@poolzin/pool-bot 2026.2.21 → 2026.2.23

package/dist/hooks/install.js

@@ -1,30 +1,44 @@
 import fs from "node:fs/promises";
-import os from "node:os";
 import path from "node:path";
-import { LEGACY_MANIFEST_KEY } from "../compat/legacy-names.js";
-import { runCommandWithTimeout } from "../process/exec.js";
-import { CONFIG_DIR, resolveUserPath } from "../utils.js";
+import { MANIFEST_KEY } from "../compat/legacy-names.js";
 import { extractArchive, fileExists, readJsonFile, resolveArchiveKind, resolvePackedRootDir, } from "../infra/archive.js";
+import { installPackageDir } from "../infra/install-package-dir.js";
+import { resolveSafeInstallDir, unscopedPackageName } from "../infra/install-safe-path.js";
+import { packNpmSpecToArchive, resolveArchiveSourcePath, withTempDir, } from "../infra/install-source-utils.js";
+import { validateRegistryNpmSpec } from "../infra/npm-registry-spec.js";
+import { CONFIG_DIR, resolveUserPath } from "../utils.js";
 import { parseFrontmatter } from "./frontmatter.js";
 const defaultLogger = {};
-function unscopedPackageName(name) {
-    const trimmed = name.trim();
-    if (!trimmed)
-        return trimmed;
-    return trimmed.includes("/") ? (trimmed.split("/").pop() ?? trimmed) : trimmed;
-}
-function safeDirName(input) {
-    const trimmed = input.trim();
-    if (!trimmed)
-        return trimmed;
-    return trimmed.replaceAll("/", "__");
+function validateHookId(hookId) {
+    if (!hookId) {
+        return "invalid hook name: missing";
+    }
+    if (hookId === "." || hookId === "..") {
+        return "invalid hook name: reserved path segment";
+    }
+    if (hookId.includes("/") || hookId.includes("\\")) {
+        return "invalid hook name: path separators not allowed";
+    }
+    return null;
 }
 export function resolveHookInstallDir(hookId, hooksDir) {
     const hooksBase = hooksDir ? resolveUserPath(hooksDir) : path.join(CONFIG_DIR, "hooks");
-    return path.join(hooksBase, safeDirName(hookId));
+    const hookIdError = validateHookId(hookId);
+    if (hookIdError) {
+        throw new Error(hookIdError);
+    }
+    const targetDirResult = resolveSafeInstallDir({
+        baseDir: hooksBase,
+        id: hookId,
+        invalidNameMessage: "invalid hook name: path traversal detected",
+    });
+    if (!targetDirResult.ok) {
+        throw new Error(targetDirResult.error);
+    }
+    return targetDirResult.path;
 }
 async function ensurePoolbotHooks(manifest) {
-    const hooks = manifest.poolbot?.hooks ?? manifest[LEGACY_MANIFEST_KEY]?.hooks;
+    const hooks = manifest[MANIFEST_KEY]?.hooks;
     if (!Array.isArray(hooks)) {
         throw new Error("package.json missing poolbot.hooks");
     }
@@ -34,6 +48,32 @@ async function ensurePoolbotHooks(manifest) {
     }
     return list;
 }
+function resolveHookInstallModeOptions(params) {
+    return {
+        logger: params.logger ?? defaultLogger,
+        mode: params.mode ?? "install",
+        dryRun: params.dryRun ?? false,
+    };
+}
+function resolveTimedHookInstallModeOptions(params) {
+    return {
+        ...resolveHookInstallModeOptions(params),
+        timeoutMs: params.timeoutMs ?? 120_000,
+    };
+}
+async function resolveInstallTargetDir(id, hooksDir) {
+    const baseHooksDir = hooksDir ? resolveUserPath(hooksDir) : path.join(CONFIG_DIR, "hooks");
+    await fs.mkdir(baseHooksDir, { recursive: true });
+    const targetDirResult = resolveSafeInstallDir({
+        baseDir: baseHooksDir,
+        id,
+        invalidNameMessage: "invalid hook name: path traversal detected",
+    });
+    if (!targetDirResult.ok) {
+        return { ok: false, error: targetDirResult.error };
+    }
+    return { ok: true, targetDir: targetDirResult.path };
+}
 async function resolveHookNameFromDir(hookDir) {
     const hookMdPath = path.join(hookDir, "HOOK.md");
     if (!(await fileExists(hookMdPath))) {
@@ -55,10 +95,7 @@ async function validateHookDir(hookDir) {
     }
 }
 async function installHookPackageFromDir(params) {
-    const logger = params.logger ?? defaultLogger;
-    const timeoutMs = params.timeoutMs ?? 120_000;
-    const mode = params.mode ?? "install";
-    const dryRun = params.dryRun ?? false;
+    const { logger, timeoutMs, mode, dryRun } = resolveTimedHookInstallModeOptions(params);
     const manifestPath = path.join(params.packageDir, "package.json");
     if (!(await fileExists(manifestPath))) {
         return { ok: false, error: "package.json missing" };
@@ -79,17 +116,21 @@ async function installHookPackageFromDir(params) {
     }
     const pkgName = typeof manifest.name === "string" ? manifest.name : "";
     const hookPackId = pkgName ? unscopedPackageName(pkgName) : path.basename(params.packageDir);
+    const hookIdError = validateHookId(hookPackId);
+    if (hookIdError) {
+        return { ok: false, error: hookIdError };
+    }
     if (params.expectedHookPackId && params.expectedHookPackId !== hookPackId) {
         return {
             ok: false,
             error: `hook pack id mismatch: expected ${params.expectedHookPackId}, got ${hookPackId}`,
         };
     }
-    const hooksDir = params.hooksDir
-        ? resolveUserPath(params.hooksDir)
-        : path.join(CONFIG_DIR, "hooks");
-    await fs.mkdir(hooksDir, { recursive: true });
-    const targetDir = resolveHookInstallDir(hookPackId, hooksDir);
+    const targetDirResult = await resolveInstallTargetDir(hookPackId, params.hooksDir);
+    if (!targetDirResult.ok) {
+        return { ok: false, error: targetDirResult.error };
+    }
+    const targetDir = targetDirResult.targetDir;
     if (mode === "install" && (await fileExists(targetDir))) {
         return { ok: false, error: `hook pack already exists: ${targetDir} (delete it first)` };
     }
@@ -109,43 +150,20 @@ async function installHookPackageFromDir(params) {
             version: typeof manifest.version === "string" ? manifest.version : undefined,
         };
     }
-    logger.info?.(`Installing to ${targetDir}…`);
-    let backupDir = null;
-    if (mode === "update" && (await fileExists(targetDir))) {
-        backupDir = `${targetDir}.backup-${Date.now()}`;
-        await fs.rename(targetDir, backupDir);
-    }
-    try {
-        await fs.cp(params.packageDir, targetDir, { recursive: true });
-    }
-    catch (err) {
-        if (backupDir) {
-            await fs.rm(targetDir, { recursive: true, force: true }).catch(() => undefined);
-            await fs.rename(backupDir, targetDir).catch(() => undefined);
-        }
-        return { ok: false, error: `failed to copy hook pack: ${String(err)}` };
-    }
     const deps = manifest.dependencies ?? {};
     const hasDeps = Object.keys(deps).length > 0;
-    if (hasDeps) {
-        logger.info?.("Installing hook pack dependencies…");
-        const npmRes = await runCommandWithTimeout(["npm", "install", "--omit=dev", "--silent"], {
-            timeoutMs: Math.max(timeoutMs, 300_000),
-            cwd: targetDir,
-        });
-        if (npmRes.code !== 0) {
-            if (backupDir) {
-                await fs.rm(targetDir, { recursive: true, force: true }).catch(() => undefined);
-                await fs.rename(backupDir, targetDir).catch(() => undefined);
-            }
-            return {
-                ok: false,
-                error: `npm install failed: ${npmRes.stderr.trim() || npmRes.stdout.trim()}`,
-            };
-        }
-    }
-    if (backupDir) {
-        await fs.rm(backupDir, { recursive: true, force: true }).catch(() => undefined);
+    const installRes = await installPackageDir({
+        sourceDir: params.packageDir,
+        targetDir,
+        mode,
+        timeoutMs,
+        logger,
+        copyErrorPrefix: "failed to copy hook pack",
+        hasDeps,
+        depsLogMessage: "Installing hook pack dependencies…",
+    });
+    if (!installRes.ok) {
+        return installRes;
     }
     return {
         ok: true,
@@ -156,22 +174,24 @@ async function installHookPackageFromDir(params) {
     };
 }
 async function installHookFromDir(params) {
-    const logger = params.logger ?? defaultLogger;
-    const mode = params.mode ?? "install";
-    const dryRun = params.dryRun ?? false;
+    const { logger, mode, dryRun } = resolveHookInstallModeOptions(params);
     await validateHookDir(params.hookDir);
     const hookName = await resolveHookNameFromDir(params.hookDir);
+    const hookIdError = validateHookId(hookName);
+    if (hookIdError) {
+        return { ok: false, error: hookIdError };
+    }
     if (params.expectedHookPackId && params.expectedHookPackId !== hookName) {
         return {
             ok: false,
             error: `hook id mismatch: expected ${params.expectedHookPackId}, got ${hookName}`,
         };
     }
-    const hooksDir = params.hooksDir
-        ? resolveUserPath(params.hooksDir)
-        : path.join(CONFIG_DIR, "hooks");
-    await fs.mkdir(hooksDir, { recursive: true });
-    const targetDir = resolveHookInstallDir(hookName, hooksDir);
+    const targetDirResult = await resolveInstallTargetDir(hookName, params.hooksDir);
+    if (!targetDirResult.ok) {
+        return { ok: false, error: targetDirResult.error };
+    }
+    const targetDir = targetDirResult.targetDir;
     if (mode === "install" && (await fileExists(targetDir))) {
         return { ok: false, error: `hook already exists: ${targetDir} (delete it first)` };
     }
@@ -202,87 +222,77 @@ async function installHookFromDir(params) {
 export async function installHooksFromArchive(params) {
     const logger = params.logger ?? defaultLogger;
     const timeoutMs = params.timeoutMs ?? 120_000;
-    const archivePath = resolveUserPath(params.archivePath);
-    if (!(await fileExists(archivePath))) {
-        return { ok: false, error: `archive not found: ${archivePath}` };
-    }
-    if (!resolveArchiveKind(archivePath)) {
-        return { ok: false, error: `unsupported archive: ${archivePath}` };
-    }
-    const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "poolbot-hook-"));
-    const extractDir = path.join(tmpDir, "extract");
-    await fs.mkdir(extractDir, { recursive: true });
-    logger.info?.(`Extracting ${archivePath}…`);
-    try {
-        await extractArchive({ archivePath, destDir: extractDir, timeoutMs, logger });
-    }
-    catch (err) {
-        return { ok: false, error: `failed to extract archive: ${String(err)}` };
-    }
-    let rootDir = "";
-    try {
-        rootDir = await resolvePackedRootDir(extractDir);
-    }
-    catch (err) {
-        return { ok: false, error: String(err) };
-    }
-    const manifestPath = path.join(rootDir, "package.json");
-    if (await fileExists(manifestPath)) {
-        return await installHookPackageFromDir({
-            packageDir: rootDir,
+    const archivePathResult = await resolveArchiveSourcePath(params.archivePath);
+    if (!archivePathResult.ok) {
+        return archivePathResult;
+    }
+    const archivePath = archivePathResult.path;
+    return await withTempDir("poolbot-hook-", async (tmpDir) => {
+        const extractDir = path.join(tmpDir, "extract");
+        await fs.mkdir(extractDir, { recursive: true });
+        logger.info?.(`Extracting ${archivePath}…`);
+        try {
+            await extractArchive({ archivePath, destDir: extractDir, timeoutMs, logger });
+        }
+        catch (err) {
+            return { ok: false, error: `failed to extract archive: ${String(err)}` };
+        }
+        let rootDir = "";
+        try {
+            rootDir = await resolvePackedRootDir(extractDir);
+        }
+        catch (err) {
+            return { ok: false, error: String(err) };
+        }
+        const manifestPath = path.join(rootDir, "package.json");
+        if (await fileExists(manifestPath)) {
+            return await installHookPackageFromDir({
+                packageDir: rootDir,
+                hooksDir: params.hooksDir,
+                timeoutMs,
+                logger,
+                mode: params.mode,
+                dryRun: params.dryRun,
+                expectedHookPackId: params.expectedHookPackId,
+            });
+        }
+        return await installHookFromDir({
+            hookDir: rootDir,
             hooksDir: params.hooksDir,
-            timeoutMs,
             logger,
             mode: params.mode,
             dryRun: params.dryRun,
             expectedHookPackId: params.expectedHookPackId,
         });
-    }
-    return await installHookFromDir({
-        hookDir: rootDir,
-        hooksDir: params.hooksDir,
-        logger,
-        mode: params.mode,
-        dryRun: params.dryRun,
-        expectedHookPackId: params.expectedHookPackId,
     });
 }
 export async function installHooksFromNpmSpec(params) {
-    const logger = params.logger ?? defaultLogger;
-    const timeoutMs = params.timeoutMs ?? 120_000;
-    const mode = params.mode ?? "install";
-    const dryRun = params.dryRun ?? false;
+    const { logger, timeoutMs, mode, dryRun } = resolveTimedHookInstallModeOptions(params);
     const expectedHookPackId = params.expectedHookPackId;
     const spec = params.spec.trim();
-    if (!spec)
-        return { ok: false, error: "missing npm spec" };
-    const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "poolbot-hook-pack-"));
-    logger.info?.(`Downloading ${spec}…`);
-    const res = await runCommandWithTimeout(["npm", "pack", spec], {
-        timeoutMs: Math.max(timeoutMs, 300_000),
-        cwd: tmpDir,
-        env: { COREPACK_ENABLE_DOWNLOAD_PROMPT: "0" },
-    });
-    if (res.code !== 0) {
-        return { ok: false, error: `npm pack failed: ${res.stderr.trim() || res.stdout.trim()}` };
-    }
-    const packed = (res.stdout || "")
-        .split("\n")
-        .map((l) => l.trim())
-        .filter(Boolean)
-        .pop();
-    if (!packed) {
-        return { ok: false, error: "npm pack produced no archive" };
-    }
-    const archivePath = path.join(tmpDir, packed);
-    return await installHooksFromArchive({
-        archivePath,
-        hooksDir: params.hooksDir,
-        timeoutMs,
-        logger,
-        mode,
-        dryRun,
-        expectedHookPackId,
+    const specError = validateRegistryNpmSpec(spec);
+    if (specError) {
+        return { ok: false, error: specError };
+    }
+    return await withTempDir("poolbot-hook-pack-", async (tmpDir) => {
+        logger.info?.(`Downloading ${spec}…`);
+        const packedResult = await packNpmSpecToArchive({
+            spec,
+            timeoutMs,
+            cwd: tmpDir,
+        });
+        if (!packedResult.ok) {
+            return packedResult;
+        }
+        return await installHooksFromArchive({
+            archivePath: packedResult.archivePath,
+            hooksDir: params.hooksDir,
+            timeoutMs,
+            logger,
+            mode,
+            dryRun,
+            expectedHookPackId,
+        });
     });
 }
 export async function installHooksFromPath(params) {

package/dist/hooks/internal-hooks.js

@@ -1,5 +1,5 @@
 /**
- * Hook system for poolbot agent events
+ * Hook system for Pool Bot agent events
  *
  * Provides an extensible event-driven hook system for agent events
  * like command processing, session lifecycle, etc.
@@ -110,12 +110,37 @@ export function createInternalHookEvent(type, action, sessionKey, context = {})
     };
 }
 export function isAgentBootstrapEvent(event) {
-    if (event.type !== "agent" || event.action !== "bootstrap")
+    if (event.type !== "agent" || event.action !== "bootstrap") {
         return false;
+    }
     const context = event.context;
-    if (!context || typeof context !== "object")
+    if (!context || typeof context !== "object") {
         return false;
-    if (typeof context.workspaceDir !== "string")
+    }
+    if (typeof context.workspaceDir !== "string") {
         return false;
+    }
     return Array.isArray(context.bootstrapFiles);
 }
+export function isMessageReceivedEvent(event) {
+    if (event.type !== "message" || event.action !== "received") {
+        return false;
+    }
+    const context = event.context;
+    if (!context || typeof context !== "object") {
+        return false;
+    }
+    return typeof context.from === "string" && typeof context.channelId === "string";
+}
+export function isMessageSentEvent(event) {
+    if (event.type !== "message" || event.action !== "sent") {
+        return false;
+    }
+    const context = event.context;
+    if (!context || typeof context !== "object") {
+        return false;
+    }
+    return (typeof context.to === "string" &&
+        typeof context.channelId === "string" &&
+        typeof context.success === "boolean");
+}

package/dist/hooks/plugin-hooks.js

@@ -3,8 +3,9 @@ import { pathToFileURL } from "node:url";
 import { shouldIncludeHook } from "./config.js";
 import { loadHookEntriesFromDir } from "./workspace.js";
 function resolveHookDir(api, dir) {
-    if (path.isAbsolute(dir))
+    if (path.isAbsolute(dir)) {
         return dir;
+    }
     return path.resolve(path.dirname(api.source), dir);
 }
 function normalizePluginHookEntry(api, entry) {

package/dist/imessage/monitor/deliver.js

@@ -5,6 +5,7 @@ import { convertMarkdownTables } from "../../markdown/tables.js";
 import { sendMessageIMessage } from "../send.js";
 export async function deliverReplies(params) {
     const { replies, target, client, runtime, maxBytes, textLimit, accountId, sentMessageCache } = params;
+    const scope = `${accountId ?? ""}:${target}`;
     const cfg = loadConfig();
     const tableMode = resolveMarkdownTableMode({
         cfg,
@@ -16,16 +17,19 @@ export async function deliverReplies(params) {
         const mediaList = payload.mediaUrls ?? (payload.mediaUrl ? [payload.mediaUrl] : []);
         const rawText = payload.text ?? "";
         const text = convertMarkdownTables(rawText, tableMode);
-        if (!text && mediaList.length === 0)
+        if (!text && mediaList.length === 0) {
             continue;
+        }
         if (mediaList.length === 0) {
+            sentMessageCache?.remember(scope, text);
             for (const chunk of chunkTextWithMode(text, textLimit, chunkMode)) {
                 await sendMessageIMessage(target, chunk, {
                     maxBytes,
                     client,
                     accountId,
+                    replyToId: payload.replyToId,
                 });
-                sentMessageCache?.remember(target, chunk);
+                sentMessageCache?.remember(scope, chunk);
             }
         }
         else {
@@ -38,9 +42,11 @@ export async function deliverReplies(params) {
                     maxBytes,
                     client,
                     accountId,
+                    replyToId: payload.replyToId,
                 });
-                if (caption)
-                    sentMessageCache?.remember(target, caption);
+                if (caption) {
+                    sentMessageCache?.remember(scope, caption);
+                }
             }
         }
         runtime.log?.(`imessage: delivered reply to ${target}`);