@poolzin/pool-bot 2026.2.11 → 2026.2.18

package/dist/browser/control-auth.js

@@ -0,0 +1,73 @@
+import crypto from "node:crypto";
+import { loadConfig, writeConfigFile } from "../config/config.js";
+import { resolveGatewayAuth } from "../gateway/auth.js";
+export function resolveBrowserControlAuth(cfg, env = process.env) {
+    const auth = resolveGatewayAuth({
+        authConfig: cfg?.gateway?.auth,
+        env,
+        tailscaleMode: cfg?.gateway?.tailscale?.mode,
+    });
+    const token = typeof auth.token === "string" ? auth.token.trim() : "";
+    const password = typeof auth.password === "string" ? auth.password.trim() : "";
+    return {
+        token: token || undefined,
+        password: password || undefined,
+    };
+}
+function shouldAutoGenerateBrowserAuth(env) {
+    const nodeEnv = (env.NODE_ENV ?? "").trim().toLowerCase();
+    if (nodeEnv === "test") {
+        return false;
+    }
+    const vitest = (env.VITEST ?? "").trim().toLowerCase();
+    if (vitest && vitest !== "0" && vitest !== "false" && vitest !== "off") {
+        return false;
+    }
+    return true;
+}
+export async function ensureBrowserControlAuth(params) {
+    const env = params.env ?? process.env;
+    const auth = resolveBrowserControlAuth(params.cfg, env);
+    if (auth.token || auth.password) {
+        return { auth };
+    }
+    if (!shouldAutoGenerateBrowserAuth(env)) {
+        return { auth };
+    }
+    // Respect explicit password mode even if currently unset.
+    if (params.cfg.gateway?.auth?.mode === "password") {
+        return { auth };
+    }
+    if (params.cfg.gateway?.auth?.mode === "trusted-proxy") {
+        return { auth };
+    }
+    // Re-read latest config to avoid racing with concurrent config writers.
+    const latestCfg = loadConfig();
+    const latestAuth = resolveBrowserControlAuth(latestCfg, env);
+    if (latestAuth.token || latestAuth.password) {
+        return { auth: latestAuth };
+    }
+    if (latestCfg.gateway?.auth?.mode === "password") {
+        return { auth: latestAuth };
+    }
+    if (latestCfg.gateway?.auth?.mode === "trusted-proxy") {
+        return { auth: latestAuth };
+    }
+    const generatedToken = crypto.randomBytes(24).toString("hex");
+    const nextCfg = {
+        ...latestCfg,
+        gateway: {
+            ...latestCfg.gateway,
+            auth: {
+                ...latestCfg.gateway?.auth,
+                mode: "token",
+                token: generatedToken,
+            },
+        },
+    };
+    await writeConfigFile(nextCfg);
+    return {
+        auth: { token: generatedToken },
+        generatedToken,
+    };
+}

package/dist/browser/csrf.js

@@ -0,0 +1,64 @@
+import { isLoopbackHost } from "../gateway/net.js";
+function firstHeader(value) {
+    return Array.isArray(value) ? (value[0] ?? "") : (value ?? "");
+}
+function isMutatingMethod(method) {
+    const m = (method || "").trim().toUpperCase();
+    return m === "POST" || m === "PUT" || m === "PATCH" || m === "DELETE";
+}
+function isLoopbackUrl(value) {
+    const v = value.trim();
+    if (!v || v === "null") {
+        return false;
+    }
+    try {
+        const parsed = new URL(v);
+        return isLoopbackHost(parsed.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+export function shouldRejectBrowserMutation(params) {
+    if (!isMutatingMethod(params.method)) {
+        return false;
+    }
+    // Strong signal when present: browser says this is cross-site.
+    // Avoid being overly clever with "same-site" since localhost vs 127.0.0.1 may differ.
+    const secFetchSite = (params.secFetchSite ?? "").trim().toLowerCase();
+    if (secFetchSite === "cross-site") {
+        return true;
+    }
+    const origin = (params.origin ?? "").trim();
+    if (origin) {
+        return !isLoopbackUrl(origin);
+    }
+    const referer = (params.referer ?? "").trim();
+    if (referer) {
+        return !isLoopbackUrl(referer);
+    }
+    // Non-browser clients (curl/undici/Node) typically send no Origin/Referer.
+    return false;
+}
+export function browserMutationGuardMiddleware() {
+    return (req, res, next) => {
+        // OPTIONS is used for CORS preflight. Even if cross-origin, the preflight isn't mutating.
+        const method = (req.method || "").trim().toUpperCase();
+        if (method === "OPTIONS") {
+            return next();
+        }
+        const origin = firstHeader(req.headers.origin);
+        const referer = firstHeader(req.headers.referer);
+        const secFetchSite = firstHeader(req.headers["sec-fetch-site"]);
+        if (shouldRejectBrowserMutation({
+            method,
+            origin,
+            referer,
+            secFetchSite,
+        })) {
+            res.status(403).send("Forbidden");
+            return;
+        }
+        next();
+    };
+}

package/dist/browser/http-auth.js

@@ -0,0 +1,52 @@
+import { safeEqualSecret } from "../security/secret-equal.js";
+function firstHeaderValue(value) {
+    return Array.isArray(value) ? (value[0] ?? "") : (value ?? "");
+}
+function parseBearerToken(authorization) {
+    if (!authorization || !authorization.toLowerCase().startsWith("bearer ")) {
+        return undefined;
+    }
+    const token = authorization.slice(7).trim();
+    return token || undefined;
+}
+function parseBasicPassword(authorization) {
+    if (!authorization || !authorization.toLowerCase().startsWith("basic ")) {
+        return undefined;
+    }
+    const encoded = authorization.slice(6).trim();
+    if (!encoded) {
+        return undefined;
+    }
+    try {
+        const decoded = Buffer.from(encoded, "base64").toString("utf8");
+        const sep = decoded.indexOf(":");
+        if (sep < 0) {
+            return undefined;
+        }
+        const password = decoded.slice(sep + 1).trim();
+        return password || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function isAuthorizedBrowserRequest(req, auth) {
+    const authorization = firstHeaderValue(req.headers.authorization).trim();
+    if (auth.token) {
+        const bearer = parseBearerToken(authorization);
+        if (bearer && safeEqualSecret(bearer, auth.token)) {
+            return true;
+        }
+    }
+    if (auth.password) {
+        const passwordHeader = firstHeaderValue(req.headers["x-openclaw-password"]).trim();
+        if (passwordHeader && safeEqualSecret(passwordHeader, auth.password)) {
+            return true;
+        }
+        const basicPassword = parseBasicPassword(authorization);
+        if (basicPassword && safeEqualSecret(basicPassword, auth.password)) {
+            return true;
+        }
+    }
+    return false;
+}

package/dist/browser/paths.js

@@ -0,0 +1,37 @@
+import path from "node:path";
+import { resolvePreferredOpenClawTmpDir } from "../infra/tmp-poolbot-dir.js";
+export const DEFAULT_BROWSER_TMP_DIR = resolvePreferredOpenClawTmpDir();
+export const DEFAULT_TRACE_DIR = DEFAULT_BROWSER_TMP_DIR;
+export const DEFAULT_DOWNLOAD_DIR = path.join(DEFAULT_BROWSER_TMP_DIR, "downloads");
+export const DEFAULT_UPLOAD_DIR = path.join(DEFAULT_BROWSER_TMP_DIR, "uploads");
+export function resolvePathWithinRoot(params) {
+    const root = path.resolve(params.rootDir);
+    const raw = params.requestedPath.trim();
+    if (!raw) {
+        if (!params.defaultFileName) {
+            return { ok: false, error: "path is required" };
+        }
+        return { ok: true, path: path.join(root, params.defaultFileName) };
+    }
+    const resolved = path.resolve(root, raw);
+    const rel = path.relative(root, resolved);
+    if (!rel || rel.startsWith("..") || path.isAbsolute(rel)) {
+        return { ok: false, error: `Invalid path: must stay within ${params.scopeLabel}` };
+    }
+    return { ok: true, path: resolved };
+}
+export function resolvePathsWithinRoot(params) {
+    const resolvedPaths = [];
+    for (const raw of params.requestedPaths) {
+        const pathResult = resolvePathWithinRoot({
+            rootDir: params.rootDir,
+            requestedPath: raw,
+            scopeLabel: params.scopeLabel,
+        });
+        if (!pathResult.ok) {
+            return { ok: false, error: pathResult.error };
+        }
+        resolvedPaths.push(pathResult.path);
+    }
+    return { ok: true, paths: resolvedPaths };
+}

package/dist/browser/proxy-files.js

@@ -0,0 +1,32 @@
+import { saveMediaBuffer } from "../media/store.js";
+export async function persistBrowserProxyFiles(files) {
+    if (!files || files.length === 0) {
+        return new Map();
+    }
+    const mapping = new Map();
+    for (const file of files) {
+        const buffer = Buffer.from(file.base64, "base64");
+        const saved = await saveMediaBuffer(buffer, file.mimeType, "browser", buffer.byteLength);
+        mapping.set(file.path, saved.path);
+    }
+    return mapping;
+}
+export function applyBrowserProxyPaths(result, mapping) {
+    if (!result || typeof result !== "object") {
+        return;
+    }
+    const obj = result;
+    if (typeof obj.path === "string" && mapping.has(obj.path)) {
+        obj.path = mapping.get(obj.path);
+    }
+    if (typeof obj.imagePath === "string" && mapping.has(obj.imagePath)) {
+        obj.imagePath = mapping.get(obj.imagePath);
+    }
+    const download = obj.download;
+    if (download && typeof download === "object") {
+        const d = download;
+        if (typeof d.path === "string" && mapping.has(d.path)) {
+            d.path = mapping.get(d.path);
+        }
+    }
+}

package/dist/browser/pw-ai-state.js

@@ -0,0 +1,7 @@
+let pwAiLoaded = false;
+export function markPwAiLoaded() {
+    pwAiLoaded = true;
+}
+export function isPwAiLoaded() {
+    return pwAiLoaded;
+}

package/dist/browser/resolved-config-refresh.js

@@ -0,0 +1,42 @@
+import { createConfigIO, loadConfig } from "../config/config.js";
+import { resolveBrowserConfig, resolveProfile } from "./config.js";
+function applyResolvedConfig(current, freshResolved) {
+    current.resolved = freshResolved;
+    for (const [name, runtime] of current.profiles) {
+        const nextProfile = resolveProfile(freshResolved, name);
+        if (nextProfile) {
+            runtime.profile = nextProfile;
+            continue;
+        }
+        if (!runtime.running) {
+            current.profiles.delete(name);
+        }
+    }
+}
+export function refreshResolvedBrowserConfigFromDisk(params) {
+    if (!params.refreshConfigFromDisk) {
+        return;
+    }
+    const cfg = params.mode === "fresh" ? createConfigIO().loadConfig() : loadConfig();
+    const freshResolved = resolveBrowserConfig(cfg.browser, cfg);
+    applyResolvedConfig(params.current, freshResolved);
+}
+export function resolveBrowserProfileWithHotReload(params) {
+    refreshResolvedBrowserConfigFromDisk({
+        current: params.current,
+        refreshConfigFromDisk: params.refreshConfigFromDisk,
+        mode: "cached",
+    });
+    let profile = resolveProfile(params.current.resolved, params.name);
+    if (profile) {
+        return profile;
+    }
+    // Hot-reload: profile missing; retry with a fresh disk read without flushing the global cache.
+    refreshResolvedBrowserConfigFromDisk({
+        current: params.current,
+        refreshConfigFromDisk: params.refreshConfigFromDisk,
+        mode: "fresh",
+    });
+    profile = resolveProfile(params.current.resolved, params.name);
+    return profile;
+}

package/dist/browser/routes/path-output.js

@@ -0,0 +1 @@
+export * from "../paths.js";

package/dist/browser/server-context.chrome-test-harness.js

@@ -0,0 +1,20 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterAll, beforeAll, vi } from "vitest";
+const chromeUserDataDir = { dir: "/tmp/openclaw" };
+beforeAll(async () => {
+    chromeUserDataDir.dir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-chrome-user-data-"));
+});
+afterAll(async () => {
+    await fs.rm(chromeUserDataDir.dir, { recursive: true, force: true });
+});
+vi.mock("./chrome.js", () => ({
+    isChromeCdpReady: vi.fn(async () => true),
+    isChromeReachable: vi.fn(async () => true),
+    launchOpenClawChrome: vi.fn(async () => {
+        throw new Error("unexpected launch");
+    }),
+    resolveOpenClawUserDataDir: vi.fn(() => chromeUserDataDir.dir),
+    stopOpenClawChrome: vi.fn(async () => { }),
+}));

package/dist/browser/server-middleware.js

@@ -0,0 +1,31 @@
+import express from "express";
+import { browserMutationGuardMiddleware } from "./csrf.js";
+import { isAuthorizedBrowserRequest } from "./http-auth.js";
+export function installBrowserCommonMiddleware(app) {
+    app.use((req, res, next) => {
+        const ctrl = new AbortController();
+        const abort = () => ctrl.abort(new Error("request aborted"));
+        req.once("aborted", abort);
+        res.once("close", () => {
+            if (!res.writableEnded) {
+                abort();
+            }
+        });
+        // Make the signal available to browser route handlers (best-effort).
+        req.signal = ctrl.signal;
+        next();
+    });
+    app.use(express.json({ limit: "1mb" }));
+    app.use(browserMutationGuardMiddleware());
+}
+export function installBrowserAuthMiddleware(app, auth) {
+    if (!auth.token && !auth.password) {
+        return;
+    }
+    app.use((req, res, next) => {
+        if (isAuthorizedBrowserRequest(req, auth)) {
+            return next();
+        }
+        res.status(401).send("Unauthorized");
+    });
+}

package/dist/browser/test-port.js

@@ -0,0 +1,16 @@
+import { createServer } from "node:http";
+export async function getFreePort() {
+    while (true) {
+        const port = await new Promise((resolve, reject) => {
+            const s = createServer();
+            s.once("error", reject);
+            s.listen(0, "127.0.0.1", () => {
+                const assigned = s.address().port;
+                s.close((err) => (err ? reject(err) : resolve(assigned)));
+            });
+        });
+        if (port < 65535) {
+            return port;
+        }
+    }
+}

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "2026.2.11",
-  "commit": "b3008a972dfe57f49c7098dcb9bb60771c21eff9",
-  "builtAt": "2026-02-16T06:11:58.641Z"
+  "version": "2026.2.18",
+  "commit": "ccd6d576b4fbca2206909ed0f075b14ea0a39326",
+  "builtAt": "2026-02-17T23:17:53.571Z"
 }

package/dist/canvas-host/file-resolver.js

@@ -0,0 +1,43 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { SafeOpenError, openFileWithinRoot } from "../infra/fs-safe.js";
+export function normalizeUrlPath(rawPath) {
+    const decoded = decodeURIComponent(rawPath || "/");
+    const normalized = path.posix.normalize(decoded);
+    return normalized.startsWith("/") ? normalized : `/${normalized}`;
+}
+export async function resolveFileWithinRoot(rootReal, urlPath) {
+    const normalized = normalizeUrlPath(urlPath);
+    const rel = normalized.replace(/^\/+/, "");
+    if (rel.split("/").some((p) => p === "..")) {
+        return null;
+    }
+    const tryOpen = async (relative) => {
+        try {
+            return await openFileWithinRoot({ rootDir: rootReal, relativePath: relative });
+        }
+        catch (err) {
+            if (err instanceof SafeOpenError) {
+                return null;
+            }
+            throw err;
+        }
+    };
+    if (normalized.endsWith("/")) {
+        return await tryOpen(path.posix.join(rel, "index.html"));
+    }
+    const candidate = path.join(rootReal, rel);
+    try {
+        const st = await fs.lstat(candidate);
+        if (st.isSymbolicLink()) {
+            return null;
+        }
+        if (st.isDirectory()) {
+            return await tryOpen(path.posix.join(rel, "index.html"));
+        }
+    }
+    catch {
+        // ignore
+    }
+    return await tryOpen(rel);
+}

package/dist/channels/account-summary.js

@@ -0,0 +1,19 @@
+export function buildChannelAccountSnapshot(params) {
+    const described = params.plugin.config.describeAccount?.(params.account, params.cfg);
+    return {
+        enabled: params.enabled,
+        configured: params.configured,
+        ...described,
+        accountId: params.accountId,
+    };
+}
+export function formatChannelAllowFrom(params) {
+    if (params.plugin.config.formatAllowFrom) {
+        return params.plugin.config.formatAllowFrom({
+            cfg: params.cfg,
+            accountId: params.accountId,
+            allowFrom: params.allowFrom,
+        });
+    }
+    return params.allowFrom.map((entry) => String(entry).trim()).filter(Boolean);
+}

package/dist/channels/draft-stream-loop.js

@@ -0,0 +1,77 @@
+export function createDraftStreamLoop(params) {
+    let lastSentAt = 0;
+    let pendingText = "";
+    let inFlightPromise;
+    let timer;
+    const flush = async () => {
+        if (timer) {
+            clearTimeout(timer);
+            timer = undefined;
+        }
+        while (!params.isStopped()) {
+            if (inFlightPromise) {
+                await inFlightPromise;
+                continue;
+            }
+            const text = pendingText;
+            if (!text.trim()) {
+                pendingText = "";
+                return;
+            }
+            pendingText = "";
+            lastSentAt = Date.now();
+            const current = params.sendOrEditStreamMessage(text).finally(() => {
+                if (inFlightPromise === current) {
+                    inFlightPromise = undefined;
+                }
+            });
+            inFlightPromise = current;
+            await current;
+            if (!pendingText) {
+                return;
+            }
+        }
+    };
+    const schedule = () => {
+        if (timer) {
+            return;
+        }
+        const delay = Math.max(0, params.throttleMs - (Date.now() - lastSentAt));
+        timer = setTimeout(() => {
+            void flush();
+        }, delay);
+    };
+    return {
+        update: (text) => {
+            if (params.isStopped()) {
+                return;
+            }
+            pendingText = text;
+            if (inFlightPromise) {
+                schedule();
+                return;
+            }
+            if (!timer && Date.now() - lastSentAt >= params.throttleMs) {
+                void flush();
+                return;
+            }
+            schedule();
+        },
+        flush,
+        stop: () => {
+            pendingText = "";
+            if (timer) {
+                clearTimeout(timer);
+                timer = undefined;
+            }
+        },
+        resetPending: () => {
+            pendingText = "";
+        },
+        waitForInFlight: async () => {
+            if (inFlightPromise) {
+                await inFlightPromise;
+            }
+        },
+    };
+}

package/dist/channels/plugins/account-helpers.js

@@ -0,0 +1,26 @@
+import { DEFAULT_ACCOUNT_ID } from "../../routing/session-key.js";
+export function createAccountListHelpers(channelKey) {
+    function listConfiguredAccountIds(cfg) {
+        const channel = cfg.channels?.[channelKey];
+        const accounts = channel?.accounts;
+        if (!accounts || typeof accounts !== "object") {
+            return [];
+        }
+        return Object.keys(accounts).filter(Boolean);
+    }
+    function listAccountIds(cfg) {
+        const ids = listConfiguredAccountIds(cfg);
+        if (ids.length === 0) {
+            return [DEFAULT_ACCOUNT_ID];
+        }
+        return ids.toSorted((a, b) => a.localeCompare(b));
+    }
+    function resolveDefaultAccountId(cfg) {
+        const ids = listAccountIds(cfg);
+        if (ids.includes(DEFAULT_ACCOUNT_ID)) {
+            return DEFAULT_ACCOUNT_ID;
+        }
+        return ids[0] ?? DEFAULT_ACCOUNT_ID;
+    }
+    return { listConfiguredAccountIds, listAccountIds, resolveDefaultAccountId };
+}

package/dist/channels/telegram/allow-from.js

@@ -0,0 +1,10 @@
+export function normalizeTelegramAllowFromEntry(raw) {
+    const base = typeof raw === "string" ? raw : typeof raw === "number" ? String(raw) : "";
+    return base
+        .trim()
+        .replace(/^(telegram|tg):/i, "")
+        .trim();
+}
+export function isNumericTelegramUserId(raw) {
+    return /^\d+$/.test(raw);
+}

package/dist/cli/browser-cli-resize.js

@@ -0,0 +1,22 @@
+import { danger } from "../globals.js";
+import { defaultRuntime } from "../runtime.js";
+import { callBrowserResize } from "./browser-cli-shared.js";
+export async function runBrowserResizeWithOutput(params) {
+    const { width, height } = params;
+    if (!Number.isFinite(width) || !Number.isFinite(height)) {
+        defaultRuntime.error(danger("width and height must be numbers"));
+        defaultRuntime.exit(1);
+        return;
+    }
+    const result = await callBrowserResize(params.parent, {
+        profile: params.profile,
+        width,
+        height,
+        targetId: params.targetId,
+    }, { timeoutMs: params.timeoutMs ?? 20000 });
+    if (params.parent?.json) {
+        defaultRuntime.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    defaultRuntime.log(params.successMessage);
+}

package/dist/cli/browser-cli-shared.js

@@ -32,3 +32,11 @@ export async function callBrowserRequest(opts, params, extra) {
     }
     return payload;
 }
+export async function callBrowserResize(opts, params, extra) {
+    return await callBrowserRequest(opts, {
+        method: "POST",
+        path: "/resize",
+        query: params.profile ? { profile: params.profile } : undefined,
+        body: { width: params.width, height: params.height, targetId: params.targetId },
+    }, extra);
+}

package/dist/cli/clawbot-cli.js

@@ -0,0 +1,5 @@
+import { registerQrCli } from "./qr-cli.js";
+export function registerClawbotCli(program) {
+    const clawbot = program.command("clawbot").description("Legacy clawbot command aliases");
+    registerQrCli(clawbot);
+}