feat(plugins): add claude-tunnels multi-project orchestration plugin

[matteblack9]

Summary

• Adds a claude-tunnels plugin that introduces a Project Orchestrator (PO) layer on top of the Claude Code CLI.
• Routes tasks from Slack, Telegram, or Microsoft Teams to the correct project, builds dependency-aware phased execution plans, and delegates each task to an isolated Claude session scoped to that workspace’s .claude/ context.
• Scales to an unlimited number of projects and workspaces through a single channel integration.

Problem

Running Claude Code across multiple projects currently requires manually switching between sessions and workspaces. There is no built-in way to:

• receive tasks from team communication channels and route them to the correct project
• orchestrate multi-workspace execution with dependency ordering
• isolate each workspace in its own session with its own .claude/ context
• log execution results with a structured audit trail

How it works

Micro-Agent Architecture (MAA) — decomposes a single AI session into independently operating micro-agents:

1. Channel Adapters receive messages from Slack, Telegram, or Teams.

2. ConfirmGate requires explicit user approval before execution begins.

3. Router (Sonnet) identifies the target project from natural-language input.

4. Project Orchestrator (Opus) reads CLAUDE.md, analyzes dependencies, and builds a phased execution plan.

5. Executor runs workspaces phase by phase:

   • Within a phase: parallel execution via asyncio.gather
   • Across phases: sequential execution with upstream context handoff
   • Each workspace spawns a fresh Claude session with cwd=workspace/

6. Task Logger records results in .tasks/ with 30-day retention.

Security

• XML tag isolation for user input
• Path traversal prevention for workspace names
• Prompt injection defenses
• Downstream context sanitization with a 1000-character limit
• Credentials stored in ARCHIVE/ and excluded from commits

Commands provided

Command	Purpose
/setup-orchestrator	Full installation wizard
/connect-slack	Add a Slack channel via Socket Mode
/connect-telegram	Add a Telegram channel via long polling
/connect-teams	Add a Teams channel via Bot Framework
/setup-remote-project	Deploy an SSH listener to a remote host
/setup-remote-workspace	Connect a Kubernetes pod workspace

Test plan

• Install plugin and run /setup-orchestrator — verify generated configuration
• Connect Slack adapter and send a message — verify routing and execution
• Connect Telegram adapter and send a message — verify routing and execution
• Connect Teams adapter and send a message — verify routing and execution
• Run phased multi-workspace execution — verify intra-phase parallelism and upstream context handoff
• ConfirmGate — verify that user confirmation is required before execution
• Task logging — verify correctly structured entries in .tasks/
• Run claude plugin validate plugins/claude-tunnels — pass validation

Related Issues: #38044 #38698 #29086 #11455 #24798

Also available as a standalone tool: https://github.com/matteblack9/claude-code-tunnels