@overpod/mcp-telegram 1.18.0 → 1.20.0

package/CHANGELOG.md

@@ -0,0 +1,273 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [1.20.0] - 2026-03-31
+
+### Added
+- **Rate limiting & retry** — automatic FLOOD_WAIT handling, network error recovery with exponential backoff (`src/rate-limiter.ts`)
+- `send-message` now returns `messageId` in the response (`Message sent to @user [#12345]`), enabling send → edit workflows (closes #16)
+- Rate limiter unit tests (7 tests in `src/__tests__/rate-limiter.test.ts`)
+
+### Changed
+- `sendMessage()` return type changed from `void` to `Api.Message | Api.UpdateShortSentMessage | undefined`
+- Write methods (`sendMessage`, `sendFile`, `editMessage`, `deleteMessages`) are now rate-limited with automatic retry on transient errors
+
+## [1.19.0] - 2026-03-30
+
+### Added
+- Docker support for containerized deployment
+- Non-blocking startup behavior
+- Local QR code fallback for authentication
+- Automated test infrastructure with Node.js test runner
+- CI workflow to publish Docker images to GitHub Container Registry
+
+### Changed
+- Added pnpm-lock.yaml for better dependency management
+
+## [1.18.0] - 2026-03-28
+
+### Added
+- New `telegram-get-my-role` tool to check user's role in a chat
+- Role information in `telegram-get-chat-members` results
+
+## [1.17.0] - 2026-03-28
+
+### Added
+- Chat resolution by display name (not just ID or username)
+
+### Changed
+- Updated documentation to replace static tool list with auto-discovery note
+- Improved project structure documentation
+
+## [1.16.0] - 2026-03-28
+
+### Added
+- Group management tools: invite, kick, ban, edit, leave
+- Admin management capabilities
+
+## [1.15.0] - 2026-03-28
+
+### Added
+- `telegram-create-group` tool for creating new groups
+
+### Fixed
+- Documented `AUTH_KEY_DUPLICATED` error handling
+
+## [1.14.0] - 2026-03-28
+
+### Added
+- SOCKS5 proxy support for Telegram connections
+- MTProxy support for Telegram connections
+
+### Changed
+- Updated Biome to 2.4.9 with new config schema
+- Sorted imports for Biome compliance
+- Added proxy documentation to README
+
+## [1.13.0] - 2026-03-26
+
+### Changed
+- Refactored tools into modular files organized by category
+
+## [1.12.0] - 2026-03-26
+
+### Changed
+- Migrated to `registerTool()` API with tool annotations
+
+## [1.11.1] - 2026-03-25
+
+### Fixed
+- Sanitized unpaired UTF-16 surrogates in tool responses
+
+### Changed
+- Upgraded TypeScript to 6.0
+- Updated README with missing tools
+
+## [1.11.0] - 2026-03-23
+
+### Added
+- Full reactions support: read, send multiple reactions, get detailed info
+
+### Changed
+- Included message ID in all message-reading tool outputs
+
+## [1.10.1] - 2026-03-22
+
+### Fixed
+- Message ID now included in all message-reading tool outputs
+
+## [1.10.0] - 2026-03-20
+
+### Added
+- Enhanced `telegram-get-profile` with birthday, business, and premium data
+- New `telegram-get-profile-photo` tool
+- Global message search capability
+- Enriched chat search results
+
+## [1.9.0] - 2026-03-18
+
+### Added
+- Forum Topics support
+- Per-topic unread count for forum groups
+- Secure session storage with configurable path
+- Multiple accounts support
+
+### Fixed
+- Per-topic unread sum calculation for forum groups
+
+### Changed
+- Updated session path and security documentation
+- Upgraded GitHub Actions to v6
+- Replaced Node 20 with Node 24 in CI
+- Updated Biome to 2.4.7 and @types/node to 25.5.0
+
+## [1.8.1] - 2026-03-19
+
+### Fixed
+- Redirected console.log to stderr to prevent MCP JSON-RPC corruption
+
+### Changed
+- Updated dependencies (Biome 2.4.8)
+
+## [1.8.0] - 2026-03-18
+
+### Added
+- Secure session storage with configurable path via SESSION_PATH environment variable
+
+### Changed
+- Updated session path and security information in README
+
+## [1.7.0] - 2026-03-16
+
+### Added
+- CI workflow to publish to GitHub Packages alongside npm
+- Manual workflow dispatch trigger for publishing
+
+## [1.6.0] - 2026-03-16
+
+### Added
+- Contact request management
+- Block/unblock users
+- Report spam functionality
+- Add contact tool
+- ChatGPT to list of supported clients
+
+### Changed
+- Removed hardcoded tool counts from README and package.json
+- Updated Biome to 2.4.7 and @types/node to 25.5.0
+
+## [1.5.0] - 2026-03-16
+
+### Added
+- Reactions support
+- Scheduled messages
+- Polls creation and management
+- `telegram-join-chat` tool for joining groups and channels
+
+### Changed
+- Updated README with new tool documentation
+- Increased tool count to 24
+
+## [1.4.0] - 2026-03-15
+
+### Added
+- Glama.ai MCP catalog verification (glama.json)
+- Smithery MCP catalog listing (smithery.yaml)
+- Demo GIF and badges to README
+- Hosted version link
+
+### Fixed
+- Removed PNG file save from CLI QR login
+
+### Changed
+- Updated README with Glama MCP server badge
+
+## [1.3.1] - 2026-03-12
+
+### Fixed
+- Use `destroy()` instead of `disconnect()` to stop GramJS update loop
+- Adopt QR login client directly instead of destroy+reconnect flow
+- Destroy GramJS client in `logOut()` and `startQrLogin()` to stop update loop
+
+## [1.3.0] - 2026-03-12
+
+### Added
+- `logOut()` method for complete Telegram session termination
+
+## [1.2.0] - 2026-03-11
+
+### Added
+- `downloadMediaAsBuffer` for serverless media download
+- Library exports and declaration types
+- Date filters for messages
+- Comprehensive README for v1.0
+
+### Fixed
+- MIME type detection from magic bytes in `downloadMediaAsBuffer`
+- Made `saveSession` resilient to file write errors in Docker
+
+### Changed
+- Use `GetFullChannel`/`GetFullChat` for complete chat information
+- Improved `telegram-login` for Claude Desktop users
+- Added npm publishing support and GitHub Actions CI/CD
+
+## [1.1.0] - 2026-03-11
+
+### Added
+- Contact management tools
+- Chat members listing
+- User profile retrieval
+- Chat type filter
+- Media tools (send, download, get info)
+- Pin/unpin messages
+- Markdown support
+- Media information in messages
+- Unread counts
+- Mark messages as read
+- Forward messages
+- Edit messages
+- Delete messages
+- Detailed chat information
+- Pagination support
+
+## [1.0.0] - 2026-03-10
+
+### Added
+- Initial release: MCP server for Telegram userbot
+- Basic message reading and sending
+- Chat listing
+- Authentication via phone number and QR code
+- Session persistence
+- GramJS/MTProto integration
+
+[Unreleased]: https://github.com/overpod/mcp-telegram/compare/v1.19.0...HEAD
+[1.19.0]: https://github.com/overpod/mcp-telegram/compare/v1.18.0...v1.19.0
+[1.18.0]: https://github.com/overpod/mcp-telegram/compare/v1.17.0...v1.18.0
+[1.17.0]: https://github.com/overpod/mcp-telegram/compare/v1.16.0...v1.17.0
+[1.16.0]: https://github.com/overpod/mcp-telegram/compare/v1.15.0...v1.16.0
+[1.15.0]: https://github.com/overpod/mcp-telegram/compare/v1.14.0...v1.15.0
+[1.14.0]: https://github.com/overpod/mcp-telegram/compare/v1.13.0...v1.14.0
+[1.13.0]: https://github.com/overpod/mcp-telegram/compare/v1.12.0...v1.13.0
+[1.12.0]: https://github.com/overpod/mcp-telegram/compare/v1.11.1...v1.12.0
+[1.11.1]: https://github.com/overpod/mcp-telegram/compare/v1.11.0...v1.11.1
+[1.11.0]: https://github.com/overpod/mcp-telegram/compare/v1.10.1...v1.11.0
+[1.10.1]: https://github.com/overpod/mcp-telegram/compare/v1.10.0...v1.10.1
+[1.10.0]: https://github.com/overpod/mcp-telegram/compare/v1.9.0...v1.10.0
+[1.9.0]: https://github.com/overpod/mcp-telegram/compare/v1.8.1...v1.9.0
+[1.8.1]: https://github.com/overpod/mcp-telegram/compare/v1.8.0...v1.8.1
+[1.8.0]: https://github.com/overpod/mcp-telegram/compare/v1.7.0...v1.8.0
+[1.7.0]: https://github.com/overpod/mcp-telegram/compare/v1.6.0...v1.7.0
+[1.6.0]: https://github.com/overpod/mcp-telegram/compare/v1.5.0...v1.6.0
+[1.5.0]: https://github.com/overpod/mcp-telegram/compare/v1.4.0...v1.5.0
+[1.4.0]: https://github.com/overpod/mcp-telegram/compare/v1.3.1...v1.4.0
+[1.3.1]: https://github.com/overpod/mcp-telegram/compare/v1.3.0...v1.3.1
+[1.3.0]: https://github.com/overpod/mcp-telegram/compare/v1.2.0...v1.3.0
+[1.2.0]: https://github.com/overpod/mcp-telegram/compare/v1.1.0...v1.2.0
+[1.1.0]: https://github.com/overpod/mcp-telegram/compare/v1.0.0...v1.1.0
+[1.0.0]: https://github.com/overpod/mcp-telegram/releases/tag/v1.0.0

package/README.md

@@ -138,6 +138,34 @@ cd mcp-telegram
 npm install && npm run build
 ```
 
+### Docker
+
+```bash
+docker build -t mcp-telegram https://github.com/overpod/mcp-telegram.git
+```
+
+Login (interactive terminal required):
+
+```bash
+docker run -it --rm \
+  -e TELEGRAM_API_ID=YOUR_ID \
+  -e TELEGRAM_API_HASH=YOUR_HASH \
+  -v ~/.mcp-telegram:/root/.mcp-telegram \
+  --entrypoint node mcp-telegram dist/qr-login-cli.js
+```
+
+Run the MCP server:
+
+```bash
+docker run -i --rm \
+  -e TELEGRAM_API_ID=YOUR_ID \
+  -e TELEGRAM_API_HASH=YOUR_HASH \
+  -v ~/.mcp-telegram:/root/.mcp-telegram \
+  mcp-telegram
+```
+
+> **Note**: Login must be done once via terminal. After that, the session is persisted in `~/.mcp-telegram` and reused automatically.
+
 ## Usage with MCP Clients
 
 ### Claude Code (CLI)
@@ -174,12 +202,37 @@ claude mcp add telegram -s user \
 
 3. Restart Claude Desktop.
 
-4. Ask Claude: **"Run telegram-login"** -- a QR code will appear. If the image is not visible, Claude will provide a browser link to view the QR code. Scan it in Telegram (**Settings > Devices > Link Desktop Device**).
+4. Ask Claude: **"Run telegram-login"** -- a QR code will appear. If the image is not visible, it's also saved to `~/.mcp-telegram/qr-login.png`. Scan it in Telegram (**Settings > Devices > Link Desktop Device**).
 
 5. Ask Claude: **"Run telegram-status"** to verify the connection.
 
 > **Note**: No terminal required! Login works entirely through Claude Desktop.
 
+### Claude Desktop (Docker)
+
+1. Login via terminal first (see [Docker](#docker) section above).
+
+2. Add to your config file:
+
+```json
+{
+  "mcpServers": {
+    "telegram": {
+      "command": "docker",
+      "args": [
+        "run", "-i", "--rm",
+        "-e", "TELEGRAM_API_ID=YOUR_ID",
+        "-e", "TELEGRAM_API_HASH=YOUR_HASH",
+        "-v", "~/.mcp-telegram:/root/.mcp-telegram",
+        "mcp-telegram"
+      ]
+    }
+  }
+}
+```
+
+3. Restart Claude Desktop. Ask Claude: **"Run telegram-status"** to verify.
+
 ### Cursor / VS Code
 
 Add the same JSON config above to your MCP settings (Cursor Settings > MCP, or VS Code MCP config).
@@ -276,6 +329,8 @@ Then set `TELEGRAM_SESSION_PATH` in each environment's MCP config accordingly.
 - Session is stored in `~/.mcp-telegram/session` with `0600` permissions (owner-only access)
 - Session directory is created with `0700` permissions
 - Phone number is **not required** -- QR-only authentication
+- No data is sent to third-party services -- all communication goes directly to Telegram servers via MTProto
+- QR login codes are generated locally and never leave your machine
 - **One session per process** -- using the same session in multiple processes simultaneously causes `AUTH_KEY_DUPLICATED` errors (see [Troubleshooting](#troubleshooting))
 - This is a **userbot** (personal account), not a bot -- respect the [Telegram Terms of Service](https://core.telegram.org/api/terms)
 

package/dist/__tests__/rate-limiter.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/rate-limiter.test.js

@@ -0,0 +1,81 @@
+import assert from "node:assert";
+import { describe, it } from "node:test";
+import { RateLimiter } from "../rate-limiter.js";
+describe("RateLimiter", () => {
+    it("should execute a function successfully", async () => {
+        const limiter = new RateLimiter({ maxRequestsPerSecond: 100 });
+        const result = await limiter.execute(async () => "success");
+        assert.strictEqual(result, "success");
+    });
+    it("should enforce rate limiting between requests", async () => {
+        const limiter = new RateLimiter({ maxRequestsPerSecond: 10 }); // 10 req/s = 100ms between requests
+        const start = Date.now();
+        await limiter.execute(async () => "first");
+        await limiter.execute(async () => "second");
+        const elapsed = Date.now() - start;
+        assert.ok(elapsed >= 90, `Expected at least 90ms, got ${elapsed}ms`);
+    });
+    it("should retry on FLOOD_WAIT error", async () => {
+        const limiter = new RateLimiter({ maxRetries: 2, maxRequestsPerSecond: 100 });
+        let attempts = 0;
+        const result = await limiter.execute(async () => {
+            attempts++;
+            if (attempts < 2) {
+                throw new Error("FLOOD_WAIT_1");
+            }
+            return "success after retry";
+        });
+        assert.strictEqual(result, "success after retry");
+        assert.strictEqual(attempts, 2);
+    });
+    it("should throw after max retries on FLOOD_WAIT", async () => {
+        const limiter = new RateLimiter({ maxRetries: 1, maxRequestsPerSecond: 100 });
+        await assert.rejects(async () => {
+            await limiter.execute(async () => {
+                throw new Error("FLOOD_WAIT_2");
+            });
+        }, {
+            message: /Rate limit exceeded after 1 retries/,
+        });
+    });
+    it("should retry on network errors with exponential backoff", async () => {
+        const limiter = new RateLimiter({
+            maxRetries: 2,
+            initialRetryDelay: 100,
+            maxRequestsPerSecond: 100,
+        });
+        let attempts = 0;
+        const result = await limiter.execute(async () => {
+            attempts++;
+            if (attempts < 2) {
+                throw new Error("TIMEOUT");
+            }
+            return "recovered";
+        });
+        assert.strictEqual(result, "recovered");
+        assert.strictEqual(attempts, 2);
+    });
+    it("should not retry on non-retryable errors", async () => {
+        const limiter = new RateLimiter({ maxRetries: 3, maxRequestsPerSecond: 100 });
+        let attempts = 0;
+        await assert.rejects(async () => {
+            await limiter.execute(async () => {
+                attempts++;
+                throw new Error("AUTH_KEY_UNREGISTERED");
+            });
+        }, {
+            message: "AUTH_KEY_UNREGISTERED",
+        });
+        assert.strictEqual(attempts, 1, "Should not retry non-retryable errors");
+    });
+    it("should handle FLOOD_WAIT with seconds parsing", async () => {
+        const limiter = new RateLimiter({ maxRetries: 1, maxRequestsPerSecond: 100 });
+        await assert.rejects(async () => {
+            await limiter.execute(async () => {
+                throw new Error("FLOOD_WAIT_1");
+            });
+        }, {
+            message: /Telegram requires 1s wait/,
+        });
+    });
+});

package/dist/__tests__/tools/shared.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/tools/shared.test.js

@@ -0,0 +1,110 @@
+import assert from "node:assert";
+import { describe, it } from "node:test";
+import { DESTRUCTIVE, fail, formatReactions, ok, READ_ONLY, sanitize, WRITE } from "../../tools/shared.js";
+describe("shared utilities", () => {
+    describe("ok()", () => {
+        it("should return success response with text content", () => {
+            const result = ok("Operation successful");
+            assert.deepStrictEqual(result, {
+                content: [{ type: "text", text: "Operation successful" }],
+            });
+        });
+        it("should handle empty string", () => {
+            const result = ok("");
+            assert.deepStrictEqual(result, {
+                content: [{ type: "text", text: "" }],
+            });
+        });
+    });
+    describe("fail()", () => {
+        it("should return error response with isError flag", () => {
+            const error = new Error("Something went wrong");
+            const result = fail(error);
+            assert.deepStrictEqual(result, {
+                content: [{ type: "text", text: "Error: Something went wrong" }],
+                isError: true,
+            });
+        });
+        it("should handle non-Error objects", () => {
+            const result = fail({ message: "Custom error" });
+            assert.ok(result.content[0].text.includes("Error:"));
+            assert.strictEqual(result.isError, true);
+        });
+    });
+    describe("sanitize()", () => {
+        it("should remove unpaired high surrogates", () => {
+            const input = "Hello\uD800World";
+            const result = sanitize(input);
+            assert.strictEqual(result, "Hello\uFFFDWorld");
+        });
+        it("should remove unpaired low surrogates", () => {
+            const input = "Hello\uDC00World";
+            const result = sanitize(input);
+            assert.strictEqual(result, "Hello\uFFFDWorld");
+        });
+        it("should preserve valid surrogate pairs", () => {
+            const input = "Hello\uD83D\uDE00World"; // 😀 emoji
+            const result = sanitize(input);
+            assert.strictEqual(result, "Hello\uD83D\uDE00World");
+        });
+        it("should handle normal text without surrogates", () => {
+            const input = "Hello World";
+            const result = sanitize(input);
+            assert.strictEqual(result, "Hello World");
+        });
+        it("should handle empty string", () => {
+            const result = sanitize("");
+            assert.strictEqual(result, "");
+        });
+    });
+    describe("formatReactions()", () => {
+        it("should format reactions with counts", () => {
+            const reactions = [
+                { emoji: "👍", count: 5, me: false },
+                { emoji: "❤️", count: 3, me: true },
+                { emoji: "🔥", count: 1, me: false },
+            ];
+            const result = formatReactions(reactions);
+            assert.strictEqual(result, " [👍×5 ❤️×3(me) 🔥×1]");
+        });
+        it("should mark reactions from current user", () => {
+            const reactions = [{ emoji: "👍", count: 2, me: true }];
+            const result = formatReactions(reactions);
+            assert.strictEqual(result, " [👍×2(me)]");
+        });
+        it("should return empty string for undefined reactions", () => {
+            const result = formatReactions(undefined);
+            assert.strictEqual(result, "");
+        });
+        it("should return empty string for empty reactions array", () => {
+            const result = formatReactions([]);
+            assert.strictEqual(result, "");
+        });
+        it("should handle single reaction", () => {
+            const reactions = [{ emoji: "🎉", count: 1, me: false }];
+            const result = formatReactions(reactions);
+            assert.strictEqual(result, " [🎉×1]");
+        });
+    });
+    describe("MCP tool annotations", () => {
+        it("should define READ_ONLY preset", () => {
+            assert.deepStrictEqual(READ_ONLY, {
+                readOnlyHint: true,
+                openWorldHint: true,
+            });
+        });
+        it("should define WRITE preset", () => {
+            assert.deepStrictEqual(WRITE, {
+                readOnlyHint: false,
+                openWorldHint: true,
+            });
+        });
+        it("should define DESTRUCTIVE preset", () => {
+            assert.deepStrictEqual(DESTRUCTIVE, {
+                readOnlyHint: false,
+                destructiveHint: true,
+                openWorldHint: true,
+            });
+        });
+    });
+});

package/dist/index.js

@@ -14,7 +14,9 @@ import { registerTools } from "./tools/index.js";
 const API_ID = Number(process.env.TELEGRAM_API_ID);
 const API_HASH = process.env.TELEGRAM_API_HASH;
 if (!API_ID || !API_HASH) {
-    console.error("[mcp-telegram] TELEGRAM_API_ID and TELEGRAM_API_HASH must be set");
+    console.error("[mcp-telegram] Missing TELEGRAM_API_ID and TELEGRAM_API_HASH");
+    console.error("Get your credentials at https://my.telegram.org/apps (API development tools)");
+    console.error("Set them in .env or export as environment variables");
     process.exit(1);
 }
 const telegram = new TelegramService(API_ID, API_HASH);
@@ -24,18 +26,19 @@ const server = new McpServer({
 });
 registerTools(server, telegram);
 async function main() {
-    // Try to auto-connect with saved session
-    await telegram.loadSession();
-    if (await telegram.connect()) {
-        const me = await telegram.getMe();
-        console.error(`[mcp-telegram] Auto-connected as @${me.username}`);
-    }
-    else if (telegram.lastError) {
-        console.error(`[mcp-telegram] ${telegram.lastError}`);
-    }
     const transport = new StdioServerTransport();
     await server.connect(transport);
     console.error("[mcp-telegram] MCP server running on stdio");
+    // Auto-connect with saved session after MCP is ready (non-blocking)
+    telegram.loadSession().then(async () => {
+        if (await telegram.connect()) {
+            const me = await telegram.getMe();
+            console.error(`[mcp-telegram] Auto-connected as @${me.username}`);
+        }
+        else if (telegram.lastError) {
+            console.error(`[mcp-telegram] ${telegram.lastError}`);
+        }
+    });
 }
 main().catch((err) => {
     console.error("[mcp-telegram] Fatal:", err);

package/dist/rate-limiter.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Rate limiter and retry logic for Telegram API calls.
+ * Handles FLOOD_WAIT errors and implements exponential backoff.
+ */
+export interface RateLimiterOptions {
+    /** Maximum number of requests per second (default: 20) */
+    maxRequestsPerSecond?: number;
+    /** Maximum number of retry attempts (default: 3) */
+    maxRetries?: number;
+    /** Initial retry delay in milliseconds (default: 1000) */
+    initialRetryDelay?: number;
+    /** Maximum retry delay in milliseconds (default: 60000) */
+    maxRetryDelay?: number;
+}
+export declare class RateLimiter {
+    private lastRequestTime;
+    private minInterval;
+    private maxRetries;
+    private initialRetryDelay;
+    private maxRetryDelay;
+    constructor(options?: RateLimiterOptions);
+    /** Execute a function with rate limiting and automatic retry */
+    execute<T>(fn: () => Promise<T>, context?: string): Promise<T>;
+    private executeWithRetry;
+    private waitForSlot;
+}

package/dist/rate-limiter.js

@@ -0,0 +1,80 @@
+/**
+ * Rate limiter and retry logic for Telegram API calls.
+ * Handles FLOOD_WAIT errors and implements exponential backoff.
+ */
+export class RateLimiter {
+    lastRequestTime = 0;
+    minInterval;
+    maxRetries;
+    initialRetryDelay;
+    maxRetryDelay;
+    constructor(options = {}) {
+        const maxRequestsPerSecond = options.maxRequestsPerSecond ?? 20;
+        this.minInterval = 1000 / maxRequestsPerSecond;
+        this.maxRetries = options.maxRetries ?? 3;
+        this.initialRetryDelay = options.initialRetryDelay ?? 1000;
+        this.maxRetryDelay = options.maxRetryDelay ?? 60000;
+    }
+    /** Execute a function with rate limiting and automatic retry */
+    async execute(fn, context = "API call") {
+        return this.executeWithRetry(fn, context, 0);
+    }
+    async executeWithRetry(fn, context, attempt) {
+        await this.waitForSlot();
+        try {
+            return await fn();
+        }
+        catch (error) {
+            const errorMessage = error.errorMessage || error.message || String(error);
+            // FLOOD_WAIT — wait the exact time Telegram requires
+            const floodMatch = errorMessage.match(/FLOOD_WAIT[_]?(\d+)/i);
+            if (floodMatch) {
+                const waitSeconds = Number.parseInt(floodMatch[1], 10);
+                if (attempt >= this.maxRetries) {
+                    throw new Error(`Rate limit exceeded after ${this.maxRetries} retries. Telegram requires ${waitSeconds}s wait. Try again later.`);
+                }
+                console.error(`[rate-limiter] FLOOD_WAIT for ${context}. Waiting ${waitSeconds}s (attempt ${attempt + 1}/${this.maxRetries})`);
+                await sleep(waitSeconds * 1000);
+                return this.executeWithRetry(fn, context, attempt + 1);
+            }
+            // Network/timeout errors — exponential backoff
+            if (isNetworkError(errorMessage)) {
+                if (attempt >= this.maxRetries) {
+                    throw new Error(`Network error after ${this.maxRetries} retries: ${errorMessage}. Check your connection.`);
+                }
+                const delay = Math.min(this.initialRetryDelay * 2 ** attempt, this.maxRetryDelay);
+                console.error(`[rate-limiter] Network error for ${context}. Retrying in ${delay}ms (attempt ${attempt + 1}/${this.maxRetries})`);
+                await sleep(delay);
+                return this.executeWithRetry(fn, context, attempt + 1);
+            }
+            // Temporary server errors (5xx) — exponential backoff
+            if (isTemporaryError(errorMessage)) {
+                if (attempt >= this.maxRetries) {
+                    throw new Error(`Temporary error after ${this.maxRetries} retries: ${errorMessage}`);
+                }
+                const delay = Math.min(this.initialRetryDelay * 2 ** attempt, this.maxRetryDelay);
+                await sleep(delay);
+                return this.executeWithRetry(fn, context, attempt + 1);
+            }
+            // Non-retryable — throw immediately
+            throw error;
+        }
+    }
+    async waitForSlot() {
+        const now = Date.now();
+        const elapsed = now - this.lastRequestTime;
+        if (elapsed < this.minInterval) {
+            await sleep(this.minInterval - elapsed);
+        }
+        this.lastRequestTime = Date.now();
+    }
+}
+function isNetworkError(msg) {
+    return /TIMEOUT|ETIMEDOUT|ECONNREFUSED|ENETUNREACH|ENOTFOUND|EHOSTUNREACH|network|timed out/i.test(msg);
+}
+function isTemporaryError(msg) {
+    return /INTERNAL|^50[023]$|Internal Server Error|Service Unavailable|Bad Gateway/i.test(msg);
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/dist/telegram-client.d.ts

@@ -1,3 +1,4 @@
+import { Api } from "telegram/tl/index.js";
 export declare class TelegramService {
     private client;
     private apiId;
@@ -5,7 +6,9 @@ export declare class TelegramService {
     private sessionString;
     private connected;
     private sessionPath;
+    private rateLimiter;
     lastError: string;
+    get sessionDir(): string;
     constructor(apiId: number, apiHash: string, options?: {
         sessionPath?: string;
     });
@@ -36,7 +39,7 @@ export declare class TelegramService {
         username?: string;
         firstName?: string;
     }>;
-    sendMessage(chatId: string, text: string, replyTo?: number, parseMode?: "md" | "html", topicId?: number): Promise<void>;
+    sendMessage(chatId: string, text: string, replyTo?: number, parseMode?: "md" | "html", topicId?: number): Promise<Api.Message | Api.UpdateShortSentMessage | undefined>;
     sendFile(chatId: string, filePath: string, caption?: string): Promise<void>;
     downloadMedia(chatId: string, messageId: number, downloadPath: string): Promise<string>;
     downloadMediaAsBuffer(chatId: string, messageId: number): Promise<{

package/dist/telegram-client.js

@@ -9,12 +9,14 @@ import { TelegramClient } from "telegram";
 import { CustomFile } from "telegram/client/uploads.js";
 import { StringSession } from "telegram/sessions/index.js";
 import { Api } from "telegram/tl/index.js";
+import { RateLimiter } from "./rate-limiter.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const LEGACY_SESSION_FILE = join(__dirname, "..", ".telegram-session");
 const DEFAULT_SESSION_DIR = join(homedir(), ".mcp-telegram");
 const DEFAULT_SESSION_FILE = join(DEFAULT_SESSION_DIR, "session");
 const SESSION_STRING_RE = /^[A-Za-z0-9+/=]+$/;
 const MIN_SESSION_LENGTH = 100;
+const NOT_CONNECTED_ERROR = "Not connected. Run telegram-status to check or telegram-login to authenticate.";
 function resolveSessionPath(sessionPath) {
     return sessionPath ?? process.env.TELEGRAM_SESSION_PATH ?? DEFAULT_SESSION_FILE;
 }
@@ -49,7 +51,11 @@ export class TelegramService {
     sessionString = "";
     connected = false;
     sessionPath;
+    rateLimiter = new RateLimiter();
     lastError = "";
+    get sessionDir() {
+        return dirname(this.sessionPath);
+    }
     constructor(apiId, apiHash, options) {
         this.apiId = apiId;
         this.apiHash = apiHash;
@@ -133,7 +139,7 @@ export class TelegramService {
             // Auth revoked — delete invalid session
             if (msg === "AUTH_KEY_UNREGISTERED" || msg === "SESSION_REVOKED" || msg === "USER_DEACTIVATED") {
                 await this.clearSession();
-                this.lastError = "Session revoked. Re-login required.";
+                this.lastError = "Session revoked. Run telegram-login to re-authenticate.";
             }
             // Network error — keep session, just report
             else if (msg.includes("TIMEOUT") ||
@@ -141,7 +147,7 @@ export class TelegramService {
                 msg.includes("ENETUNREACH") ||
                 msg.includes("ENOTFOUND") ||
                 msg.includes("network")) {
-                this.lastError = `Network error: ${msg}. Session preserved, will retry on next call.`;
+                this.lastError = `Network error: ${msg}. Run telegram-status to retry connection.`;
             }
             // Unknown error
             else {
@@ -287,7 +293,7 @@ export class TelegramService {
     }
     async getMe() {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const me = await this.client.getMe();
         const user = me;
         return {
@@ -298,38 +304,47 @@ export class TelegramService {
     }
     async sendMessage(chatId, text, replyTo, parseMode, topicId) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
-        const resolved = await this.resolvePeer(chatId);
-        if (topicId) {
-            // Forum topics require raw API call with InputReplyToMessage
-            const peer = await this.client.getInputEntity(resolved);
-            await this.client.invoke(new Api.messages.SendMessage({
-                peer,
-                message: text,
-                randomId: bigInt(Math.floor(Math.random() * 1e15)),
-                replyTo: new Api.InputReplyToMessage({
-                    replyToMsgId: replyTo ?? topicId,
-                    topMsgId: topicId,
-                }),
-            }));
-        }
-        else {
-            await this.client.sendMessage(resolved, {
+            throw new Error(NOT_CONNECTED_ERROR);
+        return this.rateLimiter.execute(async () => {
+            const resolved = await this.resolvePeer(chatId);
+            if (topicId) {
+                const peer = await this.client?.getInputEntity(resolved);
+                const result = await this.client?.invoke(new Api.messages.SendMessage({
+                    peer,
+                    message: text,
+                    randomId: bigInt(Math.floor(Math.random() * 1e15)),
+                    replyTo: new Api.InputReplyToMessage({
+                        replyToMsgId: replyTo ?? topicId,
+                        topMsgId: topicId,
+                    }),
+                }));
+                if (result instanceof Api.UpdateShortSentMessage)
+                    return result;
+                if (result instanceof Api.Updates || result instanceof Api.UpdatesCombined) {
+                    const msgUpdate = result.updates.find((u) => u instanceof Api.UpdateNewMessage);
+                    if (msgUpdate?.message instanceof Api.Message)
+                        return msgUpdate.message;
+                }
+                return undefined;
+            }
+            return await this.client?.sendMessage(resolved, {
                 message: text,
                 ...(replyTo ? { replyTo } : {}),
                 ...(parseMode ? { parseMode: parseMode === "html" ? "html" : "md" } : {}),
             });
-        }
+        }, `sendMessage to ${chatId}`);
     }
     async sendFile(chatId, filePath, caption) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
-        const resolved = await this.resolvePeer(chatId);
-        await this.client.sendFile(resolved, { file: filePath, caption });
+            throw new Error(NOT_CONNECTED_ERROR);
+        await this.rateLimiter.execute(async () => {
+            const resolved = await this.resolvePeer(chatId);
+            await this.client?.sendFile(resolved, { file: filePath, caption });
+        }, `sendFile to ${chatId}`);
     }
     async downloadMedia(chatId, messageId, downloadPath) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const resolved = await this.resolvePeer(chatId);
         const messages = await this.client.getMessages(resolved, { ids: [messageId] });
         const message = messages[0];
@@ -345,7 +360,7 @@ export class TelegramService {
     }
     async downloadMediaAsBuffer(chatId, messageId) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const resolved = await this.resolvePeer(chatId);
         const messages = await this.client.getMessages(resolved, { ids: [messageId] });
         const message = messages[0];
@@ -381,19 +396,19 @@ export class TelegramService {
     }
     async pinMessage(chatId, messageId, silent = false) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const resolved = await this.resolvePeer(chatId);
         await this.client.pinMessage(resolved, messageId, { notify: !silent });
     }
     async unpinMessage(chatId, messageId) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const resolved = await this.resolvePeer(chatId);
         await this.client.unpinMessage(resolved, messageId);
     }
     async getDialogs(limit = 20, offsetDate, filterType) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const fetchLimit = filterType ? limit * 3 : limit;
         const dialogs = await this.client.getDialogs({ limit: fetchLimit, ...(offsetDate ? { offsetDate } : {}) });
         const mapped = dialogs.map((d) => {
@@ -416,7 +431,7 @@ export class TelegramService {
     }
     async getUnreadDialogs(limit = 20) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const dialogs = await this.client.getDialogs({ limit: limit * 3 });
         const unread = dialogs.filter((d) => d.unreadCount > 0).slice(0, limit);
         const results = await Promise.all(unread.map(async (d) => {
@@ -457,7 +472,7 @@ export class TelegramService {
     }
     async getContactRequests(limit = 20) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const dialogs = await this.client.getDialogs({ limit: limit * 5 });
         return dialogs
             .filter((d) => {
@@ -482,7 +497,7 @@ export class TelegramService {
     }
     async addContact(userId, firstName, lastName, phone) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const entity = await this.client.getInputEntity(userId);
         await this.client.invoke(new Api.contacts.AddContact({
             id: entity,
@@ -493,39 +508,43 @@ export class TelegramService {
     }
     async blockUser(userId) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const entity = await this.client.getInputEntity(userId);
         await this.client.invoke(new Api.contacts.Block({ id: entity }));
     }
     async reportSpam(chatId) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const peer = await this.client.getInputEntity(chatId);
         await this.client.invoke(new Api.messages.ReportSpam({ peer }));
     }
     async markAsRead(chatId) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         await this.client.markAsRead(chatId);
     }
     async forwardMessage(fromChatId, toChatId, messageIds) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const resolvedFrom = await this.resolvePeer(fromChatId);
         const resolvedTo = await this.resolvePeer(toChatId);
         await this.client.forwardMessages(resolvedTo, { messages: messageIds, fromPeer: resolvedFrom });
     }
     async editMessage(chatId, messageId, newText) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
-        const resolved = await this.resolvePeer(chatId);
-        await this.client.editMessage(resolved, { message: messageId, text: newText });
+            throw new Error(NOT_CONNECTED_ERROR);
+        await this.rateLimiter.execute(async () => {
+            const resolved = await this.resolvePeer(chatId);
+            await this.client?.editMessage(resolved, { message: messageId, text: newText });
+        }, `editMessage ${messageId} in ${chatId}`);
     }
     async deleteMessages(chatId, messageIds) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
-        const resolved = await this.resolvePeer(chatId);
-        await this.client.deleteMessages(resolved, messageIds, { revoke: true });
+            throw new Error(NOT_CONNECTED_ERROR);
+        await this.rateLimiter.execute(async () => {
+            const resolved = await this.resolvePeer(chatId);
+            await this.client?.deleteMessages(resolved, messageIds, { revoke: true });
+        }, `deleteMessages in ${chatId}`);
     }
     /**
      * Resolve a chat by ID, username, or display name.
@@ -534,7 +553,7 @@ export class TelegramService {
     // biome-ignore lint: GramJS has no proper entity union type
     async resolveChat(chatId) {
         if (!this.client)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         // First try direct resolve (numeric ID, username, phone)
         try {
             return await this.client.getEntity(chatId);
@@ -573,7 +592,7 @@ export class TelegramService {
     }
     async getChatInfo(chatId) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const entity = await this.resolveChat(chatId);
         if (entity instanceof Api.User) {
             const parts = [entity.firstName, entity.lastName].filter(Boolean);
@@ -681,7 +700,7 @@ export class TelegramService {
     }
     async getMessages(chatId, limit = 10, offsetId, minDate, maxDate) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const resolved = await this.resolvePeer(chatId);
         const opts = {
             limit,
@@ -705,7 +724,7 @@ export class TelegramService {
     }
     async searchChats(query, limit = 10) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const result = await this.client.invoke(new Api.contacts.Search({ q: query, limit }));
         const chats = [];
         for (const user of result.users) {
@@ -766,7 +785,7 @@ export class TelegramService {
     }
     async searchGlobal(query, limit = 20, minDate, maxDate) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const result = await this.client.invoke(new Api.messages.SearchGlobal({
             q: query,
             filter: new Api.InputMessagesFilterEmpty(),
@@ -835,7 +854,7 @@ export class TelegramService {
     }
     async searchMessages(chatId, query, limit = 20, minDate, maxDate) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const resolved = await this.resolvePeer(chatId);
         const messages = await this.client.getMessages(resolved, {
             search: query,
@@ -858,7 +877,7 @@ export class TelegramService {
     }
     async getContacts(limit = 50) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const result = await this.client.invoke(new Api.contacts.GetContacts({ hash: bigInt(0) }));
         if (!(result instanceof Api.contacts.Contacts))
             return [];
@@ -878,7 +897,7 @@ export class TelegramService {
     }
     async getChatMembers(chatId, limit = 50) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const entity = await this.resolveChat(chatId);
         if (entity instanceof Api.Channel) {
             const result = await this.client.invoke(new Api.channels.GetParticipants({
@@ -923,7 +942,7 @@ export class TelegramService {
     }
     async getMyRole(chatId) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const entity = await this.resolveChat(chatId);
         const me = await this.getMe();
         if (entity instanceof Api.Channel) {
@@ -975,7 +994,7 @@ export class TelegramService {
     }
     async getProfile(userId) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const entity = await this.client.getEntity(userId);
         if (!(entity instanceof Api.User))
             throw new Error("Entity is not a user");
@@ -1035,7 +1054,7 @@ export class TelegramService {
     }
     async downloadProfilePhoto(entityId, options) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const entity = await this.client.getEntity(entityId);
         const buffer = (await this.client.downloadProfilePhoto(entity, {
             isBig: options?.isBig !== false,
@@ -1086,7 +1105,7 @@ export class TelegramService {
     }
     async sendReaction(chatId, messageId, emoji, addToExisting = false) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const resolved = await this.resolvePeer(chatId);
         const peer = await this.client.getInputEntity(resolved);
         const reactionList = [];
@@ -1126,7 +1145,7 @@ export class TelegramService {
     }
     async getMessageReactions(chatId, messageId) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const resolved = await this.resolvePeer(chatId);
         const peer = await this.client.getInputEntity(resolved);
         // First get the message to know which reactions exist
@@ -1181,7 +1200,7 @@ export class TelegramService {
     }
     async sendScheduledMessage(chatId, text, scheduleDate, replyTo, parseMode) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const resolved = await this.resolvePeer(chatId);
         await this.client.sendMessage(resolved, {
             message: text,
@@ -1192,7 +1211,7 @@ export class TelegramService {
     }
     async createPoll(chatId, question, answers, options) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const peer = await this.client.getInputEntity(chatId);
         const pollAnswers = answers.map((text, i) => new Api.PollAnswer({
             text: new Api.TextWithEntities({ text, entities: [] }),
@@ -1228,7 +1247,7 @@ export class TelegramService {
     }
     async getForumTopics(chatId, limit = 100) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const entity = await this.resolveChat(chatId);
         if (!(entity instanceof Api.Channel))
             throw new Error("Forum topics are only available in supergroups");
@@ -1257,7 +1276,7 @@ export class TelegramService {
     }
     async getTopicMessages(chatId, topicId, limit = 20, offsetId) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const peer = await this.client.getInputEntity(chatId);
         const result = await this.client.invoke(new Api.messages.GetReplies({
             peer,
@@ -1286,7 +1305,7 @@ export class TelegramService {
     /** Check if a chat entity is a forum (has topics enabled) */
     async isForum(chatId) {
         if (!this.client || !this.connected)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         try {
             const entity = await this.resolveChat(chatId);
             if (entity instanceof Api.Channel) {
@@ -1298,7 +1317,7 @@ export class TelegramService {
     }
     async joinChat(target) {
         if (!this.client)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         // Extract invite hash from various link formats
         const inviteMatch = target.match(/(?:t\.me\/\+|t\.me\/joinchat\/|tg:\/\/join\?invite=)([a-zA-Z0-9_-]+)/);
         if (inviteMatch) {
@@ -1329,7 +1348,7 @@ export class TelegramService {
     }
     async createGroup(options) {
         if (!this.client)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const { title, users, supergroup = false, forum = false, description } = options;
         if (supergroup || forum) {
             // Create supergroup/channel via channels.CreateChannel
@@ -1403,7 +1422,7 @@ export class TelegramService {
     }
     async inviteToGroup(chatId, users) {
         if (!this.client)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const entity = await this.resolveChat(chatId);
         const invited = [];
         const failed = [];
@@ -1431,7 +1450,7 @@ export class TelegramService {
     }
     async kickUser(chatId, userId) {
         if (!this.client)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const entity = await this.resolveChat(chatId);
         const user = await this.client.getEntity(userId);
         if (!(user instanceof Api.User))
@@ -1456,7 +1475,7 @@ export class TelegramService {
     }
     async banUser(chatId, userId) {
         if (!this.client)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const entity = await this.resolveChat(chatId);
         const user = await this.client.getEntity(userId);
         if (!(user instanceof Api.User))
@@ -1472,7 +1491,7 @@ export class TelegramService {
     }
     async unbanUser(chatId, userId) {
         if (!this.client)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const entity = await this.resolveChat(chatId);
         const user = await this.client.getEntity(userId);
         if (!(user instanceof Api.User))
@@ -1488,7 +1507,7 @@ export class TelegramService {
     }
     async editGroup(chatId, options) {
         if (!this.client)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const entity = await this.resolveChat(chatId);
         if (options.title) {
             if (entity instanceof Api.Channel) {
@@ -1518,7 +1537,7 @@ export class TelegramService {
     }
     async leaveGroup(chatId) {
         if (!this.client)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const entity = await this.resolveChat(chatId);
         if (entity instanceof Api.Channel) {
             await this.client.invoke(new Api.channels.LeaveChannel({ channel: entity }));
@@ -1535,7 +1554,7 @@ export class TelegramService {
     }
     async setAdmin(chatId, userId, options) {
         if (!this.client)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const entity = await this.resolveChat(chatId);
         if (!(entity instanceof Api.Channel))
             throw new Error("Set admin is only supported for supergroups and channels");
@@ -1561,7 +1580,7 @@ export class TelegramService {
     }
     async removeAdmin(chatId, userId) {
         if (!this.client)
-            throw new Error("Not connected");
+            throw new Error(NOT_CONNECTED_ERROR);
         const entity = await this.resolveChat(chatId);
         if (!(entity instanceof Api.Channel))
             throw new Error("Remove admin is only supported for supergroups and channels");

package/dist/tools/auth.js

@@ -1,3 +1,5 @@
+import { writeFile } from "node:fs/promises";
+import { join } from "node:path";
 import { fail, ok, READ_ONLY, WRITE } from "./shared.js";
 export function registerAuthTools(server, telegram) {
     server.registerTool("telegram-status", { description: "Check Telegram connection status", annotations: READ_ONLY }, async () => {
@@ -18,11 +20,8 @@ export function registerAuthTools(server, telegram) {
         annotations: WRITE,
     }, async () => {
         let qrDataUrl = "";
-        let qrRawUrl = "";
         const loginPromise = telegram.startQrLogin((dataUrl) => {
             qrDataUrl = dataUrl;
-        }, (url) => {
-            qrRawUrl = url;
         });
         // Wait for first QR to be generated
         const startTime = Date.now();
@@ -41,20 +40,17 @@ export function registerAuthTools(server, telegram) {
                 console.error(`[mcp-telegram] Login failed: ${result.message}`);
             }
         });
-        // Return as MCP image content + text with fallback options
+        // Save QR to file as fallback (no data sent to third-party services)
         const base64 = qrDataUrl.replace(/^data:image\/png;base64,/, "");
-        const qrApiUrl = qrRawUrl
-            ? `https://api.qrserver.com/v1/create-qr-code/?size=256x256&data=${encodeURIComponent(qrRawUrl)}`
-            : "";
+        const qrFilePath = join(telegram.sessionDir, "qr-login.png");
+        await writeFile(qrFilePath, Buffer.from(base64, "base64")).catch(() => { });
         const instructions = [
             "Scan this QR code in Telegram: **Settings → Devices → Link Desktop Device**.",
             "",
-            qrApiUrl ? `If the QR image is not visible, open this link in your browser:\n${qrApiUrl}` : "",
+            `If the QR image is not visible, it's also saved to: ${qrFilePath}`,
             "",
             "After scanning, run **telegram-status** to verify the connection.",
-        ]
-            .filter(Boolean)
-            .join("\n");
+        ].join("\n");
         return {
             content: [
                 {

package/dist/tools/messages.js

@@ -16,9 +16,11 @@ export function registerMessageTools(server, telegram) {
         if (err)
             return fail(new Error(err));
         try {
-            await telegram.sendMessage(chatId, text, replyTo, parseMode, topicId);
+            const result = await telegram.sendMessage(chatId, text, replyTo, parseMode, topicId);
             const dest = topicId ? `topic ${topicId} in ${chatId}` : chatId;
-            return ok(`Message sent to ${dest}`);
+            const messageId = result?.id;
+            const idInfo = messageId ? ` [#${messageId}]` : "";
+            return ok(`Message sent to ${dest}${idInfo}`);
         }
         catch (e) {
             return fail(e);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overpod/mcp-telegram",
-  "version": "1.18.0",
+  "version": "1.20.0",
   "description": "MCP server for Telegram userbot — messages, media, reactions, polls & more. Built on GramJS/MTProto.",
   "type": "module",
   "main": "dist/index.js",
@@ -14,7 +14,8 @@
   "files": [
     "dist",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "dev": "tsx watch src/index.ts",
@@ -25,7 +26,9 @@
     "prepublishOnly": "npm run build",
     "lint": "biome check src/",
     "lint:fix": "biome check --fix src/",
-    "format": "biome format --write src/"
+    "format": "biome format --write src/",
+    "test": "tsx --test src/**/*.test.ts",
+    "test:watch": "tsx --test --watch src/**/*.test.ts"
   },
   "keywords": [
     "mcp",