@deadragdoll/tellymcp 0.0.13 → 0.0.15

package/dist/services/features/telegram-mcp/src/features/session-context/model/sessionContextService.js

@@ -9,16 +9,174 @@ class SessionContextService {
     logger;
     projectIdentityResolver;
     remoteConsoleInvoker;
-    constructor(sessionStore, bindingStore, logger, projectIdentityResolver, remoteConsoleInvoker) {
+    runtimeDiagnostics;
+    constructor(sessionStore, bindingStore, logger, projectIdentityResolver, remoteConsoleInvoker, runtimeDiagnostics) {
         this.sessionStore = sessionStore;
         this.bindingStore = bindingStore;
         this.logger = logger;
         this.projectIdentityResolver = projectIdentityResolver;
         this.remoteConsoleInvoker = remoteConsoleInvoker;
+        this.runtimeDiagnostics = runtimeDiagnostics;
+    }
+    getRemoteConsoleInvoker() {
+        return this.runtimeDiagnostics?.mode === "client"
+            ? undefined
+            : this.remoteConsoleInvoker;
+    }
+    formatDiagnosticError(error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const redacted = (0, redactSecrets_1.redactSecrets)(message).replace(/\s+/gu, " ").trim();
+        return redacted.length > 500
+            ? `${redacted.slice(0, 497)}...`
+            : redacted || "Unknown error";
+    }
+    finalizeDiagnostics(output) {
+        const degraded = Object.values(output.checks).some((check) => check.status !== "ok");
+        return {
+            ...output,
+            status: degraded ? "degraded" : "ok",
+        };
+    }
+    async collectLocalDiagnostics(sessionId) {
+        const runtime = this.runtimeDiagnostics;
+        let session = null;
+        let sessionStoreCheck;
+        try {
+            session = await this.sessionStore.getSession(sessionId);
+            await this.bindingStore.getBinding(sessionId);
+            sessionStoreCheck = {
+                status: "ok",
+                message: session
+                    ? "Session and route stores are readable; session metadata exists."
+                    : "Session and route stores are readable; no saved metadata exists for this id.",
+            };
+        }
+        catch (error) {
+            sessionStoreCheck = {
+                status: "error",
+                message: `Session store check failed: ${this.formatDiagnosticError(error)}`,
+            };
+        }
+        let redisCheck;
+        if (runtime?.mode === "client") {
+            redisCheck = {
+                status: "ok",
+                message: "Redis is not required in client mode; process-local state is active.",
+            };
+        }
+        else if (!runtime?.pingRedis) {
+            redisCheck = {
+                status: "warn",
+                message: "Runtime Redis probe is unavailable.",
+            };
+        }
+        else {
+            try {
+                const reply = await runtime.pingRedis();
+                redisCheck = {
+                    status: reply.trim().toUpperCase() === "PONG" ? "ok" : "warn",
+                    message: `Redis probe returned ${reply.trim() || "an empty response"}.`,
+                };
+            }
+            catch (error) {
+                redisCheck = {
+                    status: "error",
+                    message: `Redis probe failed: ${this.formatDiagnosticError(error)}`,
+                };
+            }
+        }
+        const mode = runtime?.mode ?? "client";
+        const gatewayConfigured = Boolean(runtime?.gatewayWsUrlConfigured);
+        const gatewayConfiguration = mode === "gateway"
+            ? {
+                status: "ok",
+                message: "Gateway runtime does not require an outbound gateway WebSocket URL.",
+            }
+            : gatewayConfigured
+                ? {
+                    status: "ok",
+                    message: runtime?.gatewayAuthConfigured
+                        ? "Gateway WebSocket URL and authentication are configured."
+                        : "Gateway WebSocket URL is configured; authentication is not configured.",
+                }
+                : {
+                    status: "error",
+                    message: "Gateway WebSocket URL is not configured for this client runtime.",
+                };
+        return this.finalizeDiagnostics({
+            checked_at: new Date().toISOString(),
+            session_id: sessionId,
+            runtime: {
+                mode,
+                package_version: runtime?.packageVersion ?? "unknown",
+                protocol_version: runtime?.protocolVersion ?? "unknown",
+                ...(runtime?.nodeId ? { node_id: runtime.nodeId } : {}),
+            },
+            checks: {
+                configuration: runtime
+                    ? {
+                        status: "ok",
+                        message: "Normalized environment schema was accepted at startup.",
+                    }
+                    : {
+                        status: "warn",
+                        message: "Runtime configuration metadata is unavailable.",
+                    },
+                redis: redisCheck,
+                session_store: sessionStoreCheck,
+                terminal: session?.terminalTarget
+                    ? {
+                        status: "ok",
+                        message: "A PTY terminal target is configured for this session.",
+                    }
+                    : {
+                        status: "warn",
+                        message: "No PTY terminal target is configured for this session.",
+                    },
+                gateway_configuration: gatewayConfiguration,
+                relay: {
+                    status: "ok",
+                    message: "Local diagnostic action completed.",
+                },
+            },
+        });
+    }
+    async getRuntimeDiagnostics(input) {
+        const resolved = this.projectIdentityResolver.resolveSessionDefaults(input);
+        const remoteConsoleInvoker = this.getRemoteConsoleInvoker();
+        if (!remoteConsoleInvoker) {
+            return await this.collectLocalDiagnostics(resolved.sessionId);
+        }
+        try {
+            const remote = await remoteConsoleInvoker.invokeForRelaySession(resolved.sessionId, "telegramMcp.sessionContext.getRuntimeDiagnosticsRemote", input);
+            return this.finalizeDiagnostics({
+                ...remote,
+                checks: {
+                    ...remote.checks,
+                    relay: {
+                        status: "ok",
+                        message: "Gateway-to-client relay completed successfully.",
+                    },
+                },
+            });
+        }
+        catch (error) {
+            const local = await this.collectLocalDiagnostics(resolved.sessionId);
+            return this.finalizeDiagnostics({
+                ...local,
+                checks: {
+                    ...local.checks,
+                    relay: {
+                        status: "error",
+                        message: `Gateway-to-client relay failed: ${this.formatDiagnosticError(error)}`,
+                    },
+                },
+            });
+        }
     }
     async setContext(input) {
         const resolved = this.projectIdentityResolver.resolveSessionDefaults(input);
-        const remote = await this.remoteConsoleInvoker?.invokeForRelaySession(resolved.sessionId, "telegramMcp.sessionContext.setContextRemote", input);
+        const remote = await this.getRemoteConsoleInvoker()?.invokeForRelaySession(resolved.sessionId, "telegramMcp.sessionContext.setContextRemote", input);
         if (remote) {
             return remote;
         }
@@ -62,7 +220,9 @@ class SessionContextService {
                 : existing?.risks
                     ? { risks: existing.risks }
                     : {}),
-            ...(existing?.terminalTarget ? { terminalTarget: existing.terminalTarget } : {}),
+            ...(existing?.terminalTarget
+                ? { terminalTarget: existing.terminalTarget }
+                : {}),
             ...(existing?.lastTerminalNudgeAt
                 ? { lastTerminalNudgeAt: existing.lastTerminalNudgeAt }
                 : {}),
@@ -98,7 +258,7 @@ class SessionContextService {
     }
     async renameSession(input) {
         const resolved = this.projectIdentityResolver.resolveSessionDefaults(input);
-        const remote = await this.remoteConsoleInvoker?.invokeForRelaySession(resolved.sessionId, "telegramMcp.sessionContext.renameSessionRemote", input);
+        const remote = await this.getRemoteConsoleInvoker()?.invokeForRelaySession(resolved.sessionId, "telegramMcp.sessionContext.renameSessionRemote", input);
         if (remote) {
             return remote;
         }
@@ -120,7 +280,9 @@ class SessionContextService {
             ...(existing?.files ? { files: existing.files } : {}),
             ...(existing?.decisions ? { decisions: existing.decisions } : {}),
             ...(existing?.risks ? { risks: existing.risks } : {}),
-            ...(existing?.terminalTarget ? { terminalTarget: existing.terminalTarget } : {}),
+            ...(existing?.terminalTarget
+                ? { terminalTarget: existing.terminalTarget }
+                : {}),
             ...(existing?.lastTerminalNudgeAt
                 ? { lastTerminalNudgeAt: existing.lastTerminalNudgeAt }
                 : {}),
@@ -151,7 +313,7 @@ class SessionContextService {
     }
     async getContext(input) {
         const resolved = this.projectIdentityResolver.resolveSessionDefaults(input);
-        const remote = await this.remoteConsoleInvoker?.invokeForRelaySession(resolved.sessionId, "telegramMcp.sessionContext.getContextRemote", input);
+        const remote = await this.getRemoteConsoleInvoker()?.invokeForRelaySession(resolved.sessionId, "telegramMcp.sessionContext.getContextRemote", input);
         if (remote) {
             return remote;
         }
@@ -224,7 +386,7 @@ class SessionContextService {
     }
     async clearContext(input) {
         const resolved = this.projectIdentityResolver.resolveSessionDefaults(input);
-        const remote = await this.remoteConsoleInvoker?.invokeForRelaySession(resolved.sessionId, "telegramMcp.sessionContext.clearContextRemote", input);
+        const remote = await this.getRemoteConsoleInvoker()?.invokeForRelaySession(resolved.sessionId, "telegramMcp.sessionContext.clearContextRemote", input);
         if (remote) {
             return remote;
         }

package/dist/services/features/telegram-mcp/src/shared/integrations/memory/processLocalStateStore.js

@@ -0,0 +1,260 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProcessLocalStateStore = void 0;
+const redactSecrets_1 = require("../../lib/redact-secrets/redactSecrets");
+function principalKey(principal) {
+    return `${principal.telegramChatId}:${principal.telegramUserId}`;
+}
+function xchangeKey(sessionId, filePath) {
+    return `${sessionId}\u0000${filePath}`;
+}
+class ProcessLocalStateStore {
+    pairCodes = new Map();
+    bindings = new Map();
+    principalSessions = new Map();
+    principalActiveSessions = new Map();
+    locales = new Map();
+    authorizedPrincipals = new Map();
+    requests = new Map();
+    requestQueue = [];
+    activeRequestId = null;
+    menuPayloads = new Map();
+    xchangeFileMetas = new Map();
+    browserAttachments = new Map();
+    browserRecordings = new Map();
+    projectMenuViews = new Map();
+    outgoingNotices = new Map();
+    gatewayClientUuid;
+    constructor(input = {}) {
+        this.gatewayClientUuid = input.gatewayClientUuid?.trim() || null;
+        this.onGatewayClientUuidChange = input.onGatewayClientUuidChange;
+    }
+    onGatewayClientUuidChange;
+    async createPairCode(record, ttlSeconds) {
+        const existing = this.readExpiring(this.pairCodes, record.code);
+        if (existing)
+            return false;
+        this.pairCodes.set(record.code, { value: record, expiresAt: Date.now() + ttlSeconds * 1000 });
+        return true;
+    }
+    async consumePairCode(code) {
+        const record = this.readExpiring(this.pairCodes, code);
+        this.pairCodes.delete(code);
+        return record;
+    }
+    async getBinding(sessionId) {
+        return this.bindings.get(sessionId) ?? null;
+    }
+    async setBinding(binding) {
+        const previous = this.bindings.get(binding.sessionId);
+        if (previous)
+            this.detachSession(previous, binding.sessionId);
+        this.bindings.set(binding.sessionId, binding);
+        const key = principalKey(binding);
+        const sessions = this.principalSessions.get(key) ?? new Set();
+        sessions.add(binding.sessionId);
+        this.principalSessions.set(key, sessions);
+        this.principalActiveSessions.set(key, binding.sessionId);
+    }
+    async clearBinding(sessionId) {
+        const binding = this.bindings.get(sessionId);
+        this.bindings.delete(sessionId);
+        if (binding)
+            this.detachSession(binding, sessionId);
+    }
+    async getActiveSessionIdForPrincipal(principal) {
+        return this.principalActiveSessions.get(principalKey(principal)) ?? null;
+    }
+    async getActiveSessionIdForTelegramUser(telegramUserId) {
+        for (const [sessionId, binding] of this.bindings) {
+            if (binding.telegramUserId === telegramUserId) {
+                return this.principalActiveSessions.get(principalKey(binding)) ?? sessionId;
+            }
+        }
+        return null;
+    }
+    async clearActiveSessionIdForPrincipal(principal) {
+        this.principalActiveSessions.delete(principalKey(principal));
+    }
+    async setActiveSessionIdForPrincipal(principal, sessionId) {
+        const key = principalKey(principal);
+        const sessions = this.principalSessions.get(key) ?? new Set();
+        sessions.add(sessionId);
+        this.principalSessions.set(key, sessions);
+        this.principalActiveSessions.set(key, sessionId);
+    }
+    async listBoundSessionIdsForPrincipal(principal) {
+        return Array.from(this.principalSessions.get(principalKey(principal)) ?? []);
+    }
+    async listBoundPrincipals() {
+        const principals = new Map();
+        for (const binding of this.bindings.values()) {
+            principals.set(principalKey(binding), {
+                telegramChatId: binding.telegramChatId,
+                telegramUserId: binding.telegramUserId,
+            });
+        }
+        return Array.from(principals.values());
+    }
+    async resetRuntimeState() {
+        this.activeRequestId = null;
+        this.requestQueue.length = 0;
+    }
+    async getActive() {
+        return this.activeRequestId ? this.requests.get(this.activeRequestId) ?? null : null;
+    }
+    async createPending(request) {
+        this.requests.set(request.requestId, request);
+        this.activeRequestId = request.requestId;
+    }
+    async updatePending(request) {
+        this.requests.set(request.requestId, request);
+    }
+    async resolvePending(requestId, resolution) {
+        const current = this.requests.get(requestId);
+        if (current) {
+            this.requests.set(requestId, {
+                ...current,
+                status: resolution.status,
+                ...(resolution.answer ? { answer: (0, redactSecrets_1.redactSecrets)(resolution.answer) } : {}),
+                ...(resolution.receivedAt ? { receivedAt: resolution.receivedAt } : {}),
+                ...(resolution.fallbackUsed ? { fallbackIfTimeout: resolution.fallbackUsed } : {}),
+            });
+        }
+        this.activeRequestId = null;
+    }
+    async enqueue(request) {
+        this.requests.set(request.requestId, request);
+        this.requestQueue.push(request.requestId);
+    }
+    async dequeueNext() {
+        const requestId = this.requestQueue.shift();
+        return requestId ? this.requests.get(requestId) ?? null : null;
+    }
+    async createMenuPayload(record, ttlSeconds) {
+        this.menuPayloads.set(record.key, { value: record, expiresAt: Date.now() + ttlSeconds * 1000 });
+    }
+    async getMenuPayload(key) {
+        return this.readExpiring(this.menuPayloads, key);
+    }
+    async getUserLocale(telegramUserId) {
+        return this.locales.get(telegramUserId) ?? null;
+    }
+    async setUserLocale(telegramUserId, locale) {
+        this.locales.set(telegramUserId, locale);
+    }
+    async isAdminAuthorized(principal) {
+        return this.authorizedPrincipals.has(principalKey(principal));
+    }
+    async setAdminAuthorized(principal) {
+        this.authorizedPrincipals.set(principalKey(principal), principal);
+    }
+    async clearAdminAuthorized(principal) {
+        this.authorizedPrincipals.delete(principalKey(principal));
+    }
+    async listAdminAuthorizedPrincipals() {
+        return Array.from(this.authorizedPrincipals.values());
+    }
+    async setXchangeFileMeta(meta) {
+        this.xchangeFileMetas.set(xchangeKey(meta.sessionId, meta.filePath), meta);
+    }
+    async listXchangeFileMetas(sessionId) {
+        return Array.from(this.xchangeFileMetas.values())
+            .filter((meta) => meta.sessionId === sessionId)
+            .sort((left, right) => right.uploadedAt.localeCompare(left.uploadedAt));
+    }
+    async getXchangeFileMeta(sessionId, filePath) {
+        return this.xchangeFileMetas.get(xchangeKey(sessionId, filePath)) ?? null;
+    }
+    async deleteXchangeFileMeta(sessionId, filePath) {
+        return this.xchangeFileMetas.delete(xchangeKey(sessionId, filePath));
+    }
+    async pruneAll() {
+        const deletedKeys = this.countEntries();
+        this.pairCodes.clear();
+        this.bindings.clear();
+        this.principalSessions.clear();
+        this.principalActiveSessions.clear();
+        this.locales.clear();
+        this.authorizedPrincipals.clear();
+        this.requests.clear();
+        this.requestQueue.length = 0;
+        this.activeRequestId = null;
+        this.menuPayloads.clear();
+        this.xchangeFileMetas.clear();
+        this.browserAttachments.clear();
+        this.browserRecordings.clear();
+        this.projectMenuViews.clear();
+        this.outgoingNotices.clear();
+        this.gatewayClientUuid = null;
+        return { deletedKeys };
+    }
+    async getGatewayClientUuid() { return this.gatewayClientUuid; }
+    async setGatewayClientUuid(clientUuid) {
+        this.gatewayClientUuid = clientUuid;
+        this.onGatewayClientUuidChange?.(clientUuid);
+    }
+    async getBrowserAttachment(sessionId) {
+        return this.browserAttachments.get(sessionId) ?? null;
+    }
+    async setBrowserAttachment(record) {
+        this.browserAttachments.set(record.sessionId, record);
+    }
+    async clearBrowserAttachment(sessionId) { this.browserAttachments.delete(sessionId); }
+    async getBrowserRecording(sessionId) {
+        return this.browserRecordings.get(sessionId) ?? null;
+    }
+    async setBrowserRecording(record) {
+        this.browserRecordings.set(record.sessionId, record);
+    }
+    async clearBrowserRecording(sessionId) { this.browserRecordings.delete(sessionId); }
+    async setProjectMenuViewState(state) {
+        this.projectMenuViews.set(xchangeKey(state.projectUuid, state.sessionId), state);
+    }
+    async listProjectMenuViewStates(projectUuid) {
+        return Array.from(this.projectMenuViews.values()).filter((state) => state.projectUuid === projectUuid);
+    }
+    async deleteProjectMenuViewState(sessionId, projectUuid) {
+        return this.projectMenuViews.delete(xchangeKey(projectUuid, sessionId));
+    }
+    async setOutgoingDeliveryNotice(notice) {
+        this.outgoingNotices.set(notice.deliveryUuid, notice);
+    }
+    async listOutgoingDeliveryNotices() {
+        return Array.from(this.outgoingNotices.values());
+    }
+    async deleteOutgoingDeliveryNotice(deliveryUuid) {
+        return this.outgoingNotices.delete(deliveryUuid);
+    }
+    readExpiring(store, key) {
+        const record = store.get(key);
+        if (!record)
+            return null;
+        if (record.expiresAt <= Date.now()) {
+            store.delete(key);
+            return null;
+        }
+        return record.value;
+    }
+    detachSession(principal, sessionId) {
+        const key = principalKey(principal);
+        const sessions = this.principalSessions.get(key);
+        sessions?.delete(sessionId);
+        if (!sessions?.size)
+            this.principalSessions.delete(key);
+        if (this.principalActiveSessions.get(key) === sessionId) {
+            const next = sessions?.values().next().value;
+            if (next)
+                this.principalActiveSessions.set(key, next);
+            else
+                this.principalActiveSessions.delete(key);
+        }
+    }
+    countEntries() {
+        return this.pairCodes.size + this.bindings.size + this.locales.size +
+            this.authorizedPrincipals.size + this.requests.size + this.menuPayloads.size +
+            this.xchangeFileMetas.size + this.browserAttachments.size + this.browserRecordings.size +
+            this.projectMenuViews.size + this.outgoingNotices.size + (this.gatewayClientUuid ? 1 : 0);
+    }
+}
+exports.ProcessLocalStateStore = ProcessLocalStateStore;

package/dist/services/features/telegram-mcp/src/shared/integrations/object-storage/minioExchangeStore.js

@@ -29,7 +29,7 @@ class MinioExchangeStore {
     terminalConfig;
     exchangeDirName;
     logger;
-    constructor(_callBroker, _bindingStore, terminalConfig, exchangeDirName, _vfsScope, logger, _distributedMode = "client", _gatewayPublicUrl, _gatewayAuthToken) {
+    constructor(terminalConfig, exchangeDirName, logger) {
         this.terminalConfig = terminalConfig;
         this.exchangeDirName = exchangeDirName;
         this.logger = logger;

package/dist/services/features/telegram-mcp/src/shared/integrations/telegram/transport.js

@@ -6,6 +6,7 @@ const promises_1 = require("node:fs/promises");
 const grammy_1 = require("grammy");
 const telegramXchangeRecords_1 = require("../../lib/telegramXchangeRecords");
 const collabSemantics_1 = require("./collabSemantics");
+const bodyLimits_1 = require("../../lib/bodyLimits");
 const transportFormatting_1 = require("./transportFormatting");
 const transportConstructorWiring_1 = require("./transportConstructorWiring");
 const transportUtils_1 = require("./transportUtils");
@@ -217,7 +218,7 @@ class TelegramTransport {
     }
     isAdminAuthEnabled() {
         return (this.isAdminBotProfile() &&
-            Boolean(this.config.distributed.gatewayToken?.trim()));
+            Boolean(this.config.distributed.gatewayScopeToken?.trim()));
     }
     isAdminBotProfile() {
         return this.config.distributed.mode === "gateway";
@@ -383,6 +384,8 @@ class TelegramTransport {
     }
     async sendDocumentToChat(telegramChatId, filePath, caption) {
         this.ensureTelegramEnabledFor("send Telegram documents");
+        const fileStats = await (0, promises_1.stat)(filePath);
+        (0, bodyLimits_1.assertBodySize)(fileStats.size);
         const fileBuffer = await (0, promises_1.readFile)(filePath);
         const response = await this.bot.api.sendDocument(telegramChatId, new grammy_1.InputFile(fileBuffer, (0, node_path_1.basename)(filePath)), caption?.trim()
             ? {

package/dist/services/features/telegram-mcp/src/shared/integrations/telegram/transportConsoleRegistry.js

@@ -26,8 +26,8 @@ class TransportConsoleRegistry {
             ...(input?.principal
                 ? { telegram_user_id: input.principal.telegramUserId }
                 : {}),
-            ...(this.host.config.distributed.gatewayToken
-                ? { gateway_token: this.host.config.distributed.gatewayToken }
+            ...(this.host.config.distributed.gatewayScopeToken
+                ? { gateway_token: this.host.config.distributed.gatewayScopeToken }
                 : {}),
         });
         return Array.isArray(response.sessions) ? response.sessions : [];

package/dist/services/features/telegram-mcp/src/shared/integrations/telegram/transportFileHandoffActions.js

@@ -11,6 +11,7 @@ const xchangeRecordHints_1 = require("../../lib/xchangeRecordHints");
 const sqliteRecordStore_1 = require("../xchange/sqliteRecordStore");
 const client_1 = require("../terminal/client");
 const transportUtils_1 = require("./transportUtils");
+const bodyLimits_1 = require("../../lib/bodyLimits");
 class TransportFileHandoffActions {
     host;
     constructor(host) {
@@ -316,12 +317,12 @@ class TransportFileHandoffActions {
             ...(meta?.relativePath ? { relativePath: meta.relativePath } : {}),
             ...(meta?.storageRef ? { storageRef: meta.storageRef } : {}),
         });
-        const fileContent = await (0, client_1.readWorkspaceFile)(this.host.config.terminal, this.host.objectStore.resolveWorkspaceDir(session), localFilePath);
+        const fileContent = await (0, client_1.readWorkspaceFile)(this.host.config.terminal, this.host.objectStore.resolveWorkspaceDir(session), localFilePath, bodyLimits_1.MAX_BASE64_SOURCE_SIZE_BYTES);
         const handoffSummary = input.description
             .split(/\r?\n/u)
             .map((line) => line.trim())
             .find(Boolean) ?? `Передача файла: ${fileName}`;
-        return this.host.sendPartnerNote({
+        const note = {
             session_id: input.sessionId,
             ...(input.targetSessionId ? { target_session_id: input.targetSessionId } : {}),
             ...(input.projectUuid ? { project_uuid: input.projectUuid } : {}),
@@ -346,7 +347,9 @@ class TransportFileHandoffActions {
                     content_base64: node_buffer_1.Buffer.from(fileContent).toString("base64"),
                 },
             ],
-        });
+        };
+        (0, bodyLimits_1.assertSerializedBodySize)(note);
+        return this.host.sendPartnerNote(note);
     }
 }
 exports.TransportFileHandoffActions = TransportFileHandoffActions;

package/dist/services/features/telegram-mcp/src/shared/integrations/telegram/transportMessageFlow.js

@@ -73,7 +73,7 @@ class TransportMessageFlow {
                 await this.host.replyText(ctx, await this.host.tForContext(ctx, "menu:admin.auth.disabled"), { sessionId: "gateway-auth", kind: "transport" });
                 return true;
             }
-            if (authToken !== this.host.config.distributed.gatewayToken) {
+            if (authToken !== this.host.config.distributed.gatewayScopeToken) {
                 await this.host.replyText(ctx, await this.host.tForContext(ctx, "menu:admin.auth.invalid"), { sessionId: "gateway-auth", kind: "transport" });
                 return true;
             }

package/dist/services/features/telegram-mcp/src/shared/integrations/telegram/transportProjectState.js

@@ -46,8 +46,8 @@ class TransportProjectState {
                 this.host.config.telegram.botUsername ||
                 "telegram-mcp client",
             bot_username: this.host.config.telegram.botUsername,
-            ...(this.host.config.distributed.gatewayToken
-                ? { gateway_token: this.host.config.distributed.gatewayToken }
+            ...(this.host.config.distributed.gatewayScopeToken
+                ? { gateway_token: this.host.config.distributed.gatewayScopeToken }
                 : {}),
             meta: {
                 telegram_chat_id: principal.telegramChatId,

package/dist/services/features/telegram-mcp/src/shared/integrations/terminal/client.js

@@ -9,6 +9,7 @@ exports.writeXchangeRelativeFile = writeXchangeRelativeFile;
 exports.listXchangeFiles = listXchangeFiles;
 exports.deleteXchangeFile = deleteXchangeFile;
 exports.readWorkspaceFile = readWorkspaceFile;
+exports.resolveWorkspaceFileForRead = resolveWorkspaceFileForRead;
 exports.isTerminalUnavailableError = isTerminalUnavailableError;
 exports.isTerminalTargetInvalidError = isTerminalTargetInvalidError;
 exports.getConfiguredTerminalShell = getConfiguredTerminalShell;
@@ -31,6 +32,7 @@ exports.subscribeForegroundTerminal = subscribeForegroundTerminal;
 exports.stopAllForegroundTerminals = stopAllForegroundTerminals;
 const promises_1 = require("node:fs/promises");
 const node_path_1 = __importDefault(require("node:path"));
+const bodyLimits_1 = require("../../lib/bodyLimits");
 const ptyRegistry_1 = require("../terminal/ptyRegistry");
 const ENTER_AFTER_PASTE_DELAY_MS = 75;
 function toPtyConfig(config) {
@@ -93,9 +95,7 @@ async function allocateAvailableFilePath(dir, fileName) {
     const extension = node_path_1.default.extname(safeFileName);
     const baseName = node_path_1.default.basename(safeFileName, extension);
     for (let attempt = 0; attempt < 1000; attempt += 1) {
-        const candidateName = attempt === 0
-            ? safeFileName
-            : `${baseName}--${attempt}${extension}`;
+        const candidateName = attempt === 0 ? safeFileName : `${baseName}--${attempt}${extension}`;
         const candidatePath = node_path_1.default.join(dir, candidateName);
         try {
             await (0, promises_1.access)(candidatePath);
@@ -172,9 +172,32 @@ async function deleteXchangeFile(config, workspaceDir, exchangeDirName, filePath
     await (0, promises_1.rm)(resolvedFilePath, { force: true });
     return true;
 }
-async function readWorkspaceFile(config, workspaceDir, filePath) {
+async function readWorkspaceFile(config, workspaceDir, filePath, maxBytes = bodyLimits_1.MAX_BODY_SIZE_BYTES) {
+    const resolved = await resolveWorkspaceFileForRead(config, workspaceDir, filePath, maxBytes);
+    return (0, promises_1.readFile)(resolved.filePath);
+}
+async function resolveWorkspaceFileForRead(config, workspaceDir, filePath, maxBytes = bodyLimits_1.MAX_BODY_SIZE_BYTES) {
+    void config;
     const resolvedFilePath = resolvePathInsideWorkspace(workspaceDir, filePath);
-    return (0, promises_1.readFile)(resolvedFilePath);
+    const [realWorkspaceDir, realFilePath] = await Promise.all([
+        (0, promises_1.realpath)(node_path_1.default.resolve(workspaceDir)),
+        (0, promises_1.realpath)(resolvedFilePath),
+    ]);
+    const relative = node_path_1.default.relative(realWorkspaceDir, realFilePath);
+    if (relative.startsWith("..") ||
+        node_path_1.default.isAbsolute(relative) ||
+        relative.trim() === "") {
+        throw new Error("File path is outside the workspace directory.");
+    }
+    const fileStats = await (0, promises_1.stat)(realFilePath);
+    if (!fileStats.isFile()) {
+        throw new Error("File path does not point to a regular file.");
+    }
+    (0, bodyLimits_1.assertBodySize)(fileStats.size, maxBytes);
+    return {
+        filePath: realFilePath,
+        sizeBytes: fileStats.size,
+    };
 }
 function isTerminalUnavailableError(error) {
     const message = error instanceof Error ? (error.stack ?? error.message) : String(error);
@@ -202,7 +225,7 @@ function ensureTerminalTargetForSession(config, input) {
 }
 async function resolveTerminalTargetFromHint(config, hint) {
     const target = hint.terminalTarget?.trim() || (0, ptyRegistry_1.buildPtyTarget)("default");
-    return (0, ptyRegistry_1.hasPtyTarget)(target) ? target : hint.terminalTarget?.trim() ?? null;
+    return (0, ptyRegistry_1.hasPtyTarget)(target) ? target : (hint.terminalTarget?.trim() ?? null);
 }
 async function getTerminalWindowHeight(config, target) {
     return (0, ptyRegistry_1.getPtyWindowHeight)(target);