@poolzin/pool-bot 2026.2.11 → 2026.2.18

package/dist/infra/exec-approvals.js

@@ -35,6 +35,19 @@ export function resolveExecApprovalsPath() {
 export function resolveExecApprovalsSocketPath() {
     return expandHome(DEFAULT_SOCKET);
 }
+export function mergeExecApprovalsSocketDefaults(params) {
+    const currentSocketPath = params.current?.socket?.path?.trim();
+    const currentToken = params.current?.socket?.token?.trim();
+    const socketPath = params.normalized.socket?.path?.trim() ?? currentSocketPath ?? resolveExecApprovalsSocketPath();
+    const token = params.normalized.socket?.token?.trim() ?? currentToken ?? "";
+    return {
+        ...params.normalized,
+        socket: {
+            path: socketPath,
+            token,
+        },
+    };
+}
 function normalizeAllowlistPattern(value) {
     const trimmed = value?.trim() ?? "";
     return trimmed ? trimmed.toLowerCase() : null;

package/dist/infra/file-lock.js

@@ -0,0 +1 @@
+export { acquireFileLock, withFileLock } from "../plugin-sdk/file-lock.js";

package/dist/infra/gemini-auth.js

@@ -0,0 +1,39 @@
+/**
+ * Shared Gemini authentication utilities.
+ *
+ * Supports both traditional API keys and OAuth JSON format.
+ */
+/**
+ * Parse Gemini API key and return appropriate auth headers.
+ *
+ * OAuth format: `{"token": "...", "projectId": "..."}`
+ *
+ * @param apiKey - Either a traditional API key string or OAuth JSON
+ * @returns Headers object with appropriate authentication
+ */
+export function parseGeminiAuth(apiKey) {
+    // Try parsing as OAuth JSON format
+    if (apiKey.startsWith("{")) {
+        try {
+            const parsed = JSON.parse(apiKey);
+            if (typeof parsed.token === "string" && parsed.token) {
+                return {
+                    headers: {
+                        Authorization: `Bearer ${parsed.token}`,
+                        "Content-Type": "application/json",
+                    },
+                };
+            }
+        }
+        catch {
+            // Parse failed, fallback to API key mode
+        }
+    }
+    // Default: traditional API key
+    return {
+        headers: {
+            "x-goog-api-key": apiKey,
+            "Content-Type": "application/json",
+        },
+    };
+}

package/dist/infra/heartbeat-active-hours.js

@@ -0,0 +1,85 @@
+import { resolveUserTimezone } from "../agents/date-time.js";
+const ACTIVE_HOURS_TIME_PATTERN = /^([01]\d|2[0-3]|24):([0-5]\d)$/;
+function resolveActiveHoursTimezone(cfg, raw) {
+    const trimmed = raw?.trim();
+    if (!trimmed || trimmed === "user") {
+        return resolveUserTimezone(cfg.agents?.defaults?.userTimezone);
+    }
+    if (trimmed === "local") {
+        const host = Intl.DateTimeFormat().resolvedOptions().timeZone;
+        return host?.trim() || "UTC";
+    }
+    try {
+        new Intl.DateTimeFormat("en-US", { timeZone: trimmed }).format(new Date());
+        return trimmed;
+    }
+    catch {
+        return resolveUserTimezone(cfg.agents?.defaults?.userTimezone);
+    }
+}
+function parseActiveHoursTime(opts, raw) {
+    if (!raw || !ACTIVE_HOURS_TIME_PATTERN.test(raw)) {
+        return null;
+    }
+    const [hourStr, minuteStr] = raw.split(":");
+    const hour = Number(hourStr);
+    const minute = Number(minuteStr);
+    if (!Number.isFinite(hour) || !Number.isFinite(minute)) {
+        return null;
+    }
+    if (hour === 24) {
+        if (!opts.allow24 || minute !== 0) {
+            return null;
+        }
+        return 24 * 60;
+    }
+    return hour * 60 + minute;
+}
+function resolveMinutesInTimeZone(nowMs, timeZone) {
+    try {
+        const parts = new Intl.DateTimeFormat("en-US", {
+            timeZone,
+            hour: "2-digit",
+            minute: "2-digit",
+            hourCycle: "h23",
+        }).formatToParts(new Date(nowMs));
+        const map = {};
+        for (const part of parts) {
+            if (part.type !== "literal") {
+                map[part.type] = part.value;
+            }
+        }
+        const hour = Number(map.hour);
+        const minute = Number(map.minute);
+        if (!Number.isFinite(hour) || !Number.isFinite(minute)) {
+            return null;
+        }
+        return hour * 60 + minute;
+    }
+    catch {
+        return null;
+    }
+}
+export function isWithinActiveHours(cfg, heartbeat, nowMs) {
+    const active = heartbeat?.activeHours;
+    if (!active) {
+        return true;
+    }
+    const startMin = parseActiveHoursTime({ allow24: false }, active.start);
+    const endMin = parseActiveHoursTime({ allow24: true }, active.end);
+    if (startMin === null || endMin === null) {
+        return true;
+    }
+    if (startMin === endMin) {
+        return true;
+    }
+    const timeZone = resolveActiveHoursTimezone(cfg, active.timezone);
+    const currentMin = resolveMinutesInTimeZone(nowMs ?? Date.now(), timeZone);
+    if (currentMin === null) {
+        return true;
+    }
+    if (endMin > startMin) {
+        return currentMin >= startMin && currentMin < endMin;
+    }
+    return currentMin >= startMin || currentMin < endMin;
+}

package/dist/infra/heartbeat-events-filter.js

@@ -0,0 +1,50 @@
+import { HEARTBEAT_TOKEN } from "../auto-reply/tokens.js";
+// Build a dynamic prompt for cron events by embedding the actual event content.
+// This ensures the model sees the reminder text directly instead of relying on
+// "shown in the system messages above" which may not be visible in context.
+export function buildCronEventPrompt(pendingEvents) {
+    const eventText = pendingEvents.join("\n").trim();
+    if (!eventText) {
+        return ("A scheduled cron event was triggered, but no event content was found. " +
+            "Reply HEARTBEAT_OK.");
+    }
+    return ("A scheduled reminder has been triggered. The reminder content is:\n\n" +
+        eventText +
+        "\n\nPlease relay this reminder to the user in a helpful and friendly way.");
+}
+const HEARTBEAT_OK_PREFIX = HEARTBEAT_TOKEN.toLowerCase();
+// Detect heartbeat-specific noise so cron reminders don't trigger on non-reminder events.
+function isHeartbeatAckEvent(evt) {
+    const trimmed = evt.trim();
+    if (!trimmed) {
+        return false;
+    }
+    const lower = trimmed.toLowerCase();
+    if (!lower.startsWith(HEARTBEAT_OK_PREFIX)) {
+        return false;
+    }
+    const suffix = lower.slice(HEARTBEAT_OK_PREFIX.length);
+    if (suffix.length === 0) {
+        return true;
+    }
+    return !/[a-z0-9_]/.test(suffix[0]);
+}
+function isHeartbeatNoiseEvent(evt) {
+    const lower = evt.trim().toLowerCase();
+    if (!lower) {
+        return false;
+    }
+    return (isHeartbeatAckEvent(lower) ||
+        lower.includes("heartbeat poll") ||
+        lower.includes("heartbeat wake"));
+}
+export function isExecCompletionEvent(evt) {
+    return evt.toLowerCase().includes("exec finished");
+}
+// Returns true when a system event should be treated as real cron reminder content.
+export function isCronSystemEvent(evt) {
+    if (!evt.trim()) {
+        return false;
+    }
+    return !isHeartbeatNoiseEvent(evt) && !isExecCompletionEvent(evt);
+}

package/dist/infra/heartbeat-runner.test-utils.js

@@ -0,0 +1,39 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { vi } from "vitest";
+import * as replyModule from "../auto-reply/reply.js";
+export async function seedSessionStore(storePath, sessionKey, session) {
+    await fs.writeFile(storePath, JSON.stringify({
+        [sessionKey]: {
+            sessionId: session.sessionId ?? "sid",
+            updatedAt: session.updatedAt ?? Date.now(),
+            ...session,
+        },
+    }, null, 2));
+}
+export async function withTempHeartbeatSandbox(fn, options) {
+    const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), options?.prefix ?? "openclaw-hb-"));
+    const storePath = path.join(tmpDir, "sessions.json");
+    const replySpy = vi.spyOn(replyModule, "getReplyFromConfig");
+    const previousEnv = new Map();
+    for (const envName of options?.unsetEnvVars ?? []) {
+        previousEnv.set(envName, process.env[envName]);
+        process.env[envName] = "";
+    }
+    try {
+        return await fn({ tmpDir, storePath, replySpy });
+    }
+    finally {
+        replySpy.mockRestore();
+        for (const [envName, previousValue] of previousEnv.entries()) {
+            if (previousValue === undefined) {
+                delete process.env[envName];
+            }
+            else {
+                process.env[envName] = previousValue;
+            }
+        }
+        await fs.rm(tmpDir, { recursive: true, force: true });
+    }
+}

package/dist/infra/http-body.js

@@ -0,0 +1,265 @@
+export const DEFAULT_WEBHOOK_MAX_BODY_BYTES = 1024 * 1024;
+export const DEFAULT_WEBHOOK_BODY_TIMEOUT_MS = 30_000;
+const DEFAULT_ERROR_MESSAGE = {
+    PAYLOAD_TOO_LARGE: "PayloadTooLarge",
+    REQUEST_BODY_TIMEOUT: "RequestBodyTimeout",
+    CONNECTION_CLOSED: "RequestBodyConnectionClosed",
+};
+const DEFAULT_ERROR_STATUS_CODE = {
+    PAYLOAD_TOO_LARGE: 413,
+    REQUEST_BODY_TIMEOUT: 408,
+    CONNECTION_CLOSED: 400,
+};
+const DEFAULT_RESPONSE_MESSAGE = {
+    PAYLOAD_TOO_LARGE: "Payload too large",
+    REQUEST_BODY_TIMEOUT: "Request body timeout",
+    CONNECTION_CLOSED: "Connection closed",
+};
+export class RequestBodyLimitError extends Error {
+    code;
+    statusCode;
+    constructor(init) {
+        super(init.message ?? DEFAULT_ERROR_MESSAGE[init.code]);
+        this.name = "RequestBodyLimitError";
+        this.code = init.code;
+        this.statusCode = DEFAULT_ERROR_STATUS_CODE[init.code];
+    }
+}
+export function isRequestBodyLimitError(error, code) {
+    if (!(error instanceof RequestBodyLimitError)) {
+        return false;
+    }
+    if (!code) {
+        return true;
+    }
+    return error.code === code;
+}
+export function requestBodyErrorToText(code) {
+    return DEFAULT_RESPONSE_MESSAGE[code];
+}
+function parseContentLengthHeader(req) {
+    const header = req.headers["content-length"];
+    const raw = Array.isArray(header) ? header[0] : header;
+    if (typeof raw !== "string") {
+        return null;
+    }
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isFinite(parsed) || parsed < 0) {
+        return null;
+    }
+    return parsed;
+}
+export async function readRequestBodyWithLimit(req, options) {
+    const maxBytes = Number.isFinite(options.maxBytes)
+        ? Math.max(1, Math.floor(options.maxBytes))
+        : 1;
+    const timeoutMs = typeof options.timeoutMs === "number" && Number.isFinite(options.timeoutMs)
+        ? Math.max(1, Math.floor(options.timeoutMs))
+        : DEFAULT_WEBHOOK_BODY_TIMEOUT_MS;
+    const encoding = options.encoding ?? "utf-8";
+    const declaredLength = parseContentLengthHeader(req);
+    if (declaredLength !== null && declaredLength > maxBytes) {
+        const error = new RequestBodyLimitError({ code: "PAYLOAD_TOO_LARGE" });
+        if (!req.destroyed) {
+            // Limit violations are expected user input; destroying with an Error causes
+            // an async 'error' event which can crash the process if no listener remains.
+            req.destroy();
+        }
+        throw error;
+    }
+    return await new Promise((resolve, reject) => {
+        let done = false;
+        let ended = false;
+        let totalBytes = 0;
+        const chunks = [];
+        const cleanup = () => {
+            req.removeListener("data", onData);
+            req.removeListener("end", onEnd);
+            req.removeListener("error", onError);
+            req.removeListener("close", onClose);
+            clearTimeout(timer);
+        };
+        const finish = (cb) => {
+            if (done) {
+                return;
+            }
+            done = true;
+            cleanup();
+            cb();
+        };
+        const fail = (error) => {
+            finish(() => reject(error));
+        };
+        const timer = setTimeout(() => {
+            const error = new RequestBodyLimitError({ code: "REQUEST_BODY_TIMEOUT" });
+            if (!req.destroyed) {
+                req.destroy();
+            }
+            fail(error);
+        }, timeoutMs);
+        const onData = (chunk) => {
+            if (done) {
+                return;
+            }
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            totalBytes += buffer.length;
+            if (totalBytes > maxBytes) {
+                const error = new RequestBodyLimitError({ code: "PAYLOAD_TOO_LARGE" });
+                if (!req.destroyed) {
+                    req.destroy();
+                }
+                fail(error);
+                return;
+            }
+            chunks.push(buffer);
+        };
+        const onEnd = () => {
+            ended = true;
+            finish(() => resolve(Buffer.concat(chunks).toString(encoding)));
+        };
+        const onError = (error) => {
+            if (done) {
+                return;
+            }
+            fail(error);
+        };
+        const onClose = () => {
+            if (done || ended) {
+                return;
+            }
+            fail(new RequestBodyLimitError({ code: "CONNECTION_CLOSED" }));
+        };
+        req.on("data", onData);
+        req.on("end", onEnd);
+        req.on("error", onError);
+        req.on("close", onClose);
+    });
+}
+export async function readJsonBodyWithLimit(req, options) {
+    try {
+        const raw = await readRequestBodyWithLimit(req, options);
+        const trimmed = raw.trim();
+        if (!trimmed) {
+            if (options.emptyObjectOnEmpty === false) {
+                return { ok: false, code: "INVALID_JSON", error: "empty payload" };
+            }
+            return { ok: true, value: {} };
+        }
+        try {
+            return { ok: true, value: JSON.parse(trimmed) };
+        }
+        catch (error) {
+            return {
+                ok: false,
+                code: "INVALID_JSON",
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    catch (error) {
+        if (isRequestBodyLimitError(error)) {
+            return { ok: false, code: error.code, error: requestBodyErrorToText(error.code) };
+        }
+        return {
+            ok: false,
+            code: "INVALID_JSON",
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+export function installRequestBodyLimitGuard(req, res, options) {
+    const maxBytes = Number.isFinite(options.maxBytes)
+        ? Math.max(1, Math.floor(options.maxBytes))
+        : 1;
+    const timeoutMs = typeof options.timeoutMs === "number" && Number.isFinite(options.timeoutMs)
+        ? Math.max(1, Math.floor(options.timeoutMs))
+        : DEFAULT_WEBHOOK_BODY_TIMEOUT_MS;
+    const responseFormat = options.responseFormat ?? "json";
+    const customText = options.responseText ?? {};
+    let tripped = false;
+    let reason = null;
+    let done = false;
+    let ended = false;
+    let totalBytes = 0;
+    const cleanup = () => {
+        req.removeListener("data", onData);
+        req.removeListener("end", onEnd);
+        req.removeListener("close", onClose);
+        req.removeListener("error", onError);
+        clearTimeout(timer);
+    };
+    const finish = () => {
+        if (done) {
+            return;
+        }
+        done = true;
+        cleanup();
+    };
+    const respond = (error) => {
+        const text = customText[error.code] ?? requestBodyErrorToText(error.code);
+        if (!res.headersSent) {
+            res.statusCode = error.statusCode;
+            if (responseFormat === "text") {
+                res.setHeader("Content-Type", "text/plain; charset=utf-8");
+                res.end(text);
+            }
+            else {
+                res.setHeader("Content-Type", "application/json; charset=utf-8");
+                res.end(JSON.stringify({ error: text }));
+            }
+        }
+    };
+    const trip = (error) => {
+        if (tripped) {
+            return;
+        }
+        tripped = true;
+        reason = error.code;
+        finish();
+        respond(error);
+        if (!req.destroyed) {
+            // Limit violations are expected user input; destroying with an Error causes
+            // an async 'error' event which can crash the process if no listener remains.
+            req.destroy();
+        }
+    };
+    const onData = (chunk) => {
+        if (done) {
+            return;
+        }
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        totalBytes += buffer.length;
+        if (totalBytes > maxBytes) {
+            trip(new RequestBodyLimitError({ code: "PAYLOAD_TOO_LARGE" }));
+        }
+    };
+    const onEnd = () => {
+        ended = true;
+        finish();
+    };
+    const onClose = () => {
+        if (done || ended) {
+            return;
+        }
+        finish();
+    };
+    const onError = () => {
+        finish();
+    };
+    const timer = setTimeout(() => {
+        trip(new RequestBodyLimitError({ code: "REQUEST_BODY_TIMEOUT" }));
+    }, timeoutMs);
+    req.on("data", onData);
+    req.on("end", onEnd);
+    req.on("close", onClose);
+    req.on("error", onError);
+    const declaredLength = parseContentLengthHeader(req);
+    if (declaredLength !== null && declaredLength > maxBytes) {
+        trip(new RequestBodyLimitError({ code: "PAYLOAD_TOO_LARGE" }));
+    }
+    return {
+        dispose: finish,
+        isTripped: () => tripped,
+        code: () => reason,
+    };
+}

package/dist/infra/install-package-dir.js

@@ -0,0 +1,50 @@
+import fs from "node:fs/promises";
+import { runCommandWithTimeout } from "../process/exec.js";
+import { fileExists } from "./archive.js";
+export async function installPackageDir(params) {
+    params.logger?.info?.(`Installing to ${params.targetDir}…`);
+    let backupDir = null;
+    if (params.mode === "update" && (await fileExists(params.targetDir))) {
+        backupDir = `${params.targetDir}.backup-${Date.now()}`;
+        await fs.rename(params.targetDir, backupDir);
+    }
+    const rollback = async () => {
+        if (!backupDir) {
+            return;
+        }
+        await fs.rm(params.targetDir, { recursive: true, force: true }).catch(() => undefined);
+        await fs.rename(backupDir, params.targetDir).catch(() => undefined);
+    };
+    try {
+        await fs.cp(params.sourceDir, params.targetDir, { recursive: true });
+    }
+    catch (err) {
+        await rollback();
+        return { ok: false, error: `${params.copyErrorPrefix}: ${String(err)}` };
+    }
+    try {
+        await params.afterCopy?.();
+    }
+    catch (err) {
+        await rollback();
+        return { ok: false, error: `post-copy validation failed: ${String(err)}` };
+    }
+    if (params.hasDeps) {
+        params.logger?.info?.(params.depsLogMessage);
+        const npmRes = await runCommandWithTimeout(["npm", "install", "--omit=dev", "--silent", "--ignore-scripts"], {
+            timeoutMs: Math.max(params.timeoutMs, 300_000),
+            cwd: params.targetDir,
+        });
+        if (npmRes.code !== 0) {
+            await rollback();
+            return {
+                ok: false,
+                error: `npm install failed: ${npmRes.stderr.trim() || npmRes.stdout.trim()}`,
+            };
+        }
+    }
+    if (backupDir) {
+        await fs.rm(backupDir, { recursive: true, force: true }).catch(() => undefined);
+    }
+    return { ok: true };
+}

package/dist/infra/install-safe-path.js

@@ -0,0 +1,49 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+export function unscopedPackageName(name) {
+    const trimmed = name.trim();
+    if (!trimmed) {
+        return trimmed;
+    }
+    return trimmed.includes("/") ? (trimmed.split("/").pop() ?? trimmed) : trimmed;
+}
+export function safeDirName(input) {
+    const trimmed = input.trim();
+    if (!trimmed) {
+        return trimmed;
+    }
+    return trimmed.replaceAll("/", "__").replaceAll("\\", "__");
+}
+export function safePathSegmentHashed(input) {
+    const trimmed = input.trim();
+    const base = trimmed
+        .replaceAll(/[\\/]/g, "-")
+        .replaceAll(/[^a-zA-Z0-9._-]/g, "-")
+        .replaceAll(/-+/g, "-")
+        .replaceAll(/^-+/g, "")
+        .replaceAll(/-+$/g, "");
+    const normalized = base.length > 0 ? base : "skill";
+    const safe = normalized === "." || normalized === ".." ? "skill" : normalized;
+    const hash = createHash("sha256").update(trimmed).digest("hex").slice(0, 10);
+    if (safe !== trimmed) {
+        const prefix = safe.length > 50 ? safe.slice(0, 50) : safe;
+        return `${prefix}-${hash}`;
+    }
+    if (safe.length > 60) {
+        return `${safe.slice(0, 50)}-${hash}`;
+    }
+    return safe;
+}
+export function resolveSafeInstallDir(params) {
+    const targetDir = path.join(params.baseDir, safeDirName(params.id));
+    const resolvedBase = path.resolve(params.baseDir);
+    const resolvedTarget = path.resolve(targetDir);
+    const relative = path.relative(resolvedBase, resolvedTarget);
+    if (!relative ||
+        relative === ".." ||
+        relative.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relative)) {
+        return { ok: false, error: params.invalidNameMessage };
+    }
+    return { ok: true, path: targetDir };
+}

package/dist/infra/json-files.js

@@ -0,0 +1,49 @@
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+export async function readJsonFile(filePath) {
+    try {
+        const raw = await fs.readFile(filePath, "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeJsonAtomic(filePath, value, options) {
+    const mode = options?.mode ?? 0o600;
+    const dir = path.dirname(filePath);
+    await fs.mkdir(dir, { recursive: true });
+    const tmp = `${filePath}.${randomUUID()}.tmp`;
+    await fs.writeFile(tmp, JSON.stringify(value, null, 2), "utf8");
+    try {
+        await fs.chmod(tmp, mode);
+    }
+    catch {
+        // best-effort; ignore on platforms without chmod
+    }
+    await fs.rename(tmp, filePath);
+    try {
+        await fs.chmod(filePath, mode);
+    }
+    catch {
+        // best-effort; ignore on platforms without chmod
+    }
+}
+export function createAsyncLock() {
+    let lock = Promise.resolve();
+    return async function withLock(fn) {
+        const prev = lock;
+        let release;
+        lock = new Promise((resolve) => {
+            release = resolve;
+        });
+        await prev;
+        try {
+            return await fn();
+        }
+        finally {
+            release?.();
+        }
+    };
+}