@overpod/mcp-telegram 1.28.0 → 1.28.1

package/README.md

@@ -316,7 +316,7 @@ All tools are auto-discoverable via MCP — your AI client will see the full lis
 
 | Category | Tools |
 |----------|-------|
-| **Auth** | `telegram-status`, `telegram-login` |
+| **Auth** | `telegram-status`, `telegram-login`, `telegram-logout` |
 | **Messaging** | `telegram-send-message`, `telegram-edit-message`, `telegram-delete-message`, `telegram-forward-message`, `telegram-send-scheduled`, `telegram-send-typing`, `telegram-translate-message`, `telegram-get-message-link` |
 | **Scheduled** | `telegram-get-scheduled`, `telegram-delete-scheduled` |
 | **Reading** | `telegram-list-chats`, `telegram-read-messages`, `telegram-search-messages`, `telegram-search-global`, `telegram-search-chats`, `telegram-get-unread`, `telegram-mark-as-read`, `telegram-get-replies`, `telegram-get-unread-mentions`, `telegram-get-unread-reactions`, `telegram-get-saved-dialogs` |

package/dist/master.js

@@ -81,6 +81,11 @@ async function handleToolRequest(socket, req, mcpServer) {
         response.error = `Unknown tool: ${req.tool}`;
     }
     else {
+        // telegram-logout must cancel an in-progress QR login instead of queueing behind it
+        // for up to 5 minutes. Aborting releases the globalLock held by handleLoginStart.
+        if (req.tool === "telegram-logout" && activeLogin) {
+            activeLogin.abort.abort();
+        }
         const unlock = await globalLock.acquire();
         try {
             response.result = await tool.handler(req.args ?? {}, {});

package/dist/telegram-client.d.ts

@@ -16,6 +16,7 @@ export declare class TelegramService {
     private entityCache;
     lastError: string;
     get sessionDir(): string;
+    hasLocalSession(): boolean;
     getClient(): TelegramClient | null;
     constructor(apiId: number, apiHash: string, options?: {
         sessionPath?: string;
@@ -33,8 +34,11 @@ export declare class TelegramService {
     ensureConnected(): Promise<boolean>;
     disconnect(): Promise<void>;
     /**
-     * Log out from Telegram completely — terminates the session on Telegram servers.
-     * After this, the session string becomes invalid and won't appear in "Active Sessions".
+     * Terminates the session on Telegram servers, destroys the client, and clears
+     * local session (in-memory + file). Returns true only when server-side revoke
+     * confirmed. False means server revoke could not be confirmed — local wipe
+     * was still attempted. Throws if local file removal failed so callers can
+     * surface the partial state instead of silently misreporting success.
      */
     logOut(): Promise<boolean>;
     isConnected(): boolean;

package/dist/telegram-client.js

@@ -60,6 +60,9 @@ export class TelegramService {
     get sessionDir() {
         return dirname(this.sessionPath);
     }
+    hasLocalSession() {
+        return existsSync(this.sessionPath);
+    }
     // ─── Session & Auth ────────────────────────────────────────────────────────
     getClient() {
         return this.client;
@@ -195,25 +198,42 @@ export class TelegramService {
         }
     }
     /**
-     * Log out from Telegram completely — terminates the session on Telegram servers.
-     * After this, the session string becomes invalid and won't appear in "Active Sessions".
+     * Terminates the session on Telegram servers, destroys the client, and clears
+     * local session (in-memory + file). Returns true only when server-side revoke
+     * confirmed. False means server revoke could not be confirmed — local wipe
+     * was still attempted. Throws if local file removal failed so callers can
+     * surface the partial state instead of silently misreporting success.
      */
     async logOut() {
-        if (!this.client || !this.connected)
+        const wipeLocalOrThrow = async () => {
+            await this.clearSession();
+            if (existsSync(this.sessionPath)) {
+                throw new Error(`Local session file still present after clearSession: ${this.sessionPath}`);
+            }
+        };
+        if (!this.client || !this.connected) {
+            if (existsSync(this.sessionPath))
+                await wipeLocalOrThrow();
             return false;
+        }
+        const client = this.client;
+        let revoked = false;
         try {
-            await this.client.invoke(new Api.auth.LogOut());
-            await this.client.destroy();
-            this.connected = false;
-            this.sessionString = "";
-            this.client = null;
-            return true;
+            await client.invoke(new Api.auth.LogOut());
+            revoked = true;
         }
         catch (error) {
-            console.error("[telegram] logOut error:", error);
-            await this.disconnect();
-            return false;
+            console.error("[telegram] auth.LogOut failed:", error);
+        }
+        // destroy() failure must NOT mask a successful server revoke — log and continue.
+        try {
+            await client.destroy();
+        }
+        catch (err) {
+            console.error("[telegram] client.destroy failed during logOut:", err);
         }
+        await wipeLocalOrThrow();
+        return revoked;
     }
     isConnected() {
         return this.connected;

package/dist/tools/auth.js

@@ -1,6 +1,6 @@
 import { writeFile } from "node:fs/promises";
 import { join } from "node:path";
-import { fail, ok, READ_ONLY, WRITE } from "./shared.js";
+import { DESTRUCTIVE, fail, ok, READ_ONLY, WRITE } from "./shared.js";
 export function registerAuthTools(server, telegram) {
     server.registerTool("telegram-status", { description: "Check Telegram connection status", annotations: READ_ONLY }, async () => {
         if (await telegram.ensureConnected()) {
@@ -65,4 +65,29 @@ export function registerAuthTools(server, telegram) {
             ],
         };
     });
+    server.registerTool("telegram-logout", {
+        description: "Log out from Telegram completely. Revokes the session on Telegram servers (removes it from Settings → Devices), deletes the local session file, and disconnects. After this you must run telegram-login to re-authenticate.",
+        annotations: DESTRUCTIVE,
+    }, async () => {
+        const wasConnected = await telegram.ensureConnected();
+        if (!wasConnected && !telegram.hasLocalSession()) {
+            return fail(new Error("Not logged in. Nothing to log out from."));
+        }
+        try {
+            const revoked = await telegram.logOut();
+            if (!wasConnected) {
+                return ok("Local session removed (was already disconnected). Server-side revoke was not performed.");
+            }
+            if (revoked) {
+                return ok("Logged out. Session revoked on Telegram servers and removed locally.");
+            }
+            return fail(new Error("Local session removed, but server-side revoke could not be confirmed. Open 'Settings → Devices' in Telegram and terminate the session manually if it is still listed."));
+        }
+        catch (err) {
+            // Local file removal failed (read-only FS, permission denied, etc.).
+            // Never claim local cleanup succeeded when the file may still be on disk.
+            return fail(new Error(`Failed to remove local session file: ${err instanceof Error ? err.message : String(err)}. ` +
+                `Delete it manually (check telegram-status for the path).`));
+        }
+    });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overpod/mcp-telegram",
-  "version": "1.28.0",
+  "version": "1.28.1",
   "description": "MCP server for Telegram userbot — messages, media, reactions, polls & more. Built on GramJS/MTProto.",
   "type": "module",
   "main": "dist/index.js",