Open source · MIT · v3.1.1 · experimental
TAS is an experimental local-first CLI with AES-256-GCM content encryption, resumable 19 MiB chunks, encrypted index recovery, native FUSE mount, sync, and multi-bot routing. It is not an unlimited-storage or durability service.
npm i -g @nightowne/tas-cli
copy
I had a tax spreadsheet, a folder of scanned contracts, and a growing paranoia about what Google does with files sitting in Drive. They scan them. It's in the terms. They scan your documents to serve you better ads. That's the deal.
Dropbox wants twelve dollars a month. iCloud is fine if you live inside Apple's ecosystem and don't mind another monthly charge. Mega gives you 20 gigs for free with closed-source encryption — you're trusting a company in New Zealand that's been through multiple ownership changes to keep your files safe and honest.
I started exploring whether an existing messaging API could act as an encrypted blob transport. Telegram's Bot API can send documents, but it provides TAS no storage quota, retention SLA, recovery service, or promise that bots/accounts will remain available.
So I wrote a CLI that compresses files, encrypts them locally with AES-256-GCM, splits them into 19 MiB payload chunks, and uploads them to bot chats. New chunks omit the user filename and original size from Telegram-visible fields. Telegram still observes timing, bot/chat identity, encrypted sizes, and chunk counts.
That was the first version. Then I added FUSE mounting so you can drag files in like a regular folder. Then folder sync, so changes upload automatically. Then expiring share links with a download page. Then resume for interrupted uploads, integrity verification, JSON output for scripting, and a diagnostics command. It became a real tool.
This does not replace proper backups. Telegram is a messaging app, not a storage provider, and its current Bot Developer Terms may restrict cloud-storage use cases. Use TAS at your own risk and only alongside a tested independent backup.
Every file goes through the same pipeline before it touches the network.
Downloads reverse the process into a private temporary file. TAS verifies the SHA-256 hash before replacing the destination, so a failed or corrupted transfer does not overwrite a good local copy.
What Telegram sees in your bot chat
chunk-000000.tas — 12.4 MB — tas:c1:42:1/2
No user filename or original size. Encrypted content; traffic metadata remains visible.
Run tas mount ~/cloud on a validated Linux/libfuse host or a Mac with current macFUSE and Xcode Command Line Tools. Desktop and SMB metadata operations are supported. Service access stays opt-in with --allow-other; nested sync paths are real virtual directories and writes are disk-backed.
Register a directory with tas sync add and TAS watches for changes. On startup it resumes valid staged uploads, reports scan and verification progress, then uploads new and modified files with debouncing. Startup remains interruptible with Ctrl+C.
Generate a one-time download URL that expires after a set duration or download count. TAS spins up a local HTTP server and decrypts on-the-fly. The recipient gets the file. They never get your password.
Organize files with arbitrary tags. Search by name or tag with fuzzy matching. All metadata lives in a local SQLite database — fast, offline, and yours.
Connection dropped at chunk 14 of 20? tas sync start picks up from chunk 15 before its next scan. Use tas resume --yes for a standalone non-interactive recovery run.
tas list --json and tas status --json output machine-readable data. Pipe to jq, parse in scripts, feed into dashboards. First-class automation support.
Every download verifies the SHA-256 hash against the original. tas verify checks all stored files at once. If Telegram lost or corrupted a message, you'll know immediately.
tas doctor checks your Node.js version, config format, database health, disk space, FUSE availability, and encryption parameters. One command tells you if anything is wrong.
The encryption is real, auditable, and open source. Here's exactly what happens to your data.
TeleDrive gives you a web UI for Telegram storage. Various Python scripts on GitHub do basic upload/download. rclone can mount Telegram as a backend with some configuration. restic and BorgBackup are serious backup tools that TAS borrows reliability patterns from.
TAS is different because it's a purpose-built CLI for Telegram-as-storage with end-to-end encryption, FUSE mount, folder sync, share links, resume, and integrity verification in one package. It handles Telegram's API quirks — the 50 MB chunk limit, rate limiting, 429 retries — so you don't have to.
Where TAS falls short: no file versioning (yet), no web UI, no multi-user support, and the fundamental limitation that Telegram is a messaging platform that can delete your content. Google Drive and Dropbox have SLA-backed reliability. TAS doesn't. Be honest about your threat model.
# Install npm install -g @nightowne/tas-cli # Setup wizard — creates a Telegram bot, sets your password, links your account tas init # Upload tas push document.pdf # Download (decrypts + verifies hash) tas pull document.pdf # Mount as a folder tas mount ~/cloud # Sync a directory tas sync add ~/Documents && tas sync start # Headless sync without exposing the password in the process list tas sync start --password-file ~/.config/tas/password # Share with an expiring link tas share create document.pdf --expire 1h # Automation mode export TAS_PASSWORD="your-password" tas list --json | jq '.[].filename'
TAS is MIT-licensed and charges no service fee. Telegram does not promise TAS an unlimited quota, retention, durability, or continued account access. Do not use TAS as your only backup.
File content is encrypted locally with AES-256-GCM. Telegram cannot read that plaintext without the password, but it still observes traffic metadata and controls the bot account and messages.
TAS cannot decrypt the content or recovery manifest without the password. Store it securely and separately from config.json.
TAS does not promise an unlimited file or vault size. It splits streams into 19 MiB payload chunks so hosted Bot API downloads remain possible; practical scale depends on local disk, SQLite, network time, Telegram limits, and provider retention.
Run tas doctor. For legacy chunks, operate a local Telegram Bot API server and configure the owning bot with tas bot endpoint http://127.0.0.1:8081 --bot primary. The endpoint receives the bot token and file traffic, so it must be a server you administer.
There is real policy risk. Telegram's current Bot Developer Terms restrict external cloud-storage use cases and rate-limit circumvention and permit termination. Multiple bots do not remove that risk. Use TAS at your own risk.
Great tools — TAS borrows patterns from both. But TAS is purpose-built for Telegram: it handles the 50 MB limit, Bot API rate limiting, and provides Telegram-specific features like share links. If you want cloud-agnostic backup, use restic.
CLI operations work where Node.js and native dependencies are supported. FUSE needs Linux libfuse or current macFUSE with Xcode Command Line Tools. Run tas doctor and mount only after its real smoke test passes.
No corporation reading your documents. No monthly invoice. Just a CLI and a Telegram bot.