# WardenDeck

> Self-hosted control plane that connects Feishu/Lark chats to Claude Code running on your own machine, with approvals, audit logging and sandboxing.

WardenDeck is an MIT-licensed, self-hosted control plane that links Feishu/Lark to a coding agent running on your own computer. You send a task from chat, watch a live execution card, approve or deny tool calls, and keep a hash-chained audit record of the activity. The README labels it a prototype, and Claude Code is currently the only execution adapter.

## What It Is

WardenDeck is a bridge between instant messaging and a local AI coding agent. It runs as a Node.js service (`wardendeck serve`) and a CLI, stores data in a local SQLite file, and listens on 127.0.0.1 by default, so no inbound public port is required. An optional web console manages projects, bots, members, platform bindings, memory and the audit log, and can be disabled with `--no-web`.

## How a Message Becomes a Task

Feishu delivers messages over a long connection. WardenDeck checks the chat and user against a binding, the allowed-users list and the @-mention rule in groups, then queues the message and passes it to a persistent Claude Code process in the project's working directory. When Claude Code requests tool permission, WardenDeck posts an approval card; users can allow once, allow for 30 minutes, or deny, or reply 1/2/3. Progress patches the same card in place, and sessions are resumed per chat. Commands such as `/stop`, `/remember`, `/memory` and `/forget` are available in chat.

## Security and Memory Model

Platform credentials are encrypted with AES-256-GCM using a local master key. Audit events (inbound and outbound messages, approvals, runs) form an append-only SHA-256 hash chain that `wardendeck audit verify` checks. On macOS the agent and its spawned tools run under `sandbox-exec`. Long-term memory belongs to the bot and merges four scopes (assistant, project, chat, user) with token budgets.

## Current Status and Limitations

The README documents these limits: Codex is detected but not wired up; Slack and Telegram support credential tests and bindings but not message ingestion; the kernel sandbox is macOS-only; and a sleeping laptop goes offline. The database itself is not encrypted, and the port should not be exposed to the public internet.

## Features
- Feishu/Lark chat control of a local coding agent
- Live execution cards updated in place
- Per-tool-call approvals (allow once, 30 minutes, deny)
- Approvals bound to the task initiator
- Append-only SHA-256 hash-chained audit log with verification
- macOS sandbox-exec isolation of the agent
- Four-scope long-term memory (assistant, project, chat, user)
- AES-256-GCM encrypted credentials
- Local SQLite storage and optional web console
- QR-based Feishu app setup
- CLI for projects, bindings, users, models, memory and audit
- Image attachments sent through the bot

## Integrations
Feishu, Lark, Claude Code, SQLite

## Platforms
MACOS, LINUX, WEB, API, CLI

## Pricing
Open Source

## Links
- Website: https://github.com/bocoboho/wardendeck
- Documentation: https://github.com/bocoboho/wardendeck#quick-start
- Repository: https://github.com/bocoboho/wardendeck
- EveryDev.ai: https://www.everydev.ai/tools/wardendeck