@deadragdoll/tellymcp 0.0.13 → 0.0.15

package/dist/services/features/telegram-mcp/src/features/file-content/model/temporaryFileLinkStore.js

@@ -0,0 +1,307 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEMPORARY_FILE_LINK_MAX_BYTES = exports.TemporaryFileLinkStore = void 0;
+exports.resolvePublicFilesBaseUrl = resolvePublicFilesBaseUrl;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const node_stream_1 = require("node:stream");
+const promises_2 = require("node:stream/promises");
+const FILE_LINK_TTL_MS = 10 * 60 * 1000;
+const FILE_LINK_MAX_BYTES = 32 * 1024 * 1024;
+const FILE_LINK_MAX_DOWNLOADS = 3;
+const FILE_LINK_CLEANUP_INTERVAL_MS = 60 * 1000;
+function sanitizeFilename(value) {
+    const basename = node_path_1.default.basename(value?.trim() || "file.bin");
+    const withoutControlChars = Array.from(basename)
+        .map((character) => {
+        const code = character.charCodeAt(0);
+        return code < 32 || code === 127 ? "-" : character;
+    })
+        .join("");
+    const safe = withoutControlChars.replace(/[/\\<>:"|?*]/gu, "-").trim();
+    return safe || "file.bin";
+}
+function decodeFilenameHeader(value) {
+    if (!value) {
+        return undefined;
+    }
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+function encodeContentDispositionFilename(filename) {
+    return encodeURIComponent(filename).replace(/[!'()*]/gu, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function resolvePublicFilesBaseUrl(gatewayPublicUrl) {
+    if (!gatewayPublicUrl?.trim()) {
+        throw new Error("URL file delivery requires GATEWAY_PUBLIC_URL.");
+    }
+    const url = new URL(gatewayPublicUrl);
+    url.search = "";
+    url.hash = "";
+    url.pathname = url.pathname.replace(/\/+$/u, "");
+    if (url.pathname.endsWith("/gateway")) {
+        url.pathname = url.pathname.slice(0, -"/gateway".length) || "/";
+    }
+    url.pathname = `${url.pathname.replace(/\/+$/u, "")}/files`.replace(/\/{2,}/gu, "/");
+    return url;
+}
+function readSingleHeader(req, name) {
+    const value = req.headers[name];
+    return Array.isArray(value) ? value[0] : value;
+}
+class TemporaryFileLinkStore {
+    logger;
+    recordsByUploadToken = new Map();
+    recordsByDownloadToken = new Map();
+    recordsByCacheKey = new Map();
+    cleanupTimer = null;
+    baseUrl;
+    rootDir;
+    constructor(gatewayPublicUrl, logger, rootDir = node_path_1.default.resolve(".tellymcp", "tmp", "file-links")) {
+        this.logger = logger;
+        this.baseUrl = resolvePublicFilesBaseUrl(gatewayPublicUrl);
+        this.rootDir = rootDir;
+    }
+    async start() {
+        await (0, promises_1.mkdir)(this.rootDir, { recursive: true });
+        const entries = await (0, promises_1.readdir)(this.rootDir).catch(() => []);
+        await Promise.all(entries.map((entry) => (0, promises_1.rm)(node_path_1.default.join(this.rootDir, entry), { force: true, recursive: true })));
+        this.cleanupTimer = setInterval(() => {
+            void this.cleanupExpired();
+        }, FILE_LINK_CLEANUP_INTERVAL_MS);
+        this.cleanupTimer.unref();
+    }
+    async stop() {
+        if (this.cleanupTimer) {
+            clearInterval(this.cleanupTimer);
+            this.cleanupTimer = null;
+        }
+        await this.cleanupExpired(true);
+    }
+    createTicket(cacheKey) {
+        const id = (0, node_crypto_1.randomUUID)();
+        const uploadToken = (0, node_crypto_1.randomBytes)(32).toString("base64url");
+        const downloadToken = (0, node_crypto_1.randomBytes)(32).toString("base64url");
+        const expiresAtMs = Date.now() + FILE_LINK_TTL_MS;
+        const record = {
+            id,
+            uploadToken,
+            downloadToken,
+            cacheKey,
+            filePath: node_path_1.default.join(this.rootDir, `${id}.bin`),
+            partialPath: node_path_1.default.join(this.rootDir, `${id}.upload`),
+            expiresAtMs,
+            status: "pending",
+            downloadCount: 0,
+        };
+        this.recordsByUploadToken.set(uploadToken, record);
+        this.recordsByDownloadToken.set(downloadToken, record);
+        this.recordsByCacheKey.set(cacheKey, record);
+        const uploadUrl = new URL(this.baseUrl);
+        uploadUrl.pathname = `${this.baseUrl.pathname}/upload/${uploadToken}`;
+        return {
+            upload_url: uploadUrl.toString(),
+            download_token: downloadToken,
+            expires_at: new Date(expiresAtMs).toISOString(),
+        };
+    }
+    async discard(downloadToken) {
+        const record = this.recordsByDownloadToken.get(downloadToken);
+        if (record) {
+            await this.deleteRecord(record);
+        }
+    }
+    getReadyLink(downloadToken) {
+        const record = this.recordsByDownloadToken.get(downloadToken);
+        if (!record ||
+            record.expiresAtMs <= Date.now() ||
+            record.status !== "ready") {
+            throw new Error("Temporary file upload did not complete.");
+        }
+        if (!record.filename ||
+            !record.mimetype ||
+            record.sizeBytes === undefined) {
+            throw new Error("Temporary file metadata is incomplete.");
+        }
+        const downloadUrl = new URL(this.baseUrl);
+        downloadUrl.pathname = `${this.baseUrl.pathname}/download/${record.downloadToken}/${encodeURIComponent(record.filename)}`;
+        return {
+            url: downloadUrl.toString(),
+            filename: record.filename,
+            mimetype: record.mimetype,
+            size_bytes: record.sizeBytes,
+            expires_at: new Date(record.expiresAtMs).toISOString(),
+        };
+    }
+    async readCachedBase64(cacheKey, maxBytes) {
+        const record = this.recordsByCacheKey.get(cacheKey);
+        if (!record ||
+            record.status !== "ready" ||
+            record.expiresAtMs <= Date.now() ||
+            !record.filename ||
+            !record.mimetype ||
+            record.sizeBytes === undefined ||
+            record.sizeBytes > maxBytes) {
+            return null;
+        }
+        const content = await (0, promises_1.readFile)(record.filePath);
+        return {
+            data: content.toString("base64"),
+            filename: record.filename,
+            mimetype: record.mimetype,
+            size_bytes: record.sizeBytes,
+        };
+    }
+    matches(pathname) {
+        return pathname.startsWith("/files/");
+    }
+    async handleRequest(req, res, pathname) {
+        if (!this.matches(pathname)) {
+            return false;
+        }
+        const uploadMatch = /^\/files\/upload\/([^/]+)$/u.exec(pathname);
+        if (uploadMatch) {
+            await this.handleUpload(req, res, uploadMatch[1] ?? "");
+            return true;
+        }
+        const downloadMatch = /^\/files\/download\/([^/]+)(?:\/[^/]*)?$/u.exec(pathname);
+        if (downloadMatch) {
+            await this.handleDownload(req, res, downloadMatch[1] ?? "");
+            return true;
+        }
+        res.statusCode = 404;
+        res.end("Not found");
+        return true;
+    }
+    async handleUpload(req, res, uploadToken) {
+        if (req.method !== "PUT") {
+            res.statusCode = 405;
+            res.end("Method not allowed");
+            return;
+        }
+        const record = this.recordsByUploadToken.get(uploadToken);
+        if (!record ||
+            record.expiresAtMs <= Date.now() ||
+            record.status !== "pending") {
+            res.statusCode = 404;
+            res.end("Upload ticket not found");
+            return;
+        }
+        const declaredLength = Number(readSingleHeader(req, "content-length") ?? "0");
+        if (!Number.isFinite(declaredLength) ||
+            declaredLength < 0 ||
+            declaredLength > FILE_LINK_MAX_BYTES) {
+            res.statusCode = 413;
+            res.end("Invalid or oversized content-length");
+            return;
+        }
+        let receivedBytes = 0;
+        const limiter = new node_stream_1.Transform({
+            transform(chunk, _encoding, callback) {
+                receivedBytes += chunk.byteLength;
+                if (receivedBytes > FILE_LINK_MAX_BYTES) {
+                    callback(new Error("Temporary file exceeds the 32 MiB limit."));
+                    return;
+                }
+                callback(null, chunk);
+            },
+        });
+        try {
+            await (0, promises_2.pipeline)(req, limiter, (0, node_fs_1.createWriteStream)(record.partialPath, { flags: "wx" }));
+            if (receivedBytes !== declaredLength) {
+                throw new Error("Uploaded file size does not match content-length.");
+            }
+            await (0, promises_1.rename)(record.partialPath, record.filePath);
+            record.filename = sanitizeFilename(decodeFilenameHeader(readSingleHeader(req, "x-telly-filename")));
+            record.mimetype =
+                readSingleHeader(req, "content-type")?.split(";", 1)[0]?.trim() ||
+                    "application/octet-stream";
+            record.sizeBytes = receivedBytes;
+            record.status = "ready";
+            this.recordsByUploadToken.delete(uploadToken);
+            res.statusCode = 204;
+            res.end();
+        }
+        catch (error) {
+            await (0, promises_1.rm)(record.partialPath, { force: true });
+            this.logger.warn("Temporary file upload failed", {
+                transferId: record.id,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            res.statusCode = 400;
+            res.end("Upload failed");
+        }
+    }
+    async handleDownload(req, res, downloadToken) {
+        if (req.method !== "GET" && req.method !== "HEAD") {
+            res.statusCode = 405;
+            res.end("Method not allowed");
+            return;
+        }
+        const record = this.recordsByDownloadToken.get(downloadToken);
+        if (!record ||
+            record.status !== "ready" ||
+            record.expiresAtMs <= Date.now() ||
+            !record.filename ||
+            !record.mimetype ||
+            record.sizeBytes === undefined ||
+            record.downloadCount >= FILE_LINK_MAX_DOWNLOADS) {
+            res.statusCode = 404;
+            res.end("File link expired or unavailable");
+            return;
+        }
+        res.statusCode = 200;
+        res.setHeader("content-type", record.mimetype);
+        res.setHeader("content-length", record.sizeBytes);
+        res.setHeader("content-disposition", `attachment; filename*=UTF-8''${encodeContentDispositionFilename(record.filename)}`);
+        res.setHeader("cache-control", "private, no-store, max-age=0");
+        res.setHeader("x-content-type-options", "nosniff");
+        if (req.method === "HEAD") {
+            res.end();
+            return;
+        }
+        record.downloadCount += 1;
+        try {
+            await (0, promises_2.pipeline)((0, node_fs_1.createReadStream)(record.filePath), res);
+        }
+        catch (error) {
+            record.downloadCount -= 1;
+            this.logger.warn("Temporary file download failed", {
+                transferId: record.id,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            if (!res.writableEnded) {
+                res.destroy(error instanceof Error ? error : undefined);
+            }
+        }
+    }
+    async cleanupExpired(force = false) {
+        const now = Date.now();
+        const records = [...this.recordsByDownloadToken.values()];
+        await Promise.all(records
+            .filter((record) => force || record.expiresAtMs <= now)
+            .map((record) => this.deleteRecord(record)));
+    }
+    async deleteRecord(record) {
+        this.recordsByUploadToken.delete(record.uploadToken);
+        this.recordsByDownloadToken.delete(record.downloadToken);
+        if (this.recordsByCacheKey.get(record.cacheKey) === record) {
+            this.recordsByCacheKey.delete(record.cacheKey);
+        }
+        await Promise.all([
+            (0, promises_1.rm)(record.filePath, { force: true }),
+            (0, promises_1.rm)(record.partialPath, { force: true }),
+        ]);
+    }
+}
+exports.TemporaryFileLinkStore = TemporaryFileLinkStore;
+exports.TEMPORARY_FILE_LINK_MAX_BYTES = FILE_LINK_MAX_BYTES;

package/dist/services/features/telegram-mcp/src/features/file-content/model/workspaceFilePolicy.js

@@ -0,0 +1,115 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertWorkspaceFilePathAllowed = assertWorkspaceFilePathAllowed;
+exports.resolveWorkspaceFileMimeType = resolveWorkspaceFileMimeType;
+exports.decodeWorkspaceTextContent = decodeWorkspaceTextContent;
+const node_path_1 = __importDefault(require("node:path"));
+const node_util_1 = require("node:util");
+const mime_types_1 = require("mime-types");
+const BLOCKED_DIRECTORY_NAMES = new Set([
+    ".aws",
+    ".azure",
+    ".docker",
+    ".git",
+    ".gnupg",
+    ".kube",
+    ".ssh",
+    ".tellymcp",
+]);
+const BLOCKED_FILE_NAMES = new Set([
+    ".dockerconfigjson",
+    ".git-credentials",
+    ".netrc",
+    ".npmrc",
+    ".pypirc",
+    ".yarnrc",
+    ".yarnrc.yml",
+    "_netrc",
+    "credentials",
+    "credentials.json",
+    "id_dsa",
+    "id_ecdsa",
+    "id_ed25519",
+    "id_rsa",
+    "secrets.json",
+    "service-account-key.json",
+    "service-account.json",
+]);
+const BLOCKED_FILE_EXTENSIONS = new Set([
+    ".jks",
+    ".kdbx",
+    ".key",
+    ".keystore",
+    ".p12",
+    ".pem",
+    ".pfx",
+]);
+const SAFE_ENV_TEMPLATE_MARKERS = new Set([
+    "dist",
+    "example",
+    "sample",
+    "template",
+]);
+const SOURCE_MIME_TYPES = new Map([
+    [".astro", "text/plain"],
+    [".cts", "text/typescript"],
+    [".gql", "application/graphql"],
+    [".graphql", "application/graphql"],
+    [".jsx", "text/javascript"],
+    [".mdx", "text/markdown"],
+    [".mts", "text/typescript"],
+    [".prisma", "text/plain"],
+    [".svelte", "text/plain"],
+    [".toml", "application/toml"],
+    [".ts", "text/typescript"],
+    [".tsx", "text/typescript"],
+    [".vue", "text/plain"],
+]);
+const SOURCE_FILE_MIME_TYPES = new Map([
+    ["dockerfile", "text/plain"],
+    ["makefile", "text/plain"],
+]);
+function isBlockedEnvFile(fileName) {
+    if (fileName === ".env") {
+        return true;
+    }
+    if (!fileName.startsWith(".env.")) {
+        return false;
+    }
+    const suffixSegments = fileName.slice(".env.".length).split(".");
+    return !suffixSegments.some((segment) => SAFE_ENV_TEMPLATE_MARKERS.has(segment));
+}
+function assertWorkspaceFilePathAllowed(filePath) {
+    const normalized = filePath.replaceAll("\\", "/").toLowerCase();
+    const segments = normalized.split("/").filter(Boolean);
+    const fileName = segments.at(-1) ?? "";
+    if (segments.some((segment) => BLOCKED_DIRECTORY_NAMES.has(segment)) ||
+        BLOCKED_FILE_NAMES.has(fileName) ||
+        BLOCKED_FILE_EXTENSIONS.has(node_path_1.default.posix.extname(fileName)) ||
+        isBlockedEnvFile(fileName)) {
+        throw new Error("Access to sensitive workspace files is blocked.");
+    }
+}
+function resolveWorkspaceFileMimeType(fileName) {
+    const normalized = fileName.toLowerCase();
+    return (SOURCE_FILE_MIME_TYPES.get(normalized) ||
+        SOURCE_MIME_TYPES.get(node_path_1.default.extname(normalized)) ||
+        (0, mime_types_1.lookup)(fileName) ||
+        "application/octet-stream");
+}
+function decodeWorkspaceTextContent(content) {
+    let text;
+    try {
+        text = new node_util_1.TextDecoder("utf-8", { fatal: true }).decode(content);
+    }
+    catch {
+        throw new Error("type='text' requires valid UTF-8 content; use type='url' or type='base64' for binary files.");
+    }
+    if (text.includes("\0")) {
+        throw new Error("type='text' does not accept binary content; use type='url' or type='base64'.");
+    }
+    return text;
+}

package/dist/services/features/telegram-mcp/src/features/notify/model/notifyService.js

@@ -8,6 +8,7 @@ const node_path_1 = __importDefault(require("node:path"));
 const schema_1 = require("../../../entities/request/model/schema");
 const redactSecrets_1 = require("../../../shared/lib/redact-secrets/redactSecrets");
 const client_1 = require("../../../shared/integrations/terminal/client");
+const bodyLimits_1 = require("../../../shared/lib/bodyLimits");
 const relay_1 = require("../../../app/webapp/relay");
 const gatewayClientAccess_1 = require("../../distributed-client/model/gatewayClientAccess");
 function mergeSavedContext(input, session) {
@@ -300,7 +301,10 @@ class NotifyService {
         if (!binding) {
             throw new Error("Gateway relay session has no active Telegram route yet.");
         }
-        const sendResult = await this.transport.sendDocumentBufferToChat?.(binding.telegramChatId, input.fileName, Buffer.from(input.contentBase64, "base64"), input.caption);
+        (0, bodyLimits_1.assertStringBodySize)(input.contentBase64);
+        const decodedContent = Buffer.from(input.contentBase64, "base64");
+        (0, bodyLimits_1.assertBodySize)(decodedContent.byteLength);
+        const sendResult = await this.transport.sendDocumentBufferToChat?.(binding.telegramChatId, input.fileName, decodedContent, input.caption);
         if (!sendResult) {
             throw new Error("Gateway transport document proxy is unavailable.");
         }
@@ -321,8 +325,8 @@ class NotifyService {
             ...(this._config.distributed.gatewayAuthToken
                 ? { gatewayAuthToken: this._config.distributed.gatewayAuthToken }
                 : {}),
-            ...(this._config.distributed.gatewayToken
-                ? { gatewayToken: this._config.distributed.gatewayToken }
+            ...(this._config.distributed.gatewayScopeToken
+                ? { gatewayScopeToken: this._config.distributed.gatewayScopeToken }
                 : {}),
             ...(this._config.project.name
                 ? { projectName: this._config.project.name }
@@ -378,8 +382,8 @@ class NotifyService {
             ...(this._config.distributed.gatewayAuthToken
                 ? { gatewayAuthToken: this._config.distributed.gatewayAuthToken }
                 : {}),
-            ...(this._config.distributed.gatewayToken
-                ? { gatewayToken: this._config.distributed.gatewayToken }
+            ...(this._config.distributed.gatewayScopeToken
+                ? { gatewayScopeToken: this._config.distributed.gatewayScopeToken }
                 : {}),
             ...(this._config.project.name
                 ? { projectName: this._config.project.name }

package/dist/services/features/telegram-mcp/src/features/session-context/model/getRuntimeDiagnosticsTool.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetRuntimeDiagnosticsTool = void 0;
+const schema_1 = require("../../../entities/request/model/schema");
+class GetRuntimeDiagnosticsTool {
+    sessionContextService;
+    constructor(sessionContextService) {
+        this.sessionContextService = sessionContextService;
+    }
+    register(server) {
+        server.registerTool("get_runtime_diagnostics", {
+            title: "Get Runtime Diagnostics",
+            description: "Run safe, read-only health checks for a selected console: environment schema, package/protocol version, runtime state store, PTY state, gateway configuration, and gateway-to-client relay. Redis is probed only for gateway runtimes. Secrets and raw connection strings are never returned. In gateway mode, pass session_id exactly as returned by list_gateway_sessions.",
+            inputSchema: schema_1.getRuntimeDiagnosticsInputSchema,
+            outputSchema: schema_1.getRuntimeDiagnosticsOutputSchema,
+        }, async (args) => {
+            const output = await this.sessionContextService.getRuntimeDiagnostics(args);
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify(output, null, 2),
+                    },
+                ],
+                structuredContent: output,
+            };
+        });
+    }
+}
+exports.GetRuntimeDiagnosticsTool = GetRuntimeDiagnosticsTool;