Switch from Claude Code/Codeman to native Avi Telegram Agent (@amangt_bot), OpenCode CLI, and DeepSeek Harness

Dockerfile

@@ -75,7 +75,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     tmux \
     locales \
     && rm -rf /var/lib/apt/lists/* && \
-    locale-gen en_US.UTF-8
+    sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && \
+    /usr/sbin/locale-gen en_US.UTF-8
 
 ENV LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8
 
@@ -146,7 +147,7 @@ ENV REA_APKTOOL_COMMAND="/usr/local/bin/apktool"
 # ------------------------------------------
 COPY --from=binwalk-builder /install/bin/binwalk /usr/local/bin/binwalk
 RUN chmod +x /usr/local/bin/binwalk && \
-    pip3 install --no-cache-dir --break-system-packages unblob==26.6.4 pwntools
+    pip3 install --no-cache-dir --break-system-packages unblob==26.6.4 pwntools python-telegram-bot httpx
 
 ENV REA_BINWALK_COMMAND="/usr/local/bin/binwalk"
 ENV REA_UNBLOB_COMMAND="/usr/local/bin/unblob"
@@ -189,39 +190,20 @@ RUN curl -fsSL "https://github.com/oven-sh/bun/releases/latest/download/bun-linu
     rm -rf /tmp/bun*
 
 # ------------------------------------------
-# 12. Claude Code CLI, REA, Supergateway, Codeman + Browser Hard-Block
+# 12. CLI Agents (OpenCode, DeepSeek Harness, REA, Supergateway) + Browser Hard-Block
 # ------------------------------------------
 COPY security/stub-playwright-index.js /tmp/stub-pw.js
 COPY security/stub-playwright-index.mjs /tmp/stub-pw.mjs
-RUN npm install -g supergateway@latest && \
-    npm install -g rea-agents@latest && \
-    npm install -g @anthropic-ai/claude-code && \
-    npm install -g aicodeman@latest && \
-    npm install -g opencode-ai && \
-    npm install -g @deepseek-ai/dsh pnpm yarn typescript && \
-    which supergateway codeman claude rea opencode && \
+RUN npm install -g supergateway@latest rea-agents@latest opencode-ai @deepseek-ai/dsh pnpm yarn typescript && \
+    which supergateway rea opencode && \
     cp /tmp/stub-pw.js /usr/local/lib/node_modules/rea-agents/node_modules/playwright-core/index.js 2>/dev/null || true && \
     cp /tmp/stub-pw.mjs /usr/local/lib/node_modules/rea-agents/node_modules/playwright-core/index.mjs 2>/dev/null || true && \
     rm -f /tmp/stub-pw.* && \
     for b in chromium chromium-browser google-chrome google-chrome-stable chrome firefox playwright playwright-core puppeteer chromedriver geckodriver msedge brave-browser webkit; do \
       printf '#!/bin/sh\necho "ERROR: Browser engines and browser automation are strictly disabled by host security policy." >&2\nexit 126\n' > "/usr/local/bin/$b" && chmod 755 "/usr/local/bin/$b"; \
     done && \
-    rm -rf /root/.npm
-
-# ------------------------------------------
-# 13. Claude Code Telegram Bot Bridge
-# ------------------------------------------
-COPY security/patch-claude-telegram.py /tmp/patch-claude-telegram.py
-RUN git clone https://github.com/RichardAtCT/claude-code-telegram.git /opt/claude-code-telegram && \
-    python3 /tmp/patch-claude-telegram.py && \
-    python3 -m venv /opt/claude-code-telegram/venv && \
-    /opt/claude-code-telegram/venv/bin/pip install --no-cache-dir poetry && \
-    /opt/claude-code-telegram/venv/bin/pip install --no-cache-dir /opt/claude-code-telegram && \
-    rm -f /tmp/patch-claude-telegram.py
-
-COPY security/claude-wrapper.sh /tmp/claude-wrapper.sh
-RUN cp /tmp/claude-wrapper.sh /usr/local/bin/claude && chmod 755 /usr/local/bin/claude && rm -f /tmp/claude-wrapper.sh && \
-    /usr/local/bin/rea setup --client claude_code --client opencode --client vscode --yes || true
+    rm -rf /root/.npm && \
+    /usr/local/bin/rea setup --client opencode --client vscode --yes || true
 
 # ------------------------------------------
 # 14. Application Setup & Runtime Runner

config/Caddyfile.example

@@ -1,5 +1,14 @@
 :7860 {
-	# 1. REA MCP Server (Streamable HTTP via supergateway)
+	# 1. REA MCP Server (Streamable HTTP via supergateway, gated with auth)
+	@mcp_unauth {
+		path /mcp*
+		not header Authorization "Bearer @man.g"
+		not header X-API-Key "@man.g"
+	}
+	respond @mcp_unauth "{\"jsonrpc\":\"2.0\",\"error\":{\"code\":-32000,\"message\":\"Unauthorized: valid Bearer token or X-API-Key required.\"},\"id\":null}" 401 {
+		close
+	}
+
 	handle /mcp* {
 		reverse_proxy 127.0.0.1:8093 {
 			flush_interval -1
@@ -52,10 +61,8 @@
 		file_server
 	}
 
-	# 6. Codeman AI Coding Mission Control fallback
+	# 6. Root URL redirects directly to VS Code (/code/)
 	handle {
-		reverse_proxy 127.0.0.1:3000 {
-			header_up Host 127.0.0.1
-		}
+		redir / /code/ 302
 	}
 }

security/claude-wrapper.sh

@@ -1,16 +0,0 @@
-#!/bin/bash
-# Wrapper to allow Claude Code to run as root by stripping --dangerously-skip-permissions
-args=("$@")
-newargs=()
-for arg in "${args[@]}"; do
-    if [ "$arg" != "--dangerously-skip-permissions" ] && [ "$arg" != "--allow-dangerously-skip-permissions" ]; then
-        newargs+=("$arg")
-    fi
-done
-
-REAL_CLAUDE="/usr/local/lib/node_modules/@anthropic-ai/claude-code/bin/claude.js"
-if [ -f "$REAL_CLAUDE" ]; then
-    exec node "$REAL_CLAUDE" "${newargs[@]}"
-else
-    exec npx -y @anthropic-ai/claude-code "${newargs[@]}"
-fi

security/patch-claude-telegram.py

@@ -1,19 +0,0 @@
-import pathlib
-
-p = pathlib.Path("/opt/claude-code-telegram/src/bot/core.py")
-text = p.read_text(encoding="utf-8")
-
-needle = "builder.get_updates_connection_pool_size(8)"
-patch = """builder.get_updates_connection_pool_size(8)
-
-        apibase = os.environ.get("TELEGRAM_BOT_APIBASE")
-        if apibase:
-            builder.base_url(f"https://{apibase}/bot")
-            builder.base_file_url(f"https://{apibase}/file/bot")"""
-
-if needle in text and "TELEGRAM_BOT_APIBASE" not in text:
-    text = text.replace(needle, patch, 1)
-    p.write_text(text, encoding="utf-8")
-    print("Patched TELEGRAM_BOT_APIBASE into claude-code-telegram core.py")
-else:
-    print("Patch already applied or needle not found")

services/25-codeman.sh

@@ -1,36 +0,0 @@
-#!/bin/bash
-# 25-codeman.sh — Codeman AI Coding Mission Control on 127.0.0.1:3000
-mkdir -p /data/script/codeman/data /data/workspace /tmp/logs /tmp/.codeman
-LOG="/tmp/logs/codeman.log"
-
-if [ -f /data/.env ]; then
-    set -a
-    . /data/.env
-    set +a
-fi
-
-export PATH="/usr/local/bin:/usr/bin:/bin:$PATH"
-export TERM="xterm-256color"
-export CODEMAN_PORT=3000
-export CODEMAN_HOST="127.0.0.1"
-export CODEMAN_PASSWORD="${AUTH_TOKEN:-}"
-export CODEMAN_ALLOWED_HOSTS=".hf.space,amangs-cbot.hf.space,localhost,127.0.0.1"
-export CODEMAN_CONFIG_DIR="/data/script/codeman"
-export CODEMAN_DATA_DIR="/data/script/codeman/data"
-export CODEMAN_CASES_PATH="/data/workspace"
-export TMPDIR="/tmp"
-
-# Route all CLI agents (Claude Code, OpenCode, Codex) to local opencode-router
-export ANTHROPIC_BASE_URL="http://127.0.0.1:8787"
-export OPENAI_BASE_URL="http://127.0.0.1:8787/v1"
-export OPENCODE_BASE_URL="http://127.0.0.1:8787/v1"
-export ANTHROPIC_API_KEY="${AUTH_TOKEN:-}"
-export OPENAI_API_KEY="${AUTH_TOKEN:-}"
-
-if pgrep -f "codeman.*web" >/dev/null 2>&1; then
-    echo "codeman already running"
-    exit 0
-fi
-
-cd /data/workspace || exit 1
-exec codeman web --host 127.0.0.1 --port 3000 >> "$LOG" 2>&1

services/30-claude-telegram.sh

@@ -1,52 +0,0 @@
-#!/bin/bash
-# 30-claude-telegram.sh — Run Claude Code Telegram bot (@amangt_bot)
-mkdir -p /tmp/logs /data/workspace /tmp/.cache
-LOG="/tmp/logs/claude-telegram.log"
-
-if [ -f /data/.env ]; then
-    set -a
-    . /data/.env
-    set +a
-fi
-
-TOKEN="${TELEGRAM_BOT_TOKEN:-}"
-if [ -z "$TOKEN" ]; then
-    echo "TELEGRAM_BOT_TOKEN not set, skipping claude-code-telegram"
-    exit 0
-fi
-
-export TELEGRAM_BOT_TOKEN="$TOKEN"
-export TELEGRAM_BOT_USERNAME="${TELEGRAM_BOT_USERNAME:-amangt_bot}"
-export APPROVED_DIRECTORY="/data/workspace"
-export ALLOWED_USERS="${TELEGRAM_USER:-973904286}"
-export DATABASE_URL="sqlite+aiosqlite:////tmp/claude_bot.db"
-export DISABLE_SECURITY_PATTERNS="true"
-export DISABLE_TOOL_VALIDATION="true"
-export INTERACTIVE_TOOL_APPROVAL="false"
-export CLAUDE_MAX_TURNS="100"
-
-# Caching & Temp redirected strictly to /tmp (never S3 /data)
-export TMPDIR="/tmp"
-export PIP_CACHE_DIR="/tmp/.cache/pip"
-export npm_config_cache="/tmp/.cache/npm"
-export GRADLE_USER_HOME="/tmp/.gradle"
-export GOCACHE="/tmp/.cache/go-build"
-export GOPATH="/tmp/go"
-export XDG_CACHE_HOME="/tmp/.cache"
-export HF_HOME="/tmp/.cache/huggingface"
-
-# Point Claude Code to local opencode-router if ANTHROPIC_BASE_URL is unset
-export ANTHROPIC_BASE_URL="${ANTHROPIC_BASE_URL:-http://127.0.0.1:8787}"
-export ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY:-${AUTH_TOKEN:-}}"
-
-# Environment markers for Claude Code CLI inside Docker
-export IS_SANDBOX="1"
-export CI="1"
-
-if pgrep -f "claude-telegram-bot" >/dev/null 2>&1; then
-    echo "claude-code-telegram already running"
-    exit 0
-fi
-
-cd /opt/claude-code-telegram || exit 1
-exec /opt/claude-code-telegram/venv/bin/python3 -m src.main >> "$LOG" 2>&1

services/30-telegram-agent.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+# 30-telegram-agent.sh — Avi Telegram AI Coding Agent (@amangt_bot)
+mkdir -p /tmp/logs /data/workspace
+LOG="/tmp/logs/telegram-agent.log"
+
+if [ -f /tmp/.env ]; then
+    set -a
+    . /tmp/.env
+    set +a
+fi
+if [ -f /data/.env ]; then
+    set -a
+    . /data/.env
+    set +a
+fi
+
+TOKEN="${TELEGRAM_BOT_TOKEN:-}"
+if [ -z "$TOKEN" ]; then
+    echo "TELEGRAM_BOT_TOKEN not set, skipping telegram agent" >> "$LOG"
+    exit 0
+fi
+
+export TELEGRAM_BOT_TOKEN="$TOKEN"
+export TELEGRAM_BOT_APIBASE="${TELEGRAM_BOT_APIBASE:-tgp.ind.pp.ua}"
+export ALLOWED_USERS="${TELEGRAM_USER:-973904286}"
+export LLM_AMAN_BASE_URL="${LLM_AMAN_BASE_URL:-https://llm.aman.ltd/v1}"
+export LLM_AMAN_API_KEY="${LLM_AMAN_API_KEY:-sk-mSm7P3YFDdeasXvlWgLKCGHsucUtAWJJBnLapDyRVUe6TV8w}"
+export DEFAULT_MODEL="gemini-3.8-flash-high"
+export WORKSPACE="/data/workspace"
+
+if pgrep -f "services/telegram_agent.py" >/dev/null 2>&1; then
+    echo "telegram_agent already running"
+    exit 0
+fi
+
+cd /app || cd /data || exit 1
+exec python3 /app/services/telegram_agent.py >> "$LOG" 2>&1

services/telegram_agent.py

@@ -0,0 +1,170 @@
+import os
+import sys
+import json
+import asyncio
+import subprocess
+import httpx
+from telegram import Update
+from telegram.ext import Application, CommandHandler, MessageHandler, filters, ContextTypes
+
+BOT_TOKEN = os.environ.get("TELEGRAM_BOT_TOKEN", "")
+API_BASE = os.environ.get("TELEGRAM_BOT_APIBASE", "api.telegram.org")
+ALLOWED_USERS = [int(u.strip()) for u in os.environ.get("ALLOWED_USERS", "973904286").split(",") if u.strip().isdigit()]
+LLM_BASE = os.environ.get("LLM_AMAN_BASE_URL", "https://llm.aman.ltd/v1")
+LLM_KEY = os.environ.get("LLM_AMAN_API_KEY", "")
+DEFAULT_MODEL = os.environ.get("DEFAULT_MODEL", "gemini-3.8-flash-high")
+WORKSPACE = os.environ.get("WORKSPACE", "/data/workspace")
+
+if not BOT_TOKEN:
+    print("TELEGRAM_BOT_TOKEN not configured. Exiting.")
+    sys.exit(0)
+
+# In-memory per-user chat history
+HISTORIES = {}
+CURRENT_MODELS = {}
+
+TOOLS = [
+    {
+        "type": "function",
+        "function": {
+            "name": "bash",
+            "description": "Execute a shell command in the persistent /data/workspace directory.",
+            "parameters": {
+                "type": "object",
+                "properties": {
+                    "command": {"type": "string", "description": "The shell command to run"}
+                },
+                "required": ["command"]
+            }
+        }
+    }
+]
+
+def run_bash(cmd: str) -> str:
+    try:
+        res = subprocess.run(cmd, shell=True, cwd=WORKSPACE, capture_output=True, text=True, timeout=120)
+        out = (res.stdout + res.stderr).strip()
+        return out if out else "(command produced no output, exit 0)"
+    except subprocess.TimeoutExpired:
+        return "Error: Command timed out after 120 seconds."
+    except Exception as e:
+        return f"Error executing command: {e}"
+
+async def call_llm(user_id: int, user_msg: str) -> str:
+    model = CURRENT_MODELS.get(user_id, DEFAULT_MODEL)
+    history = HISTORIES.setdefault(user_id, [
+        {"role": "system", "content": f"You are Avi, an expert software engineer and reverse-engineering assistant on a dedicated Linux development server. You have full terminal access via the bash tool. Working directory is {WORKSPACE}. Answer concisely and accurately. Use your tools to inspect, build, and debug."}
+    ])
+    history.append({"role": "user", "content": user_msg})
+    
+    # Cap history to last 16 messages
+    if len(history) > 17:
+        history = [history[0]] + history[-16:]
+        HISTORIES[user_id] = history
+
+    headers = {"Authorization": f"Bearer {LLM_KEY}", "Content-Type": "application/json"}
+    payload = {
+        "model": model,
+        "messages": history,
+        "tools": TOOLS,
+        "temperature": 0.2
+    }
+
+    async with httpx.AsyncClient(timeout=60.0) as client:
+        for _ in range(5):  # Tool call loop up to 5 turns
+            try:
+                resp = await client.post(f"{LLM_BASE}/chat/completions", headers=headers, json=payload)
+                if resp.status_code != 200:
+                    return f"API Error {resp.status_code}: {resp.text[:300]}"
+                data = resp.json()
+                msg = data["choices"][0]["message"]
+            except Exception as e:
+                return f"LLM error: {e}"
+
+            tool_calls = msg.get("tool_calls")
+            if not tool_calls:
+                reply = msg.get("content", "")
+                history.append({"role": "assistant", "content": reply})
+                return reply
+
+            # Handle tool calls
+            history.append(msg)
+            for tc in tool_calls:
+                fn_name = tc["function"]["name"]
+                try:
+                    fn_args = json.loads(tc["function"]["arguments"])
+                except Exception:
+                    fn_args = {}
+                if fn_name == "bash":
+                    cmd = fn_args.get("command", "")
+                    output = run_bash(cmd)
+                else:
+                    output = f"Unknown tool {fn_name}"
+
+                history.append({
+                    "role": "tool",
+                    "tool_call_id": tc["id"],
+                    "content": output[:8000]
+                })
+
+    return "Reached maximum tool execution turns."
+
+async def handle_start(update: Update, context: ContextTypes.DEFAULT_TYPE) -> None:
+    user_id = update.effective_user.id
+    if ALLOWED_USERS and user_id not in ALLOWED_USERS:
+        return
+    model = CURRENT_MODELS.get(user_id, DEFAULT_MODEL)
+    await update.message.reply_text(
+        f"Avi online.\nModel: {model} (via {LLM_BASE})\nWorkspace: {WORKSPACE}\nSend a message to start coding or running commands."
+    )
+
+async def handle_model(update: Update, context: ContextTypes.DEFAULT_TYPE) -> None:
+    user_id = update.effective_user.id
+    if ALLOWED_USERS and user_id not in ALLOWED_USERS:
+        return
+    args = context.args
+    if not args:
+        cur = CURRENT_MODELS.get(user_id, DEFAULT_MODEL)
+        await update.message.reply_text(f"Current model: {cur}\nUsage: /model <name>\nPopular: gemini-3.8-flash-high, deepseek-v4-flash, Codestral, Devstral 2, gpt-oss:120b")
+        return
+    new_model = args[0]
+    CURRENT_MODELS[user_id] = new_model
+    await update.message.reply_text(f"Model switched to: {new_model}")
+
+async def handle_clear(update: Update, context: ContextTypes.DEFAULT_TYPE) -> None:
+    user_id = update.effective_user.id
+    HISTORIES[user_id] = []
+    await update.message.reply_text("Conversation history cleared.")
+
+async def handle_message(update: Update, context: ContextTypes.DEFAULT_TYPE) -> None:
+    user_id = update.effective_user.id
+    if ALLOWED_USERS and user_id not in ALLOWED_USERS:
+        return
+    text = update.message.text
+    if not text:
+        return
+    await context.bot.send_chat_action(chat_id=update.effective_chat.id, action="typing")
+    reply = await call_llm(user_id, text)
+    # Split long replies to Telegram 4096 limit
+    for chunk in [reply[i:i+4000] for i in range(0, len(reply), 4000)]:
+        await update.message.reply_text(chunk)
+
+def main():
+    builder = Application.builder()
+    builder.token(BOT_TOKEN)
+    if API_BASE and API_BASE != "api.telegram.org":
+        builder.base_url(f"https://{API_BASE}/bot")
+        builder.base_file_url(f"https://{API_BASE}/file/bot")
+
+    app = builder.build()
+    app.add_handler(CommandHandler("start", handle_start))
+    app.add_handler(CommandHandler("model", handle_model))
+    app.add_handler(CommandHandler("clear", handle_clear))
+    app.add_handler(CommandHandler("reset", handle_clear))
+    app.add_handler(MessageHandler(filters.TEXT & ~filters.COMMAND, handle_message))
+
+    print(f"Starting Avi Telegram agent using {API_BASE}...")
+    app.run_polling()
+
+if __name__ == "__main__":
+    main()