@poolzin/pool-bot 2026.2.21 → 2026.2.22

package/dist/config/defaults.js

@@ -1,12 +1,12 @@
 import { DEFAULT_CONTEXT_TOKENS } from "../agents/defaults.js";
 import { parseModelRef } from "../agents/model-selection.js";
-import { resolveTalkApiKey } from "./talk.js";
 import { DEFAULT_AGENT_MAX_CONCURRENT, DEFAULT_SUBAGENT_MAX_CONCURRENT } from "./agent-limits.js";
+import { resolveTalkApiKey } from "./talk.js";
 let defaultWarnState = { warned: false };
 const DEFAULT_MODEL_ALIASES = {
     // Anthropic (pi-ai catalog uses "latest" ids without date suffix)
     opus: "anthropic/claude-opus-4-6",
-    sonnet: "anthropic/claude-sonnet-4-5",
+    sonnet: "anthropic/claude-sonnet-4-6",
     // OpenAI
     gpt: "openai/gpt-5.2",
     "gpt-mini": "openai/gpt-5-mini",
@@ -39,39 +39,49 @@ function resolveAnthropicDefaultAuthMode(cfg) {
     const order = cfg.auth?.order?.anthropic ?? [];
     for (const profileId of order) {
         const entry = profiles[profileId];
-        if (!entry || entry.provider !== "anthropic")
+        if (!entry || entry.provider !== "anthropic") {
             continue;
-        if (entry.mode === "api_key")
+        }
+        if (entry.mode === "api_key") {
             return "api_key";
-        if (entry.mode === "oauth" || entry.mode === "token")
+        }
+        if (entry.mode === "oauth" || entry.mode === "token") {
             return "oauth";
+        }
     }
     const hasApiKey = anthropicProfiles.some(([, profile]) => profile?.mode === "api_key");
     const hasOauth = anthropicProfiles.some(([, profile]) => profile?.mode === "oauth" || profile?.mode === "token");
-    if (hasApiKey && !hasOauth)
+    if (hasApiKey && !hasOauth) {
         return "api_key";
-    if (hasOauth && !hasApiKey)
+    }
+    if (hasOauth && !hasApiKey) {
         return "oauth";
-    if (process.env.ANTHROPIC_OAUTH_TOKEN?.trim())
+    }
+    if (process.env.ANTHROPIC_OAUTH_TOKEN?.trim()) {
         return "oauth";
-    if (process.env.ANTHROPIC_API_KEY?.trim())
+    }
+    if (process.env.ANTHROPIC_API_KEY?.trim()) {
         return "api_key";
+    }
     return null;
 }
 function resolvePrimaryModelRef(raw) {
-    if (!raw || typeof raw !== "string")
+    if (!raw || typeof raw !== "string") {
         return null;
+    }
     const trimmed = raw.trim();
-    if (!trimmed)
+    if (!trimmed) {
         return null;
+    }
     const aliasKey = trimmed.toLowerCase();
     return DEFAULT_MODEL_ALIASES[aliasKey] ?? trimmed;
 }
 export function applyMessageDefaults(cfg) {
     const messages = cfg.messages;
     const hasAckScope = messages?.ackReactionScope !== undefined;
-    if (hasAckScope)
+    if (hasAckScope) {
         return cfg;
+    }
     const nextMessages = messages ? { ...messages } : {};
     nextMessages.ackReactionScope = "group-mentions";
     return {
@@ -81,8 +91,9 @@ export function applyMessageDefaults(cfg) {
 }
 export function applySessionDefaults(cfg, options = {}) {
     const session = cfg.session;
-    if (!session || session.mainKey === undefined)
+    if (!session || session.mainKey === undefined) {
         return cfg;
+    }
     const trimmed = session.mainKey.trim();
     const warn = options.warn ?? console.warn;
     const warnState = options.warnState ?? defaultWarnState;
@@ -98,11 +109,13 @@ export function applySessionDefaults(cfg, options = {}) {
 }
 export function applyTalkApiKey(config) {
     const resolved = resolveTalkApiKey();
-    if (!resolved)
+    if (!resolved) {
         return config;
+    }
     const existing = config.talk?.apiKey?.trim();
-    if (existing)
+    if (existing) {
         return config;
+    }
     return {
         ...config,
         talk: {
@@ -119,38 +132,45 @@ export function applyModelDefaults(cfg) {
         const nextProviders = { ...providerConfig };
         for (const [providerId, provider] of Object.entries(providerConfig)) {
             const models = provider.models;
-            if (!Array.isArray(models) || models.length === 0)
+            if (!Array.isArray(models) || models.length === 0) {
                 continue;
+            }
             let providerMutated = false;
             const nextModels = models.map((model) => {
                 const raw = model;
                 let modelMutated = false;
                 const reasoning = typeof raw.reasoning === "boolean" ? raw.reasoning : false;
-                if (raw.reasoning !== reasoning)
+                if (raw.reasoning !== reasoning) {
                     modelMutated = true;
+                }
                 const input = raw.input ?? [...DEFAULT_MODEL_INPUT];
-                if (raw.input === undefined)
+                if (raw.input === undefined) {
                     modelMutated = true;
+                }
                 const cost = resolveModelCost(raw.cost);
                 const costMutated = !raw.cost ||
                     raw.cost.input !== cost.input ||
                     raw.cost.output !== cost.output ||
                     raw.cost.cacheRead !== cost.cacheRead ||
                     raw.cost.cacheWrite !== cost.cacheWrite;
-                if (costMutated)
+                if (costMutated) {
                     modelMutated = true;
+                }
                 const contextWindow = isPositiveNumber(raw.contextWindow)
                     ? raw.contextWindow
                     : DEFAULT_CONTEXT_TOKENS;
-                if (raw.contextWindow !== contextWindow)
+                if (raw.contextWindow !== contextWindow) {
                     modelMutated = true;
+                }
                 const defaultMaxTokens = Math.min(DEFAULT_MODEL_MAX_TOKENS, contextWindow);
                 const rawMaxTokens = isPositiveNumber(raw.maxTokens) ? raw.maxTokens : defaultMaxTokens;
                 const maxTokens = Math.min(rawMaxTokens, contextWindow);
-                if (raw.maxTokens !== maxTokens)
+                if (raw.maxTokens !== maxTokens) {
                     modelMutated = true;
-                if (!modelMutated)
+                }
+                if (!modelMutated) {
                     return model;
+                }
                 providerMutated = true;
                 return {
                     ...raw,
@@ -161,8 +181,9 @@ export function applyModelDefaults(cfg) {
                     maxTokens,
                 };
             });
-            if (!providerMutated)
+            if (!providerMutated) {
                 continue;
+            }
             nextProviders[providerId] = { ...provider, models: nextModels };
             mutated = true;
         }
@@ -177,25 +198,30 @@ export function applyModelDefaults(cfg) {
         }
     }
     const existingAgent = nextCfg.agents?.defaults;
-    if (!existingAgent)
+    if (!existingAgent) {
         return mutated ? nextCfg : cfg;
+    }
     const existingModels = existingAgent.models ?? {};
-    if (Object.keys(existingModels).length === 0)
+    if (Object.keys(existingModels).length === 0) {
         return mutated ? nextCfg : cfg;
+    }
     const nextModels = {
         ...existingModels,
     };
     for (const [alias, target] of Object.entries(DEFAULT_MODEL_ALIASES)) {
         const entry = nextModels[target];
-        if (!entry)
+        if (!entry) {
             continue;
-        if (entry.alias !== undefined)
+        }
+        if (entry.alias !== undefined) {
             continue;
+        }
         nextModels[target] = { ...entry, alias };
         mutated = true;
     }
-    if (!mutated)
+    if (!mutated) {
         return cfg;
+    }
     return {
         ...nextCfg,
         agents: {
@@ -210,8 +236,9 @@ export function applyAgentDefaults(cfg) {
     const hasMax = typeof defaults?.maxConcurrent === "number" && Number.isFinite(defaults.maxConcurrent);
     const hasSubMax = typeof defaults?.subagents?.maxConcurrent === "number" &&
         Number.isFinite(defaults.subagents.maxConcurrent);
-    if (hasMax && hasSubMax)
+    if (hasMax && hasSubMax) {
         return cfg;
+    }
     let mutated = false;
     const nextDefaults = defaults ? { ...defaults } : {};
     if (!hasMax) {
@@ -223,8 +250,9 @@ export function applyAgentDefaults(cfg) {
         nextSubagents.maxConcurrent = DEFAULT_SUBAGENT_MAX_CONCURRENT;
         mutated = true;
     }
-    if (!mutated)
+    if (!mutated) {
         return cfg;
+    }
     return {
         ...cfg,
         agents: {
@@ -238,10 +266,12 @@ export function applyAgentDefaults(cfg) {
 }
 export function applyLoggingDefaults(cfg) {
     const logging = cfg.logging;
-    if (!logging)
+    if (!logging) {
         return cfg;
-    if (logging.redactSensitive)
+    }
+    if (logging.redactSensitive) {
         return cfg;
+    }
     return {
         ...cfg,
         logging: {
@@ -252,11 +282,13 @@ export function applyLoggingDefaults(cfg) {
 }
 export function applyContextPruningDefaults(cfg) {
     const defaults = cfg.agents?.defaults;
-    if (!defaults)
+    if (!defaults) {
         return cfg;
+    }
     const authMode = resolveAnthropicDefaultAuthMode(cfg);
-    if (!authMode)
+    if (!authMode) {
         return cfg;
+    }
     let mutated = false;
     const nextDefaults = { ...defaults };
     const contextPruning = defaults.contextPruning ?? {};
@@ -281,15 +313,17 @@ export function applyContextPruningDefaults(cfg) {
         let modelsMutated = false;
         for (const [key, entry] of Object.entries(nextModels)) {
             const parsed = parseModelRef(key, "anthropic");
-            if (!parsed || parsed.provider !== "anthropic")
+            if (!parsed || parsed.provider !== "anthropic") {
                 continue;
+            }
             const current = entry ?? {};
             const params = current.params ?? {};
-            if (typeof params.cacheControlTtl === "string")
+            if (typeof params.cacheRetention === "string") {
                 continue;
+            }
             nextModels[key] = {
                 ...current,
-                params: { ...params, cacheControlTtl: "1h" },
+                params: { ...params, cacheRetention: "short" },
             };
             modelsMutated = true;
         }
@@ -301,10 +335,10 @@ export function applyContextPruningDefaults(cfg) {
                 const entry = nextModels[key];
                 const current = entry ?? {};
                 const params = current.params ?? {};
-                if (typeof params.cacheControlTtl !== "string") {
+                if (typeof params.cacheRetention !== "string") {
                     nextModels[key] = {
                         ...current,
-                        params: { ...params, cacheControlTtl: "1h" },
+                        params: { ...params, cacheRetention: "short" },
                     };
                     modelsMutated = true;
                 }
@@ -315,8 +349,9 @@ export function applyContextPruningDefaults(cfg) {
             mutated = true;
         }
     }
-    if (!mutated)
+    if (!mutated) {
         return cfg;
+    }
     return {
         ...cfg,
         agents: {
@@ -327,11 +362,13 @@ export function applyContextPruningDefaults(cfg) {
 }
 export function applyCompactionDefaults(cfg) {
     const defaults = cfg.agents?.defaults;
-    if (!defaults)
+    if (!defaults) {
         return cfg;
+    }
     const compaction = defaults?.compaction;
-    if (compaction?.mode)
+    if (compaction?.mode) {
         return cfg;
+    }
     return {
         ...cfg,
         agents: {

package/dist/config/group-policy.js

@@ -1,26 +1,49 @@
 import { normalizeAccountId } from "../routing/session-key.js";
+function resolveChannelGroupConfig(groups, groupId, caseInsensitive = false) {
+    if (!groups) {
+        return undefined;
+    }
+    const direct = groups[groupId];
+    if (direct) {
+        return direct;
+    }
+    if (!caseInsensitive) {
+        return undefined;
+    }
+    const target = groupId.toLowerCase();
+    const matchedKey = Object.keys(groups).find((key) => key !== "*" && key.toLowerCase() === target);
+    if (!matchedKey) {
+        return undefined;
+    }
+    return groups[matchedKey];
+}
 function normalizeSenderKey(value) {
     const trimmed = value.trim();
-    if (!trimmed)
+    if (!trimmed) {
         return "";
+    }
     const withoutAt = trimmed.startsWith("@") ? trimmed.slice(1) : trimmed;
     return withoutAt.toLowerCase();
 }
 export function resolveToolsBySender(params) {
     const toolsBySender = params.toolsBySender;
-    if (!toolsBySender)
+    if (!toolsBySender) {
         return undefined;
+    }
     const entries = Object.entries(toolsBySender);
-    if (entries.length === 0)
+    if (entries.length === 0) {
         return undefined;
+    }
     const normalized = new Map();
     let wildcard;
     for (const [rawKey, policy] of entries) {
-        if (!policy)
+        if (!policy) {
             continue;
+        }
         const key = normalizeSenderKey(rawKey);
-        if (!key)
+        if (!key) {
             continue;
+        }
         if (key === "*") {
             wildcard = policy;
             continue;
@@ -32,8 +55,9 @@ export function resolveToolsBySender(params) {
     const candidates = [];
     const pushCandidate = (value) => {
         const trimmed = value?.trim();
-        if (!trimmed)
+        if (!trimmed) {
             return;
+        }
         candidates.push(trimmed);
     };
     pushCandidate(params.senderId);
@@ -42,19 +66,22 @@ export function resolveToolsBySender(params) {
     pushCandidate(params.senderName);
     for (const candidate of candidates) {
         const key = normalizeSenderKey(candidate);
-        if (!key)
+        if (!key) {
             continue;
+        }
         const match = normalized.get(key);
-        if (match)
+        if (match) {
             return match;
+        }
     }
     return wildcard;
 }
 function resolveChannelGroups(cfg, channel, accountId) {
     const normalizedAccountId = normalizeAccountId(accountId);
     const channelConfig = cfg.channels?.[channel];
-    if (!channelConfig)
+    if (!channelConfig) {
         return undefined;
+    }
     const accountGroups = channelConfig.accounts?.[normalizedAccountId]?.groups ??
         channelConfig.accounts?.[Object.keys(channelConfig.accounts ?? {}).find((key) => key.toLowerCase() === normalizedAccountId.toLowerCase()) ?? ""]?.groups;
     return accountGroups ?? channelConfig.groups;
@@ -64,12 +91,12 @@ export function resolveChannelGroupPolicy(params) {
     const groups = resolveChannelGroups(cfg, channel, params.accountId);
     const allowlistEnabled = Boolean(groups && Object.keys(groups).length > 0);
     const normalizedId = params.groupId?.trim();
-    const groupConfig = normalizedId && groups ? groups[normalizedId] : undefined;
+    const groupConfig = normalizedId
+        ? resolveChannelGroupConfig(groups, normalizedId, params.groupIdCaseInsensitive)
+        : undefined;
     const defaultConfig = groups?.["*"];
     const allowAll = allowlistEnabled && Boolean(groups && Object.hasOwn(groups, "*"));
-    const allowed = !allowlistEnabled ||
-        allowAll ||
-        (normalizedId ? Boolean(groups && Object.hasOwn(groups, normalizedId)) : false);
+    const allowed = !allowlistEnabled || allowAll || Boolean(groupConfig);
     return {
         allowlistEnabled,
         allowed,
@@ -88,8 +115,9 @@ export function resolveChannelGroupRequireMention(params) {
     if (overrideOrder === "before-config" && typeof requireMentionOverride === "boolean") {
         return requireMentionOverride;
     }
-    if (typeof configMention === "boolean")
+    if (typeof configMention === "boolean") {
         return configMention;
+    }
     if (overrideOrder !== "before-config" && typeof requireMentionOverride === "boolean") {
         return requireMentionOverride;
     }
@@ -104,10 +132,12 @@ export function resolveChannelGroupToolsPolicy(params) {
         senderUsername: params.senderUsername,
         senderE164: params.senderE164,
     });
-    if (groupSenderPolicy)
+    if (groupSenderPolicy) {
         return groupSenderPolicy;
-    if (groupConfig?.tools)
+    }
+    if (groupConfig?.tools) {
         return groupConfig.tools;
+    }
     const defaultSenderPolicy = resolveToolsBySender({
         toolsBySender: defaultConfig?.toolsBySender,
         senderId: params.senderId,
@@ -115,9 +145,11 @@ export function resolveChannelGroupToolsPolicy(params) {
         senderUsername: params.senderUsername,
         senderE164: params.senderE164,
     });
-    if (defaultSenderPolicy)
+    if (defaultSenderPolicy) {
         return defaultSenderPolicy;
-    if (defaultConfig?.tools)
+    }
+    if (defaultConfig?.tools) {
         return defaultConfig.tools;
+    }
     return undefined;
 }

package/dist/config/includes.js

@@ -12,6 +12,8 @@
 import fs from "node:fs";
 import path from "node:path";
 import JSON5 from "json5";
+import { isPathInside } from "../security/scan-paths.js";
+import { isPlainObject } from "../utils.js";
 export const INCLUDE_KEY = "$include";
 export const MAX_INCLUDE_DEPTH = 10;
 // ============================================================================
@@ -38,12 +40,6 @@ export class CircularIncludeError extends ConfigIncludeError {
 // ============================================================================
 // Utilities
 // ============================================================================
-function isPlainObject(value) {
-    return (typeof value === "object" &&
-        value !== null &&
-        !Array.isArray(value) &&
-        Object.prototype.toString.call(value) === "[object Object]");
-}
 /** Deep merge: arrays concatenate, objects merge recursively, primitives: source wins */
 export function deepMerge(target, source) {
     if (Array.isArray(target) && Array.isArray(source)) {
@@ -66,10 +62,14 @@ class IncludeProcessor {
     resolver;
     visited = new Set();
     depth = 0;
-    constructor(basePath, resolver) {
+    rootDir;
+    rootRealDir;
+    constructor(basePath, resolver, rootDir) {
         this.basePath = basePath;
         this.resolver = resolver;
         this.visited.add(path.normalize(basePath));
+        this.rootDir = path.normalize(rootDir ?? path.dirname(basePath));
+        this.rootRealDir = path.normalize(safeRealpath(this.rootDir));
     }
     process(obj) {
         if (Array.isArray(obj)) {
@@ -130,10 +130,29 @@ class IncludeProcessor {
         return this.processNested(resolvedPath, parsed);
     }
     resolvePath(includePath) {
+        const configDir = path.dirname(this.basePath);
         const resolved = path.isAbsolute(includePath)
             ? includePath
-            : path.resolve(path.dirname(this.basePath), includePath);
-        return path.normalize(resolved);
+            : path.resolve(configDir, includePath);
+        const normalized = path.normalize(resolved);
+        // SECURITY: Reject paths outside top-level config directory (CWE-22: Path Traversal)
+        if (!isPathInside(this.rootDir, normalized)) {
+            throw new ConfigIncludeError(`Include path escapes config directory: ${includePath} (root: ${this.rootDir})`, includePath);
+        }
+        // SECURITY: Resolve symlinks and re-validate to prevent symlink bypass
+        try {
+            const real = fs.realpathSync(normalized);
+            if (!isPathInside(this.rootRealDir, real)) {
+                throw new ConfigIncludeError(`Include path resolves outside config directory (symlink): ${includePath} (root: ${this.rootDir})`, includePath);
+            }
+        }
+        catch (err) {
+            if (err instanceof ConfigIncludeError) {
+                throw err;
+            }
+            // File doesn't exist yet - normalized path check above is sufficient
+        }
+        return normalized;
     }
     checkCircular(resolvedPath) {
         if (this.visited.has(resolvedPath)) {
@@ -162,12 +181,20 @@ class IncludeProcessor {
         }
     }
     processNested(resolvedPath, parsed) {
-        const nested = new IncludeProcessor(resolvedPath, this.resolver);
+        const nested = new IncludeProcessor(resolvedPath, this.resolver, this.rootDir);
         nested.visited = new Set([...this.visited, resolvedPath]);
         nested.depth = this.depth + 1;
         return nested.process(parsed);
     }
 }
+function safeRealpath(target) {
+    try {
+        return fs.realpathSync(target);
+    }
+    catch {
+        return target;
+    }
+}
 // ============================================================================
 // Public API
 // ============================================================================

package/dist/config/schema.help.js

@@ -1,6 +1,6 @@
 import { IRC_FIELD_HELP } from "./schema.irc.js";
 export const FIELD_HELP = {
-    "meta.lastTouchedVersion": "Auto-set when OpenClaw writes the config.",
+    "meta.lastTouchedVersion": "Auto-set when Pool Bot writes the config.",
     "meta.lastTouchedAt": "ISO timestamp of the last config write (auto-set).",
     "update.channel": 'Update channel for git + npm installs ("stable", "beta", or "dev").',
     "update.checkOnStart": "Check for npm updates when the gateway starts (default: true).",
@@ -16,7 +16,7 @@ export const FIELD_HELP = {
     "discovery.mdns.mode": 'mDNS broadcast mode ("minimal" default, "full" includes cliPath/sshPort, "off" disables mDNS).',
     "gateway.auth.token": "Required by default for gateway access (unless using Tailscale Serve identity); required for non-loopback binds.",
     "gateway.auth.password": "Required for Tailscale funnel.",
-    "gateway.controlUi.basePath": "Optional URL prefix where the Control UI is served (e.g. /openclaw).",
+    "gateway.controlUi.basePath": "Optional URL prefix where the Control UI is served (e.g. /poolbot).",
     "gateway.controlUi.root": "Optional filesystem root for Control UI assets (defaults to dist/control-ui).",
     "gateway.controlUi.allowedOrigins": "Allowed browser origins for Control UI/WebChat websocket connections (full origins only, e.g. https://control.example.com).",
     "gateway.controlUi.allowInsecureAuth": "Allow Control UI auth over insecure HTTP (token-only; not recommended).",
@@ -129,7 +129,7 @@ export const FIELD_HELP = {
     "agents.defaults.memorySearch.query.hybrid.candidateMultiplier": "Multiplier for candidate pool size (default: 4).",
     "agents.defaults.memorySearch.cache.enabled": "Cache chunk embeddings in SQLite to speed up reindexing and frequent updates (default: true).",
     memory: "Memory backend configuration (global).",
-    "memory.backend": 'Memory backend ("builtin" for OpenClaw embeddings, "qmd" for QMD sidecar).',
+    "memory.backend": 'Memory backend ("builtin" for Pool Bot embeddings, "qmd" for QMD sidecar).',
     "memory.citations": 'Default citation behavior ("auto", "on", or "off").',
     "memory.qmd.command": "Path to the qmd binary (default: resolves from PATH).",
     "memory.qmd.includeDefaultMemory": "Whether to automatically index MEMORY.md + memory/**/*.md (default: true).",
@@ -167,7 +167,7 @@ export const FIELD_HELP = {
     "plugins.entries": "Per-plugin settings keyed by plugin id (enable/disable + config payloads).",
     "plugins.entries.*.enabled": "Overrides plugin enable/disable for this entry (restart required).",
     "plugins.entries.*.config": "Plugin-defined config payload (schema is provided by the plugin).",
-    "plugins.installs": "CLI-managed install metadata (used by `openclaw plugins update` to locate install sources).",
+    "plugins.installs": "CLI-managed install metadata (used by `poolbot plugins update` to locate install sources).",
     "plugins.installs.*.source": 'Install source ("npm", "archive", or "path").',
     "plugins.installs.*.spec": "Original npm spec used for install (if source is npm).",
     "plugins.installs.*.sourcePath": "Original archive/path used for install (if any).",
@@ -179,6 +179,7 @@ export const FIELD_HELP = {
     "agents.defaults.model.fallbacks": "Ordered fallback models (provider/model). Used when the primary model fails.",
     "agents.defaults.imageModel.primary": "Optional image model (provider/model) used when the primary model lacks image input.",
     "agents.defaults.imageModel.fallbacks": "Ordered fallback image models (provider/model).",
+    "agents.defaults.imageMaxDimensionPx": "Max image side length in pixels when sanitizing transcript/tool-result image payloads (default: 1200).",
     "agents.defaults.cliBackends": "Optional CLI backends for text-only fallback (claude-cli, etc.).",
     "agents.defaults.humanDelay.mode": 'Delay style for block replies ("off", "natural", "custom").',
     "agents.defaults.humanDelay.minMs": "Minimum delay in ms for custom humanDelay (default: 800).",

package/dist/config/schema.hints.js

@@ -62,11 +62,11 @@ const FIELD_PLACEHOLDERS = {
     "gateway.remote.url": "ws://host:18789",
     "gateway.remote.tlsFingerprint": "sha256:ab12cd34…",
     "gateway.remote.sshTarget": "user@host",
-    "gateway.controlUi.basePath": "/openclaw",
+    "gateway.controlUi.basePath": "/poolbot",
     "gateway.controlUi.root": "dist/control-ui",
     "gateway.controlUi.allowedOrigins": "https://control.example.com",
     "channels.mattermost.baseUrl": "https://chat.example.com",
-    "agents.list[].identity.avatar": "avatars/openclaw.png",
+    "agents.list[].identity.avatar": "avatars/poolbot.png",
 };
 /**
  * Non-sensitive field names that happen to match sensitive patterns.

package/dist/config/schema.labels.js

@@ -201,6 +201,7 @@ export const FIELD_LABELS = {
     "agents.defaults.model.fallbacks": "Model Fallbacks",
     "agents.defaults.imageModel.primary": "Image Model",
     "agents.defaults.imageModel.fallbacks": "Image Model Fallbacks",
+    "agents.defaults.imageMaxDimensionPx": "Image Max Dimension (px)",
     "agents.defaults.humanDelay.mode": "Human Delay Mode",
     "agents.defaults.humanDelay.minMs": "Human Delay Min (ms)",
     "agents.defaults.humanDelay.maxMs": "Human Delay Max (ms)",

package/dist/config/sessions/group.js

@@ -1,19 +1,17 @@
+import { normalizeHyphenSlug } from "../../shared/string-normalization.js";
 import { listDeliverableMessageChannels } from "../../utils/message-channel.js";
 const getGroupSurfaces = () => new Set([...listDeliverableMessageChannels(), "webchat"]);
 function normalizeGroupLabel(raw) {
-    const trimmed = raw?.trim().toLowerCase() ?? "";
-    if (!trimmed)
-        return "";
-    const dashed = trimmed.replace(/\s+/g, "-");
-    const cleaned = dashed.replace(/[^a-z0-9#@._+-]+/g, "-");
-    return cleaned.replace(/-{2,}/g, "-").replace(/^[-.]+|[-.]+$/g, "");
+    return normalizeHyphenSlug(raw);
 }
 function shortenGroupId(value) {
     const trimmed = value?.trim() ?? "";
-    if (!trimmed)
+    if (!trimmed) {
         return "";
-    if (trimmed.length <= 14)
+    }
+    if (trimmed.length <= 14) {
         return trimmed;
+    }
     return `${trimmed.slice(0, 6)}...${trimmed.slice(-4)}`;
 }
 export function buildGroupDisplayName(params) {
@@ -48,8 +46,9 @@ export function resolveGroupSessionKey(ctx) {
         from.includes(":group:") ||
         from.includes(":channel:") ||
         isWhatsAppGroupId;
-    if (!looksLikeGroup)
+    if (!looksLikeGroup) {
         return null;
+    }
     const providerHint = ctx.Provider?.trim().toLowerCase();
     const parts = from.split(":").filter(Boolean);
     const head = parts[0]?.trim().toLowerCase() ?? "";
@@ -57,8 +56,9 @@ export function resolveGroupSessionKey(ctx) {
     const provider = headIsSurface
         ? head
         : (providerHint ?? (isWhatsAppGroupId ? "whatsapp" : undefined));
-    if (!provider)
+    if (!provider) {
         return null;
+    }
     const second = parts[1]?.trim().toLowerCase();
     const secondIsKind = second === "group" || second === "channel";
     const kind = secondIsKind
@@ -72,8 +72,9 @@ export function resolveGroupSessionKey(ctx) {
             : parts.slice(1).join(":")
         : from;
     const finalId = id.trim().toLowerCase();
-    if (!finalId)
+    if (!finalId) {
         return null;
+    }
     return {
         key: `${provider}:${kind}:${finalId}`,
         channel: provider,