@deadragdoll/tellymcp 0.0.12 → 0.0.14

package/dist/services/features/telegram-mcp/src/app/bootstrap/runtime.js

@@ -12,6 +12,8 @@ const transport_1 = require("../../shared/integrations/telegram/transport");
 const minioExchangeStore_1 = require("../../shared/integrations/object-storage/minioExchangeStore");
 const gatewayHttpService_1 = require("../../features/distributed-gateway/model/gatewayHttpService");
 const gatewayClientAccess_1 = require("../../features/distributed-client/model/gatewayClientAccess");
+const firefoxAttachServer_1 = require("../../features/browser-attach/model/firefoxAttachServer");
+const temporaryFileLinkStore_1 = require("../../features/file-content/model/temporaryFileLinkStore");
 const client_2 = require("../../shared/integrations/terminal/client");
 const ptyRegistry_1 = require("../../shared/integrations/terminal/ptyRegistry");
 async function createAppRuntime(input) {
@@ -33,6 +35,7 @@ async function createAppRuntime(input) {
             httpPort: config.mcp.httpPort,
             httpPath: config.mcp.httpPath,
             bearerAuthEnabled: Boolean(config.mcp.bearerToken),
+            oauthConnectorEnabled: Boolean(config.oauth),
             enableDebugRoutes: config.mcp.enableDebugRoutes,
             enablePruneRoute: config.mcp.enablePruneRoute,
         },
@@ -55,7 +58,6 @@ async function createAppRuntime(input) {
             initDataTtlSeconds: config.webapp.initDataTtlSeconds,
             sessionTtlSeconds: config.webapp.sessionTtlSeconds,
             launchMode: config.webapp.launchMode,
-            pollIntervalMs: config.webapp.pollIntervalMs,
             actionCooldownMs: config.webapp.actionCooldownMs,
         },
         terminal: {
@@ -63,6 +65,15 @@ async function createAppRuntime(input) {
             nudgeDebounceSeconds: config.terminal.nudgeDebounceSeconds,
             nudgeCooldownSeconds: config.terminal.nudgeCooldownSeconds,
         },
+        browser: {
+            enabled: config.browser.enabled,
+            headless: config.browser.headless,
+            devtools: config.browser.devtools,
+            attachEnabled: config.browser.attach.enabled,
+            attachHost: config.browser.attach.host,
+            attachPort: config.browser.attach.port,
+            attachPath: config.browser.attach.path,
+        },
         telegram: {
             webhookEnabled: config.telegram.webhook.enabled,
             webhookPath: config.telegram.webhook.path,
@@ -200,6 +211,13 @@ async function createAppRuntime(input) {
     await telegramTransport.sendStartupNotifications();
     logger.info("Startup Telegram notifications completed");
     const gatewayHttpService = new gatewayHttpService_1.GatewayHttpService(config, input.callBroker);
+    const temporaryFileLinkStore = config.distributed.mode !== "client" &&
+        config.distributed.gatewayPublicUrl?.trim()
+        ? new temporaryFileLinkStore_1.TemporaryFileLinkStore(config.distributed.gatewayPublicUrl, logger)
+        : null;
+    await temporaryFileLinkStore?.start();
+    const firefoxAttachServer = new firefoxAttachServer_1.FirefoxAttachServer(config, logger, stateStore, stateStore);
+    await firefoxAttachServer.start();
     return {
         callBroker: input.callBroker,
         config,
@@ -217,8 +235,12 @@ async function createAppRuntime(input) {
         projectIdentityResolver,
         webAppLaunchRegistry,
         gatewayHttpService,
+        firefoxAttachServer,
+        temporaryFileLinkStore,
         shutdown: async () => {
             logger.info("Shutdown started");
+            await temporaryFileLinkStore?.stop();
+            await firefoxAttachServer.stop();
             await telegramTransport.stop();
             (0, ptyRegistry_1.stopAllPtyTargets)();
             redis.disconnect();

package/dist/services/features/telegram-mcp/src/app/config/env.js

@@ -93,6 +93,22 @@ const envSchema = z.object({
     MCP_HTTP_PORT: z.coerce.number().int().positive().default(8787),
     MCP_HTTP_PATH: z.string().min(1).default("/mcp"),
     MCP_HTTP_BEARER_TOKEN: optionalNonEmptyString,
+    TELLYMCP_PUBLIC_URL: optionalUrlString,
+    TELLYMCP_OAUTH_ISSUER: optionalUrlString,
+    TELLYMCP_OAUTH_AUDIENCE: optionalUrlString,
+    TELLYMCP_MAGIC_TOKEN: optionalNonEmptyString,
+    TELLYMCP_MAGIC_TOKEN_HASH: optionalNonEmptyString,
+    TELLYMCP_OAUTH_CLIENT_ID: optionalNonEmptyString,
+    TELLYMCP_OAUTH_CLIENT_SECRET: optionalNonEmptyString,
+    TELLYMCP_ALLOWED_REDIRECT_URIS: optionalNonEmptyString,
+    TELLYMCP_OAUTH_PRIVATE_KEY_PEM: optionalNonEmptyString,
+    TELLYMCP_AUTH_CODE_TTL_SECONDS: z.coerce
+        .number()
+        .int()
+        .positive()
+        .default(300),
+    TELLYMCP_OAUTH_SCOPES: z.string().min(1).default("tellymcp:read tellymcp:write"),
+    TELLYMCP_OAUTH_KEY_ID: z.string().min(1).default("tellymcp-oauth"),
     MCP_HTTP_ENABLE_DEBUG_ROUTES: z
         .string()
         .optional()
@@ -145,7 +161,6 @@ const envSchema = z.object({
         .enum(["default", "expand", "fullscreen"])
         .default("fullscreen"),
     WEBAPP_VISIBLE_SCREENS: z.coerce.number().int().positive().default(2),
-    WEBAPP_POLL_INTERVAL_MS: z.coerce.number().int().positive().default(2000),
     WEBAPP_ACTION_COOLDOWN_MS: z.coerce.number().int().nonnegative().default(150),
     MCP_XCHANGE_DIR: z.string().min(1).default(".mcp-xchange"),
     TERMINAL_SHELL: z.string().min(1).default(process.env.SHELL || "bash"),
@@ -211,6 +226,13 @@ const envSchema = z.object({
     BROWSER_EXECUTABLE_PATH: optionalNonEmptyString,
     BROWSER_CHANNEL: z.preprocess(emptyStringToUndefined, z.enum(["chrome", "chromium", "msedge"]).optional()),
     BROWSER_SLOW_MO_MS: z.coerce.number().int().nonnegative().default(0),
+    BROWSER_ATTACH_ENABLED: z
+        .string()
+        .optional()
+        .transform((value) => value === "true"),
+    BROWSER_ATTACH_WS_HOST: z.string().min(1).default("127.0.0.1"),
+    BROWSER_ATTACH_WS_PORT: z.coerce.number().int().positive().default(9999),
+    BROWSER_ATTACH_WS_PATH: z.string().min(1).default("/browser-attach/ws"),
     PROXY_USE: z.preprocess(emptyStringToUndefined, z.enum(["http", "socks5"]).optional()),
     HTTP_PROXY: optionalNonEmptyString,
     SOCKS5_PROXY: optionalNonEmptyString,
@@ -239,6 +261,16 @@ function loadConfig() {
         !parsed.TELEGRAM_BOT_TOKEN?.trim()) {
         throw new Error("TELEGRAM_BOT_TOKEN is required for gateway and both distributed modes.");
     }
+    const gatewayServerEnabled = parsed.DISTRIBUTED_MODE === "gateway" ||
+        parsed.DISTRIBUTED_MODE === "both";
+    const gatewayClientConfigured = parsed.DISTRIBUTED_MODE === "client" &&
+        Boolean(parsed.GATEWAY_PUBLIC_URL || parsed.GATEWAY_WS_URL);
+    if ((gatewayServerEnabled || gatewayClientConfigured) &&
+        !parsed.GATEWAY_AUTH_TOKEN?.trim()) {
+        throw new Error(gatewayServerEnabled
+            ? "GATEWAY_AUTH_TOKEN is required for gateway and both distributed modes."
+            : "GATEWAY_AUTH_TOKEN is required when a client connects to a gateway.");
+    }
     if (parsed.ADMIN_TOKEN?.trim() && !parsed.TELEGRAM_BOT_TOKEN?.trim()) {
         throw new Error("ADMIN_TOKEN requires TELEGRAM_BOT_TOKEN because admin mode runs through the gateway bot.");
     }
@@ -250,6 +282,69 @@ function loadConfig() {
             throw new Error("TELEGRAM_WEBHOOK_ENABLED=true requires TELEGRAM_WEBHOOK_SECRET.");
         }
     }
+    const oauthConfigured = Boolean(parsed.TELLYMCP_PUBLIC_URL ||
+        parsed.TELLYMCP_OAUTH_ISSUER ||
+        parsed.TELLYMCP_OAUTH_AUDIENCE ||
+        parsed.TELLYMCP_MAGIC_TOKEN ||
+        parsed.TELLYMCP_MAGIC_TOKEN_HASH ||
+        parsed.TELLYMCP_OAUTH_CLIENT_ID ||
+        parsed.TELLYMCP_OAUTH_CLIENT_SECRET ||
+        parsed.TELLYMCP_ALLOWED_REDIRECT_URIS ||
+        parsed.TELLYMCP_OAUTH_PRIVATE_KEY_PEM);
+    if (oauthConfigured && !parsed.TELLYMCP_PUBLIC_URL) {
+        throw new Error("TELLYMCP_PUBLIC_URL is required when OAuth connector settings are configured.");
+    }
+    if (oauthConfigured &&
+        !parsed.TELLYMCP_MAGIC_TOKEN &&
+        !parsed.TELLYMCP_MAGIC_TOKEN_HASH) {
+        throw new Error("TELLYMCP_MAGIC_TOKEN or TELLYMCP_MAGIC_TOKEN_HASH is required when OAuth is configured.");
+    }
+    if (parsed.TELLYMCP_MAGIC_TOKEN && parsed.TELLYMCP_MAGIC_TOKEN_HASH) {
+        throw new Error("Configure only one of TELLYMCP_MAGIC_TOKEN and TELLYMCP_MAGIC_TOKEN_HASH.");
+    }
+    if (parsed.TELLYMCP_MAGIC_TOKEN_HASH &&
+        !/^sha256:[a-f0-9]{64}$/iu.test(parsed.TELLYMCP_MAGIC_TOKEN_HASH)) {
+        throw new Error("TELLYMCP_MAGIC_TOKEN_HASH must use the format sha256:<64 hex characters>.");
+    }
+    if (parsed.TELLYMCP_OAUTH_CLIENT_SECRET && !parsed.TELLYMCP_OAUTH_CLIENT_ID) {
+        throw new Error("TELLYMCP_OAUTH_CLIENT_SECRET requires TELLYMCP_OAUTH_CLIENT_ID.");
+    }
+    for (const [name, value] of [
+        ["TELLYMCP_PUBLIC_URL", parsed.TELLYMCP_PUBLIC_URL],
+        ["TELLYMCP_OAUTH_ISSUER", parsed.TELLYMCP_OAUTH_ISSUER],
+        ["TELLYMCP_OAUTH_AUDIENCE", parsed.TELLYMCP_OAUTH_AUDIENCE],
+    ]) {
+        if (!value) {
+            continue;
+        }
+        const url = new URL(value);
+        if (url.search || url.hash) {
+            throw new Error(`${name} must not contain a query string or fragment.`);
+        }
+    }
+    const oauthScopes = parsed.TELLYMCP_OAUTH_SCOPES
+        .split(/[\s,]+/u)
+        .map((scope) => scope.trim())
+        .filter(Boolean);
+    if (oauthConfigured && oauthScopes.length === 0) {
+        throw new Error("TELLYMCP_OAUTH_SCOPES must contain at least one scope.");
+    }
+    const allowedRedirectUris = parsed.TELLYMCP_ALLOWED_REDIRECT_URIS
+        ? parsed.TELLYMCP_ALLOWED_REDIRECT_URIS.split(",")
+            .map((redirectUri) => redirectUri.trim())
+            .filter(Boolean)
+        : [];
+    for (const redirectUri of allowedRedirectUris) {
+        try {
+            const parsedRedirectUri = new URL(redirectUri);
+            if (parsedRedirectUri.hash) {
+                throw new Error("fragment");
+            }
+        }
+        catch {
+            throw new Error(`TELLYMCP_ALLOWED_REDIRECT_URIS contains an invalid URL: ${redirectUri}`);
+        }
+    }
     const telegramProxy = parsed.PROXY_USE === "http"
         ? parsed.HTTP_PROXY
             ? {
@@ -321,6 +416,36 @@ function loadConfig() {
             enableDebugRoutes: parsed.MCP_HTTP_ENABLE_DEBUG_ROUTES,
             enablePruneRoute: parsed.MCP_HTTP_ENABLE_PRUNE_ROUTE,
         },
+        ...(oauthConfigured && parsed.TELLYMCP_PUBLIC_URL
+            ? {
+                oauth: {
+                    publicUrl: parsed.TELLYMCP_PUBLIC_URL.replace(/\/+$/u, ""),
+                    issuer: (parsed.TELLYMCP_OAUTH_ISSUER ?? parsed.TELLYMCP_PUBLIC_URL).replace(/\/+$/u, ""),
+                    audience: (parsed.TELLYMCP_OAUTH_AUDIENCE ?? parsed.TELLYMCP_PUBLIC_URL).replace(/\/+$/u, ""),
+                    ...(parsed.TELLYMCP_MAGIC_TOKEN
+                        ? { magicToken: parsed.TELLYMCP_MAGIC_TOKEN }
+                        : {}),
+                    ...(parsed.TELLYMCP_MAGIC_TOKEN_HASH
+                        ? { magicTokenHash: parsed.TELLYMCP_MAGIC_TOKEN_HASH }
+                        : {}),
+                    ...(parsed.TELLYMCP_OAUTH_CLIENT_ID
+                        ? { clientId: parsed.TELLYMCP_OAUTH_CLIENT_ID }
+                        : {}),
+                    ...(parsed.TELLYMCP_OAUTH_CLIENT_SECRET
+                        ? { clientSecret: parsed.TELLYMCP_OAUTH_CLIENT_SECRET }
+                        : {}),
+                    allowedRedirectUris,
+                    ...(parsed.TELLYMCP_OAUTH_PRIVATE_KEY_PEM
+                        ? {
+                            privateKeyPem: parsed.TELLYMCP_OAUTH_PRIVATE_KEY_PEM.replace(/\\n/gu, "\n"),
+                        }
+                        : {}),
+                    authCodeTtlSeconds: parsed.TELLYMCP_AUTH_CODE_TTL_SECONDS,
+                    scopes: oauthScopes,
+                    keyId: parsed.TELLYMCP_OAUTH_KEY_ID,
+                },
+            }
+            : {}),
         distributed: {
             mode: parsed.DISTRIBUTED_MODE,
             ...(parsed.GATEWAY_PUBLIC_URL
@@ -379,7 +504,6 @@ function loadConfig() {
             sessionTtlSeconds: parsed.WEBAPP_SESSION_TTL_SECONDS,
             launchMode: parsed.WEBAPP_LAUNCH_MODE,
             visibleScreens: parsed.WEBAPP_VISIBLE_SCREENS,
-            pollIntervalMs: parsed.WEBAPP_POLL_INTERVAL_MS,
             actionCooldownMs: parsed.WEBAPP_ACTION_COOLDOWN_MS,
         },
         exchange: {
@@ -417,6 +541,12 @@ function loadConfig() {
                 : {}),
             ...(parsed.BROWSER_CHANNEL ? { channel: parsed.BROWSER_CHANNEL } : {}),
             slowMoMs: parsed.BROWSER_SLOW_MO_MS,
+            attach: {
+                enabled: parsed.BROWSER_ATTACH_ENABLED,
+                host: parsed.BROWSER_ATTACH_WS_HOST,
+                port: parsed.BROWSER_ATTACH_WS_PORT,
+                path: parsed.BROWSER_ATTACH_WS_PATH,
+            },
         },
         project: {
             ...(parsed.PROJECT_NAME ? { name: parsed.PROJECT_NAME } : {}),

package/dist/services/features/telegram-mcp/src/app/http.js

@@ -3,15 +3,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveMcpHttpAuthorization = resolveMcpHttpAuthorization;
+exports.isMcpHttpRequestAuthorized = isMcpHttpRequestAuthorized;
 exports.createMcpHttpHandler = createMcpHttpHandler;
 const node_crypto_1 = require("node:crypto");
 const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
 const ws_1 = __importDefault(require("ws"));
+const oauthFacade_1 = require("./oauthFacade");
 const auth_1 = require("./webapp/auth");
 const relay_1 = require("./webapp/relay");
 const assets_1 = require("./webapp/assets");
 const client_1 = require("../shared/integrations/terminal/client");
 const terminal_1 = require("./webapp/terminal");
+const bodyLimits_1 = require("../shared/lib/bodyLimits");
 function formatTerminalHttpError(error, fallback) {
     if ((0, terminal_1.isTerminalUnavailableError)(error)) {
         return "terminal runtime is unavailable";
@@ -32,6 +36,13 @@ function isInitializeRequest(body) {
     const method = Reflect.get(body, "method");
     return method === "initialize";
 }
+function readMcpRpcMethod(body) {
+    if (!body || typeof body !== "object") {
+        return undefined;
+    }
+    const method = Reflect.get(body, "method");
+    return typeof method === "string" ? method : undefined;
+}
 function readHeader(req, headerName) {
     const value = req.headers[headerName];
     if (Array.isArray(value)) {
@@ -44,24 +55,21 @@ async function readJsonBody(req) {
     if (knownParams &&
         typeof knownParams === "object" &&
         Object.keys(knownParams).length > 0) {
+        (0, bodyLimits_1.assertSerializedBodySize)(knownParams);
         return knownParams;
     }
     const knownBody = req.body;
     if (knownBody !== undefined) {
+        (0, bodyLimits_1.assertSerializedBodySize)(knownBody);
         return knownBody;
     }
-    const chunks = [];
-    for await (const chunk of req) {
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
-    }
-    if (chunks.length === 0) {
-        return undefined;
-    }
-    const raw = Buffer.concat(chunks).toString("utf8").trim();
-    if (!raw) {
-        return undefined;
+    return (0, bodyLimits_1.readLimitedJsonBody)(req);
+}
+function ignoreInvalidJsonBody(error) {
+    if ((0, bodyLimits_1.isBodySizeLimitError)(error)) {
+        throw error;
     }
-    return JSON.parse(raw);
+    return undefined;
 }
 function writeJson(res, statusCode, payload) {
     const body = JSON.stringify(payload);
@@ -103,6 +111,19 @@ function readBearerToken(req) {
     }
     return header.slice("Bearer ".length).trim() || null;
 }
+function resolveMcpHttpAuthorization(req, internalBearerToken, oauthFacade) {
+    if (!internalBearerToken && !oauthFacade) {
+        return "public";
+    }
+    if (internalBearerToken && isAuthorized(req, internalBearerToken)) {
+        return "internal_bearer";
+    }
+    const token = readBearerToken(req);
+    return token && oauthFacade?.verifyAccessToken(token) ? "oauth" : null;
+}
+function isMcpHttpRequestAuthorized(req, internalBearerToken, oauthFacade) {
+    return resolveMcpHttpAuthorization(req, internalBearerToken, oauthFacade) !== null;
+}
 function isDuplicateSseStreamError(error) {
     const message = error instanceof Error ? (error.stack ?? error.message) : String(error);
     return message.includes("Only one SSE stream is allowed per session");
@@ -143,7 +164,10 @@ function isRelayTerminalUnavailableMessage(error) {
 function createMcpHttpHandler(runtime, input) {
     const transports = new Map();
     const webAppSessions = new auth_1.WebAppSessionRegistry();
-    const liveWsServer = new WebSocketServer({ noServer: true });
+    const liveWsServer = new WebSocketServer({
+        noServer: true,
+        maxPayload: bodyLimits_1.MAX_BODY_SIZE_BYTES,
+    });
     const webAppBasePath = runtime.config.webapp.basePath.replace(/\/+$/u, "") || "/webapp";
     const rootPrefix = normalizeBasePath(process.env.ROOT_PREFIX || "/api");
     const publicWebAppBasePath = rootPrefix === "/"
@@ -153,6 +177,13 @@ function createMcpHttpHandler(runtime, input) {
     const webAppLivePrefix = `${webAppBasePath}/live/`;
     const telegramWebhookPath = runtime.config.telegram.webhook.path.replace(/\/+$/u, "") ||
         "/telegram/webhook";
+    const mcpHttpPath = runtime.config.mcp.httpPath.replace(/\/+$/u, "") || "/mcp";
+    const oauthFacade = runtime.config.oauth
+        ? (0, oauthFacade_1.createOAuthFacade)(runtime.config.oauth, mcpHttpPath, runtime.logger)
+        : null;
+    if (oauthFacade?.ephemeralSigningKey) {
+        runtime.logger.warn("OAuth connector is using an ephemeral signing key; access tokens will stop working after restart");
+    }
     const closeSessionEntry = async (entry) => {
         await entry.close();
     };
@@ -220,6 +251,11 @@ function createMcpHttpHandler(runtime, input) {
             socket.on("close", () => {
                 void cleanup();
             });
+            socket.on("error", (error) => {
+                runtime.logger.warn("Telegram WebApp live WS socket error", {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            });
             socket.on("message", (raw) => {
                 void (async () => {
                     const parsed = raw && typeof raw === "string"
@@ -288,6 +324,15 @@ function createMcpHttpHandler(runtime, input) {
                         }
                         if (resolved.session?.terminalTarget && (0, client_1.isStreamableTerminalTarget)(resolved.session.terminalTarget)) {
                             (0, client_1.resizeForegroundTerminal)(resolved.session.terminalTarget, Math.max(20, Math.min(400, Math.round(cols))), Math.max(5, Math.min(200, Math.round(rows))));
+                            return;
+                        }
+                        if (resolved.relayTarget) {
+                            await input.getGatewaySocketService?.()?.requestLiveRelay?.({
+                                clientUuid: resolved.relayTarget.clientUuid,
+                                localSessionId: resolved.relayTarget.localSessionId,
+                                requestType: "resize",
+                                payload: { cols, rows },
+                            });
                         }
                     }
                 })().catch((error) => {
@@ -356,11 +401,39 @@ function createMcpHttpHandler(runtime, input) {
             socket.close(1011, "Live stream bootstrap failed");
         });
     });
-    const handleRequest = async (req, res, pathname) => {
+    const handleRequestInternal = async (req, res, pathname) => {
         const method = req.method ?? "GET";
         const normalizedPathname = normalizePrefixedPathname(pathname);
         const requestUrl = new URL(req.url ?? normalizedPathname, `http://gateway.local`);
         requestUrl.pathname = normalizedPathname;
+        if (runtime.temporaryFileLinkStore &&
+            (await runtime.temporaryFileLinkStore.handleRequest(req, res, requestUrl.pathname))) {
+            return;
+        }
+        if (oauthFacade) {
+            const authorizationHeader = readHeader(req, "authorization");
+            const connectorRequestContext = {
+                method,
+                rawPath: pathname,
+                path: requestUrl.pathname,
+                queryParameters: [...requestUrl.searchParams.keys()],
+                userAgent: readHeader(req, "user-agent"),
+                accept: readHeader(req, "accept"),
+                contentType: readHeader(req, "content-type"),
+                authorizationHeaderPresent: Boolean(authorizationHeader),
+                authorizationScheme: authorizationHeader?.split(/\s+/u, 1)[0],
+                mcpSessionId: readHeader(req, "mcp-session-id"),
+                remoteAddress: req.socket.remoteAddress,
+            };
+            runtime.logger.info("OAuth connector HTTP request received", connectorRequestContext);
+            res.once("finish", () => {
+                runtime.logger.info("OAuth connector HTTP response completed", {
+                    ...connectorRequestContext,
+                    statusCode: res.statusCode,
+                    responseContentType: String(res.getHeader("content-type") ?? ""),
+                });
+            });
+        }
         if (requestUrl.pathname === "/healthz") {
             writeJson(res, 200, {
                 ok: true,
@@ -369,6 +442,10 @@ function createMcpHttpHandler(runtime, input) {
             });
             return;
         }
+        if (oauthFacade &&
+            (await oauthFacade.handleRequest(req, res, requestUrl.pathname))) {
+            return;
+        }
         if (runtime.config.telegram.webhook.enabled &&
             requestUrl.pathname === telegramWebhookPath) {
             if (method !== "POST") {
@@ -457,7 +534,7 @@ function createMcpHttpHandler(runtime, input) {
                     method,
                     path: requestUrl.pathname,
                 });
-                const body = await readJsonBody(req).catch(() => undefined);
+                const body = await readJsonBody(req).catch(ignoreInvalidJsonBody);
                 let sessionId = body &&
                     typeof body === "object" &&
                     typeof Reflect.get(body, "sessionId") === "string"
@@ -529,7 +606,6 @@ function createMcpHttpHandler(runtime, input) {
                             session_id: relayBootstrap.session_id,
                             session_label: relayBootstrap.session_label,
                             terminal_target: relayBootstrap.terminal_target,
-                            poll_interval_ms: relayBootstrap.poll_interval_ms,
                             expires_at: new Date(record.expiresAtMs).toISOString(),
                         });
                         if (trustedTelegramUserId !== null) {
@@ -569,17 +645,6 @@ function createMcpHttpHandler(runtime, input) {
                 }
                 try {
                     const validated = (0, auth_1.validateTelegramWebAppInitData)(initDataRaw, initDataUnsafe, requireTelegramBotToken(runtime, "validate Telegram WebApp bootstrap"), runtime.config.webapp.initDataTtlSeconds);
-                    runtime.logger.info("Telegram WebApp initData validation debug", {
-                        sessionId: sessionId || null,
-                        telegramUserId: validated.user.id,
-                        providedHash: validated.validationDebug.providedHash,
-                        officialRawMatches: validated.validationDebug.officialRaw.matches,
-                        officialRawCheckString: validated.validationDebug.officialRaw.checkString,
-                        officialRawComputedHash: validated.validationDebug.officialRaw.computedHash,
-                        userFieldsMatches: validated.validationDebug.userFields?.matches ?? null,
-                        userFieldsCheckString: validated.validationDebug.userFields?.checkString ?? null,
-                        userFieldsComputedHash: validated.validationDebug.userFields?.computedHash ?? null,
-                    });
                     if (!sessionId) {
                         sessionId =
                             (await runtime.bindingStore.getActiveSessionIdForTelegramUser(validated.user.id)) ?? "";
@@ -615,7 +680,6 @@ function createMcpHttpHandler(runtime, input) {
                         session_id: sessionId,
                         session_label: session?.label ?? null,
                         terminal_target: Boolean(session?.terminalTarget),
-                        poll_interval_ms: runtime.config.webapp.pollIntervalMs,
                         expires_at: new Date(record.expiresAtMs).toISOString(),
                     });
                     if (launchRecord?.telegramChatId !== undefined &&
@@ -640,7 +704,6 @@ function createMcpHttpHandler(runtime, input) {
                     runtime.logger.warn("Telegram WebApp bootstrap rejected", {
                         sessionId,
                         initDataLength: initDataRaw.length,
-                        initDataPreview: initDataRaw.slice(0, 160),
                         hasUnsafeUser: Boolean(initDataUnsafe?.user) &&
                             typeof initDataUnsafe?.user?.id === "number",
                         error: error instanceof Error
@@ -651,74 +714,6 @@ function createMcpHttpHandler(runtime, input) {
                 }
                 return;
             }
-            if (requestUrl.pathname === `${webAppBasePath}/api/view`) {
-                if (method !== "GET") {
-                    writeText(res, 405, "Method not allowed");
-                    return;
-                }
-                const token = readBearerToken(req);
-                const webAppSession = token ? webAppSessions.get(token) : null;
-                if (!webAppSession) {
-                    writeText(res, 401, "Unauthorized");
-                    return;
-                }
-                const relayTarget = (0, relay_1.parseLiveRelaySessionId)(webAppSession.sessionId);
-                if (relayTarget) {
-                    try {
-                        const result = await runtime.gatewayHttpService.requestLiveRelayView({
-                            clientUuid: relayTarget.clientUuid,
-                            localSessionId: relayTarget.localSessionId,
-                        });
-                        writeJson(res, 200, result);
-                    }
-                    catch (error) {
-                        runtime.logger.error("Telegram WebApp relay visible buffer capture failed", {
-                            sessionId: webAppSession.sessionId,
-                            clientUuid: relayTarget.clientUuid,
-                            localSessionId: relayTarget.localSessionId,
-                            error: error instanceof Error
-                                ? (error.stack ?? error.message)
-                                : String(error),
-                        });
-                        writeText(res, isRelayTerminalUnavailableMessage(error) ? 503 : 500, error instanceof Error ? error.message : "Failed to capture relay terminal buffer");
-                    }
-                    return;
-                }
-                const binding = await runtime.bindingStore.getBinding(webAppSession.sessionId);
-                if (!binding ||
-                    binding.telegramUserId !== webAppSession.telegramUserId) {
-                    writeText(res, 403, "Session binding is no longer valid");
-                    return;
-                }
-                const session = await runtime.sessionStore.getSession(webAppSession.sessionId);
-                if (!session?.terminalTarget) {
-                    writeText(res, 409, "terminal target is not configured for this session");
-                    return;
-                }
-                try {
-                    const terminalSize = await (0, terminal_1.getTerminalWindowSize)(runtime.config.terminal, session.terminalTarget);
-                    const content = await (0, terminal_1.captureVisibleTerminal)(runtime.config.terminal, session.terminalTarget, runtime.config.terminal.captureLines, runtime.config.webapp.visibleScreens);
-                    const ansi = await (0, terminal_1.captureVisibleTerminalAnsi)(runtime.config.terminal, session.terminalTarget, runtime.config.terminal.captureLines, runtime.config.webapp.visibleScreens);
-                    writeJson(res, 200, {
-                        session_id: session.sessionId,
-                        session_label: session.label ?? null,
-                        captured_at: new Date().toISOString(),
-                        content,
-                        ansi,
-                        ...(terminalSize ? terminalSize : {}),
-                    });
-                }
-                catch (error) {
-                    runtime.logger.error("Telegram WebApp visible buffer capture failed", {
-                        sessionId: webAppSession.sessionId,
-                        error: error instanceof Error
-                            ? (error.stack ?? error.message)
-                            : String(error),
-                    });
-                    writeText(res, (0, terminal_1.isTerminalUnavailableError)(error) ? 503 : 500, formatTerminalHttpError(error, "Failed to capture visible terminal buffer"));
-                }
-                return;
-            }
             if (requestUrl.pathname === `${webAppBasePath}/api/action`) {
                 if (method !== "POST") {
                     writeText(res, 405, "Method not allowed");
@@ -730,7 +725,7 @@ function createMcpHttpHandler(runtime, input) {
                     writeText(res, 401, "Unauthorized");
                     return;
                 }
-                const body = await readJsonBody(req).catch(() => undefined);
+                const body = await readJsonBody(req).catch(ignoreInvalidJsonBody);
                 const action = body &&
                     typeof body === "object" &&
                     typeof Reflect.get(body, "action") === "string"
@@ -921,16 +916,22 @@ function createMcpHttpHandler(runtime, input) {
             });
             return;
         }
-        if (requestUrl.pathname !== runtime.config.mcp.httpPath) {
+        if (requestUrl.pathname !== mcpHttpPath &&
+            requestUrl.pathname !== `${mcpHttpPath}/`) {
             writeText(res, 404, "Not found");
             return;
         }
-        if (!isAuthorized(req, runtime.config.mcp.bearerToken)) {
+        const authorizationMode = resolveMcpHttpAuthorization(req, runtime.config.mcp.bearerToken, oauthFacade);
+        if (!authorizationMode) {
+            const authorizationHeader = readHeader(req, "authorization");
             runtime.logger.warn("Unauthorized MCP HTTP request rejected", {
                 method,
                 path: requestUrl.pathname,
                 remoteAddress: req.socket.remoteAddress,
+                authorizationHeaderPresent: Boolean(authorizationHeader),
+                authorizationScheme: authorizationHeader?.split(/\s+/u, 1)[0],
             });
+            oauthFacade?.writeMcpChallenge(res);
             writeText(res, 401, "Unauthorized");
             return;
         }
@@ -938,12 +939,33 @@ function createMcpHttpHandler(runtime, input) {
         const parsedBody = method === "POST" || method === "DELETE"
             ? await readJsonBody(req)
             : undefined;
+        const rpcMethod = readMcpRpcMethod(parsedBody);
         runtime.logger.debug("MCP HTTP request received", {
             method,
             path: requestUrl.pathname,
             sessionId,
+            authorizationMode,
+            rpcMethod,
             hasBody: parsedBody !== undefined,
         });
+        if (rpcMethod === "initialize" || rpcMethod === "tools/list") {
+            runtime.logger.info("Chat connector MCP handshake request received", {
+                rpcMethod,
+                authorizationMode,
+                sessionId,
+                userAgent: readHeader(req, "user-agent"),
+            });
+            res.once("finish", () => {
+                runtime.logger.info("Chat connector MCP handshake response completed", {
+                    rpcMethod,
+                    authorizationMode,
+                    statusCode: res.statusCode,
+                    sessionId: readHeader(req, "mcp-session-id") ??
+                        (String(res.getHeader("mcp-session-id") ?? "") || undefined),
+                    contentType: String(res.getHeader("content-type") ?? ""),
+                });
+            });
+        }
         try {
             if (method === "POST") {
                 if (sessionId) {
@@ -1090,6 +1112,24 @@ function createMcpHttpHandler(runtime, input) {
             }
         }
     };
+    const handleRequest = async (req, res, pathname) => {
+        try {
+            await handleRequestInternal(req, res, pathname);
+        }
+        catch (error) {
+            if (!(0, bodyLimits_1.isBodySizeLimitError)(error)) {
+                throw error;
+            }
+            if (!res.headersSent) {
+                writeJson(res, 413, {
+                    error: `Request body exceeds the ${bodyLimits_1.MAX_BODY_SIZE} MiB limit`,
+                });
+            }
+            else if (!res.writableEnded) {
+                res.end();
+            }
+        }
+    };
     let shuttingDown = false;
     const handleUpgrade = async (req, socket, head, pathname) => {
         const normalizedPathname = normalizePrefixedPathname(pathname);