@gonzih/cc-tg 0.2.11 → 0.2.13

package/dist/bot.d.ts

@@ -39,6 +39,7 @@ export declare class CcTgBot {
     private handleMcpVersion;
     private handleClearNpxCache;
     private handleRestart;
+    private handleGetFile;
     private killSession;
     stop(): void;
 }

package/dist/bot.js

@@ -3,10 +3,10 @@
  * One ClaudeProcess per chat_id — sessions are isolated per user.
  */
 import TelegramBot from "node-telegram-bot-api";
-import { existsSync, createWriteStream, mkdirSync } from "fs";
+import { existsSync, createWriteStream, mkdirSync, statSync } from "fs";
 import { resolve, basename, join } from "path";
 import os from "os";
-import { execSync, spawn } from "child_process";
+import { execSync } from "child_process";
 import https from "https";
 import http from "http";
 import { ClaudeProcess, extractText } from "./claude.js";
@@ -23,6 +23,7 @@ const BOT_COMMANDS = [
     { command: "mcp_version", description: "Show cc-agent npm version and npx cache info" },
     { command: "clear_npx_cache", description: "Clear npx cache and restart MCP to pick up latest version" },
     { command: "restart", description: "Restart the bot process in-place" },
+    { command: "get_file", description: "Send a file from the server to this chat" },
 ];
 const FLUSH_DELAY_MS = 800; // debounce streaming chunks into one Telegram message
 const TYPING_INTERVAL_MS = 4000; // re-send typing action before Telegram's 5s expiry
@@ -138,6 +139,11 @@ export class CcTgBot {
             await this.handleRestart(chatId);
             return;
         }
+        // /get_file <path> — send a file from the server to the user
+        if (text.startsWith("/get_file")) {
+            await this.handleGetFile(chatId, text);
+            return;
+        }
         const session = this.getOrCreateSession(chatId);
         try {
             session.claude.sendPrompt(text);
@@ -434,6 +440,13 @@ export class CcTgBot {
                 console.log(`[claude:files] skipping sensitive file: ${filePath}`);
                 continue;
             }
+            const fileSize = statSync(filePath).size;
+            const MAX_TG_FILE_BYTES = 50 * 1024 * 1024;
+            if (fileSize > MAX_TG_FILE_BYTES) {
+                const mb = (fileSize / (1024 * 1024)).toFixed(1);
+                this.bot.sendMessage(chatId, `File too large for Telegram (${mb}mb). Find it at: ${filePath}`).catch(() => { });
+                continue;
+            }
             console.log(`[claude:files] uploading to telegram: ${filePath}`);
             this.bot.sendDocument(chatId, filePath).catch((err) => console.error(`[tg:${chatId}] sendDocument failed for ${filePath}:`, err.message));
         }
@@ -649,22 +662,44 @@ export class CcTgBot {
         await this.bot.sendMessage(chatId, `NPX cache cleared and MCP restarted.${pidNote} Will pick up latest npm version on next call.`);
     }
     async handleRestart(chatId) {
-        await this.bot.sendMessage(chatId, "Restarting bot... brb.");
-        await new Promise(resolve => setTimeout(resolve, 1000));
-        this.stop();
-        const isLaunchd = process.ppid === 1;
-        if (!isLaunchd) {
-            // Running manually — spawn a replacement process
-            const child = spawn(process.execPath, process.argv.slice(1), {
-                detached: true,
-                stdio: "ignore",
-                env: process.env,
-            });
-            child.unref();
-        }
-        // If launchd-managed, just exit — launchd will restart us
+        await this.bot.sendMessage(chatId, "Restarting... brb.");
+        await new Promise(resolve => setTimeout(resolve, 500));
         process.exit(0);
     }
+    async handleGetFile(chatId, text) {
+        const arg = text.slice("/get_file".length).trim();
+        if (!arg) {
+            await this.bot.sendMessage(chatId, "Usage: /get_file <path>");
+            return;
+        }
+        const filePath = resolve(arg);
+        const safeDirs = ["/tmp/", "/var/folders/", os.homedir() + "/Downloads/", this.opts.cwd ?? process.cwd()];
+        const inSafeDir = safeDirs.some(d => filePath.startsWith(d));
+        if (!inSafeDir) {
+            await this.bot.sendMessage(chatId, "Access denied: path not in allowed directories");
+            return;
+        }
+        if (!existsSync(filePath)) {
+            await this.bot.sendMessage(chatId, `File not found: ${filePath}`);
+            return;
+        }
+        if (!statSync(filePath).isFile()) {
+            await this.bot.sendMessage(chatId, `Not a file: ${filePath}`);
+            return;
+        }
+        if (this.isSensitiveFile(filePath)) {
+            await this.bot.sendMessage(chatId, "Access denied: sensitive file");
+            return;
+        }
+        const MAX_TG_FILE_BYTES = 50 * 1024 * 1024;
+        const fileSize = statSync(filePath).size;
+        if (fileSize > MAX_TG_FILE_BYTES) {
+            const mb = (fileSize / (1024 * 1024)).toFixed(1);
+            await this.bot.sendMessage(chatId, `File too large for Telegram (${mb}mb). Find it at: ${filePath}`);
+            return;
+        }
+        await this.bot.sendDocument(chatId, filePath);
+    }
     killSession(chatId, keepCrons = true) {
         const session = this.sessions.get(chatId);
         if (session) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gonzih/cc-tg",
-  "version": "0.2.11",
+  "version": "0.2.13",
   "description": "Claude Code Telegram bot — chat with Claude Code via Telegram",
   "type": "module",
   "bin": {