Your agents from your phone

Start and steer Claude Code and Codex on your own machine from Claude, ChatGPT or the dashboard, and approve their permission prompts from your phone. It needs no Slack bot and no gateway of your own. Each machine stays out of it until you run 0b agent on there.

Last updated 2026-10-09

How it works#

0b agent runs a small program on your machine. It opens an outbound connection to 0bridge (no open ports, no tunnel), and 0bridge relays your requests to it. The program starts the coding agent, and sends back what it says and any permission prompt it hits.

From a chat app or any MCP client you get seven tools: bridge__machines, bridge__agent_sessions, bridge__agent_start, bridge__agent_send, bridge__agent_read, bridge__agent_approve and bridge__agent_stop. The dashboard's Machines page shows the same thing, laid out for a phone.

Turn it on#

1. On the dashboard, under Settings → AI apps, check that Agent control is on. New accounts start with it on; an account from before 2026-10-06 turns it on there, which needs you to confirm it is you.
2. On the machine, in the repo you want to allow:

0b agent on

It asks once to allow the current repo, checks that the account has agent control on, and installs a background service.

Nothing is allowed until you add a repo. 0b agent allow <path> and 0b agent deny <path> change the list, 0b agent status shows machines, agents and repos, and 0b agent off stops it. Host work handed to a supervisor (0b agent supervisor) isn't limited by this list: see Dots and your dev host.

If the machine runs an OpenClaw supervisor with Herdr workers, 0b agent supervisor openclaw --agent <name> lets you hand it whole tasks instead, answer its workers' questions, and hear back when they finish; if it keeps a work ledger a team of agents works from, 0b agent supervisor ledger puts your requests and answers there: Dots and your dev host.

Sessions you start yourself, in a terminal, show up on the session board too, with the ones waiting for you first. A webhook can start a task, always in plan mode unless you confirm otherwise: Triggers and webhooks.

What a task looks like#

Ask your chat app: "start Claude on the 0bridge repo and fix the failing test".

1. The agent starts in a new git worktree on a branch named 0b/<task>, so your working copy is untouched.
2. You read progress with bridge__agent_read, or on the task page in the dashboard.
3. When the agent needs permission, the task shows as waiting. You approve or deny in the dashboard, or by telling your chat app to call bridge__agent_approve. Anything left for 30 minutes is denied.
4. It ends as done, failed or stopped. You review the branch and merge it yourself.

Notifications can tell you when a task finishes or needs you: an ntfy topic or email, both off until you set them. A notification links to the task page; there is no approve button in a notification.

What keeps it safe#

• Off for each machine until you run 0b agent on there, and limited to repos you list. The account's switch is on for new accounts; any connected AI turns it off when you ask (bridge__settings_off), or 0b settings off agent-control. Turning it back on needs the dashboard and your passkey.
• Each task gets its own worktree. The default mode is edit; plan is read-only and auto is never the default.
• Default deny rules apply on your machine before anything reaches you: pushing to main or master, force pushes, merging pull requests, deploys, publishing packages and rm -rf /.
• Permission prompts are relayed to you, not answered for you.
• Every start, send, approve and stop is recorded in the audit log, without the prompt text.

What 0bridge can read#

Your prompts and what the agent prints go through 0bridge and are stored for the task page, up to 500 events or 256 KB per task. Secret-shaped text is masked first. Treat the task page like your conversation history in server mode: readable by 0bridge, not sealed.

Limits#

• Claude Code and Codex are the supported agents. Gemini is best effort.
• A session you started in a terminal can be followed up through herdr or tmux if either is installed, only for repos you allowed. It can't be approved from here. herdr and tmux type the text and press Enter, so if the session is showing a prompt, the text answers it; that is not a safe queue for a prompt nobody has read.
• bridge__agent_sessions lists only sessions in repos you allowed, and says how many more it found outside them and why (for example "no repo is allowed on this machine"), without naming them. bridge__agent_send can still name a session by its 0b: ref; its machine refuses it outside the allowed repos. With dryRun: true nothing is sent: the machine says whether it would take it, why not, and the route (herdr, tmux, codex queue or a headless resume).
• A session that is open in a terminal won't also be resumed headlessly; 0bridge routes to the terminal or refuses, so two writers never share one session.
• Codex control uses codex app-server, which Codex marks experimental.
• Whether Dots or ChatGPT confirm write tools such as bridge__agent_approve the way you'd want is not verified on every plan: Supported clients. Keep OpenClaw or your current setup running until approvals from your phone have worked for you for a week.