Worth underlining for anyone deploying this: a Telegram bridge to Claude Code is remote code execution guarded by whatever the bot's auth layer does. The allowed-user-ID list is the entire security model, so treat the bot token like an SSH key and rotate it if it ever lands in a log, and run the bot under an account that only owns the approved project directories. Directory sandboxing limits where the agent works, but Claude Code can still execute shell commands inside those directories, so a compromised Telegram account equals shell access there. The proactive-notification half is the part I would adopt first; firing CI results into the chat is low risk and most of the convenience.
Worth underlining for anyone deploying this: a Telegram bridge to Claude Code is remote code execution guarded by whatever the bot's auth layer does. The allowed-user-ID list is the entire security model, so treat the bot token like an SSH key and rotate it if it ever lands in a log, and run the bot under an account that only owns the approved project directories. Directory sandboxing limits where the agent works, but Claude Code can still execute shell commands inside those directories, so a compromised Telegram account equals shell access there. The proactive-notification half is the part I would adopt first; firing CI results into the chat is low risk and most of the convenience.