@gonzih/cc-tg 0.2.4 → 0.2.5

package/README.md

@@ -53,6 +53,8 @@ Message [@userinfobot](https://t.me/userinfobot) on Telegram — it replies with
 | `/cron clear` | Remove all cron jobs |
 | Any text | Sent directly to Claude Code |
 | Voice message | Transcribed via whisper.cpp and sent to Claude |
+| Photo | Sent as native image input to Claude (base64 content block) |
+| Document / file | Downloaded to `<CWD>/.cc-tg/uploads/`, path passed to Claude as `ATTACHMENTS: [name](path)` |
 
 ## Features
 
@@ -62,6 +64,12 @@ Each Telegram chat ID gets its own isolated Claude Code subprocess. Sessions sur
 ### Voice messages
 Send a voice message → automatically transcribed via whisper.cpp → fed into Claude as text. Requires `whisper-cpp` and `ffmpeg` installed on the host.
 
+### Images
+Send a photo → downloaded and base64-encoded → sent to Claude as a native image content block via the stream-JSON protocol. Claude sees the full image, no intermediate vision step. Caption (if any) is included as text alongside the image.
+
+### Documents
+Send any file as a document → downloaded to `<CWD>/.cc-tg/uploads/<filename>` → Claude receives the path as `ATTACHMENTS: [filename](path)` and can read/process it directly. Works for PDFs, CSVs, code files, etc.
+
 ### File delivery
 When Claude writes a file and mentions it in the response, the bot automatically uploads it to Telegram. Hybrid detection: tracks `Write`/`Edit` tool calls during the session, cross-references with filenames mentioned in the final response.
 

package/dist/bot.d.ts

@@ -25,6 +25,7 @@ export declare class CcTgBot {
     private stopTyping;
     private flushPending;
     private trackWrittenFiles;
+    private isSensitiveFile;
     private uploadMentionedFiles;
     private extractToolName;
     private handleCron;

package/dist/bot.js

@@ -306,6 +306,16 @@ export class CcTgBot {
             session.writtenFiles.add(resolved);
         }
     }
+    isSensitiveFile(filePath) {
+        const name = basename(filePath).toLowerCase();
+        const sensitivePatterns = [
+            /credential/i, /secret/i, /password/i, /passwd/i, /\.env/i,
+            /api[_-]?key/i, /token/i, /private[_-]?key/i, /id_rsa/i,
+            /\.pem$/i, /\.key$/i, /\.pfx$/i, /\.p12$/i,
+            /gmail/i, /oauth/i, /auth/i,
+        ];
+        return sensitivePatterns.some((p) => p.test(name));
+    }
     uploadMentionedFiles(chatId, resultText, session) {
         if (session.writtenFiles.size === 0)
             return;
@@ -336,9 +346,13 @@ export class CcTgBot {
                 }
             }
         }
-        // Deduplicate
+        // Deduplicate and filter sensitive files
         const unique = [...new Set(toUpload)];
         for (const filePath of unique) {
+            if (this.isSensitiveFile(filePath)) {
+                console.log(`[claude:files] skipping sensitive file: ${filePath}`);
+                continue;
+            }
             console.log(`[claude:files] uploading to telegram: ${filePath}`);
             this.bot.sendDocument(chatId, filePath).catch((err) => console.error(`[tg:${chatId}] sendDocument failed for ${filePath}:`, err.message));
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gonzih/cc-tg",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Claude Code Telegram bot — chat with Claude Code via Telegram",
   "type": "module",
   "bin": {