@fre4x/telegram 1.1.5 → 1.1.7

package/dist/index.js

@@ -28236,9 +28236,9 @@ var StdioServerTransport = class {
 var import_dotenv = __toESM(require_main(), 1);
 import { Telegraf } from "telegraf";
 import { createHash } from "node:crypto";
-import * as fs from "fs";
+import * as fs from "node:fs";
 import os from "node:os";
-import * as path from "path";
+import * as path from "node:path";
 
 // ../node_modules/zod/index.js
 var zod_exports = {};
@@ -28587,8 +28587,107 @@ function applyPagination(items, params) {
   };
 }
 
+// src/channel.ts
+var MAX_CHANNEL_CONTENT_BYTES = 8192;
+var ChannelPermissionRequestNotificationSchema = external_exports3.object({
+  method: external_exports3.literal("notifications/claude/channel/permission_request"),
+  params: external_exports3.object({
+    request_id: external_exports3.string().min(1),
+    tool_name: external_exports3.string(),
+    description: external_exports3.string(),
+    input_preview: external_exports3.string().optional()
+  })
+});
+function coerceMetaValue(value) {
+  if (value === null || value === void 0) return "";
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") {
+    return String(value);
+  }
+  return JSON.stringify(value);
+}
+function buildChannelMeta(meta3) {
+  const result = {};
+  for (const [key, value] of Object.entries(meta3)) {
+    result[key] = coerceMetaValue(value);
+  }
+  return result;
+}
+function truncateChannelContent(content) {
+  const bytes = Buffer.byteLength(content, "utf8");
+  if (bytes > MAX_CHANNEL_CONTENT_BYTES) {
+    console.error(
+      `[telegram:channel] dropping message (${bytes} bytes > ${MAX_CHANNEL_CONTENT_BYTES})`
+    );
+    return null;
+  }
+  return content;
+}
+async function sendChannelNotification(server2, content, meta3) {
+  const safeContent = truncateChannelContent(content);
+  if (!safeContent) return false;
+  try {
+    await server2.notification({
+      method: "claude/channel",
+      params: {
+        content: safeContent,
+        meta: meta3 ?? {}
+      }
+    });
+    return true;
+  } catch (error48) {
+    console.error("[telegram:channel] failed to send notification:", error48);
+    return false;
+  }
+}
+async function sendPermissionVerdict(server2, requestId, behavior) {
+  try {
+    await server2.notification({
+      method: "claude/channel/permission",
+      params: {
+        request_id: requestId,
+        behavior
+      }
+    });
+    return true;
+  } catch (error48) {
+    console.error(
+      `[telegram:channel] failed to send permission verdict (${behavior}):`,
+      error48
+    );
+    return false;
+  }
+}
+function formatPermissionRequestMessage(params) {
+  const preview = params.input_preview?.trim();
+  const lines = [
+    "Tool approval requested",
+    "",
+    `Tool: ${params.tool_name}`,
+    params.description
+  ];
+  if (preview) {
+    lines.push("", "Preview:", preview);
+  }
+  return lines.join("\n");
+}
+function parsePermissionCallbackData(data) {
+  const match = /^perm:(allow|deny):([a-f0-9]{32})$/.exec(data);
+  if (!match) return null;
+  return {
+    behavior: match[1],
+    requestId: match[2]
+  };
+}
+function buildPermissionCallbackData(behavior, requestId) {
+  return `perm:${behavior}:${requestId}`;
+}
+
 // src/index.ts
 import_dotenv.default.config();
+function isCallbackQueryUpdate(update) {
+  return typeof update === "object" && update !== null && "callback_query" in update && update.callback_query !== void 0;
+}
 function getStatePath() {
   if (process.env.TELEGRAM_STATE_PATH) {
     return process.env.TELEGRAM_STATE_PATH;
@@ -28599,29 +28698,29 @@ function getStatePath() {
 var window = new JSDOM("").window;
 var DOMPurify = createDOMPurify(window);
 var IS_MOCK = process.env.MOCK === "true" || process.env.TELEGRAM_MOCK === "true";
-var botToken = process.env.TELEGRAM_BOT_TOKEN;
-var allowedUserId = process.env.ALLOWED_USER_ID;
-var allowedRecipients = process.env.ALLOWED_RECIPIENTS?.split(",").map((id) => id.trim()) || [];
+var botToken = process.env.TELEGRAM_BOT_TOKEN || process.env.BOT_TOKEN;
+var MAX_TOKEN_REDACT_LENGTH = 256;
+function redactBotToken(message) {
+  if (!botToken || !message.includes(botToken)) {
+    return message;
+  }
+  if (botToken.length > MAX_TOKEN_REDACT_LENGTH) {
+    return message.split(botToken).join("[REDACTED_TOKEN]");
+  }
+  const escapedToken = botToken.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return message.replace(new RegExp(escapedToken, "g"), "[REDACTED_TOKEN]");
+}
+var allowedUserId = process.env.ALLOWED_USER_ID || process.env.TELEGRAM_ALLOWED_USER_ID || process.env.TELEGRAM_CHAT_ID || process.env.CHAT_ID;
+var rawAllowedRecipients = process.env.ALLOWED_RECIPIENTS || process.env.TELEGRAM_ALLOWED_RECIPIENTS;
+var allowedRecipients = rawAllowedRecipients?.split(",").map((id) => id.trim()).filter(Boolean) || [];
 var enableRecipientWhitelist = process.env.ENABLE_RECIPIENT_WHITELIST === "true";
 var originalError = console.error;
 console.error = (...args) => {
-  let message = args.map((arg) => String(arg)).join(" ");
-  if (botToken && message.includes(botToken)) {
-    message = message.replace(
-      new RegExp(botToken.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"),
-      "[REDACTED_TOKEN]"
-    );
-  }
+  const message = redactBotToken(args.map((arg) => String(arg)).join(" "));
   originalError(message);
 };
 process.on("uncaughtException", (err) => {
-  let message = err.stack || err.message;
-  if (botToken && message.includes(botToken)) {
-    message = message.replace(
-      new RegExp(botToken.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"),
-      "[REDACTED_TOKEN]"
-    );
-  }
+  const message = redactBotToken(err.stack || err.message);
   console.error("Uncaught Exception:", message);
   process.exit(1);
 });
@@ -28630,13 +28729,7 @@ process.on("unhandledRejection", (reason) => {
   if (reason instanceof Error) {
     message = reason.stack || reason.message;
   }
-  if (botToken && message.includes(botToken)) {
-    message = message.replace(
-      new RegExp(botToken.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"),
-      "[REDACTED_TOKEN]"
-    );
-  }
-  console.error("Unhandled Rejection:", message);
+  console.error("Unhandled Rejection:", redactBotToken(message));
 });
 if (!IS_MOCK && !botToken) {
   console.error(
@@ -28730,14 +28823,16 @@ var server = new Server(
     capabilities: {
       tools: {},
       logging: {},
-      // Required by SDK for notifications/message
       experimental: {
         "claude/channel": {
-          description: "Telegram events are delivered via channel notifications"
+          description: "Telegram events are delivered via claude/channel notifications"
+        },
+        "claude/channel/permission": {
+          description: "Tool approval requests are relayed to Telegram for allow/deny"
         }
       }
     },
-    instructions: "Telegram MCP server. Delivers inbound Telegram messages as channel notifications via notifications/message."
+    instructions: "Telegram MCP server. Inbound Telegram messages are pushed via claude/channel. Tool approvals can be relayed through Telegram when claude/channel/permission is enabled."
   }
 );
 var isImage = (filePath) => {
@@ -28747,6 +28842,10 @@ var isImage = (filePath) => {
 var messageHistory = [];
 var MAX_HISTORY = 100;
 var pollingOffset = 0;
+var channelReady = false;
+var channelPollTimer = null;
+var CHANNEL_POLL_INTERVAL_MS = 3e3;
+var pendingPermissionRequests = /* @__PURE__ */ new Map();
 var knownChats = /* @__PURE__ */ new Map();
 function loadState() {
   if (IS_MOCK) return;
@@ -28766,7 +28865,10 @@ function loadState() {
       `[telegram:state] loaded ${knownChats.size} chat(s) from ${getStatePath()}`
     );
   } catch (error48) {
-    console.error(`[telegram:state] failed to load ${getStatePath()}:`, error48);
+    console.error(
+      `[telegram:state] failed to load ${getStatePath()}:`,
+      error48
+    );
   }
 }
 function persistState() {
@@ -28777,9 +28879,16 @@ function persistState() {
       pollingOffset
     };
     fs.mkdirSync(path.dirname(getStatePath()), { recursive: true });
-    fs.writeFileSync(getStatePath(), JSON.stringify(state, null, 2), "utf-8");
+    fs.writeFileSync(
+      getStatePath(),
+      JSON.stringify(state, null, 2),
+      "utf-8"
+    );
   } catch (error48) {
-    console.error(`[telegram:state] failed to persist ${getStatePath()}:`, error48);
+    console.error(
+      `[telegram:state] failed to persist ${getStatePath()}:`,
+      error48
+    );
   }
 }
 function reloadState() {
@@ -28797,7 +28906,10 @@ function reloadState() {
       pollingOffset = state.pollingOffset;
     }
   } catch (error48) {
-    console.error(`[telegram:state] failed to reload ${getStatePath()}:`, error48);
+    console.error(
+      `[telegram:state] failed to reload ${getStatePath()}:`,
+      error48
+    );
   }
 }
 function chatTitleFromTelegramChat(chat) {
@@ -28955,17 +29067,23 @@ function getActiveChats() {
   );
 }
 async function fetchNewUpdates() {
-  if (!bot || IS_MOCK) return;
+  const added = [];
+  if (!bot || IS_MOCK) return added;
   try {
     await ensurePollingMode();
     const updates = await bot.telegram.getUpdates(0, 100, pollingOffset, [
       "message",
       "edited_message",
       "channel_post",
-      "my_chat_member"
+      "my_chat_member",
+      "callback_query"
     ]);
     for (const update of updates) {
       pollingOffset = update.update_id + 1;
+      if (isCallbackQueryUpdate(update)) {
+        await handlePermissionCallback(update.callback_query);
+        continue;
+      }
       const msgLike = update;
       if (!msgLike.message && !msgLike.edited_message && !msgLike.channel_post && !msgLike.my_chat_member)
         continue;
@@ -28974,7 +29092,7 @@ async function fetchNewUpdates() {
       if (!msg?.text) continue;
       const senderId = msg.from?.id?.toString() ?? "unknown";
       const chatId = msg.chat.id.toString();
-      const chatTitle = msg.chat.title || msg.chat.username || msg.chat.first_name || "Private Chat";
+      const chatTitle = chatTitleFromTelegramChat(msg.chat);
       if (messageHistory.some(
         (m) => m.metadata?.message_id === msg.message_id
       ))
@@ -28988,7 +29106,7 @@ async function fetchNewUpdates() {
         ALLOWED_ATTR: []
       });
       content = content.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/[*_~]/g, "\\$&");
-      messageHistory.push({
+      const entry = {
         senderId,
         chatId,
         chatTitle,
@@ -28999,15 +29117,140 @@ async function fetchNewUpdates() {
           chatType: msg.chat.type,
           message_id: msg.message_id
         }
-      });
+      };
+      messageHistory.push(entry);
+      added.push(entry);
       if (messageHistory.length > MAX_HISTORY) {
         messageHistory.shift();
       }
+      if (channelReady) {
+        await pushMessageToChannel(entry);
+      }
     }
     persistState();
   } catch (error48) {
     console.error("fetchNewUpdates failed:", error48);
   }
+  return added;
+}
+async function pushMessageToChannel(entry) {
+  const meta3 = buildChannelMeta({
+    chat_id: entry.chatId,
+    sender_id: entry.senderId,
+    sender_name: entry.chatTitle ?? entry.senderId,
+    message_id: entry.metadata?.message_id,
+    timestamp: entry.timestamp
+  });
+  const sent = await sendChannelNotification(server, entry.content, meta3);
+  if (sent) {
+    console.error(
+      `[telegram:channel] pushed message_id=${entry.metadata?.message_id ?? "unknown"} chat_id=${entry.chatId}`
+    );
+  }
+}
+async function relayPermissionRequestToTelegram(params) {
+  pendingPermissionRequests.set(params.request_id, params);
+  if (IS_MOCK || !bot) {
+    console.error(
+      `[telegram:channel] permission request (mock): ${params.tool_name} (${params.request_id})`
+    );
+    return;
+  }
+  const targetId = allowedUserId;
+  if (!targetId) {
+    console.error(
+      "[telegram:channel] cannot relay permission \u2014 ALLOWED_USER_ID not set"
+    );
+    return;
+  }
+  try {
+    await bot.telegram.sendMessage(
+      targetId,
+      formatPermissionRequestMessage(params),
+      {
+        reply_markup: {
+          inline_keyboard: [
+            [
+              {
+                text: "Allow",
+                callback_data: buildPermissionCallbackData(
+                  "allow",
+                  params.request_id
+                )
+              },
+              {
+                text: "Deny",
+                callback_data: buildPermissionCallbackData(
+                  "deny",
+                  params.request_id
+                )
+              }
+            ]
+          ]
+        }
+      }
+    );
+  } catch (error48) {
+    console.error(
+      "[telegram:channel] failed to relay permission request:",
+      error48
+    );
+  }
+}
+async function handlePermissionCallback(callbackQuery) {
+  if (!callbackQuery.data) return;
+  const parsed = parsePermissionCallbackData(callbackQuery.data);
+  if (!parsed) return;
+  const currentAllowedUserId = process.env.ALLOWED_USER_ID;
+  if (currentAllowedUserId && callbackQuery.from) {
+    if (callbackQuery.from.id.toString() !== currentAllowedUserId) {
+      console.error(
+        `[telegram:channel] permission callback rejected from ${callbackQuery.from.id}`
+      );
+      return;
+    }
+  }
+  if (!pendingPermissionRequests.has(parsed.requestId)) {
+    console.error(
+      `[telegram:channel] unknown permission request_id=${parsed.requestId}`
+    );
+    return;
+  }
+  pendingPermissionRequests.delete(parsed.requestId);
+  const sent = await sendPermissionVerdict(
+    server,
+    parsed.requestId,
+    parsed.behavior
+  );
+  if (sent) {
+    console.error(
+      `[telegram:channel] permission verdict ${parsed.behavior} for ${parsed.requestId}`
+    );
+  }
+  if (bot && !IS_MOCK) {
+    try {
+      await bot.telegram.answerCbQuery(
+        callbackQuery.id,
+        parsed.behavior === "allow" ? "Approved" : "Denied"
+      );
+    } catch (error48) {
+      console.error("[telegram:channel] answerCbQuery failed:", error48);
+    }
+  }
+}
+function startChannelPolling() {
+  if (channelPollTimer || IS_MOCK || !bot) return;
+  channelPollTimer = setInterval(() => {
+    void fetchNewUpdates();
+  }, CHANNEL_POLL_INTERVAL_MS);
+  console.error(
+    `[telegram:channel] background polling started (${CHANNEL_POLL_INTERVAL_MS}ms)`
+  );
+}
+function stopChannelPolling() {
+  if (!channelPollTimer) return;
+  clearInterval(channelPollTimer);
+  channelPollTimer = null;
 }
 server.setRequestHandler(ListToolsRequestSchema, async () => {
   return {
@@ -29129,9 +29372,13 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         const source = { source: safePath };
         const isPhoto = mediaType === "photo" || !mediaType && isImage(safePath);
         if (isPhoto) {
-          const sent = await bot.telegram.sendPhoto(targetId, source, {
-            caption: content
-          });
+          const sent = await bot.telegram.sendPhoto(
+            targetId,
+            source,
+            {
+              caption: content
+            }
+          );
           recordKnownChatFromTelegramMessage(sent);
         } else {
           const sent = await bot.telegram.sendDocument(
@@ -29299,12 +29546,34 @@ ${formatPaginationFooter(offset, limit, activeChats.length)}` : "No active chats
     );
   }
 });
+server.setNotificationHandler(
+  ChannelPermissionRequestNotificationSchema,
+  async (notification) => {
+    await relayPermissionRequestToTelegram(notification.params);
+  }
+);
+server.oninitialized = () => {
+  channelReady = true;
+  console.error(
+    "[telegram:channel] client initialized \u2014 channel push enabled"
+  );
+  startChannelPolling();
+};
 async function run() {
   loadState();
   const transport = new StdioServerTransport();
   await server.connect(transport);
   console.error("Telegram MCP Server running on stdio");
+  if (!IS_MOCK && bot) {
+    void discoverChatsFromApi();
+  }
 }
+process.on("SIGINT", () => {
+  stopChannelPolling();
+});
+process.on("SIGTERM", () => {
+  stopChannelPolling();
+});
 if (process.env.NODE_ENV !== "test") {
   run().catch((error48) => {
     console.error("Fatal error in run():", error48);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fre4x/telegram",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "Telegram MCP server implementing Claude Code Channels for bidirectional communication and remote permission relay.",
   "type": "module",
   "main": "dist/index.js",