Skip to content

FleetTelegram

Phase 1 Telegram command center for one Windows machine running Claude Code.

Scope

Built now: - Telegram long-poll gateway. - Andrew-only user allowlist. - Caveman outbound compression. - Usage-governor gate for inbound commands. - Dangerous-command confirmation tokens. - Claude CLI commander seam and phase-1 claude -p implementation. - Claude Code session adapter seam. - Per-session digest buffer and Telegram forum topic manager. - /shot screenshot command. - /rec <seconds> user-initiated desktop recording via ffmpeg, split under Telegram's upload cap. - JSONL audit log.

Deferred: - Non-Claude adapters, board rendering.

Config

Create user-local config at %USERPROFILE%\.claude\fleet-telegram.json:

{
  "botToken": "<Telegram bot token from BotFather>",
  "chatId": -1001234567890,
  "andrewUserId": 123456789,
  "defaultSessionCwd": "C:\\Users\\fives\\source\\repos",
  "recordingEnabled": true,
  "recordingMaxSeconds": 60,
  "recordingMaxBytes": 51380224,
  "recordingFramerate": 10,
  "recordingVideoBitrateKbps": 900,
  "recordingFfmpegPath": "ffmpeg"
}

Bot token and IDs stay out of repo and logs. /rec requires ffmpeg on PATH or recordingFfmpegPath pointing to ffmpeg.exe.

Build

$env:NUGET_PACKAGES = "$PWD\.nuget\packages"
dotnet restore FleetTelegram.sln
dotnet build FleetTelegram.sln --no-restore -warnaserror
dotnet test tests/FleetTelegram.Tests/FleetTelegram.Tests.csproj --no-build --collect:"XPlat Code Coverage" --results-directory ./coverage

Telegram client package: Telegram.Bot 22.10.0.2.

Security limitations (phase 1)

The dangerous-command confirm gate (delete/rm/push/reboot/format/...) is a heuristic word-boundary match on the inbound text. It deliberately catches literal dangerous verbs and forces a confirm button, but it CANNOT catch intent-only phrasing ("erase the folder", "wipe the disk") that a model might translate into a destructive shell command downstream. It is one layer, not the only one:

  • Allowlist: only Andrew's Telegram user-ID is ever processed; everything else is dropped and audited.
  • Usage-governor gate: RED/BLACKOUT refuse non-critical commands; a present-but-unreadable governor state fails CLOSED for non-critical (not open).
  • Audit log: every inbound command, gate decision, and result is appended (with credential-shaped substrings redacted).
  • !critical only grants the RED/BLACKOUT override when written as a separate token (!critical <cmd>), never glued (!criticalreboot).
  • Screen recordings: /rec is user-initiated only, never scheduled. Automatic sensitive-window detection is not implemented; vault and .kdbx windows are out of scope for auto-recording, so set recordingEnabled:false when capture risk is unacceptable.

Phase-2 hardening (tracked): intercept the ACTUAL shell commands the agent tries to run (via Claude permission hooks) and gate on those, rather than only the natural-language prompt.