@poolzin/pool-bot 2026.1.39 → 2026.2.1

package/dist/memory/session-files.js

@@ -1,6 +1,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { resolveSessionTranscriptsDirForAgent } from "../config/sessions/paths.js";
+import { redactSensitiveText } from "../logging/redact.js";
 import { createSubsystemLogger } from "../logging/subsystem.js";
 import { hashText } from "./internal.js";
 const log = createSubsystemLogger("memory");
@@ -55,7 +56,9 @@ export async function buildSessionEntry(absPath) {
         const raw = await fs.readFile(absPath, "utf-8");
         const lines = raw.split("\n");
         const collected = [];
-        for (const line of lines) {
+        const lineMap = [];
+        for (let jsonlIdx = 0; jsonlIdx < lines.length; jsonlIdx++) {
+            const line = lines[jsonlIdx];
             if (!line.trim())
                 continue;
             let record;
@@ -78,8 +81,10 @@ export async function buildSessionEntry(absPath) {
             const text = extractSessionText(message.content);
             if (!text)
                 continue;
+            const safe = redactSensitiveText(text, { mode: "tools" });
             const label = message.role === "user" ? "User" : "Assistant";
-            collected.push(`${label}: ${text}`);
+            collected.push(`${label}: ${safe}`);
+            lineMap.push(jsonlIdx + 1);
         }
         const content = collected.join("\n");
         return {
@@ -87,8 +92,9 @@ export async function buildSessionEntry(absPath) {
             absPath,
             mtimeMs: stat.mtimeMs,
             size: stat.size,
-            hash: hashText(content),
+            hash: hashText(content + "\n" + lineMap.join(",")),
             content,
+            lineMap,
         };
     }
     catch (err) {

package/dist/memory/types.js

@@ -0,0 +1 @@
+export {};

package/dist/node-host/runner.js

@@ -13,14 +13,20 @@ import { createBrowserControlContext, startBrowserControlServiceFromConfig, } fr
 import { createBrowserRouteDispatcher } from "../browser/routes/dispatcher.js";
 import { detectMime } from "../media/mime.js";
 import { resolveAgentConfig } from "../agents/agent-scope.js";
-import { ensureMoltbotCliOnPath } from "../infra/path-env.js";
+import { ensurePoolbotCliOnPath } from "../infra/path-env.js";
 import { VERSION } from "../version.js";
 import { GATEWAY_CLIENT_MODES, GATEWAY_CLIENT_NAMES } from "../utils/message-channel.js";
 import { ensureNodeHostConfig, saveNodeHostConfig } from "./config.js";
+import { withTimeout } from "./with-timeout.js";
 import { GatewayClient } from "../gateway/client.js";
 function resolveExecSecurity(value) {
     return value === "deny" || value === "allowlist" || value === "full" ? value : "allowlist";
 }
+function isCmdExeInvocation(argv) {
+    const bin = argv[0]?.trim().toLowerCase().replace(/\\/g, "/") ?? "";
+    const base = bin.split("/").pop() ?? "";
+    return base === "cmd" || base === "cmd.exe";
+}
 function resolveExecAsk(value) {
     return value === "off" || value === "on-miss" || value === "always" ? value : "on-miss";
 }
@@ -124,26 +130,6 @@ async function ensureBrowserControlService() {
     })();
     return browserControlReady;
 }
-async function withTimeout(promise, timeoutMs, label) {
-    const resolved = typeof timeoutMs === "number" && Number.isFinite(timeoutMs)
-        ? Math.max(1, Math.floor(timeoutMs))
-        : undefined;
-    if (!resolved)
-        return await promise;
-    let timer;
-    const timeoutPromise = new Promise((_, reject) => {
-        timer = setTimeout(() => {
-            reject(new Error(`${label ?? "request"} timed out`));
-        }, resolved);
-    });
-    try {
-        return await Promise.race([promise, timeoutPromise]);
-    }
-    finally {
-        if (timer)
-            clearTimeout(timer);
-    }
-}
 function isProfileAllowed(params) {
     const { allowProfiles, profile } = params;
     if (!allowProfiles.length)
@@ -296,7 +282,7 @@ function resolveEnvPath(env) {
     return raw.split(path.delimiter).filter(Boolean);
 }
 function ensureNodePathEnv() {
-    ensureMoltbotCliOnPath({ pathEnv: process.env.PATH ?? "" });
+    ensurePoolbotCliOnPath({ pathEnv: process.env.PATH ?? "" });
     const current = process.env.PATH ?? "";
     if (current.trim())
         return current;
@@ -422,7 +408,7 @@ export async function runNodeHost(opts) {
         },
     });
     const skillBins = new SkillBinsCache(async () => {
-        const res = (await client.request("skills.bins", {}));
+        const res = await client.request("skills.bins", {});
         const bins = Array.isArray(res?.bins) ? res.bins.map((bin) => String(bin)) : [];
         return bins;
     });
@@ -562,7 +548,7 @@ async function handleInvoke(frame, client, skillBins) {
                 query[key] = typeof value === "string" ? value : String(value);
             }
             const dispatcher = createBrowserRouteDispatcher(createBrowserControlContext());
-            const response = await withTimeout(dispatcher.dispatch({
+            const response = await withTimeout((_signal) => dispatcher.dispatch({
                 method: method === "DELETE" ? "DELETE" : method === "POST" ? "POST" : "GET",
                 path,
                 query,
@@ -597,7 +583,9 @@ async function handleInvoke(frame, client, skillBins) {
                         return file;
                     }
                     catch (err) {
-                        throw new Error(`browser proxy file read failed for ${p}: ${String(err)}`);
+                        throw new Error(`browser proxy file read failed for ${p}: ${String(err)}`, {
+                            cause: err,
+                        });
                     }
                 }));
                 if (loaded.length > 0)
@@ -675,6 +663,7 @@ async function handleInvoke(frame, client, skillBins) {
             env,
             skillBins: bins,
             autoAllowSkills,
+            platform: process.platform,
         });
         analysisOk = allowlistEval.analysisOk;
         allowlistMatches = allowlistEval.allowlistMatches;
@@ -698,6 +687,14 @@ async function handleInvoke(frame, client, skillBins) {
             security === "allowlist" && analysisOk ? allowlistEval.allowlistSatisfied : false;
         segments = analysis.segments;
     }
+    const isWindows = process.platform === "win32";
+    const cmdInvocation = rawCommand
+        ? isCmdExeInvocation(segments[0]?.argv ?? [])
+        : isCmdExeInvocation(argv);
+    if (security === "allowlist" && isWindows && cmdInvocation) {
+        analysisOk = false;
+        allowlistSatisfied = false;
+    }
     const useMacAppExec = process.platform === "darwin";
     if (useMacAppExec) {
         const approvalDecision = params.approvalDecision === "allow-once" || params.approvalDecision === "allow-always"
@@ -853,7 +850,20 @@ async function handleInvoke(frame, client, skillBins) {
         });
         return;
     }
-    const result = await runCommand(argv, params.cwd?.trim() || undefined, env, params.timeoutMs ?? undefined);
+    /* On Windows, avoid spawning via cmd.exe when the allowlist already approved
+     * a single-segment command — run the parsed argv directly instead. */
+    let execArgv = argv;
+    if (security === "allowlist" &&
+        isWindows &&
+        !approvedByAsk &&
+        rawCommand &&
+        analysisOk &&
+        allowlistSatisfied &&
+        segments.length === 1 &&
+        segments[0]?.argv.length > 0) {
+        execArgv = segments[0].argv;
+    }
+    const result = await runCommand(execArgv, params.cwd?.trim() || undefined, env, params.timeoutMs ?? undefined);
     if (result.truncated) {
         const suffix = "... (truncated)";
         if (result.stderr.trim().length > 0) {

package/dist/node-host/with-timeout.js

@@ -0,0 +1,27 @@
+export async function withTimeout(work, timeoutMs, label) {
+    const resolved = typeof timeoutMs === "number" && Number.isFinite(timeoutMs)
+        ? Math.max(1, Math.floor(timeoutMs))
+        : undefined;
+    if (!resolved) {
+        return await work(undefined);
+    }
+    const abortCtrl = new AbortController();
+    const timeoutError = new Error(`${label ?? "request"} timed out`);
+    const timer = setTimeout(() => abortCtrl.abort(timeoutError), resolved);
+    let abortListener;
+    const abortPromise = abortCtrl.signal.aborted
+        ? Promise.reject(abortCtrl.signal.reason ?? timeoutError)
+        : new Promise((_, reject) => {
+            abortListener = () => reject(abortCtrl.signal.reason ?? timeoutError);
+            abortCtrl.signal.addEventListener("abort", abortListener, { once: true });
+        });
+    try {
+        return await Promise.race([work(abortCtrl.signal), abortPromise]);
+    }
+    finally {
+        clearTimeout(timer);
+        if (abortListener) {
+            abortCtrl.signal.removeEventListener("abort", abortListener);
+        }
+    }
+}

package/dist/pairing/pairing-messages.js

@@ -2,7 +2,7 @@ import { formatCliCommand } from "../cli/command-format.js";
 export function buildPairingReply(params) {
     const { channel, idLine, code } = params;
     return [
-        "Moltbot: access not configured.",
+        "Poolbot: access not configured.",
         "",
         idLine,
         "",

package/dist/plugins/commands.js

@@ -172,7 +172,7 @@ function sanitizeArgs(args) {
  * specific use case. This function provides basic defense-in-depth sanitization.
  */
 export async function executePluginCommand(params) {
-    const { command, args, senderId, channel, isAuthorizedSender, commandBody, config } = params;
+    const { command, args, senderId, channel, isAuthorizedSender, commandBody, config, from, to, accountId, messageThreadId, } = params;
     // Check authorization
     const requireAuth = command.requireAuth !== false; // Default to true
     if (requireAuth && !isAuthorizedSender) {
@@ -188,6 +188,10 @@ export async function executePluginCommand(params) {
         args: sanitizedArgs,
         commandBody,
         config,
+        from,
+        to,
+        accountId,
+        messageThreadId,
     };
     // Lock registry during execution to prevent concurrent modifications
     registryLocked = true;

package/dist/plugins/config-state.js

@@ -1,18 +1,26 @@
 import { defaultSlotIdForKey } from "./slots.js";
-export const BUNDLED_ENABLED_BY_DEFAULT = new Set();
+export const BUNDLED_ENABLED_BY_DEFAULT = new Set([
+    "device-pair",
+    "phone-control",
+    "talk-voice",
+]);
 const normalizeList = (value) => {
-    if (!Array.isArray(value))
+    if (!Array.isArray(value)) {
         return [];
+    }
     return value.map((entry) => (typeof entry === "string" ? entry.trim() : "")).filter(Boolean);
 };
 const normalizeSlotValue = (value) => {
-    if (typeof value !== "string")
+    if (typeof value !== "string") {
         return undefined;
+    }
     const trimmed = value.trim();
-    if (!trimmed)
+    if (!trimmed) {
         return undefined;
-    if (trimmed.toLowerCase() === "none")
+    }
+    if (trimmed.toLowerCase() === "none") {
         return null;
+    }
     return trimmed;
 };
 const normalizePluginEntries = (entries) => {
@@ -21,8 +29,9 @@ const normalizePluginEntries = (entries) => {
     }
     const normalized = {};
     for (const [key, value] of Object.entries(entries)) {
-        if (!key.trim())
+        if (!key.trim()) {
             continue;
+        }
         if (!value || typeof value !== "object" || Array.isArray(value)) {
             normalized[key] = {};
             continue;
@@ -48,6 +57,75 @@ export const normalizePluginsConfig = (config) => {
         entries: normalizePluginEntries(config?.entries),
     };
 };
+const hasExplicitMemorySlot = (plugins) => Boolean(plugins?.slots && Object.prototype.hasOwnProperty.call(plugins.slots, "memory"));
+const hasExplicitMemoryEntry = (plugins) => Boolean(plugins?.entries && Object.prototype.hasOwnProperty.call(plugins.entries, "memory-core"));
+const hasExplicitPluginConfig = (plugins) => {
+    if (!plugins) {
+        return false;
+    }
+    if (typeof plugins.enabled === "boolean") {
+        return true;
+    }
+    if (Array.isArray(plugins.allow) && plugins.allow.length > 0) {
+        return true;
+    }
+    if (Array.isArray(plugins.deny) && plugins.deny.length > 0) {
+        return true;
+    }
+    if (plugins.load?.paths && Array.isArray(plugins.load.paths) && plugins.load.paths.length > 0) {
+        return true;
+    }
+    if (plugins.slots && Object.keys(plugins.slots).length > 0) {
+        return true;
+    }
+    if (plugins.entries && Object.keys(plugins.entries).length > 0) {
+        return true;
+    }
+    return false;
+};
+export function applyTestPluginDefaults(cfg, env = process.env) {
+    if (!env.VITEST) {
+        return cfg;
+    }
+    const plugins = cfg.plugins;
+    const explicitConfig = hasExplicitPluginConfig(plugins);
+    if (explicitConfig) {
+        if (hasExplicitMemorySlot(plugins) || hasExplicitMemoryEntry(plugins)) {
+            return cfg;
+        }
+        return {
+            ...cfg,
+            plugins: {
+                ...plugins,
+                slots: {
+                    ...plugins?.slots,
+                    memory: "none",
+                },
+            },
+        };
+    }
+    return {
+        ...cfg,
+        plugins: {
+            ...plugins,
+            enabled: false,
+            slots: {
+                ...plugins?.slots,
+                memory: "none",
+            },
+        },
+    };
+}
+export function isTestDefaultMemorySlotDisabled(cfg, env = process.env) {
+    if (!env.VITEST) {
+        return false;
+    }
+    const plugins = cfg.plugins;
+    if (hasExplicitMemorySlot(plugins) || hasExplicitMemoryEntry(plugins)) {
+        return false;
+    }
+    return true;
+}
 export function resolveEnableState(id, origin, config) {
     if (!config.enabled) {
         return { enabled: false, reason: "plugins disabled" };
@@ -77,8 +155,9 @@ export function resolveEnableState(id, origin, config) {
     return { enabled: true };
 }
 export function resolveMemorySlotDecision(params) {
-    if (params.kind !== "memory")
+    if (params.kind !== "memory") {
         return { enabled: true };
+    }
     if (params.slot === null) {
         return { enabled: false, reason: "memory slot disabled" };
     }

package/dist/plugins/discovery.js

@@ -58,7 +58,7 @@ function addCandidate(params) {
         packageVersion: manifest?.version?.trim() || undefined,
         packageDescription: manifest?.description?.trim() || undefined,
         packageDir: params.packageDir,
-        packageMoltbot: getPackageManifestMetadata(manifest ?? undefined),
+        packagePoolbot: getPackageManifestMetadata(manifest ?? undefined),
     });
 }
 function discoverInDirectory(params) {

package/dist/plugins/install.js

@@ -21,7 +21,7 @@ function safeDirName(input) {
 function safeFileName(input) {
     return safeDirName(input);
 }
-async function ensureMoltbotExtensions(manifest) {
+async function ensurePoolbotExtensions(manifest) {
     const extensions = manifest.poolbot?.extensions ?? manifest[LEGACY_MANIFEST_KEY]?.extensions;
     if (!Array.isArray(extensions)) {
         throw new Error("package.json missing poolbot.extensions");
@@ -56,7 +56,7 @@ async function installPluginFromPackageDir(params) {
     }
     let extensions;
     try {
-        extensions = await ensureMoltbotExtensions(manifest);
+        extensions = await ensurePoolbotExtensions(manifest);
     }
     catch (err) {
         return { ok: false, error: String(err) };

package/dist/plugins/source-display.js

@@ -0,0 +1,51 @@
+import path from "node:path";
+import { resolveConfigDir, shortenHomeInString } from "../utils.js";
+import { resolveBundledPluginsDir } from "./bundled-dir.js";
+function tryRelative(root, filePath) {
+    const rel = path.relative(root, filePath);
+    if (!rel || rel === ".") {
+        return null;
+    }
+    if (rel === "..") {
+        return null;
+    }
+    if (rel.startsWith(`..${path.sep}`) || rel.startsWith("../") || rel.startsWith("..\\")) {
+        return null;
+    }
+    if (path.isAbsolute(rel)) {
+        return null;
+    }
+    // Normalize to forward slashes for display (path.relative uses backslashes on Windows)
+    return rel.replaceAll("\\", "/");
+}
+export function resolvePluginSourceRoots(params) {
+    const stock = resolveBundledPluginsDir();
+    const global = path.join(resolveConfigDir(), "extensions");
+    const workspace = params.workspaceDir
+        ? path.join(params.workspaceDir, ".poolbot", "extensions")
+        : undefined;
+    return { stock, global, workspace };
+}
+export function formatPluginSourceForTable(plugin, roots) {
+    const raw = plugin.source;
+    if (plugin.origin === "bundled" && roots.stock) {
+        const rel = tryRelative(roots.stock, raw);
+        if (rel) {
+            return { value: `stock:${rel}`, rootKey: "stock" };
+        }
+    }
+    if (plugin.origin === "workspace" && roots.workspace) {
+        const rel = tryRelative(roots.workspace, raw);
+        if (rel) {
+            return { value: `workspace:${rel}`, rootKey: "workspace" };
+        }
+    }
+    if (plugin.origin === "global" && roots.global) {
+        const rel = tryRelative(roots.global, raw);
+        if (rel) {
+            return { value: `global:${rel}`, rootKey: "global" };
+        }
+    }
+    // Keep this stable/pasteable; only ~-shorten.
+    return { value: shortenHomeInString(raw) };
+}

package/dist/plugins/update.js

@@ -26,7 +26,7 @@ function resolveBundledPluginSources(params) {
         const pluginId = manifest.manifest.id;
         if (bundled.has(pluginId))
             continue;
-        const npmSpec = candidate.packageMoltbot?.install?.npmSpec?.trim() ||
+        const npmSpec = candidate.packagePoolbot?.install?.npmSpec?.trim() ||
             candidate.packageName?.trim() ||
             undefined;
         bundled.set(pluginId, {

package/dist/process/exec.js

@@ -5,6 +5,24 @@ import { danger, shouldLogVerbose } from "../globals.js";
 import { logDebug, logError } from "../logger.js";
 import { resolveCommandStdio } from "./spawn-utils.js";
 const execFileAsync = promisify(execFile);
+/**
+ * Resolves a command for Windows compatibility.
+ * On Windows, non-.exe commands (like npm, pnpm) require their .cmd extension.
+ */
+function resolveCommand(command) {
+    if (process.platform !== "win32")
+        return command;
+    const basename = path.basename(command).toLowerCase();
+    // Skip if already has an extension (.cmd, .exe, .bat, etc.)
+    const ext = path.extname(basename);
+    if (ext)
+        return command;
+    // Common npm-related commands that need .cmd extension on Windows
+    const cmdCommands = ["npm", "pnpm", "yarn", "npx"];
+    if (cmdCommands.includes(basename))
+        return `${command}.cmd`;
+    return command;
+}
 // Simple promise-wrapped execFile with optional verbosity logging.
 export async function runExec(command, args, opts = 10_000) {
     const options = typeof opts === "number"
@@ -15,7 +33,7 @@ export async function runExec(command, args, opts = 10_000) {
             encoding: "utf8",
         };
     try {
-        const { stdout, stderr } = await execFileAsync(command, args, options);
+        const { stdout, stderr } = await execFileAsync(resolveCommand(command), args, options);
         if (shouldLogVerbose()) {
             if (stdout.trim())
                 logDebug(stdout.trim());
@@ -54,7 +72,7 @@ export async function runCommandWithTimeout(argv, optionsOrTimeout) {
             resolvedEnv.npm_config_fund = "false";
     }
     const stdio = resolveCommandStdio({ hasInput, preferInherit: true });
-    const child = spawn(argv[0], argv.slice(1), {
+    const child = spawn(resolveCommand(argv[0]), argv.slice(1), {
         stdio,
         cwd,
         env: resolvedEnv,

package/dist/routing/resolve-route.js

@@ -27,6 +27,7 @@ export function buildAgentSessionKey(params) {
         agentId: params.agentId,
         mainKey: DEFAULT_MAIN_KEY,
         channel,
+        accountId: params.accountId,
         peerKind: peer?.kind ?? "dm",
         peerId: peer ? normalizeId(peer.id) || "unknown" : null,
         dmScope: params.dmScope,
@@ -98,6 +99,7 @@ export function resolveAgentRoute(input) {
         const sessionKey = buildAgentSessionKey({
             agentId: resolvedAgentId,
             channel,
+            accountId,
             peer,
             dmScope,
             identityLinks,
@@ -120,6 +122,16 @@ export function resolveAgentRoute(input) {
         if (peerMatch)
             return choose(peerMatch.agentId, "binding.peer");
     }
+    // Thread parent inheritance: if peer (thread) didn't match, check parent peer binding
+    const parentPeer = input.parentPeer
+        ? { kind: input.parentPeer.kind, id: normalizeId(input.parentPeer.id) }
+        : null;
+    if (parentPeer && parentPeer.id) {
+        const parentPeerMatch = bindings.find((b) => matchesPeer(b.match, parentPeer));
+        if (parentPeerMatch) {
+            return choose(parentPeerMatch.agentId, "binding.peer.parent");
+        }
+    }
     if (guildId) {
         const guildMatch = bindings.find((b) => matchesGuild(b.match, guildId));
         if (guildMatch)

package/dist/routing/session-key.js

@@ -38,6 +38,16 @@ export function resolveAgentIdFromSessionKey(sessionKey) {
     const parsed = parseAgentSessionKey(sessionKey);
     return normalizeAgentId(parsed?.agentId ?? DEFAULT_AGENT_ID);
 }
+export function classifySessionKeyShape(sessionKey) {
+    const raw = (sessionKey ?? "").trim();
+    if (!raw) {
+        return "missing";
+    }
+    if (parseAgentSessionKey(raw)) {
+        return "agent";
+    }
+    return raw.toLowerCase().startsWith("agent:") ? "malformed_agent" : "legacy_or_alias";
+}
 export function normalizeAgentId(value) {
     const trimmed = (value ?? "").trim();
     if (!trimmed)
@@ -99,6 +109,11 @@ export function buildAgentPeerSessionKey(params) {
         if (linkedPeerId)
             peerId = linkedPeerId;
         peerId = peerId.toLowerCase();
+        if (dmScope === "per-account-channel-peer" && peerId) {
+            const channel = (params.channel ?? "").trim().toLowerCase() || "unknown";
+            const accountId = normalizeAccountId(params.accountId);
+            return `agent:${normalizeAgentId(params.agentId)}:${channel}:${accountId}:dm:${peerId}`;
+        }
         if (dmScope === "per-channel-peer" && peerId) {
             const channel = (params.channel ?? "").trim().toLowerCase() || "unknown";
             return `agent:${normalizeAgentId(params.agentId)}:${channel}:dm:${peerId}`;

package/dist/runtime.js

@@ -1,4 +1,5 @@
 import { clearActiveProgressLine } from "./terminal/progress-line.js";
+import { restoreTerminalState } from "./terminal/restore.js";
 export const defaultRuntime = {
     log: (...args) => {
         clearActiveProgressLine();
@@ -9,6 +10,7 @@ export const defaultRuntime = {
         console.error(...args);
     },
     exit: (code) => {
+        restoreTerminalState("runtime exit");
         process.exit(code);
         throw new Error("unreachable"); // satisfies tests when mocked
     },