@deadragdoll/tellymcp 0.0.12 → 0.0.14

package/dist/services/features/telegram-mcp/src/app/webapp/auth.js

@@ -124,27 +124,42 @@ function normalizeTelegramWebAppInitData(rawInitData) {
     }
     return normalized.trim();
 }
-function normalizeUnsafeUser(user) {
-    if (!user || typeof user !== "object" || typeof user.id !== "number") {
+function normalizeTelegramWebAppUser(user) {
+    if (!user || typeof user !== "object") {
+        return null;
+    }
+    const record = user;
+    if (typeof record.id !== "number" ||
+        !Number.isSafeInteger(record.id) ||
+        record.id <= 0) {
         return null;
     }
     return {
-        id: user.id,
-        ...(typeof user.first_name === "string" ? { first_name: user.first_name } : {}),
-        ...(typeof user.last_name === "string" ? { last_name: user.last_name } : {}),
-        ...(typeof user.username === "string" ? { username: user.username } : {}),
-        ...(typeof user.language_code === "string"
-            ? { language_code: user.language_code }
+        id: record.id,
+        ...(typeof record.first_name === "string"
+            ? { first_name: record.first_name }
+            : {}),
+        ...(typeof record.last_name === "string"
+            ? { last_name: record.last_name }
+            : {}),
+        ...(typeof record.username === "string"
+            ? { username: record.username }
+            : {}),
+        ...(typeof record.language_code === "string"
+            ? { language_code: record.language_code }
+            : {}),
+        ...(typeof record.photo_url === "string"
+            ? { photo_url: record.photo_url }
             : {}),
-        ...(typeof user.photo_url === "string" ? { photo_url: user.photo_url } : {}),
     };
 }
-function buildOfficialRawValidation(rawInitData, botToken) {
+function validateOfficialRawHash(rawInitData, botToken) {
     const params = new URLSearchParams(rawInitData);
-    const receivedHash = params.get("hash");
-    if (!receivedHash) {
-        return null;
+    const receivedHashes = params.getAll("hash");
+    if (receivedHashes.length !== 1 || !receivedHashes[0]) {
+        throw new Error("Telegram WebApp initData hash validation failed.");
     }
+    const receivedHash = receivedHashes[0];
     const checkString = [...params.entries()]
         .filter(([key, value]) => key !== "hash" && value !== undefined)
         .sort((left, right) => left[0].localeCompare(right[0]))
@@ -158,83 +173,86 @@ function buildOfficialRawValidation(rawInitData, botToken) {
         .digest("hex");
     const matches = computed.length === receivedHash.length &&
         (0, node_crypto_1.timingSafeEqual)(Buffer.from(computed, "utf8"), Buffer.from(receivedHash, "utf8"));
-    return {
-        checkString,
-        computedHash: computed,
-        providedHash: receivedHash,
-        matches,
-    };
+    if (!matches) {
+        throw new Error("Telegram WebApp initData hash validation failed.");
+    }
+    return params;
 }
-function buildUserFieldsValidation(unsafe, botToken) {
-    if (!unsafe) {
-        return null;
+function readSignedParam(params, key, required) {
+    const values = params.getAll(key);
+    if (values.length > 1) {
+        throw new Error(`Telegram WebApp initData contains duplicate ${key}.`);
     }
-    const user = normalizeUnsafeUser(unsafe.user);
-    const authDateValue = typeof unsafe.auth_date === "number" || typeof unsafe.auth_date === "string"
-        ? unsafe.auth_date
-        : undefined;
-    const receivedHash = typeof unsafe.hash === "string" && unsafe.hash.length > 0
-        ? unsafe.hash
+    const value = values[0];
+    if (required && (value === undefined || value.length === 0)) {
+        throw new Error(`Telegram WebApp initData is missing ${key}.`);
+    }
+    return value;
+}
+function parseSignedUser(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new Error("Telegram WebApp signed user is malformed.");
+    }
+    const user = normalizeTelegramWebAppUser(parsed);
+    if (!user) {
+        throw new Error("Telegram WebApp signed user is invalid.");
+    }
+    return user;
+}
+function assertUnsafeDataMatchesSigned(unsafe, signed) {
+    const unsafeUser = normalizeTelegramWebAppUser(unsafe.user);
+    if (!unsafeUser ||
+        JSON.stringify(unsafeUser) !== JSON.stringify(signed.user)) {
+        throw new Error("Telegram WebApp unsafe user does not match signed initData.");
+    }
+    const unsafeAuthDate = typeof unsafe.auth_date === "number" || typeof unsafe.auth_date === "string"
+        ? String(unsafe.auth_date)
         : undefined;
-    if (!user || authDateValue === undefined || !receivedHash) {
-        return null;
+    if (unsafeAuthDate !== String(signed.authDate)) {
+        throw new Error("Telegram WebApp unsafe auth_date does not match signed initData.");
+    }
+    if (unsafe.query_id !== signed.queryId) {
+        throw new Error("Telegram WebApp unsafe query_id does not match signed initData.");
+    }
+    if (unsafe.start_param !== signed.startParam) {
+        throw new Error("Telegram WebApp unsafe start_param does not match signed initData.");
+    }
+    if (unsafe.hash !== undefined && unsafe.hash !== signed.hash) {
+        throw new Error("Telegram WebApp unsafe hash does not match signed initData.");
     }
-    const params = {
-        id: user.id,
-        first_name: user.first_name,
-        last_name: user.last_name,
-        username: user.username,
-        photo_url: user.photo_url,
-        auth_date: authDateValue,
-    };
-    const checkString = Object.keys(params)
-        .sort()
-        .filter((key) => params[key] !== undefined)
-        .map((key) => `${key}=${params[key]}`)
-        .join("\n");
-    const secretKey = (0, node_crypto_1.createHash)("sha256")
-        .update(botToken.trim())
-        .digest();
-    const computed = (0, node_crypto_1.createHmac)("sha256", secretKey)
-        .update(checkString)
-        .digest("hex");
-    const matches = computed.length === receivedHash.length &&
-        (0, node_crypto_1.timingSafeEqual)(Buffer.from(computed, "utf8"), Buffer.from(receivedHash, "utf8"));
-    return {
-        checkString,
-        computedHash: computed,
-        providedHash: receivedHash,
-        matches,
-    };
 }
 function validateTelegramWebAppInitData(rawInitData, unsafeInitData, botToken, maxAgeSeconds) {
     const normalizedRaw = rawInitData
         ? normalizeTelegramWebAppInitData(rawInitData)
         : "";
-    const normalizedUnsafe = unsafeInitData ?? null;
-    if (!normalizedRaw && !normalizedUnsafe) {
+    if (!normalizedRaw) {
         throw new Error("Telegram WebApp initData is empty.");
     }
-    const officialRawValidation = buildOfficialRawValidation(normalizedRaw, botToken);
-    const userFieldsValidation = buildUserFieldsValidation(normalizedUnsafe, botToken);
-    if (!officialRawValidation?.matches && !userFieldsValidation?.matches) {
-        throw new Error("Telegram WebApp initData hash validation failed.");
-    }
-    if (!normalizedUnsafe) {
-        throw new Error("Telegram WebApp unsafe init data is missing.");
-    }
-    const user = normalizeUnsafeUser(normalizedUnsafe.user);
-    const authDateRaw = typeof normalizedUnsafe.auth_date === "number" ||
-        typeof normalizedUnsafe.auth_date === "string"
-        ? String(normalizedUnsafe.auth_date)
-        : null;
-    if (!authDateRaw || !user) {
-        throw new Error("Telegram WebApp initData is missing auth_date or user.");
+    const signedParams = validateOfficialRawHash(normalizedRaw, botToken);
+    const user = parseSignedUser(readSignedParam(signedParams, "user", true));
+    const authDateRaw = readSignedParam(signedParams, "auth_date", true);
+    if (!/^\d+$/.test(authDateRaw)) {
+        throw new Error("Telegram WebApp auth_date is invalid.");
     }
-    const authDate = Number.parseInt(authDateRaw, 10);
-    if (!Number.isFinite(authDate) || authDate <= 0) {
+    const authDate = Number(authDateRaw);
+    if (!Number.isSafeInteger(authDate) || authDate <= 0) {
         throw new Error("Telegram WebApp auth_date is invalid.");
     }
+    const queryId = readSignedParam(signedParams, "query_id", false);
+    const startParam = readSignedParam(signedParams, "start_param", false);
+    if (unsafeInitData) {
+        assertUnsafeDataMatchesSigned(unsafeInitData, {
+            user,
+            authDate,
+            ...(queryId !== undefined ? { queryId } : {}),
+            ...(startParam !== undefined ? { startParam } : {}),
+            hash: readSignedParam(signedParams, "hash", true),
+        });
+    }
     const nowSeconds = Math.floor(Date.now() / 1000);
     if (nowSeconds - authDate > maxAgeSeconds) {
         throw new Error("Telegram WebApp initData is expired.");
@@ -243,28 +261,7 @@ function validateTelegramWebAppInitData(rawInitData, unsafeInitData, botToken, m
         user,
         authDate,
         rawInitData: normalizedRaw,
-        ...(typeof normalizedUnsafe.query_id === "string"
-            ? { queryId: normalizedUnsafe.query_id }
-            : {}),
-        ...(typeof normalizedUnsafe.start_param === "string"
-            ? { startParam: normalizedUnsafe.start_param }
-            : {}),
-        validationDebug: {
-            providedHash: officialRawValidation?.providedHash ??
-                userFieldsValidation?.providedHash ??
-                "",
-            officialRaw: {
-                checkString: officialRawValidation?.checkString ?? "",
-                computedHash: officialRawValidation?.computedHash ?? "",
-                matches: officialRawValidation?.matches ?? false,
-            },
-            userFields: userFieldsValidation
-                ? {
-                    checkString: userFieldsValidation.checkString,
-                    computedHash: userFieldsValidation.computedHash,
-                    matches: userFieldsValidation.matches,
-                }
-                : null,
-        },
+        ...(queryId !== undefined ? { queryId } : {}),
+        ...(startParam !== undefined ? { startParam } : {}),
     };
 }

package/dist/services/features/telegram-mcp/src/entities/request/model/schema.js

@@ -33,9 +33,11 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sendPartnerFileInputSchema = exports.sendPartnerNoteInputSchema = exports.browserCloseOutputSchema = exports.browserCloseInputSchema = exports.browserScreenshotOutputSchema = exports.browserScreenshotInputSchema = exports.browserComputedStyleOutputSchema = exports.browserComputedStyleInputSchema = exports.browserDomOutputSchema = exports.browserDomInputSchema = exports.browserClearLogsOutputSchema = exports.browserClearLogsInputSchema = exports.browserNetworkFailuresOutputSchema = exports.browserNetworkFailuresInputSchema = exports.browserErrorsOutputSchema = exports.browserErrorsInputSchema = exports.browserConsoleOutputSchema = exports.browserConsoleInputSchema = exports.browserWaitForUrlOutputSchema = exports.browserWaitForUrlInputSchema = exports.browserWaitForOutputSchema = exports.browserWaitForInputSchema = exports.browserPressOutputSchema = exports.browserPressInputSchema = exports.browserFillOutputSchema = exports.browserFillInputSchema = exports.browserClickOutputSchema = exports.browserClickInputSchema = exports.browserReloadOutputSchema = exports.browserReloadInputSchema = exports.browserOpenOutputSchema = exports.browserOpenInputSchema = exports.clearSessionContextOutputSchema = exports.clearSessionContextInputSchema = exports.getSessionContextOutputSchema = exports.getSessionContextInputSchema = exports.setSessionContextOutputSchema = exports.renameSessionOutputSchema = exports.renameSessionInputSchema = exports.setSessionContextInputSchema = exports.refreshToolsMarkdownOutputSchema = exports.refreshToolsMarkdownInputSchema = exports.listGatewaySessionsOutputSchema = exports.listGatewaySessionsInputSchema = exports.sendFileToTelegramOutputSchema = exports.sendFileToTelegramInputSchema = exports.notifyTelegramOutputSchema = exports.notifyTelegramInputSchema = exports.askUserTelegramOutputSchema = exports.askUserTelegramInputSchema = void 0;
-exports.markXchangeRecordReadOutputSchema = exports.markXchangeRecordReadInputSchema = exports.getXchangeRecordOutputSchema = exports.getXchangeRecordInputSchema = exports.listXchangeRecordsOutputSchema = exports.listXchangeRecordsInputSchema = exports.sendPartnerNoteOutputSchema = void 0;
+exports.browserWaitForInputSchema = exports.browserInjectScriptOutputSchema = exports.browserInjectScriptInputSchema = exports.browserPressOutputSchema = exports.browserPressInputSchema = exports.browserFillOutputSchema = exports.browserFillInputSchema = exports.browserClickOutputSchema = exports.browserClickInputSchema = exports.browserReloadOutputSchema = exports.browserReloadInputSchema = exports.browserRecordingStatusOutputSchema = exports.browserRecordingStatusInputSchema = exports.browserRecordingStopOutputSchema = exports.browserRecordingStopInputSchema = exports.browserRecordingStartOutputSchema = exports.browserRecordingStartInputSchema = exports.browserDetachTabOutputSchema = exports.browserDetachTabInputSchema = exports.browserAttachTabOutputSchema = exports.browserAttachTabInputSchema = exports.browserAttachActiveTabInputSchema = exports.browserListTabsOutputSchema = exports.browserListTabsInputSchema = exports.browserListAttachedInstancesOutputSchema = exports.browserListAttachedInstancesInputSchema = exports.browserOpenOutputSchema = exports.browserOpenInputSchema = exports.clearSessionContextOutputSchema = exports.clearSessionContextInputSchema = exports.getSessionContextOutputSchema = exports.getSessionContextInputSchema = exports.setSessionContextOutputSchema = exports.renameSessionOutputSchema = exports.renameSessionInputSchema = exports.setSessionContextInputSchema = exports.refreshToolsMarkdownOutputSchema = exports.refreshToolsMarkdownInputSchema = exports.listGatewaySessionsOutputSchema = exports.listGatewaySessionsInputSchema = exports.getFileListOutputSchema = exports.getFileListInputSchema = exports.getFileOutputSchema = exports.getFileInputSchema = exports.sendFileToTelegramOutputSchema = exports.sendFileToTelegramInputSchema = exports.notifyTelegramOutputSchema = exports.notifyTelegramInputSchema = exports.askUserTelegramOutputSchema = exports.askUserTelegramInputSchema = void 0;
+exports.markXchangeRecordReadOutputSchema = exports.markXchangeRecordReadInputSchema = exports.getXchangeRecordOutputSchema = exports.getXchangeRecordInputSchema = exports.listXchangeRecordsOutputSchema = exports.listXchangeRecordsInputSchema = exports.sendPartnerNoteOutputSchema = exports.sendPartnerFileInputSchema = exports.sendPartnerNoteInputSchema = exports.browserCloseOutputSchema = exports.browserCloseInputSchema = exports.browserScreenshotOutputSchema = exports.browserScreenshotInputSchema = exports.browserComputedStyleOutputSchema = exports.browserComputedStyleInputSchema = exports.browserDomOutputSchema = exports.browserDomInputSchema = exports.browserClearLogsOutputSchema = exports.browserClearLogsInputSchema = exports.browserNetworkFailuresOutputSchema = exports.browserNetworkFailuresInputSchema = exports.browserErrorsOutputSchema = exports.browserErrorsInputSchema = exports.browserConsoleOutputSchema = exports.browserConsoleInputSchema = exports.browserWaitForUrlOutputSchema = exports.browserWaitForUrlInputSchema = exports.browserWaitForOutputSchema = void 0;
 const z = __importStar(require("zod/v4"));
+const bodyLimits_1 = require("../../../shared/lib/bodyLimits");
+const bodyStringSchema = z.string().max(bodyLimits_1.MAX_BODY_SIZE_BYTES);
 const partnerNoteKindSchema = z.enum([
     "share",
     "question",
@@ -87,6 +89,45 @@ exports.sendFileToTelegramOutputSchema = z.object({
     sent: z.boolean(),
     message_id: z.number().int().positive().optional(),
 });
+exports.getFileInputSchema = z
+    .object({
+    session_id: z.string().trim().min(1).optional(),
+    file_path: z.string().trim().min(1).optional(),
+    selector: z.enum(["latest_screenshot"]).optional(),
+    type: z.enum(["url", "image", "text", "base64"]).optional(),
+})
+    .refine((input) => Boolean(input.file_path) !== Boolean(input.selector), {
+    message: "Provide exactly one of file_path or selector.",
+});
+exports.getFileOutputSchema = z.object({
+    type: z.enum(["url", "image", "text", "base64"]),
+    data: bodyStringSchema,
+    mimetype: z.string().trim().min(1),
+    filename: z.string().trim().min(1),
+    size_bytes: z.number().int().nonnegative(),
+    expires_at: z.string().trim().min(1).optional(),
+});
+const getFileListSourceSchema = z.enum([
+    "telegram-upload",
+    "browser-screenshot",
+    "partner-artifact",
+]);
+exports.getFileListInputSchema = z.object({
+    session_id: z.string().trim().min(1).optional(),
+    source: getFileListSourceSchema.optional(),
+    limit: z.number().int().positive().max(200).optional(),
+});
+exports.getFileListOutputSchema = z.object({
+    total: z.number().int().nonnegative(),
+    files: z.array(z.object({
+        file_path: z.string().trim().min(1),
+        filename: z.string().trim().min(1),
+        mimetype: z.string().trim().min(1),
+        source: getFileListSourceSchema,
+        size_bytes: z.number().int().nonnegative().optional(),
+        created_at: z.string().trim().min(1),
+    })),
+});
 exports.listGatewaySessionsInputSchema = z.object({
     client_uuid: z.string().trim().min(1).optional(),
     connected_only: z.boolean().optional(),
@@ -210,6 +251,131 @@ exports.browserOpenOutputSchema = z.object({
     viewport_width: z.number().int().positive().optional(),
     viewport_height: z.number().int().positive().optional(),
 });
+exports.browserListAttachedInstancesInputSchema = z.object({
+    session_id: z.string().trim().min(1).optional(),
+});
+exports.browserListAttachedInstancesOutputSchema = z.object({
+    session_id: z.string().trim().min(1).optional(),
+    total: z.number().int().nonnegative(),
+    instances: z.array(z.object({
+        instance_id: z.string().trim().min(1),
+        browser: z.enum(["firefox", "chrome"]),
+        extension_version: z.string().trim().min(1),
+        profile_name: z.string().trim().min(1).optional(),
+        connected_at: z.string().trim().min(1),
+        last_seen_at: z.string().trim().min(1),
+        capabilities: z.array(z.string().trim().min(1)),
+        tab_count: z.number().int().nonnegative(),
+        active_tab: z
+            .object({
+            tab_id: z.number().int().nonnegative(),
+            window_id: z.number().int().nonnegative().optional(),
+            active: z.boolean(),
+            title: z.string(),
+            url: z.string(),
+            status: z.string().optional(),
+        })
+            .optional(),
+    })),
+});
+exports.browserListTabsInputSchema = z.object({
+    session_id: z.string().trim().min(1).optional(),
+    instance_id: z.string().trim().min(1).optional(),
+});
+exports.browserListTabsOutputSchema = z.object({
+    session_id: z.string().trim().min(1).optional(),
+    instance_id: z.string().trim().min(1),
+    total: z.number().int().nonnegative(),
+    tabs: z.array(z.object({
+        tab_id: z.number().int().nonnegative(),
+        window_id: z.number().int().nonnegative().optional(),
+        active: z.boolean(),
+        selected: z.boolean().optional(),
+        title: z.string(),
+        url: z.string(),
+        status: z.string().optional(),
+    })),
+});
+exports.browserAttachActiveTabInputSchema = z.object({
+    session_id: z.string().trim().min(1).optional(),
+    instance_id: z.string().trim().min(1).optional(),
+});
+exports.browserAttachTabInputSchema = z.object({
+    session_id: z.string().trim().min(1).optional(),
+    instance_id: z.string().trim().min(1).optional(),
+    tab_id: z.number().int().nonnegative(),
+});
+exports.browserAttachTabOutputSchema = z.object({
+    session_id: z.string().trim().min(1),
+    backend: z.literal("firefox-attached"),
+    instance_id: z.string().trim().min(1),
+    tab_id: z.number().int().nonnegative(),
+    attached_at: z.string().trim().min(1),
+    title: z.string().optional(),
+    url: z.string().optional(),
+});
+exports.browserDetachTabInputSchema = z.object({
+    session_id: z.string().trim().min(1).optional(),
+});
+exports.browserDetachTabOutputSchema = z.object({
+    session_id: z.string().trim().min(1),
+    detached: z.boolean(),
+});
+exports.browserRecordingStartInputSchema = z.object({
+    session_id: z.string().trim().min(1).optional(),
+    instance_id: z.string().trim().min(1).optional(),
+});
+exports.browserRecordingStartOutputSchema = z.object({
+    session_id: z.string().trim().min(1),
+    backend: z.literal("firefox-attached"),
+    started: z.boolean(),
+    recording_id: z.string().trim().min(1),
+    instance_id: z.string().trim().min(1),
+    tab_id: z.number().int().nonnegative(),
+    tab_title: z.string().optional(),
+    tab_url: z.string().optional(),
+    bundle_dir_name: z.string().trim().min(1),
+    bundle_relative_path: z.string().trim().min(1),
+    bundle_path: z.string().trim().min(1),
+    started_at: z.string().trim().min(1),
+});
+exports.browserRecordingStopInputSchema = z.object({
+    session_id: z.string().trim().min(1).optional(),
+});
+exports.browserRecordingStopOutputSchema = z.object({
+    session_id: z.string().trim().min(1),
+    stopped: z.boolean(),
+    recording_id: z.string().trim().min(1).optional(),
+    bundle_dir_name: z.string().trim().min(1).optional(),
+    bundle_relative_path: z.string().trim().min(1).optional(),
+    bundle_path: z.string().trim().min(1).optional(),
+    stopped_at: z.string().trim().min(1).optional(),
+});
+exports.browserRecordingStatusInputSchema = z.object({
+    session_id: z.string().trim().min(1).optional(),
+});
+exports.browserRecordingStatusOutputSchema = z.object({
+    session_id: z.string().trim().min(1),
+    active: z.boolean(),
+    recording: z
+        .object({
+        backend: z.literal("firefox-attached"),
+        recording_id: z.string().trim().min(1),
+        instance_id: z.string().trim().min(1),
+        tab_id: z.number().int().nonnegative(),
+        tab_title: z.string().optional(),
+        tab_url: z.string().optional(),
+        bundle_dir_name: z.string().trim().min(1),
+        bundle_relative_path: z.string().trim().min(1),
+        bundle_path: z.string().trim().min(1),
+        started_at: z.string().trim().min(1),
+        stopped_at: z.string().trim().min(1).optional(),
+        status: z.enum(["recording", "stopped"]),
+        event_count: z.number().int().nonnegative(),
+        last_event_at: z.string().trim().min(1).optional(),
+    })
+        .optional(),
+});
 exports.browserReloadInputSchema = z.object({
     session_id: z.string().trim().min(1).optional(),
     wait_until: z
@@ -219,7 +385,7 @@ exports.browserReloadInputSchema = z.object({
 exports.browserReloadOutputSchema = z.object({
     session_id: z.string(),
     reloaded: z.boolean(),
-    url: z.string().url(),
+    url: z.string(),
     title: z.string().optional(),
 });
 const browserLocatorInputShape = {
@@ -242,7 +408,7 @@ exports.browserClickOutputSchema = z.object({
     ai_tag: z.string().optional(),
     selector: z.string().optional(),
     text: z.string().optional(),
-    url: z.string().url(),
+    url: z.string(),
     title: z.string().optional(),
 });
 exports.browserFillInputSchema = z
@@ -261,7 +427,7 @@ exports.browserFillOutputSchema = z.object({
     selector: z.string().optional(),
     text: z.string().optional(),
     value_length: z.number().int().nonnegative(),
-    url: z.string().url(),
+    url: z.string(),
     title: z.string().optional(),
 });
 exports.browserPressInputSchema = z.object({
@@ -275,7 +441,27 @@ exports.browserPressOutputSchema = z.object({
     ai_tag: z.string().optional(),
     selector: z.string().optional(),
     text: z.string().optional(),
-    url: z.string().url(),
+    url: z.string(),
+    title: z.string().optional(),
+});
+exports.browserInjectScriptInputSchema = z
+    .object({
+    session_id: z.string().trim().min(1).optional(),
+    source: z.string().optional(),
+    file_path: z.string().trim().min(1).optional(),
+    namespace: z.string().trim().min(1).optional(),
+})
+    .refine((input) => Boolean(input.source?.trim() || input.file_path?.trim()), {
+    message: "Provide source or file_path.",
+    path: ["source"],
+});
+exports.browserInjectScriptOutputSchema = z.object({
+    session_id: z.string(),
+    injected: z.boolean(),
+    namespace: z.string(),
+    source_type: z.enum(["inline", "file"]),
+    bytes: z.number().int().nonnegative(),
+    url: z.string(),
     title: z.string().optional(),
 });
 exports.browserWaitForInputSchema = z
@@ -294,7 +480,7 @@ exports.browserWaitForOutputSchema = z.object({
     ai_tag: z.string().optional(),
     selector: z.string().optional(),
     text: z.string().optional(),
-    url: z.string().url(),
+    url: z.string(),
     title: z.string().optional(),
 });
 exports.browserWaitForUrlInputSchema = z
@@ -314,7 +500,7 @@ exports.browserWaitForUrlOutputSchema = z.object({
     matched: z.enum(["url", "url_contains"]),
     url: z.string().optional(),
     url_contains: z.string().optional(),
-    current_url: z.string().url(),
+    current_url: z.string(),
     title: z.string().optional(),
 });
 exports.browserConsoleInputSchema = z.object({
@@ -352,7 +538,7 @@ exports.browserNetworkFailuresOutputSchema = z.object({
     session_id: z.string(),
     total: z.number().int().nonnegative(),
     failures: z.array(z.object({
-        url: z.string().url(),
+        url: z.string(),
         method: z.string(),
         status: z.number().int().optional(),
         error_text: z.string().optional(),
@@ -440,9 +626,9 @@ exports.sendPartnerNoteInputSchema = z.object({
     target_local_session_id: z.string().trim().min(1).optional(),
     project_uuid: z.string().trim().min(1).optional(),
     kind: partnerNoteKindSchema,
-    summary: z.string().trim().min(1),
-    message: z.string().trim().min(1),
-    expected_reply: z.string().trim().min(1).optional(),
+    summary: bodyStringSchema.trim().min(1),
+    message: bodyStringSchema.trim().min(1),
+    expected_reply: bodyStringSchema.trim().min(1).optional(),
     requires_reply: z.boolean().optional(),
     in_reply_to: z.string().trim().min(1).optional(),
     artifacts: z.array(z.string().trim().min(1)).optional(),
@@ -454,7 +640,7 @@ exports.sendPartnerNoteInputSchema = z.object({
         mime_type: z.string().trim().min(1).optional(),
         size_bytes: z.number().int().nonnegative().optional(),
         storage_ref: z.string().trim().min(1).optional(),
-        content_base64: z.string().trim().min(1).optional(),
+        content_base64: bodyStringSchema.trim().min(1).optional(),
     }))
         .optional(),
 });
@@ -467,9 +653,9 @@ exports.sendPartnerFileInputSchema = z.object({
     cwd: z.string().trim().min(1).optional(),
     file_path: z.string().trim().min(1),
     kind: partnerNoteKindSchema.optional(),
-    summary: z.string().trim().min(1).optional(),
-    message: z.string().trim().min(1).optional(),
-    expected_reply: z.string().trim().min(1).optional(),
+    summary: bodyStringSchema.trim().min(1).optional(),
+    message: bodyStringSchema.trim().min(1).optional(),
+    expected_reply: bodyStringSchema.trim().min(1).optional(),
     requires_reply: z.boolean().optional(),
     in_reply_to: z.string().trim().min(1).optional(),
 });
@@ -533,7 +719,9 @@ const xchangeRecordSchema = z.object({
 exports.listXchangeRecordsInputSchema = z.object({
     session_id: z.string().trim().min(1).optional(),
     status: z.enum(["new", "read", "archived"]).optional(),
-    category: z.enum(["partner_note", "local_handoff", "telegram_message"]).optional(),
+    category: z
+        .enum(["partner_note", "local_handoff", "telegram_message"])
+        .optional(),
     direction: z.enum(["incoming", "outgoing", "local"]).optional(),
     limit: z.number().int().positive().max(200).optional(),
 });

package/dist/services/features/telegram-mcp/src/features/browser/model/browserAttachActiveTabTool.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BrowserAttachActiveTabTool = void 0;
+const schema_1 = require("../../../entities/request/model/schema");
+function createContent(output) {
+    return [{ type: "text", text: JSON.stringify(output, null, 2) }];
+}
+class BrowserAttachActiveTabTool {
+    browserService;
+    constructor(browserService) {
+        this.browserService = browserService;
+    }
+    register(server) {
+        server.registerTool("browser_attach_active_tab", {
+            title: "Browser Attach Active Tab",
+            description: "Attach the current MCP session to the active tab of a connected attached browser instance. If only one instance is connected, instance_id can be omitted.",
+            inputSchema: schema_1.browserAttachActiveTabInputSchema,
+            outputSchema: schema_1.browserAttachTabOutputSchema,
+        }, async (args) => {
+            const output = await this.browserService.attachActiveTab(args);
+            return {
+                content: createContent(output),
+                structuredContent: output,
+            };
+        });
+    }
+}
+exports.BrowserAttachActiveTabTool = BrowserAttachActiveTabTool;

package/dist/services/features/telegram-mcp/src/features/browser/model/browserAttachTabTool.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BrowserAttachTabTool = void 0;
+const schema_1 = require("../../../entities/request/model/schema");
+function createContent(output) {
+    return [{ type: "text", text: JSON.stringify(output, null, 2) }];
+}
+class BrowserAttachTabTool {
+    browserService;
+    constructor(browserService) {
+        this.browserService = browserService;
+    }
+    register(server) {
+        server.registerTool("browser_attach_tab", {
+            title: "Browser Attach Tab",
+            description: "Attach the current MCP session to a specific tab in a connected attached browser instance by tab_id.",
+            inputSchema: schema_1.browserAttachTabInputSchema,
+            outputSchema: schema_1.browserAttachTabOutputSchema,
+        }, async (args) => {
+            const output = await this.browserService.attachTab(args);
+            return {
+                content: createContent(output),
+                structuredContent: output,
+            };
+        });
+    }
+}
+exports.BrowserAttachTabTool = BrowserAttachTabTool;

package/dist/services/features/telegram-mcp/src/features/browser/model/browserClickTool.js

@@ -13,7 +13,7 @@ class BrowserClickTool {
     register(server) {
         server.registerTool("browser_click", {
             title: "Browser Click",
-            description: "Click an element in the session browser page by CSS selector or visible text.",
+            description: "Click an element in the current session browser target by CSS selector or visible text. If the session has a selected attached Firefox tab, click there; otherwise use the isolated Playwright page.",
             inputSchema: schema_1.browserClickInputSchema,
             outputSchema: schema_1.browserClickOutputSchema,
         }, async (args) => {

package/dist/services/features/telegram-mcp/src/features/browser/model/browserDetachTabTool.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BrowserDetachTabTool = void 0;
+const schema_1 = require("../../../entities/request/model/schema");
+function createContent(output) {
+    return [{ type: "text", text: JSON.stringify(output, null, 2) }];
+}
+class BrowserDetachTabTool {
+    browserService;
+    constructor(browserService) {
+        this.browserService = browserService;
+    }
+    register(server) {
+        server.registerTool("browser_detach_tab", {
+            title: "Browser Detach Tab",
+            description: "Detach the current MCP session from the currently selected attached browser tab.",
+            inputSchema: schema_1.browserDetachTabInputSchema,
+            outputSchema: schema_1.browserDetachTabOutputSchema,
+        }, async (args) => {
+            const output = await this.browserService.detachTab(args);
+            return {
+                content: createContent(output),
+                structuredContent: output,
+            };
+        });
+    }
+}
+exports.BrowserDetachTabTool = BrowserDetachTabTool;

package/dist/services/features/telegram-mcp/src/features/browser/model/browserDomTool.js

@@ -13,7 +13,7 @@ class BrowserDomTool {
     register(server) {
         server.registerTool("browser_dom", {
             title: "Browser DOM",
-            description: "Inspect a DOM element in the Playwright tab for the current session and return text, HTML, attributes, and visibility.",
+            description: "Inspect a DOM element in the current session browser target and return text, HTML, attributes, and visibility. If the session has a selected attached Firefox tab, inspect that tab; otherwise use the isolated Playwright page.",
             inputSchema: schema_1.browserDomInputSchema,
             outputSchema: schema_1.browserDomOutputSchema,
         }, async (args) => {