@poolzin/pool-bot 1.28.0 → 2026.1.26

package/dist/media/server.js

@@ -1,49 +1,35 @@
 import fs from "node:fs/promises";
+import path from "node:path";
 import express from "express";
 import { danger } from "../globals.js";
 import { defaultRuntime } from "../runtime.js";
-import { SafeOpenError, openFileWithinRoot } from "../infra/fs-safe.js";
 import { detectMime } from "./mime.js";
-import { cleanOldMedia, getMediaDir, MEDIA_MAX_BYTES } from "./store.js";
+import { cleanOldMedia, getMediaDir } from "./store.js";
 const DEFAULT_TTL_MS = 2 * 60 * 1000;
-const MAX_MEDIA_ID_CHARS = 200;
-const MEDIA_ID_PATTERN = /^[\p{L}\p{N}._-]+$/u;
-const MAX_MEDIA_BYTES = MEDIA_MAX_BYTES;
-const isValidMediaId = (id) => {
-    if (!id)
-        return false;
-    if (id.length > MAX_MEDIA_ID_CHARS)
-        return false;
-    if (id === "." || id === "..")
-        return false;
-    return MEDIA_ID_PATTERN.test(id);
-};
 export function attachMediaRoutes(app, ttlMs = DEFAULT_TTL_MS, _runtime = defaultRuntime) {
     const mediaDir = getMediaDir();
     app.get("/media/:id", async (req, res) => {
         const id = req.params.id;
-        if (!isValidMediaId(id)) {
-            res.status(400).send("invalid path");
-            return;
-        }
+        const mediaRoot = (await fs.realpath(mediaDir)) + path.sep;
+        const file = path.resolve(mediaRoot, id);
         try {
-            const { handle, realPath, stat } = await openFileWithinRoot({
-                rootDir: mediaDir,
-                relativePath: id,
-            });
-            if (stat.size > MAX_MEDIA_BYTES) {
-                await handle.close().catch(() => { });
-                res.status(413).send("too large");
+            const lstat = await fs.lstat(file);
+            if (lstat.isSymbolicLink()) {
+                res.status(400).send("invalid path");
                 return;
             }
+            const realPath = await fs.realpath(file);
+            if (!realPath.startsWith(mediaRoot)) {
+                res.status(400).send("invalid path");
+                return;
+            }
+            const stat = await fs.stat(realPath);
             if (Date.now() - stat.mtimeMs > ttlMs) {
-                await handle.close().catch(() => { });
                 await fs.rm(realPath).catch(() => { });
                 res.status(410).send("expired");
                 return;
             }
-            const data = await handle.readFile();
-            await handle.close().catch(() => { });
+            const data = await fs.readFile(realPath);
             const mime = await detectMime({ buffer: data, filePath: realPath });
             if (mime)
                 res.type(mime);
@@ -55,17 +41,7 @@ export function attachMediaRoutes(app, ttlMs = DEFAULT_TTL_MS, _runtime = defaul
                 }, 50);
             });
         }
-        catch (err) {
-            if (err instanceof SafeOpenError) {
-                if (err.code === "invalid-path") {
-                    res.status(400).send("invalid path");
-                    return;
-                }
-                if (err.code === "not-found") {
-                    res.status(404).send("not found");
-                    return;
-                }
-            }
+        catch {
             res.status(404).send("not found");
         }
     });

package/dist/media/store.js

@@ -1,16 +1,13 @@
 import crypto from "node:crypto";
 import { createWriteStream } from "node:fs";
 import fs from "node:fs/promises";
-import { request as httpRequest } from "node:http";
-import { request as httpsRequest } from "node:https";
+import { request } from "node:https";
 import path from "node:path";
 import { pipeline } from "node:stream/promises";
 import { resolveConfigDir } from "../utils.js";
-import { resolvePinnedHostname } from "../infra/net/ssrf.js";
 import { detectMime, extensionForMime } from "./mime.js";
 const resolveMediaDir = () => path.join(resolveConfigDir(), "media");
-export const MEDIA_MAX_BYTES = 5 * 1024 * 1024; // 5MB default
-const MAX_BYTES = MEDIA_MAX_BYTES;
+const MAX_BYTES = 5 * 1024 * 1024; // 5MB default
 const DEFAULT_TTL_MS = 2 * 60 * 1000; // 2 minutes
 /**
  * Sanitize a filename for cross-platform safety.
@@ -18,10 +15,10 @@ const DEFAULT_TTL_MS = 2 * 60 * 1000; // 2 minutes
  * Keeps: alphanumeric, dots, hyphens, underscores, Unicode letters/numbers.
  */
 function sanitizeFilename(name) {
-    const trimmed = name.trim();
-    if (!trimmed)
-        return "";
-    const sanitized = trimmed.replace(/[^\p{L}\p{N}._-]+/gu, "_");
+    // Remove: < > : " / \ | ? * and control chars (U+0000-U+001F)
+    // oxlint-disable-next-line no-control-regex -- Intentionally matching control chars
+    const unsafe = /[<>:"/\\|?*\x00-\x1f]/g;
+    const sanitized = name.trim().replace(unsafe, "_").replace(/\s+/g, "_"); // Replace whitespace runs with underscore
     // Collapse multiple underscores, trim leading/trailing, limit length
     return sanitized.replace(/_+/g, "_").replace(/^_|_$/g, "").slice(0, 60);
 }
@@ -48,7 +45,7 @@ export function getMediaDir() {
 }
 export async function ensureMediaDir() {
     const mediaDir = resolveMediaDir();
-    await fs.mkdir(mediaDir, { recursive: true, mode: 0o700 });
+    await fs.mkdir(mediaDir, { recursive: true });
     return mediaDir;
 }
 export async function cleanOldMedia(ttlMs = DEFAULT_TTL_MS) {
@@ -73,74 +70,57 @@ function looksLikeUrl(src) {
  */
 async function downloadToFile(url, dest, headers, maxRedirects = 5) {
     return await new Promise((resolve, reject) => {
-        let parsedUrl;
-        try {
-            parsedUrl = new URL(url);
-        }
-        catch {
-            reject(new Error("Invalid URL"));
-            return;
-        }
-        if (!["http:", "https:"].includes(parsedUrl.protocol)) {
-            reject(new Error(`Invalid URL protocol: ${parsedUrl.protocol}. Only HTTP/HTTPS allowed.`));
-            return;
-        }
-        const requestImpl = parsedUrl.protocol === "https:" ? httpsRequest : httpRequest;
-        resolvePinnedHostname(parsedUrl.hostname)
-            .then((pinned) => {
-            const req = requestImpl(parsedUrl, { headers, lookup: pinned.lookup }, (res) => {
-                // Follow redirects
-                if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400) {
-                    const location = res.headers.location;
-                    if (!location || maxRedirects <= 0) {
-                        reject(new Error(`Redirect loop or missing Location header`));
-                        return;
-                    }
-                    const redirectUrl = new URL(location, url).href;
-                    resolve(downloadToFile(redirectUrl, dest, headers, maxRedirects - 1));
+        const req = request(url, { headers }, (res) => {
+            // Follow redirects
+            if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400) {
+                const location = res.headers.location;
+                if (!location || maxRedirects <= 0) {
+                    reject(new Error(`Redirect loop or missing Location header`));
                     return;
                 }
-                if (!res.statusCode || res.statusCode >= 400) {
-                    reject(new Error(`HTTP ${res.statusCode ?? "?"} downloading media`));
-                    return;
+                const redirectUrl = new URL(location, url).href;
+                resolve(downloadToFile(redirectUrl, dest, headers, maxRedirects - 1));
+                return;
+            }
+            if (!res.statusCode || res.statusCode >= 400) {
+                reject(new Error(`HTTP ${res.statusCode ?? "?"} downloading media`));
+                return;
+            }
+            let total = 0;
+            const sniffChunks = [];
+            let sniffLen = 0;
+            const out = createWriteStream(dest);
+            res.on("data", (chunk) => {
+                total += chunk.length;
+                if (sniffLen < 16384) {
+                    sniffChunks.push(chunk);
+                    sniffLen += chunk.length;
+                }
+                if (total > MAX_BYTES) {
+                    req.destroy(new Error("Media exceeds 5MB limit"));
                 }
-                let total = 0;
-                const sniffChunks = [];
-                let sniffLen = 0;
-                const out = createWriteStream(dest, { mode: 0o600 });
-                res.on("data", (chunk) => {
-                    total += chunk.length;
-                    if (sniffLen < 16384) {
-                        sniffChunks.push(chunk);
-                        sniffLen += chunk.length;
-                    }
-                    if (total > MAX_BYTES) {
-                        req.destroy(new Error("Media exceeds 5MB limit"));
-                    }
-                });
-                pipeline(res, out)
-                    .then(() => {
-                    const sniffBuffer = Buffer.concat(sniffChunks, Math.min(sniffLen, 16384));
-                    const rawHeader = res.headers["content-type"];
-                    const headerMime = Array.isArray(rawHeader) ? rawHeader[0] : rawHeader;
-                    resolve({
-                        headerMime,
-                        sniffBuffer,
-                        size: total,
-                    });
-                })
-                    .catch(reject);
             });
-            req.on("error", reject);
-            req.end();
-        })
-            .catch(reject);
+            pipeline(res, out)
+                .then(() => {
+                const sniffBuffer = Buffer.concat(sniffChunks, Math.min(sniffLen, 16384));
+                const rawHeader = res.headers["content-type"];
+                const headerMime = Array.isArray(rawHeader) ? rawHeader[0] : rawHeader;
+                resolve({
+                    headerMime,
+                    sniffBuffer,
+                    size: total,
+                });
+            })
+                .catch(reject);
+        });
+        req.on("error", reject);
+        req.end();
     });
 }
 export async function saveMediaSource(source, headers, subdir = "") {
     const baseDir = resolveMediaDir();
     const dir = subdir ? path.join(baseDir, subdir) : baseDir;
-    await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    await fs.mkdir(dir, { recursive: true });
     await cleanOldMedia();
     const baseId = crypto.randomUUID();
     if (looksLikeUrl(source)) {
@@ -170,7 +150,7 @@ export async function saveMediaSource(source, headers, subdir = "") {
     const ext = extensionForMime(mime) ?? path.extname(source);
     const id = ext ? `${baseId}${ext}` : baseId;
     const dest = path.join(dir, id);
-    await fs.writeFile(dest, buffer, { mode: 0o600 });
+    await fs.writeFile(dest, buffer);
     return { id, path: dest, size: stat.size, contentType: mime };
 }
 export async function saveMediaBuffer(buffer, contentType, subdir = "inbound", maxBytes = MAX_BYTES, originalFilename) {
@@ -178,7 +158,7 @@ export async function saveMediaBuffer(buffer, contentType, subdir = "inbound", m
         throw new Error(`Media exceeds ${(maxBytes / (1024 * 1024)).toFixed(0)}MB limit`);
     }
     const dir = path.join(resolveMediaDir(), subdir);
-    await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    await fs.mkdir(dir, { recursive: true });
     const uuid = crypto.randomUUID();
     const headerExt = extensionForMime(contentType?.split(";")[0]?.trim() ?? undefined);
     const mime = await detectMime({ buffer, headerMime: contentType });
@@ -195,6 +175,6 @@ export async function saveMediaBuffer(buffer, contentType, subdir = "inbound", m
         id = ext ? `${uuid}${ext}` : uuid;
     }
     const dest = path.join(dir, id);
-    await fs.writeFile(dest, buffer, { mode: 0o600 });
+    await fs.writeFile(dest, buffer);
     return { id, path: dest, size: buffer.byteLength, contentType: mime };
 }

package/dist/media-understanding/attachments.js

@@ -253,7 +253,7 @@ export class MediaAttachmentCache {
             timeoutMs: params.timeoutMs,
         });
         const extension = path.extname(bufferResult.fileName || "") || "";
-        const tmpPath = path.join(os.tmpdir(), `moltbot-media-${crypto.randomUUID()}${extension}`);
+        const tmpPath = path.join(os.tmpdir(), `clawdbot-media-${crypto.randomUUID()}${extension}`);
         await fs.writeFile(tmpPath, bufferResult.buffer);
         entry.tempPath = tmpPath;
         entry.tempCleanup = async () => {

package/dist/media-understanding/providers/image.js

@@ -1,11 +1,11 @@
 import { complete } from "@mariozechner/pi-ai";
 import { discoverAuthStorage, discoverModels } from "@mariozechner/pi-coding-agent";
 import { getApiKeyForModel, requireApiKey } from "../../agents/model-auth.js";
-import { ensureMoltbotModelsJson } from "../../agents/models-config.js";
+import { ensureClawdbotModelsJson } from "../../agents/models-config.js";
 import { minimaxUnderstandImage } from "../../agents/minimax-vlm.js";
 import { coerceImageAssistantText } from "../../agents/tools/image-tool.helpers.js";
 export async function describeImageWithModel(params) {
-    await ensureMoltbotModelsJson(params.cfg, params.agentDir);
+    await ensureClawdbotModelsJson(params.cfg, params.agentDir);
     const authStorage = discoverAuthStorage(params.agentDir);
     const modelRegistry = discoverModels(authStorage, params.agentDir);
     const model = modelRegistry.find(params.provider, params.model);

package/dist/media-understanding/runner.js

@@ -370,38 +370,6 @@ async function resolveAutoEntries(params) {
         return [keys];
     return [];
 }
-export async function resolveAutoImageModel(params) {
-    const providerRegistry = buildProviderRegistry();
-    const toActive = (entry) => {
-        if (!entry || entry.type === "cli")
-            return null;
-        const provider = entry.provider;
-        if (!provider)
-            return null;
-        const model = entry.model ?? DEFAULT_IMAGE_MODELS[provider];
-        if (!model)
-            return null;
-        return { provider, model };
-    };
-    const activeEntry = await resolveActiveModelEntry({
-        cfg: params.cfg,
-        agentDir: params.agentDir,
-        providerRegistry,
-        capability: "image",
-        activeModel: params.activeModel,
-    });
-    const resolvedActive = toActive(activeEntry);
-    if (resolvedActive)
-        return resolvedActive;
-    const keyEntry = await resolveKeyEntry({
-        cfg: params.cfg,
-        agentDir: params.agentDir,
-        providerRegistry,
-        capability: "image",
-        activeModel: params.activeModel,
-    });
-    return toActive(keyEntry);
-}
 async function resolveActiveModelEntry(params) {
     const activeProviderRaw = params.activeModel?.provider?.trim();
     if (!activeProviderRaw)
@@ -769,7 +737,7 @@ async function runCliEntry(params) {
         maxBytes,
         timeoutMs,
     });
-    const outputDir = await fs.mkdtemp(path.join(os.tmpdir(), "moltbot-media-cli-"));
+    const outputDir = await fs.mkdtemp(path.join(os.tmpdir(), "clawdbot-media-cli-"));
     const mediaPath = pathResult.path;
     const outputBase = path.join(outputDir, path.parse(mediaPath).name);
     const templCtx = {

package/dist/memory/batch-gemini.js

@@ -42,7 +42,7 @@ function splitGeminiBatchRequests(requests) {
     return groups;
 }
 function buildGeminiUploadBody(params) {
-    const boundary = `moltbot-${hashText(params.displayName)}`;
+    const boundary = `clawdbot-${hashText(params.displayName)}`;
     const jsonPart = JSON.stringify({
         file: {
             displayName: params.displayName,

package/dist/memory/batch-openai.js

@@ -56,7 +56,7 @@ async function submitOpenAiBatch(params) {
                 endpoint: OPENAI_BATCH_ENDPOINT,
                 completion_window: OPENAI_BATCH_COMPLETION_WINDOW,
                 metadata: {
-                    source: "moltbot-memory",
+                    source: "clawdbot-memory",
                     agent: params.agentId,
                 },
             }),

package/dist/memory/embeddings.js

@@ -160,7 +160,7 @@ function formatLocalSetupError(err) {
         "To enable local embeddings:",
         "1) Use Node 22 LTS (recommended for installs/updates)",
         missing
-            ? "2) Reinstall Moltbot (this should install node-llama-cpp): npm i -g moltbot@latest"
+            ? "2) Reinstall Clawdbot (this should install node-llama-cpp): npm i -g clawdbot@latest"
             : null,
         "3) If you use pnpm: pnpm approve-builds (select node-llama-cpp), then pnpm rebuild node-llama-cpp",
         'Or set agents.defaults.memorySearch.provider = "openai" (remote).',

package/dist/node-host/runner.js

@@ -8,12 +8,10 @@ import { requestExecHostViaSocket, } from "../infra/exec-host.js";
 import { getMachineDisplayName } from "../infra/machine-name.js";
 import { loadOrCreateDeviceIdentity } from "../infra/device-identity.js";
 import { loadConfig } from "../config/config.js";
-import { resolveBrowserConfig } from "../browser/config.js";
-import { createBrowserControlContext, startBrowserControlServiceFromConfig, } from "../browser/control-service.js";
-import { createBrowserRouteDispatcher } from "../browser/routes/dispatcher.js";
+import { resolveBrowserConfig, shouldStartLocalBrowserServer } from "../browser/config.js";
 import { detectMime } from "../media/mime.js";
 import { resolveAgentConfig } from "../agents/agent-scope.js";
-import { ensureMoltbotCliOnPath } from "../infra/path-env.js";
+import { ensureClawdbotCliOnPath } from "../infra/path-env.js";
 import { VERSION } from "../version.js";
 import { GATEWAY_CLIENT_MODES, GATEWAY_CLIENT_NAMES } from "../utils/message-channel.js";
 import { ensureNodeHostConfig, saveNodeHostConfig } from "./config.js";
@@ -109,41 +107,23 @@ function resolveBrowserProxyConfig() {
     return { enabled, allowProfiles };
 }
 let browserControlReady = null;
-async function ensureBrowserControlService() {
+async function ensureBrowserControlServer() {
     if (browserControlReady)
         return browserControlReady;
     browserControlReady = (async () => {
         const cfg = loadConfig();
-        const resolved = resolveBrowserConfig(cfg.browser, cfg);
+        const resolved = resolveBrowserConfig(cfg.browser);
         if (!resolved.enabled) {
             throw new Error("browser control disabled");
         }
-        const started = await startBrowserControlServiceFromConfig();
-        if (!started)
-            throw new Error("browser control disabled");
+        if (!shouldStartLocalBrowserServer(resolved)) {
+            throw new Error("browser control URL is non-loopback");
+        }
+        const mod = await import("../browser/server.js");
+        await mod.startBrowserControlServerFromConfig();
     })();
     return browserControlReady;
 }
-async function withTimeout(promise, timeoutMs, label) {
-    const resolved = typeof timeoutMs === "number" && Number.isFinite(timeoutMs)
-        ? Math.max(1, Math.floor(timeoutMs))
-        : undefined;
-    if (!resolved)
-        return await promise;
-    let timer;
-    const timeoutPromise = new Promise((_, reject) => {
-        timer = setTimeout(() => {
-            reject(new Error(`${label ?? "request"} timed out`));
-        }, resolved);
-    });
-    try {
-        return await Promise.race([promise, timeoutPromise]);
-    }
-    finally {
-        if (timer)
-            clearTimeout(timer);
-    }
-}
 function isProfileAllowed(params) {
     const { allowProfiles, profile } = params;
     if (!allowProfiles.length)
@@ -296,7 +276,7 @@ function resolveEnvPath(env) {
     return raw.split(path.delimiter).filter(Boolean);
 }
 function ensureNodePathEnv() {
-    ensureMoltbotCliOnPath({ pathEnv: process.env.PATH ?? "" });
+    ensureClawdbotCliOnPath({ pathEnv: process.env.PATH ?? "" });
     const current = process.env.PATH ?? "";
     if (current.trim())
         return current;
@@ -365,8 +345,10 @@ export async function runNodeHost(opts) {
     await saveNodeHostConfig(config);
     const cfg = loadConfig();
     const browserProxy = resolveBrowserProxyConfig();
-    const resolvedBrowser = resolveBrowserConfig(cfg.browser, cfg);
-    const browserProxyEnabled = browserProxy.enabled && resolvedBrowser.enabled;
+    const resolvedBrowser = resolveBrowserConfig(cfg.browser);
+    const browserProxyEnabled = browserProxy.enabled &&
+        resolvedBrowser.enabled &&
+        shouldStartLocalBrowserServer(resolvedBrowser);
     const isRemoteMode = cfg.gateway?.mode === "remote";
     const token = process.env.CLAWDBOT_GATEWAY_TOKEN?.trim() ||
         (isRemoteMode ? cfg.gateway?.remote?.token : cfg.gateway?.auth?.token);
@@ -447,11 +429,9 @@ async function handleInvoke(frame, client, skillBins) {
             });
         }
         catch (err) {
-            const message = String(err);
-            const code = message.toLowerCase().includes("timed out") ? "TIMEOUT" : "INVALID_REQUEST";
             await sendInvokeResult(client, frame, {
                 ok: false,
-                error: { code, message },
+                error: { code: "INVALID_REQUEST", message: String(err) },
             });
         }
         return;
@@ -530,9 +510,8 @@ async function handleInvoke(frame, client, skillBins) {
             if (!proxyConfig.enabled) {
                 throw new Error("UNAVAILABLE: node browser proxy disabled");
             }
-            await ensureBrowserControlService();
-            const cfg = loadConfig();
-            const resolved = resolveBrowserConfig(cfg.browser, cfg);
+            await ensureBrowserControlServer();
+            const resolved = resolveBrowserConfig(loadConfig().browser);
             const requestedProfile = typeof params.profile === "string" ? params.profile.trim() : "";
             const allowedProfiles = proxyConfig.allowProfiles;
             if (allowedProfiles.length > 0) {
@@ -548,34 +527,51 @@ async function handleInvoke(frame, client, skillBins) {
                     }
                 }
             }
-            const method = typeof params.method === "string" ? params.method.toUpperCase() : "GET";
-            const path = pathValue.startsWith("/") ? pathValue : `/${pathValue}`;
-            const body = params.body;
-            const query = {};
+            const url = new URL(pathValue.startsWith("/") ? pathValue : `/${pathValue}`, resolved.controlUrl);
             if (requestedProfile) {
-                query.profile = requestedProfile;
+                url.searchParams.set("profile", requestedProfile);
             }
-            const rawQuery = params.query ?? {};
-            for (const [key, value] of Object.entries(rawQuery)) {
+            const query = params.query ?? {};
+            for (const [key, value] of Object.entries(query)) {
                 if (value === undefined || value === null)
                     continue;
-                query[key] = typeof value === "string" ? value : String(value);
+                url.searchParams.set(key, String(value));
+            }
+            const method = typeof params.method === "string" ? params.method.toUpperCase() : "GET";
+            const body = params.body;
+            const ctrl = new AbortController();
+            const timeoutMs = typeof params.timeoutMs === "number" && Number.isFinite(params.timeoutMs)
+                ? Math.max(1, Math.floor(params.timeoutMs))
+                : 20_000;
+            const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+            const headers = new Headers();
+            let bodyJson;
+            if (body !== undefined) {
+                headers.set("Content-Type", "application/json");
+                bodyJson = JSON.stringify(body);
+            }
+            const token = process.env.CLAWDBOT_BROWSER_CONTROL_TOKEN?.trim() || resolved.controlToken?.trim();
+            if (token) {
+                headers.set("Authorization", `Bearer ${token}`);
+            }
+            let res;
+            try {
+                res = await fetch(url.toString(), {
+                    method,
+                    headers,
+                    body: bodyJson,
+                    signal: ctrl.signal,
+                });
+            }
+            finally {
+                clearTimeout(timer);
             }
-            const dispatcher = createBrowserRouteDispatcher(createBrowserControlContext());
-            const response = await withTimeout(dispatcher.dispatch({
-                method: method === "DELETE" ? "DELETE" : method === "POST" ? "POST" : "GET",
-                path,
-                query,
-                body,
-            }), params.timeoutMs, "browser proxy request");
-            if (response.status >= 400) {
-                const message = response.body && typeof response.body === "object" && "error" in response.body
-                    ? String(response.body.error)
-                    : `HTTP ${response.status}`;
-                throw new Error(message);
+            if (!res.ok) {
+                const text = await res.text().catch(() => "");
+                throw new Error(text ? `${res.status}: ${text}` : `HTTP ${res.status}`);
             }
-            const result = response.body;
-            if (allowedProfiles.length > 0 && path === "/profiles") {
+            const result = (await res.json());
+            if (allowedProfiles.length > 0 && url.pathname === "/profiles") {
                 const obj = typeof result === "object" && result !== null ? result : {};
                 const profiles = Array.isArray(obj.profiles) ? obj.profiles : [];
                 obj.profiles = profiles.filter((entry) => {

package/dist/pairing/pairing-messages.js

@@ -2,13 +2,13 @@ import { formatCliCommand } from "../cli/command-format.js";
 export function buildPairingReply(params) {
     const { channel, idLine, code } = params;
     return [
-        "Moltbot: access not configured.",
+        "Clawdbot: access not configured.",
         "",
         idLine,
         "",
         `Pairing code: ${code}`,
         "",
         "Ask the bot owner to approve with:",
-        formatCliCommand(`moltbot pairing approve ${channel} <code>`),
+        formatCliCommand(`clawdbot pairing approve ${channel} <code>`),
     ].join("\n");
 }

package/dist/plugin-sdk/index.js

@@ -11,7 +11,6 @@ export { ToolPolicySchema } from "../config/zod-schema.agent-runtime.js";
 export { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "../routing/session-key.js";
 export { resolveAckReaction } from "../agents/identity.js";
 export { SILENT_REPLY_TOKEN, isSilentReplyText } from "../auto-reply/tokens.js";
-export { resolveToolsBySender } from "../config/group-policy.js";
 export { buildPendingHistoryContextFromMap, clearHistoryEntries, clearHistoryEntriesIfEnabled, DEFAULT_GROUP_HISTORY_LIMIT, recordPendingHistoryEntry, recordPendingHistoryEntryIfEnabled, } from "../auto-reply/reply/history.js";
 export { mergeAllowlist, summarizeMapping } from "../channels/allowlists/resolve-utils.js";
 export { resolveMentionGating, resolveMentionGatingWithBypass, } from "../channels/mention-gating.js";

package/dist/plugins/cli.js

@@ -1,7 +1,7 @@
 import { resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agents/agent-scope.js";
 import { loadConfig } from "../config/config.js";
 import { createSubsystemLogger } from "../logging/subsystem.js";
-import { loadPoolBotPlugins } from "./loader.js";
+import { loadClawdbotPlugins } from "./loader.js";
 const log = createSubsystemLogger("plugins");
 export function registerPluginCliCommands(program, cfg) {
     const config = cfg ?? loadConfig();
@@ -12,7 +12,7 @@ export function registerPluginCliCommands(program, cfg) {
         error: (msg) => log.error(msg),
         debug: (msg) => log.debug(msg),
     };
-    const registry = loadPoolBotPlugins({
+    const registry = loadClawdbotPlugins({
         config,
         workspaceDir,
         logger,

package/dist/plugins/discovery.js

@@ -2,7 +2,6 @@ import fs from "node:fs";
 import path from "node:path";
 import { resolveConfigDir, resolveUserPath } from "../utils.js";
 import { resolveBundledPluginsDir } from "./bundled-dir.js";
-import { getPackageManifestMetadata, } from "./manifest.js";
 const EXTENSION_EXTS = new Set([".ts", ".js", ".mts", ".cts", ".mjs", ".cjs"]);
 function isExtensionFile(filePath) {
     const ext = path.extname(filePath);
@@ -23,7 +22,7 @@ function readPackageManifest(dir) {
     }
 }
 function resolvePackageExtensions(manifest) {
-    const raw = getPackageManifestMetadata(manifest)?.extensions;
+    const raw = manifest.clawdbot?.extensions;
     if (!Array.isArray(raw))
         return [];
     return raw.map((entry) => (typeof entry === "string" ? entry.trim() : "")).filter(Boolean);
@@ -34,7 +33,7 @@ function deriveIdHint(params) {
     if (!rawPackageName)
         return base;
     // Prefer the unscoped name so config keys stay stable even when the npm
-    // package is scoped (example: @moltbot/voice-call -> voice-call).
+    // package is scoped (example: @clawdbot/voice-call -> voice-call).
     const unscoped = rawPackageName.includes("/")
         ? (rawPackageName.split("/").pop() ?? rawPackageName)
         : rawPackageName;
@@ -58,7 +57,7 @@ function addCandidate(params) {
         packageVersion: manifest?.version?.trim() || undefined,
         packageDescription: manifest?.description?.trim() || undefined,
         packageDir: params.packageDir,
-        packageMoltbot: getPackageManifestMetadata(manifest ?? undefined),
+        packageClawdbot: manifest?.clawdbot,
     });
 }
 function discoverInDirectory(params) {
@@ -219,7 +218,7 @@ function discoverFromPath(params) {
         return;
     }
 }
-export function discoverPoolBotPlugins(params) {
+export function discoverClawdbotPlugins(params) {
     const candidates = [];
     const diagnostics = [];
     const seen = new Set();