@deadragdoll/tellymcp 0.0.13 → 0.0.14

package/dist/services/features/telegram-mcp/src/features/browser-attach/model/browserRecordingBundle.js

@@ -17,8 +17,25 @@ function sanitizeSegment(value) {
         .replace(/-+$/u, "");
     return normalized || "recording";
 }
+function padNumber(value, length = 2) {
+    return String(value).padStart(length, "0");
+}
+function formatLocalTimestamp(date) {
+    return `${date.getFullYear()}-${padNumber(date.getMonth() + 1)}-${padNumber(date.getDate())}T${padNumber(date.getHours())}:${padNumber(date.getMinutes())}:${padNumber(date.getSeconds())}.${padNumber(date.getMilliseconds(), 3)}`;
+}
 function formatTimestampForDir(date) {
-    return date.toISOString().replace(/[:.]/gu, "-");
+    return formatLocalTimestamp(date).replace(/[:.]/gu, "-");
+}
+function normalizeRecordedTimestamp(rawValue) {
+    const trimmed = rawValue?.trim();
+    if (!trimmed) {
+        return formatLocalTimestamp(new Date());
+    }
+    const parsed = new Date(trimmed);
+    if (Number.isNaN(parsed.getTime())) {
+        return formatLocalTimestamp(new Date());
+    }
+    return formatLocalTimestamp(parsed);
 }
 function formatJsonLine(value) {
     return Buffer.from(`${JSON.stringify(value)}\n`, "utf8");
@@ -85,7 +102,7 @@ class BrowserRecordingBundleWriter {
         ]) {
             await (0, client_1.writeXchangeRelativeFile)(this.config.terminal, input.session.cwd, this.config.exchange.dir, `${segment}/.keep`, Buffer.from("", "utf8"));
         }
-        const startedAt = new Date().toISOString();
+        const startedAt = formatLocalTimestamp(new Date());
         const record = {
             sessionId: input.sessionId,
             backend: "firefox-attached",
@@ -150,7 +167,7 @@ class BrowserRecordingBundleWriter {
         return state;
     }
     async appendEvent(state, event) {
-        const at = event.at?.trim() || new Date().toISOString();
+        const at = normalizeRecordedTimestamp(event.at);
         state.record.eventCount += 1;
         state.record.lastEventAt = at;
         let relPath;
@@ -255,6 +272,23 @@ class BrowserRecordingBundleWriter {
         await this.writeSessionJson(state);
         return state;
     }
+    async finalizeExisting(input) {
+        const state = {
+            record: { ...input.record },
+            session: input.session,
+            currentPageId: undefined,
+            currentPageUrl: input.record.tabUrl,
+            pageCounter: 0,
+            snapshotCounter: 0,
+            requestCounter: 0,
+            requestArtifacts: new Map(),
+        };
+        await this.appendEvent(state, {
+            kind: "session_stopped",
+            status: "stopped",
+        });
+        return state.record;
+    }
     async appendJsonLine(state, relativePath, value) {
         await (0, client_1.writeXchangeRelativeFile)(this.config.terminal, state.session.cwd || "", this.config.exchange.dir, relativePath, formatJsonLine(value), { append: true });
     }

package/dist/services/features/telegram-mcp/src/features/browser-attach/model/firefoxAttachRegistry.js

@@ -1,14 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FirefoxAttachRegistry = void 0;
+const localTimestamp_1 = require("../../../shared/lib/time/localTimestamp");
 class FirefoxAttachRegistry {
     instances = new Map();
     setConnected(input) {
-        const now = new Date().toISOString();
+        const now = (0, localTimestamp_1.formatLocalTimestamp)(new Date());
         const existing = this.instances.get(input.instanceId);
         const next = {
             instanceId: input.instanceId,
-            browser: "firefox",
+            browser: input.browser,
             extensionVersion: input.extensionVersion,
             ...(input.profileName ? { profileName: input.profileName } : {}),
             connectedAt: existing?.connectedAt ?? now,
@@ -25,7 +26,7 @@ class FirefoxAttachRegistry {
         if (!existing) {
             return;
         }
-        existing.lastSeenAt = new Date().toISOString();
+        existing.lastSeenAt = (0, localTimestamp_1.formatLocalTimestamp)(new Date());
     }
     setTabs(instanceId, tabs) {
         const existing = this.instances.get(instanceId);
@@ -35,7 +36,7 @@ class FirefoxAttachRegistry {
         existing.tabs = tabs.map((tab) => ({ ...tab }));
         existing.activeTab =
             tabs.find((tab) => tab.active) ?? existing.activeTab ?? null;
-        existing.lastSeenAt = new Date().toISOString();
+        existing.lastSeenAt = (0, localTimestamp_1.formatLocalTimestamp)(new Date());
     }
     setActiveTab(instanceId, tab) {
         const existing = this.instances.get(instanceId);
@@ -43,7 +44,7 @@ class FirefoxAttachRegistry {
             return;
         }
         existing.activeTab = tab ? { ...tab } : null;
-        existing.lastSeenAt = new Date().toISOString();
+        existing.lastSeenAt = (0, localTimestamp_1.formatLocalTimestamp)(new Date());
     }
     updateTab(instanceId, tab) {
         const existing = this.instances.get(instanceId);
@@ -62,7 +63,7 @@ class FirefoxAttachRegistry {
         if (tab.active) {
             existing.activeTab = { ...tab };
         }
-        existing.lastSeenAt = new Date().toISOString();
+        existing.lastSeenAt = (0, localTimestamp_1.formatLocalTimestamp)(new Date());
     }
     remove(instanceId) {
         this.instances.delete(instanceId);

package/dist/services/features/telegram-mcp/src/features/browser-attach/model/firefoxAttachServer.js

@@ -1,16 +1,67 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FirefoxAttachServer = void 0;
 const node_crypto_1 = require("node:crypto");
-const ws_1 = __importDefault(require("ws"));
+const wsModule = __importStar(require("ws"));
+const localTimestamp_1 = require("../../../shared/lib/time/localTimestamp");
+const bodyLimits_1 = require("../../../shared/lib/bodyLimits");
 const browserRecordingBundle_1 = require("./browserRecordingBundle");
 const firefoxAttachRegistry_1 = require("./firefoxAttachRegistry");
-const wsLib = ws_1.default;
+const types_1 = require("./types");
+const wsLib = wsModule;
 const WebSocketServer = wsLib.WebSocketServer;
-const WS_OPEN = wsLib.OPEN;
+const WS_OPEN = wsLib.WebSocket.OPEN;
+const ATTACH_HEARTBEAT_TIMEOUT_MS = 45_000;
+const ATTACH_HEARTBEAT_REAP_INTERVAL_MS = 15_000;
+const ATTACH_RATE_WINDOW_MS = 1_000;
+const ATTACH_RATE_MAX_MESSAGES = 1_000;
+class FirefoxAttachProtocolError extends Error {
+    reason;
+    constructor(reason) {
+        super(reason);
+        this.reason = reason;
+        this.name = "FirefoxAttachProtocolError";
+    }
+}
+const isAllowedAttachOrigin = (origin) => {
+    if (!origin) {
+        return false;
+    }
+    return /^(?:moz|chrome)-extension:\/\/[a-z0-9-]+\/?$/iu.test(origin);
+};
 class FirefoxAttachServer {
     config;
     logger;
@@ -24,6 +75,7 @@ class FirefoxAttachServer {
     pendingTabActions = new Map();
     pendingRecordingControls = new Map();
     activeRecordingsById = new Map();
+    heartbeatReaper = null;
     constructor(config, logger, sessionStore, maintenanceStore) {
         this.config = config;
         this.logger = logger;
@@ -38,22 +90,48 @@ class FirefoxAttachServer {
         if (this.wsServer) {
             return;
         }
-        this.wsServer = new WebSocketServer({
+        const wsServer = new WebSocketServer({
             host: this.config.browser.attach.host,
             port: this.config.browser.attach.port,
             path: this.config.browser.attach.path,
+            maxPayload: bodyLimits_1.MAX_BODY_SIZE_BYTES,
+            verifyClient: (info, done) => {
+                if (!isAllowedAttachOrigin(info.origin)) {
+                    done(false, 403, "Forbidden");
+                    return;
+                }
+                done(true);
+            },
         });
-        this.wsServer.on("connection", (socket) => {
-            const state = { socket };
+        this.wsServer = wsServer;
+        wsServer.on("connection", (socket) => {
+            const now = Date.now();
+            const state = {
+                socket,
+                lastSeenAt: now,
+                rateWindowStartedAt: now,
+                rateWindowMessageCount: 0,
+                protocolFailed: false,
+            };
             this.sockets.add(state);
             socket.on("message", (payload) => {
-                void this.handleMessage(state, payload);
+                void this.handleMessage(state, payload).catch((error) => {
+                    this.handleProtocolError(state, error);
+                });
             });
             socket.on("close", () => {
                 if (state.instanceId) {
-                    void this.handleInstanceDisconnect(state.instanceId);
-                    this.registry.remove(state.instanceId);
-                    this.socketsByInstanceId.delete(state.instanceId);
+                    const current = this.socketsByInstanceId.get(state.instanceId);
+                    if (current === state) {
+                        void this.handleInstanceDisconnect(state.instanceId).catch((error) => {
+                            this.logger.error("Firefox attach disconnect cleanup failed", {
+                                instanceId: state.instanceId,
+                                error: error instanceof Error ? error.message : String(error),
+                            });
+                        });
+                        this.registry.remove(state.instanceId);
+                        this.socketsByInstanceId.delete(state.instanceId);
+                    }
                     this.logger.info("Firefox attach instance disconnected", {
                         instanceId: state.instanceId,
                     });
@@ -66,6 +144,10 @@ class FirefoxAttachServer {
                 });
             });
         });
+        this.heartbeatReaper = setInterval(() => {
+            this.reapStaleSockets();
+        }, ATTACH_HEARTBEAT_REAP_INTERVAL_MS);
+        this.heartbeatReaper.unref();
         this.logger.info("Firefox attach WebSocket server started", {
             host: this.config.browser.attach.host,
             port: this.config.browser.attach.port,
@@ -76,6 +158,10 @@ class FirefoxAttachServer {
         if (!this.wsServer) {
             return;
         }
+        if (this.heartbeatReaper) {
+            clearInterval(this.heartbeatReaper);
+            this.heartbeatReaper = null;
+        }
         for (const state of this.sockets) {
             try {
                 state.socket.close(1001, "server shutdown");
@@ -85,6 +171,7 @@ class FirefoxAttachServer {
             }
         }
         this.sockets.clear();
+        this.socketsByInstanceId.clear();
         const wsServer = this.wsServer;
         this.wsServer = null;
         await new Promise((resolve, reject) => {
@@ -110,6 +197,9 @@ class FirefoxAttachServer {
             if (existing.instanceId !== input.instanceId) {
                 throw new Error("Recording is already active in another browser instance.");
             }
+            if (existing.tabId !== input.tabId) {
+                throw new Error(`Browser instance '${input.instanceId}' is already recording tab '${existing.tabId}'. Stop it before starting recording for tab '${input.tabId}'.`);
+            }
             return existing;
         }
         const session = await this.sessionStore.getSession(input.sessionId);
@@ -118,7 +208,7 @@ class FirefoxAttachServer {
                 sessionId: input.sessionId,
                 label: this.config.project.sessionLabel?.trim() || input.sessionId,
                 cwd: process.cwd(),
-                updatedAt: new Date().toISOString(),
+                updatedAt: (0, localTimestamp_1.formatLocalTimestamp)(new Date()),
             };
         if (!resolvedSession.cwd?.trim()) {
             throw new Error("Workspace cwd is not registered for this console.");
@@ -170,19 +260,22 @@ class FirefoxAttachServer {
         if (!existing) {
             return null;
         }
+        const socketState = this.socketsByInstanceId.get(existing.instanceId);
         const activeState = this.activeRecordingsById.get(existing.recordingId);
-        if (activeState) {
+        if (socketState) {
             try {
                 await this.invokeRecordingControl({
-                    instanceId: activeState.record.instanceId,
-                    tabId: activeState.record.tabId,
-                    recordingId: activeState.record.recordingId,
+                    instanceId: existing.instanceId,
+                    tabId: existing.tabId,
+                    recordingId: existing.recordingId,
                     mode: "stop",
                 });
             }
             catch {
-                // Local writer still finalizes the bundle.
+                // Local writer or persisted state still finalizes the bundle.
             }
+        }
+        if (activeState) {
             await this.recordingWriter.appendEvent(activeState, {
                 kind: "session_stopped",
                 status: "stopped",
@@ -193,11 +286,17 @@ class FirefoxAttachServer {
             return activeState.record;
         }
         if (existing.status !== "stopped") {
-            const stopped = {
-                ...existing,
-                status: "stopped",
-                stoppedAt: new Date().toISOString(),
-            };
+            const session = await this.sessionStore.getSession(existing.sessionId);
+            const stopped = session?.cwd?.trim()
+                ? await this.recordingWriter.finalizeExisting({
+                    session,
+                    record: existing,
+                })
+                : {
+                    ...existing,
+                    status: "stopped",
+                    stoppedAt: (0, localTimestamp_1.formatLocalTimestamp)(new Date()),
+                };
             await this.maintenanceStore.setBrowserRecording(stopped);
             await this.broadcastRecordingState(stopped);
             return stopped;
@@ -216,6 +315,7 @@ class FirefoxAttachServer {
                 reject(new Error(`Attached browser action '${input.action}' timed out for instance '${input.instanceId}'.`));
             }, this.config.browser.timeoutMs);
             this.pendingTabActions.set(requestId, {
+                instanceId: input.instanceId,
                 resolve,
                 reject,
                 timer,
@@ -241,19 +341,39 @@ class FirefoxAttachServer {
         socket.send(JSON.stringify(payload));
     }
     async handleMessage(state, payload) {
+        if (state.protocolFailed) {
+            return;
+        }
+        this.enforceRateLimit(state);
+        state.lastSeenAt = Date.now();
         const raw = typeof payload === "string"
             ? payload
             : Buffer.isBuffer(payload)
                 ? payload.toString("utf8")
-                : String(payload ?? "");
-        let message;
+                : payload instanceof ArrayBuffer
+                    ? Buffer.from(payload).toString("utf8")
+                    : Array.isArray(payload) && payload.every(Buffer.isBuffer)
+                        ? Buffer.concat(payload).toString("utf8")
+                        : String(payload ?? "");
+        let decoded;
         try {
-            message = JSON.parse(raw);
+            decoded = JSON.parse(raw);
         }
         catch {
-            this.logger.debug("Firefox attach message ignored because it is not valid JSON");
-            return;
+            throw new FirefoxAttachProtocolError("invalid_json");
+        }
+        const parsed = types_1.firefoxAttachInboundMessageSchema.safeParse(decoded);
+        if (!parsed.success) {
+            throw new FirefoxAttachProtocolError("invalid_message");
         }
+        const message = parsed.data;
+        if (!state.instanceId && message.type !== "hello") {
+            throw new FirefoxAttachProtocolError("hello_required");
+        }
+        if (state.instanceId && message.type === "hello") {
+            throw new FirefoxAttachProtocolError("duplicate_hello");
+        }
+        const connectedInstanceId = state.instanceId;
         switch (message.type) {
             case "hello":
                 await this.handleHello(state, message);
@@ -293,10 +413,14 @@ class FirefoxAttachServer {
                 }
                 return;
             case "tab_action_result":
-                this.resolvePendingTabAction(message);
+                if (connectedInstanceId) {
+                    this.resolvePendingTabAction(connectedInstanceId, message);
+                }
                 return;
             case "recording_control_result":
-                this.resolvePendingRecordingControl(message);
+                if (connectedInstanceId) {
+                    this.resolvePendingRecordingControl(connectedInstanceId, message);
+                }
                 return;
             case "recording_event":
                 if (state.instanceId) {
@@ -315,10 +439,18 @@ class FirefoxAttachServer {
         }
     }
     async handleHello(state, message) {
+        const previous = this.socketsByInstanceId.get(message.instance_id);
         state.instanceId = message.instance_id;
         this.socketsByInstanceId.set(message.instance_id, state);
+        if (previous && previous !== state) {
+            this.logger.warn("Firefox attach instance connection replaced", {
+                instanceId: message.instance_id,
+            });
+            previous.socket.close(4001, "replaced by newer connection");
+        }
         const instance = this.registry.setConnected({
             instanceId: message.instance_id,
+            browser: message.browser,
             extensionVersion: message.extension_version,
             ...(message.profile_name ? { profileName: message.profile_name } : {}),
             capabilities: ["tabs", "active_tab", "recording"],
@@ -360,7 +492,7 @@ class FirefoxAttachServer {
             backend: "firefox-attached",
             instanceId,
             tabId: tab.tab_id,
-            attachedAt: new Date().toISOString(),
+            attachedAt: (0, localTimestamp_1.formatLocalTimestamp)(new Date()),
             ...(tab.title ? { title: tab.title } : {}),
             ...(tab.url ? { url: tab.url } : {}),
         });
@@ -372,18 +504,18 @@ class FirefoxAttachServer {
             url: tab.url,
         });
     }
-    resolvePendingTabAction(message) {
+    resolvePendingTabAction(instanceId, message) {
         const pending = this.pendingTabActions.get(message.request_id);
-        if (!pending) {
+        if (!pending || pending.instanceId !== instanceId) {
             return;
         }
         clearTimeout(pending.timer);
         this.pendingTabActions.delete(message.request_id);
         pending.resolve(message);
     }
-    resolvePendingRecordingControl(message) {
+    resolvePendingRecordingControl(instanceId, message) {
         const pending = this.pendingRecordingControls.get(message.request_id);
-        if (!pending) {
+        if (!pending || pending.instanceId !== instanceId) {
             return;
         }
         clearTimeout(pending.timer);
@@ -402,6 +534,7 @@ class FirefoxAttachServer {
                 reject(new Error(`Attached browser recording '${input.mode}' timed out for instance '${input.instanceId}'.`));
             }, this.config.browser.timeoutMs);
             this.pendingRecordingControls.set(requestId, {
+                instanceId: input.instanceId,
                 resolve,
                 reject,
                 timer,
@@ -468,7 +601,51 @@ class FirefoxAttachServer {
     async broadcastRecordingState(record) {
         const payload = this.buildRecordingStateMessage(record);
         for (const state of this.sockets) {
-            this.sendJson(state.socket, payload);
+            if (state.instanceId) {
+                this.sendJson(state.socket, payload);
+            }
+        }
+    }
+    enforceRateLimit(state) {
+        const now = Date.now();
+        if (now - state.rateWindowStartedAt >= ATTACH_RATE_WINDOW_MS) {
+            state.rateWindowStartedAt = now;
+            state.rateWindowMessageCount = 0;
+        }
+        state.rateWindowMessageCount += 1;
+        if (state.rateWindowMessageCount > ATTACH_RATE_MAX_MESSAGES) {
+            throw new FirefoxAttachProtocolError("rate_limit_exceeded");
+        }
+    }
+    handleProtocolError(state, error) {
+        if (state.protocolFailed) {
+            return;
+        }
+        state.protocolFailed = true;
+        const reason = error instanceof FirefoxAttachProtocolError
+            ? error.reason
+            : "message_handler_failed";
+        this.logger.warn("Firefox attach protocol error", {
+            ...(state.instanceId ? { instanceId: state.instanceId } : {}),
+            reason,
+        });
+        try {
+            state.socket.close(1008, reason);
+        }
+        catch {
+            // The socket may already have closed while the handler was awaiting I/O.
+        }
+    }
+    reapStaleSockets() {
+        const staleBefore = Date.now() - ATTACH_HEARTBEAT_TIMEOUT_MS;
+        for (const state of this.sockets) {
+            if (state.lastSeenAt >= staleBefore) {
+                continue;
+            }
+            this.logger.warn("Firefox attach socket heartbeat expired", {
+                ...(state.instanceId ? { instanceId: state.instanceId } : {}),
+            });
+            state.socket.close(4002, "heartbeat timeout");
         }
     }
     mapManualRecordingResult(record) {