-gap on while it runs sends your direct chat on each connected app ONE fixed final message, Bodega Remote is paused: Air-gap is on, and then disconnects within a second. Nothing else is sent while Air-gap is on. A project with its Air-Gap Vault on gets no replies in chat either (the turn still runs on the computer; you are told once that replies stay there). These refusals are counted in the air-gap attestation as remote_channel_start and remote_channel_vault.

Not supported, and why: WhatsApp (its business terms in force since January 2026 bar general-purpose AI assistants, the official route needs a business account and a public web address, and the unofficial libraries risk banning your personal number), Signal, iMessage and email.