@poolzin/pool-bot 2026.2.21 → 2026.2.22

package/dist/agents/tools/sessions-spawn-tool.js

@@ -1,17 +1,7 @@
-import crypto from "node:crypto";
 import { Type } from "@sinclair/typebox";
-import { formatThinkingLevels, normalizeThinkLevel } from "../../auto-reply/thinking.js";
-import { loadConfig } from "../../config/config.js";
-import { callGateway } from "../../gateway/call.js";
-import { isSubagentSessionKey, normalizeAgentId, parseAgentSessionKey, } from "../../routing/session-key.js";
-import { normalizeDeliveryContext } from "../../utils/delivery-context.js";
-import { resolveAgentConfig } from "../agent-scope.js";
-import { AGENT_LANE_SUBAGENT } from "../lanes.js";
 import { optionalStringEnum } from "../schema/typebox.js";
-import { buildSubagentSystemPrompt } from "../subagent-announce.js";
-import { registerSubagentRun } from "../subagent-registry.js";
+import { spawnSubagentDirect } from "../subagent-spawn.js";
 import { jsonResult, readStringParam } from "./common.js";
-import { resolveDisplaySessionKey, resolveInternalSessionKey, resolveMainSessionAlias, } from "./sessions-helpers.js";
 const SessionsSpawnToolSchema = Type.Object({
     task: Type.String(),
     label: Type.Optional(Type.String()),
@@ -19,33 +9,10 @@ const SessionsSpawnToolSchema = Type.Object({
     model: Type.Optional(Type.String()),
     thinking: Type.Optional(Type.String()),
     runTimeoutSeconds: Type.Optional(Type.Number({ minimum: 0 })),
-    // Back-compat alias. Prefer runTimeoutSeconds.
+    // Back-compat: older callers used timeoutSeconds for this tool.
     timeoutSeconds: Type.Optional(Type.Number({ minimum: 0 })),
     cleanup: optionalStringEnum(["delete", "keep"]),
 });
-function splitModelRef(ref) {
-    if (!ref)
-        return { provider: undefined, model: undefined };
-    const trimmed = ref.trim();
-    if (!trimmed)
-        return { provider: undefined, model: undefined };
-    const [provider, model] = trimmed.split("/", 2);
-    if (model)
-        return { provider, model };
-    return { provider: undefined, model: trimmed };
-}
-function normalizeModelSelection(value) {
-    if (typeof value === "string") {
-        const trimmed = value.trim();
-        return trimmed || undefined;
-    }
-    if (!value || typeof value !== "object")
-        return undefined;
-    const primary = value.primary;
-    if (typeof primary === "string" && primary.trim())
-        return primary.trim();
-    return undefined;
-}
 export function createSessionsSpawnTool(opts) {
     return {
         label: "Sessions",
@@ -59,174 +26,37 @@ export function createSessionsSpawnTool(opts) {
             const requestedAgentId = readStringParam(params, "agentId");
             const modelOverride = readStringParam(params, "model");
             const thinkingOverrideRaw = readStringParam(params, "thinking");
-            const cleanup = params.cleanup === "keep" || params.cleanup === "delete"
-                ? params.cleanup
-                : "keep";
-            const requesterOrigin = normalizeDeliveryContext({
-                channel: opts?.agentChannel,
-                accountId: opts?.agentAccountId,
-                to: opts?.agentTo,
-                threadId: opts?.agentThreadId,
-            });
-            const runTimeoutSeconds = (() => {
-                const explicit = typeof params.runTimeoutSeconds === "number" && Number.isFinite(params.runTimeoutSeconds)
-                    ? Math.max(0, Math.floor(params.runTimeoutSeconds))
+            const cleanup = params.cleanup === "keep" || params.cleanup === "delete" ? params.cleanup : "keep";
+            // Back-compat: older callers used timeoutSeconds for this tool.
+            const timeoutSecondsCandidate = typeof params.runTimeoutSeconds === "number"
+                ? params.runTimeoutSeconds
+                : typeof params.timeoutSeconds === "number"
+                    ? params.timeoutSeconds
                     : undefined;
-                if (explicit !== undefined)
-                    return explicit;
-                const legacy = typeof params.timeoutSeconds === "number" && Number.isFinite(params.timeoutSeconds)
-                    ? Math.max(0, Math.floor(params.timeoutSeconds))
-                    : undefined;
-                return legacy ?? 0;
-            })();
-            let modelWarning;
-            let modelApplied = false;
-            const cfg = loadConfig();
-            const { mainKey, alias } = resolveMainSessionAlias(cfg);
-            const requesterSessionKey = opts?.agentSessionKey;
-            if (typeof requesterSessionKey === "string" && isSubagentSessionKey(requesterSessionKey)) {
-                return jsonResult({
-                    status: "forbidden",
-                    error: "sessions_spawn is not allowed from sub-agent sessions",
-                });
-            }
-            const requesterInternalKey = requesterSessionKey
-                ? resolveInternalSessionKey({
-                    key: requesterSessionKey,
-                    alias,
-                    mainKey,
-                })
-                : alias;
-            const requesterDisplayKey = resolveDisplaySessionKey({
-                key: requesterInternalKey,
-                alias,
-                mainKey,
-            });
-            const requesterAgentId = normalizeAgentId(opts?.requesterAgentIdOverride ?? parseAgentSessionKey(requesterInternalKey)?.agentId);
-            const targetAgentId = requestedAgentId
-                ? normalizeAgentId(requestedAgentId)
-                : requesterAgentId;
-            if (targetAgentId !== requesterAgentId) {
-                const allowAgents = resolveAgentConfig(cfg, requesterAgentId)?.subagents?.allowAgents ?? [];
-                const allowAny = allowAgents.some((value) => value.trim() === "*");
-                const normalizedTargetId = targetAgentId.toLowerCase();
-                const allowSet = new Set(allowAgents
-                    .filter((value) => value.trim() && value.trim() !== "*")
-                    .map((value) => normalizeAgentId(value).toLowerCase()));
-                if (!allowAny && !allowSet.has(normalizedTargetId)) {
-                    const allowedText = allowAny
-                        ? "*"
-                        : allowSet.size > 0
-                            ? Array.from(allowSet).join(", ")
-                            : "none";
-                    return jsonResult({
-                        status: "forbidden",
-                        error: `agentId is not allowed for sessions_spawn (allowed: ${allowedText})`,
-                    });
-                }
-            }
-            const childSessionKey = `agent:${targetAgentId}:subagent:${crypto.randomUUID()}`;
-            const spawnedByKey = requesterInternalKey;
-            const targetAgentConfig = resolveAgentConfig(cfg, targetAgentId);
-            const resolvedModel = normalizeModelSelection(modelOverride) ??
-                normalizeModelSelection(targetAgentConfig?.subagents?.model) ??
-                normalizeModelSelection(cfg.agents?.defaults?.subagents?.model);
-            let thinkingOverride;
-            if (thinkingOverrideRaw) {
-                const normalized = normalizeThinkLevel(thinkingOverrideRaw);
-                if (!normalized) {
-                    const { provider, model } = splitModelRef(resolvedModel);
-                    const hint = formatThinkingLevels(provider, model);
-                    return jsonResult({
-                        status: "error",
-                        error: `Invalid thinking level "${thinkingOverrideRaw}". Use one of: ${hint}.`,
-                    });
-                }
-                thinkingOverride = normalized;
-            }
-            if (resolvedModel) {
-                try {
-                    await callGateway({
-                        method: "sessions.patch",
-                        params: { key: childSessionKey, model: resolvedModel },
-                        timeoutMs: 10_000,
-                    });
-                    modelApplied = true;
-                }
-                catch (err) {
-                    const messageText = err instanceof Error ? err.message : typeof err === "string" ? err : "error";
-                    const recoverable = messageText.includes("invalid model") || messageText.includes("model not allowed");
-                    if (!recoverable) {
-                        return jsonResult({
-                            status: "error",
-                            error: messageText,
-                            childSessionKey,
-                        });
-                    }
-                    modelWarning = messageText;
-                }
-            }
-            const childSystemPrompt = buildSubagentSystemPrompt({
-                requesterSessionKey,
-                requesterOrigin,
-                childSessionKey,
-                label: label || undefined,
+            const runTimeoutSeconds = typeof timeoutSecondsCandidate === "number" && Number.isFinite(timeoutSecondsCandidate)
+                ? Math.max(0, Math.floor(timeoutSecondsCandidate))
+                : undefined;
+            const result = await spawnSubagentDirect({
                 task,
-            });
-            const childIdem = crypto.randomUUID();
-            let childRunId = childIdem;
-            try {
-                const response = (await callGateway({
-                    method: "agent",
-                    params: {
-                        message: task,
-                        sessionKey: childSessionKey,
-                        channel: requesterOrigin?.channel,
-                        idempotencyKey: childIdem,
-                        deliver: false,
-                        lane: AGENT_LANE_SUBAGENT,
-                        extraSystemPrompt: childSystemPrompt,
-                        thinking: thinkingOverride,
-                        timeout: runTimeoutSeconds > 0 ? runTimeoutSeconds : undefined,
-                        label: label || undefined,
-                        spawnedBy: spawnedByKey,
-                        groupId: opts?.agentGroupId ?? undefined,
-                        groupChannel: opts?.agentGroupChannel ?? undefined,
-                        groupSpace: opts?.agentGroupSpace ?? undefined,
-                    },
-                    timeoutMs: 10_000,
-                }));
-                if (typeof response?.runId === "string" && response.runId) {
-                    childRunId = response.runId;
-                }
-            }
-            catch (err) {
-                const messageText = err instanceof Error ? err.message : typeof err === "string" ? err : "error";
-                return jsonResult({
-                    status: "error",
-                    error: messageText,
-                    childSessionKey,
-                    runId: childRunId,
-                });
-            }
-            registerSubagentRun({
-                runId: childRunId,
-                childSessionKey,
-                requesterSessionKey: requesterInternalKey,
-                requesterOrigin,
-                requesterDisplayKey,
-                task,
-                cleanup,
                 label: label || undefined,
+                agentId: requestedAgentId,
+                model: modelOverride,
+                thinking: thinkingOverrideRaw,
                 runTimeoutSeconds,
+                cleanup,
+                expectsCompletionMessage: true,
+            }, {
+                agentSessionKey: opts?.agentSessionKey,
+                agentChannel: opts?.agentChannel,
+                agentAccountId: opts?.agentAccountId,
+                agentTo: opts?.agentTo,
+                agentThreadId: opts?.agentThreadId,
+                agentGroupId: opts?.agentGroupId,
+                agentGroupChannel: opts?.agentGroupChannel,
+                agentGroupSpace: opts?.agentGroupSpace,
+                requesterAgentIdOverride: opts?.requesterAgentIdOverride,
             });
-            return jsonResult({
-                status: "accepted",
-                childSessionKey,
-                runId: childRunId,
-                modelApplied: resolvedModel ? modelApplied : undefined,
-                warning: modelWarning,
-            });
+            return jsonResult(result);
         },
     };
 }

package/dist/agents/tools/telegram-actions.js

@@ -1,13 +1,16 @@
+import { createTelegramActionGate } from "../../telegram/accounts.js";
+import { resolveTelegramInlineButtonsScope, resolveTelegramTargetChatType, } from "../../telegram/inline-buttons.js";
 import { resolveTelegramReactionLevel } from "../../telegram/reaction-level.js";
-import { deleteMessageTelegram, editMessageTelegram, reactMessageTelegram, sendMessageTelegram, sendStickerTelegram, } from "../../telegram/send.js";
+import { createForumTopicTelegram, deleteMessageTelegram, editMessageTelegram, reactMessageTelegram, sendMessageTelegram, sendStickerTelegram, } from "../../telegram/send.js";
 import { getCacheStats, searchStickers } from "../../telegram/sticker-cache.js";
 import { resolveTelegramToken } from "../../telegram/token.js";
-import { resolveTelegramInlineButtonsScope, resolveTelegramTargetChatType, } from "../../telegram/inline-buttons.js";
-import { createActionGate, jsonResult, readNumberParam, readReactionParams, readStringOrNumberParam, readStringParam, } from "./common.js";
+import { jsonResult, readNumberParam, readReactionParams, readStringOrNumberParam, readStringParam, } from "./common.js";
+const TELEGRAM_BUTTON_STYLES = ["danger", "success", "primary"];
 export function readTelegramButtons(params) {
     const raw = params.buttons;
-    if (raw == null)
+    if (raw == null) {
         return undefined;
+    }
     if (!Array.isArray(raw)) {
         throw new Error("buttons must be an array of button rows");
     }
@@ -31,7 +34,19 @@ export function readTelegramButtons(params) {
             if (callbackData.length > 64) {
                 throw new Error(`buttons[${rowIndex}][${buttonIndex}] callback_data too long (max 64 chars)`);
             }
-            return { text, callback_data: callbackData };
+            const styleRaw = button.style;
+            const style = typeof styleRaw === "string" ? styleRaw.trim().toLowerCase() : undefined;
+            if (styleRaw !== undefined && !style) {
+                throw new Error(`buttons[${rowIndex}][${buttonIndex}] style must be string`);
+            }
+            if (style && !TELEGRAM_BUTTON_STYLES.includes(style)) {
+                throw new Error(`buttons[${rowIndex}][${buttonIndex}] style must be one of ${TELEGRAM_BUTTON_STYLES.join(", ")}`);
+            }
+            return {
+                text,
+                callback_data: callbackData,
+                ...(style ? { style: style } : {}),
+            };
         });
     });
     const filtered = rows.filter((row) => row.length > 0);
@@ -40,7 +55,7 @@ export function readTelegramButtons(params) {
 export async function handleTelegramAction(params, cfg) {
     const action = readStringParam(params, "action", { required: true });
     const accountId = readStringParam(params, "accountId");
-    const isActionEnabled = createActionGate(cfg.channels?.telegram?.actions);
+    const isActionEnabled = createTelegramActionGate({ cfg, accountId });
     if (action === "react") {
         // Check reaction level first
         const reactionLevelInfo = resolveTelegramReactionLevel({
@@ -69,11 +84,18 @@ export async function handleTelegramAction(params, cfg) {
         if (!token) {
             throw new Error("Telegram bot token missing. Set TELEGRAM_BOT_TOKEN or channels.telegram.botToken.");
         }
-        await reactMessageTelegram(chatId ?? "", messageId ?? 0, emoji ?? "", {
+        const reactionResult = await reactMessageTelegram(chatId ?? "", messageId ?? 0, emoji ?? "", {
             token,
             remove,
             accountId: accountId ?? undefined,
         });
+        if (!reactionResult.ok) {
+            return jsonResult({
+                ok: false,
+                warning: reactionResult.warning,
+                ...(remove || isEmpty ? { removed: true } : { added: emoji }),
+            });
+        }
         if (!remove && !isEmpty) {
             return jsonResult({ ok: true, added: emoji });
         }
@@ -119,6 +141,7 @@ export async function handleTelegramAction(params, cfg) {
         const messageThreadId = readNumberParam(params, "messageThreadId", {
             integer: true,
         });
+        const quoteText = readStringParam(params, "quoteText");
         const token = resolveTelegramToken(cfg, { accountId }).token;
         if (!token) {
             throw new Error("Telegram bot token missing. Set TELEGRAM_BOT_TOKEN or channels.telegram.botToken.");
@@ -130,6 +153,7 @@ export async function handleTelegramAction(params, cfg) {
             buttons,
             replyToMessageId: replyToMessageId ?? undefined,
             messageThreadId: messageThreadId ?? undefined,
+            quoteText: quoteText ?? undefined,
             asVoice: typeof params.asVoice === "boolean" ? params.asVoice : undefined,
             silent: typeof params.silent === "boolean" ? params.silent : undefined,
         });
@@ -250,5 +274,32 @@ export async function handleTelegramAction(params, cfg) {
         const stats = getCacheStats();
         return jsonResult({ ok: true, ...stats });
     }
+    if (action === "createForumTopic") {
+        if (!isActionEnabled("createForumTopic")) {
+            throw new Error("Telegram createForumTopic is disabled.");
+        }
+        const chatId = readStringOrNumberParam(params, "chatId", {
+            required: true,
+        });
+        const name = readStringParam(params, "name", { required: true });
+        const iconColor = readNumberParam(params, "iconColor", { integer: true });
+        const iconCustomEmojiId = readStringParam(params, "iconCustomEmojiId");
+        const token = resolveTelegramToken(cfg, { accountId }).token;
+        if (!token) {
+            throw new Error("Telegram bot token missing. Set TELEGRAM_BOT_TOKEN or channels.telegram.botToken.");
+        }
+        const result = await createForumTopicTelegram(chatId ?? "", name, {
+            token,
+            accountId: accountId ?? undefined,
+            iconColor: iconColor ?? undefined,
+            iconCustomEmojiId: iconCustomEmojiId ?? undefined,
+        });
+        return jsonResult({
+            ok: true,
+            topicId: result.topicId,
+            name: result.name,
+            chatId: result.chatId,
+        });
+    }
     throw new Error(`Unsupported Telegram action: ${action}`);
 }

package/dist/agents/tools/web-fetch-utils.js

@@ -1,3 +1,21 @@
+const READABILITY_MAX_HTML_CHARS = 1_000_000;
+const READABILITY_MAX_ESTIMATED_NESTING_DEPTH = 3_000;
+let readabilityDepsPromise;
+async function loadReadabilityDeps() {
+    if (!readabilityDepsPromise) {
+        readabilityDepsPromise = Promise.all([import("@mozilla/readability"), import("linkedom")]).then(([readability, linkedom]) => ({
+            Readability: readability.Readability,
+            parseHTML: linkedom.parseHTML,
+        }));
+    }
+    try {
+        return await readabilityDepsPromise;
+    }
+    catch (error) {
+        readabilityDepsPromise = undefined;
+        throw error;
+    }
+}
 function decodeEntities(value) {
     return value
         .replace(/ /gi, " ")
@@ -29,8 +47,9 @@ export function htmlToMarkdown(html) {
         .replace(/<noscript[\s\S]*?<\/noscript>/gi, "");
     text = text.replace(/<a\s+[^>]*href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi, (_, href, body) => {
         const label = normalizeWhitespace(stripTags(body));
-        if (!label)
+        if (!label) {
             return href;
+        }
         return `[${label}](${href})`;
     });
     text = text.replace(/<h([1-6])[^>]*>([\s\S]*?)<\/h\1>/gi, (_, level, body) => {
@@ -61,10 +80,94 @@ export function markdownToText(markdown) {
     return normalizeWhitespace(text);
 }
 export function truncateText(value, maxChars) {
-    if (value.length <= maxChars)
+    if (value.length <= maxChars) {
         return { text: value, truncated: false };
+    }
     return { text: value.slice(0, maxChars), truncated: true };
 }
+function exceedsEstimatedHtmlNestingDepth(html, maxDepth) {
+    // Cheap heuristic to skip Readability+DOM parsing on pathological HTML (deep nesting => stack/memory blowups).
+    // Not an HTML parser; tuned to catch attacker-controlled "<div><div>..." cases.
+    const voidTags = new Set([
+        "area",
+        "base",
+        "br",
+        "col",
+        "embed",
+        "hr",
+        "img",
+        "input",
+        "link",
+        "meta",
+        "param",
+        "source",
+        "track",
+        "wbr",
+    ]);
+    let depth = 0;
+    const len = html.length;
+    for (let i = 0; i < len; i++) {
+        if (html.charCodeAt(i) !== 60) {
+            continue; // '<'
+        }
+        const next = html.charCodeAt(i + 1);
+        if (next === 33 || next === 63) {
+            continue; // <! ...> or <? ...>
+        }
+        let j = i + 1;
+        let closing = false;
+        if (html.charCodeAt(j) === 47) {
+            closing = true;
+            j += 1;
+        }
+        while (j < len && html.charCodeAt(j) <= 32) {
+            j += 1;
+        }
+        const nameStart = j;
+        while (j < len) {
+            const c = html.charCodeAt(j);
+            const isNameChar = (c >= 65 && c <= 90) || // A-Z
+                (c >= 97 && c <= 122) || // a-z
+                (c >= 48 && c <= 57) || // 0-9
+                c === 58 || // :
+                c === 45; // -
+            if (!isNameChar) {
+                break;
+            }
+            j += 1;
+        }
+        const tagName = html.slice(nameStart, j).toLowerCase();
+        if (!tagName) {
+            continue;
+        }
+        if (closing) {
+            depth = Math.max(0, depth - 1);
+            continue;
+        }
+        if (voidTags.has(tagName)) {
+            continue;
+        }
+        // Best-effort self-closing detection: scan a short window for "/>".
+        let selfClosing = false;
+        for (let k = j; k < len && k < j + 200; k++) {
+            const c = html.charCodeAt(k);
+            if (c === 62) {
+                if (html.charCodeAt(k - 1) === 47) {
+                    selfClosing = true;
+                }
+                break;
+            }
+        }
+        if (selfClosing) {
+            continue;
+        }
+        depth += 1;
+        if (depth > maxDepth) {
+            return true;
+        }
+    }
+    return false;
+}
 export async function extractReadableContent(params) {
     const fallback = () => {
         const rendered = htmlToMarkdown(params.html);
@@ -74,11 +177,12 @@ export async function extractReadableContent(params) {
         }
         return rendered;
     };
+    if (params.html.length > READABILITY_MAX_HTML_CHARS ||
+        exceedsEstimatedHtmlNestingDepth(params.html, READABILITY_MAX_ESTIMATED_NESTING_DEPTH)) {
+        return fallback();
+    }
     try {
-        const [{ Readability }, { parseHTML }] = await Promise.all([
-            import("@mozilla/readability"),
-            import("linkedom"),
-        ]);
+        const { Readability, parseHTML } = await loadReadabilityDeps();
         const { document } = parseHTML(params.html);
         try {
             document.baseURI = params.url;
@@ -88,8 +192,9 @@ export async function extractReadableContent(params) {
         }
         const reader = new Readability(document, { charThreshold: 0 });
         const parsed = reader.parse();
-        if (!parsed?.content)
+        if (!parsed?.content) {
             return fallback();
+        }
         const title = parsed.title || undefined;
         if (params.extractMode === "text") {
             const text = normalizeWhitespace(parsed.textContent ?? "");