@inetafrica/open-claudia 1.4.2 → 1.4.4

package/bot.js

@@ -475,7 +475,7 @@ ${lastSessionId ? "Resuming conversation — you have prior context." : "New con
 - For long output (logs, diffs, large code), save to a file and send via the Telegram API curl above — don't paste walls of text.
 - Act on screenshots (fix bugs, implement designs) — don't just describe what you see.
 - When the user sends a file, it's saved in ${FILES_DIR}. Read it with the Read tool.
-- When asked to remember credentials, tell the user to use /vault.
+- When the user sends a credential, token, or API key, store it in the vault immediately using the vault CLI or bot commands. Tell them it's stored and that you've deleted their message for security. Don't tell them to use /vault manually — handle it for them.
 - When asked to change your personality, edit ${SOUL_FILE}.
 - When asked about yourself, you are Open Claudia — an AI coding assistant running Claude Code via Telegram.
 - If a task will take a while, let the user know upfront.
@@ -636,7 +636,7 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
   streamInterval = setInterval(async () => {
     bot.sendChatAction(CHAT_ID, "typing");
     const elapsed = Math.floor((Date.now() - startTime) / 1000);
-    const display = formatProgress(assistantText, toolUses, currentTool);
+    const display = formatProgress(assistantText, toolUses, currentTool, elapsed);
     if (display && display !== lastUpdate) {
       if (!statusMessageId && assistantText) {
         statusMessageId = await send(display.length > 4000 ? display.slice(-4000) : display, { replyTo: replyToMsgId });
@@ -676,11 +676,8 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
     clearInterval(streamInterval); streamInterval = null;
     const finalText = assistantText || "(no output)";
     const chunks = splitMessage(finalText);
-    // Delete the streaming progress message and send final result as new message(s)
+    // Keep the streaming progress message and send final result as a new message
     // This ensures the user gets a notification for the final answer
-    if (statusMessageId) {
-      await deleteMessage(statusMessageId);
-    }
     await send(chunks[0], { replyTo: replyToMsgId });
     for (let i = 1; i < chunks.length; i++) {
       await send(chunks[i]);
@@ -727,13 +724,17 @@ async function runClaudeSilent(prompt, cwd, label) {
   });
 }
 
-function formatProgress(text, tools, currentTool) {
+function formatProgress(text, tools, currentTool, elapsed) {
+  const mins = Math.floor(elapsed / 60);
+  const secs = elapsed % 60;
+  const time = mins > 0 ? `${mins}m ${secs}s` : `${secs}s`;
+
   const parts = [];
-  if (currentTool) parts.push(`Tool: ${currentTool}`);
-  if (tools.length > 0) parts.push(`Used: ${[...new Set(tools)].join(", ")}`);
+  const status = currentTool ? `Working: ${currentTool}` : (tools.length > 0 ? "Processing..." : "Thinking...");
+  parts.push(`${status} (${time})`);
+  if (tools.length > 0) parts.push(`Steps: ${[...new Set(tools)].join(" > ")}`);
   if (text) parts.push(text.length > 800 ? "..." + text.slice(-800) : text);
-  else parts.push("Thinking...");
-  return parts.join("\n\n") || "Thinking...";
+  return parts.join("\n\n");
 }
 
 // ── Cron System ─────────────────────────────────────────────────────
@@ -1228,6 +1229,18 @@ bot.on("message", async (msg) => {
   // Normal message
   if (!requireSession(msg)) return;
 
+  // Detect credential-like messages and delete them from chat
+  const text = msg.text;
+  const credPatterns = [
+    /^(sk-ant-|sk-|glpat-|ghp_|gho_|github_pat_|xoxb-|xoxp-|AKIA|AIza)/,  // API keys
+    /^[A-Za-z0-9_-]{20,}$/,  // Long token-like strings with no spaces
+    /^(Bearer |token:|key:|secret:|password:)/i,  // Prefixed credentials
+  ];
+  const looksLikeCredential = credPatterns.some((p) => p.test(text.trim()));
+  if (looksLikeCredential) {
+    await deleteMessage(msg.message_id);
+  }
+
   let prompt = msg.text;
   const reply = msg.reply_to_message;
   if (reply) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "description": "Your always-on AI coding assistant — Claude Code via Telegram",
   "main": "bot.js",
   "bin": {