@deadragdoll/tellymcp 0.0.13 → 0.0.15

package/dist/services/features/telegram-mcp/mcp-server.service.js

@@ -5,16 +5,20 @@ const server_1 = require("./src/app/providers/mcp/server");
 const approval_service_1 = require("./approval.service");
 const browser_service_1 = require("./browser.service");
 const collaboration_service_1 = require("./collaboration.service");
+const file_content_service_1 = require("./file-content.service");
 const notify_service_1 = require("./notify.service");
 const session_context_service_1 = require("./session-context.service");
 const tools_sync_service_1 = require("./tools-sync.service");
 const xchange_service_1 = require("./xchange.service");
 const askUserTelegram_1 = require("./src/features/ask-user/model/askUserTelegram");
+const browserAttachActiveTabTool_1 = require("./src/features/browser/model/browserAttachActiveTabTool");
+const browserAttachTabTool_1 = require("./src/features/browser/model/browserAttachTabTool");
 const browserClickTool_1 = require("./src/features/browser/model/browserClickTool");
 const browserClearLogsTool_1 = require("./src/features/browser/model/browserClearLogsTool");
 const browserCloseTool_1 = require("./src/features/browser/model/browserCloseTool");
 const browserComputedStyleTool_1 = require("./src/features/browser/model/browserComputedStyleTool");
 const browserConsoleTool_1 = require("./src/features/browser/model/browserConsoleTool");
+const browserDetachTabTool_1 = require("./src/features/browser/model/browserDetachTabTool");
 const browserDomTool_1 = require("./src/features/browser/model/browserDomTool");
 const browserErrorsTool_1 = require("./src/features/browser/model/browserErrorsTool");
 const browserFillTool_1 = require("./src/features/browser/model/browserFillTool");
@@ -34,9 +38,12 @@ const browserWaitForUrlTool_1 = require("./src/features/browser/model/browserWai
 const sendPartnerFileTool_1 = require("./src/features/collaboration/model/sendPartnerFileTool");
 const listGatewaySessionsTool_1 = require("./src/features/collaboration/model/listGatewaySessionsTool");
 const sendPartnerNoteTool_1 = require("./src/features/collaboration/model/sendPartnerNoteTool");
+const getFileTool_1 = require("./src/features/file-content/model/getFileTool");
+const getFileListTool_1 = require("./src/features/file-content/model/getFileListTool");
 const sendFileToTelegramTool_1 = require("./src/features/notify/model/sendFileToTelegramTool");
 const notifyTelegramTool_1 = require("./src/features/notify/model/notifyTelegramTool");
 const clearSessionContextTool_1 = require("./src/features/session-context/model/clearSessionContextTool");
+const getRuntimeDiagnosticsTool_1 = require("./src/features/session-context/model/getRuntimeDiagnosticsTool");
 const getSessionContextTool_1 = require("./src/features/session-context/model/getSessionContextTool");
 const renameSessionTool_1 = require("./src/features/session-context/model/renameSessionTool");
 const setSessionContextTool_1 = require("./src/features/session-context/model/setSessionContextTool");
@@ -53,6 +60,7 @@ const TelegramMcpMcpServerService = {
         approval_service_1.TELEGRAM_MCP_APPROVAL_SERVICE_NAME,
         browser_service_1.TELEGRAM_MCP_BROWSER_SERVICE_NAME,
         collaboration_service_1.TELEGRAM_MCP_COLLABORATION_SERVICE_NAME,
+        file_content_service_1.TELEGRAM_MCP_FILE_CONTENT_SERVICE_NAME,
         tools_sync_service_1.TELEGRAM_MCP_TOOLS_SYNC_SERVICE_NAME,
         xchange_service_1.TELEGRAM_MCP_XCHANGE_SERVICE_NAME,
     ],
@@ -63,6 +71,7 @@ const TelegramMcpMcpServerService = {
             const approvalService = this.broker.getLocalService(approval_service_1.TELEGRAM_MCP_APPROVAL_SERVICE_NAME);
             const browserService = this.broker.getLocalService(browser_service_1.TELEGRAM_MCP_BROWSER_SERVICE_NAME);
             const collaborationService = this.broker.getLocalService(collaboration_service_1.TELEGRAM_MCP_COLLABORATION_SERVICE_NAME);
+            const fileContentService = this.broker.getLocalService(file_content_service_1.TELEGRAM_MCP_FILE_CONTENT_SERVICE_NAME);
             const toolsSyncService = this.broker.getLocalService(tools_sync_service_1.TELEGRAM_MCP_TOOLS_SYNC_SERVICE_NAME);
             const xchangeService = this.broker.getLocalService(xchange_service_1.TELEGRAM_MCP_XCHANGE_SERVICE_NAME);
             if (!sessionContextService ||
@@ -70,6 +79,7 @@ const TelegramMcpMcpServerService = {
                 !approvalService ||
                 !browserService ||
                 !collaborationService ||
+                !fileContentService ||
                 !toolsSyncService ||
                 !xchangeService) {
                 throw new Error("telegram_mcp MCP server dependencies are not ready");
@@ -78,12 +88,16 @@ const TelegramMcpMcpServerService = {
                 new setSessionContextTool_1.SetSessionContextTool(sessionContextService.getSessionContextService()),
                 new renameSessionTool_1.RenameSessionTool(sessionContextService.getSessionContextService()),
                 new getSessionContextTool_1.GetSessionContextTool(sessionContextService.getSessionContextService()),
+                new getRuntimeDiagnosticsTool_1.GetRuntimeDiagnosticsTool(sessionContextService.getSessionContextService()),
                 new clearSessionContextTool_1.ClearSessionContextTool(sessionContextService.getSessionContextService()),
                 new notifyTelegramTool_1.NotifyTelegramTool(notifyService.getNotifyService()),
                 new sendFileToTelegramTool_1.SendFileToTelegramTool(notifyService.getNotifyService()),
                 new askUserTelegram_1.AskUserTelegramTool(approvalService.getApprovalOrchestrator()),
                 new browserListAttachedInstancesTool_1.BrowserListAttachedInstancesTool(browserService.getBrowserService()),
                 new browserListTabsTool_1.BrowserListTabsTool(browserService.getBrowserService()),
+                new browserAttachActiveTabTool_1.BrowserAttachActiveTabTool(browserService.getBrowserService()),
+                new browserAttachTabTool_1.BrowserAttachTabTool(browserService.getBrowserService()),
+                new browserDetachTabTool_1.BrowserDetachTabTool(browserService.getBrowserService()),
                 new browserRecordingStartTool_1.BrowserRecordingStartTool(browserService.getBrowserService()),
                 new browserRecordingStopTool_1.BrowserRecordingStopTool(browserService.getBrowserService()),
                 new browserRecordingStatusTool_1.BrowserRecordingStatusTool(browserService.getBrowserService()),
@@ -106,11 +120,16 @@ const TelegramMcpMcpServerService = {
                 new sendPartnerNoteTool_1.SendPartnerNoteTool(collaborationService.getCollaborationService()),
                 new listGatewaySessionsTool_1.ListGatewaySessionsTool(collaborationService.getGatewaySessionsService()),
                 new sendPartnerFileTool_1.SendPartnerFileTool(collaborationService.getSendPartnerFileService()),
+                new getFileTool_1.GetFileTool(fileContentService.getGetFileService()),
+                new getFileListTool_1.GetFileListTool(fileContentService.getGetFileService()),
                 new listXchangeRecordsTool_1.ListXchangeRecordsTool(xchangeService.getXchangeService()),
                 new getXchangeRecordTool_1.GetXchangeRecordTool(xchangeService.getXchangeService()),
                 new markXchangeRecordReadTool_1.MarkXchangeRecordReadTool(xchangeService.getXchangeService()),
                 new refreshToolsMarkdownTool_1.RefreshToolsMarkdownTool(toolsSyncService.getRefreshToolsMarkdownService()),
             ];
+            this.logger.info("telegram_mcp MCP server instance created", {
+                toolCount: tools.length,
+            });
             return (0, server_1.createMcpServer)(tools);
         },
     },
@@ -121,6 +140,7 @@ const TelegramMcpMcpServerService = {
             approval_service_1.TELEGRAM_MCP_APPROVAL_SERVICE_NAME,
             browser_service_1.TELEGRAM_MCP_BROWSER_SERVICE_NAME,
             collaboration_service_1.TELEGRAM_MCP_COLLABORATION_SERVICE_NAME,
+            file_content_service_1.TELEGRAM_MCP_FILE_CONTENT_SERVICE_NAME,
             tools_sync_service_1.TELEGRAM_MCP_TOOLS_SYNC_SERVICE_NAME,
             xchange_service_1.TELEGRAM_MCP_XCHANGE_SERVICE_NAME,
         ]);

package/dist/services/features/telegram-mcp/session-context.service.js

@@ -4,6 +4,7 @@ exports.TELEGRAM_MCP_SESSION_CONTEXT_SERVICE_NAME = void 0;
 const runtime_service_1 = require("./runtime.service");
 const remoteConsoleActionClient_1 = require("./src/features/distributed-gateway/model/remoteConsoleActionClient");
 const sessionContextService_1 = require("./src/features/session-context/model/sessionContextService");
+const versionHandshake_1 = require("./src/shared/lib/version/versionHandshake");
 exports.TELEGRAM_MCP_SESSION_CONTEXT_SERVICE_NAME = "telegramMcp.sessionContext";
 const TelegramMcpSessionContextService = {
     name: exports.TELEGRAM_MCP_SESSION_CONTEXT_SERVICE_NAME,
@@ -15,6 +16,12 @@ const TelegramMcpSessionContextService = {
                 return this.getSessionContextService().getContext(ctx.params);
             },
         },
+        getRuntimeDiagnosticsRemote: {
+            params: { $$strict: false },
+            async handler(ctx) {
+                return this.getSessionContextService().getRuntimeDiagnostics(ctx.params);
+            },
+        },
         setContextRemote: {
             params: { $$strict: false },
             async handler(ctx) {
@@ -53,7 +60,24 @@ const TelegramMcpSessionContextService = {
         }
         const runtime = await runtimeService.waitUntilReady();
         this.logger.info("Starting telegram_mcp session-context service");
-        this.sessionContextService = new sessionContextService_1.SessionContextService(runtime.sessionStore, runtime.stateStore, runtime.logger, runtime.projectIdentityResolver, new remoteConsoleActionClient_1.RemoteConsoleActionClient((actionName, params) => this.broker.call(actionName, params, { meta: { internal_call: true } })));
+        this.sessionContextService = new sessionContextService_1.SessionContextService(runtime.sessionStore, runtime.stateStore, runtime.logger, runtime.projectIdentityResolver, runtime.config.distributed.mode === "client"
+            ? undefined
+            : new remoteConsoleActionClient_1.RemoteConsoleActionClient((actionName, params) => this.broker.call(actionName, params, {
+                meta: { internal_call: true },
+            })), {
+            mode: runtime.config.distributed.mode,
+            packageVersion: (0, versionHandshake_1.getTellyMcpPackageVersion)(__dirname),
+            protocolVersion: versionHandshake_1.TELLYMCP_PROTOCOL_VERSION,
+            ...(process.env.NODE_ID?.trim()
+                ? { nodeId: process.env.NODE_ID.trim() }
+                : {}),
+            gatewayWsUrlConfigured: Boolean(runtime.config.distributed.gatewayWsUrl),
+            gatewayAuthConfigured: Boolean(runtime.config.distributed.gatewayAuthToken ||
+                runtime.config.distributed.gatewayScopeToken),
+            ...(runtime.redis
+                ? { pingRedis: async () => await runtime.redis.ping() }
+                : {}),
+        });
         this.logger.info("telegram_mcp session-context service is ready");
     },
 };

package/dist/services/features/telegram-mcp/src/app/bootstrap/runtime.js

@@ -8,11 +8,13 @@ const logger_1 = require("../../shared/lib/logger/logger");
 const projectIdentity_1 = require("../../shared/lib/project-identity/projectIdentity");
 const stateStore_1 = require("../../shared/integrations/redis/stateStore");
 const processLocalSessionStore_1 = require("../../shared/integrations/memory/processLocalSessionStore");
+const processLocalStateStore_1 = require("../../shared/integrations/memory/processLocalStateStore");
 const transport_1 = require("../../shared/integrations/telegram/transport");
 const minioExchangeStore_1 = require("../../shared/integrations/object-storage/minioExchangeStore");
 const gatewayHttpService_1 = require("../../features/distributed-gateway/model/gatewayHttpService");
 const gatewayClientAccess_1 = require("../../features/distributed-client/model/gatewayClientAccess");
 const firefoxAttachServer_1 = require("../../features/browser-attach/model/firefoxAttachServer");
+const temporaryFileLinkStore_1 = require("../../features/file-content/model/temporaryFileLinkStore");
 const client_2 = require("../../shared/integrations/terminal/client");
 const ptyRegistry_1 = require("../../shared/integrations/terminal/ptyRegistry");
 async function createAppRuntime(input) {
@@ -21,11 +23,14 @@ async function createAppRuntime(input) {
     const projectIdentityResolver = new projectIdentity_1.ProjectIdentityResolver(config, logger);
     logger.info("Configuration loaded", {
         mode: config.mode,
-        redis: {
-            host: config.redis.host,
-            port: config.redis.port,
-            db: config.redis.db,
-        },
+        state: config.distributed.mode === "client"
+            ? { backend: "process-local" }
+            : {
+                backend: "redis",
+                host: config.redis.host,
+                port: config.redis.port,
+                db: config.redis.db,
+            },
         logging: {
             level: config.logging.level,
         },
@@ -34,19 +39,16 @@ async function createAppRuntime(input) {
             httpPort: config.mcp.httpPort,
             httpPath: config.mcp.httpPath,
             bearerAuthEnabled: Boolean(config.mcp.bearerToken),
+            oauthConnectorEnabled: Boolean(config.oauth),
             enableDebugRoutes: config.mcp.enableDebugRoutes,
             enablePruneRoute: config.mcp.enablePruneRoute,
         },
         distributed: {
             mode: config.distributed.mode,
             gatewayPublicUrlConfigured: Boolean(config.distributed.gatewayPublicUrl),
-            gatewayBindHost: config.distributed.gatewayBindHost,
-            gatewayBindPort: config.distributed.gatewayBindPort,
             gatewayWsUrlConfigured: Boolean(config.distributed.gatewayWsUrl),
             gatewayWsPath: config.distributed.gatewayWsPath,
             gatewayAuthEnabled: Boolean(config.distributed.gatewayAuthToken),
-            gatewayDatabaseConfigured: Boolean(config.distributed.gatewayDatabaseUrl),
-            gatewayS3Configured: Boolean(config.distributed.gatewayS3Bucket),
             gatewayRmqConfigured: Boolean(config.distributed.rmq?.host),
         },
         webapp: {
@@ -56,7 +58,6 @@ async function createAppRuntime(input) {
             initDataTtlSeconds: config.webapp.initDataTtlSeconds,
             sessionTtlSeconds: config.webapp.sessionTtlSeconds,
             launchMode: config.webapp.launchMode,
-            pollIntervalMs: config.webapp.pollIntervalMs,
             actionCooldownMs: config.webapp.actionCooldownMs,
         },
         terminal: {
@@ -81,81 +82,85 @@ async function createAppRuntime(input) {
         },
         project: projectIdentityResolver.getIdentity(),
     });
-    const redis = await (0, client_1.createRedisClient)(config);
-    logger.info("Redis connected", {
-        host: config.redis.host,
-        port: config.redis.port,
-        db: config.redis.db,
-    });
-    const stateStore = new stateStore_1.RedisStateStore(redis);
-    let sessionStore = stateStore;
+    let redis = null;
+    let stateStore;
+    let sessionStore;
+    if (config.distributed.mode === "client") {
+        const resolvedSession = projectIdentityResolver.resolveSessionDefaults({ cwd: process.cwd() });
+        const marker = (0, projectIdentity_1.readSessionMarkerState)(resolvedSession.cwd, logger);
+        stateStore = new processLocalStateStore_1.ProcessLocalStateStore({
+            ...(marker?.gatewayClientUuid
+                ? { gatewayClientUuid: marker.gatewayClientUuid }
+                : {}),
+            onGatewayClientUuidChange: (gatewayClientUuid) => {
+                (0, projectIdentity_1.writeSessionMarkerState)({
+                    cwd: resolvedSession.cwd,
+                    localSessionId: resolvedSession.sessionId,
+                    sessionLabel: resolvedSession.sessionLabel,
+                    ...(marker?.envFile ? { envFile: marker.envFile } : {}),
+                    ...(marker?.lastSeenToolsHash
+                        ? { lastSeenToolsHash: marker.lastSeenToolsHash }
+                        : {}),
+                    ...(marker?.lastNotifiedToolsHash
+                        ? { lastNotifiedToolsHash: marker.lastNotifiedToolsHash }
+                        : {}),
+                    gatewayClientUuid,
+                    logger,
+                });
+            },
+        });
+        sessionStore = new processLocalSessionStore_1.ProcessLocalSessionStore();
+        logger.info("Client process-local state store initialized", {
+            gatewayClientUuidRestored: Boolean(marker?.gatewayClientUuid),
+        });
+    }
+    else {
+        redis = await (0, client_1.createRedisClient)(config);
+        logger.info("Redis connected", {
+            host: config.redis.host,
+            port: config.redis.port,
+            db: config.redis.db,
+        });
+        const redisStateStore = new stateStore_1.RedisStateStore(redis);
+        stateStore = redisStateStore;
+        sessionStore = redisStateStore;
+    }
     const webAppLaunchRegistry = new auth_1.WebAppLaunchRegistry();
-    const objectStore = new minioExchangeStore_1.MinioExchangeStore(input.callBroker, stateStore, config.terminal, config.exchange.dir, config.mcp.vfsScope, logger, config.distributed.mode, config.distributed.gatewayPublicUrl, config.distributed.gatewayAuthToken);
+    const objectStore = new minioExchangeStore_1.MinioExchangeStore(config.terminal, config.exchange.dir, logger);
     if (config.distributed.mode === "client") {
         const resolvedSession = projectIdentityResolver.resolveSessionDefaults({
             cwd: process.cwd(),
         });
-        const existingSession = await stateStore.getSession(resolvedSession.sessionId);
         const persistedToolsState = (0, projectIdentity_1.readSessionMarkerState)(resolvedSession.cwd, logger);
         const terminalTarget = (0, client_2.ensureTerminalTargetForSession)(config.terminal, {
             sessionId: resolvedSession.sessionId,
             cwd: resolvedSession.cwd,
-            ...(typeof existingSession?.terminalTarget === "string"
-                ? { target: existingSession.terminalTarget }
-                : {}),
         });
         if (!terminalTarget) {
             throw new Error("PTY terminal target could not be created during runtime bootstrap");
         }
         const initialSession = {
             sessionId: resolvedSession.sessionId,
-            ...(typeof existingSession?.label === "string"
-                ? { label: existingSession.label }
-                : { label: resolvedSession.sessionLabel }),
-            ...(typeof existingSession?.cwd === "string"
-                ? { cwd: existingSession.cwd }
-                : { cwd: resolvedSession.cwd }),
-            ...(typeof existingSession?.activeProjectUuid === "string"
-                ? { activeProjectUuid: existingSession.activeProjectUuid }
-                : {}),
-            ...(typeof existingSession?.activeProjectName === "string"
-                ? { activeProjectName: existingSession.activeProjectName }
-                : {}),
-            ...(typeof existingSession?.task === "string"
-                ? { task: existingSession.task }
-                : {}),
-            ...(typeof existingSession?.summary === "string"
-                ? { summary: existingSession.summary }
-                : {}),
-            ...(Array.isArray(existingSession?.files)
-                ? { files: existingSession.files }
-                : {}),
-            ...(Array.isArray(existingSession?.decisions)
-                ? { decisions: existingSession.decisions }
-                : {}),
-            ...(Array.isArray(existingSession?.risks)
-                ? { risks: existingSession.risks }
-                : {}),
+            label: resolvedSession.sessionLabel,
+            cwd: resolvedSession.cwd,
             terminalTarget: terminalTarget,
-            ...(typeof existingSession?.lastTerminalNudgeAt === "string"
-                ? { lastTerminalNudgeAt: existingSession.lastTerminalNudgeAt }
+            ...(typeof persistedToolsState?.lastSeenToolsHash === "string"
+                ? { lastSeenToolsHash: persistedToolsState.lastSeenToolsHash }
+                : {}),
+            ...(typeof persistedToolsState?.lastNotifiedToolsHash === "string"
+                ? { lastNotifiedToolsHash: persistedToolsState.lastNotifiedToolsHash }
                 : {}),
-            ...(typeof existingSession?.lastSeenToolsHash === "string"
-                ? { lastSeenToolsHash: existingSession.lastSeenToolsHash }
-                : typeof persistedToolsState?.lastSeenToolsHash === "string"
-                    ? { lastSeenToolsHash: persistedToolsState.lastSeenToolsHash }
-                    : {}),
-            ...(typeof existingSession?.lastNotifiedToolsHash === "string"
-                ? { lastNotifiedToolsHash: existingSession.lastNotifiedToolsHash }
-                : typeof persistedToolsState?.lastNotifiedToolsHash === "string"
-                    ? { lastNotifiedToolsHash: persistedToolsState.lastNotifiedToolsHash }
-                    : {}),
             updatedAt: new Date().toISOString(),
         };
         sessionStore = new processLocalSessionStore_1.ProcessLocalSessionStore({
             initialSessions: [initialSession],
             onClearSession: async (sessionId) => {
-                await stateStore.clearSession(sessionId);
+                await stateStore.clearBinding(sessionId);
+                await stateStore.clearBrowserAttachment(sessionId);
+                await stateStore.clearBrowserRecording(sessionId);
+                for (const meta of await stateStore.listXchangeFileMetas(sessionId)) {
+                    await stateStore.deleteXchangeFileMeta(sessionId, meta.filePath);
+                }
             },
         });
         logger.info("Client PTY process-local session store initialized", {
@@ -174,8 +179,8 @@ async function createAppRuntime(input) {
                 : {}),
             ...(config.project.name ? { projectName: config.project.name } : {}),
             ...(config.telegram.botUsername ? { botUsername: config.telegram.botUsername } : {}),
-            ...(config.distributed.gatewayToken
-                ? { gatewayToken: config.distributed.gatewayToken }
+            ...(config.distributed.gatewayScopeToken
+                ? { gatewayScopeToken: config.distributed.gatewayScopeToken }
                 : {}),
             ...(config.distributed.gatewayUserUuid
                 ? { gatewayUserUuid: config.distributed.gatewayUserUuid }
@@ -210,7 +215,12 @@ async function createAppRuntime(input) {
     await telegramTransport.sendStartupNotifications();
     logger.info("Startup Telegram notifications completed");
     const gatewayHttpService = new gatewayHttpService_1.GatewayHttpService(config, input.callBroker);
-    const firefoxAttachServer = new firefoxAttachServer_1.FirefoxAttachServer(config, logger, stateStore, stateStore);
+    const temporaryFileLinkStore = config.distributed.mode !== "client" &&
+        config.distributed.gatewayPublicUrl?.trim()
+        ? new temporaryFileLinkStore_1.TemporaryFileLinkStore(config.distributed.gatewayPublicUrl, logger)
+        : null;
+    await temporaryFileLinkStore?.start();
+    const firefoxAttachServer = new firefoxAttachServer_1.FirefoxAttachServer(config, logger, sessionStore, stateStore);
     await firefoxAttachServer.start();
     return {
         callBroker: input.callBroker,
@@ -230,12 +240,14 @@ async function createAppRuntime(input) {
         webAppLaunchRegistry,
         gatewayHttpService,
         firefoxAttachServer,
+        temporaryFileLinkStore,
         shutdown: async () => {
             logger.info("Shutdown started");
+            await temporaryFileLinkStore?.stop();
             await firefoxAttachServer.stop();
             await telegramTransport.stop();
             (0, ptyRegistry_1.stopAllPtyTargets)();
-            redis.disconnect();
+            redis?.disconnect();
             logger.info("Shutdown completed");
         },
     };

package/dist/services/features/telegram-mcp/src/app/config/env.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadConfig = loadConfig;
 const node_fs_1 = require("node:fs");
 const z = __importStar(require("zod/v4"));
+const environmentContract_1 = require("./environmentContract");
 const emptyStringToUndefined = (value) => {
     if (typeof value !== "string") {
         return value;
@@ -79,13 +80,12 @@ const envSchema = z.object({
         .optional()
         .transform((value) => value === "true"),
     DEBUG_LANGUAGE: z.preprocess(emptyStringToUndefined, z.enum(["en", "ru"]).optional()),
-    REDIS_HOST: z.string().min(1),
-    REDIS_PORT: z.coerce.number().int().positive(),
-    REDIS_DB: z.coerce.number().int().nonnegative(),
+    REDIS_HOST: z.string().min(1).default("127.0.0.1"),
+    REDIS_PORT: z.coerce.number().int().positive().default(6379),
+    REDIS_DB: z.coerce.number().int().nonnegative().default(1),
     REDIS_USERNAME: optionalNonEmptyString,
     REDIS_PASSWORD: optionalNonEmptyString,
-    MODE: z.enum(["queue", "reject"]).default("queue"),
-    PAIR_CODE_TTL_SECONDS: z.coerce.number().int().positive().default(600),
+    TELEGRAM_REQUEST_MODE: z.enum(["queue", "reject"]).default("queue"),
     PROJECT_NAME: optionalNonEmptyString,
     TELLYMCP_SESSION_ID: optionalNonEmptyString,
     TELLYMCP_SESSION_LABEL: optionalNonEmptyString,
@@ -93,6 +93,22 @@ const envSchema = z.object({
     MCP_HTTP_PORT: z.coerce.number().int().positive().default(8787),
     MCP_HTTP_PATH: z.string().min(1).default("/mcp"),
     MCP_HTTP_BEARER_TOKEN: optionalNonEmptyString,
+    TELLYMCP_PUBLIC_URL: optionalUrlString,
+    TELLYMCP_OAUTH_ISSUER: optionalUrlString,
+    TELLYMCP_OAUTH_AUDIENCE: optionalUrlString,
+    TELLYMCP_MAGIC_TOKEN: optionalNonEmptyString,
+    TELLYMCP_MAGIC_TOKEN_HASH: optionalNonEmptyString,
+    TELLYMCP_OAUTH_CLIENT_ID: optionalNonEmptyString,
+    TELLYMCP_OAUTH_CLIENT_SECRET: optionalNonEmptyString,
+    TELLYMCP_ALLOWED_REDIRECT_URIS: optionalNonEmptyString,
+    TELLYMCP_OAUTH_PRIVATE_KEY_PEM: optionalNonEmptyString,
+    TELLYMCP_AUTH_CODE_TTL_SECONDS: z.coerce
+        .number()
+        .int()
+        .positive()
+        .default(300),
+    TELLYMCP_OAUTH_SCOPES: z.string().min(1).default("tellymcp:read tellymcp:write"),
+    TELLYMCP_OAUTH_KEY_ID: z.string().min(1).default("tellymcp-oauth"),
     MCP_HTTP_ENABLE_DEBUG_ROUTES: z
         .string()
         .optional()
@@ -101,24 +117,16 @@ const envSchema = z.object({
         .string()
         .optional()
         .transform((value) => value === "true"),
-    MCP_VFS_SCOPE: z.string().min(1).default("mcp"),
     DISTRIBUTED_MODE: z.enum(["client", "gateway", "both"]).default("client"),
     GATEWAY_PUBLIC_URL: optionalUrlString,
-    GATEWAY_BIND_HOST: z.string().min(1).default("127.0.0.1"),
-    GATEWAY_BIND_PORT: z.coerce.number().int().positive().default(8790),
     GATEWAY_WS_URL: optionalUrlString,
     GATEWAY_WS_PATH: z
         .string()
         .min(1)
         .default(`${(process.env.ROOT_PREFIX || "/api").replace(/\/+$/u, "")}/gateway/ws`),
-    GATEWAY_TOKEN: optionalNonEmptyString,
+    GATEWAY_SCOPE_TOKEN: optionalNonEmptyString,
     GATEWAY_USER_UUID: optionalNonEmptyString,
     GATEWAY_AUTH_TOKEN: optionalNonEmptyString,
-    GATEWAY_DATABASE_URL: optionalNonEmptyString,
-    GATEWAY_S3_ENDPOINT: optionalNonEmptyString,
-    GATEWAY_S3_BUCKET: optionalNonEmptyString,
-    GATEWAY_S3_ACCESS_KEY: optionalNonEmptyString,
-    GATEWAY_S3_SECRET_KEY: optionalNonEmptyString,
     RMQ_HOST: optionalNonEmptyString,
     RMQ_PORT: z.coerce.number().int().positive().optional(),
     RMQ_USER: optionalNonEmptyString,
@@ -145,7 +153,6 @@ const envSchema = z.object({
         .enum(["default", "expand", "fullscreen"])
         .default("fullscreen"),
     WEBAPP_VISIBLE_SCREENS: z.coerce.number().int().positive().default(2),
-    WEBAPP_POLL_INTERVAL_MS: z.coerce.number().int().positive().default(2000),
     WEBAPP_ACTION_COOLDOWN_MS: z.coerce.number().int().nonnegative().default(150),
     MCP_XCHANGE_DIR: z.string().min(1).default(".mcp-xchange"),
     TERMINAL_SHELL: z.string().min(1).default(process.env.SHELL || "bash"),
@@ -241,11 +248,22 @@ function loadConfig() {
     else if ((0, node_fs_1.existsSync)(".env")) {
         process.loadEnvFile(".env");
     }
+    (0, environmentContract_1.assertNoLegacyEnvironmentVariables)(process.env);
     const parsed = envSchema.parse(process.env);
     if (parsed.DISTRIBUTED_MODE !== "client" &&
         !parsed.TELEGRAM_BOT_TOKEN?.trim()) {
         throw new Error("TELEGRAM_BOT_TOKEN is required for gateway and both distributed modes.");
     }
+    const gatewayServerEnabled = parsed.DISTRIBUTED_MODE === "gateway" ||
+        parsed.DISTRIBUTED_MODE === "both";
+    const gatewayClientConfigured = parsed.DISTRIBUTED_MODE === "client" &&
+        Boolean(parsed.GATEWAY_PUBLIC_URL || parsed.GATEWAY_WS_URL);
+    if ((gatewayServerEnabled || gatewayClientConfigured) &&
+        !parsed.GATEWAY_AUTH_TOKEN?.trim()) {
+        throw new Error(gatewayServerEnabled
+            ? "GATEWAY_AUTH_TOKEN is required for gateway and both distributed modes."
+            : "GATEWAY_AUTH_TOKEN is required when a client connects to a gateway.");
+    }
     if (parsed.ADMIN_TOKEN?.trim() && !parsed.TELEGRAM_BOT_TOKEN?.trim()) {
         throw new Error("ADMIN_TOKEN requires TELEGRAM_BOT_TOKEN because admin mode runs through the gateway bot.");
     }
@@ -257,6 +275,69 @@ function loadConfig() {
             throw new Error("TELEGRAM_WEBHOOK_ENABLED=true requires TELEGRAM_WEBHOOK_SECRET.");
         }
     }
+    const oauthConfigured = Boolean(parsed.TELLYMCP_PUBLIC_URL ||
+        parsed.TELLYMCP_OAUTH_ISSUER ||
+        parsed.TELLYMCP_OAUTH_AUDIENCE ||
+        parsed.TELLYMCP_MAGIC_TOKEN ||
+        parsed.TELLYMCP_MAGIC_TOKEN_HASH ||
+        parsed.TELLYMCP_OAUTH_CLIENT_ID ||
+        parsed.TELLYMCP_OAUTH_CLIENT_SECRET ||
+        parsed.TELLYMCP_ALLOWED_REDIRECT_URIS ||
+        parsed.TELLYMCP_OAUTH_PRIVATE_KEY_PEM);
+    if (oauthConfigured && !parsed.TELLYMCP_PUBLIC_URL) {
+        throw new Error("TELLYMCP_PUBLIC_URL is required when OAuth connector settings are configured.");
+    }
+    if (oauthConfigured &&
+        !parsed.TELLYMCP_MAGIC_TOKEN &&
+        !parsed.TELLYMCP_MAGIC_TOKEN_HASH) {
+        throw new Error("TELLYMCP_MAGIC_TOKEN or TELLYMCP_MAGIC_TOKEN_HASH is required when OAuth is configured.");
+    }
+    if (parsed.TELLYMCP_MAGIC_TOKEN && parsed.TELLYMCP_MAGIC_TOKEN_HASH) {
+        throw new Error("Configure only one of TELLYMCP_MAGIC_TOKEN and TELLYMCP_MAGIC_TOKEN_HASH.");
+    }
+    if (parsed.TELLYMCP_MAGIC_TOKEN_HASH &&
+        !/^sha256:[a-f0-9]{64}$/iu.test(parsed.TELLYMCP_MAGIC_TOKEN_HASH)) {
+        throw new Error("TELLYMCP_MAGIC_TOKEN_HASH must use the format sha256:<64 hex characters>.");
+    }
+    if (parsed.TELLYMCP_OAUTH_CLIENT_SECRET && !parsed.TELLYMCP_OAUTH_CLIENT_ID) {
+        throw new Error("TELLYMCP_OAUTH_CLIENT_SECRET requires TELLYMCP_OAUTH_CLIENT_ID.");
+    }
+    for (const [name, value] of [
+        ["TELLYMCP_PUBLIC_URL", parsed.TELLYMCP_PUBLIC_URL],
+        ["TELLYMCP_OAUTH_ISSUER", parsed.TELLYMCP_OAUTH_ISSUER],
+        ["TELLYMCP_OAUTH_AUDIENCE", parsed.TELLYMCP_OAUTH_AUDIENCE],
+    ]) {
+        if (!value) {
+            continue;
+        }
+        const url = new URL(value);
+        if (url.search || url.hash) {
+            throw new Error(`${name} must not contain a query string or fragment.`);
+        }
+    }
+    const oauthScopes = parsed.TELLYMCP_OAUTH_SCOPES
+        .split(/[\s,]+/u)
+        .map((scope) => scope.trim())
+        .filter(Boolean);
+    if (oauthConfigured && oauthScopes.length === 0) {
+        throw new Error("TELLYMCP_OAUTH_SCOPES must contain at least one scope.");
+    }
+    const allowedRedirectUris = parsed.TELLYMCP_ALLOWED_REDIRECT_URIS
+        ? parsed.TELLYMCP_ALLOWED_REDIRECT_URIS.split(",")
+            .map((redirectUri) => redirectUri.trim())
+            .filter(Boolean)
+        : [];
+    for (const redirectUri of allowedRedirectUris) {
+        try {
+            const parsedRedirectUri = new URL(redirectUri);
+            if (parsedRedirectUri.hash) {
+                throw new Error("fragment");
+            }
+        }
+        catch {
+            throw new Error(`TELLYMCP_ALLOWED_REDIRECT_URIS contains an invalid URL: ${redirectUri}`);
+        }
+    }
     const telegramProxy = parsed.PROXY_USE === "http"
         ? parsed.HTTP_PROXY
             ? {
@@ -315,32 +396,58 @@ function loadConfig() {
             ...(parsed.REDIS_USERNAME ? { username: parsed.REDIS_USERNAME } : {}),
             ...(parsed.REDIS_PASSWORD ? { password: parsed.REDIS_PASSWORD } : {}),
         },
-        mode: parsed.MODE,
-        pairCodeTtlSeconds: parsed.PAIR_CODE_TTL_SECONDS,
+        mode: parsed.TELEGRAM_REQUEST_MODE,
         mcp: {
             httpHost: parsed.MCP_HTTP_HOST,
             httpPort: parsed.MCP_HTTP_PORT,
             httpPath: parsed.MCP_HTTP_PATH,
-            vfsScope: parsed.MCP_VFS_SCOPE,
             ...(parsed.MCP_HTTP_BEARER_TOKEN
                 ? { bearerToken: parsed.MCP_HTTP_BEARER_TOKEN }
                 : {}),
             enableDebugRoutes: parsed.MCP_HTTP_ENABLE_DEBUG_ROUTES,
             enablePruneRoute: parsed.MCP_HTTP_ENABLE_PRUNE_ROUTE,
         },
+        ...(oauthConfigured && parsed.TELLYMCP_PUBLIC_URL
+            ? {
+                oauth: {
+                    publicUrl: parsed.TELLYMCP_PUBLIC_URL.replace(/\/+$/u, ""),
+                    issuer: (parsed.TELLYMCP_OAUTH_ISSUER ?? parsed.TELLYMCP_PUBLIC_URL).replace(/\/+$/u, ""),
+                    audience: (parsed.TELLYMCP_OAUTH_AUDIENCE ?? parsed.TELLYMCP_PUBLIC_URL).replace(/\/+$/u, ""),
+                    ...(parsed.TELLYMCP_MAGIC_TOKEN
+                        ? { magicToken: parsed.TELLYMCP_MAGIC_TOKEN }
+                        : {}),
+                    ...(parsed.TELLYMCP_MAGIC_TOKEN_HASH
+                        ? { magicTokenHash: parsed.TELLYMCP_MAGIC_TOKEN_HASH }
+                        : {}),
+                    ...(parsed.TELLYMCP_OAUTH_CLIENT_ID
+                        ? { clientId: parsed.TELLYMCP_OAUTH_CLIENT_ID }
+                        : {}),
+                    ...(parsed.TELLYMCP_OAUTH_CLIENT_SECRET
+                        ? { clientSecret: parsed.TELLYMCP_OAUTH_CLIENT_SECRET }
+                        : {}),
+                    allowedRedirectUris,
+                    ...(parsed.TELLYMCP_OAUTH_PRIVATE_KEY_PEM
+                        ? {
+                            privateKeyPem: parsed.TELLYMCP_OAUTH_PRIVATE_KEY_PEM.replace(/\\n/gu, "\n"),
+                        }
+                        : {}),
+                    authCodeTtlSeconds: parsed.TELLYMCP_AUTH_CODE_TTL_SECONDS,
+                    scopes: oauthScopes,
+                    keyId: parsed.TELLYMCP_OAUTH_KEY_ID,
+                },
+            }
+            : {}),
         distributed: {
             mode: parsed.DISTRIBUTED_MODE,
             ...(parsed.GATEWAY_PUBLIC_URL
                 ? { gatewayPublicUrl: parsed.GATEWAY_PUBLIC_URL }
                 : {}),
-            gatewayBindHost: parsed.GATEWAY_BIND_HOST,
-            gatewayBindPort: parsed.GATEWAY_BIND_PORT,
             ...(parsed.GATEWAY_WS_URL
                 ? { gatewayWsUrl: parsed.GATEWAY_WS_URL }
                 : {}),
             gatewayWsPath: parsed.GATEWAY_WS_PATH,
-            ...(parsed.GATEWAY_TOKEN
-                ? { gatewayToken: parsed.GATEWAY_TOKEN }
+            ...(parsed.GATEWAY_SCOPE_TOKEN
+                ? { gatewayScopeToken: parsed.GATEWAY_SCOPE_TOKEN }
                 : {}),
             ...(parsed.GATEWAY_USER_UUID
                 ? { gatewayUserUuid: parsed.GATEWAY_USER_UUID }
@@ -348,21 +455,6 @@ function loadConfig() {
             ...(parsed.GATEWAY_AUTH_TOKEN
                 ? { gatewayAuthToken: parsed.GATEWAY_AUTH_TOKEN }
                 : {}),
-            ...(parsed.GATEWAY_DATABASE_URL
-                ? { gatewayDatabaseUrl: parsed.GATEWAY_DATABASE_URL }
-                : {}),
-            ...(parsed.GATEWAY_S3_ENDPOINT
-                ? { gatewayS3Endpoint: parsed.GATEWAY_S3_ENDPOINT }
-                : {}),
-            ...(parsed.GATEWAY_S3_BUCKET
-                ? { gatewayS3Bucket: parsed.GATEWAY_S3_BUCKET }
-                : {}),
-            ...(parsed.GATEWAY_S3_ACCESS_KEY
-                ? { gatewayS3AccessKey: parsed.GATEWAY_S3_ACCESS_KEY }
-                : {}),
-            ...(parsed.GATEWAY_S3_SECRET_KEY
-                ? { gatewayS3SecretKey: parsed.GATEWAY_S3_SECRET_KEY }
-                : {}),
             ...(parsed.RMQ_HOST
                 ? {
                     rmq: {
@@ -386,7 +478,6 @@ function loadConfig() {
             sessionTtlSeconds: parsed.WEBAPP_SESSION_TTL_SECONDS,
             launchMode: parsed.WEBAPP_LAUNCH_MODE,
             visibleScreens: parsed.WEBAPP_VISIBLE_SCREENS,
-            pollIntervalMs: parsed.WEBAPP_POLL_INTERVAL_MS,
             actionCooldownMs: parsed.WEBAPP_ACTION_COOLDOWN_MS,
         },
         exchange: {