What Does It Take to Give a Chat AI Nine Tools and Your Home Directory? A 50-Line Bot That Grew to 850

Episode 2 of One Man One Legion, opening the cockpit arc. Episode 16 tells where this bot’s supervision lessons migrated next; the map holds the series together.

Every legion needs a doorway. This one is a Telegram bot: type a message, GLM-5.2 thinks, and nine tools execute on a real Linux home directory — read, grep, edit, write, run commands, search and fetch the web, pull RSS. The README still calls it “~50 lines of code,” and that was true once. The file on disk today is 850 lines, and the difference between those two numbers is the actual story of this episode: what it costs, in code, to let a chat model touch your filesystem without regretting it.

The premise: one protocol, one credential, one chat window

The bot speaks the Anthropic protocol to a GLM-5.2 endpoint — the same coding-plan credential a Claude Code CLI uses, so the “brain” is a cloud model billed like a coding assistant, not a bespoke integration. A chat message becomes a tool loop: the model may chain up to 15 tool iterations per turn, which is what lets “find the failing test and fix it” run as read → grep → edit → exec → read, unattended. The nine tools:

Tool	Guard behavior
read_file	Wrong path falls back to a filename search instead of erroring out
glob / grep	Bounded result sizes
edit	Exact-match old_string required — no whole-file rewrites
write_file	Jailed to the work directory
exec_command	Blocklist: rm -rf, sudo, mkfs, dd of= intercepted
web_search / web_fetch / rss_fetch	Read-only externals, capped output

The 800 lines that grew after the failures

The README’s own section header for all of this is “safety and robustness — added gradually, after stepping in holes.” What got added, and why each exists:

• The work-directory jail, with prefix-spoof protection. Every file tool refuses paths outside one directory — including /home/user-evil-style prefixes that would textually pass a naive startswith check. The check resolves real boundaries, not string prefixes.
• The dangerous-command blocklist. The model mostly proposes reasonable commands; the one time it doesn’t, interception is cheap and a restore from a bad rm is not.
• Exact-match edits. Early versions let the model rewrite whole files, which converted small mistakes into large ones. Forcing “point at exactly this string” keeps blast radius proportional to intent.
• Path fallback on reads. A wrong path used to stall the loop with an error the model would then narrate instead of fixing. Now the tool searches by filename and hands back something usable.

The philosophy line in the README could have been lifted from the mini-agent docs of episode 16: tolerant tools, bounded environment — the brain is the model’s; how much of it you actually get is the harness. The two projects traded lessons in both directions — the bot’s dead-process incident (found 14 hours after exit) is what taught the daemon-first diagnostic habit that the mini-agent later inherited as step one.

Operations: what “reliable” means at personal scale

The bot runs as a systemd user unit: 5-second crash restart, lingering enabled so it survives without a login session. Its log has grown to 168,996 lines — and the honest detail worth publishing is that the log’s tail is a live NetworkError: server disconnected trace. At personal scale, “reliable” is not the absence of failures; it is crash-restart hygiene plus a log you can actually read. No uptime claims are made here — the evidence would laugh.

What we claim and what we don’t

Line counts and tool lists are from the source on disk (850 lines, 9 tools, 15-iteration cap, 5-second restart). The “~50-line origin” is the README’s own account of the starting point, not an independently reconstructable measurement. The log-line count measures chatter, not messages or tasks — no throughput is claimed. One whitelisted user, by design: this is a personal gateway, not a service.

Primary sources: bot.py (850 lines, tool definitions and guards as cited), the project README (origin narrative, design philosophy), and bot.log (168,996 lines incl. the terminal NetworkError), 2026-08.

Measured 2026-08-27 from source and logs. License: CC BY 4.0 — cite the source URL.

Next in the cockpit arc: the runtime this bot’s philosophy grew into — twelve chat groups, trigger words, and a scheduler that once ran 22 jobs. Back to the series map.