better-tg-cli 0.26.0 → 0.28.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-tg-cli",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "Telegram for your terminal and your AI agents: read, search, send and press bot buttons on your own account. MCP server included.",
   "mcpName": "io.github.TheVilfer/better-tg-cli",
   "keywords": [
@@ -59,7 +59,7 @@
     "provenance": true
   },
   "scripts": {
-    "build": "node scripts/gen-version.mjs && tsc --noEmit && rm -rf dist && bun scripts/bundle.mjs node",
+    "build": "node scripts/gen-version.mjs && tsc --noEmit && node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && bun scripts/bundle.mjs node",
     "prepublishOnly": "npm run build",
     "dev": "scripts/tg-dev",
     "dev:node": "TG_PROFILE=${TG_PROFILE-dev} TG_NO_UPDATE_CHECK=1 tsx src/index.ts",

package/skills/better-tg-cli/SKILL.md

@@ -13,8 +13,8 @@ description: Telegram on the user's own account through the `telegram` CLI (bett
 telegram help-all -g read >/dev/null && telegram check
 ```
 
-- **`telegram` is missing, or it has no `help-all`.** A different program is installed under that name. Ask the user before installing anything, then run `brew install thevilfer/tap/better-tg-cli` (macOS or Linux) or `npm install -g better-tg-cli` (Node 20 or newer). Never install `@skillhq/telegram`: it is an old build, and bot replies come back as `(no text)`.
-- **"Not configured" or "Not authenticated".** Logging in is interactive and needs the user's phone, so never run it yourself. Ask the user to run `telegram auth --qr` in their terminal. It uses their own API keys from my.telegram.org and a QR scan in the Telegram app. If the maintainer gave them an invite, the command is `telegram auth --invite --qr`.
+- **`telegram` is missing, or it has no `help-all`.** A different program is installed under that name. Ask the user before installing anything, then run `brew install thevilfer/tap/better-tg-cli` (macOS or Linux), `scoop install better-tg-cli` after `scoop bucket add thevilfer https://github.com/TheVilfer/scoop-bucket` (Windows), or `npm install -g better-tg-cli` (Node 20 or newer, any OS). Never install `@skillhq/telegram`: it is an old build, and bot replies come back as `(no text)`.
+- **"Not configured" or "Not authenticated".** Run `telegram onboard --json` (in the background if your tool times out before ~15 minutes). It opens a page on 127.0.0.1 where the user gets an invite or enters their own API keys, scans a QR code and types their 2FA password. You never see any of that. Tell the user the page is open (relay the `url` event if the browser didn't open), wait for the `done` event, then confirm with `telegram whoami`. Never run `telegram auth` yourself. Never ask for a login code, 2FA password, invite token or api_hash in chat, and never fill in the onboarding page yourself. If the user is on SSH or `onboard` can't open a page, ask them to run `telegram auth --qr` in their own terminal.
 
 Before you use an unfamiliar flag, run `telegram help-all -g <word>`. It is generated from the code, so it is always current. For behaviour details (threads, bot buttons, sync, JSON shapes, errors), read `reference.md` next to this file.
 

package/skills/better-tg-cli/reference.md

@@ -115,7 +115,7 @@ Buttons that need 2FA take `--password`. `--no-wait` skips waiting for the bot's
   - Read tool: only the read commands.
   - Write tool: everything that changes the account or writes local files (`download`, `sync`,
     `avatar`).
-  - Never over MCP: `auth`, `logout`, `transfer-owner`, `update`, `skill`, and changing `write-access`.
+  - Never over MCP: `auth`, `onboard`, `logout`, `transfer-owner`, `update`, `skill`, and changing `write-access`.
     Showing its status is allowed.
 - **Safety:** the read tool runs with `TG_READ_ONLY=1`, which blocks every guarded write even if a
   command were misclassified.
@@ -141,12 +141,18 @@ matches titles.
 
 ## Troubleshooting
 
-- `Not configured`: the user must log in themselves with `telegram auth` (their own keys from
-  my.telegram.org) or `telegram auth --invite` (a token from the maintainer). It is interactive,
-  so never run it for them. `--qr` logs in by scanning a QR code in the Telegram app instead of
+- `Not configured`: run `telegram onboard --json`. It serves a one-shot page on 127.0.0.1 (random
+  secret path, closes when done, `--timeout` 15 min by default) where the user gets an invite from
+  better-tg-cli.com (it comes back to the page by itself), or enters their own keys, then scans a QR
+  code and types their 2FA password. Events: `url`, `waiting_invite`, `waiting_scan`, `need_password`,
+  `done` (exit 0), `error`, `timeout` (exit 1); `already_logged_in` exits 0 without changes.
+  `--no-open` only prints the URL. You never get tokens, codes or passwords, and you must not ask
+  for them or fill in the page. Without a browser on this machine (SSH), the user runs
+  `telegram auth --qr` (own keys) or `telegram auth --invite --qr` in their terminal; that is
+  interactive, so never run it for them. `--qr` logs in by scanning a QR code in the Telegram app instead of
   typing a code (`TG_QR_INVERT=1` for light terminals).
 
-- `command not found: telegram`: run `brew install thevilfer/tap/better-tg-cli` or `npm install -g better-tg-cli`, or build this folder (`npm install && npm run build && npm install -g .`, needs Bun)
+- `command not found: telegram`: run `brew install thevilfer/tap/better-tg-cli`, `scoop install better-tg-cli` (Windows, after `scoop bucket add thevilfer https://github.com/TheVilfer/scoop-bucket`) or `npm install -g better-tg-cli`, or build this folder (`npm install && npm run build && npm install -g .`, needs Bun)
   `telegram update` upgrades an existing install (brew, npm or git checkout); `update --check` only reports.
   `telegram skill install|status|uninstall [-a <agent>...]` copies this skill into coding agents' global
   skills folders; only run it when the user asks.