#58 Telegram progress bubble echoes raw tool output into chat history

[Anonymous]

Originally created by: sosidudku1

The live progress indicator shipped in v0.1.69 echoes step_finished.summary into the status bubble. That summary is built from the tail of the tool's raw output, so a step that reads a config file or greps a repo can put a file path, a grep hit or a key fragment into the bubble text, clipped to 80 chars, which is short for prose but plenty for a secret.

The chat is the operator's own bot DM, but the text still transits and persists in Telegram's cloud, notification previews can surface it on a lock screen, and if the process dies mid-turn the bubble is never deleted and stays in forwardable history. This contradicts the local-first promise.

Also missing from the shipped indicator: disable_notification on the bubble (every message currently double-notifies), a config kill switch, and 429 retry_after backoff on edits.

Fix: [#56] (drops the summary echo entirely, builds labels from stable identifiers only, and covers the other three points).

[Anonymous]

Ticket changed by: Ooooze

• status: open --> closed