Response includes raw SSE events (output, rate_limit_event) in Telegram messages

[eisen0419]

Description

When Claude Code responds via HAPI Telegram bot, the end of each message includes raw JSON from internal SSE stream events that should be filtered out.

Reproduction

1. Send a message to the HAPI Telegram bot
2. Wait for Claude Code to respond
3. The response text is correct, but at the end, raw JSON objects are appended

Expected Behavior

Only the assistant's text content should be forwarded to Telegram. Internal SSE control events should be filtered out.

Actual Behavior

Two types of internal events leak into the visible message:

{"type": "output", "data": {"parentUuid": "...", "isSidechain": false, "userType": "external", "cwd": "...", "sessionId": "...", "version": "0.0.0", "uuid": "...", "timestamp": "..."}}

{"type": "rate_limit_event", "rate_limit_info": {"status": "allowed", "resetsAt": ..., "rateLimitType": "five_hour", "overageStatus": "rejected", "overageDisabledReason": "org_level_disabled", "isUsingOverage": false, "session_id": "..."}}

Screenshot

(See attached screenshot showing the leaked JSON at the end of a normal response)

Environment

• HAPI version: 0.16.5
• Platform: macOS (darwin-arm64)
• Claude model: Opus 4.6

[github-actions]

I checked the current codebase and the v0.16.5 tag.

What I could verify:

• The Telegram bot code in this repo is notification-only. It handles /start, /app, ready notifications, and permission notifications, but I could not find a code path here that forwards Claude assistant replies as plain Telegram chat messages.
• The leaked objects in your report do match HAPI's internal Claude message envelope shape. Non-user Claude records are wrapped as role: 'agent' with content.type: 'output' and the raw Claude payload stored under content.data.
• The web chat already filters non-visible Claude output records before rendering, using the shared visibility rules.
• The notification hub only reacts to event envelopes such as ready; it does not render assistant text from message-received events.

Relevant code:

• hub/src/telegram/bot.ts:111 - bot commands are /app and /start
• hub/src/telegram/bot.ts:190 - ready notification sender
• hub/src/telegram/bot.ts:221 - permission notification sender
• cli/src/api/apiSession.ts:364 - Claude messages are wrapped into content.type = 'output'
• web/src/chat/normalizeAgent.ts:208 - web chat filters/skips non-visible output records
• shared/src/messages.ts:41 - shared Claude visibility rules
• hub/src/notifications/notificationHub.ts:57 - notification hub only reacts to ready events
• hub/src/notifications/eventParsing.ts:26 - extracts event types from event envelopes only

Need more info:

• Does the leaked JSON appear in a normal bot chat message, or inside the Telegram Mini App session view?
• Can you share one full redacted leaked Telegram message, including the assistant text before the appended JSON?
• Are you running the published 0.16.5 release binary, or a custom build from source?

---

HAPI Bot