@deadragdoll/tellymcp 0.0.13 → 0.0.14

package/dist/services/features/telegram-mcp/browser.service.js

@@ -33,6 +33,24 @@ const TelegramMcpBrowserService = {
                 return this.getBrowserService().listTabs(ctx.params);
             },
         },
+        attachActiveTabRemote: {
+            params: { $$strict: false },
+            async handler(ctx) {
+                return this.getBrowserService().attachActiveTab(ctx.params);
+            },
+        },
+        attachTabRemote: {
+            params: { $$strict: false },
+            async handler(ctx) {
+                return this.getBrowserService().attachTab(ctx.params);
+            },
+        },
+        detachTabRemote: {
+            params: { $$strict: false },
+            async handler(ctx) {
+                return this.getBrowserService().detachTab(ctx.params);
+            },
+        },
         startRecordingRemote: {
             params: { $$strict: false },
             async handler(ctx) {

package/dist/services/features/telegram-mcp/file-content.service.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TELEGRAM_MCP_FILE_CONTENT_SERVICE_NAME = void 0;
+const runtime_service_1 = require("./runtime.service");
+const remoteConsoleActionClient_1 = require("./src/features/distributed-gateway/model/remoteConsoleActionClient");
+const getFileService_1 = require("./src/features/file-content/model/getFileService");
+exports.TELEGRAM_MCP_FILE_CONTENT_SERVICE_NAME = "telegramMcp.fileContent";
+const TelegramMcpFileContentService = {
+    name: exports.TELEGRAM_MCP_FILE_CONTENT_SERVICE_NAME,
+    dependencies: [runtime_service_1.TELEGRAM_MCP_RUNTIME_SERVICE_NAME],
+    actions: {
+        listFilesRemote: {
+            params: {
+                $$strict: false,
+                session_id: { type: "string", optional: true, trim: true, min: 1 },
+                source: {
+                    type: "enum",
+                    optional: true,
+                    values: ["telegram-upload", "browser-screenshot", "partner-artifact"],
+                },
+                limit: {
+                    type: "number",
+                    optional: true,
+                    integer: true,
+                    positive: true,
+                    max: 200,
+                },
+            },
+            async handler(ctx) {
+                return this.getGetFileService().list(ctx.params);
+            },
+        },
+        getFileRemote: {
+            params: {
+                $$strict: false,
+                session_id: { type: "string", optional: true, trim: true, min: 1 },
+                file_path: { type: "string", optional: true, trim: true, min: 1 },
+                selector: {
+                    type: "enum",
+                    optional: true,
+                    values: ["latest_screenshot"],
+                },
+                type: {
+                    type: "enum",
+                    optional: true,
+                    values: ["text", "base64"],
+                },
+            },
+            async handler(ctx) {
+                return this.getGetFileService().get(ctx.params);
+            },
+        },
+        uploadFileRemote: {
+            params: {
+                $$strict: false,
+                session_id: { type: "string", optional: true, trim: true, min: 1 },
+                file_path: { type: "string", optional: true, trim: true, min: 1 },
+                selector: {
+                    type: "enum",
+                    optional: true,
+                    values: ["latest_screenshot"],
+                },
+                type: { type: "enum", values: ["url"] },
+                upload_url: { type: "string", trim: true, min: 1 },
+            },
+            async handler(ctx) {
+                return this.getGetFileService().upload(ctx.params);
+            },
+        },
+    },
+    created() {
+        this.getFileService = null;
+    },
+    methods: {
+        getGetFileService() {
+            if (!this.getFileService) {
+                throw new Error("telegram_mcp file content service is not initialized yet");
+            }
+            return this.getFileService;
+        },
+    },
+    async started() {
+        await this.broker.waitForServices([runtime_service_1.TELEGRAM_MCP_RUNTIME_SERVICE_NAME]);
+        const runtimeService = this.broker.getLocalService(runtime_service_1.TELEGRAM_MCP_RUNTIME_SERVICE_NAME);
+        if (!runtimeService) {
+            throw new Error(`Local Moleculer service '${runtime_service_1.TELEGRAM_MCP_RUNTIME_SERVICE_NAME}' is unavailable`);
+        }
+        const runtime = await runtimeService.waitUntilReady();
+        this.logger.info("Starting telegram_mcp file content service");
+        this.getFileService = new getFileService_1.GetFileService(runtime.config, runtime.sessionStore, runtime.stateStore, runtime.stateStore, runtime.logger, runtime.projectIdentityResolver, new remoteConsoleActionClient_1.RemoteConsoleActionClient((actionName, params) => this.broker.call(actionName, params, { meta: { internal_call: true } })), runtime.temporaryFileLinkStore);
+        this.logger.info("telegram_mcp file content service is ready");
+    },
+};
+exports.default = TelegramMcpFileContentService;

package/dist/services/features/telegram-mcp/gateway-delivery.service.js

@@ -9,6 +9,7 @@ const runtime_service_1 = require("./runtime.service");
 const xchangeRecordHints_1 = require("./src/shared/lib/xchangeRecordHints");
 const client_1 = require("./src/shared/integrations/terminal/client");
 const sqliteRecordStore_1 = require("./src/shared/integrations/xchange/sqliteRecordStore");
+const bodyLimits_1 = require("./src/shared/lib/bodyLimits");
 exports.TELEGRAM_MCP_GATEWAY_DELIVERY_SERVICE_NAME = "telegramMcp.gatewayDelivery";
 function renderYamlArray(values) {
     if (values.length === 0) {
@@ -319,7 +320,10 @@ const TelegramMcpGatewayDeliveryService = {
                     `shares/files/${delivery.share_id}/${artifact.original_name}`;
                 let localArtifactPath;
                 if (artifact.content_base64) {
-                    localArtifactPath = await (0, client_1.writeXchangeRelativeFile)(runtime.config.terminal, workspaceDir, runtime.config.exchange.dir, relativePath, Buffer.from(artifact.content_base64, "base64"));
+                    (0, bodyLimits_1.assertStringBodySize)(artifact.content_base64);
+                    const decodedContent = Buffer.from(artifact.content_base64, "base64");
+                    (0, bodyLimits_1.assertBodySize)(decodedContent.byteLength);
+                    localArtifactPath = await (0, client_1.writeXchangeRelativeFile)(runtime.config.terminal, workspaceDir, runtime.config.exchange.dir, relativePath, decodedContent);
                 }
                 else {
                     localArtifactPath = await runtime.objectStore.ensureLocalFile({

package/dist/services/features/telegram-mcp/gateway-socket.service.js

@@ -11,6 +11,8 @@ const auth_1 = require("./src/app/webapp/auth");
 const terminal_1 = require("./src/app/webapp/terminal");
 const client_1 = require("./src/shared/integrations/terminal/client");
 const gateway_loopback_1 = require("./gateway-loopback");
+const gatewayAuth_1 = require("./src/shared/lib/gatewayAuth");
+const bodyLimits_1 = require("./src/shared/lib/bodyLimits");
 const versionHandshake_1 = require("./src/shared/lib/version/versionHandshake");
 const wsLib = require("ws");
 const WebSocketServer = wsLib.WebSocketServer;
@@ -226,6 +228,7 @@ const TelegramMcpGatewaySocketService = {
                         "bootstrap_validate",
                         "view",
                         "action",
+                        "resize",
                         "stream_subscribe",
                         "stream_unsubscribe",
                     ],
@@ -941,7 +944,6 @@ const TelegramMcpGatewaySocketService = {
                             session_id: sessionId,
                             session_label: session?.label ?? null,
                             terminal_target: Boolean(session?.terminalTarget),
-                            poll_interval_ms: runtime.config.webapp.pollIntervalMs,
                             telegram_user_id: telegramUserId,
                         },
                     };
@@ -1002,6 +1004,25 @@ const TelegramMcpGatewaySocketService = {
                         },
                     };
                 }
+                if (request.request_type === "resize") {
+                    const cols = typeof request.payload?.cols === "number" ? request.payload.cols : NaN;
+                    const rows = typeof request.payload?.rows === "number" ? request.payload.rows : NaN;
+                    if (!Number.isFinite(cols) || !Number.isFinite(rows)) {
+                        throw new Error("Terminal cols and rows are required");
+                    }
+                    const sessionId = request.local_session_id.trim();
+                    const session = await runtime.sessionStore.getSession(sessionId);
+                    if (!session?.terminalTarget || !(0, client_1.isStreamableTerminalTarget)(session.terminalTarget)) {
+                        throw new Error("Terminal target does not support resize");
+                    }
+                    (0, client_1.resizeForegroundTerminal)(session.terminalTarget, Math.max(20, Math.min(400, Math.round(cols))), Math.max(5, Math.min(200, Math.round(rows))));
+                    return {
+                        type: "live_response",
+                        request_id: request.request_id,
+                        ok: true,
+                        result: { ok: true },
+                    };
+                }
                 if (request.request_type === "stream_subscribe") {
                     const streamId = typeof request.payload?.stream_id === "string"
                         ? request.payload.stream_id.trim()
@@ -1582,7 +1603,9 @@ const TelegramMcpGatewaySocketService = {
                         requestId,
                         actionName,
                         error: formattedError,
-                        payload: parsed.payload ?? {},
+                        payload: actionName === "telegramMcp.fileContent.uploadFileRemote"
+                            ? { ...(parsed.payload ?? {}), upload_url: "[redacted]" }
+                            : (parsed.payload ?? {}),
                     });
                     this.wsClient?.send(JSON.stringify({
                         type: "action_response",
@@ -1956,16 +1979,11 @@ const TelegramMcpGatewaySocketService = {
             }
             const httpServer = await this.waitForHttpServer?.();
             const wsPath = runtime.config.distributed.gatewayWsPath.replace(/\/+$/u, "") || "/";
-            const wsServer = new WebSocketServer({ noServer: true });
+            const wsServer = new WebSocketServer({
+                noServer: true,
+                maxPayload: bodyLimits_1.MAX_BODY_SIZE_BYTES,
+            });
             wsServer.on("connection", (socket, req) => {
-                if (runtime.config.distributed.gatewayAuthToken) {
-                    const authorization = req.headers?.authorization;
-                    if (authorization !==
-                        `Bearer ${runtime.config.distributed.gatewayAuthToken}`) {
-                        socket.close(1008, "Unauthorized");
-                        return;
-                    }
-                }
                 runtime.logger.warn("Gateway WS client connected", {
                     remoteAddress: req.socket.remoteAddress,
                     path: req.url,
@@ -1977,6 +1995,11 @@ const TelegramMcpGatewaySocketService = {
                         });
                     });
                 });
+                socket.on("error", (error) => {
+                    runtime.logger.warn("Gateway WS server socket error", {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                });
                 socket.on("close", () => {
                     const hello = this.connectedClients?.get(socket);
                     if (hello?.connection_id) {
@@ -2026,6 +2049,14 @@ const TelegramMcpGatewaySocketService = {
                 if (requestPath !== wsPath) {
                     return;
                 }
+                if (!(0, gatewayAuth_1.isGatewayAuthorizationValid)(req.headers.authorization, runtime.config.distributed.gatewayAuthToken)) {
+                    socket.write("HTTP/1.1 401 Unauthorized\r\n" +
+                        "Connection: close\r\n" +
+                        "Content-Length: 0\r\n" +
+                        "\r\n");
+                    socket.destroy();
+                    return;
+                }
                 wsServer.handleUpgrade(req, socket, head, (clientSocket) => {
                     wsServer.emit("connection", clientSocket, req);
                 });
@@ -2082,6 +2113,7 @@ const TelegramMcpGatewaySocketService = {
             const normalizedUrl = normalizeWebSocketUrl(wsUrl, runtime.config.distributed.gatewayWsPath);
             this.wsConnectionId = (0, node_crypto_1.randomUUID)();
             const socket = new wsLib.WebSocket(normalizedUrl, {
+                maxPayload: bodyLimits_1.MAX_BODY_SIZE_BYTES,
                 headers: runtime.config.distributed.gatewayAuthToken
                     ? {
                         authorization: `Bearer ${runtime.config.distributed.gatewayAuthToken}`,

package/dist/services/features/telegram-mcp/mcp-http.service.js

@@ -69,6 +69,7 @@ const TelegramMcpHttpService = {
             path: runtime.config.mcp.httpPath,
             webappBasePath: runtime.config.webapp.basePath,
             bearerAuthEnabled: Boolean(runtime.config.mcp.bearerToken),
+            oauthConnectorEnabled: Boolean(runtime.config.oauth),
         });
     },
     async stopped() {

package/dist/services/features/telegram-mcp/mcp-server.service.js

@@ -5,16 +5,20 @@ const server_1 = require("./src/app/providers/mcp/server");
 const approval_service_1 = require("./approval.service");
 const browser_service_1 = require("./browser.service");
 const collaboration_service_1 = require("./collaboration.service");
+const file_content_service_1 = require("./file-content.service");
 const notify_service_1 = require("./notify.service");
 const session_context_service_1 = require("./session-context.service");
 const tools_sync_service_1 = require("./tools-sync.service");
 const xchange_service_1 = require("./xchange.service");
 const askUserTelegram_1 = require("./src/features/ask-user/model/askUserTelegram");
+const browserAttachActiveTabTool_1 = require("./src/features/browser/model/browserAttachActiveTabTool");
+const browserAttachTabTool_1 = require("./src/features/browser/model/browserAttachTabTool");
 const browserClickTool_1 = require("./src/features/browser/model/browserClickTool");
 const browserClearLogsTool_1 = require("./src/features/browser/model/browserClearLogsTool");
 const browserCloseTool_1 = require("./src/features/browser/model/browserCloseTool");
 const browserComputedStyleTool_1 = require("./src/features/browser/model/browserComputedStyleTool");
 const browserConsoleTool_1 = require("./src/features/browser/model/browserConsoleTool");
+const browserDetachTabTool_1 = require("./src/features/browser/model/browserDetachTabTool");
 const browserDomTool_1 = require("./src/features/browser/model/browserDomTool");
 const browserErrorsTool_1 = require("./src/features/browser/model/browserErrorsTool");
 const browserFillTool_1 = require("./src/features/browser/model/browserFillTool");
@@ -34,6 +38,8 @@ const browserWaitForUrlTool_1 = require("./src/features/browser/model/browserWai
 const sendPartnerFileTool_1 = require("./src/features/collaboration/model/sendPartnerFileTool");
 const listGatewaySessionsTool_1 = require("./src/features/collaboration/model/listGatewaySessionsTool");
 const sendPartnerNoteTool_1 = require("./src/features/collaboration/model/sendPartnerNoteTool");
+const getFileTool_1 = require("./src/features/file-content/model/getFileTool");
+const getFileListTool_1 = require("./src/features/file-content/model/getFileListTool");
 const sendFileToTelegramTool_1 = require("./src/features/notify/model/sendFileToTelegramTool");
 const notifyTelegramTool_1 = require("./src/features/notify/model/notifyTelegramTool");
 const clearSessionContextTool_1 = require("./src/features/session-context/model/clearSessionContextTool");
@@ -53,6 +59,7 @@ const TelegramMcpMcpServerService = {
         approval_service_1.TELEGRAM_MCP_APPROVAL_SERVICE_NAME,
         browser_service_1.TELEGRAM_MCP_BROWSER_SERVICE_NAME,
         collaboration_service_1.TELEGRAM_MCP_COLLABORATION_SERVICE_NAME,
+        file_content_service_1.TELEGRAM_MCP_FILE_CONTENT_SERVICE_NAME,
         tools_sync_service_1.TELEGRAM_MCP_TOOLS_SYNC_SERVICE_NAME,
         xchange_service_1.TELEGRAM_MCP_XCHANGE_SERVICE_NAME,
     ],
@@ -63,6 +70,7 @@ const TelegramMcpMcpServerService = {
             const approvalService = this.broker.getLocalService(approval_service_1.TELEGRAM_MCP_APPROVAL_SERVICE_NAME);
             const browserService = this.broker.getLocalService(browser_service_1.TELEGRAM_MCP_BROWSER_SERVICE_NAME);
             const collaborationService = this.broker.getLocalService(collaboration_service_1.TELEGRAM_MCP_COLLABORATION_SERVICE_NAME);
+            const fileContentService = this.broker.getLocalService(file_content_service_1.TELEGRAM_MCP_FILE_CONTENT_SERVICE_NAME);
             const toolsSyncService = this.broker.getLocalService(tools_sync_service_1.TELEGRAM_MCP_TOOLS_SYNC_SERVICE_NAME);
             const xchangeService = this.broker.getLocalService(xchange_service_1.TELEGRAM_MCP_XCHANGE_SERVICE_NAME);
             if (!sessionContextService ||
@@ -70,6 +78,7 @@ const TelegramMcpMcpServerService = {
                 !approvalService ||
                 !browserService ||
                 !collaborationService ||
+                !fileContentService ||
                 !toolsSyncService ||
                 !xchangeService) {
                 throw new Error("telegram_mcp MCP server dependencies are not ready");
@@ -84,6 +93,9 @@ const TelegramMcpMcpServerService = {
                 new askUserTelegram_1.AskUserTelegramTool(approvalService.getApprovalOrchestrator()),
                 new browserListAttachedInstancesTool_1.BrowserListAttachedInstancesTool(browserService.getBrowserService()),
                 new browserListTabsTool_1.BrowserListTabsTool(browserService.getBrowserService()),
+                new browserAttachActiveTabTool_1.BrowserAttachActiveTabTool(browserService.getBrowserService()),
+                new browserAttachTabTool_1.BrowserAttachTabTool(browserService.getBrowserService()),
+                new browserDetachTabTool_1.BrowserDetachTabTool(browserService.getBrowserService()),
                 new browserRecordingStartTool_1.BrowserRecordingStartTool(browserService.getBrowserService()),
                 new browserRecordingStopTool_1.BrowserRecordingStopTool(browserService.getBrowserService()),
                 new browserRecordingStatusTool_1.BrowserRecordingStatusTool(browserService.getBrowserService()),
@@ -106,11 +118,16 @@ const TelegramMcpMcpServerService = {
                 new sendPartnerNoteTool_1.SendPartnerNoteTool(collaborationService.getCollaborationService()),
                 new listGatewaySessionsTool_1.ListGatewaySessionsTool(collaborationService.getGatewaySessionsService()),
                 new sendPartnerFileTool_1.SendPartnerFileTool(collaborationService.getSendPartnerFileService()),
+                new getFileTool_1.GetFileTool(fileContentService.getGetFileService()),
+                new getFileListTool_1.GetFileListTool(fileContentService.getGetFileService()),
                 new listXchangeRecordsTool_1.ListXchangeRecordsTool(xchangeService.getXchangeService()),
                 new getXchangeRecordTool_1.GetXchangeRecordTool(xchangeService.getXchangeService()),
                 new markXchangeRecordReadTool_1.MarkXchangeRecordReadTool(xchangeService.getXchangeService()),
                 new refreshToolsMarkdownTool_1.RefreshToolsMarkdownTool(toolsSyncService.getRefreshToolsMarkdownService()),
             ];
+            this.logger.info("telegram_mcp MCP server instance created", {
+                toolCount: tools.length,
+            });
             return (0, server_1.createMcpServer)(tools);
         },
     },
@@ -121,6 +138,7 @@ const TelegramMcpMcpServerService = {
             approval_service_1.TELEGRAM_MCP_APPROVAL_SERVICE_NAME,
             browser_service_1.TELEGRAM_MCP_BROWSER_SERVICE_NAME,
             collaboration_service_1.TELEGRAM_MCP_COLLABORATION_SERVICE_NAME,
+            file_content_service_1.TELEGRAM_MCP_FILE_CONTENT_SERVICE_NAME,
             tools_sync_service_1.TELEGRAM_MCP_TOOLS_SYNC_SERVICE_NAME,
             xchange_service_1.TELEGRAM_MCP_XCHANGE_SERVICE_NAME,
         ]);

package/dist/services/features/telegram-mcp/src/app/bootstrap/runtime.js

@@ -13,6 +13,7 @@ const minioExchangeStore_1 = require("../../shared/integrations/object-storage/m
 const gatewayHttpService_1 = require("../../features/distributed-gateway/model/gatewayHttpService");
 const gatewayClientAccess_1 = require("../../features/distributed-client/model/gatewayClientAccess");
 const firefoxAttachServer_1 = require("../../features/browser-attach/model/firefoxAttachServer");
+const temporaryFileLinkStore_1 = require("../../features/file-content/model/temporaryFileLinkStore");
 const client_2 = require("../../shared/integrations/terminal/client");
 const ptyRegistry_1 = require("../../shared/integrations/terminal/ptyRegistry");
 async function createAppRuntime(input) {
@@ -34,6 +35,7 @@ async function createAppRuntime(input) {
             httpPort: config.mcp.httpPort,
             httpPath: config.mcp.httpPath,
             bearerAuthEnabled: Boolean(config.mcp.bearerToken),
+            oauthConnectorEnabled: Boolean(config.oauth),
             enableDebugRoutes: config.mcp.enableDebugRoutes,
             enablePruneRoute: config.mcp.enablePruneRoute,
         },
@@ -56,7 +58,6 @@ async function createAppRuntime(input) {
             initDataTtlSeconds: config.webapp.initDataTtlSeconds,
             sessionTtlSeconds: config.webapp.sessionTtlSeconds,
             launchMode: config.webapp.launchMode,
-            pollIntervalMs: config.webapp.pollIntervalMs,
             actionCooldownMs: config.webapp.actionCooldownMs,
         },
         terminal: {
@@ -210,6 +211,11 @@ async function createAppRuntime(input) {
     await telegramTransport.sendStartupNotifications();
     logger.info("Startup Telegram notifications completed");
     const gatewayHttpService = new gatewayHttpService_1.GatewayHttpService(config, input.callBroker);
+    const temporaryFileLinkStore = config.distributed.mode !== "client" &&
+        config.distributed.gatewayPublicUrl?.trim()
+        ? new temporaryFileLinkStore_1.TemporaryFileLinkStore(config.distributed.gatewayPublicUrl, logger)
+        : null;
+    await temporaryFileLinkStore?.start();
     const firefoxAttachServer = new firefoxAttachServer_1.FirefoxAttachServer(config, logger, stateStore, stateStore);
     await firefoxAttachServer.start();
     return {
@@ -230,8 +236,10 @@ async function createAppRuntime(input) {
         webAppLaunchRegistry,
         gatewayHttpService,
         firefoxAttachServer,
+        temporaryFileLinkStore,
         shutdown: async () => {
             logger.info("Shutdown started");
+            await temporaryFileLinkStore?.stop();
             await firefoxAttachServer.stop();
             await telegramTransport.stop();
             (0, ptyRegistry_1.stopAllPtyTargets)();

package/dist/services/features/telegram-mcp/src/app/config/env.js

@@ -93,6 +93,22 @@ const envSchema = z.object({
     MCP_HTTP_PORT: z.coerce.number().int().positive().default(8787),
     MCP_HTTP_PATH: z.string().min(1).default("/mcp"),
     MCP_HTTP_BEARER_TOKEN: optionalNonEmptyString,
+    TELLYMCP_PUBLIC_URL: optionalUrlString,
+    TELLYMCP_OAUTH_ISSUER: optionalUrlString,
+    TELLYMCP_OAUTH_AUDIENCE: optionalUrlString,
+    TELLYMCP_MAGIC_TOKEN: optionalNonEmptyString,
+    TELLYMCP_MAGIC_TOKEN_HASH: optionalNonEmptyString,
+    TELLYMCP_OAUTH_CLIENT_ID: optionalNonEmptyString,
+    TELLYMCP_OAUTH_CLIENT_SECRET: optionalNonEmptyString,
+    TELLYMCP_ALLOWED_REDIRECT_URIS: optionalNonEmptyString,
+    TELLYMCP_OAUTH_PRIVATE_KEY_PEM: optionalNonEmptyString,
+    TELLYMCP_AUTH_CODE_TTL_SECONDS: z.coerce
+        .number()
+        .int()
+        .positive()
+        .default(300),
+    TELLYMCP_OAUTH_SCOPES: z.string().min(1).default("tellymcp:read tellymcp:write"),
+    TELLYMCP_OAUTH_KEY_ID: z.string().min(1).default("tellymcp-oauth"),
     MCP_HTTP_ENABLE_DEBUG_ROUTES: z
         .string()
         .optional()
@@ -145,7 +161,6 @@ const envSchema = z.object({
         .enum(["default", "expand", "fullscreen"])
         .default("fullscreen"),
     WEBAPP_VISIBLE_SCREENS: z.coerce.number().int().positive().default(2),
-    WEBAPP_POLL_INTERVAL_MS: z.coerce.number().int().positive().default(2000),
     WEBAPP_ACTION_COOLDOWN_MS: z.coerce.number().int().nonnegative().default(150),
     MCP_XCHANGE_DIR: z.string().min(1).default(".mcp-xchange"),
     TERMINAL_SHELL: z.string().min(1).default(process.env.SHELL || "bash"),
@@ -246,6 +261,16 @@ function loadConfig() {
         !parsed.TELEGRAM_BOT_TOKEN?.trim()) {
         throw new Error("TELEGRAM_BOT_TOKEN is required for gateway and both distributed modes.");
     }
+    const gatewayServerEnabled = parsed.DISTRIBUTED_MODE === "gateway" ||
+        parsed.DISTRIBUTED_MODE === "both";
+    const gatewayClientConfigured = parsed.DISTRIBUTED_MODE === "client" &&
+        Boolean(parsed.GATEWAY_PUBLIC_URL || parsed.GATEWAY_WS_URL);
+    if ((gatewayServerEnabled || gatewayClientConfigured) &&
+        !parsed.GATEWAY_AUTH_TOKEN?.trim()) {
+        throw new Error(gatewayServerEnabled
+            ? "GATEWAY_AUTH_TOKEN is required for gateway and both distributed modes."
+            : "GATEWAY_AUTH_TOKEN is required when a client connects to a gateway.");
+    }
     if (parsed.ADMIN_TOKEN?.trim() && !parsed.TELEGRAM_BOT_TOKEN?.trim()) {
         throw new Error("ADMIN_TOKEN requires TELEGRAM_BOT_TOKEN because admin mode runs through the gateway bot.");
     }
@@ -257,6 +282,69 @@ function loadConfig() {
             throw new Error("TELEGRAM_WEBHOOK_ENABLED=true requires TELEGRAM_WEBHOOK_SECRET.");
         }
     }
+    const oauthConfigured = Boolean(parsed.TELLYMCP_PUBLIC_URL ||
+        parsed.TELLYMCP_OAUTH_ISSUER ||
+        parsed.TELLYMCP_OAUTH_AUDIENCE ||
+        parsed.TELLYMCP_MAGIC_TOKEN ||
+        parsed.TELLYMCP_MAGIC_TOKEN_HASH ||
+        parsed.TELLYMCP_OAUTH_CLIENT_ID ||
+        parsed.TELLYMCP_OAUTH_CLIENT_SECRET ||
+        parsed.TELLYMCP_ALLOWED_REDIRECT_URIS ||
+        parsed.TELLYMCP_OAUTH_PRIVATE_KEY_PEM);
+    if (oauthConfigured && !parsed.TELLYMCP_PUBLIC_URL) {
+        throw new Error("TELLYMCP_PUBLIC_URL is required when OAuth connector settings are configured.");
+    }
+    if (oauthConfigured &&
+        !parsed.TELLYMCP_MAGIC_TOKEN &&
+        !parsed.TELLYMCP_MAGIC_TOKEN_HASH) {
+        throw new Error("TELLYMCP_MAGIC_TOKEN or TELLYMCP_MAGIC_TOKEN_HASH is required when OAuth is configured.");
+    }
+    if (parsed.TELLYMCP_MAGIC_TOKEN && parsed.TELLYMCP_MAGIC_TOKEN_HASH) {
+        throw new Error("Configure only one of TELLYMCP_MAGIC_TOKEN and TELLYMCP_MAGIC_TOKEN_HASH.");
+    }
+    if (parsed.TELLYMCP_MAGIC_TOKEN_HASH &&
+        !/^sha256:[a-f0-9]{64}$/iu.test(parsed.TELLYMCP_MAGIC_TOKEN_HASH)) {
+        throw new Error("TELLYMCP_MAGIC_TOKEN_HASH must use the format sha256:<64 hex characters>.");
+    }
+    if (parsed.TELLYMCP_OAUTH_CLIENT_SECRET && !parsed.TELLYMCP_OAUTH_CLIENT_ID) {
+        throw new Error("TELLYMCP_OAUTH_CLIENT_SECRET requires TELLYMCP_OAUTH_CLIENT_ID.");
+    }
+    for (const [name, value] of [
+        ["TELLYMCP_PUBLIC_URL", parsed.TELLYMCP_PUBLIC_URL],
+        ["TELLYMCP_OAUTH_ISSUER", parsed.TELLYMCP_OAUTH_ISSUER],
+        ["TELLYMCP_OAUTH_AUDIENCE", parsed.TELLYMCP_OAUTH_AUDIENCE],
+    ]) {
+        if (!value) {
+            continue;
+        }
+        const url = new URL(value);
+        if (url.search || url.hash) {
+            throw new Error(`${name} must not contain a query string or fragment.`);
+        }
+    }
+    const oauthScopes = parsed.TELLYMCP_OAUTH_SCOPES
+        .split(/[\s,]+/u)
+        .map((scope) => scope.trim())
+        .filter(Boolean);
+    if (oauthConfigured && oauthScopes.length === 0) {
+        throw new Error("TELLYMCP_OAUTH_SCOPES must contain at least one scope.");
+    }
+    const allowedRedirectUris = parsed.TELLYMCP_ALLOWED_REDIRECT_URIS
+        ? parsed.TELLYMCP_ALLOWED_REDIRECT_URIS.split(",")
+            .map((redirectUri) => redirectUri.trim())
+            .filter(Boolean)
+        : [];
+    for (const redirectUri of allowedRedirectUris) {
+        try {
+            const parsedRedirectUri = new URL(redirectUri);
+            if (parsedRedirectUri.hash) {
+                throw new Error("fragment");
+            }
+        }
+        catch {
+            throw new Error(`TELLYMCP_ALLOWED_REDIRECT_URIS contains an invalid URL: ${redirectUri}`);
+        }
+    }
     const telegramProxy = parsed.PROXY_USE === "http"
         ? parsed.HTTP_PROXY
             ? {
@@ -328,6 +416,36 @@ function loadConfig() {
             enableDebugRoutes: parsed.MCP_HTTP_ENABLE_DEBUG_ROUTES,
             enablePruneRoute: parsed.MCP_HTTP_ENABLE_PRUNE_ROUTE,
         },
+        ...(oauthConfigured && parsed.TELLYMCP_PUBLIC_URL
+            ? {
+                oauth: {
+                    publicUrl: parsed.TELLYMCP_PUBLIC_URL.replace(/\/+$/u, ""),
+                    issuer: (parsed.TELLYMCP_OAUTH_ISSUER ?? parsed.TELLYMCP_PUBLIC_URL).replace(/\/+$/u, ""),
+                    audience: (parsed.TELLYMCP_OAUTH_AUDIENCE ?? parsed.TELLYMCP_PUBLIC_URL).replace(/\/+$/u, ""),
+                    ...(parsed.TELLYMCP_MAGIC_TOKEN
+                        ? { magicToken: parsed.TELLYMCP_MAGIC_TOKEN }
+                        : {}),
+                    ...(parsed.TELLYMCP_MAGIC_TOKEN_HASH
+                        ? { magicTokenHash: parsed.TELLYMCP_MAGIC_TOKEN_HASH }
+                        : {}),
+                    ...(parsed.TELLYMCP_OAUTH_CLIENT_ID
+                        ? { clientId: parsed.TELLYMCP_OAUTH_CLIENT_ID }
+                        : {}),
+                    ...(parsed.TELLYMCP_OAUTH_CLIENT_SECRET
+                        ? { clientSecret: parsed.TELLYMCP_OAUTH_CLIENT_SECRET }
+                        : {}),
+                    allowedRedirectUris,
+                    ...(parsed.TELLYMCP_OAUTH_PRIVATE_KEY_PEM
+                        ? {
+                            privateKeyPem: parsed.TELLYMCP_OAUTH_PRIVATE_KEY_PEM.replace(/\\n/gu, "\n"),
+                        }
+                        : {}),
+                    authCodeTtlSeconds: parsed.TELLYMCP_AUTH_CODE_TTL_SECONDS,
+                    scopes: oauthScopes,
+                    keyId: parsed.TELLYMCP_OAUTH_KEY_ID,
+                },
+            }
+            : {}),
         distributed: {
             mode: parsed.DISTRIBUTED_MODE,
             ...(parsed.GATEWAY_PUBLIC_URL
@@ -386,7 +504,6 @@ function loadConfig() {
             sessionTtlSeconds: parsed.WEBAPP_SESSION_TTL_SECONDS,
             launchMode: parsed.WEBAPP_LAUNCH_MODE,
             visibleScreens: parsed.WEBAPP_VISIBLE_SCREENS,
-            pollIntervalMs: parsed.WEBAPP_POLL_INTERVAL_MS,
             actionCooldownMs: parsed.WEBAPP_ACTION_COOLDOWN_MS,
         },
         exchange: {