@poolzin/pool-bot 2026.2.20 → 2026.2.22

package/dist/plugins/install.js

@@ -1,28 +1,32 @@
 import fs from "node:fs/promises";
-import os from "node:os";
 import path from "node:path";
-import { LEGACY_MANIFEST_KEY } from "../compat/legacy-names.js";
-import { runCommandWithTimeout } from "../process/exec.js";
-import { CONFIG_DIR, resolveUserPath } from "../utils.js";
+import { MANIFEST_KEY } from "../compat/legacy-names.js";
 import { extractArchive, fileExists, readJsonFile, resolveArchiveKind, resolvePackedRootDir, } from "../infra/archive.js";
+import { installPackageDir } from "../infra/install-package-dir.js";
+import { resolveSafeInstallDir, safeDirName, unscopedPackageName, } from "../infra/install-safe-path.js";
+import { packNpmSpecToArchive, resolveArchiveSourcePath, withTempDir, } from "../infra/install-source-utils.js";
+import { validateRegistryNpmSpec } from "../infra/npm-registry-spec.js";
+import { extensionUsesSkippedScannerPath, isPathInside } from "../security/scan-paths.js";
+import * as skillScanner from "../security/skill-scanner.js";
+import { CONFIG_DIR, resolveUserPath } from "../utils.js";
 const defaultLogger = {};
-function unscopedPackageName(name) {
-    const trimmed = name.trim();
-    if (!trimmed)
-        return trimmed;
-    return trimmed.includes("/") ? (trimmed.split("/").pop() ?? trimmed) : trimmed;
-}
-function safeDirName(input) {
-    const trimmed = input.trim();
-    if (!trimmed)
-        return trimmed;
-    return trimmed.replaceAll("/", "__");
-}
 function safeFileName(input) {
     return safeDirName(input);
 }
+function validatePluginId(pluginId) {
+    if (!pluginId) {
+        return "invalid plugin name: missing";
+    }
+    if (pluginId === "." || pluginId === "..") {
+        return "invalid plugin name: reserved path segment";
+    }
+    if (pluginId.includes("/") || pluginId.includes("\\")) {
+        return "invalid plugin name: path separators not allowed";
+    }
+    return null;
+}
 async function ensurePoolbotExtensions(manifest) {
-    const extensions = manifest.poolbot?.extensions ?? manifest[LEGACY_MANIFEST_KEY]?.extensions;
+    const extensions = manifest[MANIFEST_KEY]?.extensions;
     if (!Array.isArray(extensions)) {
         throw new Error("package.json missing poolbot.extensions");
     }
@@ -32,17 +36,49 @@ async function ensurePoolbotExtensions(manifest) {
     }
     return list;
 }
+function resolvePluginInstallModeOptions(params) {
+    return {
+        logger: params.logger ?? defaultLogger,
+        mode: params.mode ?? "install",
+        dryRun: params.dryRun ?? false,
+    };
+}
+function resolveTimedPluginInstallModeOptions(params) {
+    return {
+        ...resolvePluginInstallModeOptions(params),
+        timeoutMs: params.timeoutMs ?? 120_000,
+    };
+}
+function buildFileInstallResult(pluginId, targetFile) {
+    return {
+        ok: true,
+        pluginId,
+        targetDir: targetFile,
+        manifestName: undefined,
+        version: undefined,
+        extensions: [path.basename(targetFile)],
+    };
+}
 export function resolvePluginInstallDir(pluginId, extensionsDir) {
     const extensionsBase = extensionsDir
         ? resolveUserPath(extensionsDir)
         : path.join(CONFIG_DIR, "extensions");
-    return path.join(extensionsBase, safeDirName(pluginId));
+    const pluginIdError = validatePluginId(pluginId);
+    if (pluginIdError) {
+        throw new Error(pluginIdError);
+    }
+    const targetDirResult = resolveSafeInstallDir({
+        baseDir: extensionsBase,
+        id: pluginId,
+        invalidNameMessage: "invalid plugin name: path traversal detected",
+    });
+    if (!targetDirResult.ok) {
+        throw new Error(targetDirResult.error);
+    }
+    return targetDirResult.path;
 }
 async function installPluginFromPackageDir(params) {
-    const logger = params.logger ?? defaultLogger;
-    const timeoutMs = params.timeoutMs ?? 120_000;
-    const mode = params.mode ?? "install";
-    const dryRun = params.dryRun ?? false;
+    const { logger, timeoutMs, mode, dryRun } = resolveTimedPluginInstallModeOptions(params);
     const manifestPath = path.join(params.packageDir, "package.json");
     if (!(await fileExists(manifestPath))) {
         return { ok: false, error: "extracted package missing package.json" };
@@ -63,17 +99,61 @@ async function installPluginFromPackageDir(params) {
     }
     const pkgName = typeof manifest.name === "string" ? manifest.name : "";
     const pluginId = pkgName ? unscopedPackageName(pkgName) : "plugin";
+    const pluginIdError = validatePluginId(pluginId);
+    if (pluginIdError) {
+        return { ok: false, error: pluginIdError };
+    }
     if (params.expectedPluginId && params.expectedPluginId !== pluginId) {
         return {
             ok: false,
             error: `plugin id mismatch: expected ${params.expectedPluginId}, got ${pluginId}`,
         };
     }
+    const packageDir = path.resolve(params.packageDir);
+    const forcedScanEntries = [];
+    for (const entry of extensions) {
+        const resolvedEntry = path.resolve(packageDir, entry);
+        if (!isPathInside(packageDir, resolvedEntry)) {
+            logger.warn?.(`extension entry escapes plugin directory and will not be scanned: ${entry}`);
+            continue;
+        }
+        if (extensionUsesSkippedScannerPath(entry)) {
+            logger.warn?.(`extension entry is in a hidden/node_modules path and will receive targeted scan coverage: ${entry}`);
+        }
+        forcedScanEntries.push(resolvedEntry);
+    }
+    // Scan plugin source for dangerous code patterns (warn-only; never blocks install)
+    try {
+        const scanSummary = await skillScanner.scanDirectoryWithSummary(params.packageDir, {
+            includeFiles: forcedScanEntries,
+        });
+        if (scanSummary.critical > 0) {
+            const criticalDetails = scanSummary.findings
+                .filter((f) => f.severity === "critical")
+                .map((f) => `${f.message} (${f.file}:${f.line})`)
+                .join("; ");
+            logger.warn?.(`WARNING: Plugin "${pluginId}" contains dangerous code patterns: ${criticalDetails}`);
+        }
+        else if (scanSummary.warn > 0) {
+            logger.warn?.(`Plugin "${pluginId}" has ${scanSummary.warn} suspicious code pattern(s). Run "poolbot security audit --deep" for details.`);
+        }
+    }
+    catch (err) {
+        logger.warn?.(`Plugin "${pluginId}" code safety scan failed (${String(err)}). Installation continues; run "poolbot security audit --deep" after install.`);
+    }
     const extensionsDir = params.extensionsDir
         ? resolveUserPath(params.extensionsDir)
         : path.join(CONFIG_DIR, "extensions");
     await fs.mkdir(extensionsDir, { recursive: true });
-    const targetDir = path.join(extensionsDir, safeDirName(pluginId));
+    const targetDirResult = resolveSafeInstallDir({
+        baseDir: extensionsDir,
+        id: pluginId,
+        invalidNameMessage: "invalid plugin name: path traversal detected",
+    });
+    if (!targetDirResult.ok) {
+        return { ok: false, error: targetDirResult.error };
+    }
+    const targetDir = targetDirResult.path;
     if (mode === "install" && (await fileExists(targetDir))) {
         return {
             ok: false,
@@ -90,49 +170,32 @@ async function installPluginFromPackageDir(params) {
             extensions,
         };
     }
-    logger.info?.(`Installing to ${targetDir}…`);
-    let backupDir = null;
-    if (mode === "update" && (await fileExists(targetDir))) {
-        backupDir = `${targetDir}.backup-${Date.now()}`;
-        await fs.rename(targetDir, backupDir);
-    }
-    try {
-        await fs.cp(params.packageDir, targetDir, { recursive: true });
-    }
-    catch (err) {
-        if (backupDir) {
-            await fs.rm(targetDir, { recursive: true, force: true }).catch(() => undefined);
-            await fs.rename(backupDir, targetDir).catch(() => undefined);
-        }
-        return { ok: false, error: `failed to copy plugin: ${String(err)}` };
-    }
-    for (const entry of extensions) {
-        const resolvedEntry = path.resolve(targetDir, entry);
-        if (!(await fileExists(resolvedEntry))) {
-            logger.warn?.(`extension entry not found: ${entry}`);
-        }
-    }
     const deps = manifest.dependencies ?? {};
     const hasDeps = Object.keys(deps).length > 0;
-    if (hasDeps) {
-        logger.info?.("Installing plugin dependencies…");
-        const npmRes = await runCommandWithTimeout(["npm", "install", "--omit=dev", "--silent"], {
-            timeoutMs: Math.max(timeoutMs, 300_000),
-            cwd: targetDir,
-        });
-        if (npmRes.code !== 0) {
-            if (backupDir) {
-                await fs.rm(targetDir, { recursive: true, force: true }).catch(() => undefined);
-                await fs.rename(backupDir, targetDir).catch(() => undefined);
+    const installRes = await installPackageDir({
+        sourceDir: params.packageDir,
+        targetDir,
+        mode,
+        timeoutMs,
+        logger,
+        copyErrorPrefix: "failed to copy plugin",
+        hasDeps,
+        depsLogMessage: "Installing plugin dependencies…",
+        afterCopy: async () => {
+            for (const entry of extensions) {
+                const resolvedEntry = path.resolve(targetDir, entry);
+                if (!isPathInside(targetDir, resolvedEntry)) {
+                    logger.warn?.(`extension entry escapes plugin directory: ${entry}`);
+                    continue;
+                }
+                if (!(await fileExists(resolvedEntry))) {
+                    logger.warn?.(`extension entry not found: ${entry}`);
+                }
             }
-            return {
-                ok: false,
-                error: `npm install failed: ${npmRes.stderr.trim() || npmRes.stdout.trim()}`,
-            };
-        }
-    }
-    if (backupDir) {
-        await fs.rm(backupDir, { recursive: true, force: true }).catch(() => undefined);
+        },
+    });
+    if (!installRes.ok) {
+        return installRes;
     }
     return {
         ok: true,
@@ -147,43 +210,42 @@ export async function installPluginFromArchive(params) {
     const logger = params.logger ?? defaultLogger;
     const timeoutMs = params.timeoutMs ?? 120_000;
     const mode = params.mode ?? "install";
-    const archivePath = resolveUserPath(params.archivePath);
-    if (!(await fileExists(archivePath))) {
-        return { ok: false, error: `archive not found: ${archivePath}` };
-    }
-    if (!resolveArchiveKind(archivePath)) {
-        return { ok: false, error: `unsupported archive: ${archivePath}` };
-    }
-    const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "poolbot-plugin-"));
-    const extractDir = path.join(tmpDir, "extract");
-    await fs.mkdir(extractDir, { recursive: true });
-    logger.info?.(`Extracting ${archivePath}…`);
-    try {
-        await extractArchive({
-            archivePath,
-            destDir: extractDir,
+    const archivePathResult = await resolveArchiveSourcePath(params.archivePath);
+    if (!archivePathResult.ok) {
+        return archivePathResult;
+    }
+    const archivePath = archivePathResult.path;
+    return await withTempDir("poolbot-plugin-", async (tmpDir) => {
+        const extractDir = path.join(tmpDir, "extract");
+        await fs.mkdir(extractDir, { recursive: true });
+        logger.info?.(`Extracting ${archivePath}…`);
+        try {
+            await extractArchive({
+                archivePath,
+                destDir: extractDir,
+                timeoutMs,
+                logger,
+            });
+        }
+        catch (err) {
+            return { ok: false, error: `failed to extract archive: ${String(err)}` };
+        }
+        let packageDir = "";
+        try {
+            packageDir = await resolvePackedRootDir(extractDir);
+        }
+        catch (err) {
+            return { ok: false, error: String(err) };
+        }
+        return await installPluginFromPackageDir({
+            packageDir,
+            extensionsDir: params.extensionsDir,
             timeoutMs,
             logger,
+            mode,
+            dryRun: params.dryRun,
+            expectedPluginId: params.expectedPluginId,
         });
-    }
-    catch (err) {
-        return { ok: false, error: `failed to extract archive: ${String(err)}` };
-    }
-    let packageDir = "";
-    try {
-        packageDir = await resolvePackedRootDir(extractDir);
-    }
-    catch (err) {
-        return { ok: false, error: String(err) };
-    }
-    return await installPluginFromPackageDir({
-        packageDir,
-        extensionsDir: params.extensionsDir,
-        timeoutMs,
-        logger,
-        mode,
-        dryRun: params.dryRun,
-        expectedPluginId: params.expectedPluginId,
     });
 }
 export async function installPluginFromDir(params) {
@@ -206,9 +268,7 @@ export async function installPluginFromDir(params) {
     });
 }
 export async function installPluginFromFile(params) {
-    const logger = params.logger ?? defaultLogger;
-    const mode = params.mode ?? "install";
-    const dryRun = params.dryRun ?? false;
+    const { logger, mode, dryRun } = resolvePluginInstallModeOptions(params);
     const filePath = resolveUserPath(params.filePath);
     if (!(await fileExists(filePath))) {
         return { ok: false, error: `file not found: ${filePath}` };
@@ -219,70 +279,48 @@ export async function installPluginFromFile(params) {
     await fs.mkdir(extensionsDir, { recursive: true });
     const base = path.basename(filePath, path.extname(filePath));
     const pluginId = base || "plugin";
+    const pluginIdError = validatePluginId(pluginId);
+    if (pluginIdError) {
+        return { ok: false, error: pluginIdError };
+    }
     const targetFile = path.join(extensionsDir, `${safeFileName(pluginId)}${path.extname(filePath)}`);
     if (mode === "install" && (await fileExists(targetFile))) {
         return { ok: false, error: `plugin already exists: ${targetFile} (delete it first)` };
     }
     if (dryRun) {
-        return {
-            ok: true,
-            pluginId,
-            targetDir: targetFile,
-            manifestName: undefined,
-            version: undefined,
-            extensions: [path.basename(targetFile)],
-        };
+        return buildFileInstallResult(pluginId, targetFile);
     }
     logger.info?.(`Installing to ${targetFile}…`);
     await fs.copyFile(filePath, targetFile);
-    return {
-        ok: true,
-        pluginId,
-        targetDir: targetFile,
-        manifestName: undefined,
-        version: undefined,
-        extensions: [path.basename(targetFile)],
-    };
+    return buildFileInstallResult(pluginId, targetFile);
 }
 export async function installPluginFromNpmSpec(params) {
-    const logger = params.logger ?? defaultLogger;
-    const timeoutMs = params.timeoutMs ?? 120_000;
-    const mode = params.mode ?? "install";
-    const dryRun = params.dryRun ?? false;
+    const { logger, timeoutMs, mode, dryRun } = resolveTimedPluginInstallModeOptions(params);
     const expectedPluginId = params.expectedPluginId;
     const spec = params.spec.trim();
-    if (!spec)
-        return { ok: false, error: "missing npm spec" };
-    const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "poolbot-npm-pack-"));
-    logger.info?.(`Downloading ${spec}…`);
-    const res = await runCommandWithTimeout(["npm", "pack", spec], {
-        timeoutMs: Math.max(timeoutMs, 300_000),
-        cwd: tmpDir,
-        env: { COREPACK_ENABLE_DOWNLOAD_PROMPT: "0" },
-    });
-    if (res.code !== 0) {
-        return {
-            ok: false,
-            error: `npm pack failed: ${res.stderr.trim() || res.stdout.trim()}`,
-        };
-    }
-    const packed = (res.stdout || "")
-        .split("\n")
-        .map((l) => l.trim())
-        .filter(Boolean)
-        .pop();
-    if (!packed) {
-        return { ok: false, error: "npm pack produced no archive" };
-    }
-    const archivePath = path.join(tmpDir, packed);
-    return await installPluginFromArchive({
-        archivePath,
-        extensionsDir: params.extensionsDir,
-        timeoutMs,
-        logger,
-        mode,
-        dryRun,
-        expectedPluginId,
+    const specError = validateRegistryNpmSpec(spec);
+    if (specError) {
+        return { ok: false, error: specError };
+    }
+    return await withTempDir("poolbot-npm-pack-", async (tmpDir) => {
+        logger.info?.(`Downloading ${spec}…`);
+        const packedResult = await packNpmSpecToArchive({
+            spec,
+            timeoutMs,
+            cwd: tmpDir,
+        });
+        if (!packedResult.ok) {
+            return packedResult;
+        }
+        return await installPluginFromArchive({
+            archivePath: packedResult.archivePath,
+            extensionsDir: params.extensionsDir,
+            timeoutMs,
+            logger,
+            mode,
+            dryRun,
+            expectedPluginId,
+        });
     });
 }
 export async function installPluginFromPath(params) {

package/dist/polls.js

@@ -21,6 +21,13 @@ export function normalizePollInput(input, options = {}) {
     if (maxSelections > cleaned.length) {
         throw new Error("maxSelections cannot exceed option count");
     }
+    const durationSecondsRaw = input.durationSeconds;
+    const durationSeconds = typeof durationSecondsRaw === "number" && Number.isFinite(durationSecondsRaw)
+        ? Math.floor(durationSecondsRaw)
+        : undefined;
+    if (durationSeconds !== undefined && durationSeconds < 1) {
+        throw new Error("durationSeconds must be at least 1");
+    }
     const durationRaw = input.durationHours;
     const durationHours = typeof durationRaw === "number" && Number.isFinite(durationRaw)
         ? Math.floor(durationRaw)
@@ -28,10 +35,14 @@ export function normalizePollInput(input, options = {}) {
     if (durationHours !== undefined && durationHours < 1) {
         throw new Error("durationHours must be at least 1");
     }
+    if (durationSeconds !== undefined && durationHours !== undefined) {
+        throw new Error("durationSeconds and durationHours are mutually exclusive");
+    }
     return {
         question,
         options: cleaned,
         maxSelections,
+        durationSeconds,
         durationHours,
     };
 }