@pan-sec/notebooklm-mcp 2026.4.0 → 2026.4.1

package/dist/notebook-creation/audio-manager.d.ts

@@ -4,8 +4,7 @@
  * Manages audio overview generation in NotebookLM notebooks.
  * Audio overviews are AI-generated podcast-style summaries of notebook content.
  */
-import { AuthManager } from "../auth/auth-manager.js";
-import { SharedContextManager } from "../session/shared-context-manager.js";
+import { StudioManagerBase } from "./studio-manager-base.js";
 export interface AudioStatus {
     status: "not_started" | "generating" | "ready" | "failed" | "unknown";
     progress?: number;
@@ -23,15 +22,12 @@ export interface DownloadAudioResult {
     size?: number;
     error?: string;
 }
-export declare class AudioManager {
-    private authManager;
-    private contextManager;
-    private page;
-    constructor(authManager: AuthManager, contextManager: SharedContextManager);
-    /**
-     * Navigate to a notebook and ensure we're on the right page
-     */
-    private navigateToNotebook;
+export declare class AudioManager extends StudioManagerBase {
+    protected readonly logName = "audio-manager";
+    protected readonly navigateDelay: {
+        min: number;
+        max: number;
+    };
     /**
      * Generate an audio overview for a notebook
      */
@@ -48,8 +44,4 @@ export declare class AudioManager {
      * Download the generated audio file
      */
     downloadAudio(notebookUrl: string, outputPath?: string): Promise<DownloadAudioResult>;
-    /**
-     * Close the page if open
-     */
-    private closePage;
 }

package/dist/notebook-creation/audio-manager.js

@@ -6,6 +6,7 @@
  */
 import { log } from "../utils/logger.js";
 import { randomDelay } from "../utils/stealth-utils.js";
+import { StudioManagerBase, } from "./studio-manager-base.js";
 import fs from "fs";
 import path from "path";
 import os from "os";
@@ -100,29 +101,9 @@ const AUDIO_SELECTORS = {
         text: '[class*="progress-text"], [class*="eta"]',
     },
 };
-export class AudioManager {
-    authManager;
-    contextManager;
-    page = null;
-    constructor(authManager, contextManager) {
-        this.authManager = authManager;
-        this.contextManager = contextManager;
-    }
-    /**
-     * Navigate to a notebook and ensure we're on the right page
-     */
-    async navigateToNotebook(notebookUrl) {
-        const context = await this.contextManager.getOrCreateContext();
-        const isAuth = await this.authManager.validateWithRetry(context);
-        if (!isAuth) {
-            throw new Error("Not authenticated. Run setup_auth first.");
-        }
-        this.page = await context.newPage();
-        await this.page.goto(notebookUrl, { waitUntil: "domcontentloaded" });
-        await this.page.waitForLoadState("networkidle").catch(() => { });
-        await randomDelay(1500, 2500);
-        return this.page;
-    }
+export class AudioManager extends StudioManagerBase {
+    logName = "audio-manager";
+    navigateDelay = { min: 1500, max: 2500 };
     /**
      * Generate an audio overview for a notebook
      */
@@ -403,19 +384,4 @@ export class AudioManager {
             await this.closePage();
         }
     }
-    /**
-     * Close the page if open
-     */
-    async closePage() {
-        if (this.page) {
-            try {
-                await this.page.close();
-            }
-            catch (err) {
-                log.debug(`audio-manager: closing page: ${err instanceof Error ? err.message : String(err)}`);
-                // Ignore close errors
-            }
-            this.page = null;
-        }
-    }
 }

package/dist/notebook-creation/data-table-manager.d.ts

@@ -14,8 +14,7 @@
  * - Artifact title during generation: "Generating data table…"
  * - Chat-embedded tables use standard <table><tr><th>/<td> (no <tbody>)
  */
-import { AuthManager } from "../auth/auth-manager.js";
-import { SharedContextManager } from "../session/shared-context-manager.js";
+import { StudioManagerBase } from "./studio-manager-base.js";
 export interface DataTable {
     headers: string[];
     rows: string[][];
@@ -36,15 +35,8 @@ export interface GetDataTableResult {
     table?: DataTable;
     error?: string;
 }
-export declare class DataTableManager {
-    private authManager;
-    private contextManager;
-    private page;
-    constructor(authManager: AuthManager, contextManager: SharedContextManager);
-    /**
-     * Navigate to a notebook and ensure we're on the right page
-     */
-    private navigateToNotebook;
+export declare class DataTableManager extends StudioManagerBase {
+    protected readonly logName = "data-table-manager";
     /**
      * Ensure the Studio panel is visible (expand if collapsed).
      *
@@ -94,8 +86,4 @@ export declare class DataTableManager {
      * to the calling model.
      */
     private sanitizeTable;
-    /**
-     * Close the page if open
-     */
-    private closePage;
 }

package/dist/notebook-creation/data-table-manager.js

@@ -17,29 +17,9 @@
 import { log } from "../utils/logger.js";
 import { randomDelay } from "../utils/stealth-utils.js";
 import { validateResponse } from "../utils/response-validator.js";
-export class DataTableManager {
-    authManager;
-    contextManager;
-    page = null;
-    constructor(authManager, contextManager) {
-        this.authManager = authManager;
-        this.contextManager = contextManager;
-    }
-    /**
-     * Navigate to a notebook and ensure we're on the right page
-     */
-    async navigateToNotebook(notebookUrl) {
-        const context = await this.contextManager.getOrCreateContext();
-        const isAuth = await this.authManager.validateWithRetry(context);
-        if (!isAuth) {
-            throw new Error("Not authenticated. Run setup_auth first.");
-        }
-        this.page = await context.newPage();
-        await this.page.goto(notebookUrl, { waitUntil: "domcontentloaded" });
-        await this.page.waitForLoadState("networkidle").catch(() => { });
-        await randomDelay(2000, 3000);
-        return this.page;
-    }
+import { StudioManagerBase, } from "./studio-manager-base.js";
+export class DataTableManager extends StudioManagerBase {
+    logName = "data-table-manager";
     /**
      * Ensure the Studio panel is visible (expand if collapsed).
      *
@@ -288,6 +268,12 @@ export class DataTableManager {
                     error: "Could not click on data table artifact.",
                 };
             }
+            // Status is already confirmed "ready" above, so a table is expected to
+            // render after opening the artifact. Wait for the concrete <table> element
+            // that extractTableData() reads, instead of relying on a fixed sleep as the
+            // only readiness gate (M30). Bounded + .catch so a miss degrades to the
+            // prior behavior (fall through to extractTableData, which returns null).
+            await page.waitForSelector("table", { timeout: 10000 }).catch(() => { });
             await randomDelay(2000, 3000);
             // Extract table data from the page
             const table = await this.extractTableData(page);
@@ -392,19 +378,4 @@ export class DataTableManager {
             totalColumns: table.totalColumns,
         };
     }
-    /**
-     * Close the page if open
-     */
-    async closePage() {
-        if (this.page) {
-            try {
-                await this.page.close();
-            }
-            catch (err) {
-                log.debug(`data-table-manager: closing page: ${err instanceof Error ? err.message : String(err)}`);
-                // Ignore close errors
-            }
-            this.page = null;
-        }
-    }
 }

package/dist/notebook-creation/source-manager-shared.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Source Manager — shared primitives
+ *
+ * Helpers genuinely shared between the two source managers in
+ * `source-manager.ts`:
+ *   - SourceManager                  (legacy: list/add/remove on an existing
+ *                                     notebook)
+ *   - NotebookCreationSourceManager  (the creation flow)
+ *
+ * Only logic that is byte-equivalent between the two classes lives here; the
+ * managers' distinct flows (source-type selection, submit/insert clicks, error
+ * alert handling, waitForSourceProcessing) intentionally differ and stay in
+ * place. These helpers are a pure de-duplication and are behavior-preserving.
+ */
+import type { Page } from "patchright";
+export type BrowserDomElement = unknown;
+export type BrowserSourceItem = {
+    textContent?: string | null;
+    className?: string;
+    id?: string;
+    getAttribute(name: string): string | null;
+    querySelector(selector: string): BrowserDomElement | null;
+    click(): void;
+};
+export type BrowserVisibleElement = {
+    textContent?: string | null;
+    className?: string;
+    offsetParent?: unknown;
+    parentElement?: BrowserVisibleElement | null;
+    getAttribute(name: string): string | null;
+    click(): void;
+};
+export type BrowserTextVisibleElement = BrowserVisibleElement & {
+    className?: string;
+};
+export type BrowserTextAreaCandidate = BrowserVisibleElement & {
+    value?: string;
+};
+export type BrowserInnerTextHandle = {
+    innerText(): Promise<string>;
+};
+export type BrowserDocumentContext = {
+    document: {
+        querySelector(selector: string): BrowserDomElement | null;
+        querySelectorAll(selector: string): Iterable<BrowserDomElement>;
+    };
+    window: {
+        innerWidth: number;
+    };
+};
+/**
+ * Find the first `textInput` selector that resolves to a visible textarea which
+ * is NOT the "discover sources" / "search the web" / query-box control.
+ *
+ * This is the exact, equivalent logic that both SourceManager and
+ * NotebookCreationSourceManager used (their two private copies differed only in
+ * an unused `rejected` field and the debug-log wording — callers read only the
+ * boolean match). The three exclusion substrings are kept byte-identical.
+ *
+ * @param debugLabel preserves each caller's original debug log line verbatim.
+ */
+export declare function findValidTextInputSelector(page: Page, debugLabel: string): Promise<string | null>;
+/**
+ * Set the text-source content via the direct DOM-value path only.
+ * The value is passed as a serialized page.evaluate argument (never
+ * string-interpolated). We deliberately do NOT use the OS copy/paste
+ * buffer: writing to it leaks/overwrites the host's copied data and, when
+ * the relevant browser permission is denied (common in headless), a paste
+ * keystroke would inject STALE buffered contents and corrupt the source.
+ *
+ * This is the byte-identical evaluate block both classes used. The differing
+ * focus/click step that precedes it (textArea.focus() in the legacy manager,
+ * textarea.click() in the creation manager) stays with each caller.
+ */
+export declare function setTextSourceValue(page: Page, selector: string, value: string): Promise<void>;

package/dist/notebook-creation/source-manager-shared.js

@@ -0,0 +1,86 @@
+/**
+ * Source Manager — shared primitives
+ *
+ * Helpers genuinely shared between the two source managers in
+ * `source-manager.ts`:
+ *   - SourceManager                  (legacy: list/add/remove on an existing
+ *                                     notebook)
+ *   - NotebookCreationSourceManager  (the creation flow)
+ *
+ * Only logic that is byte-equivalent between the two classes lives here; the
+ * managers' distinct flows (source-type selection, submit/insert clicks, error
+ * alert handling, waitForSourceProcessing) intentionally differ and stay in
+ * place. These helpers are a pure de-duplication and are behavior-preserving.
+ */
+import { log } from "../utils/logger.js";
+import { getSelectors } from "./selectors.js";
+/**
+ * Find the first `textInput` selector that resolves to a visible textarea which
+ * is NOT the "discover sources" / "search the web" / query-box control.
+ *
+ * This is the exact, equivalent logic that both SourceManager and
+ * NotebookCreationSourceManager used (their two private copies differed only in
+ * an unused `rejected` field and the debug-log wording — callers read only the
+ * boolean match). The three exclusion substrings are kept byte-identical.
+ *
+ * @param debugLabel preserves each caller's original debug log line verbatim.
+ */
+export async function findValidTextInputSelector(page, debugLabel) {
+    for (const selector of getSelectors("textInput")) {
+        try {
+            const state = await page.evaluate((targetSelector) => {
+                const browser = globalThis;
+                const textarea = browser.document.querySelector(targetSelector);
+                if (!textarea || textarea.offsetParent === null) {
+                    return { matches: false };
+                }
+                const aria = textarea.getAttribute("aria-label")?.toLowerCase() || "";
+                const placeholder = textarea.getAttribute("placeholder")?.toLowerCase() || "";
+                const className = textarea.className?.toLowerCase() || "";
+                const haystack = `${aria} ${placeholder} ${className}`;
+                return {
+                    matches: !haystack.includes("discover sources") &&
+                        !haystack.includes("search the web") &&
+                        !haystack.includes("query-box"),
+                };
+            }, selector);
+            if (state.matches) {
+                return selector;
+            }
+        }
+        catch (err) {
+            log.debug(`${debugLabel}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return null;
+}
+/**
+ * Set the text-source content via the direct DOM-value path only.
+ * The value is passed as a serialized page.evaluate argument (never
+ * string-interpolated). We deliberately do NOT use the OS copy/paste
+ * buffer: writing to it leaks/overwrites the host's copied data and, when
+ * the relevant browser permission is denied (common in headless), a paste
+ * keystroke would inject STALE buffered contents and corrupt the source.
+ *
+ * This is the byte-identical evaluate block both classes used. The differing
+ * focus/click step that precedes it (textArea.focus() in the legacy manager,
+ * textarea.click() in the creation manager) stays with each caller.
+ */
+export async function setTextSourceValue(page, selector, value) {
+    await page.evaluate(({ selector, value }) => {
+        const browser = globalThis;
+        const textarea = browser.document.querySelector(selector);
+        if (!textarea)
+            return false;
+        textarea.focus();
+        if (typeof textarea.value === "string") {
+            textarea.value = value;
+        }
+        else {
+            textarea.textContent = value;
+        }
+        textarea.dispatchEvent(new browser.Event("input", { bubbles: true }));
+        textarea.dispatchEvent(new browser.Event("change", { bubbles: true }));
+        return true;
+    }, { selector, value });
+}

package/dist/notebook-creation/studio-manager-base.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Studio Manager Base
+ *
+ * Shared page-lifecycle plumbing for the NotebookLM "Studio" managers
+ * (audio, video, data table). These managers all open a notebook page,
+ * validate authentication, drive a Studio-panel artifact flow, then close
+ * the page. The navigation and teardown logic is identical across them and
+ * lives here; the artifact-specific flows stay in each subclass.
+ *
+ * Behavior is preserved exactly:
+ *   - navigateToNotebook: getOrCreateContext → validateWithRetry (throws
+ *     "Not authenticated. Run setup_auth first." when false) → newPage →
+ *     goto(domcontentloaded) → waitForLoadState("networkidle") (errors
+ *     swallowed) → per-subclass randomDelay → return page.
+ *   - closePage: close the page, swallowing errors, then null the handle.
+ *
+ * Per-subclass differences are expressed as protected properties so that no
+ * call site needs to thread arguments:
+ *   - navigateDelay: video & data table use 2000–3000ms, audio uses 1500–2500ms.
+ *   - logName: the log-prefix used in the swallowed close-error debug line.
+ */
+import type { Page } from "patchright";
+import { AuthManager } from "../auth/auth-manager.js";
+import { SharedContextManager } from "../session/shared-context-manager.js";
+/** Opaque DOM element handle used only in `as`-casts inside page.evaluate bodies. */
+export type BrowserDomElement = unknown;
+/** Minimal `document` shape used inside page.evaluate bodies. Common to all managers. */
+export interface BrowserDocumentContext {
+    document: {
+        querySelector(selector: string): BrowserDomElement | null;
+        querySelectorAll(selector: string): Iterable<BrowserDomElement>;
+    };
+}
+export declare abstract class StudioManagerBase {
+    protected authManager: AuthManager;
+    protected contextManager: SharedContextManager;
+    protected page: Page | null;
+    /**
+     * Trailing delay applied after navigation settles. Video & data table use the
+     * default (2000–3000ms); audio overrides to 1500–2500ms.
+     */
+    protected readonly navigateDelay: {
+        min: number;
+        max: number;
+    };
+    /** Log prefix used in the swallowed close-error debug line (kept per-manager). */
+    protected abstract readonly logName: string;
+    constructor(authManager: AuthManager, contextManager: SharedContextManager);
+    /**
+     * Navigate to a notebook and ensure we're on the right page
+     */
+    protected navigateToNotebook(notebookUrl: string): Promise<Page>;
+    /**
+     * Close the page if open
+     */
+    protected closePage(): Promise<void>;
+}

package/dist/notebook-creation/studio-manager-base.js

@@ -0,0 +1,67 @@
+/**
+ * Studio Manager Base
+ *
+ * Shared page-lifecycle plumbing for the NotebookLM "Studio" managers
+ * (audio, video, data table). These managers all open a notebook page,
+ * validate authentication, drive a Studio-panel artifact flow, then close
+ * the page. The navigation and teardown logic is identical across them and
+ * lives here; the artifact-specific flows stay in each subclass.
+ *
+ * Behavior is preserved exactly:
+ *   - navigateToNotebook: getOrCreateContext → validateWithRetry (throws
+ *     "Not authenticated. Run setup_auth first." when false) → newPage →
+ *     goto(domcontentloaded) → waitForLoadState("networkidle") (errors
+ *     swallowed) → per-subclass randomDelay → return page.
+ *   - closePage: close the page, swallowing errors, then null the handle.
+ *
+ * Per-subclass differences are expressed as protected properties so that no
+ * call site needs to thread arguments:
+ *   - navigateDelay: video & data table use 2000–3000ms, audio uses 1500–2500ms.
+ *   - logName: the log-prefix used in the swallowed close-error debug line.
+ */
+import { log } from "../utils/logger.js";
+import { randomDelay } from "../utils/stealth-utils.js";
+export class StudioManagerBase {
+    authManager;
+    contextManager;
+    page = null;
+    /**
+     * Trailing delay applied after navigation settles. Video & data table use the
+     * default (2000–3000ms); audio overrides to 1500–2500ms.
+     */
+    navigateDelay = { min: 2000, max: 3000 };
+    constructor(authManager, contextManager) {
+        this.authManager = authManager;
+        this.contextManager = contextManager;
+    }
+    /**
+     * Navigate to a notebook and ensure we're on the right page
+     */
+    async navigateToNotebook(notebookUrl) {
+        const context = await this.contextManager.getOrCreateContext();
+        const isAuth = await this.authManager.validateWithRetry(context);
+        if (!isAuth) {
+            throw new Error("Not authenticated. Run setup_auth first.");
+        }
+        this.page = await context.newPage();
+        await this.page.goto(notebookUrl, { waitUntil: "domcontentloaded" });
+        await this.page.waitForLoadState("networkidle").catch(() => { });
+        await randomDelay(this.navigateDelay.min, this.navigateDelay.max);
+        return this.page;
+    }
+    /**
+     * Close the page if open
+     */
+    async closePage() {
+        if (this.page) {
+            try {
+                await this.page.close();
+            }
+            catch (err) {
+                log.debug(`${this.logName}: closing page: ${err instanceof Error ? err.message : String(err)}`);
+                // Ignore close errors
+            }
+            this.page = null;
+        }
+    }
+}

package/dist/notebook-creation/video-manager.d.ts

@@ -14,8 +14,7 @@
  * - Artifacts appear in .artifact-library-container with .artifact-item-button
  * - Generating state: .shimmer-blue class + .rotate icon + "Generating" title
  */
-import { AuthManager } from "../auth/auth-manager.js";
-import { SharedContextManager } from "../session/shared-context-manager.js";
+import { StudioManagerBase } from "./studio-manager-base.js";
 /**
  * Visual styles for video overviews (matches actual NotebookLM UI)
  */
@@ -34,15 +33,8 @@ export interface GenerateVideoResult {
     status: VideoStatus;
     error?: string;
 }
-export declare class VideoManager {
-    private authManager;
-    private contextManager;
-    private page;
-    constructor(authManager: AuthManager, contextManager: SharedContextManager);
-    /**
-     * Navigate to a notebook and ensure we're on the right page
-     */
-    private navigateToNotebook;
+export declare class VideoManager extends StudioManagerBase {
+    protected readonly logName = "video-manager";
     /**
      * Ensure the Studio panel is visible (expand if collapsed).
      *
@@ -93,8 +85,4 @@ export declare class VideoManager {
      * Check the current video status for a notebook
      */
     getVideoStatus(notebookUrl: string): Promise<VideoStatus>;
-    /**
-     * Close the page if open
-     */
-    private closePage;
 }

package/dist/notebook-creation/video-manager.js

@@ -16,6 +16,7 @@
  */
 import { log } from "../utils/logger.js";
 import { randomDelay } from "../utils/stealth-utils.js";
+import { StudioManagerBase, } from "./studio-manager-base.js";
 /**
  * Allowlisted style values. Single source of truth used to validate untrusted
  * input before it is passed into the page context (prevents attribute-selector
@@ -39,29 +40,8 @@ const VALID_VIDEO_STYLES = [
  * injection in selectFormat).
  */
 const VALID_VIDEO_FORMATS = ["explainer", "brief"];
-export class VideoManager {
-    authManager;
-    contextManager;
-    page = null;
-    constructor(authManager, contextManager) {
-        this.authManager = authManager;
-        this.contextManager = contextManager;
-    }
-    /**
-     * Navigate to a notebook and ensure we're on the right page
-     */
-    async navigateToNotebook(notebookUrl) {
-        const context = await this.contextManager.getOrCreateContext();
-        const isAuth = await this.authManager.validateWithRetry(context);
-        if (!isAuth) {
-            throw new Error("Not authenticated. Run setup_auth first.");
-        }
-        this.page = await context.newPage();
-        await this.page.goto(notebookUrl, { waitUntil: "domcontentloaded" });
-        await this.page.waitForLoadState("networkidle").catch(() => { });
-        await randomDelay(2000, 3000);
-        return this.page;
-    }
+export class VideoManager extends StudioManagerBase {
+    logName = "video-manager";
     /**
      * Ensure the Studio panel is visible (expand if collapsed).
      *
@@ -449,19 +429,4 @@ export class VideoManager {
             await this.closePage();
         }
     }
-    /**
-     * Close the page if open
-     */
-    async closePage() {
-        if (this.page) {
-            try {
-                await this.page.close();
-            }
-            catch (err) {
-                log.debug(`video-manager: closing page: ${err instanceof Error ? err.message : String(err)}`);
-                // Ignore close errors
-            }
-            this.page = null;
-        }
-    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pan-sec/notebooklm-mcp",
-  "version": "2026.4.0",
+  "version": "2026.4.1",
   "mcpName": "io.github.Pantheon-Security/notebooklm-mcp-secure",
   "description": "Security-hardened MCP server for NotebookLM API with compliance-ready architecture (GDPR, SOC2, CSSF controls implemented)",
   "type": "module",