@fre4x/telegram 1.1.4 → 1.1.6

package/dist/index.js

@@ -13,7 +13,11 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -3112,6 +3116,9 @@ var require_utils = __commonJS({
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+    var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
+    var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
+    var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
     function stringArrayToHexStripped(input) {
       let acc = "";
       let code = 0;
@@ -3304,27 +3311,77 @@ var require_utils = __commonJS({
       }
       return output.join("");
     }
-    function normalizeComponentEncoding(component, esc2) {
-      const func = esc2 !== true ? escape : unescape;
-      if (component.scheme !== void 0) {
-        component.scheme = func(component.scheme);
-      }
-      if (component.userinfo !== void 0) {
-        component.userinfo = func(component.userinfo);
-      }
-      if (component.host !== void 0) {
-        component.host = func(component.host);
+    var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
+    var HOST_DELIM_RE = /[@/?#:]/g;
+    var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
+    function reescapeHostDelimiters(host, isIP) {
+      const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+      re.lastIndex = 0;
+      return host.replace(re, (ch) => HOST_DELIMS[ch]);
+    }
+    function normalizePercentEncoding(input, decodeUnreserved = false) {
+      if (input.indexOf("%") === -1) {
+        return input;
       }
-      if (component.path !== void 0) {
-        component.path = func(component.path);
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            const normalizedHex = hex3.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (decodeUnreserved && isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        output += input[i];
       }
-      if (component.query !== void 0) {
-        component.query = func(component.query);
+      return output;
+    }
+    function normalizePathEncoding(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            const normalizedHex = hex3.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (decoded !== "." && isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        if (isPathCharacter(input[i])) {
+          output += input[i];
+        } else {
+          output += escape(input[i]);
+        }
       }
-      if (component.fragment !== void 0) {
-        component.fragment = func(component.fragment);
+      return output;
+    }
+    function escapePreservingEscapes(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            output += "%" + hex3.toUpperCase();
+            i += 2;
+            continue;
+          }
+        }
+        output += escape(input[i]);
       }
-      return component;
+      return output;
     }
     function recomposeAuthority(component) {
       const uriTokens = [];
@@ -3339,7 +3396,7 @@ var require_utils = __commonJS({
           if (ipV6res.isIPV6 === true) {
             host = `[${ipV6res.escapedHost}]`;
           } else {
-            host = component.host;
+            host = reescapeHostDelimiters(host, false);
           }
         }
         uriTokens.push(host);
@@ -3353,7 +3410,10 @@ var require_utils = __commonJS({
     module.exports = {
       nonSimpleDomain,
       recomposeAuthority,
-      normalizeComponentEncoding,
+      reescapeHostDelimiters,
+      normalizePercentEncoding,
+      normalizePathEncoding,
+      escapePreservingEscapes,
       removeDotSegments,
       isIPv4,
       isUUID,
@@ -3577,12 +3637,12 @@ var require_schemes = __commonJS({
 var require_fast_uri = __commonJS({
   "../node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizeComponentEncoding, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
     function normalize2(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
-        serialize(parse3(uri, options), options);
+        normalizeString(uri, options);
       } else if (typeof uri === "object") {
         uri = /** @type {T} */
         parse3(serialize(uri, options), options);
@@ -3649,19 +3709,9 @@ var require_fast_uri = __commonJS({
       return target;
     }
     function equal(uriA, uriB, options) {
-      if (typeof uriA === "string") {
-        uriA = unescape(uriA);
-        uriA = serialize(normalizeComponentEncoding(parse3(uriA, options), true), { ...options, skipEscape: true });
-      } else if (typeof uriA === "object") {
-        uriA = serialize(normalizeComponentEncoding(uriA, true), { ...options, skipEscape: true });
-      }
-      if (typeof uriB === "string") {
-        uriB = unescape(uriB);
-        uriB = serialize(normalizeComponentEncoding(parse3(uriB, options), true), { ...options, skipEscape: true });
-      } else if (typeof uriB === "object") {
-        uriB = serialize(normalizeComponentEncoding(uriB, true), { ...options, skipEscape: true });
-      }
-      return uriA.toLowerCase() === uriB.toLowerCase();
+      const normalizedA = normalizeComparableURI(uriA, options);
+      const normalizedB = normalizeComparableURI(uriB, options);
+      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA.toLowerCase() === normalizedB.toLowerCase();
     }
     function serialize(cmpts, opts) {
       const component = {
@@ -3686,12 +3736,12 @@ var require_fast_uri = __commonJS({
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
       if (component.path !== void 0) {
         if (!options.skipEscape) {
-          component.path = escape(component.path);
+          component.path = escapePreservingEscapes(component.path);
           if (component.scheme !== void 0) {
             component.path = component.path.split("%3A").join(":");
           }
         } else {
-          component.path = unescape(component.path);
+          component.path = normalizePercentEncoding(component.path);
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
@@ -3726,7 +3776,16 @@ var require_fast_uri = __commonJS({
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
-    function parse3(uri, opts) {
+    function getParseError(parsed, matches) {
+      if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
+        return 'URI path must start with "/" when authority is present.';
+      }
+      if (typeof parsed.port === "number" && (parsed.port < 0 || parsed.port > 65535)) {
+        return "URI port is malformed.";
+      }
+      return void 0;
+    }
+    function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
         scheme: void 0,
@@ -3737,6 +3796,7 @@ var require_fast_uri = __commonJS({
         query: void 0,
         fragment: void 0
       };
+      let malformedAuthorityOrPort = false;
       let isIP = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
@@ -3757,6 +3817,11 @@ var require_fast_uri = __commonJS({
         if (isNaN(parsed.port)) {
           parsed.port = matches[5];
         }
+        const parseError = getParseError(parsed, matches);
+        if (parseError !== void 0) {
+          parsed.error = parsed.error || parseError;
+          malformedAuthorityOrPort = true;
+        }
         if (parsed.host) {
           const ipv4result = isIPv4(parsed.host);
           if (ipv4result === false) {
@@ -3795,14 +3860,18 @@ var require_fast_uri = __commonJS({
               parsed.scheme = unescape(parsed.scheme);
             }
             if (parsed.host !== void 0) {
-              parsed.host = unescape(parsed.host);
+              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
             }
           }
           if (parsed.path) {
-            parsed.path = escape(unescape(parsed.path));
+            parsed.path = normalizePathEncoding(parsed.path);
           }
           if (parsed.fragment) {
-            parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+            try {
+              parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+            } catch {
+              parsed.error = parsed.error || "URI malformed";
+            }
           }
         }
         if (schemeHandler && schemeHandler.parse) {
@@ -3811,7 +3880,29 @@ var require_fast_uri = __commonJS({
       } else {
         parsed.error = parsed.error || "URI can not be parsed.";
       }
-      return parsed;
+      return { parsed, malformedAuthorityOrPort };
+    }
+    function parse3(uri, opts) {
+      return parseWithStatus(uri, opts).parsed;
+    }
+    function normalizeString(uri, opts) {
+      return normalizeStringWithStatus(uri, opts).normalized;
+    }
+    function normalizeStringWithStatus(uri, opts) {
+      const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+      return {
+        normalized: malformedAuthorityOrPort ? uri : serialize(parsed, opts),
+        malformedAuthorityOrPort
+      };
+    }
+    function normalizeComparableURI(uri, opts) {
+      if (typeof uri === "string") {
+        const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
+        return malformedAuthorityOrPort ? void 0 : normalized;
+      }
+      if (typeof uri === "object") {
+        return serialize(uri, opts);
+      }
     }
     var fastUri = {
       SCHEMES,
@@ -6878,7 +6969,7 @@ var require_main = __commonJS({
   "../node_modules/dotenv/lib/main.js"(exports, module) {
     var fs2 = __require("fs");
     var path2 = __require("path");
-    var os = __require("os");
+    var os2 = __require("os");
     var crypto = __require("crypto");
     var packageJson = require_package();
     var version2 = packageJson.version;
@@ -7001,7 +7092,7 @@ var require_main = __commonJS({
       return null;
     }
     function _resolveHome(envPath) {
-      return envPath[0] === "~" ? path2.join(os.homedir(), envPath.slice(1)) : envPath;
+      return envPath[0] === "~" ? path2.join(os2.homedir(), envPath.slice(1)) : envPath;
     }
     function _configVault(options) {
       const debug = Boolean(options && options.debug);
@@ -28144,8 +28235,10 @@ var StdioServerTransport = class {
 // src/index.ts
 var import_dotenv = __toESM(require_main(), 1);
 import { Telegraf } from "telegraf";
-import * as fs from "fs";
-import * as path from "path";
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import os from "node:os";
+import * as path from "node:path";
 
 // ../node_modules/zod/index.js
 var zod_exports = {};
@@ -28494,34 +28587,139 @@ function applyPagination(items, params) {
   };
 }
 
+// src/channel.ts
+var MAX_CHANNEL_CONTENT_BYTES = 8192;
+var ChannelPermissionRequestNotificationSchema = external_exports3.object({
+  method: external_exports3.literal("notifications/claude/channel/permission_request"),
+  params: external_exports3.object({
+    request_id: external_exports3.string().min(1),
+    tool_name: external_exports3.string(),
+    description: external_exports3.string(),
+    input_preview: external_exports3.string().optional()
+  })
+});
+function coerceMetaValue(value) {
+  if (value === null || value === void 0) return "";
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") {
+    return String(value);
+  }
+  return JSON.stringify(value);
+}
+function buildChannelMeta(meta3) {
+  const result = {};
+  for (const [key, value] of Object.entries(meta3)) {
+    result[key] = coerceMetaValue(value);
+  }
+  return result;
+}
+function truncateChannelContent(content) {
+  const bytes = Buffer.byteLength(content, "utf8");
+  if (bytes > MAX_CHANNEL_CONTENT_BYTES) {
+    console.error(
+      `[telegram:channel] dropping message (${bytes} bytes > ${MAX_CHANNEL_CONTENT_BYTES})`
+    );
+    return null;
+  }
+  return content;
+}
+async function sendChannelNotification(server2, content, meta3) {
+  const safeContent = truncateChannelContent(content);
+  if (!safeContent) return false;
+  try {
+    await server2.notification({
+      method: "claude/channel",
+      params: {
+        content: safeContent,
+        meta: meta3 ?? {}
+      }
+    });
+    return true;
+  } catch (error48) {
+    console.error("[telegram:channel] failed to send notification:", error48);
+    return false;
+  }
+}
+async function sendPermissionVerdict(server2, requestId, behavior) {
+  try {
+    await server2.notification({
+      method: "claude/channel/permission",
+      params: {
+        request_id: requestId,
+        behavior
+      }
+    });
+    return true;
+  } catch (error48) {
+    console.error(
+      `[telegram:channel] failed to send permission verdict (${behavior}):`,
+      error48
+    );
+    return false;
+  }
+}
+function formatPermissionRequestMessage(params) {
+  const preview = params.input_preview?.trim();
+  const lines = [
+    "Tool approval requested",
+    "",
+    `Tool: ${params.tool_name}`,
+    params.description
+  ];
+  if (preview) {
+    lines.push("", "Preview:", preview);
+  }
+  return lines.join("\n");
+}
+function parsePermissionCallbackData(data) {
+  const match = /^perm:(allow|deny):([a-f0-9]{32})$/.exec(data);
+  if (!match) return null;
+  return {
+    behavior: match[1],
+    requestId: match[2]
+  };
+}
+function buildPermissionCallbackData(behavior, requestId) {
+  return `perm:${behavior}:${requestId}`;
+}
+
 // src/index.ts
 import_dotenv.default.config();
+function isCallbackQueryUpdate(update) {
+  return typeof update === "object" && update !== null && "callback_query" in update && update.callback_query !== void 0;
+}
+function getStatePath() {
+  if (process.env.TELEGRAM_STATE_PATH) {
+    return process.env.TELEGRAM_STATE_PATH;
+  }
+  const suffix = botToken && !IS_MOCK ? createHash("sha256").update(botToken).digest("hex").slice(0, 12) : "default";
+  return path.join(os.homedir(), ".fre4x", `telegram-mcp-${suffix}.json`);
+}
 var window = new JSDOM("").window;
 var DOMPurify = createDOMPurify(window);
 var IS_MOCK = process.env.MOCK === "true" || process.env.TELEGRAM_MOCK === "true";
 var botToken = process.env.TELEGRAM_BOT_TOKEN;
+var MAX_TOKEN_REDACT_LENGTH = 256;
+function redactBotToken(message) {
+  if (!botToken || !message.includes(botToken)) {
+    return message;
+  }
+  if (botToken.length > MAX_TOKEN_REDACT_LENGTH) {
+    return message.split(botToken).join("[REDACTED_TOKEN]");
+  }
+  const escapedToken = botToken.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return message.replace(new RegExp(escapedToken, "g"), "[REDACTED_TOKEN]");
+}
 var allowedUserId = process.env.ALLOWED_USER_ID;
 var allowedRecipients = process.env.ALLOWED_RECIPIENTS?.split(",").map((id) => id.trim()) || [];
 var enableRecipientWhitelist = process.env.ENABLE_RECIPIENT_WHITELIST === "true";
 var originalError = console.error;
 console.error = (...args) => {
-  let message = args.map((arg) => String(arg)).join(" ");
-  if (botToken && message.includes(botToken)) {
-    message = message.replace(
-      new RegExp(botToken.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"),
-      "[REDACTED_TOKEN]"
-    );
-  }
+  const message = redactBotToken(args.map((arg) => String(arg)).join(" "));
   originalError(message);
 };
 process.on("uncaughtException", (err) => {
-  let message = err.stack || err.message;
-  if (botToken && message.includes(botToken)) {
-    message = message.replace(
-      new RegExp(botToken.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"),
-      "[REDACTED_TOKEN]"
-    );
-  }
+  const message = redactBotToken(err.stack || err.message);
   console.error("Uncaught Exception:", message);
   process.exit(1);
 });
@@ -28530,13 +28728,7 @@ process.on("unhandledRejection", (reason) => {
   if (reason instanceof Error) {
     message = reason.stack || reason.message;
   }
-  if (botToken && message.includes(botToken)) {
-    message = message.replace(
-      new RegExp(botToken.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"),
-      "[REDACTED_TOKEN]"
-    );
-  }
-  console.error("Unhandled Rejection:", message);
+  console.error("Unhandled Rejection:", redactBotToken(message));
 });
 if (!IS_MOCK && !botToken) {
   console.error(
@@ -28569,13 +28761,7 @@ function validateFilePath(filePath) {
   }
   return absolutePath;
 }
-function validateRecipient(targetId) {
-  const userPattern = /^\d+$/;
-  const groupPattern = /^-?\d+$/;
-  const usernamePattern = /^@[a-zA-Z0-9_]+$/;
-  if (!userPattern.test(targetId) && !groupPattern.test(targetId) && !usernamePattern.test(targetId)) {
-    throw new Error(`Invalid Telegram ID format: ${targetId}`);
-  }
+function assertRecipientAllowed(targetId) {
   if (enableRecipientWhitelist && allowedRecipients.length > 0) {
     if (!allowedRecipients.includes(targetId)) {
       throw new Error(
@@ -28584,6 +28770,18 @@ function validateRecipient(targetId) {
     }
   }
 }
+function validateSendRecipient(targetId) {
+  if (!/^\d+$/.test(targetId)) {
+    throw new Error(`Invalid Telegram user ID format: ${targetId}`);
+  }
+  assertRecipientAllowed(targetId);
+}
+function validateChatId(chatId) {
+  if (!/^-?\d+$/.test(chatId)) {
+    throw new Error(`Invalid Telegram chat ID format: ${chatId}`);
+  }
+  assertRecipientAllowed(chatId);
+}
 var SendMessageSchema = external_exports3.object({
   content: external_exports3.string().min(1).max(4096),
   recipientId: external_exports3.string().optional(),
@@ -28624,34 +28822,441 @@ var server = new Server(
     capabilities: {
       tools: {},
       logging: {},
-      // Required by SDK for notifications/message
       experimental: {
         "claude/channel": {
-          description: "Telegram events are delivered via channel notifications"
+          description: "Telegram events are delivered via claude/channel notifications"
+        },
+        "claude/channel/permission": {
+          description: "Tool approval requests are relayed to Telegram for allow/deny"
         }
       }
     },
-    instructions: "Telegram MCP server. Delivers inbound Telegram messages as channel notifications via notifications/message."
+    instructions: "Telegram MCP server. Inbound Telegram messages are pushed via claude/channel. Tool approvals can be relayed through Telegram when claude/channel/permission is enabled."
   }
 );
-var isInitialized = false;
-server.oninitialized = () => {
-  isInitialized = true;
-};
-var seenMessageIds = /* @__PURE__ */ new Set();
-var MAX_SEEN_IDS = 500;
 var isImage = (filePath) => {
   const ext = path.extname(filePath).toLowerCase();
   return [".jpg", ".jpeg", ".png", ".gif", ".webp", ".bmp"].includes(ext);
 };
 var messageHistory = [];
 var MAX_HISTORY = 100;
+var pollingOffset = 0;
+var channelReady = false;
+var channelPollTimer = null;
+var CHANNEL_POLL_INTERVAL_MS = 3e3;
+var pendingPermissionRequests = /* @__PURE__ */ new Map();
+var knownChats = /* @__PURE__ */ new Map();
+function loadState() {
+  if (IS_MOCK) return;
+  try {
+    if (!fs.existsSync(getStatePath())) return;
+    const raw = fs.readFileSync(getStatePath(), "utf-8");
+    const state = JSON.parse(raw);
+    for (const chat of state.knownChats ?? []) {
+      if (chat?.id) {
+        knownChats.set(chat.id, chat);
+      }
+    }
+    if (typeof state.pollingOffset === "number") {
+      pollingOffset = state.pollingOffset;
+    }
+    console.error(
+      `[telegram:state] loaded ${knownChats.size} chat(s) from ${getStatePath()}`
+    );
+  } catch (error48) {
+    console.error(
+      `[telegram:state] failed to load ${getStatePath()}:`,
+      error48
+    );
+  }
+}
+function persistState() {
+  if (IS_MOCK) return;
+  try {
+    const state = {
+      knownChats: Array.from(knownChats.values()),
+      pollingOffset
+    };
+    fs.mkdirSync(path.dirname(getStatePath()), { recursive: true });
+    fs.writeFileSync(
+      getStatePath(),
+      JSON.stringify(state, null, 2),
+      "utf-8"
+    );
+  } catch (error48) {
+    console.error(
+      `[telegram:state] failed to persist ${getStatePath()}:`,
+      error48
+    );
+  }
+}
+function reloadState() {
+  if (IS_MOCK) return;
+  try {
+    if (!fs.existsSync(getStatePath())) return;
+    const raw = fs.readFileSync(getStatePath(), "utf-8");
+    const state = JSON.parse(raw);
+    for (const chat of state.knownChats ?? []) {
+      if (chat?.id) {
+        knownChats.set(chat.id, chat);
+      }
+    }
+    if (typeof state.pollingOffset === "number" && state.pollingOffset > pollingOffset) {
+      pollingOffset = state.pollingOffset;
+    }
+  } catch (error48) {
+    console.error(
+      `[telegram:state] failed to reload ${getStatePath()}:`,
+      error48
+    );
+  }
+}
+function chatTitleFromTelegramChat(chat) {
+  return chat.title || chat.username || chat.first_name || "Private Chat";
+}
+function recordKnownChat(chat) {
+  knownChats.set(chat.id, chat);
+  persistState();
+}
+function recordKnownChatFromTelegramMessage(message) {
+  recordKnownChat({
+    id: message.chat.id.toString(),
+    title: chatTitleFromTelegramChat(message.chat),
+    type: message.chat.type ?? "unknown"
+  });
+}
+function recordKnownChatFromUpdate(update) {
+  const chat = update.message?.chat ?? update.edited_message?.chat ?? update.channel_post?.chat ?? update.my_chat_member?.chat;
+  if (!chat) return;
+  recordKnownChat({
+    id: chat.id.toString(),
+    title: chatTitleFromTelegramChat(chat),
+    type: chat.type ?? "unknown"
+  });
+}
+function logActiveChatsDebug(stage) {
+  const active = getActiveChats();
+  console.error(
+    `[telegram:list_active_chats] ${stage}: knownChats=${knownChats.size} messageHistory=${messageHistory.length} active=${active.length} pollingOffset=${pollingOffset}`
+  );
+  if (knownChats.size > 0) {
+    console.error(
+      `[telegram:list_active_chats] knownChatIds: ${Array.from(knownChats.keys()).join(", ")}`
+    );
+  }
+  if (active.length > 0) {
+    console.error(
+      `[telegram:list_active_chats] activeChatIds: ${active.map((c) => c.id).join(", ")}`
+    );
+  }
+}
+async function recordChatInteraction(chatId) {
+  if (IS_MOCK || !bot) {
+    recordKnownChat({
+      id: chatId,
+      title: `Chat ${chatId}`,
+      type: "unknown"
+    });
+    console.error(
+      `[telegram:recordChatInteraction] mock recorded chatId=${chatId} knownChats=${knownChats.size}`
+    );
+    return;
+  }
+  try {
+    const chat = await bot.telegram.getChat(chatId);
+    recordKnownChat({
+      id: chat.id.toString(),
+      title: chatTitleFromTelegramChat(chat),
+      type: chat.type
+    });
+    console.error(
+      `[telegram:recordChatInteraction] getChat ok chatId=${chat.id} knownChats=${knownChats.size}`
+    );
+  } catch (error48) {
+    recordKnownChat({
+      id: chatId,
+      title: chatId,
+      type: "unknown"
+    });
+    console.error(
+      `[telegram:recordChatInteraction] getChat failed for ${chatId}, stored fallback:`,
+      error48
+    );
+  }
+}
+function getConfiguredChatCandidates() {
+  const candidates = /* @__PURE__ */ new Set();
+  if (allowedUserId) candidates.add(allowedUserId);
+  for (const id of allowedRecipients) {
+    if (id) candidates.add(id);
+  }
+  for (const chat of knownChats.values()) {
+    candidates.add(chat.id);
+  }
+  for (const msg of messageHistory) {
+    candidates.add(msg.chatId);
+  }
+  return candidates;
+}
+async function ensurePollingMode() {
+  if (!bot || IS_MOCK) return;
+  try {
+    const info = await bot.telegram.getWebhookInfo();
+    if (info.url) {
+      console.error(
+        `[telegram] active webhook detected (${info.url}); switching to getUpdates polling`
+      );
+      await bot.telegram.deleteWebhook({ drop_pending_updates: false });
+    }
+  } catch (error48) {
+    console.error("[telegram] ensurePollingMode failed:", error48);
+  }
+}
+async function discoverChatsFromApi() {
+  if (IS_MOCK || !bot) return;
+  const candidates = getConfiguredChatCandidates();
+  console.error(
+    `[telegram:list_active_chats] discoverChatsFromApi: probing ${candidates.size} candidate chat(s) from state=${getStatePath()}`
+  );
+  for (const chatId of candidates) {
+    await recordChatInteraction(chatId);
+  }
+  try {
+    await ensurePollingMode();
+    const updates = await bot.telegram.getUpdates(0, 100, pollingOffset, [
+      "message",
+      "edited_message",
+      "channel_post",
+      "my_chat_member",
+      "chat_member"
+    ]);
+    for (const update of updates) {
+      pollingOffset = update.update_id + 1;
+      const msgLike = update;
+      if (!msgLike.message && !msgLike.edited_message && !msgLike.channel_post && !msgLike.my_chat_member)
+        continue;
+      recordKnownChatFromUpdate(msgLike);
+    }
+    console.error(
+      `[telegram:list_active_chats] discoverChatsFromApi: processed ${updates.length} update(s)`
+    );
+    persistState();
+  } catch (error48) {
+    console.error(
+      "[telegram:list_active_chats] discoverChatsFromApi getUpdates failed:",
+      error48
+    );
+  }
+}
+function getActiveChats() {
+  const chats = /* @__PURE__ */ new Map();
+  for (const chat of knownChats.values()) {
+    chats.set(chat.id, chat);
+  }
+  for (const msg of messageHistory) {
+    if (chats.has(msg.chatId)) continue;
+    chats.set(msg.chatId, {
+      id: msg.chatId,
+      title: msg.chatTitle || "Unknown",
+      type: msg.metadata?.chatType || "unknown"
+    });
+  }
+  return Array.from(chats.values()).sort(
+    (a, b) => a.title.localeCompare(b.title)
+  );
+}
+async function fetchNewUpdates() {
+  const added = [];
+  if (!bot || IS_MOCK) return added;
+  try {
+    await ensurePollingMode();
+    const updates = await bot.telegram.getUpdates(0, 100, pollingOffset, [
+      "message",
+      "edited_message",
+      "channel_post",
+      "my_chat_member",
+      "callback_query"
+    ]);
+    for (const update of updates) {
+      pollingOffset = update.update_id + 1;
+      if (isCallbackQueryUpdate(update)) {
+        await handlePermissionCallback(update.callback_query);
+        continue;
+      }
+      const msgLike = update;
+      if (!msgLike.message && !msgLike.edited_message && !msgLike.channel_post && !msgLike.my_chat_member)
+        continue;
+      recordKnownChatFromUpdate(msgLike);
+      const msg = msgLike.message;
+      if (!msg?.text) continue;
+      const senderId = msg.from?.id?.toString() ?? "unknown";
+      const chatId = msg.chat.id.toString();
+      const chatTitle = chatTitleFromTelegramChat(msg.chat);
+      if (messageHistory.some(
+        (m) => m.metadata?.message_id === msg.message_id
+      ))
+        continue;
+      const currentAllowedUserId = process.env.ALLOWED_USER_ID;
+      if (currentAllowedUserId && msg.chat.type === "private") {
+        if (senderId !== currentAllowedUserId) continue;
+      }
+      let content = DOMPurify.sanitize(msg.text, {
+        ALLOWED_TAGS: [],
+        ALLOWED_ATTR: []
+      });
+      content = content.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/[*_~]/g, "\\$&");
+      const entry = {
+        senderId,
+        chatId,
+        chatTitle,
+        content,
+        timestamp: new Date(msg.date * 1e3).toISOString(),
+        metadata: {
+          chatId,
+          chatType: msg.chat.type,
+          message_id: msg.message_id
+        }
+      };
+      messageHistory.push(entry);
+      added.push(entry);
+      if (messageHistory.length > MAX_HISTORY) {
+        messageHistory.shift();
+      }
+      if (channelReady) {
+        await pushMessageToChannel(entry);
+      }
+    }
+    persistState();
+  } catch (error48) {
+    console.error("fetchNewUpdates failed:", error48);
+  }
+  return added;
+}
+async function pushMessageToChannel(entry) {
+  const meta3 = buildChannelMeta({
+    chat_id: entry.chatId,
+    sender_id: entry.senderId,
+    sender_name: entry.chatTitle ?? entry.senderId,
+    message_id: entry.metadata?.message_id,
+    timestamp: entry.timestamp
+  });
+  const sent = await sendChannelNotification(server, entry.content, meta3);
+  if (sent) {
+    console.error(
+      `[telegram:channel] pushed message_id=${entry.metadata?.message_id ?? "unknown"} chat_id=${entry.chatId}`
+    );
+  }
+}
+async function relayPermissionRequestToTelegram(params) {
+  pendingPermissionRequests.set(params.request_id, params);
+  if (IS_MOCK || !bot) {
+    console.error(
+      `[telegram:channel] permission request (mock): ${params.tool_name} (${params.request_id})`
+    );
+    return;
+  }
+  const targetId = allowedUserId;
+  if (!targetId) {
+    console.error(
+      "[telegram:channel] cannot relay permission \u2014 ALLOWED_USER_ID not set"
+    );
+    return;
+  }
+  try {
+    await bot.telegram.sendMessage(
+      targetId,
+      formatPermissionRequestMessage(params),
+      {
+        reply_markup: {
+          inline_keyboard: [
+            [
+              {
+                text: "Allow",
+                callback_data: buildPermissionCallbackData(
+                  "allow",
+                  params.request_id
+                )
+              },
+              {
+                text: "Deny",
+                callback_data: buildPermissionCallbackData(
+                  "deny",
+                  params.request_id
+                )
+              }
+            ]
+          ]
+        }
+      }
+    );
+  } catch (error48) {
+    console.error(
+      "[telegram:channel] failed to relay permission request:",
+      error48
+    );
+  }
+}
+async function handlePermissionCallback(callbackQuery) {
+  if (!callbackQuery.data) return;
+  const parsed = parsePermissionCallbackData(callbackQuery.data);
+  if (!parsed) return;
+  const currentAllowedUserId = process.env.ALLOWED_USER_ID;
+  if (currentAllowedUserId && callbackQuery.from) {
+    if (callbackQuery.from.id.toString() !== currentAllowedUserId) {
+      console.error(
+        `[telegram:channel] permission callback rejected from ${callbackQuery.from.id}`
+      );
+      return;
+    }
+  }
+  if (!pendingPermissionRequests.has(parsed.requestId)) {
+    console.error(
+      `[telegram:channel] unknown permission request_id=${parsed.requestId}`
+    );
+    return;
+  }
+  pendingPermissionRequests.delete(parsed.requestId);
+  const sent = await sendPermissionVerdict(
+    server,
+    parsed.requestId,
+    parsed.behavior
+  );
+  if (sent) {
+    console.error(
+      `[telegram:channel] permission verdict ${parsed.behavior} for ${parsed.requestId}`
+    );
+  }
+  if (bot && !IS_MOCK) {
+    try {
+      await bot.telegram.answerCbQuery(
+        callbackQuery.id,
+        parsed.behavior === "allow" ? "Approved" : "Denied"
+      );
+    } catch (error48) {
+      console.error("[telegram:channel] answerCbQuery failed:", error48);
+    }
+  }
+}
+function startChannelPolling() {
+  if (channelPollTimer || IS_MOCK || !bot) return;
+  channelPollTimer = setInterval(() => {
+    void fetchNewUpdates();
+  }, CHANNEL_POLL_INTERVAL_MS);
+  console.error(
+    `[telegram:channel] background polling started (${CHANNEL_POLL_INTERVAL_MS}ms)`
+  );
+}
+function stopChannelPolling() {
+  if (!channelPollTimer) return;
+  clearInterval(channelPollTimer);
+  channelPollTimer = null;
+}
 server.setRequestHandler(ListToolsRequestSchema, async () => {
   return {
     tools: [
       {
-        name: "send_telegram_message",
-        description: "Send a text message, photo, or document to a specific Telegram user, group, or channel.",
+        name: "send_message",
+        description: "Send text, photo, or document to a Telegram user by numeric ID.",
         inputSchema: {
           type: "object",
           properties: {
@@ -28661,7 +29266,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             },
             recipientId: {
               type: "string",
-              description: "Target ID or @username."
+              description: "Numeric Telegram user ID."
             },
             mediaPath: {
               type: "string",
@@ -28689,7 +29294,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       },
       {
         name: "list_active_chats",
-        description: "List all unique Telegram chats the bot has interacted with.",
+        description: "List chats the bot has sent to or received messages from.",
         inputSchema: {
           type: "object",
           properties: {
@@ -28703,16 +29308,26 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
         description: "Get detailed information about a specific Telegram chat.",
         inputSchema: {
           type: "object",
-          properties: { chatId: { type: "string" } },
+          properties: {
+            chatId: {
+              type: "string",
+              description: "Numeric Telegram chat ID."
+            }
+          },
           required: ["chatId"]
         }
       },
       {
-        name: "leave_telegram_chat",
+        name: "leave_chat",
         description: "Request the bot to leave a specific group or channel.",
         inputSchema: {
           type: "object",
-          properties: { chatId: { type: "string" } },
+          properties: {
+            chatId: {
+              type: "string",
+              description: "Numeric Telegram chat ID."
+            }
+          },
           required: ["chatId"]
         }
       }
@@ -28723,7 +29338,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
   const { name, arguments: args } = request.params;
   const currentAllowedUserId = process.env.ALLOWED_USER_ID;
   try {
-    if (name === "send_telegram_message") {
+    if (name === "send_message") {
+      reloadState();
       const { content, recipientId, mediaPath, mediaType } = SendMessageSchema.parse(args);
       const targetId = recipientId || currentAllowedUserId;
       if (!targetId) {
@@ -28738,7 +29354,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           429
         );
       }
-      validateRecipient(targetId);
+      validateSendRecipient(targetId);
       let safePath;
       if (mediaPath) {
         safePath = validateFilePath(mediaPath);
@@ -28748,19 +29364,28 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         if (mediaPath)
           mockResponse += `
 [Mock] Media: ${mediaPath} (${mediaType || "auto"})`;
+        await recordChatInteraction(targetId);
         return { content: [{ type: "text", text: mockResponse }] };
       }
       if (mediaPath && safePath) {
         const source = { source: safePath };
         const isPhoto = mediaType === "photo" || !mediaType && isImage(safePath);
         if (isPhoto) {
-          await bot.telegram.sendPhoto(targetId, source, {
-            caption: content
-          });
+          const sent = await bot.telegram.sendPhoto(
+            targetId,
+            source,
+            {
+              caption: content
+            }
+          );
+          recordKnownChatFromTelegramMessage(sent);
         } else {
-          await bot.telegram.sendDocument(targetId, source, {
-            caption: content
-          });
+          const sent = await bot.telegram.sendDocument(
+            targetId,
+            source,
+            { caption: content }
+          );
+          recordKnownChatFromTelegramMessage(sent);
         }
         return {
           content: [
@@ -28771,7 +29396,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           ]
         };
       } else {
-        await bot.telegram.sendMessage(targetId, content);
+        const sent = await bot.telegram.sendMessage(targetId, content);
+        recordKnownChatFromTelegramMessage(sent);
         return {
           content: [
             { type: "text", text: `Message sent successfully.` }
@@ -28781,6 +29407,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     }
     if (name === "get_recent_messages") {
       const { limit, offset } = GetRecentMessagesSchema.parse(args || {});
+      await fetchNewUpdates();
       const paginated = applyPagination(
         messageHistory.slice().reverse(),
         { limit, offset }
@@ -28809,18 +29436,12 @@ ${formatPaginationFooter(offset, limit, messageHistory.length)}`
     }
     if (name === "list_active_chats") {
       const { limit, offset } = GetRecentMessagesSchema.parse(args || {});
-      const uniqueChatIds = Array.from(
-        new Set(messageHistory.map((m) => m.chatId))
-      );
-      const chatDetails = uniqueChatIds.map((id) => {
-        const lastMsg = messageHistory.slice().reverse().find((m) => m.chatId === id);
-        return {
-          id,
-          title: lastMsg?.chatTitle || "Unknown",
-          type: lastMsg?.metadata?.chatType || "unknown"
-        };
-      });
-      const paginated = applyPagination(chatDetails, { limit, offset });
+      reloadState();
+      await fetchNewUpdates();
+      await discoverChatsFromApi();
+      logActiveChatsDebug("after fetch and discover");
+      const activeChats = getActiveChats();
+      const paginated = applyPagination(activeChats, { limit, offset });
       const formatted = paginated.items.map((c) => `- ${c.title} (ID: ${c.id}, Type: ${c.type})`).join("\n");
       return {
         content: [
@@ -28829,14 +29450,14 @@ ${formatPaginationFooter(offset, limit, messageHistory.length)}`
             text: formatted ? `Active chats:
 ${formatted}
 
-${formatPaginationFooter(offset, limit, uniqueChatIds.length)}` : "No active chats found."
+${formatPaginationFooter(offset, limit, activeChats.length)}` : "No active chats found."
           }
         ]
       };
     }
     if (name === "get_chat_info") {
       const { chatId } = GetChatInfoSchema.parse(args);
-      validateRecipient(chatId);
+      validateChatId(chatId);
       if (IS_MOCK || !bot) {
         return {
           content: [
@@ -28862,9 +29483,9 @@ ${formatPaginationFooter(offset, limit, uniqueChatIds.length)}` : "No active cha
         ]
       };
     }
-    if (name === "leave_telegram_chat") {
+    if (name === "leave_chat") {
       const { chatId } = LeaveChatSchema.parse(args);
-      validateRecipient(chatId);
+      validateChatId(chatId);
       if (IS_MOCK || !bot) {
         return {
           content: [
@@ -28906,128 +29527,49 @@ ${formatPaginationFooter(offset, limit, uniqueChatIds.length)}` : "No active cha
       if (msg.includes("limit exceeded")) {
         return createApiError("Rate limit exceeded.", 429);
       }
+      if (msg.includes("invalid telegram user id format")) {
+        return createValidationError(
+          "recipientId",
+          'Use a numeric user ID only (e.g., "123456789"). @username is not supported.'
+        );
+      }
+      if (msg.includes("invalid telegram chat id format")) {
+        return createValidationError(
+          "chatId",
+          'Use a numeric chat ID only (e.g., "123456789"). @username is not supported.'
+        );
+      }
     }
     return createInternalError(
       "An unexpected error occurred while processing the request."
     );
   }
 });
-if (bot) {
-  bot.on("text", async (ctx) => {
-    const senderId = ctx.from.id.toString();
-    const chatId = ctx.chat.id.toString();
-    const chatTitle = ctx.chat.title || ctx.chat.username || ctx.chat.first_name || "Private Chat";
-    const currentAllowedUserId = process.env.ALLOWED_USER_ID;
-    if (currentAllowedUserId) {
-      if (ctx.chat.type === "private") {
-        if (senderId !== currentAllowedUserId) {
-          console.warn(
-            `Unauthorized private message from ${senderId}`
-          );
-          await ctx.reply(
-            "\u274C Access denied. Only the authorized user can interact with this bot."
-          ).catch(() => {
-          });
-          return;
-        }
-      } else if (ctx.chat.type === "group" || ctx.chat.type === "supergroup") {
-        try {
-          const chatMember = await ctx.getChatMember(ctx.from.id);
-          const isAdmin = ["creator", "administrator"].includes(
-            chatMember.status
-          );
-          if (!isAdmin && senderId !== currentAllowedUserId) {
-            console.warn(
-              `Unauthorized group message from ${senderId} in ${chatTitle}`
-            );
-            return;
-          }
-        } catch (error48) {
-          console.error(
-            "Failed to check group member status:",
-            error48
-          );
-          return;
-        }
-      } else if (ctx.chat.type === "channel") {
-        return;
-      }
-    }
-    let messageContent = ctx.message.text;
-    messageContent = DOMPurify.sanitize(messageContent, {
-      ALLOWED_TAGS: [],
-      ALLOWED_ATTR: []
-    });
-    messageContent = messageContent.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/[*_~]/g, "\\$&");
-    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-    const metadata = {
-      chatId,
-      chatType: ctx.chat?.type,
-      message_id: ctx.message.message_id
-    };
-    messageHistory.push({
-      senderId,
-      chatId,
-      chatTitle,
-      content: messageContent,
-      timestamp,
-      metadata
-    });
-    if (messageHistory.length > MAX_HISTORY) {
-      messageHistory.shift();
-    }
-    if (!isInitialized) {
-      console.warn(
-        `[telegram] Pre-init notification dropped (message_id=${metadata.message_id})`
-      );
-      return;
-    }
-    const msgId = metadata.message_id;
-    if (seenMessageIds.has(msgId)) {
-      return;
-    }
-    if (seenMessageIds.size >= MAX_SEEN_IDS) {
-      seenMessageIds.delete(seenMessageIds.values().next().value);
-    }
-    seenMessageIds.add(msgId);
-    try {
-      await server.notification({
-        method: "notifications/message",
-        params: {
-          _meta: {
-            channel: "telegram"
-          },
-          content: [
-            {
-              type: "text",
-              text: `New message from ${senderId} in ${chatTitle} (${chatId}): ${messageContent}`
-            }
-          ]
-        }
-      });
-    } catch (error48) {
-      console.error("Failed to push channel notification:", error48);
-    }
-  });
-}
+server.setNotificationHandler(
+  ChannelPermissionRequestNotificationSchema,
+  async (notification) => {
+    await relayPermissionRequestToTelegram(notification.params);
+  }
+);
+server.oninitialized = () => {
+  channelReady = true;
+  console.error(
+    "[telegram:channel] client initialized \u2014 channel push enabled"
+  );
+  startChannelPolling();
+};
 async function run() {
+  loadState();
   const transport = new StdioServerTransport();
   await server.connect(transport);
   console.error("Telegram MCP Server running on stdio");
-  if (bot) {
-    bot.launch().catch((err) => {
-      console.error("Failed to launch Telegram bot:", err);
-    });
-    process.once("SIGINT", () => {
-      bot.stop("SIGINT");
-      process.exit(0);
-    });
-    process.once("SIGTERM", () => {
-      bot.stop("SIGTERM");
-      process.exit(0);
-    });
-  }
 }
+process.on("SIGINT", () => {
+  stopChannelPolling();
+});
+process.on("SIGTERM", () => {
+  stopChannelPolling();
+});
 if (process.env.NODE_ENV !== "test") {
   run().catch((error48) => {
     console.error("Fatal error in run():", error48);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fre4x/telegram",
-  "version": "1.1.4",
+  "version": "1.1.6",
   "description": "Telegram MCP server implementing Claude Code Channels for bidirectional communication and remote permission relay.",
   "type": "module",
   "main": "dist/index.js",