@bytesbrains/pi-telegram-bridge 1.2.0 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytesbrains/pi-telegram-bridge",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Telegram bot bridge for pi agents — send messages, ask questions, and listen for human replies via Telegram.",
   "keywords": [
     "pi-package",

package/src/helpers.ts

@@ -151,7 +151,7 @@ export async function sendPhoto(
 	const token = getToken();
 	const formData = new FormData();
 	formData.set("chat_id", getChatId());
-	const blob = new Blob([fileData] as any);
+	const blob = new Blob([fileData]);
 	formData.set("photo", blob, filename);
 	if (caption) {
 		formData.set("caption", caption);

package/src/templates.ts

@@ -12,10 +12,7 @@ const BAR = "━".repeat(20);
 
 /** Escape user text for safe embedding inside HTML tags. */
 function escapeHtml(s: string): string {
-	return s
-		.replace(/&/g, "&")
-		.replace(/</g, "&lt;")
-		.replace(/>/g, "&gt;");
+	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 
 function bold(s: string) {
@@ -31,7 +28,7 @@ function strike(s: string) {
 	return `<s>${escapeHtml(s)}</s>`;
 }
 function labelValue(label: string, value: string) {
-	return `${bold(label + ":")} ${escapeHtml(value)}`;
+	return `${bold(label + ":")} ${value}`;
 }
 function link(url: string, text: string) {
 	return `<a href="${url}">${escapeHtml(text)}</a>`;
@@ -257,7 +254,7 @@ export function ciPipeline(p: CIPipeline): string {
 	msg += `${BAR}\n`;
 	msg += labelValue("Run", `#${p.runNumber}`) + "\n";
 	msg += labelValue("Branch", code(p.branch)) + "\n";
-	msg += labelValue("Trigger", p.event) + "\n";
+	msg += labelValue("Trigger", escapeHtml(p.event)) + "\n";
 	if (p.triggeredBy) msg += labelValue("By", code(p.triggeredBy)) + "\n";
 	msg += `${BAR}\n`;