@poolzin/pool-bot 2026.2.17 → 2026.2.19

package/extensions/msteams/src/graph.ts

@@ -0,0 +1,92 @@
+import type { MSTeamsConfig } from "poolbot/plugin-sdk";
+import { GRAPH_ROOT } from "./attachments/shared.js";
+import { loadMSTeamsSdkWithAuth } from "./sdk.js";
+import { resolveMSTeamsCredentials } from "./token.js";
+
+export type GraphUser = {
+  id?: string;
+  displayName?: string;
+  userPrincipalName?: string;
+  mail?: string;
+};
+
+export type GraphGroup = {
+  id?: string;
+  displayName?: string;
+};
+
+export type GraphChannel = {
+  id?: string;
+  displayName?: string;
+};
+
+export type GraphResponse<T> = { value?: T[] };
+
+function readAccessToken(value: unknown): string | null {
+  if (typeof value === "string") {
+    return value;
+  }
+  if (value && typeof value === "object") {
+    const token =
+      (value as { accessToken?: unknown }).accessToken ?? (value as { token?: unknown }).token;
+    return typeof token === "string" ? token : null;
+  }
+  return null;
+}
+
+export function normalizeQuery(value?: string | null): string {
+  return value?.trim() ?? "";
+}
+
+export function escapeOData(value: string): string {
+  return value.replace(/'/g, "''");
+}
+
+export async function fetchGraphJson<T>(params: {
+  token: string;
+  path: string;
+  headers?: Record<string, string>;
+}): Promise<T> {
+  const res = await fetch(`${GRAPH_ROOT}${params.path}`, {
+    headers: {
+      Authorization: `Bearer ${params.token}`,
+      ...params.headers,
+    },
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`Graph ${params.path} failed (${res.status}): ${text || "unknown error"}`);
+  }
+  return (await res.json()) as T;
+}
+
+export async function resolveGraphToken(cfg: unknown): Promise<string> {
+  const creds = resolveMSTeamsCredentials(
+    (cfg as { channels?: { msteams?: unknown } })?.channels?.msteams as MSTeamsConfig | undefined,
+  );
+  if (!creds) {
+    throw new Error("MS Teams credentials missing");
+  }
+  const { sdk, authConfig } = await loadMSTeamsSdkWithAuth(creds);
+  const tokenProvider = new sdk.MsalTokenProvider(authConfig);
+  const token = await tokenProvider.getAccessToken("https://graph.microsoft.com");
+  const accessToken = readAccessToken(token);
+  if (!accessToken) {
+    throw new Error("MS Teams graph token unavailable");
+  }
+  return accessToken;
+}
+
+export async function listTeamsByName(token: string, query: string): Promise<GraphGroup[]> {
+  const escaped = escapeOData(query);
+  const filter = `resourceProvisioningOptions/Any(x:x eq 'Team') and startsWith(displayName,'${escaped}')`;
+  const path = `/groups?$filter=${encodeURIComponent(filter)}&$select=id,displayName`;
+  const res = await fetchGraphJson<GraphResponse<GraphGroup>>({ token, path });
+  return res.value ?? [];
+}
+
+export async function listChannelsForTeam(token: string, teamId: string): Promise<GraphChannel[]> {
+  const path = `/teams/${encodeURIComponent(teamId)}/channels?$select=id,displayName`;
+  const res = await fetchGraphJson<GraphResponse<GraphChannel>>({ token, path });
+  return res.value ?? [];
+}

package/extensions/msteams/src/mentions.ts

@@ -0,0 +1,114 @@
+/**
+ * MS Teams mention handling utilities.
+ *
+ * Mentions in Teams require:
+ * 1. Text containing <at>Name</at> tags
+ * 2. entities array with mention metadata
+ */
+
+export type MentionEntity = {
+  type: "mention";
+  text: string;
+  mentioned: {
+    id: string;
+    name: string;
+  };
+};
+
+export type MentionInfo = {
+  /** User/bot ID (e.g., "28:xxx" or AAD object ID) */
+  id: string;
+  /** Display name */
+  name: string;
+};
+
+/**
+ * Check whether an ID looks like a valid Teams user/bot identifier.
+ * Accepts:
+ * - Bot Framework IDs: "28:xxx..." / "29:xxx..." / "8:orgid:..."
+ * - AAD object IDs (UUIDs): "d5318c29-33ac-4e6b-bd42-57b8b793908f"
+ *
+ * Keep this permissive enough for real Teams IDs while still rejecting
+ * documentation placeholders like `@[表示名](ユーザーID)`.
+ */
+const TEAMS_BOT_ID_PATTERN = /^\d+:[a-z0-9._=-]+(?::[a-z0-9._=-]+)*$/i;
+const AAD_OBJECT_ID_PATTERN = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+
+function isValidTeamsId(id: string): boolean {
+  return TEAMS_BOT_ID_PATTERN.test(id) || AAD_OBJECT_ID_PATTERN.test(id);
+}
+
+/**
+ * Parse mentions from text in the format @[Name](id).
+ * Example: "Hello @[John Doe](28:xxx-yyy-zzz)!"
+ *
+ * Only matches where the id looks like a real Teams user/bot ID are treated
+ * as mentions. This avoids false positives from documentation or code samples
+ * embedded in the message (e.g. `@[表示名](ユーザーID)` in backticks).
+ *
+ * Returns both the formatted text with <at> tags and the entities array.
+ */
+export function parseMentions(text: string): {
+  text: string;
+  entities: MentionEntity[];
+} {
+  const mentionPattern = /@\[([^\]]+)\]\(([^)]+)\)/g;
+  const entities: MentionEntity[] = [];
+
+  // Replace @[Name](id) with <at>Name</at> only for valid Teams IDs
+  const formattedText = text.replace(mentionPattern, (match, name, id) => {
+    const trimmedId = id.trim();
+
+    // Skip matches where the id doesn't look like a real Teams identifier
+    if (!isValidTeamsId(trimmedId)) {
+      return match;
+    }
+
+    const trimmedName = name.trim();
+    const mentionTag = `<at>${trimmedName}</at>`;
+    entities.push({
+      type: "mention",
+      text: mentionTag,
+      mentioned: {
+        id: trimmedId,
+        name: trimmedName,
+      },
+    });
+    return mentionTag;
+  });
+
+  return {
+    text: formattedText,
+    entities,
+  };
+}
+
+/**
+ * Build mention entities array from a list of mentions.
+ * Use this when you already have the mention info and formatted text.
+ */
+export function buildMentionEntities(mentions: MentionInfo[]): MentionEntity[] {
+  return mentions.map((mention) => ({
+    type: "mention",
+    text: `<at>${mention.name}</at>`,
+    mentioned: {
+      id: mention.id,
+      name: mention.name,
+    },
+  }));
+}
+
+/**
+ * Format text with mentions using <at> tags.
+ * This is a convenience function when you want to manually format mentions.
+ */
+export function formatMentionText(text: string, mentions: MentionInfo[]): string {
+  let formatted = text;
+  for (const mention of mentions) {
+    // Replace @Name or @name with <at>Name</at>
+    const escapedName = mention.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const namePattern = new RegExp(`@${escapedName}`, "gi");
+    formatted = formatted.replace(namePattern, `<at>${mention.name}</at>`);
+  }
+  return formatted;
+}

package/extensions/msteams/src/test-runtime.ts

@@ -0,0 +1,16 @@
+import os from "node:os";
+import path from "node:path";
+import type { PluginRuntime } from "poolbot/plugin-sdk";
+
+export const msteamsRuntimeStub = {
+  state: {
+    resolveStateDir: (env: NodeJS.ProcessEnv = process.env, homedir?: () => string) => {
+      const override = env.POOLBOT_STATE_DIR?.trim() || env.POOLBOT_STATE_DIR?.trim();
+      if (override) {
+        return override;
+      }
+      const resolvedHome = homedir ? homedir() : os.homedir();
+      return path.join(resolvedHome, ".openclaw");
+    },
+  },
+} as unknown as PluginRuntime;

package/extensions/openai-codex-auth/README.md

@@ -0,0 +1,82 @@
+# OpenAI Codex CLI Auth (Pool Bot plugin)
+
+Use OpenAI models with your **ChatGPT Plus/Pro subscription** via the Codex CLI OAuth tokens.
+
+This plugin reads authentication from the [OpenAI Codex CLI](https://github.com/openai/codex) and uses those OAuth credentials to access OpenAI models — no separate API key required.
+
+## Enable
+
+Bundled plugins are disabled by default. Enable this one:
+
+```bash
+poolbot plugins enable openai-codex-auth
+```
+
+Restart the Gateway after enabling.
+
+## Prerequisites
+
+1. **ChatGPT Plus or Pro subscription** — required for Codex CLI access
+2. **Codex CLI installed and authenticated**:
+
+```bash
+# Install Codex CLI
+npm install -g @openai/codex
+
+# Authenticate (opens browser for OAuth)
+codex login
+```
+
+This creates `~/.codex/auth.json` with your OAuth tokens.
+
+## Authenticate with Pool Bot
+
+After Codex CLI is authenticated:
+
+```bash
+poolbot models auth login --provider openai-codex --set-default
+```
+
+## Available Models
+
+The following models are available through Codex CLI authentication:
+
+- `openai/gpt-4.1`, `openai/gpt-4.1-mini`, `openai/gpt-4.1-nano`
+- `openai/gpt-4o`, `openai/gpt-4o-mini`
+- `openai/o1`, `openai/o1-mini`, `openai/o1-pro`
+- `openai/o3`, `openai/o3-mini`
+- `openai/o4-mini`
+
+Default model: `openai/o3`
+
+## How It Works
+
+1. The plugin reads `~/.codex/auth.json` created by `codex login`
+2. OAuth tokens from your ChatGPT subscription are extracted
+3. Pool Bot uses these tokens to authenticate with OpenAI's API
+4. Tokens auto-refresh when needed (handled by Pool Bot's credential system)
+
+## Why Use This?
+
+- **No separate API key** — use your existing ChatGPT Plus/Pro subscription
+- **No usage-based billing** — covered by your subscription
+- **Access to latest models** — same models available in ChatGPT
+
+## Troubleshooting
+
+### "No Codex auth found"
+
+Run `codex login` to authenticate the Codex CLI first.
+
+### Tokens expired
+
+Re-run `codex login` to refresh your tokens, then re-authenticate:
+
+```bash
+codex login
+poolbot models auth login --provider openai-codex --set-default
+```
+
+### Model not available
+
+Some models may require specific subscription tiers (e.g., o1-pro requires ChatGPT Pro).

package/extensions/openai-codex-auth/index.ts

@@ -0,0 +1,177 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import {
+  emptyPluginConfigSchema,
+  type PoolBotPluginApi,
+  type ProviderAuthContext,
+  type ProviderAuthResult,
+} from "poolbot/plugin-sdk";
+
+const PROVIDER_ID = "openai-codex-import";
+const PROVIDER_LABEL = "OpenAI Codex CLI Import";
+
+/**
+ * Resolve the Codex auth file path, respecting CODEX_HOME env var like core does.
+ * Called lazily to pick up env var changes.
+ */
+function getAuthFilePath(): string {
+  const codexHome = process.env.CODEX_HOME
+    ? path.resolve(process.env.CODEX_HOME)
+    : path.join(os.homedir(), ".codex");
+  return path.join(codexHome, "auth.json");
+}
+
+/**
+ * OpenAI Codex models available via ChatGPT Plus/Pro subscription.
+ * Uses openai-codex/ prefix to match core provider namespace and avoid
+ * conflicts with the standard openai/ API key-based provider.
+ */
+const CODEX_MODELS = [
+  "openai-codex/gpt-5.3-codex",
+  "openai-codex/gpt-5.3-codex-spark",
+  "openai-codex/gpt-5.2-codex",
+] as const;
+
+const DEFAULT_MODEL = "openai-codex/gpt-5.3-codex";
+
+interface CodexAuthTokens {
+  access_token: string;
+  refresh_token?: string;
+  account_id?: string;
+  expires_at?: number;
+}
+
+interface CodexAuthFile {
+  tokens?: CodexAuthTokens;
+}
+
+/**
+ * Read the Codex CLI auth.json file, respecting CODEX_HOME env var.
+ */
+function readCodexAuth(): CodexAuthFile | null {
+  try {
+    const authFile = getAuthFilePath();
+    if (!fs.existsSync(authFile)) return null;
+    const content = fs.readFileSync(authFile, "utf-8");
+    return JSON.parse(content) as CodexAuthFile;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Decode JWT expiry timestamp from access token
+ */
+function decodeJwtExpiry(token: string): number | undefined {
+  try {
+    const payload = token.split(".")[1];
+    if (!payload) return undefined;
+    const decoded = JSON.parse(Buffer.from(payload, "base64").toString()) as { exp?: number };
+    return decoded.exp ? decoded.exp * 1000 : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+const openaiCodexPlugin = {
+  id: "openai-codex-auth",
+  name: "OpenAI Codex Auth",
+  description: "Use OpenAI models via Codex CLI authentication (ChatGPT Plus/Pro)",
+  configSchema: emptyPluginConfigSchema(),
+
+  register(api: PoolBotPluginApi) {
+    api.registerProvider({
+      id: PROVIDER_ID,
+      label: PROVIDER_LABEL,
+      docsPath: "/providers/models",
+      aliases: ["codex-import"],
+
+      auth: [
+        {
+          id: "codex-cli",
+          label: "Codex CLI Auth",
+          hint: "Import existing Codex CLI authentication (respects CODEX_HOME env var)",
+          kind: "custom",
+
+          run: async (ctx: ProviderAuthContext): Promise<ProviderAuthResult> => {
+            const spin = ctx.prompter.progress("Reading Codex CLI auth…");
+
+            try {
+              const auth = readCodexAuth();
+
+              if (!auth?.tokens?.access_token) {
+                spin.stop("No Codex auth found");
+                await ctx.prompter.note(
+                  "Run 'codex login' first to authenticate with OpenAI.\n\n" +
+                    "Install Codex CLI: npm install -g @openai/codex\n" +
+                    "Then run: codex login",
+                  "Setup required",
+                );
+                throw new Error("Codex CLI not authenticated. Run: codex login");
+              }
+
+              spin.stop("Codex auth loaded");
+
+              const profileId = `openai-codex-import:${auth.tokens.account_id ?? "default"}`;
+              const expires = auth.tokens.expires_at
+                ? auth.tokens.expires_at * 1000
+                : decodeJwtExpiry(auth.tokens.access_token);
+
+              const modelsConfig: Record<string, object> = {};
+              for (const model of CODEX_MODELS) {
+                modelsConfig[model] = {};
+              }
+
+              // Validate refresh token - empty/missing refresh tokens cause silent failures
+              if (!auth.tokens.refresh_token) {
+                spin.stop("Invalid Codex auth");
+                await ctx.prompter.note(
+                  "Your Codex CLI auth is missing a refresh token.\n\n" +
+                    "Please re-authenticate: codex logout && codex login",
+                  "Re-authentication required",
+                );
+                throw new Error(
+                  "Codex CLI auth missing refresh token. Run: codex logout && codex login",
+                );
+              }
+
+              return {
+                profiles: [
+                  {
+                    profileId,
+                    credential: {
+                      type: "oauth",
+                      provider: PROVIDER_ID,
+                      access: auth.tokens.access_token,
+                      refresh: auth.tokens.refresh_token,
+                      expires: expires ?? Date.now() + 3600000,
+                    },
+                  },
+                ],
+                configPatch: {
+                  agents: {
+                    defaults: {
+                      models: modelsConfig,
+                    },
+                  },
+                },
+                defaultModel: DEFAULT_MODEL,
+                notes: [
+                  `Using Codex CLI auth from ${getAuthFilePath()}`,
+                  `Available models: ${CODEX_MODELS.join(", ")}`,
+                  "Tokens auto-refresh when needed.",
+                ],
+              };
+            } catch (err) {
+              spin.stop("Failed to load Codex auth");
+              throw err;
+            }
+          },
+        },
+      ],
+    });
+  },
+};
+
+export default openaiCodexPlugin;

package/extensions/openai-codex-auth/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "@poolzin/openai-codex-auth",
+  "version": "2026.2.18",
+  "private": true,
+  "description": "OpenAI Codex CLI auth provider plugin - use ChatGPT Plus/Pro subscription for OpenAI models",
+  "type": "module",
+  "devDependencies": {
+    "poolbot": "workspace:*"
+  },
+  "poolbot": {
+    "extensions": [
+      "./index.ts"
+    ]
+  }
+}

package/extensions/openai-codex-auth/poolbot.plugin.json

@@ -0,0 +1,9 @@
+{
+  "id": "openai-codex-auth",
+  "providers": ["openai-codex"],
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {}
+  }
+}