@poolzin/pool-bot 2026.2.17 → 2026.2.19

package/dist/security/audit-channel.js

@@ -0,0 +1,419 @@
+import { resolveChannelDefaultAccountId } from "../channels/plugins/helpers.js";
+import { isNumericTelegramUserId, normalizeTelegramAllowFromEntry, } from "../channels/telegram/allow-from.js";
+import { formatCliCommand } from "../cli/command-format.js";
+import { resolveNativeCommandsEnabled, resolveNativeSkillsEnabled } from "../config/commands.js";
+import { readChannelAllowFromStore } from "../pairing/pairing-store.js";
+function normalizeAllowFromList(list) {
+    if (!Array.isArray(list)) {
+        return [];
+    }
+    return list.map((v) => String(v).trim()).filter(Boolean);
+}
+function classifyChannelWarningSeverity(message) {
+    const s = message.toLowerCase();
+    if (s.includes("dms: open") ||
+        s.includes('grouppolicy="open"') ||
+        s.includes('dmpolicy="open"')) {
+        return "critical";
+    }
+    if (s.includes("allows any") || s.includes("anyone can dm") || s.includes("public")) {
+        return "critical";
+    }
+    if (s.includes("locked") || s.includes("disabled")) {
+        return "info";
+    }
+    return "warn";
+}
+export async function collectChannelSecurityFindings(params) {
+    const findings = [];
+    const coerceNativeSetting = (value) => {
+        if (value === true) {
+            return true;
+        }
+        if (value === false) {
+            return false;
+        }
+        if (value === "auto") {
+            return "auto";
+        }
+        return undefined;
+    };
+    const warnDmPolicy = async (input) => {
+        const policyPath = input.policyPath ?? `${input.allowFromPath}policy`;
+        const configAllowFrom = normalizeAllowFromList(input.allowFrom);
+        const hasWildcard = configAllowFrom.includes("*");
+        const dmScope = params.cfg.session?.dmScope ?? "main";
+        const storeAllowFrom = await readChannelAllowFromStore(input.provider).catch(() => []);
+        const normalizeEntry = input.normalizeEntry ?? ((value) => value);
+        const normalizedCfg = configAllowFrom
+            .filter((value) => value !== "*")
+            .map((value) => normalizeEntry(value))
+            .map((value) => value.trim())
+            .filter(Boolean);
+        const normalizedStore = storeAllowFrom
+            .map((value) => normalizeEntry(value))
+            .map((value) => value.trim())
+            .filter(Boolean);
+        const allowCount = Array.from(new Set([...normalizedCfg, ...normalizedStore])).length;
+        const isMultiUserDm = hasWildcard || allowCount > 1;
+        if (input.dmPolicy === "open") {
+            const allowFromKey = `${input.allowFromPath}allowFrom`;
+            findings.push({
+                checkId: `channels.${input.provider}.dm.open`,
+                severity: "critical",
+                title: `${input.label} DMs are open`,
+                detail: `${policyPath}="open" allows anyone to DM the bot.`,
+                remediation: `Use pairing/allowlist; if you really need open DMs, ensure ${allowFromKey} includes "*".`,
+            });
+            if (!hasWildcard) {
+                findings.push({
+                    checkId: `channels.${input.provider}.dm.open_invalid`,
+                    severity: "warn",
+                    title: `${input.label} DM config looks inconsistent`,
+                    detail: `"open" requires ${allowFromKey} to include "*".`,
+                });
+            }
+        }
+        if (input.dmPolicy === "disabled") {
+            findings.push({
+                checkId: `channels.${input.provider}.dm.disabled`,
+                severity: "info",
+                title: `${input.label} DMs are disabled`,
+                detail: `${policyPath}="disabled" ignores inbound DMs.`,
+            });
+            return;
+        }
+        if (dmScope === "main" && isMultiUserDm) {
+            findings.push({
+                checkId: `channels.${input.provider}.dm.scope_main_multiuser`,
+                severity: "warn",
+                title: `${input.label} DMs share the main session`,
+                detail: "Multiple DM senders currently share the main session, which can leak context across users.",
+                remediation: "Run: " +
+                    formatCliCommand('openclaw config set session.dmScope "per-channel-peer"') +
+                    ' (or "per-account-channel-peer" for multi-account channels) to isolate DM sessions per sender.',
+            });
+        }
+    };
+    for (const plugin of params.plugins) {
+        if (!plugin.security) {
+            continue;
+        }
+        const accountIds = plugin.config.listAccountIds(params.cfg);
+        const defaultAccountId = resolveChannelDefaultAccountId({
+            plugin,
+            cfg: params.cfg,
+            accountIds,
+        });
+        const account = plugin.config.resolveAccount(params.cfg, defaultAccountId);
+        const enabled = plugin.config.isEnabled ? plugin.config.isEnabled(account, params.cfg) : true;
+        if (!enabled) {
+            continue;
+        }
+        const configured = plugin.config.isConfigured
+            ? await plugin.config.isConfigured(account, params.cfg)
+            : true;
+        if (!configured) {
+            continue;
+        }
+        if (plugin.id === "discord") {
+            const discordCfg = account?.config ??
+                {};
+            const nativeEnabled = resolveNativeCommandsEnabled({
+                providerId: "discord",
+                providerSetting: coerceNativeSetting(discordCfg.commands?.native),
+                globalSetting: params.cfg.commands?.native,
+            });
+            const nativeSkillsEnabled = resolveNativeSkillsEnabled({
+                providerId: "discord",
+                providerSetting: coerceNativeSetting(discordCfg.commands?.nativeSkills),
+                globalSetting: params.cfg.commands?.nativeSkills,
+            });
+            const slashEnabled = nativeEnabled || nativeSkillsEnabled;
+            if (slashEnabled) {
+                const defaultGroupPolicy = params.cfg.channels?.defaults?.groupPolicy;
+                const groupPolicy = discordCfg.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
+                const guildEntries = discordCfg.guilds ?? {};
+                const guildsConfigured = Object.keys(guildEntries).length > 0;
+                const hasAnyUserAllowlist = Object.values(guildEntries).some((guild) => {
+                    if (!guild || typeof guild !== "object") {
+                        return false;
+                    }
+                    const g = guild;
+                    if (Array.isArray(g.users) && g.users.length > 0) {
+                        return true;
+                    }
+                    const channels = g.channels;
+                    if (!channels || typeof channels !== "object") {
+                        return false;
+                    }
+                    return Object.values(channels).some((channel) => {
+                        if (!channel || typeof channel !== "object") {
+                            return false;
+                        }
+                        const c = channel;
+                        return Array.isArray(c.users) && c.users.length > 0;
+                    });
+                });
+                const dmAllowFromRaw = discordCfg.dm?.allowFrom;
+                const dmAllowFrom = Array.isArray(dmAllowFromRaw) ? dmAllowFromRaw : [];
+                const storeAllowFrom = await readChannelAllowFromStore("discord").catch(() => []);
+                const ownerAllowFromConfigured = normalizeAllowFromList([...dmAllowFrom, ...storeAllowFrom]).length > 0;
+                const useAccessGroups = params.cfg.commands?.useAccessGroups !== false;
+                if (!useAccessGroups &&
+                    groupPolicy !== "disabled" &&
+                    guildsConfigured &&
+                    !hasAnyUserAllowlist) {
+                    findings.push({
+                        checkId: "channels.discord.commands.native.unrestricted",
+                        severity: "critical",
+                        title: "Discord slash commands are unrestricted",
+                        detail: "commands.useAccessGroups=false disables sender allowlists for Discord slash commands unless a per-guild/channel users allowlist is configured; with no users allowlist, any user in allowed guild channels can invoke /… commands.",
+                        remediation: "Set commands.useAccessGroups=true (recommended), or configure channels.discord.guilds.<id>.users (or channels.discord.guilds.<id>.channels.<channel>.users).",
+                    });
+                }
+                else if (useAccessGroups &&
+                    groupPolicy !== "disabled" &&
+                    guildsConfigured &&
+                    !ownerAllowFromConfigured &&
+                    !hasAnyUserAllowlist) {
+                    findings.push({
+                        checkId: "channels.discord.commands.native.no_allowlists",
+                        severity: "warn",
+                        title: "Discord slash commands have no allowlists",
+                        detail: "Discord slash commands are enabled, but neither an owner allowFrom list nor any per-guild/channel users allowlist is configured; /… commands will be rejected for everyone.",
+                        remediation: "Add your user id to channels.discord.allowFrom (or approve yourself via pairing), or configure channels.discord.guilds.<id>.users.",
+                    });
+                }
+            }
+        }
+        if (plugin.id === "slack") {
+            const slackCfg = account
+                ?.config ?? {};
+            const nativeEnabled = resolveNativeCommandsEnabled({
+                providerId: "slack",
+                providerSetting: coerceNativeSetting(slackCfg.commands?.native),
+                globalSetting: params.cfg.commands?.native,
+            });
+            const nativeSkillsEnabled = resolveNativeSkillsEnabled({
+                providerId: "slack",
+                providerSetting: coerceNativeSetting(slackCfg.commands?.nativeSkills),
+                globalSetting: params.cfg.commands?.nativeSkills,
+            });
+            const slashCommandEnabled = nativeEnabled ||
+                nativeSkillsEnabled ||
+                slackCfg.slashCommand?.enabled === true;
+            if (slashCommandEnabled) {
+                const useAccessGroups = params.cfg.commands?.useAccessGroups !== false;
+                if (!useAccessGroups) {
+                    findings.push({
+                        checkId: "channels.slack.commands.slash.useAccessGroups_off",
+                        severity: "critical",
+                        title: "Slack slash commands bypass access groups",
+                        detail: "Slack slash/native commands are enabled while commands.useAccessGroups=false; this can allow unrestricted /… command execution from channels/users you didn't explicitly authorize.",
+                        remediation: "Set commands.useAccessGroups=true (recommended).",
+                    });
+                }
+                else {
+                    const allowFromRaw = account?.config?.allowFrom;
+                    const legacyAllowFromRaw = account?.dm?.allowFrom;
+                    const allowFrom = Array.isArray(allowFromRaw)
+                        ? allowFromRaw
+                        : Array.isArray(legacyAllowFromRaw)
+                            ? legacyAllowFromRaw
+                            : [];
+                    const storeAllowFrom = await readChannelAllowFromStore("slack").catch(() => []);
+                    const ownerAllowFromConfigured = normalizeAllowFromList([...allowFrom, ...storeAllowFrom]).length > 0;
+                    const channels = slackCfg.channels ?? {};
+                    const hasAnyChannelUsersAllowlist = Object.values(channels).some((value) => {
+                        if (!value || typeof value !== "object") {
+                            return false;
+                        }
+                        const channel = value;
+                        return Array.isArray(channel.users) && channel.users.length > 0;
+                    });
+                    if (!ownerAllowFromConfigured && !hasAnyChannelUsersAllowlist) {
+                        findings.push({
+                            checkId: "channels.slack.commands.slash.no_allowlists",
+                            severity: "warn",
+                            title: "Slack slash commands have no allowlists",
+                            detail: "Slack slash/native commands are enabled, but neither an owner allowFrom list nor any channels.<id>.users allowlist is configured; /… commands will be rejected for everyone.",
+                            remediation: "Approve yourself via pairing (recommended), or set channels.slack.allowFrom and/or channels.slack.channels.<id>.users.",
+                        });
+                    }
+                }
+            }
+        }
+        const dmPolicy = plugin.security.resolveDmPolicy?.({
+            cfg: params.cfg,
+            accountId: defaultAccountId,
+            account,
+        });
+        if (dmPolicy) {
+            await warnDmPolicy({
+                label: plugin.meta.label ?? plugin.id,
+                provider: plugin.id,
+                dmPolicy: dmPolicy.policy,
+                allowFrom: dmPolicy.allowFrom,
+                policyPath: dmPolicy.policyPath,
+                allowFromPath: dmPolicy.allowFromPath,
+                normalizeEntry: dmPolicy.normalizeEntry,
+            });
+        }
+        if (plugin.security.collectWarnings) {
+            const warnings = await plugin.security.collectWarnings({
+                cfg: params.cfg,
+                accountId: defaultAccountId,
+                account,
+            });
+            for (const message of warnings ?? []) {
+                const trimmed = String(message).trim();
+                if (!trimmed) {
+                    continue;
+                }
+                findings.push({
+                    checkId: `channels.${plugin.id}.warning.${findings.length + 1}`,
+                    severity: classifyChannelWarningSeverity(trimmed),
+                    title: `${plugin.meta.label ?? plugin.id} security warning`,
+                    detail: trimmed.replace(/^-\s*/, ""),
+                });
+            }
+        }
+        if (plugin.id === "telegram") {
+            const allowTextCommands = params.cfg.commands?.text !== false;
+            if (!allowTextCommands) {
+                continue;
+            }
+            const telegramCfg = account?.config ??
+                {};
+            const defaultGroupPolicy = params.cfg.channels?.defaults?.groupPolicy;
+            const groupPolicy = telegramCfg.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
+            const groups = telegramCfg.groups;
+            const groupsConfigured = Boolean(groups) && Object.keys(groups ?? {}).length > 0;
+            const groupAccessPossible = groupPolicy === "open" || (groupPolicy === "allowlist" && groupsConfigured);
+            if (!groupAccessPossible) {
+                continue;
+            }
+            const storeAllowFrom = await readChannelAllowFromStore("telegram").catch(() => []);
+            const storeHasWildcard = storeAllowFrom.some((v) => String(v).trim() === "*");
+            const invalidTelegramAllowFromEntries = new Set();
+            for (const entry of storeAllowFrom) {
+                const normalized = normalizeTelegramAllowFromEntry(entry);
+                if (!normalized || normalized === "*") {
+                    continue;
+                }
+                if (!isNumericTelegramUserId(normalized)) {
+                    invalidTelegramAllowFromEntries.add(normalized);
+                }
+            }
+            const groupAllowFrom = Array.isArray(telegramCfg.groupAllowFrom)
+                ? telegramCfg.groupAllowFrom
+                : [];
+            const groupAllowFromHasWildcard = groupAllowFrom.some((v) => String(v).trim() === "*");
+            for (const entry of groupAllowFrom) {
+                const normalized = normalizeTelegramAllowFromEntry(entry);
+                if (!normalized || normalized === "*") {
+                    continue;
+                }
+                if (!isNumericTelegramUserId(normalized)) {
+                    invalidTelegramAllowFromEntries.add(normalized);
+                }
+            }
+            const dmAllowFrom = Array.isArray(telegramCfg.allowFrom) ? telegramCfg.allowFrom : [];
+            for (const entry of dmAllowFrom) {
+                const normalized = normalizeTelegramAllowFromEntry(entry);
+                if (!normalized || normalized === "*") {
+                    continue;
+                }
+                if (!isNumericTelegramUserId(normalized)) {
+                    invalidTelegramAllowFromEntries.add(normalized);
+                }
+            }
+            const anyGroupOverride = Boolean(groups &&
+                Object.values(groups).some((value) => {
+                    if (!value || typeof value !== "object") {
+                        return false;
+                    }
+                    const group = value;
+                    const allowFrom = Array.isArray(group.allowFrom) ? group.allowFrom : [];
+                    if (allowFrom.length > 0) {
+                        for (const entry of allowFrom) {
+                            const normalized = normalizeTelegramAllowFromEntry(entry);
+                            if (!normalized || normalized === "*") {
+                                continue;
+                            }
+                            if (!isNumericTelegramUserId(normalized)) {
+                                invalidTelegramAllowFromEntries.add(normalized);
+                            }
+                        }
+                        return true;
+                    }
+                    const topics = group.topics;
+                    if (!topics || typeof topics !== "object") {
+                        return false;
+                    }
+                    return Object.values(topics).some((topicValue) => {
+                        if (!topicValue || typeof topicValue !== "object") {
+                            return false;
+                        }
+                        const topic = topicValue;
+                        const topicAllow = Array.isArray(topic.allowFrom) ? topic.allowFrom : [];
+                        for (const entry of topicAllow) {
+                            const normalized = normalizeTelegramAllowFromEntry(entry);
+                            if (!normalized || normalized === "*") {
+                                continue;
+                            }
+                            if (!isNumericTelegramUserId(normalized)) {
+                                invalidTelegramAllowFromEntries.add(normalized);
+                            }
+                        }
+                        return topicAllow.length > 0;
+                    });
+                }));
+            const hasAnySenderAllowlist = storeAllowFrom.length > 0 || groupAllowFrom.length > 0 || anyGroupOverride;
+            if (invalidTelegramAllowFromEntries.size > 0) {
+                const examples = Array.from(invalidTelegramAllowFromEntries).slice(0, 5);
+                const more = invalidTelegramAllowFromEntries.size > examples.length
+                    ? ` (+${invalidTelegramAllowFromEntries.size - examples.length} more)`
+                    : "";
+                findings.push({
+                    checkId: "channels.telegram.allowFrom.invalid_entries",
+                    severity: "warn",
+                    title: "Telegram allowlist contains non-numeric entries",
+                    detail: "Telegram sender authorization requires numeric Telegram user IDs. " +
+                        `Found non-numeric allowFrom entries: ${examples.join(", ")}${more}.`,
+                    remediation: "Replace @username entries with numeric Telegram user IDs (use onboarding to resolve), then re-run the audit.",
+                });
+            }
+            if (storeHasWildcard || groupAllowFromHasWildcard) {
+                findings.push({
+                    checkId: "channels.telegram.groups.allowFrom.wildcard",
+                    severity: "critical",
+                    title: "Telegram group allowlist contains wildcard",
+                    detail: 'Telegram group sender allowlist contains "*", which allows any group member to run /… commands and control directives.',
+                    remediation: 'Remove "*" from channels.telegram.groupAllowFrom and pairing store; prefer explicit numeric Telegram user IDs.',
+                });
+                continue;
+            }
+            if (!hasAnySenderAllowlist) {
+                const providerSetting = telegramCfg.commands
+                    // oxlint-disable-next-line typescript/no-explicit-any
+                    ?.nativeSkills;
+                const skillsEnabled = resolveNativeSkillsEnabled({
+                    providerId: "telegram",
+                    providerSetting,
+                    globalSetting: params.cfg.commands?.nativeSkills,
+                });
+                findings.push({
+                    checkId: "channels.telegram.groups.allowFrom.missing",
+                    severity: "critical",
+                    title: "Telegram group commands have no sender allowlist",
+                    detail: `Telegram group access is enabled but no sender allowlist is configured; this allows any group member to invoke /… commands` +
+                        (skillsEnabled ? " (including skill commands)." : "."),
+                    remediation: "Approve yourself via pairing (recommended), or set channels.telegram.groupAllowFrom (or per-group groups.<id>.allowFrom).",
+                });
+            }
+        }
+    }
+    return findings;
+}

package/dist/security/audit-tool-policy.js

@@ -0,0 +1 @@
+export { pickSandboxToolPolicy } from "../agents/sandbox-tool-policy.js";

package/dist/security/scan-paths.js

@@ -0,0 +1,12 @@
+import path from "node:path";
+export function isPathInside(basePath, candidatePath) {
+    const base = path.resolve(basePath);
+    const candidate = path.resolve(candidatePath);
+    const rel = path.relative(base, candidate);
+    return rel === "" || (!rel.startsWith(`..${path.sep}`) && rel !== ".." && !path.isAbsolute(rel));
+}
+export function extensionUsesSkippedScannerPath(entry) {
+    const segments = entry.split(/[\\/]+/).filter(Boolean);
+    return segments.some((segment) => segment === "node_modules" ||
+        (segment.startsWith(".") && segment !== "." && segment !== ".."));
+}

package/dist/sessions/input-provenance.js

@@ -0,0 +1,55 @@
+export const INPUT_PROVENANCE_KIND_VALUES = [
+    "external_user",
+    "inter_session",
+    "internal_system",
+];
+function normalizeOptionalString(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed ? trimmed : undefined;
+}
+function isInputProvenanceKind(value) {
+    return (typeof value === "string" && INPUT_PROVENANCE_KIND_VALUES.includes(value));
+}
+export function normalizeInputProvenance(value) {
+    if (!value || typeof value !== "object") {
+        return undefined;
+    }
+    const record = value;
+    if (!isInputProvenanceKind(record.kind)) {
+        return undefined;
+    }
+    return {
+        kind: record.kind,
+        sourceSessionKey: normalizeOptionalString(record.sourceSessionKey),
+        sourceChannel: normalizeOptionalString(record.sourceChannel),
+        sourceTool: normalizeOptionalString(record.sourceTool),
+    };
+}
+export function applyInputProvenanceToUserMessage(message, inputProvenance) {
+    if (!inputProvenance) {
+        return message;
+    }
+    if (message.role !== "user") {
+        return message;
+    }
+    const existing = normalizeInputProvenance(message.provenance);
+    if (existing) {
+        return message;
+    }
+    return {
+        ...message,
+        provenance: inputProvenance,
+    };
+}
+export function isInterSessionInputProvenance(value) {
+    return normalizeInputProvenance(value)?.kind === "inter_session";
+}
+export function hasInterSessionUserProvenance(message) {
+    if (!message || message.role !== "user") {
+        return false;
+    }
+    return isInterSessionInputProvenance(message.provenance);
+}

package/dist/sessions/session-key-utils.js

@@ -29,6 +29,13 @@ export function isSubagentSessionKey(sessionKey) {
     const parsed = parseAgentSessionKey(raw);
     return Boolean((parsed?.rest ?? "").toLowerCase().startsWith("subagent:"));
 }
+export function getSubagentDepth(sessionKey) {
+    const raw = (sessionKey ?? "").trim().toLowerCase();
+    if (!raw) {
+        return 0;
+    }
+    return raw.split(":subagent:").length - 1;
+}
 export function isAcpSessionKey(sessionKey) {
     const raw = (sessionKey ?? "").trim();
     if (!raw)

package/dist/shared/chat-content.js

@@ -0,0 +1,31 @@
+export function extractTextFromChatContent(content, opts) {
+    const normalize = opts?.normalizeText ?? ((text) => text.replace(/\s+/g, " ").trim());
+    const joinWith = opts?.joinWith ?? " ";
+    if (typeof content === "string") {
+        const value = opts?.sanitizeText ? opts.sanitizeText(content) : content;
+        const normalized = normalize(value);
+        return normalized ? normalized : null;
+    }
+    if (!Array.isArray(content)) {
+        return null;
+    }
+    const chunks = [];
+    for (const block of content) {
+        if (!block || typeof block !== "object") {
+            continue;
+        }
+        if (block.type !== "text") {
+            continue;
+        }
+        const text = block.text;
+        if (typeof text !== "string") {
+            continue;
+        }
+        const value = opts?.sanitizeText ? opts.sanitizeText(text) : text;
+        if (value.trim()) {
+            chunks.push(value);
+        }
+    }
+    const joined = normalize(chunks.join(joinWith));
+    return joined ? joined : null;
+}

package/dist/shared/chat-envelope.js

@@ -0,0 +1,45 @@
+const ENVELOPE_PREFIX = /^\[([^\]]+)\]\s*/;
+const ENVELOPE_CHANNELS = [
+    "WebChat",
+    "WhatsApp",
+    "Telegram",
+    "Signal",
+    "Slack",
+    "Discord",
+    "Google Chat",
+    "iMessage",
+    "Teams",
+    "Matrix",
+    "Zalo",
+    "Zalo Personal",
+    "BlueBubbles",
+];
+const MESSAGE_ID_LINE = /^\s*\[message_id:\s*[^\]]+\]\s*$/i;
+function looksLikeEnvelopeHeader(header) {
+    if (/\d{4}-\d{2}-\d{2}T\d{2}:\d{2}Z\b/.test(header)) {
+        return true;
+    }
+    if (/\d{4}-\d{2}-\d{2} \d{2}:\d{2}\b/.test(header)) {
+        return true;
+    }
+    return ENVELOPE_CHANNELS.some((label) => header.startsWith(`${label} `));
+}
+export function stripEnvelope(text) {
+    const match = text.match(ENVELOPE_PREFIX);
+    if (!match) {
+        return text;
+    }
+    const header = match[1] ?? "";
+    if (!looksLikeEnvelopeHeader(header)) {
+        return text;
+    }
+    return text.slice(match[0].length);
+}
+export function stripMessageIdHints(text) {
+    if (!text.includes("[message_id:")) {
+        return text;
+    }
+    const lines = text.split(/\r?\n/);
+    const filtered = lines.filter((line) => !MESSAGE_ID_LINE.test(line));
+    return filtered.length === lines.length ? text : filtered.join("\n");
+}