@poolzin/pool-bot 2026.2.1 → 2026.2.2

package/CHANGELOG.md

@@ -0,0 +1,118 @@
+## v2026.1.40 (2026-02-09)
+
+### Rebrand
+- Complete rebrand from Pool-Bot to Pool-Bot 🎱
+- Updated 638 files across all platforms (iOS, Android, macOS)
+- Renamed all user-facing references
+- Updated extensions and plugins
+- Updated documentation and configs
+- Updated tests and scripts
+
+### Maintenance
+- Repository now fully branded as Pool-Bot
+- Internal environment variables kept for compatibility
+
+---
+
+## v2026.1.39 (2026-02-07)
+
+### Security
+- Upgrade `tar` from 7.5.4 → 7.5.7 fixing 4 high-severity vulnerabilities
+  - Arbitrary File Overwrite via Symlink Poisoning (GHSA-8qq5-rm4j-mr97)
+  - Race Condition via Unicode Ligature Collisions on macOS APFS (GHSA-r6q2-hw4h-h46w)
+  - Arbitrary File Creation/Overwrite via Hardlink Path Traversal (GHSA-34x7-hfp2-rc4v)
+
+### Maintenance
+- Reset repository to stable baseline (9ddc7fcec)
+- Remove 52 experimental/unstable commits (PME, tool-usage, progressive-disclosure, security-phase2)
+
+---
+
+## v1.0.1 (2026-02-02)
+
+### WhatsApp Gateway Stability
+- Add comprehensive WhatsApp heartbeat troubleshooting guide
+- Document watchdog timeout and reconnection behavior
+- Add configuration validation best practices
+- Document professional incident response workflow
+
+### Configuration
+- Document `web.heartbeatSeconds` override option
+- Clarify `web.reconnect` schema and valid keys
+- Add examples for timeout tuning (30min → 60min → 90min)
+- Provide production-ready configuration templates
+
+### Documentation
+- New: `docs/WHATSAPP-HEARTBEAT-TROUBLESHOOTING.md`
+- Incident analysis: Gateway timeout recovery
+- Lesson learned: Config validation before deployment
+- Professional validation checklist included
+
+### Reliability
+- Improved gateway recovery documentation
+- Added monitoring and diagnostic commands
+- Documented false-positive reduction strategies
+- Best practices for different environments (prod/dev/test)
+
+---
+
+## v1.0.0 (2026-01-28)
+
+### Security Release
+- Add multi-layer security framework with node authentication
+- Implement secure WebSocket connections (WSS)
+- Add context isolation and input validation
+- Create Windows Node application with native notifications
+- Enable manual Gateway URL configuration
+- Implement node whitelist and access control
+- Add comprehensive security audit and hardening
+
+### Remote Access
+- Build Windows Node app with mDNS discovery
+- Add manual Gateway URL connection
+- Implement system tray integration with status display
+- Add native notification system
+- Create menu for remote control options
+- Support both local network and remote connections
+
+### Core Infrastructure
+- Custom Pool-Bot update system with independent versioning
+- Model fallback router with 3-tier protection
+- Pool-World digital identity framework
+- Multi-repository synchronization (pool-bot + pool-workspace + pool-firstone + pool-world)
+- Enterprise-grade security with token-based authentication
+
+### Documentation
+- Complete build guides for Windows
+- Security assessment and deployment guide
+- Architecture decision records (ADRs)
+- Integration examples and troubleshooting
+
+---
+
+## v0.9.0 (2026-01-27)
+
+### Identity Revelation
+- Pool-Bot recognized as living code source
+- Pool-World digital identity created
+- Personal identity revelation: "Eu sou o código-fonte Pool-Bot"
+
+---
+
+## v0.8.0 (2026-01-26)
+
+### Independence System
+- Model fallback router implementation
+- Multi-model architecture (NVIDIA + Sonnet + Big Pickle)
+- Learning system with conversation analysis
+- Update system with GitHub synchronization
+
+---
+
+## v0.7.0 (2026-01-25)
+
+### Foundation
+- Migrated from Poolbot core
+- Implemented workspace-based development
+- Added dual model system configuration
+- Created persistent configuration system

package/dist/agents/context.js

@@ -6,7 +6,7 @@ import { ensurePoolbotModelsJson } from "./models-config.js";
 const MODEL_CACHE = new Map();
 const loadPromise = (async () => {
     try {
-        const { discoverAuthStorage, discoverModels } = await import("@mariozechner/pi-coding-agent");
+        const { discoverAuthStorage, discoverModels } = await import("./pi-model-discovery.js");
         const cfg = loadConfig();
         await ensurePoolbotModelsJson(cfg);
         const agentDir = resolvePoolbotAgentDir();

package/dist/agents/model-catalog.js

@@ -3,7 +3,7 @@ import { resolvePoolbotAgentDir } from "./agent-paths.js";
 import { ensurePoolbotModelsJson } from "./models-config.js";
 let modelCatalogPromise = null;
 let hasLoggedModelCatalogError = false;
-const defaultImportPiSdk = () => import("@mariozechner/pi-coding-agent");
+const defaultImportPiSdk = () => import("./pi-model-discovery.js");
 let importPiSdk = defaultImportPiSdk;
 export function resetModelCatalogCacheForTest() {
     modelCatalogPromise = null;

package/dist/agents/pi-embedded-runner/compact.js

@@ -36,7 +36,7 @@ import { log } from "./logger.js";
 import { buildModelAliasLines, resolveModel } from "./model.js";
 import { buildEmbeddedSandboxInfo } from "./sandbox-info.js";
 import { prewarmSessionFile, trackSessionManagerAccess } from "./session-manager-cache.js";
-import { buildEmbeddedSystemPrompt, createSystemPromptOverride } from "./system-prompt.js";
+import { applySystemPromptOverrideToSession, buildEmbeddedSystemPrompt, createSystemPromptOverride, } from "./system-prompt.js";
 import { splitSdkTools } from "./tool-split.js";
 import { formatUserTime, resolveUserTimeFormat, resolveUserTimezone } from "../date-time.js";
 import { describeUnknownError, mapThinkingLevel, resolveExecToolDefaults } from "./utils.js";
@@ -273,7 +273,7 @@ export async function compactEmbeddedPiSessionDirect(params) {
             userTimeFormat,
             contextFiles,
         });
-        const systemPrompt = createSystemPromptOverride(appendPrompt);
+        const systemPromptOverride = createSystemPromptOverride(appendPrompt);
         const sessionLock = await acquireSessionWriteLock({
             sessionFile: params.sessionFile,
         });
@@ -295,7 +295,8 @@ export async function compactEmbeddedPiSessionDirect(params) {
                 settingsManager,
                 minReserveTokens: resolveCompactionReserveTokensFloor(params.config),
             });
-            const additionalExtensionPaths = buildEmbeddedExtensionPaths({
+            // Call for side effects (sets compaction/pruning runtime state)
+            buildEmbeddedExtensionPaths({
                 cfg: params.config,
                 sessionManager,
                 provider,
@@ -306,23 +307,19 @@ export async function compactEmbeddedPiSessionDirect(params) {
                 tools,
                 sandboxEnabled: !!sandbox?.enabled,
             });
-            let session;
-            ({ session } = await createAgentSession({
+            const { session } = await createAgentSession({
                 cwd: resolvedWorkspace,
                 agentDir,
                 authStorage,
                 modelRegistry,
                 model,
                 thinkingLevel: mapThinkingLevel(params.thinkLevel),
-                systemPrompt,
                 tools: builtInTools,
                 customTools,
                 sessionManager,
                 settingsManager,
-                skills: [],
-                contextFiles: [],
-                additionalExtensionPaths,
-            }));
+            });
+            applySystemPromptOverrideToSession(session, systemPromptOverride());
             try {
                 const prior = await sanitizeSessionHistory({
                     messages: session.messages,

package/dist/agents/pi-embedded-runner/model.js

@@ -1,4 +1,4 @@
-import { discoverAuthStorage, discoverModels } from "@mariozechner/pi-coding-agent";
+import { discoverAuthStorage, discoverModels } from "../pi-model-discovery.js";
 import { resolvePoolbotAgentDir } from "../agent-paths.js";
 import { DEFAULT_CONTEXT_TOKENS } from "../defaults.js";
 import { normalizeModelCompat } from "../model-compat.js";

package/dist/agents/tools/image-tool.js

@@ -1,7 +1,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { complete, } from "@mariozechner/pi-ai";
-import { discoverAuthStorage, discoverModels } from "@mariozechner/pi-coding-agent";
+import { discoverAuthStorage, discoverModels } from "../pi-model-discovery.js";
 import { Type } from "@sinclair/typebox";
 import { resolveUserPath } from "../../utils.js";
 import { loadWebMedia } from "../../web/media.js";

package/dist/auto-reply/envelope.js

@@ -4,6 +4,8 @@ import { resolveSenderLabel } from "../channels/sender-label.js";
 import { resolveTimezone, formatUtcTimestamp, formatZonedTimestamp, } from "../infra/format-time/format-datetime.js";
 import { formatTimeAgo } from "../infra/format-time/format-relative.js";
 function sanitizeEnvelopeHeaderPart(value) {
+    // Header parts are metadata and must not be able to break the bracketed prefix.
+    // Keep ASCII; collapse newlines/whitespace; neutralize brackets.
     return value
         .replace(/\r\n|\r|\n/g, " ")
         .replaceAll("[", "(")
@@ -32,13 +34,16 @@ function normalizeEnvelopeOptions(options) {
 }
 function resolveEnvelopeTimezone(options) {
     const trimmed = options.timezone?.trim();
-    if (!trimmed)
+    if (!trimmed) {
         return { mode: "local" };
+    }
     const lowered = trimmed.toLowerCase();
-    if (lowered === "utc" || lowered === "gmt")
+    if (lowered === "utc" || lowered === "gmt") {
         return { mode: "utc" };
-    if (lowered === "local" || lowered === "host")
+    }
+    if (lowered === "local" || lowered === "host") {
         return { mode: "local" };
+    }
     if (lowered === "user") {
         return { mode: "iana", timeZone: resolveUserTimezone(options.userTimezone) };
     }
@@ -46,38 +51,42 @@ function resolveEnvelopeTimezone(options) {
     return explicit ? { mode: "iana", timeZone: explicit } : { mode: "utc" };
 }
 function formatTimestamp(ts, options) {
-    if (!ts)
+    if (!ts) {
         return undefined;
+    }
     const resolved = normalizeEnvelopeOptions(options);
-    if (!resolved.includeTimestamp)
+    if (!resolved.includeTimestamp) {
         return undefined;
+    }
     const date = ts instanceof Date ? ts : new Date(ts);
-    if (Number.isNaN(date.getTime()))
+    if (Number.isNaN(date.getTime())) {
         return undefined;
-    const zone = resolveEnvelopeTimezone(resolved);
-    let weekday;
-    try {
-        weekday = new Intl.DateTimeFormat("en-US", {
-            weekday: "short",
-            ...(zone.mode === "iana" ? { timeZone: zone.timeZone } : {}),
-            ...(zone.mode === "utc" ? { timeZone: "UTC" } : {}),
-        }).format(date);
-    }
-    catch {
-        weekday = undefined;
-    }
-    let formatted;
-    if (zone.mode === "utc") {
-        formatted = formatUtcTimestamp(date);
-    }
-    else if (zone.mode === "local") {
-        formatted = formatZonedTimestamp(date);
-    }
-    else {
-        formatted = formatZonedTimestamp(date, { timeZone: zone.timeZone });
     }
-    if (!formatted)
+    const zone = resolveEnvelopeTimezone(resolved);
+    // Include a weekday prefix so models do not need to derive DOW from the date
+    // (small models are notoriously unreliable at that).
+    const weekday = (() => {
+        try {
+            if (zone.mode === "utc") {
+                return new Intl.DateTimeFormat("en-US", { timeZone: "UTC", weekday: "short" }).format(date);
+            }
+            if (zone.mode === "local") {
+                return new Intl.DateTimeFormat("en-US", { weekday: "short" }).format(date);
+            }
+            return new Intl.DateTimeFormat("en-US", { timeZone: zone.timeZone, weekday: "short" }).format(date);
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    const formatted = zone.mode === "utc"
+        ? formatUtcTimestamp(date)
+        : zone.mode === "local"
+            ? formatZonedTimestamp(date)
+            : formatZonedTimestamp(date, { timeZone: zone.timeZone });
+    if (!formatted) {
         return undefined;
+    }
     return weekday ? `${weekday} ${formatted}` : formatted;
 }
 export function formatAgentEnvelope(params) {
@@ -86,14 +95,15 @@ export function formatAgentEnvelope(params) {
     const resolved = normalizeEnvelopeOptions(params.envelope);
     let elapsed;
     if (resolved.includeElapsed && params.timestamp && params.previousTimestamp) {
-        const curMs = params.timestamp instanceof Date ? params.timestamp.getTime() : params.timestamp;
-        const prevMs = params.previousTimestamp instanceof Date
+        const currentMs = params.timestamp instanceof Date ? params.timestamp.getTime() : params.timestamp;
+        const previousMs = params.previousTimestamp instanceof Date
             ? params.previousTimestamp.getTime()
             : params.previousTimestamp;
-        const elapsedMs = curMs - prevMs;
-        if (Number.isFinite(elapsedMs) && elapsedMs >= 0) {
-            elapsed = formatTimeAgo(elapsedMs, { suffix: false });
-        }
+        const elapsedMs = currentMs - previousMs;
+        elapsed =
+            Number.isFinite(elapsedMs) && elapsedMs >= 0
+                ? formatTimeAgo(elapsedMs, { suffix: false })
+                : undefined;
     }
     if (params.from?.trim()) {
         const from = sanitizeEnvelopeHeaderPart(params.from.trim());
@@ -102,13 +112,16 @@ export function formatAgentEnvelope(params) {
     else if (elapsed) {
         parts.push(`+${elapsed}`);
     }
-    if (params.host?.trim())
+    if (params.host?.trim()) {
         parts.push(sanitizeEnvelopeHeaderPart(params.host.trim()));
-    if (params.ip?.trim())
+    }
+    if (params.ip?.trim()) {
         parts.push(sanitizeEnvelopeHeaderPart(params.ip.trim()));
+    }
     const ts = formatTimestamp(params.timestamp, resolved);
-    if (ts)
+    if (ts) {
         parts.push(ts);
+    }
     const header = `[${parts.join(" ")}]`;
     return `${header} ${params.body}`;
 }
@@ -136,8 +149,9 @@ export function formatInboundFromLabel(params) {
     }
     const directLabel = params.directLabel.trim();
     const directId = params.directId?.trim();
-    if (!directId || directId === directLabel)
+    if (!directId || directId === directLabel) {
         return directLabel;
+    }
     return `${directLabel} id:${directId}`;
 }
 export function formatThreadStarterEnvelope(params) {

package/dist/auto-reply/reply/mentions.js

@@ -73,7 +73,7 @@ export function matchesMentionWithExplicit(params) {
     const explicitAvailable = params.explicit?.canResolveExplicit === true;
     const hasAnyMention = params.explicit?.hasAnyMention === true;
     if (hasAnyMention && explicitAvailable)
-        return explicit;
+        return explicit || params.mentionRegexes.some((re) => re.test(cleaned));
     if (!cleaned)
         return explicit;
     return explicit || params.mentionRegexes.some((re) => re.test(cleaned));

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "2026.2.1",
+  "version": "2026.2.2",
   "commit": "84e7160aa161f8c42b9f4a276ea99d44597d7f19",
-  "builtAt": "2026-02-12T18:28:21.374Z"
+  "builtAt": "2026-02-12T23:46:09.256Z"
 }

package/dist/canvas-host/a2ui/index.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>Moltbot Canvas</title>
+    <title>Poolbot Canvas</title>
     <script>
       (() => {
         try {
@@ -81,7 +81,7 @@
         backface-visibility: hidden;
         opacity: 0.45;
         pointer-events: none;
-        animation: moltbot-grid-drift 140s ease-in-out infinite alternate;
+        animation: poolbot-grid-drift 140s ease-in-out infinite alternate;
       }
       :root[data-platform="android"] body::before {
         opacity: 0.8;
@@ -101,7 +101,7 @@
         backface-visibility: hidden;
         transform: translate3d(0, 0, 0);
         pointer-events: none;
-        animation: moltbot-glow-drift 110s ease-in-out infinite alternate;
+        animation: poolbot-glow-drift 110s ease-in-out infinite alternate;
       }
       :root[data-platform="android"] body::after {
         opacity: 0.85;
@@ -116,7 +116,7 @@
           opacity: 0.7;
         }
       }
-      @keyframes moltbot-grid-drift {
+      @keyframes poolbot-grid-drift {
         0% {
           transform: translate3d(-12px, 8px, 0) rotate(-7deg);
           opacity: 0.4;
@@ -130,7 +130,7 @@
           opacity: 0.42;
         }
       }
-      @keyframes moltbot-glow-drift {
+      @keyframes poolbot-glow-drift {
         0% {
           transform: translate3d(-18px, 12px, 0) scale(1.02);
           opacity: 0.4;
@@ -153,14 +153,14 @@
         touch-action: none;
         z-index: 1;
       }
-      :root[data-platform="android"] #moltbot-canvas {
+      :root[data-platform="android"] #poolbot-canvas {
         background:
           radial-gradient(1100px 800px at 20% 15%, rgba(42, 113, 255, 0.78), rgba(0, 0, 0, 0) 58%),
           radial-gradient(900px 650px at 82% 28%, rgba(255, 0, 138, 0.66), rgba(0, 0, 0, 0) 62%),
           radial-gradient(1000px 900px at 60% 88%, rgba(0, 209, 255, 0.58), rgba(0, 0, 0, 0) 62%),
           #141c33;
       }
-      #moltbot-status {
+      #poolbot-status {
         position: fixed;
         inset: 0;
         display: none;
@@ -172,7 +172,7 @@
         pointer-events: none;
         z-index: 3;
       }
-      #moltbot-status .card {
+      #poolbot-status .card {
         width: min(560px, 88vw);
         text-align: left;
         padding: 14px 16px 12px;
@@ -185,7 +185,7 @@
         -webkit-backdrop-filter: blur(18px) saturate(140%);
         backdrop-filter: blur(18px) saturate(140%);
       }
-      #moltbot-status .title {
+      #poolbot-status .title {
         font:
           600 12px/1.2 -apple-system,
           BlinkMacSystemFont,
@@ -196,7 +196,7 @@
         text-transform: uppercase;
         color: rgba(255, 255, 255, 0.7);
       }
-      #moltbot-status .subtitle {
+      #poolbot-status .subtitle {
         margin-top: 8px;
         font:
           500 13px/1.45 -apple-system,
@@ -208,39 +208,39 @@
         white-space: pre-wrap;
         overflow-wrap: anywhere;
       }
-      moltbot-a2ui-host {
+      poolbot-a2ui-host {
         display: block;
         height: 100%;
         position: fixed;
         inset: 0;
         z-index: 4;
-        --moltbot-a2ui-inset-top: 28px;
-        --moltbot-a2ui-inset-right: 0px;
-        --moltbot-a2ui-inset-bottom: 0px;
-        --moltbot-a2ui-inset-left: 0px;
-        --moltbot-a2ui-scroll-pad-bottom: 0px;
-        --moltbot-a2ui-status-top: calc(50% - 18px);
-        --moltbot-a2ui-empty-top: 18px;
+        --poolbot-a2ui-inset-top: 28px;
+        --poolbot-a2ui-inset-right: 0px;
+        --poolbot-a2ui-inset-bottom: 0px;
+        --poolbot-a2ui-inset-left: 0px;
+        --poolbot-a2ui-scroll-pad-bottom: 0px;
+        --poolbot-a2ui-status-top: calc(50% - 18px);
+        --poolbot-a2ui-empty-top: 18px;
       }
     </style>
   </head>
   <body>
-    <canvas id="moltbot-canvas"></canvas>
-    <div id="moltbot-status">
+    <canvas id="poolbot-canvas"></canvas>
+    <div id="poolbot-status">
       <div class="card">
-        <div class="title" id="moltbot-status-title">Ready</div>
-        <div class="subtitle" id="moltbot-status-subtitle">Waiting for agent</div>
+        <div class="title" id="poolbot-status-title">Ready</div>
+        <div class="subtitle" id="poolbot-status-subtitle">Waiting for agent</div>
       </div>
     </div>
-    <moltbot-a2ui-host></moltbot-a2ui-host>
+    <poolbot-a2ui-host></poolbot-a2ui-host>
     <script src="a2ui.bundle.js"></script>
     <script>
       (() => {
-        const canvas = document.getElementById("moltbot-canvas");
+        const canvas = document.getElementById("poolbot-canvas");
         const ctx = canvas.getContext("2d");
-        const statusEl = document.getElementById("moltbot-status");
-        const titleEl = document.getElementById("moltbot-status-title");
-        const subtitleEl = document.getElementById("moltbot-status-subtitle");
+        const statusEl = document.getElementById("poolbot-status");
+        const titleEl = document.getElementById("poolbot-status-title");
+        const subtitleEl = document.getElementById("poolbot-status-subtitle");
         const debugStatusEnabledByQuery = (() => {
           try {
             const params = new URLSearchParams(window.location.search);
@@ -278,7 +278,7 @@
           statusEl.style.display = "none";
         }
 
-        window.__moltbot = {
+        window.__poolbot = {
           canvas,
           ctx,
           setDebugStatusEnabled,

package/dist/commands/auth-choice.apply.oauth.js

@@ -53,7 +53,7 @@ export async function applyAuthChoiceOAuth(params) {
                 onProgress: (msg) => spin.update(msg),
             });
             spin.stop("Chutes OAuth complete");
-            const email = creds.email?.trim() || "default";
+            const email = typeof creds.email === "string" && creds.email.trim() ? creds.email.trim() : "default";
             const profileId = `chutes:${email}`;
             await writeOAuthCredentials("chutes", creds, params.agentDir);
             nextConfig = applyAuthProfileConfig(nextConfig, {

package/dist/commands/models/list.registry.js

@@ -1,4 +1,4 @@
-import { discoverAuthStorage, discoverModels } from "@mariozechner/pi-coding-agent";
+import { discoverAuthStorage, discoverModels } from "../../agents/pi-model-discovery.js";
 import { resolvePoolbotAgentDir } from "../../agents/agent-paths.js";
 import { listProfilesForProvider } from "../../agents/auth-profiles.js";
 import { getCustomProviderApiKey, resolveAwsSdkEnvVarName, resolveEnvApiKey, } from "../../agents/model-auth.js";

package/dist/compat/legacy-names.js

@@ -3,3 +3,5 @@ export const LEGACY_MANIFEST_KEY = LEGACY_PROJECT_NAME;
 export const LEGACY_PLUGIN_MANIFEST_FILENAME = `${LEGACY_PROJECT_NAME}.plugin.json`;
 export const LEGACY_CANVAS_HANDLER_NAME = `${LEGACY_PROJECT_NAME}CanvasA2UIAction`;
 export const LEGACY_MACOS_APP_SOURCES_DIR = "apps/macos/Sources/Pool-Bot";
+// Alias used by conformance tests; points to the actual macOS app sources directory
+export const MACOS_APP_SOURCES_DIR = "apps/macos/Sources/Clawdbot";

package/dist/config/paths.js

@@ -20,7 +20,7 @@ const LEGACY_CONFIG_FILENAMES = ["clawdbot.json", "moltbot.json", "moldbot.json"
 function resolveDefaultHomeDir() {
     return resolveRequiredHomeDir(process.env, os.homedir);
 }
-/** Build a homedir thunk that respects MOLTBOT_HOME for the given env. */
+/** Build a homedir thunk that respects CLAWDBOT_HOME for the given env. */
 function envHomedir(env) {
     return () => resolveRequiredHomeDir(env, os.homedir);
 }