@wilm-ai/wilma-cli 2.1.2 → 2.3.0

package/README.md

@@ -18,6 +18,12 @@ Opens a one-time login page in your browser: pick your school's Wilma and log in
 
 Without a browser: `wilma login --tenant <url|city> --username <name>` with the password in `WILMA_PASSWORD` or piped via `--password-stdin`. Or set `WILMA_TENANT`, `WILMA_USERNAME`, `WILMA_PASSWORD` (and `WILMA_TOTP_SECRET`) and skip the saved login.
 
+## Log out
+```bash
+wilma logout                  # every saved login; `wilma logout 2` for one (numbers from `wilma accounts`)
+```
+Wilma allows one session per account: when WilmAI logs in, Wilma logs you out in your browser, and the other way round. `wilma logout` ends WilmAI's session, as Wilma's own Log out does, so you can use Wilma in the browser. The logins stay saved, and the next command logs in again. `wilma config clear` deletes the logins as well.
+
 ## Use it
 ```bash
 wilma summary                 # the daily briefing for every child — start here
@@ -53,7 +59,7 @@ Running `wilma` without arguments in a terminal opens an interactive menu.
 ```bash
 wilma mcp
 ```
-Starts a stdio MCP server with read-only Wilma tools (`wilma_summary`, `wilma_schedule`, `wilma_read_news`, …) that return the same data as the commands. Add it to any MCP client as `npx -y @wilm-ai/wilma-cli@2 mcp`. Setup guides for Claude, ChatGPT, Grok Bot and OpenClaw: https://wilm.ai
+Starts a stdio MCP server with read-only Wilma tools (`wilma_summary`, `wilma_schedule`, `wilma_read_news`, …) that return the same data as the commands, plus `wilma_logout`, which ends WilmAI's Wilma session like `wilma logout`. Add it to any MCP client as `npx -y @wilm-ai/wilma-cli@2 mcp`. Setup guides for Claude, ChatGPT, Grok Bot and OpenClaw: https://wilm.ai
 
 ## Bulletin attachments
 `wilma news <id>` lists every link in a bulletin (`resources`). Any resource can be downloaded with `wilma news <id> download <resource> [--output <directory>]` (the resource id also accepts a bare number, e.g. `1` for `resource-1`). Wilma-hosted files download through the session; external links are fetched without your Wilma login, and only from public websites. The result's `status` says what happened: `downloaded` (use the returned `path`) or `not_a_file` when the link answered with a web page (for example a sharing link that needs signing in — open it in a browser instead). `--output` defaults to the current directory; existing files are never overwritten.
@@ -62,7 +68,7 @@ Starts a stdio MCP server with read-only Wilma tools (`wilma_summary`, `wilma_sc
 Children at schools on different Wilmas need one login per Wilma. Run `wilma login` again (or press "Add another Wilma" on the login page); commands then cover every child, and each child carries the `wilma` it belongs to.
 ```bash
 wilma accounts                     # saved logins, numbered
-wilma accounts remove <number>     # or the Wilma name or username
+wilma accounts remove <number>     # or the Wilma name or username; also ends that login's Wilma session
 ```
 
 ## Find your Wilma
@@ -74,6 +80,7 @@ wilma find-school <city or school>
 ```bash
 wilma update                       # when a newer version is out, a command says so on stderr, at most once a day (WILMAI_NO_UPDATE_CHECK=1 turns it off)
 wilma config clear                 # deletes every saved login and session
+wilma home                         # where to download WilmAI Home, the Wilma app for Mac and Windows
 wilma --version
 ```
 
@@ -86,7 +93,7 @@ If your Wilma account has MFA/TOTP enabled:
 **Without a saved login:** set `WILMA_TOTP_SECRET` along with the other `WILMA_*` variables. `--totp-secret <key>` also works, but a key on the command line ends up in shell history and is visible to other programs on the computer.
 
 ## Config
-Logins are saved in `~/.config/wilmai/config.json` (or `$XDG_CONFIG_HOME/wilmai/config.json`; override with `WILMAI_CONFIG_PATH`) and the current Wilma sessions in `wilmai-sessions.json` next to it, both readable only by you. `wilma config clear` deletes both.
+Logins are saved in `~/.config/wilmai/config.json` (or `$XDG_CONFIG_HOME/wilmai/config.json`; override with `WILMAI_CONFIG_PATH`) and the current Wilma sessions in `wilmai-sessions.json` next to it, both readable only by you. `wilma logout` ends the sessions and deletes them, keeping the logins; `wilma config clear` deletes both.
 
 ## Troubleshooting: TLS errors on a managed laptop
 

package/dist/access.d.ts

@@ -10,3 +10,17 @@ export declare function createAccess(accounts: ActiveAccount[], opts?: {
     debug?: boolean;
     totpSecret?: string;
 }): WilmaAccess;
+/**
+ * End WilmAI's Wilma session for each login (see logoutSession), for `wilma
+ * logout` and the wilma_logout tool. The logins stay saved. Tries every login
+ * (different Wilmas don't affect each other), then throws the first failure.
+ */
+export declare function logoutAccounts(accounts: ActiveAccount[]): Promise<{
+    status: "ok";
+    logins: {
+        wilma: string;
+        username: string;
+        session: "none" | "ended";
+    }[];
+    hint: string;
+}>;

package/dist/access.js

@@ -1,4 +1,4 @@
-import { WilmaAccess } from "./agent-data.js";
+import { WilmaAccess, logoutSession } from "./agent-data.js";
 import { loadConfig, saveConfig } from "./config.js";
 import { mfaCallbackFor } from "./credentials.js";
 /**
@@ -31,3 +31,26 @@ export function createAccess(accounts, opts = {}) {
         },
     })));
 }
+/**
+ * End WilmAI's Wilma session for each login (see logoutSession), for `wilma
+ * logout` and the wilma_logout tool. The logins stay saved. Tries every login
+ * (different Wilmas don't affect each other), then throws the first failure.
+ */
+export async function logoutAccounts(accounts) {
+    const results = await Promise.allSettled(accounts.map((account) => logoutSession(account.profile)));
+    const failed = results.find((result) => result.status === "rejected");
+    if (failed)
+        throw failed.reason;
+    const logins = accounts.map((account, index) => ({
+        wilma: account.stored?.tenantName ?? account.profile.baseUrl,
+        username: account.profile.username,
+        session: results[index].value ? "ended" : "none",
+    }));
+    return {
+        status: "ok",
+        logins,
+        hint: logins.length
+            ? "The logins stay saved. The next time WilmAI reads Wilma it logs in again, and that ends the user's Wilma session in the browser."
+            : "No saved Wilma login, so there was nothing to log out.",
+    };
+}

package/dist/agent-data.d.ts

@@ -73,8 +73,23 @@ export declare function useSessionStore(store: SessionStore | undefined): void;
  * verification, no second code).
  */
 export declare function adoptSession(profile: WilmaProfile, client: WilmaClient): void;
-/** Save any sessions still being written (call before a short-lived process exits). */
+/**
+ * Finish saving sessions (call before a short-lived process exits). Only
+ * logins made here are saved, never an older session over a newer one
+ * another process saved meanwhile.
+ */
 export declare function flushSessions(): Promise<void>;
+/**
+ * End WilmAI's Wilma session for one login (Wilma's own "Log out") and forget
+ * it, in this process and in the session store, so nothing continues it. The
+ * login itself stays saved; the next command or tool call logs in again.
+ * Never logs in. Returns true when a live session was ended, false when there
+ * was none. If Wilma can't be reached, throws and keeps the saved session, so
+ * logging out can be tried again.
+ */
+export declare function logoutSession(profile: WilmaProfile): Promise<boolean>;
+/** Forget one login's session without ending it in Wilma (when the login itself is removed). */
+export declare function forgetSession(profile: WilmaProfile): Promise<void>;
 /**
  * Read-only Wilma access for agent tools (MCP). Covers every Wilma login the
  * family has saved; every method defaults to all children, and a student

package/dist/agent-data.js

@@ -237,14 +237,29 @@ let sessionStore;
 export function useSessionStore(store) {
     sessionStore = store;
 }
-function rememberSession(key, client) {
+/**
+ * Save the session for the other processes, and share theirs: when Wilma ends
+ * this one, the client first continues the newest session another process
+ * saved (a CLI command, an assistant's connector, the desktop app), and logs
+ * in only when that one has ended too. Each login ends the others, so this
+ * keeps WilmAI's programs from logging each other out.
+ */
+function rememberSession(key, client, opts) {
     const store = sessionStore;
     if (!store)
         return;
-    const save = () => store.save(key, client.exportSession()).catch(() => { });
-    client.onLogin(() => void save());
-    void save();
+    const save = (state) => {
+        const saving = store.save(key, state).catch(() => { });
+        pendingSaves.add(saving);
+        void saving.finally(() => pendingSaves.delete(saving));
+        return saving;
+    };
+    client.useSharedSession({ load: () => store.load(key), save });
+    // A resumed session is already saved (and another process may have saved a newer one since).
+    if (opts.fresh)
+        void save(client.exportSession());
 }
+const pendingSaves = new Set();
 /** Identifies one Wilma account and password (a changed password starts fresh). */
 function poolKey(profile) {
     const { baseUrl, username, password } = profile;
@@ -261,17 +276,50 @@ function poolKey(profile) {
 export function adoptSession(profile, client) {
     const key = poolKey(profile);
     pool.set(key, { client: Promise.resolve(client), lastUsed: Date.now() });
-    rememberSession(key, client);
+    rememberSession(key, client, { fresh: true });
 }
-/** Save any sessions still being written (call before a short-lived process exits). */
+/**
+ * Finish saving sessions (call before a short-lived process exits). Only
+ * logins made here are saved, never an older session over a newer one
+ * another process saved meanwhile.
+ */
 export async function flushSessions() {
-    if (!sessionStore)
-        return;
-    for (const [key, entry] of pool) {
-        const client = await entry.client.catch(() => null);
-        if (client)
-            await sessionStore.save(key, client.exportSession()).catch(() => { });
-    }
+    for (const entry of pool.values())
+        await entry.client.catch(() => null);
+    await Promise.all([...pendingSaves]);
+}
+/**
+ * End WilmAI's Wilma session for one login (Wilma's own "Log out") and forget
+ * it, in this process and in the session store, so nothing continues it. The
+ * login itself stays saved; the next command or tool call logs in again.
+ * Never logs in. Returns true when a live session was ended, false when there
+ * was none. If Wilma can't be reached, throws and keeps the saved session, so
+ * logging out can be tried again.
+ */
+export async function logoutSession(profile) {
+    const key = poolKey(profile);
+    const entry = pool.get(key);
+    // The session in use here (a login in progress finishes first) and the saved
+    // one, which another process may have replaced since. At most one is live.
+    const pooled = entry ? await entry.client.catch(() => null) : null;
+    const pooledState = pooled?.exportSession();
+    const saved = sessionStore ? await sessionStore.load(key).catch(() => null) : null;
+    let ended = pooled ? await pooled.logout() : false;
+    if (pool.get(key) === entry)
+        pool.delete(key);
+    if (saved && saved !== pooledState) {
+        const resumed = WilmaClient.resume({ ...profile, studentNumber: null }, saved);
+        if (resumed && (await resumed.logout()))
+            ended = true;
+    }
+    await sessionStore?.remove(key);
+    return ended;
+}
+/** Forget one login's session without ending it in Wilma (when the login itself is removed). */
+export async function forgetSession(profile) {
+    const key = poolKey(profile);
+    pool.delete(key);
+    await sessionStore?.remove(key);
 }
 function pooledSession(account) {
     const now = Date.now();
@@ -287,9 +335,9 @@ function pooledSession(account) {
             // A saved session first; it logs in again by itself if Wilma has ended it.
             const saved = sessionStore ? await sessionStore.load(key).catch(() => null) : null;
             const resumed = saved ? WilmaClient.resume(profile, saved, account.mfa) : null;
-            const fresh = resumed ?? (await WilmaClient.login(profile, account.mfa));
-            rememberSession(key, fresh);
-            return fresh;
+            const client = resumed ?? (await WilmaClient.login(profile, account.mfa));
+            rememberSession(key, client, { fresh: !resumed });
+            return client;
         })();
         const created = { client, lastUsed: now };
         entry = created;

package/dist/cli-args.js

@@ -13,7 +13,7 @@ const DATA_COMMANDS = [
     "printouts",
     "students",
 ];
-const OTHER_COMMANDS = ["accounts", "find-school", "login", "mcp", "update", "config", "help"];
+const OTHER_COMMANDS = ["accounts", "find-school", "home", "login", "logout", "mcp", "update", "config", "help"];
 const ALIASES = {
     kids: "students",
     tenants: "find-school",
@@ -226,6 +226,8 @@ export function parseCliArgs(argv) {
                 return parsed("remove", args.slice(1));
             noMore(args);
             return parsed(null);
+        case "logout":
+            return parsed(null, args);
         case "config":
             if (args[0] !== "clear" || args.length > 1)
                 throw usage('Expected "wilma config clear".');

package/dist/cli-help.js

@@ -68,14 +68,26 @@ const COMMAND_HELP = {
     },
     accounts: {
         usage: ["wilma accounts", "wilma accounts remove <number|Wilma name|username>"],
-        about: "Saved Wilma logins, numbered (one per Wilma the children use); remove one.",
+        about: "Saved Wilma logins, numbered (one per Wilma the children use). `remove` deletes one and ends its Wilma session; the other logins keep theirs.",
         examples: ["wilma accounts", "wilma accounts remove 2"],
     },
+    logout: {
+        usage: ["wilma logout [<number|Wilma name|username>]"],
+        about: "End WilmAI's Wilma session, as Wilma's own Log out does, so you can use Wilma in the browser (Wilma allows one session per account). Every saved login by default, or one by its number from `wilma accounts`. The logins stay saved: the next command logs in again, and that ends your Wilma session in the browser. To delete the logins as well, use `wilma config clear`.",
+        examples: ["wilma logout", "wilma logout 2"],
+        output: '{ status: "ok", logins: [{ wilma, username, session: "ended" | "none" }], hint }. "none": there was no open session to end.',
+    },
     "find-school": {
         usage: ["wilma find-school <city or school>"],
         about: "Find a Wilma address. Most city schools share their city's Wilma (big cities don't list each school); colleges, private schools and many small municipalities' schools have their own.",
         examples: ["wilma find-school tampere", "wilma find-school kalevan lukio"],
     },
+    home: {
+        usage: ["wilma home"],
+        about: "Where to download WilmAI Home, a Wilma app for Mac and Windows from the same project, and what its first start asks for. Mention it when the parent or student wants a Wilma app of their own. Needs no login.",
+        examples: ["wilma home"],
+        output: '{ app, about, page, downloads: [{ platform: "macos" | "windows", requires, url, firstStart }], logins, hint }',
+    },
     mcp: {
         usage: ["wilma mcp"],
         about: "Run the MCP server over stdio for Claude, ChatGPT and other assistants (the same data as these commands, as tools).",
@@ -98,8 +110,10 @@ const OVERVIEW = [
     ["students", "the children"],
     ["login", "log in (opens a page in the browser)"],
     ["accounts", "saved logins; accounts remove <n>"],
+    ["logout", "end WilmAI's Wilma session (the logins stay saved)"],
     ["find-school <query>", "find a Wilma address by city or school"],
     ["mcp", "MCP server for AI assistants"],
+    ["home", "WilmAI Home, the desktop app: where to download it"],
     ["update", "update the CLI"],
 ];
 export function generalHelp() {

package/dist/cli-output.js

@@ -8,7 +8,8 @@ function formatContent(value) {
     const lines = value
         .replace(/\r/g, "")
         .split("\n")
-        .map((line) => line.trim())
+        // Leading spaces stay: they indent nested list items.
+        .map((line) => line.trimEnd())
         .filter((line, index, arr) => line !== "" || arr[index - 1] !== "");
     return lines.join("\n").replace(/\n{3,}/g, "\n\n").trim();
 }

package/dist/home.d.ts

@@ -0,0 +1,15 @@
+export interface HomeInfo {
+    app: string;
+    about: string;
+    page: string;
+    downloads: {
+        platform: "macos" | "windows";
+        requires: string;
+        url: string;
+        firstStart: string;
+    }[];
+    logins: string;
+    hint: string;
+}
+export declare const HOME: HomeInfo;
+export declare function homeText(info?: HomeInfo): string;

package/dist/home.js

@@ -0,0 +1,39 @@
+/*
+ * `wilma home`: where to get WilmAI Home, the desktop app. The addresses are
+ * wilm.ai's own, which forward to the current installer, so a new Home release
+ * needs no new CLI.
+ */
+export const HOME = {
+    app: "WilmAI Home (beta)",
+    about: "A Wilma app for your computer, from the same project: today's lessons, messages, homework, exams and grades in one view, for students and parents. Free and open source; AI is optional.",
+    page: "https://wilm.ai/home",
+    downloads: [
+        {
+            platform: "macos",
+            requires: "Apple Silicon (M1 or newer), macOS 13.3 or later",
+            url: "https://wilm.ai/get/mac",
+            firstStart: "The app isn't signed by Apple yet, so macOS stops it the first time: choose Done, then System Settings → Privacy & Security → Open Anyway.",
+        },
+        {
+            platform: "windows",
+            requires: "Windows 10 or 11, 64-bit",
+            url: "https://wilm.ai/get/windows",
+            firstStart: "The installer isn't signed yet. Windows warns before the first start: choose More info, then Run anyway. A school computer may not allow it.",
+        },
+    ],
+    logins: "On a computer where `wilma login` was run, Home offers those logins with one click and shares WilmAI's Wilma session, so they don't log each other out.",
+    hint: "Give the user the link for their computer; downloading and installing the app is their step.",
+};
+export function homeText(info = HOME) {
+    const names = { macos: "Mac", windows: "Windows" };
+    const width = Math.max(...info.downloads.map((d) => d.url.length));
+    return [
+        info.app,
+        info.about,
+        "",
+        ...info.downloads.flatMap((d) => [`  ${names[d.platform].padEnd(8)} ${d.url.padEnd(width)}  ${d.requires}`, `  ${"".padEnd(8)} ${d.firstStart}`]),
+        "",
+        info.logins,
+        `More: ${info.page}`,
+    ].join("\n");
+}

package/dist/index.js

@@ -8,13 +8,14 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { APIError, AuthenticationError, MfaRequiredError, NetworkError, WilmaClient, listTenants, } from "@wilm-ai/wilma-client";
 import { clearConfig, getConfigPath, loadConfig, obfuscateSecret, revealSecret, saveConfig } from "./config.js";
-import { WilmaAccess, WilmaAiError, adoptSession, flushSessions, useSessionStore, } from "./agent-data.js";
-import { createAccess } from "./access.js";
+import { WilmaAccess, WilmaAiError, adoptSession, flushSessions, forgetSession, logoutSession, useSessionStore, } from "./agent-data.js";
+import { createAccess, logoutAccounts } from "./access.js";
 import { parseCliArgs } from "./cli-args.js";
 import { commandHelp, generalHelp } from "./cli-help.js";
 import { compactText, formatText, messageLine, newsLine } from "./cli-output.js";
 import { ENV_VARS, isMfaFailure, mfaCallbackFor, resolveAccounts, saveLogin, verifyLoginSession } from "./credentials.js";
 import { createUniqueDownloadFile } from "./downloads.js";
+import { HOME, homeText } from "./home.js";
 import { openBrowser, startLoginServer } from "./login-server.js";
 import { runMcpServer } from "./mcp.js";
 import { claimNotice, cliUpdateNotice, isNewerVersion, latestWithin, startUpdateCheck, updateChecksEnabled } from "./update-check.js";
@@ -117,9 +118,15 @@ async function runCommand(argv) {
         case "accounts":
             await handleAccounts(action, args, out);
             return;
+        case "logout":
+            await handleLogout(args.join(" "), flags, out);
+            return;
         case "find-school":
             await handleFindSchool(args.join(" "), out);
             return;
+        case "home":
+            out.data(HOME, () => homeText());
+            return;
         case "update":
             await handleUpdate();
             return;
@@ -680,24 +687,18 @@ const HEADLESS_LOGIN_HELP = [
 async function handleAccounts(action, args, out) {
     const config = await loadConfig();
     if (action === "remove") {
-        const target = args.join(" ").trim().toLowerCase();
-        if (!target)
-            throw new WilmaAiError("invalid_argument", "Which login? Use the number from `wilma accounts`, the Wilma name or the username.");
-        const byNumber = /^\d+$/.test(target) ? config.profiles[Number(target) - 1] : undefined;
-        const matches = byNumber
-            ? [byNumber]
-            : config.profiles.filter((p) => [p.tenantName ?? "", p.tenantUrl, p.username].some((v) => v.toLowerCase() === target));
-        if (matches.length !== 1) {
-            throw new WilmaAiError(matches.length ? "ambiguous_account" : "unknown_account", matches.length ? `"${target}" matches several logins; use its number.` : `No saved login matches "${target}".`);
-        }
-        const removed = matches[0];
+        const removed = findSavedLogin(config.profiles, args.join(" "));
         config.profiles = config.profiles.filter((p) => p.id !== removed.id);
         if (config.lastProfileId === removed.id)
             config.lastProfileId = config.profiles[0]?.id ?? null;
         await saveConfig(config);
-        await clearSessions();
-        const result = { status: "removed", wilma: removed.tenantName ?? removed.tenantUrl, username: removed.username };
-        out.data(result, () => `Removed ${removed.username} @ ${result.wilma}.`);
+        const session = await endRemovedSession(removed);
+        const result = { status: "removed", wilma: removed.tenantName ?? removed.tenantUrl, username: removed.username, ...session };
+        out.data(result, () => session.session === "ended"
+            ? `Removed ${removed.username} @ ${result.wilma} and ended its Wilma session.`
+            : session.session === "not_ended"
+                ? `Removed ${removed.username} @ ${result.wilma}. Its Wilma session couldn't be ended (${session.message}); Wilma ends it when it expires.`
+                : `Removed ${removed.username} @ ${result.wilma}.`);
         return;
     }
     const accounts = config.profiles.map((p, i) => ({
@@ -715,6 +716,64 @@ async function handleAccounts(action, args, out) {
         ].join("\n")
         : "No saved Wilma logins. Run `wilma login`.");
 }
+/**
+ * End a removed login's Wilma session and forget it; the other logins keep
+ * theirs. The login is removed even when Wilma can't be reached: its saved
+ * session is forgotten anyway, and Wilma ends the session when it expires.
+ */
+async function endRemovedSession(removed) {
+    const password = revealSecret(removed.passwordObfuscated);
+    if (!password)
+        return { session: "none" };
+    const profile = { baseUrl: removed.tenantUrl, username: removed.username, password };
+    try {
+        return { session: (await logoutSession(profile)) ? "ended" : "none" };
+    }
+    catch (err) {
+        await forgetSession(profile);
+        return { session: "not_ended", message: err instanceof Error ? err.message : String(err) };
+    }
+}
+/** A saved login by its number in `wilma accounts`, its Wilma's name or address, or its username. */
+function findSavedLogin(profiles, rawTarget) {
+    const target = rawTarget.trim().toLowerCase();
+    if (!target)
+        throw new WilmaAiError("invalid_argument", "Which login? Use the number from `wilma accounts`, the Wilma name or the username.");
+    const byNumber = /^\d+$/.test(target) ? profiles[Number(target) - 1] : undefined;
+    const matches = byNumber
+        ? [byNumber]
+        : profiles.filter((p) => [p.tenantName ?? "", p.tenantUrl, p.username].some((v) => v.toLowerCase() === target));
+    if (matches.length !== 1) {
+        throw new WilmaAiError(matches.length ? "ambiguous_account" : "unknown_account", matches.length ? `"${target}" matches several logins; use its number.` : `No saved login matches "${target}".`);
+    }
+    return matches[0];
+}
+/**
+ * End WilmAI's Wilma sessions so the parent can use Wilma in the browser:
+ * every login commands use, or one saved login. The logins stay saved.
+ */
+async function handleLogout(target, flags, out) {
+    if (flags.student) {
+        throw new WilmaAiError("invalid_argument", "A Wilma session belongs to a login, not to one child. Use `wilma logout <number>` with the number from `wilma accounts`, or no number for every login.");
+    }
+    const config = await loadConfig();
+    // The logins commands use (the environment's, or every saved one); a picked
+    // login is one of the saved ones, numbered as in `wilma accounts`.
+    let accounts = await resolveAccounts(config, target ? {} : process.env);
+    if (target) {
+        const login = findSavedLogin(config.profiles, target);
+        const account = (p) => `${normalizeTenantUrl(p.tenantUrl)}|${p.username.toLowerCase()}`;
+        accounts = accounts.filter((a) => a.stored && account(a.stored) === account(login));
+    }
+    const result = await logoutAccounts(accounts);
+    out.data(result, () => result.logins.length
+        ? [
+            ...result.logins.map((l) => `${l.session === "ended" ? "Logged out" : "No open session"}: ${l.username} @ ${l.wilma}`),
+            "",
+            "The logins stay saved. The next wilma command logs in again, and that ends your Wilma session in the browser.",
+        ].join("\n")
+        : result.hint);
+}
 async function readStdin() {
     const chunks = [];
     for await (const chunk of process.stdin)

package/dist/mcp-tools.d.ts

@@ -1,7 +1,7 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 import type { FetchedAttachment, WilmaAccess } from "./agent-data.js";
-export declare const INSTRUCTIONS = "Read-only access to Finland's Wilma school system for a parent/guardian.\n- Start with wilma_summary: today's and tomorrow's lessons, upcoming exams, recent homework, news and messages for every child in one call.\n- Tools cover all children by default; pass \"student\" (name or student number) to narrow to one child.\n- Wilma content is usually in Finnish. Answer in the user's language and translate as needed. Write dates the way that language does: Finnish \"ke 7.10.\" (with the final period), English \"Wed 7 Oct\".\n- Message and news lists return ids; use wilma_read_message / wilma_read_news for full text. Bulletins can link attachments; fetch them with wilma_get_news_attachment.\n- Teachers' feedback (\"forgot books\", \"did well\") and absences are lesson notes: wilma_lesson_notes for recent days, wilma_lesson_notes_summary for counts. Course and report-card grades are in wilma_gradebook.\n- If a tool says the user isn't logged in, relay the login link or instructions to the user exactly; never ask the user to type their Wilma password into the chat.\n- If a result ends with an \"Update note\", answer the question first, then pass the note on in one sentence.";
+export declare const INSTRUCTIONS = "Read-only access to Finland's Wilma school system for a parent/guardian.\n- Start with wilma_summary: today's and tomorrow's lessons, upcoming exams, recent homework, news and messages for every child in one call.\n- Tools cover all children by default; pass \"student\" (name or student number) to narrow to one child.\n- Wilma content is usually in Finnish. Answer in the user's language and translate as needed. Write dates the way that language does: Finnish \"ke 7.10.\" (with the final period), English \"Wed 7 Oct\".\n- Message and news lists return ids; use wilma_read_message / wilma_read_news for full text. Bulletins can link attachments; fetch them with wilma_get_news_attachment.\n- Teachers' feedback (\"forgot books\", \"did well\") and absences are lesson notes: wilma_lesson_notes for recent days, wilma_lesson_notes_summary for counts. Course and report-card grades are in wilma_gradebook.\n- If a tool says the user isn't logged in, relay the login link or instructions to the user exactly; never ask the user to type their Wilma password into the chat.\n- Wilma allows one session per account, so each WilmAI login logs the user out of Wilma in their browser. If they want to use Wilma in the browser, call wilma_logout and then call Wilma tools only when they ask again.\n- If a result ends with an \"Update note\", answer the question first, then pass the note on in one sentence.";
 export declare const READ_ONLY: {
     readonly readOnlyHint: true;
     readonly destructiveHint: false;

package/dist/mcp-tools.js

@@ -12,6 +12,7 @@ export const INSTRUCTIONS = `Read-only access to Finland's Wilma school system f
 - Message and news lists return ids; use wilma_read_message / wilma_read_news for full text. Bulletins can link attachments; fetch them with wilma_get_news_attachment.
 - Teachers' feedback ("forgot books", "did well") and absences are lesson notes: wilma_lesson_notes for recent days, wilma_lesson_notes_summary for counts. Course and report-card grades are in wilma_gradebook.
 - If a tool says the user isn't logged in, relay the login link or instructions to the user exactly; never ask the user to type their Wilma password into the chat.
+- Wilma allows one session per account, so each WilmAI login logs the user out of Wilma in their browser. If they want to use Wilma in the browser, call wilma_logout and then call Wilma tools only when they ask again.
 - If a result ends with an "Update note", answer the question first, then pass the note on in one sentence.`;
 export const READ_ONLY = { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false };
 const INLINE_ATTACHMENT_LIMIT = 10 * 1024 * 1024;

package/dist/mcp.js

@@ -5,8 +5,8 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { AuthenticationError } from "@wilm-ai/wilma-client";
 import { useSessionStore } from "./agent-data.js";
-import { fileSessionStore } from "./session-store.js";
-import { createAccess } from "./access.js";
+import { fileSessionStore, nameSessionOwner } from "./session-store.js";
+import { createAccess, logoutAccounts } from "./access.js";
 import { loadConfig } from "./config.js";
 import { ENV_VARS, isMfaFailure, resolveAccounts } from "./credentials.js";
 import { createUniqueDownloadFile } from "./downloads.js";
@@ -161,6 +161,20 @@ function createWilmaMcpServer(version) {
         inputSchema: {},
         annotations: { title: "Log in to Wilma", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
     }, async () => startBrowserLogin(true));
+    server.registerTool("wilma_logout", {
+        title: "Log out of Wilma",
+        description: "End WilmAI's Wilma session, as Wilma's own Log out does. Wilma allows one session per account, so use this when the user wants to use Wilma in their browser or asks to log out. The login stays saved: the next Wilma tool call logs in again, and that ends the user's session in the browser, so don't call other Wilma tools afterwards unless the user asks.",
+        inputSchema: {},
+        annotations: { title: "Log out of Wilma", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async () => {
+        try {
+            return json(await logoutAccounts(await resolveAccounts(await loadConfig())));
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return textResult(["Couldn't log out of Wilma; an open session was kept, so this can be tried again.", message].join("\n"), true);
+        }
+    });
     return server;
 }
 export async function runMcpServer(version) {
@@ -168,6 +182,7 @@ export async function runMcpServer(version) {
     console.log = (...args) => console.error(...args);
     console.info = (...args) => console.error(...args);
     // Share saved sessions with the CLI: no login per process, no extra codes.
+    nameSessionOwner("mcp");
     useSessionStore(fileSessionStore);
     // Checked once a day at most; npx already runs the newest version.
     if (updateChecksEnabled())

package/dist/session-store.d.ts

@@ -1,7 +1,16 @@
 export interface SessionStore {
     load(key: string): Promise<string | null>;
     save(key: string, state: string): Promise<void>;
+    /** Forget one session (after logging out). */
+    remove(key: string): Promise<void>;
 }
+/** Name this program in the sessions it saves (the MCP server says "mcp"). */
+export declare function nameSessionOwner(name: string): void;
 export declare const fileSessionStore: SessionStore;
-/** Forget every saved session (after removing logins or clearing the config). */
+/** When one login's session was saved, and by which program (null when there's none to try). */
+export declare function sessionInfo(key: string): Promise<{
+    savedAt: number;
+    by: string | null;
+} | null>;
+/** Forget every saved session (after clearing the config). */
 export declare function clearSessions(): Promise<void>;

package/dist/session-store.js

@@ -16,6 +16,11 @@ import { getConfigPath } from "./config.js";
  */
 /** A session older than this is not tried (Wilma ends idle sessions anyway). */
 const SESSION_TTL_MS = 6 * 60 * 60 * 1000;
+let savedBy = "cli";
+/** Name this program in the sessions it saves (the MCP server says "mcp"). */
+export function nameSessionOwner(name) {
+    savedBy = name;
+}
 function sessionsPath() {
     return resolve(dirname(getConfigPath()), "wilmai-sessions.json");
 }
@@ -46,16 +51,35 @@ export const fileSessionStore = {
             if (now - entry.savedAt > SESSION_TTL_MS)
                 delete all[k];
         }
-        all[key] = { state, savedAt: now };
-        const path = sessionsPath();
-        await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-        // Temp file + rename: a parallel command never reads half a file.
-        const tmp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
-        await writeFile(tmp, JSON.stringify(all), { encoding: "utf-8", mode: 0o600 });
-        await rename(tmp, path);
+        all[key] = { state, savedAt: now, by: savedBy };
+        await writeAll(all);
+    },
+    async remove(key) {
+        const all = await readAll();
+        if (!(key in all))
+            return;
+        delete all[key];
+        await writeAll(all);
     },
 };
-/** Forget every saved session (after removing logins or clearing the config). */
+async function writeAll(all) {
+    const path = sessionsPath();
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    // Temp file + rename: a parallel command never reads half a file.
+    const tmp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+    await writeFile(tmp, JSON.stringify(all), { encoding: "utf-8", mode: 0o600 });
+    await rename(tmp, path);
+}
+/** When one login's session was saved, and by which program (null when there's none to try). */
+export async function sessionInfo(key) {
+    if (process.env.WILMAI_NO_SESSION_CACHE === "1")
+        return null;
+    const entry = (await readAll())[key];
+    if (!entry || typeof entry.state !== "string" || Date.now() - entry.savedAt > SESSION_TTL_MS)
+        return null;
+    return { savedAt: entry.savedAt, by: typeof entry.by === "string" ? entry.by : null };
+}
+/** Forget every saved session (after clearing the config). */
 export async function clearSessions() {
     await rm(sessionsPath(), { force: true });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wilm-ai/wilma-cli",
-  "version": "2.1.2",
+  "version": "2.3.0",
   "description": "Read your children's Wilma (Finnish school system) from the terminal or an AI assistant: schedule, homework, exams, messages and news.",
   "license": "MIT",
   "repository": {
@@ -21,7 +21,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "lint": "tsc -p tsconfig.json --noEmit",
-    "test": "pnpm --filter @wilm-ai/wilma-client build && pnpm run build && node test/news-resources.mjs && node test/mcp-login.mjs && node test/mfa.mjs && node test/audit.mjs && node test/update-notice.mjs",
+    "test": "pnpm --filter @wilm-ai/wilma-client build && pnpm run build && node test/news-resources.mjs && node test/mcp-login.mjs && node test/mfa.mjs && node test/logout.mjs && node test/shared-session.mjs && node test/audit.mjs && node test/update-notice.mjs",
     "start": "node dist/index.js",
     "prepack": "pnpm --filter @wilm-ai/wilma-client build && pnpm --filter @wilm-ai/wilma-cli build",
     "test:live": "tsc -p tsconfig.json && node test/live.spec.mjs",
@@ -30,8 +30,8 @@
   "dependencies": {
     "@inquirer/prompts": "^5.3.8",
     "@modelcontextprotocol/sdk": "^1.32.0",
-    "@wilm-ai/wilma-client": "^1.6.1",
-    "zod": "^4.1.0"
+    "@wilm-ai/wilma-client": "^1.7.1",
+    "zod": "^4.6.6"
   },
   "devDependencies": {
     "@anthropic-ai/mcpb": "^2.1.2",