@poolzin/pool-bot 2026.2.23 → 2026.2.25

package/dist/infra/outbound/message.js

@@ -1,15 +1,37 @@
 import { getChannelPlugin, normalizeChannelId } from "../../channels/plugins/index.js";
 import { loadConfig } from "../../config/config.js";
-import { callGateway, randomIdempotencyKey } from "../../gateway/call.js";
+import { callGatewayLeastPrivilege, randomIdempotencyKey } from "../../gateway/call.js";
 import { normalizePollInput } from "../../polls.js";
 import { GATEWAY_CLIENT_MODES, GATEWAY_CLIENT_NAMES, } from "../../utils/message-channel.js";
 import { resolveMessageChannelSelection } from "./channel-selection.js";
 import { deliverOutboundPayloads, } from "./deliver.js";
 import { normalizeReplyPayloadsForDelivery } from "./payloads.js";
 import { resolveOutboundTarget } from "./targets.js";
+async function resolveRequiredChannel(params) {
+    const channel = params.channel?.trim()
+        ? normalizeChannelId(params.channel)
+        : (await resolveMessageChannelSelection({ cfg: params.cfg })).channel;
+    if (!channel) {
+        throw new Error(`Unknown channel: ${params.channel}`);
+    }
+    return channel;
+}
+function resolveRequiredPlugin(channel) {
+    const plugin = getChannelPlugin(channel);
+    if (!plugin) {
+        throw new Error(`Unknown channel: ${channel}`);
+    }
+    return plugin;
+}
 function resolveGatewayOptions(opts) {
+    // Security: backend callers (tools/agents) must not accept user-controlled gateway URLs.
+    // Use config-derived gateway target only.
+    const url = opts?.mode === GATEWAY_CLIENT_MODES.BACKEND ||
+        opts?.clientName === GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT
+        ? undefined
+        : opts?.url;
     return {
-        url: opts?.url,
+        url,
         token: opts?.token,
         timeoutMs: typeof opts?.timeoutMs === "number" && Number.isFinite(opts.timeoutMs)
             ? Math.max(1, Math.floor(opts.timeoutMs))
@@ -19,18 +41,23 @@ function resolveGatewayOptions(opts) {
         mode: opts?.mode ?? GATEWAY_CLIENT_MODES.CLI,
     };
 }
+async function callMessageGateway(params) {
+    const gateway = resolveGatewayOptions(params.gateway);
+    return await callGatewayLeastPrivilege({
+        url: gateway.url,
+        token: gateway.token,
+        method: params.method,
+        params: params.params,
+        timeoutMs: gateway.timeoutMs,
+        clientName: gateway.clientName,
+        clientDisplayName: gateway.clientDisplayName,
+        mode: gateway.mode,
+    });
+}
 export async function sendMessage(params) {
     const cfg = params.cfg ?? loadConfig();
-    const channel = params.channel?.trim()
-        ? normalizeChannelId(params.channel)
-        : (await resolveMessageChannelSelection({ cfg })).channel;
-    if (!channel) {
-        throw new Error(`Unknown channel: ${params.channel}`);
-    }
-    const plugin = getChannelPlugin(channel);
-    if (!plugin) {
-        throw new Error(`Unknown channel: ${channel}`);
-    }
+    const channel = await resolveRequiredChannel({ cfg, channel: params.channel });
+    const plugin = resolveRequiredPlugin(channel);
     const deliveryMode = plugin.outbound?.deliveryMode ?? "direct";
     const normalizedPayloads = normalizeReplyPayloadsForDelivery([
         {
@@ -64,18 +91,23 @@ export async function sendMessage(params) {
             accountId: params.accountId,
             mode: "explicit",
         });
-        if (!resolvedTarget.ok)
+        if (!resolvedTarget.ok) {
             throw resolvedTarget.error;
+        }
         const results = await deliverOutboundPayloads({
             cfg,
             channel: outboundChannel,
             to: resolvedTarget.to,
+            agentId: params.agentId,
             accountId: params.accountId,
             payloads: normalizedPayloads,
+            replyToId: params.replyToId,
+            threadId: params.threadId,
             gifPlayback: params.gifPlayback,
             deps: params.deps,
             bestEffort: params.bestEffort,
             abortSignal: params.abortSignal,
+            silent: params.silent,
             mirror: params.mirror
                 ? {
                     ...params.mirror,
@@ -93,10 +125,8 @@ export async function sendMessage(params) {
             result: results.at(-1),
         };
     }
-    const gateway = resolveGatewayOptions(params.gateway);
-    const result = await callGateway({
-        url: gateway.url,
-        token: gateway.token,
+    const result = await callMessageGateway({
+        gateway: params.gateway,
         method: "send",
         params: {
             to: params.to,
@@ -109,10 +139,6 @@ export async function sendMessage(params) {
             sessionKey: params.mirror?.sessionKey,
             idempotencyKey: params.idempotencyKey ?? randomIdempotencyKey(),
         },
-        timeoutMs: gateway.timeoutMs,
-        clientName: gateway.clientName,
-        clientDisplayName: gateway.clientDisplayName,
-        mode: gateway.mode,
     });
     return {
         channel,
@@ -125,19 +151,15 @@ export async function sendMessage(params) {
 }
 export async function sendPoll(params) {
     const cfg = params.cfg ?? loadConfig();
-    const channel = params.channel?.trim()
-        ? normalizeChannelId(params.channel)
-        : (await resolveMessageChannelSelection({ cfg })).channel;
-    if (!channel) {
-        throw new Error(`Unknown channel: ${params.channel}`);
-    }
+    const channel = await resolveRequiredChannel({ cfg, channel: params.channel });
     const pollInput = {
         question: params.question,
         options: params.options,
         maxSelections: params.maxSelections,
+        durationSeconds: params.durationSeconds,
         durationHours: params.durationHours,
     };
-    const plugin = getChannelPlugin(channel);
+    const plugin = resolveRequiredPlugin(channel);
     const outbound = plugin?.outbound;
     if (!outbound?.sendPoll) {
         throw new Error(`Unsupported poll channel: ${channel}`);
@@ -152,29 +174,29 @@ export async function sendPoll(params) {
             question: normalized.question,
             options: normalized.options,
             maxSelections: normalized.maxSelections,
+            durationSeconds: normalized.durationSeconds ?? null,
             durationHours: normalized.durationHours ?? null,
             via: "gateway",
             dryRun: true,
         };
     }
-    const gateway = resolveGatewayOptions(params.gateway);
-    const result = await callGateway({
-        url: gateway.url,
-        token: gateway.token,
+    const result = await callMessageGateway({
+        gateway: params.gateway,
         method: "poll",
         params: {
             to: params.to,
             question: normalized.question,
             options: normalized.options,
             maxSelections: normalized.maxSelections,
+            durationSeconds: normalized.durationSeconds,
             durationHours: normalized.durationHours,
+            threadId: params.threadId,
+            silent: params.silent,
+            isAnonymous: params.isAnonymous,
             channel,
+            accountId: params.accountId,
             idempotencyKey: params.idempotencyKey ?? randomIdempotencyKey(),
         },
-        timeoutMs: gateway.timeoutMs,
-        clientName: gateway.clientName,
-        clientDisplayName: gateway.clientDisplayName,
-        mode: gateway.mode,
     });
     return {
         channel,
@@ -182,6 +204,7 @@ export async function sendPoll(params) {
         question: normalized.question,
         options: normalized.options,
         maxSelections: normalized.maxSelections,
+        durationSeconds: normalized.durationSeconds ?? null,
         durationHours: normalized.durationHours ?? null,
         via: "gateway",
         result,

package/dist/infra/outbound/outbound-policy.js

@@ -1,5 +1,5 @@
+import { getChannelMessageAdapter, } from "./channel-adapters.js";
 import { normalizeTargetForProvider } from "./target-normalization.js";
-import { getChannelMessageAdapter } from "./channel-adapters.js";
 import { formatTargetDisplay, lookupDirectoryDisplay } from "./target-resolver.js";
 const CONTEXT_GUARDED_ACTIONS = new Set([
     "send",
@@ -21,42 +21,52 @@ const CONTEXT_MARKER_ACTIONS = new Set([
     "sticker",
 ]);
 function resolveContextGuardTarget(action, params) {
-    if (!CONTEXT_GUARDED_ACTIONS.has(action))
+    if (!CONTEXT_GUARDED_ACTIONS.has(action)) {
         return undefined;
+    }
     if (action === "thread-reply" || action === "thread-create") {
-        if (typeof params.channelId === "string")
+        if (typeof params.channelId === "string") {
             return params.channelId;
-        if (typeof params.to === "string")
+        }
+        if (typeof params.to === "string") {
             return params.to;
+        }
         return undefined;
     }
-    if (typeof params.to === "string")
+    if (typeof params.to === "string") {
         return params.to;
-    if (typeof params.channelId === "string")
+    }
+    if (typeof params.channelId === "string") {
         return params.channelId;
+    }
     return undefined;
 }
 function normalizeTarget(channel, raw) {
-    return normalizeTargetForProvider(channel, raw) ?? raw.trim().toLowerCase();
+    return normalizeTargetForProvider(channel, raw) ?? raw.trim();
 }
 function isCrossContextTarget(params) {
     const currentTarget = params.toolContext?.currentChannelId?.trim();
-    if (!currentTarget)
+    if (!currentTarget) {
         return false;
+    }
     const normalizedTarget = normalizeTarget(params.channel, params.target);
     const normalizedCurrent = normalizeTarget(params.channel, currentTarget);
-    if (!normalizedTarget || !normalizedCurrent)
+    if (!normalizedTarget || !normalizedCurrent) {
         return false;
+    }
     return normalizedTarget !== normalizedCurrent;
 }
 export function enforceCrossContextPolicy(params) {
     const currentTarget = params.toolContext?.currentChannelId?.trim();
-    if (!currentTarget)
+    if (!currentTarget) {
         return;
-    if (!CONTEXT_GUARDED_ACTIONS.has(params.action))
+    }
+    if (!CONTEXT_GUARDED_ACTIONS.has(params.action)) {
         return;
-    if (params.cfg.tools?.message?.allowCrossContextSend)
+    }
+    if (params.cfg.tools?.message?.allowCrossContextSend) {
         return;
+    }
     const currentProvider = params.toolContext?.currentChannelProvider;
     const allowWithinProvider = params.cfg.tools?.message?.crossContext?.allowWithinProvider !== false;
     const allowAcrossProviders = params.cfg.tools?.message?.crossContext?.allowAcrossProviders === true;
@@ -66,27 +76,33 @@ export function enforceCrossContextPolicy(params) {
         }
         return;
     }
-    if (allowWithinProvider)
+    if (allowWithinProvider) {
         return;
+    }
     const target = resolveContextGuardTarget(params.action, params.args);
-    if (!target)
+    if (!target) {
         return;
+    }
     if (!isCrossContextTarget({ channel: params.channel, target, toolContext: params.toolContext })) {
         return;
     }
     throw new Error(`Cross-context messaging denied: action=${params.action} target="${target}" while bound to "${currentTarget}" (channel=${params.channel}).`);
 }
 export async function buildCrossContextDecoration(params) {
-    if (!params.toolContext?.currentChannelId)
+    if (!params.toolContext?.currentChannelId) {
         return null;
+    }
     // Skip decoration for direct tool sends (agent composing, not forwarding)
-    if (params.toolContext.skipCrossContextDecoration)
+    if (params.toolContext.skipCrossContextDecoration) {
         return null;
-    if (!isCrossContextTarget(params))
+    }
+    if (!isCrossContextTarget(params)) {
         return null;
+    }
     const markerConfig = params.cfg.tools?.message?.crossContext?.marker;
-    if (markerConfig?.enabled === false)
+    if (markerConfig?.enabled === false) {
         return null;
+    }
     const currentName = (await lookupDirectoryDisplay({
         cfg: params.cfg,
         channel: params.channel,
@@ -104,19 +120,30 @@ export async function buildCrossContextDecoration(params) {
     const prefix = prefixTemplate.replaceAll("{channel}", originLabel);
     const suffix = suffixTemplate.replaceAll("{channel}", originLabel);
     const adapter = getChannelMessageAdapter(params.channel);
-    const embeds = adapter.supportsEmbeds
-        ? (adapter.buildCrossContextEmbeds?.(originLabel) ?? undefined)
+    const componentsBuilder = adapter.supportsComponentsV2
+        ? adapter.buildCrossContextComponents
+            ? (message) => adapter.buildCrossContextComponents({
+                originLabel,
+                message,
+                cfg: params.cfg,
+                accountId: params.accountId ?? undefined,
+            })
+            : undefined
         : undefined;
-    return { prefix, suffix, embeds };
+    return { prefix, suffix, componentsBuilder };
 }
 export function shouldApplyCrossContextMarker(action) {
     return CONTEXT_MARKER_ACTIONS.has(action);
 }
 export function applyCrossContextDecoration(params) {
-    const useEmbeds = params.preferEmbeds && params.decoration.embeds?.length;
-    if (useEmbeds) {
-        return { message: params.message, embeds: params.decoration.embeds, usedEmbeds: true };
+    const useComponents = params.preferComponents && params.decoration.componentsBuilder;
+    if (useComponents) {
+        return {
+            message: params.message,
+            componentsBuilder: params.decoration.componentsBuilder,
+            usedComponents: true,
+        };
     }
     const message = `${params.decoration.prefix}${params.message}${params.decoration.suffix}`;
-    return { message, usedEmbeds: false };
+    return { message, usedComponents: false };
 }

package/dist/infra/outbound/outbound-send-service.js

@@ -1,75 +1,68 @@
 import { dispatchChannelMessageAction } from "../../channels/plugins/message-actions.js";
 import { appendAssistantMessageToSessionTranscript } from "../../config/sessions.js";
+import { throwIfAborted } from "./abort.js";
 import { sendMessage, sendPoll } from "./message.js";
-function extractToolPayload(result) {
-    if (result.details !== undefined)
-        return result.details;
-    const textBlock = Array.isArray(result.content)
-        ? result.content.find((block) => block &&
-            typeof block === "object" &&
-            block.type === "text" &&
-            typeof block.text === "string")
-        : undefined;
-    const text = textBlock?.text;
-    if (text) {
-        try {
-            return JSON.parse(text);
-        }
-        catch {
-            return text;
-        }
+import { extractToolPayload } from "./tool-payload.js";
+async function tryHandleWithPluginAction(params) {
+    if (params.ctx.dryRun) {
+        return null;
     }
-    return result.content ?? result;
-}
-function throwIfAborted(abortSignal) {
-    if (abortSignal?.aborted) {
-        const err = new Error("Message send aborted");
-        err.name = "AbortError";
-        throw err;
+    const handled = await dispatchChannelMessageAction({
+        channel: params.ctx.channel,
+        action: params.action,
+        cfg: params.ctx.cfg,
+        params: params.ctx.params,
+        accountId: params.ctx.accountId ?? undefined,
+        gateway: params.ctx.gateway,
+        toolContext: params.ctx.toolContext,
+        dryRun: params.ctx.dryRun,
+    });
+    if (!handled) {
+        return null;
     }
+    await params.onHandled?.();
+    return {
+        handledBy: "plugin",
+        payload: extractToolPayload(handled),
+        toolResult: handled,
+    };
 }
 export async function executeSendAction(params) {
     throwIfAborted(params.ctx.abortSignal);
-    if (!params.ctx.dryRun) {
-        const handled = await dispatchChannelMessageAction({
-            channel: params.ctx.channel,
-            action: "send",
-            cfg: params.ctx.cfg,
-            params: params.ctx.params,
-            accountId: params.ctx.accountId ?? undefined,
-            gateway: params.ctx.gateway,
-            toolContext: params.ctx.toolContext,
-            dryRun: params.ctx.dryRun,
-        });
-        if (handled) {
-            if (params.ctx.mirror) {
-                const mirrorText = params.ctx.mirror.text ?? params.message;
-                const mirrorMediaUrls = params.ctx.mirror.mediaUrls ??
-                    params.mediaUrls ??
-                    (params.mediaUrl ? [params.mediaUrl] : undefined);
-                await appendAssistantMessageToSessionTranscript({
-                    agentId: params.ctx.mirror.agentId,
-                    sessionKey: params.ctx.mirror.sessionKey,
-                    text: mirrorText,
-                    mediaUrls: mirrorMediaUrls,
-                });
+    const pluginHandled = await tryHandleWithPluginAction({
+        ctx: params.ctx,
+        action: "send",
+        onHandled: async () => {
+            if (!params.ctx.mirror) {
+                return;
             }
-            return {
-                handledBy: "plugin",
-                payload: extractToolPayload(handled),
-                toolResult: handled,
-            };
-        }
+            const mirrorText = params.ctx.mirror.text ?? params.message;
+            const mirrorMediaUrls = params.ctx.mirror.mediaUrls ??
+                params.mediaUrls ??
+                (params.mediaUrl ? [params.mediaUrl] : undefined);
+            await appendAssistantMessageToSessionTranscript({
+                agentId: params.ctx.mirror.agentId,
+                sessionKey: params.ctx.mirror.sessionKey,
+                text: mirrorText,
+                mediaUrls: mirrorMediaUrls,
+            });
+        },
+    });
+    if (pluginHandled) {
+        return pluginHandled;
     }
     throwIfAborted(params.ctx.abortSignal);
     const result = await sendMessage({
         cfg: params.ctx.cfg,
         to: params.to,
         content: params.message,
+        agentId: params.ctx.agentId,
         mediaUrl: params.mediaUrl || undefined,
         mediaUrls: params.mediaUrls,
         channel: params.ctx.channel || undefined,
         accountId: params.ctx.accountId ?? undefined,
+        replyToId: params.replyToId,
+        threadId: params.threadId,
         gifPlayback: params.gifPlayback,
         dryRun: params.ctx.dryRun,
         bestEffort: params.bestEffort ?? undefined,
@@ -77,6 +70,7 @@ export async function executeSendAction(params) {
         gateway: params.ctx.gateway,
         mirror: params.ctx.mirror,
         abortSignal: params.ctx.abortSignal,
+        silent: params.ctx.silent,
     });
     return {
         handledBy: "core",
@@ -85,24 +79,12 @@ export async function executeSendAction(params) {
     };
 }
 export async function executePollAction(params) {
-    if (!params.ctx.dryRun) {
-        const handled = await dispatchChannelMessageAction({
-            channel: params.ctx.channel,
-            action: "poll",
-            cfg: params.ctx.cfg,
-            params: params.ctx.params,
-            accountId: params.ctx.accountId ?? undefined,
-            gateway: params.ctx.gateway,
-            toolContext: params.ctx.toolContext,
-            dryRun: params.ctx.dryRun,
-        });
-        if (handled) {
-            return {
-                handledBy: "plugin",
-                payload: extractToolPayload(handled),
-                toolResult: handled,
-            };
-        }
+    const pluginHandled = await tryHandleWithPluginAction({
+        ctx: params.ctx,
+        action: "poll",
+    });
+    if (pluginHandled) {
+        return pluginHandled;
     }
     const result = await sendPoll({
         cfg: params.ctx.cfg,
@@ -110,8 +92,13 @@ export async function executePollAction(params) {
         question: params.question,
         options: params.options,
         maxSelections: params.maxSelections,
+        durationSeconds: params.durationSeconds ?? undefined,
         durationHours: params.durationHours ?? undefined,
         channel: params.ctx.channel,
+        accountId: params.ctx.accountId ?? undefined,
+        threadId: params.threadId ?? undefined,
+        silent: params.ctx.silent ?? undefined,
+        isAnonymous: params.isAnonymous ?? undefined,
         dryRun: params.ctx.dryRun,
         gateway: params.ctx.gateway,
     });

package/dist/infra/pairing-files.js

@@ -17,3 +17,13 @@ export function pruneExpiredPending(pendingById, nowMs, ttlMs) {
         }
     }
 }
+export async function upsertPendingPairingRequest(params) {
+    const existing = Object.values(params.pendingById).find(params.isExisting);
+    if (existing) {
+        return { status: "pending", request: existing, created: false };
+    }
+    const request = params.createRequest(params.isRepair);
+    params.pendingById[request.requestId] = request;
+    await params.persist();
+    return { status: "pending", request, created: true };
+}

package/dist/infra/plain-object.js

@@ -0,0 +1,9 @@
+/**
+ * Strict plain-object guard (excludes arrays and host objects).
+ */
+export function isPlainObject(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value) &&
+        Object.prototype.toString.call(value) === "[object Object]");
+}