grinev/opencode-telegram-bot: source audit, 2026-10-10
Read from the source at commit 0a73b919546d; the bot was not run (it needs a BotFather token). Each answer cites the file and line that shows it. All 20 bots
In short
Locked to exactly one Telegram user ID and will not start without it. It shows Allow/Reject buttons when the OpenCode server asks, so whether shell and edit actions need approval depends on your own OpenCode permission config.
What the source shows
| Answer | Where | |
|---|---|---|
| Who can use it | Serves nobody until you list your Telegram ID | src/bot/middleware/auth.ts:12 — if (userId && userId === config.telegram.allowedUserId) next(); else silently ignore |
| With no allowlist set | TELEGRAM_ALLOWED_USER_ID (one user ID, required); the process throws at config load if it is missing | src/config.ts:14-16 — throw new Error(`Missing required environment variable: ...`) |
| Before the agent acts | the agent's own permission prompts come to you in Telegram | src/app/services/event-router.ts:50 — case "permission.asked": relayed to Telegram with Allow/Reject buttons; the bot passes no permission flags to opencode serve |
| Bot token | Read from the environment or a config file; no real token is committed | |