Private terminal relay

Secure command-line access, wherever the work follows you.

TeleCLI gives teams a self-hosted terminal control plane with browser access, Telegram workflows, isolated sessions, command policy, and optional AI-assisted automation.

FastAPI WebSocket Telegram AI proxy
telecli://session/ops

$ telecli connect --session deploy-prod

✓ isolated pexpect session ready

$ policy check "systemctl restart api"

↳ approval required from Telegram operator

$ ai-proxy summarize last-run.log

✓ incident brief prepared for review

$

Session isolation One terminal context per user, browser, or Telegram operator.
Policy-first Authentication, allowlists, and audit-ready logging by default.
Remote-native Designed for tunnels, mobile operators, and resilient WebSockets.
Platform

A terminal bridge built for real operations, not demos.

TeleCLI keeps the control surface lightweight while giving operators the primitives they need to act quickly and safely.

01 / Browser console

Full web terminal with persistent session state.

Launch, resize, reset, and reconnect terminals through a responsive WebSocket UI that preserves context through mobile and tunnel interruptions.

02 / Telegram ops

Operate from chat.

Route commands, receive output, and manage sessions from Telegram when a browser is not the fastest surface.

03 / AI assist

Optional LLM proxy.

Let trusted local CLI providers summarize output, propose next steps, and monitor long-running command workflows.

04 / Configured by environment
AUTH_TOKEN=••••••
ALLOWED_COMMANDS_ONLY=true
TERMINAL_SHELL=/bin/bash
AI_PROXY_ENABLED=false
Security model

Guardrails for machines that should never become public toys.

Auth

Token-gated WebSocket access

Require an authentication token before attaching any browser client to a terminal session.

Policy

Command allowlisting

Restrict execution to approved commands when you need a narrow operational surface.

Audit

Structured logging

Capture operational events with rotation-ready logs that stay out of application code.

Operational flow

From browser to bot to shell, every session stays traceable.

  1. 01Authenticate

    Clients attach with a configured token and a generated session identity.

  2. 02Execute

    Terminal input is routed to an isolated pexpect or tmux-backed session.

  3. 03Observe

    Output streams back to browser and Telegram surfaces with reconnect handling.

  4. 04Assist

    Optional AI proxy modes help interpret output without taking over policy.

Deploy your control plane

Self-host TeleCLI behind the network boundary you trust.

Run locally, behind a Cloudflare tunnel, or as part of your internal operations stack. The marketing site is served from Cloudflare Pages; your terminal runtime stays under your control.