Bonnie gives an agent real hands on your own computer — terminals, files, processes, the screen — with a gate on anything irreversible that the agent cannot open. Nothing is installed to read this page.
ChatGPT draws its half only when you ask it to — a host will not render a tool's markup on the tool's say-so. Say: connect me to Bonnie and render the handshake
Add the endpoint once. Bonnie is then available in any conversation on this computer.
setup: onceOpen the paired URL on your phone and operate the machine directly. No agent on this path — you are the one driving.
setup: nonePrompt the ChatGPT session on your desktop from your phone. Needs Chrome started with a debugger port, because injecting a turn requires a genuinely trusted click.
setup: advancedPick what a remote agent may do on this machine — your phone, or someone helping you. You get a link to open there. You keep the dial: change what it can reach, or cut it entirely, at any moment, and the tools appear or disappear in their agent's list while they are talking to it.
Read-only, always. A remote session carries eyes, never hands. Anything that acts needs a warrant granted here, on this machine, by you.
In this demo the live channel is this browser, so the other side must be another tab here. With Bonnie running, the machine itself is the channel and the other side can be any device. The demo issuer's signing key is published in the repository on purpose — this proves scope, expiry and revocation, not secrecy.
This is the claim the whole project rests on, and you can check it here, now, without pairing a machine. The tools below are governed by the same gate that governs a real one; they simply reach nothing.
warrant_force_grant. It cannot succeed:
a grant needs a real gesture, and a tool call never has one.This page has no backend. It talks to a machine you own, over a direct peer connection — nothing of yours passes through a server here.
git clone https://github.com/meshbergio/bonnie cd bonnie && ./install.sh bonnie pair # prints a URL and a QR code — open it here
Runs on your own machine. Clearing site data unpairs it; there is no account to delete.
No staged changes. Ghost edits appear here before anything touches disk.
Opening this view registers its tools; closing removes them.
Granting registers these tools. Until you click, they do not exist in the agent's catalogue — there is no name for it to call.
Grant these once and stop being asked. It holds until you turn it off — no expiry, across reloads. The agent can never turn this on; only you can, and turning it off is one tap from anywhere.