avivsinai/telclaude

telclaude

Isolation-first Telegram ⇄ agent relay for Claude Code, Codex, and operator workflows, with LLM pre-screening, approvals, and tiered permissions.

Alpha — Security-first defaults; expect breaking changes until 1.0.

Highlights

• Mandatory isolation boundary: all LLM/persona runtime execution goes through contained Hermes, with relay-owned MCP/capability services and Docker firewall enforcement.
• Credential vault: sidecar daemon stores API keys and injects them into requests — agents never see raw credentials.
• Relay-authoritative memory: trusted semantic memory + episodic shared history archive + compiled Claude MEMORY.md working set. Private recall is aggressive, but source boundaries remain hard.
• Hard defaults: secret redaction (CORE patterns + entropy), rate limits, audit log, and fail-closed chat allowlist.
• Soft controls: Haiku observer, nonce-based approval workflow for FULL_ACCESS, and optional TOTP auth gate for periodic identity verification.
• Four permission tiers mapped to agent runtime capabilities: READ_ONLY, WRITE_LOCAL, SOCIAL, FULL_ACCESS.
• Generic social services integration (X/Twitter, Moltbook, Bluesky, etc.) via config-driven SOCIAL agent context with unified social persona.
• External provider sidecars: Google Services (Gmail, Calendar, Drive, Contacts) with approval-gated actions; extensible pattern for adding new providers.
• Hermes-only runtime: run private Telegram,