@poolzin/pool-bot 2026.2.21 → 2026.2.23

package/dist/discord/send.shared.js

@@ -1,55 +1,21 @@
-import { RequestClient } from "@buape/carbon";
+import { Embed, serializePayload, } from "@buape/carbon";
 import { PollLayoutType } from "discord-api-types/payloads/v10";
 import { Routes } from "discord-api-types/v10";
 import { loadConfig } from "../config/config.js";
-import { createDiscordRetryRunner } from "../infra/retry-policy.js";
 import { normalizePollDurationHours, normalizePollInput } from "../polls.js";
 import { loadWebMedia } from "../web/media.js";
 import { resolveDiscordAccount } from "./accounts.js";
 import { chunkDiscordTextWithMode } from "./chunk.js";
+import { createDiscordClient, resolveDiscordRest } from "./client.js";
 import { fetchChannelPermissionsDiscord, isThreadChannelType } from "./send.permissions.js";
 import { DiscordSendError } from "./send.types.js";
 import { parseDiscordTarget, resolveDiscordTarget } from "./targets.js";
-import { normalizeDiscordToken } from "./token.js";
 const DISCORD_TEXT_LIMIT = 2000;
 const DISCORD_MAX_STICKERS = 3;
 const DISCORD_POLL_MAX_ANSWERS = 10;
 const DISCORD_POLL_MAX_DURATION_HOURS = 32 * 24;
 const DISCORD_MISSING_PERMISSIONS = 50013;
 const DISCORD_CANNOT_DM = 50007;
-export const SUPPRESS_NOTIFICATIONS_FLAG = 1 << 12;
-function resolveToken(params) {
-    const explicit = normalizeDiscordToken(params.explicit);
-    if (explicit) {
-        return explicit;
-    }
-    const fallback = normalizeDiscordToken(params.fallbackToken);
-    if (!fallback) {
-        throw new Error(`Discord bot token missing for account "${params.accountId}" (set discord.accounts.${params.accountId}.token or DISCORD_BOT_TOKEN for default).`);
-    }
-    return fallback;
-}
-function resolveRest(token, rest) {
-    return rest ?? new RequestClient(token);
-}
-function createDiscordClient(opts, cfg = loadConfig()) {
-    const account = resolveDiscordAccount({ cfg, accountId: opts.accountId });
-    const token = resolveToken({
-        explicit: opts.token,
-        accountId: account.accountId,
-        fallbackToken: account.token,
-    });
-    const rest = resolveRest(token, opts.rest);
-    const request = createDiscordRetryRunner({
-        retry: opts.retry,
-        configRetry: account.config.retry,
-        verbose: opts.verbose,
-    });
-    return { token, rest, request };
-}
-function resolveDiscordRest(opts) {
-    return createDiscordClient(opts).rest;
-}
 function normalizeReactionEmoji(raw) {
     const trimmed = raw.trim();
     if (!trimmed) {
@@ -202,6 +168,8 @@ async function resolveChannelId(rest, recipient, request) {
     }
     return { channelId: dmChannel.id, dm: true };
 }
+// Discord message flag for silent/suppress notifications
+export const SUPPRESS_NOTIFICATIONS_FLAG = 1 << 12;
 export function buildDiscordTextChunks(text, opts = {}) {
     if (!text) {
         return [];
@@ -216,62 +184,137 @@ export function buildDiscordTextChunks(text, opts = {}) {
     }
     return chunks;
 }
-async function sendDiscordText(rest, channelId, text, replyTo, request, maxLinesPerMessage, embeds, chunkMode) {
+function hasV2Components(components) {
+    return Boolean(components?.some((component) => "isV2" in component && component.isV2));
+}
+export function resolveDiscordSendComponents(params) {
+    if (!params.components || !params.isFirst) {
+        return undefined;
+    }
+    return typeof params.components === "function"
+        ? params.components(params.text)
+        : params.components;
+}
+function normalizeDiscordEmbeds(embeds) {
+    if (!embeds?.length) {
+        return undefined;
+    }
+    return embeds.map((embed) => (embed instanceof Embed ? embed : new Embed(embed)));
+}
+export function resolveDiscordSendEmbeds(params) {
+    if (!params.embeds || !params.isFirst) {
+        return undefined;
+    }
+    return normalizeDiscordEmbeds(params.embeds);
+}
+export function buildDiscordMessagePayload(params) {
+    const payload = {};
+    const hasV2 = hasV2Components(params.components);
+    const trimmed = params.text.trim();
+    if (!hasV2 && trimmed) {
+        payload.content = params.text;
+    }
+    if (params.components?.length) {
+        payload.components = params.components;
+    }
+    if (!hasV2 && params.embeds?.length) {
+        payload.embeds = params.embeds;
+    }
+    if (params.flags !== undefined) {
+        payload.flags = params.flags;
+    }
+    if (params.files?.length) {
+        payload.files = params.files;
+    }
+    return payload;
+}
+export function stripUndefinedFields(value) {
+    return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
+}
+async function sendDiscordText(rest, channelId, text, replyTo, request, maxLinesPerMessage, components, embeds, chunkMode, silent) {
     if (!text.trim()) {
         throw new Error("Message must be non-empty for Discord sends");
     }
     const messageReference = replyTo ? { message_id: replyTo, fail_if_not_exists: false } : undefined;
+    const flags = silent ? SUPPRESS_NOTIFICATIONS_FLAG : undefined;
     const chunks = buildDiscordTextChunks(text, { maxLinesPerMessage, chunkMode });
-    if (chunks.length === 1) {
-        const res = (await request(() => rest.post(Routes.channelMessages(channelId), {
-            body: {
-                content: chunks[0],
-                message_reference: messageReference,
-                ...(embeds?.length ? { embeds } : {}),
-            },
+    const sendChunk = async (chunk, isFirst) => {
+        const chunkComponents = resolveDiscordSendComponents({
+            components,
+            text: chunk,
+            isFirst,
+        });
+        const chunkEmbeds = resolveDiscordSendEmbeds({ embeds, isFirst });
+        const payload = buildDiscordMessagePayload({
+            text: chunk,
+            components: chunkComponents,
+            embeds: chunkEmbeds,
+            flags,
+        });
+        const body = stripUndefinedFields({
+            ...serializePayload(payload),
+            ...(messageReference ? { message_reference: messageReference } : {}),
+        });
+        return (await request(() => rest.post(Routes.channelMessages(channelId), {
+            body,
         }), "text"));
-        return res;
+    };
+    if (chunks.length === 1) {
+        return await sendChunk(chunks[0], true);
     }
     let last = null;
-    let isFirst = true;
-    for (const chunk of chunks) {
-        last = (await request(() => rest.post(Routes.channelMessages(channelId), {
-            body: {
-                content: chunk,
-                message_reference: isFirst ? messageReference : undefined,
-                ...(isFirst && embeds?.length ? { embeds } : {}),
-            },
-        }), "text"));
-        isFirst = false;
+    for (const [index, chunk] of chunks.entries()) {
+        last = await sendChunk(chunk, index === 0);
     }
     if (!last) {
         throw new Error("Discord send failed (empty chunk result)");
     }
     return last;
 }
-async function sendDiscordMedia(rest, channelId, text, mediaUrl, replyTo, request, maxLinesPerMessage, embeds, chunkMode) {
-    const media = await loadWebMedia(mediaUrl);
+async function sendDiscordMedia(rest, channelId, text, mediaUrl, mediaLocalRoots, replyTo, request, maxLinesPerMessage, components, embeds, chunkMode, silent) {
+    const media = await loadWebMedia(mediaUrl, { localRoots: mediaLocalRoots });
     const chunks = text ? buildDiscordTextChunks(text, { maxLinesPerMessage, chunkMode }) : [];
     const caption = chunks[0] ?? "";
     const messageReference = replyTo ? { message_id: replyTo, fail_if_not_exists: false } : undefined;
+    const flags = silent ? SUPPRESS_NOTIFICATIONS_FLAG : undefined;
+    let fileData;
+    if (media.buffer instanceof Blob) {
+        fileData = media.buffer;
+    }
+    else {
+        const arrayBuffer = new ArrayBuffer(media.buffer.byteLength);
+        new Uint8Array(arrayBuffer).set(media.buffer);
+        fileData = new Blob([arrayBuffer]);
+    }
+    const captionComponents = resolveDiscordSendComponents({
+        components,
+        text: caption,
+        isFirst: true,
+    });
+    const captionEmbeds = resolveDiscordSendEmbeds({ embeds, isFirst: true });
+    const payload = buildDiscordMessagePayload({
+        text: caption,
+        components: captionComponents,
+        embeds: captionEmbeds,
+        flags,
+        files: [
+            {
+                data: fileData,
+                name: media.fileName ?? "upload",
+            },
+        ],
+    });
     const res = (await request(() => rest.post(Routes.channelMessages(channelId), {
-        body: {
-            content: caption || undefined,
-            message_reference: messageReference,
-            ...(embeds?.length ? { embeds } : {}),
-            files: [
-                {
-                    data: media.buffer,
-                    name: media.fileName ?? "upload",
-                },
-            ],
-        },
+        body: stripUndefinedFields({
+            ...serializePayload(payload),
+            ...(messageReference ? { message_reference: messageReference } : {}),
+        }),
     }), "media"));
     for (const chunk of chunks.slice(1)) {
         if (!chunk.trim()) {
             continue;
         }
-        await sendDiscordText(rest, channelId, chunk, undefined, request, maxLinesPerMessage, undefined, chunkMode);
+        await sendDiscordText(rest, channelId, chunk, replyTo, request, maxLinesPerMessage, undefined, undefined, chunkMode, silent);
     }
     return res;
 }
@@ -284,7 +327,4 @@ function buildReactionIdentifier(emoji) {
 function formatReactionEmoji(emoji) {
     return buildReactionIdentifier(emoji);
 }
-export function stripUndefinedFields(obj) {
-    return Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== undefined));
-}
 export { buildDiscordSendError, buildReactionIdentifier, createDiscordClient, formatReactionEmoji, normalizeDiscordPollInput, normalizeEmojiName, normalizeReactionEmoji, normalizeStickerIds, parseRecipient, resolveChannelId, resolveDiscordRest, sendDiscordMedia, sendDiscordText, };

package/dist/discord/voice-message.js

@@ -14,7 +14,7 @@ import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { promisify } from "node:util";
-import { resolvePreferredOpenClawTmpDir } from "../infra/tmp-poolbot-dir.js";
+import { resolvePreferredPoolbotTmpDir } from "../infra/tmp-poolbot-dir.js";
 const execFileAsync = promisify(execFile);
 const DISCORD_VOICE_MESSAGE_FLAG = 1 << 13;
 const SUPPRESS_NOTIFICATIONS_FLAG = 1 << 12;
@@ -62,7 +62,7 @@ export async function generateWaveform(filePath) {
  * Generate waveform by extracting raw PCM data and sampling amplitudes
  */
 async function generateWaveformFromPcm(filePath) {
-    const tempDir = resolvePreferredOpenClawTmpDir();
+    const tempDir = resolvePreferredPoolbotTmpDir();
     const tempPcm = path.join(tempDir, `waveform-${crypto.randomUUID()}.raw`);
     try {
         // Convert to raw 16-bit signed PCM, mono, 8kHz
@@ -161,7 +161,7 @@ export async function ensureOggOpus(filePath) {
         }
     }
     // Convert to OGG/Opus
-    const tempDir = resolvePreferredOpenClawTmpDir();
+    const tempDir = resolvePreferredPoolbotTmpDir();
     const outputPath = path.join(tempDir, `voice-${crypto.randomUUID()}.ogg`);
     await execFileAsync("ffmpeg", [
         "-y",

package/dist/gateway/auth.js

@@ -1,46 +1,24 @@
-import { safeEqualSecret } from "../security/secret-equal.js";
 import { readTailscaleWhoisIdentity } from "../infra/tailscale.js";
-import { isTrustedProxyAddress, parseForwardedForClientIp, resolveGatewayClientIp } from "./net.js";
+import { safeEqualSecret } from "../security/secret-equal.js";
+import { AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET, } from "./auth-rate-limit.js";
+import { isLoopbackAddress, isTrustedProxyAddress, resolveHostName, parseForwardedForClientIp, resolveGatewayClientIp, } from "./net.js";
 function normalizeLogin(login) {
     return login.trim().toLowerCase();
 }
-function isLoopbackAddress(ip) {
-    if (!ip)
-        return false;
-    if (ip === "127.0.0.1")
-        return true;
-    if (ip.startsWith("127."))
-        return true;
-    if (ip === "::1")
-        return true;
-    if (ip.startsWith("::ffff:127."))
-        return true;
-    return false;
-}
-function getHostName(hostHeader) {
-    const host = (hostHeader ?? "").trim().toLowerCase();
-    if (!host)
-        return "";
-    if (host.startsWith("[")) {
-        const end = host.indexOf("]");
-        if (end !== -1)
-            return host.slice(1, end);
-    }
-    const [name] = host.split(":");
-    return name ?? "";
-}
 function headerValue(value) {
     return Array.isArray(value) ? value[0] : value;
 }
 function resolveTailscaleClientIp(req) {
-    if (!req)
+    if (!req) {
         return undefined;
+    }
     const forwardedFor = headerValue(req.headers?.["x-forwarded-for"]);
     return forwardedFor ? parseForwardedForClientIp(forwardedFor) : undefined;
 }
 function resolveRequestClientIp(req, trustedProxies) {
-    if (!req)
+    if (!req) {
         return undefined;
+    }
     return resolveGatewayClientIp({
         remoteAddr: req.socket?.remoteAddress ?? "",
         forwardedFor: headerValue(req.headers?.["x-forwarded-for"]),
@@ -49,12 +27,14 @@ function resolveRequestClientIp(req, trustedProxies) {
     });
 }
 export function isLocalDirectRequest(req, trustedProxies) {
-    if (!req)
+    if (!req) {
         return false;
+    }
     const clientIp = resolveRequestClientIp(req, trustedProxies) ?? "";
-    if (!isLoopbackAddress(clientIp))
+    if (!isLoopbackAddress(clientIp)) {
         return false;
-    const host = getHostName(req.headers?.host);
+    }
+    const host = resolveHostName(req.headers?.host);
     const hostIsLocal = host === "localhost" || host === "127.0.0.1" || host === "::1";
     const hostIsTailscaleServe = host.endsWith(".ts.net");
     const hasForwarded = Boolean(req.headers?.["x-forwarded-for"] ||
@@ -64,11 +44,13 @@ export function isLocalDirectRequest(req, trustedProxies) {
     return (hostIsLocal || hostIsTailscaleServe) && (!hasForwarded || remoteIsTrustedProxy);
 }
 function getTailscaleUser(req) {
-    if (!req)
+    if (!req) {
         return null;
+    }
     const login = req.headers["tailscale-user-login"];
-    if (typeof login !== "string" || !login.trim())
+    if (typeof login !== "string" || !login.trim()) {
         return null;
+    }
     const nameRaw = req.headers["tailscale-user-name"];
     const profilePic = req.headers["tailscale-user-profile-pic"];
     const name = typeof nameRaw === "string" && nameRaw.trim() ? nameRaw.trim() : login.trim();
@@ -79,15 +61,17 @@ function getTailscaleUser(req) {
     };
 }
 function hasTailscaleProxyHeaders(req) {
-    if (!req)
+    if (!req) {
         return false;
+    }
     return Boolean(req.headers["x-forwarded-for"] &&
         req.headers["x-forwarded-proto"] &&
         req.headers["x-forwarded-host"]);
 }
 function isTailscaleProxyRequest(req) {
-    if (!req)
+    if (!req) {
         return false;
+    }
     return isLoopbackAddress(req.socket?.remoteAddress) && hasTailscaleProxyHeaders(req);
 }
 async function resolveVerifiedTailscaleUser(params) {
@@ -122,40 +106,124 @@ async function resolveVerifiedTailscaleUser(params) {
 export function resolveGatewayAuth(params) {
     const authConfig = params.authConfig ?? {};
     const env = params.env ?? process.env;
-    const token = authConfig.token ?? env.POOLBOT_GATEWAY_TOKEN ?? env.CLAWDBOT_GATEWAY_TOKEN ?? undefined;
-    const password = authConfig.password ??
-        env.POOLBOT_GATEWAY_PASSWORD ??
-        env.CLAWDBOT_GATEWAY_PASSWORD ??
-        undefined;
-    const mode = authConfig.mode ?? (password ? "password" : "token");
-    const allowTailscale = authConfig.allowTailscale ?? (params.tailscaleMode === "serve" && mode !== "password");
+    const token = authConfig.token ?? env.POOLBOT_GATEWAY_TOKEN ?? undefined;
+    const password = authConfig.password ?? env.POOLBOT_GATEWAY_PASSWORD ?? undefined;
+    const trustedProxy = authConfig.trustedProxy;
+    let mode;
+    if (authConfig.mode) {
+        mode = authConfig.mode;
+    }
+    else if (password) {
+        mode = "password";
+    }
+    else if (token) {
+        mode = "token";
+    }
+    else {
+        mode = "none";
+    }
+    const allowTailscale = authConfig.allowTailscale ??
+        (params.tailscaleMode === "serve" && mode !== "password" && mode !== "trusted-proxy");
     return {
         mode,
         token,
         password,
         allowTailscale,
+        trustedProxy,
     };
 }
 export function assertGatewayAuthConfigured(auth) {
     if (auth.mode === "token" && !auth.token) {
-        if (auth.allowTailscale)
+        if (auth.allowTailscale) {
             return;
+        }
         throw new Error("gateway auth mode is token, but no token was configured (set gateway.auth.token or POOLBOT_GATEWAY_TOKEN)");
     }
     if (auth.mode === "password" && !auth.password) {
         throw new Error("gateway auth mode is password, but no password was configured");
     }
+    if (auth.mode === "trusted-proxy") {
+        if (!auth.trustedProxy) {
+            throw new Error("gateway auth mode is trusted-proxy, but no trustedProxy config was provided (set gateway.auth.trustedProxy)");
+        }
+        if (!auth.trustedProxy.userHeader || auth.trustedProxy.userHeader.trim() === "") {
+            throw new Error("gateway auth mode is trusted-proxy, but trustedProxy.userHeader is empty (set gateway.auth.trustedProxy.userHeader)");
+        }
+    }
+}
+/**
+ * Check if the request came from a trusted proxy and extract user identity.
+ * Returns the user identity if valid, or null with a reason if not.
+ */
+function authorizeTrustedProxy(params) {
+    const { req, trustedProxies, trustedProxyConfig } = params;
+    if (!req) {
+        return { reason: "trusted_proxy_no_request" };
+    }
+    const remoteAddr = req.socket?.remoteAddress;
+    if (!remoteAddr || !isTrustedProxyAddress(remoteAddr, trustedProxies)) {
+        return { reason: "trusted_proxy_untrusted_source" };
+    }
+    const requiredHeaders = trustedProxyConfig.requiredHeaders ?? [];
+    for (const header of requiredHeaders) {
+        const value = headerValue(req.headers[header.toLowerCase()]);
+        if (!value || value.trim() === "") {
+            return { reason: `trusted_proxy_missing_header_${header}` };
+        }
+    }
+    const userHeaderValue = headerValue(req.headers[trustedProxyConfig.userHeader.toLowerCase()]);
+    if (!userHeaderValue || userHeaderValue.trim() === "") {
+        return { reason: "trusted_proxy_user_missing" };
+    }
+    const user = userHeaderValue.trim();
+    const allowUsers = trustedProxyConfig.allowUsers ?? [];
+    if (allowUsers.length > 0 && !allowUsers.includes(user)) {
+        return { reason: "trusted_proxy_user_not_allowed" };
+    }
+    return { user };
 }
 export async function authorizeGatewayConnect(params) {
     const { auth, connectAuth, req, trustedProxies } = params;
     const tailscaleWhois = params.tailscaleWhois ?? readTailscaleWhoisIdentity;
     const localDirect = isLocalDirectRequest(req, trustedProxies);
+    if (auth.mode === "trusted-proxy") {
+        if (!auth.trustedProxy) {
+            return { ok: false, reason: "trusted_proxy_config_missing" };
+        }
+        if (!trustedProxies || trustedProxies.length === 0) {
+            return { ok: false, reason: "trusted_proxy_no_proxies_configured" };
+        }
+        const result = authorizeTrustedProxy({
+            req,
+            trustedProxies,
+            trustedProxyConfig: auth.trustedProxy,
+        });
+        if ("user" in result) {
+            return { ok: true, method: "trusted-proxy", user: result.user };
+        }
+        return { ok: false, reason: result.reason };
+    }
+    const limiter = params.rateLimiter;
+    const ip = params.clientIp ?? resolveRequestClientIp(req, trustedProxies) ?? req?.socket?.remoteAddress;
+    const rateLimitScope = params.rateLimitScope ?? AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET;
+    if (limiter) {
+        const rlCheck = limiter.check(ip, rateLimitScope);
+        if (!rlCheck.allowed) {
+            return {
+                ok: false,
+                reason: "rate_limited",
+                rateLimited: true,
+                retryAfterMs: rlCheck.retryAfterMs,
+            };
+        }
+    }
     if (auth.allowTailscale && !localDirect) {
         const tailscaleCheck = await resolveVerifiedTailscaleUser({
             req,
             tailscaleWhois,
         });
         if (tailscaleCheck.ok) {
+            limiter?.reset(ip, rateLimitScope);
             return {
                 ok: true,
                 method: "tailscale",
@@ -168,11 +236,14 @@ export async function authorizeGatewayConnect(params) {
             return { ok: false, reason: "token_missing_config" };
         }
         if (!connectAuth?.token) {
+            limiter?.recordFailure(ip, rateLimitScope);
             return { ok: false, reason: "token_missing" };
         }
         if (!safeEqualSecret(connectAuth.token, auth.token)) {
+            limiter?.recordFailure(ip, rateLimitScope);
             return { ok: false, reason: "token_mismatch" };
         }
+        limiter?.reset(ip, rateLimitScope);
         return { ok: true, method: "token" };
     }
     if (auth.mode === "password") {
@@ -181,12 +252,16 @@ export async function authorizeGatewayConnect(params) {
             return { ok: false, reason: "password_missing_config" };
         }
         if (!password) {
+            limiter?.recordFailure(ip, rateLimitScope);
             return { ok: false, reason: "password_missing" };
         }
         if (!safeEqualSecret(password, auth.password)) {
+            limiter?.recordFailure(ip, rateLimitScope);
             return { ok: false, reason: "password_mismatch" };
         }
+        limiter?.reset(ip, rateLimitScope);
         return { ok: true, method: "password" };
     }
+    limiter?.recordFailure(ip, rateLimitScope);
     return { ok: false, reason: "unauthorized" };
 }