I do a similar thing where the agent runs in a Docker container and I talk to it with Telegram. It has GitHub CLI access but only with a very restricted PAT. No bind mounts. Jira is pretty clever, though I'm not feeling enough pain with just Telegram to want to try switching at this point.