@poolzin/pool-bot 2026.2.23 → 2026.2.25

package/dist/infra/install-source-utils.js

@@ -23,8 +23,86 @@ export async function resolveArchiveSourcePath(archivePath) {
     }
     return { ok: true, path: resolved };
 }
+function toOptionalString(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function parseResolvedSpecFromId(id) {
+    const at = id.lastIndexOf("@");
+    if (at <= 0 || at >= id.length - 1) {
+        return undefined;
+    }
+    const name = id.slice(0, at).trim();
+    const version = id.slice(at + 1).trim();
+    if (!name || !version) {
+        return undefined;
+    }
+    return `${name}@${version}`;
+}
+function normalizeNpmPackEntry(entry) {
+    if (!entry || typeof entry !== "object") {
+        return null;
+    }
+    const rec = entry;
+    const name = toOptionalString(rec.name);
+    const version = toOptionalString(rec.version);
+    const id = toOptionalString(rec.id);
+    const resolvedSpec = (name && version ? `${name}@${version}` : undefined) ??
+        (id ? parseResolvedSpecFromId(id) : undefined);
+    return {
+        filename: toOptionalString(rec.filename),
+        metadata: {
+            name,
+            version,
+            resolvedSpec,
+            integrity: toOptionalString(rec.integrity),
+            shasum: toOptionalString(rec.shasum),
+        },
+    };
+}
+function parseNpmPackJsonOutput(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed) {
+        return null;
+    }
+    const candidates = [trimmed];
+    const arrayStart = trimmed.indexOf("[");
+    if (arrayStart > 0) {
+        candidates.push(trimmed.slice(arrayStart));
+    }
+    for (const candidate of candidates) {
+        let parsed;
+        try {
+            parsed = JSON.parse(candidate);
+        }
+        catch {
+            continue;
+        }
+        const entries = Array.isArray(parsed) ? parsed : [parsed];
+        let fallback = null;
+        for (let i = entries.length - 1; i >= 0; i -= 1) {
+            const normalized = normalizeNpmPackEntry(entries[i]);
+            if (!normalized) {
+                continue;
+            }
+            if (!fallback) {
+                fallback = normalized;
+            }
+            if (normalized.filename) {
+                return normalized;
+            }
+        }
+        if (fallback) {
+            return fallback;
+        }
+    }
+    return null;
+}
 export async function packNpmSpecToArchive(params) {
-    const res = await runCommandWithTimeout(["npm", "pack", params.spec, "--ignore-scripts"], {
+    const res = await runCommandWithTimeout(["npm", "pack", params.spec, "--ignore-scripts", "--json"], {
         timeoutMs: Math.max(params.timeoutMs, 300_000),
         cwd: params.cwd,
         env: {
@@ -35,13 +113,19 @@ export async function packNpmSpecToArchive(params) {
     if (res.code !== 0) {
         return { ok: false, error: `npm pack failed: ${res.stderr.trim() || res.stdout.trim()}` };
     }
-    const packed = (res.stdout || "")
-        .split("\n")
-        .map((line) => line.trim())
-        .filter(Boolean)
-        .pop();
+    const parsedJson = parseNpmPackJsonOutput(res.stdout || "");
+    const packed = parsedJson?.filename ??
+        (res.stdout || "")
+            .split("\n")
+            .map((line) => line.trim())
+            .filter(Boolean)
+            .pop();
     if (!packed) {
         return { ok: false, error: "npm pack produced no archive" };
     }
-    return { ok: true, archivePath: path.join(params.cwd, packed) };
+    return {
+        ok: true,
+        archivePath: path.join(params.cwd, packed),
+        metadata: parsedJson?.metadata ?? {},
+    };
 }

package/dist/infra/node-pairing.js

@@ -1,97 +1,38 @@
 import { randomUUID } from "node:crypto";
-import fs from "node:fs/promises";
-import path from "node:path";
-import { resolveStateDir } from "../config/paths.js";
+import { createAsyncLock, pruneExpiredPending, readJsonFile, resolvePairingPaths, upsertPendingPairingRequest, writeJsonAtomic, } from "./pairing-files.js";
+import { generatePairingToken, verifyPairingToken } from "./pairing-token.js";
 const PENDING_TTL_MS = 5 * 60 * 1000;
-function resolvePaths(baseDir) {
-    const root = baseDir ?? resolveStateDir();
-    const dir = path.join(root, "nodes");
-    return {
-        dir,
-        pendingPath: path.join(dir, "pending.json"),
-        pairedPath: path.join(dir, "paired.json"),
-    };
-}
-async function readJSON(filePath) {
-    try {
-        const raw = await fs.readFile(filePath, "utf8");
-        return JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-}
-async function writeJSONAtomic(filePath, value) {
-    const dir = path.dirname(filePath);
-    await fs.mkdir(dir, { recursive: true });
-    const tmp = `${filePath}.${randomUUID()}.tmp`;
-    await fs.writeFile(tmp, JSON.stringify(value, null, 2), "utf8");
-    try {
-        await fs.chmod(tmp, 0o600);
-    }
-    catch {
-        // best-effort; ignore on platforms without chmod
-    }
-    await fs.rename(tmp, filePath);
-    try {
-        await fs.chmod(filePath, 0o600);
-    }
-    catch {
-        // best-effort; ignore on platforms without chmod
-    }
-}
-function pruneExpiredPending(pendingById, nowMs) {
-    for (const [id, req] of Object.entries(pendingById)) {
-        if (nowMs - req.ts > PENDING_TTL_MS) {
-            delete pendingById[id];
-        }
-    }
-}
-let lock = Promise.resolve();
-async function withLock(fn) {
-    const prev = lock;
-    let release;
-    lock = new Promise((resolve) => {
-        release = resolve;
-    });
-    await prev;
-    try {
-        return await fn();
-    }
-    finally {
-        release?.();
-    }
-}
+const withLock = createAsyncLock();
 async function loadState(baseDir) {
-    const { pendingPath, pairedPath } = resolvePaths(baseDir);
+    const { pendingPath, pairedPath } = resolvePairingPaths(baseDir, "nodes");
     const [pending, paired] = await Promise.all([
-        readJSON(pendingPath),
-        readJSON(pairedPath),
+        readJsonFile(pendingPath),
+        readJsonFile(pairedPath),
     ]);
     const state = {
         pendingById: pending ?? {},
         pairedByNodeId: paired ?? {},
     };
-    pruneExpiredPending(state.pendingById, Date.now());
+    pruneExpiredPending(state.pendingById, Date.now(), PENDING_TTL_MS);
     return state;
 }
 async function persistState(state, baseDir) {
-    const { pendingPath, pairedPath } = resolvePaths(baseDir);
+    const { pendingPath, pairedPath } = resolvePairingPaths(baseDir, "nodes");
     await Promise.all([
-        writeJSONAtomic(pendingPath, state.pendingById),
-        writeJSONAtomic(pairedPath, state.pairedByNodeId),
+        writeJsonAtomic(pendingPath, state.pendingById),
+        writeJsonAtomic(pairedPath, state.pairedByNodeId),
     ]);
 }
 function normalizeNodeId(nodeId) {
     return nodeId.trim();
 }
 function newToken() {
-    return randomUUID().replaceAll("-", "");
+    return generatePairingToken();
 }
 export async function listNodePairing(baseDir) {
     const state = await loadState(baseDir);
-    const pending = Object.values(state.pendingById).sort((a, b) => b.ts - a.ts);
-    const paired = Object.values(state.pairedByNodeId).sort((a, b) => b.approvedAtMs - a.approvedAtMs);
+    const pending = Object.values(state.pendingById).toSorted((a, b) => b.ts - a.ts);
+    const paired = Object.values(state.pairedByNodeId).toSorted((a, b) => b.approvedAtMs - a.approvedAtMs);
     return { pending, paired };
 }
 export async function getPairedNode(nodeId, baseDir) {
@@ -105,40 +46,39 @@ export async function requestNodePairing(req, baseDir) {
         if (!nodeId) {
             throw new Error("nodeId required");
         }
-        const existing = Object.values(state.pendingById).find((p) => p.nodeId === nodeId);
-        if (existing) {
-            return { status: "pending", request: existing, created: false };
-        }
-        const isRepair = Boolean(state.pairedByNodeId[nodeId]);
-        const request = {
-            requestId: randomUUID(),
-            nodeId,
-            displayName: req.displayName,
-            platform: req.platform,
-            version: req.version,
-            coreVersion: req.coreVersion,
-            uiVersion: req.uiVersion,
-            deviceFamily: req.deviceFamily,
-            modelIdentifier: req.modelIdentifier,
-            caps: req.caps,
-            commands: req.commands,
-            permissions: req.permissions,
-            remoteIp: req.remoteIp,
-            silent: req.silent,
-            isRepair,
-            ts: Date.now(),
-        };
-        state.pendingById[request.requestId] = request;
-        await persistState(state, baseDir);
-        return { status: "pending", request, created: true };
+        return await upsertPendingPairingRequest({
+            pendingById: state.pendingById,
+            isExisting: (pending) => pending.nodeId === nodeId,
+            isRepair: Boolean(state.pairedByNodeId[nodeId]),
+            createRequest: (isRepair) => ({
+                requestId: randomUUID(),
+                nodeId,
+                displayName: req.displayName,
+                platform: req.platform,
+                version: req.version,
+                coreVersion: req.coreVersion,
+                uiVersion: req.uiVersion,
+                deviceFamily: req.deviceFamily,
+                modelIdentifier: req.modelIdentifier,
+                caps: req.caps,
+                commands: req.commands,
+                permissions: req.permissions,
+                remoteIp: req.remoteIp,
+                silent: req.silent,
+                isRepair,
+                ts: Date.now(),
+            }),
+            persist: async () => await persistState(state, baseDir),
+        });
     });
 }
 export async function approveNodePairing(requestId, baseDir) {
     return await withLock(async () => {
         const state = await loadState(baseDir);
         const pending = state.pendingById[requestId];
-        if (!pending)
+        if (!pending) {
             return null;
+        }
         const now = Date.now();
         const existing = state.pairedByNodeId[pending.nodeId];
         const node = {
@@ -168,8 +108,9 @@ export async function rejectNodePairing(requestId, baseDir) {
     return await withLock(async () => {
         const state = await loadState(baseDir);
         const pending = state.pendingById[requestId];
-        if (!pending)
+        if (!pending) {
             return null;
+        }
         delete state.pendingById[requestId];
         await persistState(state, baseDir);
         return { requestId, nodeId: pending.nodeId };
@@ -179,17 +120,19 @@ export async function verifyNodeToken(nodeId, token, baseDir) {
     const state = await loadState(baseDir);
     const normalized = normalizeNodeId(nodeId);
     const node = state.pairedByNodeId[normalized];
-    if (!node)
+    if (!node) {
         return { ok: false };
-    return node.token === token ? { ok: true, node } : { ok: false };
+    }
+    return verifyPairingToken(token, node.token) ? { ok: true, node } : { ok: false };
 }
 export async function updatePairedNodeMetadata(nodeId, patch, baseDir) {
     await withLock(async () => {
         const state = await loadState(baseDir);
         const normalized = normalizeNodeId(nodeId);
         const existing = state.pairedByNodeId[normalized];
-        if (!existing)
+        if (!existing) {
             return;
+        }
         const next = {
             ...existing,
             displayName: patch.displayName ?? existing.displayName,
@@ -215,11 +158,13 @@ export async function renamePairedNode(nodeId, displayName, baseDir) {
         const state = await loadState(baseDir);
         const normalized = normalizeNodeId(nodeId);
         const existing = state.pairedByNodeId[normalized];
-        if (!existing)
+        if (!existing) {
             return null;
+        }
         const trimmed = displayName.trim();
-        if (!trimmed)
+        if (!trimmed) {
             throw new Error("displayName required");
+        }
         const next = { ...existing, displayName: trimmed };
         state.pairedByNodeId[normalized] = next;
         await persistState(state, baseDir);

package/dist/infra/npm-integrity.js

@@ -0,0 +1,45 @@
+export async function resolveNpmIntegrityDrift(params) {
+    if (!params.expectedIntegrity || !params.resolution.integrity) {
+        return { proceed: true };
+    }
+    if (params.expectedIntegrity === params.resolution.integrity) {
+        return { proceed: true };
+    }
+    const integrityDrift = {
+        expectedIntegrity: params.expectedIntegrity,
+        actualIntegrity: params.resolution.integrity,
+    };
+    const payload = params.createPayload({
+        spec: params.spec,
+        expectedIntegrity: integrityDrift.expectedIntegrity,
+        actualIntegrity: integrityDrift.actualIntegrity,
+        resolution: params.resolution,
+    });
+    let proceed = true;
+    if (params.onIntegrityDrift) {
+        proceed = await params.onIntegrityDrift(payload);
+    }
+    else {
+        params.warn?.(payload);
+    }
+    return { integrityDrift, proceed, payload };
+}
+export async function resolveNpmIntegrityDriftWithDefaultMessage(params) {
+    const driftResult = await resolveNpmIntegrityDrift({
+        spec: params.spec,
+        expectedIntegrity: params.expectedIntegrity,
+        resolution: params.resolution,
+        createPayload: (drift) => ({ ...drift }),
+        onIntegrityDrift: params.onIntegrityDrift,
+        warn: (driftPayload) => {
+            params.warn?.(`Integrity drift detected for ${driftPayload.resolution.resolvedSpec ?? driftPayload.spec}: expected ${driftPayload.expectedIntegrity}, got ${driftPayload.actualIntegrity}`);
+        },
+    });
+    if (!driftResult.proceed && driftResult.payload) {
+        return {
+            integrityDrift: driftResult.integrityDrift,
+            error: `aborted: npm package integrity drift detected for ${driftResult.payload.resolution.resolvedSpec ?? driftResult.payload.spec}`,
+        };
+    }
+    return { integrityDrift: driftResult.integrityDrift };
+}

package/dist/infra/npm-pack-install.js

@@ -0,0 +1,40 @@
+import { packNpmSpecToArchive, withTempDir, } from "./install-source-utils.js";
+import { resolveNpmIntegrityDriftWithDefaultMessage, } from "./npm-integrity.js";
+export async function installFromNpmSpecArchive(params) {
+    return await withTempDir(params.tempDirPrefix, async (tmpDir) => {
+        const packedResult = await packNpmSpecToArchive({
+            spec: params.spec,
+            timeoutMs: params.timeoutMs,
+            cwd: tmpDir,
+        });
+        if (!packedResult.ok) {
+            return packedResult;
+        }
+        const npmResolution = {
+            ...packedResult.metadata,
+            resolvedAt: new Date().toISOString(),
+        };
+        const driftResult = await resolveNpmIntegrityDriftWithDefaultMessage({
+            spec: params.spec,
+            expectedIntegrity: params.expectedIntegrity,
+            resolution: npmResolution,
+            onIntegrityDrift: params.onIntegrityDrift,
+            warn: params.warn,
+        });
+        if (driftResult.error) {
+            return {
+                ok: false,
+                error: driftResult.error,
+            };
+        }
+        const installResult = await params.installFromArchive({
+            archivePath: packedResult.archivePath,
+        });
+        return {
+            ok: true,
+            installResult,
+            npmResolution,
+            integrityDrift: driftResult.integrityDrift,
+        };
+    });
+}

package/dist/infra/outbound/channel-adapters.js

@@ -1,16 +1,29 @@
+import { Separator, TextDisplay } from "@buape/carbon";
+import { DiscordUiContainer } from "../../discord/ui.js";
+class CrossContextContainer extends DiscordUiContainer {
+    constructor({ originLabel, message, cfg, accountId }) {
+        const trimmed = message.trim();
+        const components = [];
+        if (trimmed) {
+            components.push(new TextDisplay(message));
+            components.push(new Separator({ divider: true, spacing: "small" }));
+        }
+        components.push(new TextDisplay(`*From ${originLabel}*`));
+        super({ cfg, accountId, components });
+    }
+}
 const DEFAULT_ADAPTER = {
-    supportsEmbeds: false,
+    supportsComponentsV2: false,
 };
 const DISCORD_ADAPTER = {
-    supportsEmbeds: true,
-    buildCrossContextEmbeds: (originLabel) => [
-        {
-            description: `From ${originLabel}`,
-        },
+    supportsComponentsV2: true,
+    buildCrossContextComponents: ({ originLabel, message, cfg, accountId }) => [
+        new CrossContextContainer({ originLabel, message, cfg, accountId }),
     ],
 };
 export function getChannelMessageAdapter(channel) {
-    if (channel === "discord")
+    if (channel === "discord") {
         return DISCORD_ADAPTER;
+    }
     return DEFAULT_ADAPTER;
 }