WardenDeck

WardenDeck is an MIT-licensed, self-hosted control plane that links Feishu/Lark to a coding agent running on your own computer. You send a task from chat, watch a live execution card, approve or deny tool calls, and keep a hash-chained audit record of the activity. The README labels it a prototype, and Claude Code is currently the only execution adapter.

What It Is

WardenDeck is a bridge between instant messaging and a local AI coding agent. It runs as a Node.js service (wardendeck serve) and a CLI, stores data in a local SQLite file, and listens on 127.0.0.1 by default, so no inbound public port is required. An optional web console manages projects, bots, members, platform bindings, memory and the audit log, and can be disabled with --no-web.

How a Message Becomes a Task

Feishu delivers messages over a long connection. WardenDeck checks the chat and user against a binding, the allowed-users list and the @-mention rule in groups, then queues the message and passes it to a persistent Claude Code process in the project's working directory. When Claude Code requests tool permission, WardenDeck posts an approval card; users can allow once, allow for 30 minutes, or deny, or reply 1/2/3. Progress patches the same card in place, and sessions are resumed per chat. Commands such as /stop, /remember, /memory and /forget are available in chat.

Security and Memory Model

Platform credentials are encrypted with AES-256-GCM using a local master key. Audit events (inbound and outbound messages, approvals, runs) form an append-only SHA-256 hash chain that wardendeck audit verify checks. On macOS the agent and its spawned tools run under sandbox-exec. Long-term memory belongs to the bot and merges four scopes (assistant, project, chat, user) with token budgets.

Current Status and Limitations

The README documents these limits: Codex is detected but not wired up; Slack and Telegram support credential tests and bindings but not message ingestion; the kernel sandbox is macOS-only; and a sleeping laptop goes offline. The database itself is not encrypted, and the port should not be exposed to the public internet.