supertelegram 0.4.0 → 0.6.0

package/.github/workflows/publish.yml

@@ -0,0 +1,52 @@
+name: publish
+
+# publishes to npm when you push a version tag (e.g. v0.5.0) or cut a GitHub release.
+# tag the current version with:  git tag v$(node -p "require('./package.json').version") && git push --tags
+# auth is via npm OIDC trusted publishing (no NPM_TOKEN) — configure a trusted
+# publisher for this package on npmjs.com pointing at this repo + workflow.
+
+on:
+  push:
+    tags:
+      - "v*"
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # enables npm provenance
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: install deps
+        run: bun install --frozen-lockfile
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          registry-url: "https://registry.npmjs.org"
+
+      # OIDC trusted publishing needs a recent npm (node 24 ships one, but pin latest)
+      - name: upgrade npm
+        run: npm install -g npm@latest
+
+      - name: guard — tag matches package.json version
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          PKG_VERSION="v$(node -p "require('./package.json').version")"
+          if [ "$PKG_VERSION" != "${GITHUB_REF_NAME}" ]; then
+            echo "::error::tag ${GITHUB_REF_NAME} does not match package.json ($PKG_VERSION)"
+            exit 1
+          fi
+
+      # no NODE_AUTH_TOKEN: npm authenticates via OIDC (id-token: write above)
+      - name: publish
+        run: npm publish --access public --provenance

package/PUBLISHING.md

@@ -1,6 +1,23 @@
 # publishing guide
 
-## setup
+## automated (github actions) — preferred
+
+CI publishes to npm on every version tag. auth is via **OIDC trusted
+publishing** — no `NPM_TOKEN` secret. one-time setup: on npmjs.com, open the
+package → Settings → Trusted Publishing, and add a GitHub Actions publisher
+pointing at `caffeinum/supertelegram`, workflow `publish.yml`.
+
+then to release:
+```bash
+# bump version in package.json first, commit, then:
+git tag "v$(node -p "require('./package.json').version")"
+git push --tags
+```
+the `.github/workflows/publish.yml` workflow checks the tag matches
+package.json, installs, and runs `npm publish --access public --provenance`.
+you can also trigger it manually from the Actions tab (workflow_dispatch).
+
+## manual setup
 
 1. login to npm:
 ```bash

package/README.md

@@ -78,15 +78,42 @@ telegram config set appHash "abc123..."
 - `--help` - show help
 - `--version` - show version
 
+### multiple accounts
+
+log in to as many accounts as you want, each stored under a name, and switch
+between them:
+
+```bash
+# log into named accounts (prompts phone/code the first time)
+telegram login personal
+telegram login work
+
+# see them (* marks the active one)
+telegram accounts
+# * work — @yourworkhandle
+#   personal — @yourhandle
+
+# switch the active account (all later commands use it)
+telegram switch personal
+telegram whoami            # personal — @yourhandle
+
+# or run a single command as another account without switching
+telegram -a work send @boss "on it"
+
+# remove an account
+telegram logout work
+```
+
+sessions live in `~/.supertelegram/accounts/<name>.txt`; the active account is
+tracked in `~/.supertelegram/accounts.json`. API credentials (appId/appHash)
+are shared across accounts. upgrading from an older version? your existing
+login is migrated automatically into an account named `default`.
+
 ### advanced
 
-**multi-account / custom session location:**
+**custom session location (one-off / scripting):**
 ```bash
-# use env var
 TELEGRAM_SESSION=./custom.txt telegram send @friend "hey"
-
-# or pass flag (todo)
-telegram send @friend "hey" --session ./custom.txt
 ```
 
 **precedence for API credentials:**
@@ -95,9 +122,27 @@ telegram send @friend "hey" --session ./custom.txt
 3. `.env` file in current directory (for dev)
 
 **precedence for session file:**
-1. `TELEGRAM_SESSION` env var
-2. `~/.supertelegram/session.txt` (global default)
-3. `./session.txt` (backwards compat)
+1. `--account <name>` flag
+2. `TELEGRAM_SESSION` env var
+3. active account (`~/.supertelegram/accounts/<name>.txt`)
+4. `./session.txt` (backwards compat)
+5. `~/.supertelegram/session.txt` (legacy default)
+
+## websocket transport (blocked mtproto)
+
+some networks (cloud sandboxes, agent runtimes, corporate proxies) let tcp reach
+telegram DC ips but kill the raw mtproto handshake — login dies with
+`Not connected` on `ReqPqMulti`. switch to the same wss path web telegram uses:
+
+```bash
+TELEGRAM_WSS=1 telegram login
+# or persist it
+telegram config set wss true
+```
+
+this talks to `*.web.telegram.org/apiws` over tls 443 with the obfuscated
+transport. login, messages and media all work; only the transport changes.
+needs bun or node >= 22 (native WebSocket).
 
 ## development
 

package/package.json

@@ -1,9 +1,17 @@
 {
   "name": "supertelegram",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "telegram cli for humans and bots",
   "module": "index.ts",
   "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/caffeinum/supertelegram.git"
+  },
+  "homepage": "https://github.com/caffeinum/supertelegram#readme",
+  "bugs": {
+    "url": "https://github.com/caffeinum/supertelegram/issues"
+  },
   "bin": {
     "telegram": "src/cli/run.ts"
   },

package/src/cli/commands.ts

@@ -10,7 +10,16 @@ import {
   downloadMedia as telegramDownloadMedia,
 } from "../client/telegram";
 import { askPhoneNumber, askPhoneCode, askPassword, askAppId, askAppHash } from "./prompts";
-import { getApiCredentials, setConfig } from "../config/manager";
+import { getApiCredentials, getConfig, setConfig } from "../config/manager";
+import {
+  listAccounts,
+  setCurrentAccount,
+  registerAccount,
+  removeAccount,
+  getCurrentAccount,
+  accountSessionPath,
+} from "../config/accounts";
+import { setSessionPath } from "../client/telegram";
 import { Api } from "telegram";
 
 export async function send(username: string, message: string) {
@@ -160,37 +169,118 @@ export async function reply(chatName: string, message: string) {
   await disconnect();
 }
 
-export async function login() {
-  // check if API credentials are configured
+export async function login(accountName?: string) {
+  const name = accountName || getCurrentAccount() || "default";
+  // isolate this login to the named account's own session file
+  setSessionPath(accountSessionPath(name));
+
+  // check if API credentials are configured (shared across accounts)
   const creds = getApiCredentials();
   if (!creds) {
     console.log("no API credentials found. let's set them up first.");
     const appId = await askAppId();
     const appHash = await askAppHash();
-    
+
     setConfig("appId", appId);
     setConfig("appHash", appHash);
     console.log("credentials saved to ~/.supertelegram/config.json\n");
   }
 
   const loggedIn = await isLoggedIn();
-  if (loggedIn) {
-    console.log("already logged in!");
-    await disconnect();
-    return;
+  if (!loggedIn) {
+    console.log(`starting login for account "${name}"...`);
+    await telegramLogin({
+      phoneNumber: askPhoneNumber,
+      phoneCode: askPhoneCode,
+      password: askPassword,
+    });
+  } else {
+    console.log(`account "${name}" already has a session, refreshing details...`);
   }
 
-  console.log("starting login...");
-  await telegramLogin({
-    phoneNumber: askPhoneNumber,
-    phoneCode: askPhoneCode,
-    password: askPassword,
+  // capture identity + register (and make current)
+  const client = await getClient();
+  const me = await client.getMe();
+  const fullName = [me.firstName, me.lastName].filter(Boolean).join(" ");
+  registerAccount(name, {
+    username: me.username ?? undefined,
+    userId: me.id?.toString(),
+    name: fullName || undefined,
   });
 
-  console.log("login complete!");
+  const label = me.username ? `@${me.username}` : fullName || name;
+  console.log(`logged in as ${label} — account "${name}" is now active`);
   await disconnect();
 }
 
+export async function accounts() {
+  const list = listAccounts();
+  if (list.length === 0) {
+    console.log("no accounts yet. run: telegram login <name>");
+    return;
+  }
+  for (const { name, meta, current } of list) {
+    const marker = current ? "*" : " ";
+    const who = meta.username
+      ? `@${meta.username}`
+      : meta.name || (meta.userId ? `id ${meta.userId}` : "");
+    console.log(`${marker} ${name}${who ? ` — ${who}` : ""}`);
+  }
+  console.log("\nswitch with: telegram switch <name>");
+}
+
+export async function switchAccount(name?: string) {
+  if (!name) {
+    console.error("usage: telegram switch <name>");
+    console.error("see accounts with: telegram accounts");
+    process.exit(1);
+  }
+  setCurrentAccount(name);
+  console.log(`switched to account "${name}"`);
+}
+
+export async function logout(name?: string) {
+  const target = name || getCurrentAccount();
+  if (!target) {
+    console.error("no account to log out. see: telegram accounts");
+    process.exit(1);
+  }
+  removeAccount(target);
+  const now = getCurrentAccount();
+  console.log(
+    `logged out of "${target}"` + (now ? `. active account is now "${now}"` : ". no accounts left")
+  );
+}
+
+export async function whoami() {
+  const current = getCurrentAccount();
+  if (!current) {
+    console.log("not logged in. run: telegram login");
+    return;
+  }
+
+  let meta = listAccounts().find((a) => a.name === current)?.meta;
+
+  // backfill identity for accounts migrated without metadata
+  if (meta && !meta.username && !meta.name && (await isLoggedIn())) {
+    const client = await getClient();
+    const me = await client.getMe();
+    const fullName = [me.firstName, me.lastName].filter(Boolean).join(" ");
+    meta = {
+      username: me.username ?? undefined,
+      userId: me.id?.toString(),
+      name: fullName || undefined,
+    };
+    registerAccount(current, meta, false);
+    await disconnect();
+  }
+
+  const who = meta?.username
+    ? `@${meta.username}`
+    : meta?.name || (meta?.userId ? `id ${meta.userId}` : "unknown");
+  console.log(`${current} — ${who}`);
+}
+
 export async function config(action?: string, key?: string, value?: string) {
   if (action === "set" && key && value) {
     setConfig(key, value);
@@ -204,6 +294,8 @@ export async function config(action?: string, key?: string, value?: string) {
       console.log(cfg.appId);
     } else if (key === "appHash" && cfg) {
       console.log(cfg.appHash);
+    } else if (key === "wss") {
+      console.log(String(getConfig().wss === "true"));
     } else {
       console.log("not found");
     }
@@ -213,6 +305,7 @@ export async function config(action?: string, key?: string, value?: string) {
   console.log("usage:");
   console.log("  telegram config set appId <id>");
   console.log("  telegram config set appHash <hash>");
+  console.log("  telegram config set wss true    (websocket transport for networks blocking mtproto)");
   console.log("  telegram config get appId");
 }
 

package/src/cli/run.ts

@@ -1,6 +1,8 @@
 #!/usr/bin/env bun
-import { send, read, dialogs, unread, reply, login, config, sendFile, downloadMedia } from "./commands";
+import { explainConnectionError } from "../client/wss";
+import { send, read, dialogs, unread, reply, login, config, sendFile, downloadMedia, accounts, switchAccount, logout, whoami } from "./commands";
 import { setVerbose, setSessionPath } from "../client/telegram";
+import { migrateLegacyIfNeeded, accountSessionPath } from "../config/accounts";
 import pkg from "../../package.json";
 
 const VERSION = pkg.version;
@@ -20,10 +22,15 @@ commands:
   reply <chat> <message>     reply to a chat by name (partial match)
   dialogs [limit]            list recent dialogs (default: 10)
   unread [limit]             show unread messages as json (default: 20)
-  login                      authenticate with telegram
-  config set <key> <val>     set API credentials (appId, appHash)
+  login [name]               authenticate with telegram (into a named account)
+  accounts                   list logged-in accounts (* = current)
+  switch <name>              switch the active account
+  whoami                     show the active account
+  logout [name]              remove an account (default: current)
+  config set <key> <val>     set API credentials (appId, appHash) or wss true
 
 options:
+  -a, --account <name>     run this command as a specific account
   -v, --verbose            show debug logs
   -h, --help               show this help
   --version                show version
@@ -36,6 +43,9 @@ examples:
   ${NAME} reply "John" "hey!"
   ${NAME} unread
   ${NAME} dialogs 20
+  ${NAME} login work            # log into a second account named "work"
+  ${NAME} switch work           # make it active
+  ${NAME} -a personal unread    # run one command as another account
 `.trim();
 
 const rawArgs = process.argv.slice(2);
@@ -52,6 +62,15 @@ if (rawArgs.includes("--version")) {
 }
 
 const verbose = rawArgs.includes("--verbose") || rawArgs.includes("-v");
+
+// pull out --account/-a <name> before positional parsing
+let accountFlag: string | undefined;
+const accIdx = rawArgs.findIndex((a) => a === "--account" || a === "-a");
+if (accIdx !== -1) {
+  accountFlag = rawArgs[accIdx + 1];
+  rawArgs.splice(accIdx, accountFlag ? 2 : 1);
+}
+
 const args = rawArgs.filter((a) => !a.startsWith("-"));
 const [command, ...rest] = args;
 
@@ -59,6 +78,14 @@ if (verbose) {
   setVerbose(true);
 }
 
+// fold a pre-multi-account session.txt into account "default" (one-time, no-op after)
+migrateLegacyIfNeeded();
+
+// an explicit --account pins this invocation to that account's session
+if (accountFlag) {
+  setSessionPath(accountSessionPath(accountFlag));
+}
+
 async function main() {
   switch (command) {
     case "send":
@@ -110,7 +137,23 @@ async function main() {
       break;
 
     case "login":
-      await login();
+      await login(rest[0]);
+      break;
+
+    case "accounts":
+      await accounts();
+      break;
+
+    case "switch":
+      await switchAccount(rest[0]);
+      break;
+
+    case "whoami":
+      await whoami();
+      break;
+
+    case "logout":
+      await logout(rest[0]);
       break;
 
     case "config":
@@ -128,7 +171,10 @@ async function main() {
   }
 }
 
-main().catch((err) => {
-  console.error("error:", err.message);
+function die(err: unknown) {
+  console.error("error:", explainConnectionError(err).message);
   process.exit(1);
-});
+}
+
+process.on("unhandledRejection", die);
+main().catch(die);

package/src/client/telegram.ts

@@ -4,6 +4,7 @@ import { Logger } from "telegram/extensions/Logger";
 import type { LogLevel } from "telegram/extensions/Logger";
 import { loadSession, saveSession } from "../session/storage";
 import { getApiCredentials } from "../config/manager";
+import { wssEnabled, wssClientParams, applyWss, restoreTcpDc, explainConnectionError } from "./wss";
 
 let verbose = false;
 
@@ -46,9 +47,17 @@ export async function getClient(): Promise<TelegramClient> {
   client = new TelegramClient(session, creds.appId, creds.appHash, {
     connectionRetries: 5,
     baseLogger: new SilentLogger(),
+    ...(wssEnabled() ? wssClientParams : {}),
   });
 
-  await client.connect();
+  if (wssEnabled()) applyWss(client);
+  else restoreTcpDc(client);
+
+  try {
+    await client.connect();
+  } catch (err) {
+    throw explainConnectionError(err);
+  }
   return client;
 }
 

package/src/client/wss.ts

@@ -0,0 +1,162 @@
+import type { TelegramClient } from "telegram";
+import { ConnectionTCPObfuscated } from "telegram/network";
+
+import { wssEnabled } from "../config/manager";
+export { wssEnabled };
+
+const WEB_DC_HOSTS: Record<number, string> = {
+  1: "pluto",
+  2: "venus",
+  3: "aurora",
+  4: "vesta",
+  5: "flora",
+};
+
+const TCP_DC_IPS: Record<number, string> = {
+  1: "149.154.175.53",
+  2: "149.154.167.51",
+  3: "149.154.175.100",
+  4: "149.154.167.91",
+  5: "91.108.56.130",
+};
+
+export function isWebHost(host: string): boolean {
+  return host.endsWith(".web.telegram.org");
+}
+
+export function restoreTcpDc(client: TelegramClient): void {
+  const host = client.session.serverAddress;
+  if (!host || !isWebHost(host)) return;
+  const dcId = client.session.dcId;
+  const ip = TCP_DC_IPS[dcId];
+  if (!ip) throw new Error(`no tcp ip for DC ${dcId}`);
+  client.session.setDC(dcId, ip, 443);
+}
+
+export const MTPROTO_BLOCKED_HINT =
+  "mtproto handshake failed — this network likely blocks raw telegram DC traffic.\n" +
+  "retry over websockets: TELEGRAM_WSS=1 or `telegram config set wss true`";
+
+export function explainConnectionError(err: unknown): Error {
+  const msg = err instanceof Error ? err.message : String(err);
+  if (!wssEnabled() && msg.includes("Not connected")) {
+    return new Error(`${MTPROTO_BLOCKED_HINT}\noriginal: ${msg}`);
+  }
+  return err instanceof Error ? err : new Error(msg);
+}
+
+export function webDcHost(dcId: number, download = false): string {
+  const name = WEB_DC_HOSTS[dcId];
+  if (!name) throw new Error(`no web host for DC ${dcId}`);
+  return `${name}${download ? "-1" : ""}.web.telegram.org`;
+}
+
+const closeError = new Error("WebSocket was closed");
+
+// gramjs ships PromisedWebSockets on top of the `websocket` npm package,
+// which breaks under bun (101 upgrade surfaces as a plain http response).
+// native WebSocket exists in bun and node >= 22, so use that instead.
+// same read/write shape gramjs' Connection expects.
+class NativeWebSocket {
+  private ws?: WebSocket;
+  private stream = Buffer.alloc(0);
+  private closed = true;
+  private canRead!: Promise<boolean>;
+  private resolveRead?: (value: boolean) => void;
+
+  private resetRead() {
+    this.canRead = new Promise((resolve) => {
+      this.resolveRead = resolve;
+    });
+  }
+
+  getWebSocketLink(host: string, port: number, testServers: boolean): string {
+    const scheme = port === 443 ? "wss" : "ws";
+    return `${scheme}://${host}/apiws${testServers ? "_test" : ""}`;
+  }
+
+  async connect(port: number, host: string, testServers = false): Promise<this> {
+    if (typeof WebSocket === "undefined") {
+      throw new Error("wss transport needs a native WebSocket (bun or node >= 22)");
+    }
+    this.stream = Buffer.alloc(0);
+    this.resetRead();
+    this.closed = false;
+    const url = this.getWebSocketLink(host, port, testServers);
+    const ws = new WebSocket(url, "binary");
+    ws.binaryType = "arraybuffer";
+    this.ws = ws;
+
+    return new Promise((resolve, reject) => {
+      ws.onopen = () => resolve(this);
+      ws.onerror = (event) => {
+        reject(new Error(`wss connect to ${url} failed: ${(event as ErrorEvent).message ?? "unknown"}`));
+      };
+      ws.onclose = () => {
+        this.closed = true;
+        this.resolveRead?.(false);
+      };
+      ws.onmessage = (message) => {
+        this.stream = Buffer.concat([this.stream, Buffer.from(message.data as ArrayBuffer)]);
+        this.resolveRead?.(true);
+      };
+    });
+  }
+
+  async read(number: number): Promise<Buffer> {
+    if (this.closed) throw closeError;
+    await this.canRead;
+    if (this.closed) throw closeError;
+    const toReturn = this.stream.subarray(0, number);
+    this.stream = this.stream.subarray(number);
+    if (this.stream.length === 0) this.resetRead();
+    return toReturn;
+  }
+
+  async readExactly(number: number): Promise<Buffer> {
+    let readData = Buffer.alloc(0);
+    while (number > 0) {
+      const chunk = await this.read(number);
+      readData = Buffer.concat([readData, chunk]);
+      number -= chunk.length;
+    }
+    return readData;
+  }
+
+  async readAll(): Promise<Buffer> {
+    if (this.closed || !(await this.canRead)) throw closeError;
+    const toReturn = this.stream;
+    this.stream = Buffer.alloc(0);
+    this.resetRead();
+    return toReturn;
+  }
+
+  write(data: Buffer) {
+    if (this.closed) throw closeError;
+    this.ws?.send(data);
+  }
+
+  async close() {
+    this.ws?.close();
+    this.closed = true;
+  }
+
+  toString() {
+    return "NativeWebSocket";
+  }
+}
+
+export const wssClientParams = {
+  useWSS: true,
+  networkSocket: NativeWebSocket as any,
+  connection: ConnectionTCPObfuscated,
+} as const;
+
+export function applyWss(client: TelegramClient): void {
+  const dcId = client.session.dcId || 2;
+  client.session.setDC(dcId, webDcHost(dcId), 443);
+
+  const original = client.getDC.bind(client);
+  client.getDC = (id: number, downloadDC = false) =>
+    original(id, downloadDC, true);
+}

package/src/config/accounts.ts

@@ -0,0 +1,113 @@
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+  copyFileSync,
+  rmSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// kept in sync with manager.ts; recomputed here to avoid a circular import
+const CONFIG_DIR = join(homedir(), ".supertelegram");
+const ACCOUNTS_DIR = join(CONFIG_DIR, "accounts");
+const ACCOUNTS_FILE = join(CONFIG_DIR, "accounts.json");
+const LEGACY_SESSION_FILE = join(CONFIG_DIR, "session.txt");
+
+export interface AccountMeta {
+  username?: string;
+  userId?: string;
+  name?: string;
+}
+
+export interface AccountsRegistry {
+  current?: string;
+  accounts: Record<string, AccountMeta>;
+}
+
+function readRegistry(): AccountsRegistry {
+  if (!existsSync(ACCOUNTS_FILE)) return { accounts: {} };
+  try {
+    return JSON.parse(readFileSync(ACCOUNTS_FILE, "utf-8"));
+  } catch {
+    return { accounts: {} };
+  }
+}
+
+function writeRegistry(reg: AccountsRegistry): void {
+  if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, { recursive: true });
+  writeFileSync(ACCOUNTS_FILE, JSON.stringify(reg, null, 2));
+}
+
+export function accountSessionPath(name: string): string {
+  return join(ACCOUNTS_DIR, `${name}.txt`);
+}
+
+export function getCurrentAccount(): string | undefined {
+  return readRegistry().current;
+}
+
+export function listAccounts(): {
+  name: string;
+  meta: AccountMeta;
+  current: boolean;
+}[] {
+  const reg = readRegistry();
+  return Object.entries(reg.accounts).map(([name, meta]) => ({
+    name,
+    meta,
+    current: name === reg.current,
+  }));
+}
+
+export function setCurrentAccount(name: string): void {
+  const reg = readRegistry();
+  if (!reg.accounts[name]) {
+    const known = Object.keys(reg.accounts);
+    throw new Error(
+      `account "${name}" not found.` +
+        (known.length ? ` known accounts: ${known.join(", ")}` : " run: telegram login <name>")
+    );
+  }
+  reg.current = name;
+  writeRegistry(reg);
+}
+
+export function registerAccount(
+  name: string,
+  meta: AccountMeta,
+  makeCurrent = true
+): void {
+  if (!existsSync(ACCOUNTS_DIR)) mkdirSync(ACCOUNTS_DIR, { recursive: true });
+  const reg = readRegistry();
+  reg.accounts[name] = meta;
+  if (makeCurrent) reg.current = name;
+  writeRegistry(reg);
+}
+
+export function removeAccount(name: string): void {
+  const reg = readRegistry();
+  if (!reg.accounts[name]) {
+    throw new Error(`account "${name}" not found`);
+  }
+  delete reg.accounts[name];
+  if (reg.current === name) reg.current = Object.keys(reg.accounts)[0];
+  writeRegistry(reg);
+
+  const sessionFile = accountSessionPath(name);
+  if (existsSync(sessionFile)) rmSync(sessionFile);
+}
+
+// one-time migration: fold a pre-multi-account session.txt into account "default"
+// so existing installs keep their login after upgrading.
+export function migrateLegacyIfNeeded(): void {
+  const reg = readRegistry();
+  if (Object.keys(reg.accounts).length > 0) return; // already on the accounts system
+
+  if (existsSync(LEGACY_SESSION_FILE) && readFileSync(LEGACY_SESSION_FILE, "utf-8").trim()) {
+    if (!existsSync(ACCOUNTS_DIR)) mkdirSync(ACCOUNTS_DIR, { recursive: true });
+    copyFileSync(LEGACY_SESSION_FILE, accountSessionPath("default"));
+    registerAccount("default", {}, true);
+  }
+}

package/src/config/manager.ts

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { getCurrentAccount, accountSessionPath } from "./accounts";
 
 const CONFIG_DIR = join(homedir(), ".supertelegram");
 const CONFIG_FILE = join(CONFIG_DIR, "config.json");
@@ -9,6 +10,7 @@ const SESSION_FILE = join(CONFIG_DIR, "session.txt");
 export interface Config {
   appId?: string;
   appHash?: string;
+  wss?: string;
 }
 
 function ensureConfigDir() {
@@ -44,27 +46,39 @@ export function setConfig(key: string, value: string) {
 
 export function getSessionPath(customPath?: string): string {
   // precedence:
-  // 1. custom path from flag
+  // 1. custom path from flag (--account resolves to one of these)
   // 2. TELEGRAM_SESSION env var
-  // 3. global ~/.supertelegram/session.txt
+  // 3. current account's session (~/.supertelegram/accounts/<name>.txt)
   // 4. local ./session.txt (backwards compat)
-  
+  // 5. global ~/.supertelegram/session.txt (legacy default)
+
   if (customPath) {
     return customPath;
   }
-  
+
   if (process.env.TELEGRAM_SESSION) {
     return process.env.TELEGRAM_SESSION;
   }
-  
+
+  const current = getCurrentAccount();
+  if (current) {
+    return accountSessionPath(current);
+  }
+
   // check if local session.txt exists (backwards compat)
   if (existsSync("./session.txt")) {
     return "./session.txt";
   }
-  
+
   return SESSION_FILE;
 }
 
+export function wssEnabled(): boolean {
+  const env = process.env.TELEGRAM_WSS;
+  if (env !== undefined) return env === "1" || env === "true";
+  return getConfig().wss === "true";
+}
+
 export function getApiCredentials(): { appId: number; appHash: string } | null {
   // precedence:
   // 1. env vars