@poolzin/pool-bot 2026.2.24 → 2026.2.26

package/dist/infra/update-channels.js

@@ -2,18 +2,22 @@ export const DEFAULT_PACKAGE_CHANNEL = "stable";
 export const DEFAULT_GIT_CHANNEL = "dev";
 export const DEV_BRANCH = "main";
 export function normalizeUpdateChannel(value) {
-    if (!value)
+    if (!value) {
         return null;
+    }
     const normalized = value.trim().toLowerCase();
-    if (normalized === "stable" || normalized === "beta" || normalized === "dev")
+    if (normalized === "stable" || normalized === "beta" || normalized === "dev") {
         return normalized;
+    }
     return null;
 }
 export function channelToNpmTag(channel) {
-    if (channel === "beta")
+    if (channel === "beta") {
         return "beta";
-    if (channel === "dev")
+    }
+    if (channel === "dev") {
         return "dev";
+    }
     return "latest";
 }
 export function isBetaTag(tag) {
@@ -43,8 +47,9 @@ export function resolveEffectiveUpdateChannel(params) {
     return { channel: DEFAULT_PACKAGE_CHANNEL, source: "default" };
 }
 export function formatUpdateChannelLabel(params) {
-    if (params.source === "config")
+    if (params.source === "config") {
         return `${params.channel} (config)`;
+    }
     if (params.source === "git-tag") {
         return params.gitTag ? `${params.channel} (${params.gitTag})` : `${params.channel} (tag)`;
     }

package/dist/infra/update-startup.js

@@ -1,18 +1,27 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+import { formatCliCommand } from "../cli/command-format.js";
 import { resolveStateDir } from "../config/paths.js";
+import { VERSION } from "../version.js";
 import { resolvePoolBotPackageRoot } from "./poolbot-root.js";
-import { compareSemverStrings, resolveNpmChannelTag, checkUpdateStatus } from "./update-check.js";
 import { normalizeUpdateChannel, DEFAULT_PACKAGE_CHANNEL } from "./update-channels.js";
-import { VERSION } from "../version.js";
-import { formatCliCommand } from "../cli/command-format.js";
+import { compareSemverStrings, resolveNpmChannelTag, checkUpdateStatus } from "./update-check.js";
+let updateAvailableCache = null;
+export function getUpdateAvailable() {
+    return updateAvailableCache;
+}
+export function resetUpdateAvailableStateForTest() {
+    updateAvailableCache = null;
+}
 const UPDATE_CHECK_FILENAME = "update-check.json";
 const UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 function shouldSkipCheck(allowInTests) {
-    if (allowInTests)
+    if (allowInTests) {
         return false;
-    if (process.env.VITEST || process.env.NODE_ENV === "test")
+    }
+    if (process.env.VITEST || process.env.NODE_ENV === "test") {
         return true;
+    }
     return false;
 }
 async function readState(statePath) {
@@ -29,20 +38,63 @@ async function writeState(statePath, state) {
     await fs.mkdir(path.dirname(statePath), { recursive: true });
     await fs.writeFile(statePath, JSON.stringify(state, null, 2), "utf-8");
 }
+function sameUpdateAvailable(a, b) {
+    if (a === b) {
+        return true;
+    }
+    if (!a || !b) {
+        return false;
+    }
+    return (a.currentVersion === b.currentVersion &&
+        a.latestVersion === b.latestVersion &&
+        a.channel === b.channel);
+}
+function setUpdateAvailableCache(params) {
+    if (sameUpdateAvailable(updateAvailableCache, params.next)) {
+        return;
+    }
+    updateAvailableCache = params.next;
+    params.onUpdateAvailableChange?.(params.next);
+}
+function resolvePersistedUpdateAvailable(state) {
+    const latestVersion = state.lastAvailableVersion?.trim();
+    if (!latestVersion) {
+        return null;
+    }
+    const cmp = compareSemverStrings(VERSION, latestVersion);
+    if (cmp == null || cmp >= 0) {
+        return null;
+    }
+    const channel = state.lastAvailableTag?.trim() || DEFAULT_PACKAGE_CHANNEL;
+    return {
+        currentVersion: VERSION,
+        latestVersion,
+        channel,
+    };
+}
 export async function runGatewayUpdateCheck(params) {
-    if (shouldSkipCheck(Boolean(params.allowInTests)))
+    if (shouldSkipCheck(Boolean(params.allowInTests))) {
         return;
-    if (params.isNixMode)
+    }
+    if (params.isNixMode) {
         return;
-    if (params.cfg.update?.checkOnStart === false)
+    }
+    if (params.cfg.update?.checkOnStart === false) {
         return;
+    }
     const statePath = path.join(resolveStateDir(), UPDATE_CHECK_FILENAME);
     const state = await readState(statePath);
     const now = Date.now();
     const lastCheckedAt = state.lastCheckedAt ? Date.parse(state.lastCheckedAt) : null;
+    const persistedAvailable = resolvePersistedUpdateAvailable(state);
+    setUpdateAvailableCache({
+        next: persistedAvailable,
+        onUpdateAvailableChange: params.onUpdateAvailableChange,
+    });
     if (lastCheckedAt && Number.isFinite(lastCheckedAt)) {
-        if (now - lastCheckedAt < UPDATE_CHECK_INTERVAL_MS)
+        if (now - lastCheckedAt < UPDATE_CHECK_INTERVAL_MS) {
             return;
+        }
     }
     const root = await resolvePoolBotPackageRoot({
         moduleUrl: import.meta.url,
@@ -60,6 +112,12 @@ export async function runGatewayUpdateCheck(params) {
         lastCheckedAt: new Date(now).toISOString(),
     };
     if (status.installKind !== "package") {
+        delete nextState.lastAvailableVersion;
+        delete nextState.lastAvailableTag;
+        setUpdateAvailableCache({
+            next: null,
+            onUpdateAvailableChange: params.onUpdateAvailableChange,
+        });
         await writeState(statePath, nextState);
         return;
     }
@@ -72,6 +130,17 @@ export async function runGatewayUpdateCheck(params) {
     }
     const cmp = compareSemverStrings(VERSION, resolved.version);
     if (cmp != null && cmp < 0) {
+        const nextAvailable = {
+            currentVersion: VERSION,
+            latestVersion: resolved.version,
+            channel: tag,
+        };
+        setUpdateAvailableCache({
+            next: nextAvailable,
+            onUpdateAvailableChange: params.onUpdateAvailableChange,
+        });
+        nextState.lastAvailableVersion = resolved.version;
+        nextState.lastAvailableTag = tag;
         const shouldNotify = state.lastNotifiedVersion !== resolved.version || state.lastNotifiedTag !== tag;
         if (shouldNotify) {
             params.log.info(`update available (${tag}): v${resolved.version} (current v${VERSION}). Run: ${formatCliCommand("poolbot update")}`);
@@ -79,6 +148,14 @@ export async function runGatewayUpdateCheck(params) {
             nextState.lastNotifiedTag = tag;
         }
     }
+    else {
+        delete nextState.lastAvailableVersion;
+        delete nextState.lastAvailableTag;
+        setUpdateAvailableCache({
+            next: null,
+            onUpdateAvailableChange: params.onUpdateAvailableChange,
+        });
+    }
     await writeState(statePath, nextState);
 }
 export function scheduleGatewayUpdateCheck(params) {

package/dist/line/accounts.js

@@ -1,8 +1,10 @@
 import fs from "node:fs";
-export const DEFAULT_ACCOUNT_ID = "default";
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId as normalizeSharedAccountId, } from "../routing/account-id.js";
+export { DEFAULT_ACCOUNT_ID } from "../routing/account-id.js";
 function readFileIfExists(filePath) {
-    if (!filePath)
+    if (!filePath) {
         return undefined;
+    }
     try {
         return fs.readFileSync(filePath, "utf-8").trim();
     }
@@ -122,9 +124,5 @@ export function resolveDefaultLineAccountId(cfg) {
     return ids[0] ?? DEFAULT_ACCOUNT_ID;
 }
 export function normalizeAccountId(accountId) {
-    const trimmed = accountId?.trim().toLowerCase();
-    if (!trimmed || trimmed === "default") {
-        return DEFAULT_ACCOUNT_ID;
-    }
-    return trimmed;
+    return normalizeSharedAccountId(accountId);
 }

package/dist/line/bot-access.js

@@ -1,9 +1,12 @@
+import { firstDefined, isSenderIdAllowed, mergeAllowFromSources } from "../channels/allow-from.js";
 function normalizeAllowEntry(value) {
     const trimmed = String(value).trim();
-    if (!trimmed)
+    if (!trimmed) {
         return "";
-    if (trimmed === "*")
+    }
+    if (trimmed === "*") {
         return "*";
+    }
     return trimmed.replace(/^line:(?:user:)?/i, "");
 }
 export const normalizeAllowFrom = (list) => {
@@ -15,24 +18,9 @@ export const normalizeAllowFrom = (list) => {
         hasEntries: entries.length > 0,
     };
 };
-export const normalizeAllowFromWithStore = (params) => {
-    const combined = [...(params.allowFrom ?? []), ...(params.storeAllowFrom ?? [])];
-    return normalizeAllowFrom(combined);
-};
-export const firstDefined = (...values) => {
-    for (const value of values) {
-        if (typeof value !== "undefined")
-            return value;
-    }
-    return undefined;
-};
+export const normalizeAllowFromWithStore = (params) => normalizeAllowFrom(mergeAllowFromSources(params));
 export const isSenderAllowed = (params) => {
     const { allow, senderId } = params;
-    if (!allow.hasEntries)
-        return false;
-    if (allow.hasWildcard)
-        return true;
-    if (!senderId)
-        return false;
-    return allow.entries.includes(senderId);
+    return isSenderIdAllowed(allow, senderId, false);
 };
+export { firstDefined };

package/dist/line/bot-handlers.js

@@ -77,10 +77,12 @@ async function shouldProcessLineEvent(event, context) {
     const { cfg, account } = context;
     const { userId, groupId, roomId, isGroup } = getSourceInfo(event.source);
     const senderId = userId ?? "";
+    const dmPolicy = account.config.dmPolicy ?? "pairing";
     const storeAllowFrom = await readChannelAllowFromStore("line").catch(() => []);
     const effectiveDmAllow = normalizeAllowFromWithStore({
         allowFrom: account.config.allowFrom,
         storeAllowFrom,
+        dmPolicy,
     });
     const groupConfig = resolveLineGroupConfig({ config: account.config, groupId, roomId });
     const groupAllowOverride = groupConfig?.allowFrom;
@@ -91,8 +93,8 @@ async function shouldProcessLineEvent(event, context) {
     const effectiveGroupAllow = normalizeAllowFromWithStore({
         allowFrom: groupAllowFrom,
         storeAllowFrom,
+        dmPolicy,
     });
-    const dmPolicy = account.config.dmPolicy ?? "pairing";
     const defaultGroupPolicy = cfg.channels?.defaults?.groupPolicy;
     const groupPolicy = account.config.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
     if (isGroup) {

package/dist/link-understanding/detect.js

@@ -1,3 +1,4 @@
+import { isBlockedHostnameOrIp } from "../infra/net/ssrf.js";
 import { DEFAULT_MAX_LINKS } from "./defaults.js";
 // Remove markdown link syntax so only bare URLs are considered.
 const MARKDOWN_LINK_RE = /\[[^\]]*]\((https?:\/\/\S+?)\)/gi;
@@ -14,10 +15,12 @@ function resolveMaxLinks(value) {
 function isAllowedUrl(raw) {
     try {
         const parsed = new URL(raw);
-        if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
             return false;
-        if (parsed.hostname === "127.0.0.1")
+        }
+        if (isBlockedHostnameOrIp(parsed.hostname)) {
             return false;
+        }
         return true;
     }
     catch {
@@ -26,24 +29,29 @@ function isAllowedUrl(raw) {
 }
 export function extractLinksFromMessage(message, opts) {
     const source = message?.trim();
-    if (!source)
+    if (!source) {
         return [];
+    }
     const maxLinks = resolveMaxLinks(opts?.maxLinks);
     const sanitized = stripMarkdownLinks(source);
     const seen = new Set();
     const results = [];
     for (const match of sanitized.matchAll(BARE_LINK_RE)) {
         const raw = match[0]?.trim();
-        if (!raw)
+        if (!raw) {
             continue;
-        if (!isAllowedUrl(raw))
+        }
+        if (!isAllowedUrl(raw)) {
             continue;
-        if (seen.has(raw))
+        }
+        if (seen.has(raw)) {
             continue;
+        }
         seen.add(raw);
         results.push(raw);
-        if (results.length >= maxLinks)
+        if (results.length >= maxLinks) {
             break;
+        }
     }
     return results;
 }

package/dist/media/constants.js

@@ -3,18 +3,27 @@ export const MAX_AUDIO_BYTES = 16 * 1024 * 1024; // 16MB
 export const MAX_VIDEO_BYTES = 16 * 1024 * 1024; // 16MB
 export const MAX_DOCUMENT_BYTES = 100 * 1024 * 1024; // 100MB
 export function mediaKindFromMime(mime) {
-    if (!mime)
+    if (!mime) {
         return "unknown";
-    if (mime.startsWith("image/"))
+    }
+    if (mime.startsWith("image/")) {
         return "image";
-    if (mime.startsWith("audio/"))
+    }
+    if (mime.startsWith("audio/")) {
         return "audio";
-    if (mime.startsWith("video/"))
+    }
+    if (mime.startsWith("video/")) {
         return "video";
-    if (mime === "application/pdf")
+    }
+    if (mime === "application/pdf") {
         return "document";
-    if (mime.startsWith("application/"))
+    }
+    if (mime.startsWith("text/")) {
+        return "document";
+    }
+    if (mime.startsWith("application/")) {
         return "document";
+    }
     return "unknown";
 }
 export function maxBytesForKind(kind) {

package/dist/media/image-ops.js

@@ -2,6 +2,13 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { runExec } from "../process/exec.js";
+export const IMAGE_REDUCE_QUALITY_STEPS = [85, 75, 65, 55, 45, 35];
+export function buildImageResizeSideGrid(maxSide, sideStart) {
+    return [sideStart, 1800, 1600, 1400, 1200, 1000, 800]
+        .map((value) => Math.min(maxSide, value))
+        .filter((value, idx, arr) => value > 0 && arr.indexOf(value) === idx)
+        .toSorted((a, b) => b - a);
+}
 function isBun() {
     return typeof process.versions.bun === "string";
 }

package/dist/media/inbound-path-policy.js

@@ -0,0 +1,114 @@
+import path from "node:path";
+const WILDCARD_SEGMENT = "*";
+const WINDOWS_DRIVE_ABS_RE = /^[A-Za-z]:\//;
+const WINDOWS_DRIVE_ROOT_RE = /^[A-Za-z]:$/;
+export const DEFAULT_IMESSAGE_ATTACHMENT_ROOTS = ["/Users/*/Library/Messages/Attachments"];
+function normalizePosixAbsolutePath(value) {
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.includes("\0")) {
+        return undefined;
+    }
+    const normalized = path.posix.normalize(trimmed.replaceAll("\\", "/"));
+    const isAbsolute = normalized.startsWith("/") || WINDOWS_DRIVE_ABS_RE.test(normalized);
+    if (!isAbsolute || normalized === "/") {
+        return undefined;
+    }
+    const withoutTrailingSlash = normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
+    if (WINDOWS_DRIVE_ROOT_RE.test(withoutTrailingSlash)) {
+        return undefined;
+    }
+    return withoutTrailingSlash;
+}
+function splitPathSegments(value) {
+    return value.split("/").filter(Boolean);
+}
+function matchesRootPattern(params) {
+    const candidateSegments = splitPathSegments(params.candidatePath);
+    const rootSegments = splitPathSegments(params.rootPattern);
+    if (candidateSegments.length < rootSegments.length) {
+        return false;
+    }
+    for (let idx = 0; idx < rootSegments.length; idx += 1) {
+        const expected = rootSegments[idx];
+        const actual = candidateSegments[idx];
+        if (expected === WILDCARD_SEGMENT) {
+            continue;
+        }
+        if (expected !== actual) {
+            return false;
+        }
+    }
+    return true;
+}
+export function isValidInboundPathRootPattern(value) {
+    const normalized = normalizePosixAbsolutePath(value);
+    if (!normalized) {
+        return false;
+    }
+    const segments = splitPathSegments(normalized);
+    if (segments.length === 0) {
+        return false;
+    }
+    return segments.every((segment) => segment === WILDCARD_SEGMENT || !segment.includes("*"));
+}
+export function normalizeInboundPathRoots(roots) {
+    const normalized = [];
+    const seen = new Set();
+    for (const root of roots ?? []) {
+        if (typeof root !== "string") {
+            continue;
+        }
+        if (!isValidInboundPathRootPattern(root)) {
+            continue;
+        }
+        const candidate = normalizePosixAbsolutePath(root);
+        if (!candidate || seen.has(candidate)) {
+            continue;
+        }
+        seen.add(candidate);
+        normalized.push(candidate);
+    }
+    return normalized;
+}
+export function mergeInboundPathRoots(...rootsLists) {
+    const merged = [];
+    const seen = new Set();
+    for (const roots of rootsLists) {
+        const normalized = normalizeInboundPathRoots(roots);
+        for (const root of normalized) {
+            if (seen.has(root)) {
+                continue;
+            }
+            seen.add(root);
+            merged.push(root);
+        }
+    }
+    return merged;
+}
+export function isInboundPathAllowed(params) {
+    const candidatePath = normalizePosixAbsolutePath(params.filePath);
+    if (!candidatePath) {
+        return false;
+    }
+    const roots = normalizeInboundPathRoots(params.roots);
+    const effectiveRoots = roots.length > 0 ? roots : normalizeInboundPathRoots(params.fallbackRoots ?? undefined);
+    if (effectiveRoots.length === 0) {
+        return false;
+    }
+    return effectiveRoots.some((rootPattern) => matchesRootPattern({ candidatePath, rootPattern }));
+}
+function resolveIMessageAccountConfig(params) {
+    const accountId = params.accountId?.trim();
+    if (!accountId) {
+        return undefined;
+    }
+    return params.cfg.channels?.imessage?.accounts?.[accountId];
+}
+export function resolveIMessageAttachmentRoots(params) {
+    const accountConfig = resolveIMessageAccountConfig(params);
+    return mergeInboundPathRoots(accountConfig?.attachmentRoots, params.cfg.channels?.imessage?.attachmentRoots, DEFAULT_IMESSAGE_ATTACHMENT_ROOTS);
+}
+export function resolveIMessageRemoteAttachmentRoots(params) {
+    const accountConfig = resolveIMessageAccountConfig(params);
+    return mergeInboundPathRoots(accountConfig?.remoteAttachmentRoots, params.cfg.channels?.imessage?.remoteAttachmentRoots, accountConfig?.attachmentRoots, params.cfg.channels?.imessage?.attachmentRoots, DEFAULT_IMESSAGE_ATTACHMENT_ROOTS);
+}

package/dist/media/input-files.js

@@ -62,6 +62,22 @@ export function normalizeMimeList(values, fallback) {
     const input = values && values.length > 0 ? values : fallback;
     return new Set(input.map((value) => normalizeMimeType(value)).filter(Boolean));
 }
+export function resolveInputFileLimits(config) {
+    return {
+        allowUrl: config?.allowUrl ?? true,
+        allowedMimes: normalizeMimeList(config?.allowedMimes, DEFAULT_INPUT_FILE_MIMES),
+        maxBytes: config?.maxBytes ?? DEFAULT_INPUT_FILE_MAX_BYTES,
+        maxChars: config?.maxChars ?? DEFAULT_INPUT_FILE_MAX_CHARS,
+        maxRedirects: config?.maxRedirects ?? DEFAULT_INPUT_MAX_REDIRECTS,
+        timeoutMs: config?.timeoutMs ?? DEFAULT_INPUT_TIMEOUT_MS,
+        urlAllowlist: config?.urlAllowlist,
+        pdf: {
+            maxPages: config?.pdf?.maxPages ?? DEFAULT_INPUT_PDF_MAX_PAGES,
+            maxPixels: config?.pdf?.maxPixels ?? DEFAULT_INPUT_PDF_MAX_PIXELS,
+            minTextChars: config?.pdf?.minTextChars ?? DEFAULT_INPUT_PDF_MIN_TEXT_CHARS,
+        },
+    };
+}
 export async function fetchWithGuard(params) {
     let currentUrl = params.url;
     let redirectCount = 0;

package/dist/media/local-roots.js

@@ -1,11 +1,12 @@
-import os from "node:os";
 import path from "node:path";
+import { resolvePreferredPoolbotTmpDir } from "../infra/tmp-poolbot-dir.js";
 import { resolveAgentWorkspaceDir } from "../agents/agent-scope.js";
 import { resolveStateDir } from "../config/paths.js";
 function buildMediaLocalRoots(stateDir) {
     const resolvedStateDir = path.resolve(stateDir);
+    const preferredTmpDir = resolvePreferredPoolbotTmpDir();
     return [
-        os.tmpdir(),
+        preferredTmpDir,
         path.join(resolvedStateDir, "media"),
         path.join(resolvedStateDir, "agents"),
         path.join(resolvedStateDir, "workspace"),

package/dist/media-understanding/apply.js

@@ -315,7 +315,10 @@ async function extractFileBlocks(params) {
         }
         const utf16Charset = resolveUtf16Charset(bufferResult?.buffer);
         const textSample = decodeTextSample(bufferResult?.buffer);
-        const textLike = Boolean(utf16Charset) || looksLikeUtf8Text(bufferResult?.buffer);
+        // Do not coerce real PDFs into text/plain via printable-byte heuristics.
+        // PDFs have a dedicated extraction path in extractFileContentFromSource.
+        const allowTextHeuristic = normalizedRawMime !== "application/pdf";
+        const textLike = allowTextHeuristic && (Boolean(utf16Charset) || looksLikeUtf8Text(bufferResult?.buffer));
         const guessedDelimited = textLike ? guessDelimitedMime(textSample) : undefined;
         const textHint = forcedTextMimeResolved ?? guessedDelimited ?? (textLike ? "text/plain" : undefined);
         const mimeType = sanitizeMimeType(textHint ?? normalizeMimeType(rawMime));

package/dist/media-understanding/concurrency.js

@@ -1,26 +1,14 @@
 import { logVerbose, shouldLogVerbose } from "../globals.js";
+import { runTasksWithConcurrency } from "../utils/run-with-concurrency.js";
 export async function runWithConcurrency(tasks, limit) {
-    if (tasks.length === 0)
-        return [];
-    const resolvedLimit = Math.max(1, Math.min(limit, tasks.length));
-    const results = Array.from({ length: tasks.length });
-    let next = 0;
-    const workers = Array.from({ length: resolvedLimit }, async () => {
-        while (true) {
-            const index = next;
-            next += 1;
-            if (index >= tasks.length)
-                return;
-            try {
-                results[index] = await tasks[index]();
+    const { results } = await runTasksWithConcurrency({
+        tasks,
+        limit,
+        onTaskError(err) {
+            if (shouldLogVerbose()) {
+                logVerbose(`Media understanding task failed: ${String(err)}`);
             }
-            catch (err) {
-                if (shouldLogVerbose()) {
-                    logVerbose(`Media understanding task failed: ${String(err)}`);
-                }
-            }
-        }
+        },
     });
-    await Promise.allSettled(workers);
     return results;
 }