@poolzin/pool-bot 2026.2.24 → 2026.2.26

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (646) hide show
  1. package/CHANGELOG.md +21 -0
  2. package/dist/acp/client.js +207 -18
  3. package/dist/acp/event-mapper.js +87 -22
  4. package/dist/acp/meta.js +12 -6
  5. package/dist/acp/secret-file.js +22 -0
  6. package/dist/agents/agent-paths.js +8 -9
  7. package/dist/agents/agent-scope.js +17 -5
  8. package/dist/agents/auth-profiles/oauth.js +148 -64
  9. package/dist/agents/auth-profiles/session-override.js +13 -7
  10. package/dist/agents/bash-process-registry.test-helpers.js +29 -0
  11. package/dist/agents/bash-tools.exec-approval-request.js +20 -0
  12. package/dist/agents/bash-tools.exec-host-gateway.js +240 -0
  13. package/dist/agents/bash-tools.exec-host-node.js +235 -0
  14. package/dist/agents/bash-tools.exec-runtime.js +2 -25
  15. package/dist/agents/bash-tools.exec-types.js +1 -0
  16. package/dist/agents/bash-tools.process.js +224 -218
  17. package/dist/agents/bedrock-discovery.js +3 -1
  18. package/dist/agents/byteplus-models.js +97 -0
  19. package/dist/agents/chutes-oauth.js +1 -0
  20. package/dist/agents/cli-runner/helpers.js +4 -0
  21. package/dist/agents/compaction.js +41 -14
  22. package/dist/agents/content-blocks.js +16 -0
  23. package/dist/agents/doubao-models.js +121 -0
  24. package/dist/agents/failover-error.js +2 -0
  25. package/dist/agents/huggingface-models.js +5 -3
  26. package/dist/agents/live-model-filter.js +5 -0
  27. package/dist/agents/minimax-vlm.js +10 -8
  28. package/dist/agents/model-auth.js +6 -0
  29. package/dist/agents/model-catalog.js +3 -1
  30. package/dist/agents/model-fallback.js +96 -101
  31. package/dist/agents/model-selection.js +7 -1
  32. package/dist/agents/models-config.providers.js +364 -165
  33. package/dist/agents/ollama-stream.js +117 -4
  34. package/dist/agents/opencode-zen-models.js +22 -11
  35. package/dist/agents/pi-embedded-helpers/errors.js +55 -33
  36. package/dist/agents/pi-embedded-helpers/messaging-dedupe.js +10 -5
  37. package/dist/agents/pi-embedded-helpers/thinking.js +10 -5
  38. package/dist/agents/pi-embedded-helpers.js +1 -1
  39. package/dist/agents/pi-embedded-payloads.js +1 -0
  40. package/dist/agents/pi-embedded-runner/compact.js +29 -7
  41. package/dist/agents/pi-embedded-runner/extensions.js +28 -26
  42. package/dist/agents/pi-embedded-runner/google.js +20 -8
  43. package/dist/agents/pi-embedded-runner/run/attempt.js +95 -36
  44. package/dist/agents/pi-embedded-runner/run.js +71 -12
  45. package/dist/agents/pi-embedded-runner/run.overflow-compaction.fixture.js +34 -0
  46. package/dist/agents/pi-embedded-runner/run.overflow-compaction.mocks.shared.js +11 -2
  47. package/dist/agents/pi-embedded-runner/session-manager-cache.js +11 -7
  48. package/dist/agents/pi-embedded-runner/system-prompt.js +2 -0
  49. package/dist/agents/pi-embedded-runner/thinking.js +42 -0
  50. package/dist/agents/pi-embedded-runner/tool-name-allowlist.js +19 -0
  51. package/dist/agents/pi-embedded-runner/utils.js +7 -10
  52. package/dist/agents/pi-embedded-subscribe.handlers.lifecycle.js +45 -56
  53. package/dist/agents/pi-embedded-subscribe.handlers.tools.js +2 -2
  54. package/dist/agents/pi-embedded-subscribe.js +9 -4
  55. package/dist/agents/pi-embedded-subscribe.tools.js +68 -14
  56. package/dist/agents/pi-embedded-utils.js +3 -0
  57. package/dist/agents/pi-extensions/compaction-safeguard-runtime.js +4 -20
  58. package/dist/agents/pi-extensions/compaction-safeguard.js +75 -33
  59. package/dist/agents/pi-settings.js +40 -0
  60. package/dist/agents/pi-tools.policy.js +2 -1
  61. package/dist/agents/provider/config-loader.js +1 -1
  62. package/dist/agents/sandbox/browser.js +170 -33
  63. package/dist/agents/sandbox/config-hash.js +14 -27
  64. package/dist/agents/sandbox/config.js +21 -2
  65. package/dist/agents/sandbox/constants.js +2 -0
  66. package/dist/agents/sandbox/docker.js +16 -2
  67. package/dist/agents/sandbox/novnc-auth.js +62 -0
  68. package/dist/agents/sandbox/sanitize-env-vars.js +1 -1
  69. package/dist/agents/sandbox/shared.js +10 -6
  70. package/dist/agents/sandbox-paths.js +24 -11
  71. package/dist/agents/schema/clean-for-gemini.js +132 -85
  72. package/dist/agents/session-slug.js +10 -5
  73. package/dist/agents/session-tool-result-guard-wrapper.js +1 -0
  74. package/dist/agents/session-tool-result-guard.js +3 -1
  75. package/dist/agents/session-transcript-repair.js +40 -6
  76. package/dist/agents/skills/bundled-dir.js +19 -5
  77. package/dist/agents/skills/env-overrides.js +124 -43
  78. package/dist/agents/skills/frontmatter.js +6 -6
  79. package/dist/agents/skills/plugin-skills.js +14 -7
  80. package/dist/agents/skills/workspace.js +1 -0
  81. package/dist/agents/skills.test-helpers.js +13 -0
  82. package/dist/agents/stable-stringify.js +12 -0
  83. package/dist/agents/subagent-announce.js +251 -49
  84. package/dist/agents/subagent-lifecycle-events.js +19 -0
  85. package/dist/agents/subagent-registry-cleanup.js +31 -0
  86. package/dist/agents/subagent-registry-completion.js +68 -0
  87. package/dist/agents/subagent-registry-queries.js +117 -0
  88. package/dist/agents/subagent-registry-state.js +46 -0
  89. package/dist/agents/subagent-registry.js +252 -221
  90. package/dist/agents/subagent-registry.mocks.shared.js +12 -0
  91. package/dist/agents/subagent-registry.store.js +1 -0
  92. package/dist/agents/subagent-registry.types.js +1 -0
  93. package/dist/agents/subagent-spawn.js +195 -7
  94. package/dist/agents/system-prompt.js +22 -6
  95. package/dist/agents/test-helpers/assistant-message-fixtures.js +29 -0
  96. package/dist/agents/test-helpers/fast-coding-tools.js +1 -18
  97. package/dist/agents/test-helpers/fast-core-tools.js +1 -17
  98. package/dist/agents/test-helpers/pi-tools-sandbox-context.js +27 -0
  99. package/dist/agents/timeout.js +18 -6
  100. package/dist/agents/tool-call-id.js +1 -1
  101. package/dist/agents/tool-display-common.js +162 -29
  102. package/dist/agents/tool-images.js +82 -9
  103. package/dist/agents/tool-policy-shared.js +108 -0
  104. package/dist/agents/tool-policy.js +51 -26
  105. package/dist/agents/tools/browser-tool.js +160 -54
  106. package/dist/agents/tools/canvas-tool.js +27 -1
  107. package/dist/agents/tools/common.js +45 -0
  108. package/dist/agents/tools/cron-tool.test-helpers.js +12 -0
  109. package/dist/agents/tools/discord-actions-guild.js +4 -1
  110. package/dist/agents/tools/discord-actions-moderation-shared.js +27 -0
  111. package/dist/agents/tools/gateway-tool.js +3 -1
  112. package/dist/agents/tools/image-tool.js +214 -99
  113. package/dist/agents/tools/nodes-utils.js +1 -10
  114. package/dist/agents/tools/sessions-history-tool.js +140 -108
  115. package/dist/agents/tools/sessions-send-helpers.js +12 -6
  116. package/dist/agents/tools/sessions-spawn-tool.js +8 -2
  117. package/dist/agents/tools/subagents-tool.js +2 -1
  118. package/dist/agents/tools/whatsapp-actions.js +10 -2
  119. package/dist/agents/tools/whatsapp-target-auth.js +18 -0
  120. package/dist/agents/transcript-policy.js +22 -8
  121. package/dist/agents/venice-models.js +11 -3
  122. package/dist/agents/workspace.js +222 -46
  123. package/dist/auto-reply/commands-registry.data.js +51 -0
  124. package/dist/auto-reply/commands-registry.js +19 -21
  125. package/dist/auto-reply/fallback-state.js +114 -0
  126. package/dist/auto-reply/group-activation.js +10 -5
  127. package/dist/auto-reply/inbound-debounce.js +10 -5
  128. package/dist/auto-reply/model-runtime.js +68 -0
  129. package/dist/auto-reply/reply/abort.js +1 -1
  130. package/dist/auto-reply/reply/agent-runner-execution.js +40 -5
  131. package/dist/auto-reply/reply/agent-runner.js +165 -39
  132. package/dist/auto-reply/reply/bash-command.js +41 -39
  133. package/dist/auto-reply/reply/command-gates.js +25 -0
  134. package/dist/auto-reply/reply/commands-allowlist.js +111 -72
  135. package/dist/auto-reply/reply/commands-bash.js +6 -5
  136. package/dist/auto-reply/reply/commands-config.js +30 -28
  137. package/dist/auto-reply/reply/commands-core.js +2 -1
  138. package/dist/auto-reply/reply/commands-info.js +1 -0
  139. package/dist/auto-reply/reply/commands-models.js +65 -14
  140. package/dist/auto-reply/reply/commands-session.js +237 -82
  141. package/dist/auto-reply/reply/commands-setunset-standard.js +13 -0
  142. package/dist/auto-reply/reply/commands-setunset.js +45 -0
  143. package/dist/auto-reply/reply/commands-subagents/action-agents.js +44 -0
  144. package/dist/auto-reply/reply/commands-subagents/action-focus.js +64 -0
  145. package/dist/auto-reply/reply/commands-subagents/action-help.js +4 -0
  146. package/dist/auto-reply/reply/commands-subagents/action-info.js +45 -0
  147. package/dist/auto-reply/reply/commands-subagents/action-kill.js +60 -0
  148. package/dist/auto-reply/reply/commands-subagents/action-list.js +44 -0
  149. package/dist/auto-reply/reply/commands-subagents/action-log.js +29 -0
  150. package/dist/auto-reply/reply/commands-subagents/action-send.js +119 -0
  151. package/dist/auto-reply/reply/commands-subagents/action-spawn.js +52 -0
  152. package/dist/auto-reply/reply/commands-subagents/action-unfocus.js +30 -0
  153. package/dist/auto-reply/reply/commands-subagents/shared.js +303 -0
  154. package/dist/auto-reply/reply/commands-subagents.js +51 -587
  155. package/dist/auto-reply/reply/commands-tts.js +10 -5
  156. package/dist/auto-reply/reply/config-value.js +10 -5
  157. package/dist/auto-reply/reply/directive-handling.model-picker.js +12 -6
  158. package/dist/auto-reply/reply/directive-handling.persist.js +9 -21
  159. package/dist/auto-reply/reply/directive-handling.shared.js +24 -4
  160. package/dist/auto-reply/reply/followup-runner.js +1 -0
  161. package/dist/auto-reply/reply/get-reply-directives-utils.js +23 -14
  162. package/dist/auto-reply/reply/get-reply-directives.js +17 -28
  163. package/dist/auto-reply/reply/get-reply-inline-actions.js +1 -0
  164. package/dist/auto-reply/reply/get-reply.js +71 -12
  165. package/dist/auto-reply/reply/model-selection.js +80 -39
  166. package/dist/auto-reply/reply/queue/enqueue.js +10 -5
  167. package/dist/auto-reply/reply/queue/state.js +13 -12
  168. package/dist/auto-reply/reply/reply-payloads.js +67 -36
  169. package/dist/auto-reply/reply/reply-reference.js +9 -8
  170. package/dist/auto-reply/reply/route-reply.js +15 -8
  171. package/dist/auto-reply/reply/session-reset-prompt.js +1 -1
  172. package/dist/auto-reply/reply/session.js +22 -6
  173. package/dist/auto-reply/reply/strip-inbound-meta.js +147 -0
  174. package/dist/auto-reply/reply/subagents-utils.js +56 -30
  175. package/dist/auto-reply/reply/typing.js +46 -21
  176. package/dist/auto-reply/send-policy.js +14 -7
  177. package/dist/auto-reply/status.js +140 -16
  178. package/dist/auto-reply/templating.js +10 -5
  179. package/dist/auto-reply/thinking.js +7 -16
  180. package/dist/auto-reply/tokens.js +21 -5
  181. package/dist/browser/bridge-server.js +36 -20
  182. package/dist/browser/cdp.helpers.js +7 -14
  183. package/dist/browser/cdp.js +35 -15
  184. package/dist/browser/chrome.profile-decoration.js +7 -4
  185. package/dist/browser/config.js +30 -0
  186. package/dist/browser/extension-relay-auth.js +55 -0
  187. package/dist/browser/extension-relay.js +74 -29
  188. package/dist/browser/navigation-guard.js +39 -0
  189. package/dist/browser/paths.js +77 -0
  190. package/dist/browser/profiles.js +13 -8
  191. package/dist/browser/pw-ai-module.js +10 -5
  192. package/dist/browser/pw-session.js +76 -39
  193. package/dist/browser/pw-tools-core.interactions.js +14 -7
  194. package/dist/browser/pw-tools-core.state.js +12 -6
  195. package/dist/browser/routes/agent.act.js +431 -424
  196. package/dist/browser/routes/agent.shared.js +47 -3
  197. package/dist/browser/routes/agent.snapshot.js +122 -116
  198. package/dist/browser/routes/agent.storage.js +303 -297
  199. package/dist/browser/routes/tabs.js +154 -100
  200. package/dist/browser/server-context.js +7 -0
  201. package/dist/browser/server-lifecycle.js +37 -0
  202. package/dist/build-info.json +3 -3
  203. package/dist/channels/allow-from.js +26 -0
  204. package/dist/channels/allowlists/resolve-utils.js +43 -19
  205. package/dist/channels/channel-config.js +14 -7
  206. package/dist/channels/draft-stream-loop.js +7 -0
  207. package/dist/channels/model-overrides.js +82 -0
  208. package/dist/channels/plugins/account-action-gate.js +13 -0
  209. package/dist/channels/plugins/message-actions.js +10 -0
  210. package/dist/channels/plugins/normalize/imessage.js +14 -7
  211. package/dist/channels/plugins/normalize/slack.js +10 -5
  212. package/dist/channels/plugins/normalize/telegram.js +14 -7
  213. package/dist/channels/plugins/outbound/discord.js +80 -8
  214. package/dist/channels/plugins/outbound/signal.js +11 -11
  215. package/dist/channels/plugins/setup-helpers.js +10 -5
  216. package/dist/channels/sender-label.js +14 -7
  217. package/dist/channels/session.js +4 -2
  218. package/dist/channels/status-reactions.js +297 -0
  219. package/dist/channels/telegram/api.js +18 -0
  220. package/dist/cli/argv.js +84 -21
  221. package/dist/cli/banner.js +3 -2
  222. package/dist/cli/browser-cli-actions-input/register.files-downloads.js +65 -56
  223. package/dist/cli/cli-name.js +11 -11
  224. package/dist/cli/cli-utils.js +13 -3
  225. package/dist/cli/command-format.js +1 -1
  226. package/dist/cli/config-cli.js +1 -1
  227. package/dist/cli/daemon-cli/lifecycle-core.js +31 -19
  228. package/dist/cli/daemon-cli/lifecycle.js +64 -2
  229. package/dist/cli/daemon-cli/restart-health.js +126 -0
  230. package/dist/cli/daemon-cli/status.gather.js +9 -13
  231. package/dist/cli/daemon-cli/status.print.js +2 -10
  232. package/dist/cli/deps.js +27 -22
  233. package/dist/cli/exec-approvals-cli.js +92 -124
  234. package/dist/cli/gateway-cli/run-loop.js +23 -5
  235. package/dist/cli/memory-cli.js +158 -61
  236. package/dist/cli/node-cli/register.js +14 -5
  237. package/dist/cli/nodes-cli/register.push.js +63 -0
  238. package/dist/cli/nodes-media-utils.js +26 -0
  239. package/dist/cli/outbound-send-deps.js +2 -9
  240. package/dist/cli/outbound-send-mapping.js +11 -0
  241. package/dist/cli/pairing-cli.js +40 -14
  242. package/dist/cli/plugins-cli.js +250 -73
  243. package/dist/cli/ports.js +11 -10
  244. package/dist/cli/program/build-program.js +3 -1
  245. package/dist/cli/program/command-registry.js +214 -136
  246. package/dist/cli/program/command-tree.js +16 -0
  247. package/dist/cli/program/help.js +43 -12
  248. package/dist/cli/program/preaction.js +13 -9
  249. package/dist/cli/program/register.configure.js +3 -18
  250. package/dist/cli/program/register.maintenance.js +2 -2
  251. package/dist/cli/program/register.onboard.js +2 -0
  252. package/dist/cli/program/register.status-health-sessions.js +16 -17
  253. package/dist/cli/program/register.subclis.js +93 -52
  254. package/dist/cli/route.js +12 -8
  255. package/dist/cli/system-cli.js +36 -46
  256. package/dist/cli/test-runtime-capture.js +24 -0
  257. package/dist/cli/update-cli/shared.js +22 -9
  258. package/dist/cli/update-cli/update-command.js +89 -14
  259. package/dist/cli/update-cli/wizard.js +6 -12
  260. package/dist/commands/agent/run-context.js +18 -5
  261. package/dist/commands/agent/session-store.js +17 -4
  262. package/dist/commands/agent.js +185 -89
  263. package/dist/commands/agents.bindings.js +14 -7
  264. package/dist/commands/agents.commands.add.js +13 -9
  265. package/dist/commands/agents.commands.identity.js +12 -6
  266. package/dist/commands/agents.commands.list.js +11 -6
  267. package/dist/commands/agents.config.js +8 -10
  268. package/dist/commands/agents.providers.js +12 -6
  269. package/dist/commands/auth-choice-options.js +103 -75
  270. package/dist/commands/auth-choice.apply.byteplus.js +55 -0
  271. package/dist/commands/auth-choice.apply.js +4 -0
  272. package/dist/commands/auth-choice.apply.minimax.js +61 -13
  273. package/dist/commands/auth-choice.apply.openai.js +3 -1
  274. package/dist/commands/auth-choice.apply.volcengine.js +55 -0
  275. package/dist/commands/auth-choice.preferred-provider.js +2 -0
  276. package/dist/commands/channels/remove.js +13 -6
  277. package/dist/commands/channels/shared.js +4 -14
  278. package/dist/commands/channels.mock-harness.js +23 -0
  279. package/dist/commands/configure.commands.js +14 -0
  280. package/dist/commands/configure.gateway.js +2 -4
  281. package/dist/commands/configure.js +1 -1
  282. package/dist/commands/configure.shared.js +11 -0
  283. package/dist/commands/daemon-install-helpers.js +2 -2
  284. package/dist/commands/daemon-install-runtime-warning.js +11 -0
  285. package/dist/commands/dashboard.js +12 -10
  286. package/dist/commands/docs.js +14 -8
  287. package/dist/commands/doctor-config-flow.js +11 -9
  288. package/dist/commands/doctor-legacy-config.js +281 -0
  289. package/dist/commands/doctor-state-integrity.js +99 -23
  290. package/dist/commands/doctor-update.js +12 -9
  291. package/dist/commands/models/list.list-command.js +7 -5
  292. package/dist/commands/models/set-image.js +2 -21
  293. package/dist/commands/node-daemon-install-helpers.js +10 -8
  294. package/dist/commands/onboard-auth.config-minimax.js +54 -80
  295. package/dist/commands/onboard-auth.config-opencode.js +2 -18
  296. package/dist/commands/onboard-auth.credentials.js +90 -13
  297. package/dist/commands/onboard-auth.js +1 -1
  298. package/dist/commands/onboard-auth.models.js +6 -5
  299. package/dist/commands/onboard-hooks.js +1 -1
  300. package/dist/commands/onboard-non-interactive/api-keys.js +14 -7
  301. package/dist/commands/onboard-non-interactive/local/auth-choice.js +64 -49
  302. package/dist/commands/onboard-provider-auth-flags.js +14 -0
  303. package/dist/commands/onboard-remote.js +14 -7
  304. package/dist/commands/onboard.js +11 -13
  305. package/dist/commands/sandbox-display.js +6 -5
  306. package/dist/commands/sessions.test-helpers.js +61 -0
  307. package/dist/commands/status-all/diagnosis.js +14 -10
  308. package/dist/commands/status-all/format.js +1 -0
  309. package/dist/commands/status.gateway-probe.js +1 -16
  310. package/dist/commands/systemd-linger.js +12 -6
  311. package/dist/config/agent-limits.js +2 -0
  312. package/dist/config/commands.js +32 -15
  313. package/dist/config/config-paths.js +9 -11
  314. package/dist/config/config.js +1 -1
  315. package/dist/config/defaults.js +22 -2
  316. package/dist/config/discord-preview-streaming.js +104 -0
  317. package/dist/config/env-substitution.js +62 -34
  318. package/dist/config/env-vars.js +45 -7
  319. package/dist/config/includes.js +4 -0
  320. package/dist/config/io.js +656 -171
  321. package/dist/config/legacy.migrations.part-1.js +189 -78
  322. package/dist/config/legacy.shared.js +3 -1
  323. package/dist/config/merge-patch.js +54 -4
  324. package/dist/config/prototype-keys.js +4 -0
  325. package/dist/config/redact-snapshot.js +404 -76
  326. package/dist/config/schema.help.js +44 -7
  327. package/dist/config/schema.js +58 -570
  328. package/dist/config/schema.labels.js +38 -6
  329. package/dist/config/sessions/delivery-info.js +10 -3
  330. package/dist/config/sessions/main-session.js +10 -5
  331. package/dist/config/sessions/session-file.js +33 -0
  332. package/dist/config/sessions/session-key.js +10 -5
  333. package/dist/config/sessions/store.js +1 -1
  334. package/dist/config/sessions.js +1 -0
  335. package/dist/config/validation.js +140 -85
  336. package/dist/config/zod-schema.agent-runtime.js +11 -0
  337. package/dist/config/zod-schema.hooks.js +40 -11
  338. package/dist/config/zod-schema.installs.js +20 -0
  339. package/dist/config/zod-schema.js +156 -20
  340. package/dist/config/zod-schema.providers-core.js +78 -4
  341. package/dist/config/zod-schema.providers.js +6 -1
  342. package/dist/config/zod-schema.session.js +41 -2
  343. package/dist/cron/run-log.js +3 -0
  344. package/dist/cron/schedule.js +21 -10
  345. package/dist/cron/service/ops.js +35 -21
  346. package/dist/cron/service/timer.js +116 -16
  347. package/dist/cron/stagger.js +3 -1
  348. package/dist/daemon/cmd-argv.js +21 -0
  349. package/dist/daemon/cmd-set.js +58 -0
  350. package/dist/daemon/service-types.js +1 -0
  351. package/dist/discord/api.js +12 -6
  352. package/dist/discord/draft-chunking.js +22 -0
  353. package/dist/discord/draft-stream.js +124 -0
  354. package/dist/discord/monitor/agent-components.js +1 -1
  355. package/dist/discord/monitor/commands.js +5 -0
  356. package/dist/discord/monitor/exec-approvals.js +357 -162
  357. package/dist/discord/monitor/gateway-plugin.js +2 -1
  358. package/dist/discord/monitor/listeners.js +37 -27
  359. package/dist/discord/monitor/message-handler.js +4 -1
  360. package/dist/discord/monitor/message-handler.preflight.js +65 -8
  361. package/dist/discord/monitor/message-handler.process.js +246 -217
  362. package/dist/discord/monitor/message-utils.js +143 -6
  363. package/dist/discord/monitor/model-picker-preferences.js +143 -0
  364. package/dist/discord/monitor/model-picker.js +651 -0
  365. package/dist/discord/monitor/native-command.js +573 -16
  366. package/dist/discord/monitor/provider.allowlist.js +223 -0
  367. package/dist/discord/monitor/provider.js +275 -347
  368. package/dist/discord/monitor/provider.lifecycle.js +100 -0
  369. package/dist/discord/monitor/reply-delivery.js +123 -16
  370. package/dist/discord/monitor/thread-bindings.discord-api.js +215 -0
  371. package/dist/discord/monitor/thread-bindings.js +4 -0
  372. package/dist/discord/monitor/thread-bindings.lifecycle.js +177 -0
  373. package/dist/discord/monitor/thread-bindings.manager.js +423 -0
  374. package/dist/discord/monitor/thread-bindings.messages.js +55 -0
  375. package/dist/discord/monitor/thread-bindings.state.js +358 -0
  376. package/dist/discord/monitor/thread-bindings.types.js +6 -0
  377. package/dist/discord/resolve-users.js +33 -21
  378. package/dist/discord/send.channels.js +15 -0
  379. package/dist/discord/send.js +3 -2
  380. package/dist/discord/send.outbound.js +82 -26
  381. package/dist/discord/send.permissions.js +83 -30
  382. package/dist/discord/send.reactions.js +8 -4
  383. package/dist/discord/token.js +10 -5
  384. package/dist/discord/voice/command.js +263 -0
  385. package/dist/discord/voice/manager.js +531 -0
  386. package/dist/gateway/auth.js +72 -13
  387. package/dist/gateway/call.js +152 -83
  388. package/dist/gateway/canvas-capability.js +75 -0
  389. package/dist/gateway/client.js +28 -4
  390. package/dist/gateway/config-reload.js +3 -4
  391. package/dist/gateway/control-plane-audit.js +28 -0
  392. package/dist/gateway/control-plane-rate-limit.js +53 -0
  393. package/dist/gateway/control-ui.js +219 -96
  394. package/dist/gateway/events.js +1 -0
  395. package/dist/gateway/hooks-mapping.js +88 -38
  396. package/dist/gateway/hooks.js +109 -54
  397. package/dist/gateway/http-auth-helpers.js +3 -2
  398. package/dist/gateway/http-common.js +22 -0
  399. package/dist/gateway/http-endpoint-helpers.js +1 -0
  400. package/dist/gateway/method-scopes.js +169 -0
  401. package/dist/gateway/net.js +74 -9
  402. package/dist/gateway/node-invoke-system-run-approval.js +14 -35
  403. package/dist/gateway/node-registry.js +10 -5
  404. package/dist/gateway/openai-http.js +1 -0
  405. package/dist/gateway/openresponses-http.js +121 -110
  406. package/dist/gateway/origin-check.js +1 -18
  407. package/dist/gateway/probe-auth.js +2 -0
  408. package/dist/gateway/protocol/index.js +4 -2
  409. package/dist/gateway/protocol/schema/cron.js +1 -0
  410. package/dist/gateway/protocol/schema/devices.js +1 -0
  411. package/dist/gateway/protocol/schema/protocol-schemas.js +4 -1
  412. package/dist/gateway/protocol/schema/push.js +18 -0
  413. package/dist/gateway/protocol/schema/sessions.js +6 -0
  414. package/dist/gateway/protocol/schema.js +1 -0
  415. package/dist/gateway/role-policy.js +17 -0
  416. package/dist/gateway/server/ws-connection/connect-policy.js +37 -0
  417. package/dist/gateway/server/ws-connection/message-handler.js +175 -148
  418. package/dist/gateway/server-chat.js +83 -25
  419. package/dist/gateway/server-constants.js +10 -9
  420. package/dist/gateway/server-cron.js +1 -0
  421. package/dist/gateway/server-http.js +247 -54
  422. package/dist/gateway/server-maintenance.js +20 -5
  423. package/dist/gateway/server-methods/agent.js +162 -24
  424. package/dist/gateway/server-methods/chat.js +465 -130
  425. package/dist/gateway/server-methods/config.js +193 -152
  426. package/dist/gateway/server-methods/devices.js +17 -3
  427. package/dist/gateway/server-methods/models.js +11 -1
  428. package/dist/gateway/server-methods/nodes.helpers.js +12 -0
  429. package/dist/gateway/server-methods/nodes.js +251 -69
  430. package/dist/gateway/server-methods/push.js +53 -0
  431. package/dist/gateway/server-methods/sessions.js +64 -8
  432. package/dist/gateway/server-methods/usage.js +162 -75
  433. package/dist/gateway/server-node-events.js +29 -0
  434. package/dist/gateway/server-reload-handlers.js +2 -3
  435. package/dist/gateway/server-runtime-config.js +39 -13
  436. package/dist/gateway/server-runtime-state.js +2 -0
  437. package/dist/gateway/server-startup-memory.js +17 -11
  438. package/dist/gateway/server-ws-runtime.js +1 -0
  439. package/dist/gateway/server.impl.js +296 -139
  440. package/dist/gateway/session-preview.test-helpers.js +11 -0
  441. package/dist/gateway/session-utils.fs.js +32 -34
  442. package/dist/gateway/sessions-resolve.js +17 -5
  443. package/dist/gateway/startup-auth.js +126 -0
  444. package/dist/gateway/test-helpers.agent-results.js +15 -0
  445. package/dist/gateway/test-helpers.mocks.js +37 -14
  446. package/dist/gateway/test-helpers.openai-mock.js +14 -7
  447. package/dist/gateway/test-helpers.server.js +161 -77
  448. package/dist/gateway/tools-invoke-http.js +21 -10
  449. package/dist/hooks/bundled/bootstrap-extra-files/handler.js +3 -1
  450. package/dist/hooks/bundled/command-logger/handler.js +7 -2
  451. package/dist/hooks/bundled/session-memory/handler.js +170 -38
  452. package/dist/hooks/frontmatter.js +6 -6
  453. package/dist/hooks/gmail-watcher-lifecycle.js +23 -0
  454. package/dist/hooks/gmail-watcher.js +11 -6
  455. package/dist/hooks/internal-hooks.js +11 -1
  456. package/dist/hooks/llm-slug-generator.js +4 -1
  457. package/dist/hooks/workspace.js +47 -17
  458. package/dist/imessage/accounts.js +9 -20
  459. package/dist/imessage/monitor/inbound-processing.js +2 -1
  460. package/dist/infra/archive-path.js +49 -0
  461. package/dist/infra/archive.js +174 -73
  462. package/dist/infra/control-ui-assets.js +14 -6
  463. package/dist/infra/device-pairing.js +204 -144
  464. package/dist/infra/env.js +10 -5
  465. package/dist/infra/exec-approvals-allowlist.js +141 -70
  466. package/dist/infra/exec-approvals-analysis.js +78 -20
  467. package/dist/infra/exec-approvals.js +5 -17
  468. package/dist/infra/exec-safe-bin-policy.js +277 -0
  469. package/dist/infra/fixed-window-rate-limit.js +33 -0
  470. package/dist/infra/fs-safe.js +71 -39
  471. package/dist/infra/gateway-lock.js +6 -2
  472. package/dist/infra/git-root.js +61 -0
  473. package/dist/infra/heartbeat-active-hours.js +2 -2
  474. package/dist/infra/heartbeat-reason.js +40 -0
  475. package/dist/infra/heartbeat-runner.js +72 -32
  476. package/dist/infra/heartbeat-wake.js +6 -12
  477. package/dist/infra/host-env-security-policy.json +19 -0
  478. package/dist/infra/host-env-security.js +66 -0
  479. package/dist/infra/install-source-utils.js +91 -7
  480. package/dist/infra/net/ssrf.js +131 -38
  481. package/dist/infra/node-pairing.js +50 -105
  482. package/dist/infra/npm-integrity.js +45 -0
  483. package/dist/infra/npm-pack-install.js +40 -0
  484. package/dist/infra/outbound/bound-delivery-router.js +88 -0
  485. package/dist/infra/outbound/channel-adapters.js +20 -7
  486. package/dist/infra/outbound/channel-selection.js +12 -6
  487. package/dist/infra/outbound/envelope.js +1 -1
  488. package/dist/infra/outbound/format.js +12 -6
  489. package/dist/infra/outbound/message-action-runner.js +107 -327
  490. package/dist/infra/outbound/message.js +59 -36
  491. package/dist/infra/outbound/outbound-policy.js +52 -25
  492. package/dist/infra/outbound/outbound-send-service.js +58 -71
  493. package/dist/infra/outbound/payloads.js +14 -7
  494. package/dist/infra/outbound/session-binding-service.js +123 -0
  495. package/dist/infra/pairing-files.js +10 -0
  496. package/dist/infra/path-guards.js +25 -0
  497. package/dist/infra/plain-object.js +9 -0
  498. package/dist/infra/provider-usage.fetch.codex.js +7 -15
  499. package/dist/infra/provider-usage.fetch.gemini.js +14 -11
  500. package/dist/infra/provider-usage.fetch.shared.js +30 -1
  501. package/dist/infra/provider-usage.fetch.zai.js +10 -9
  502. package/dist/infra/push-apns.js +365 -0
  503. package/dist/infra/restart-sentinel.js +16 -1
  504. package/dist/infra/restart.js +229 -26
  505. package/dist/infra/retry-policy.js +4 -2
  506. package/dist/infra/retry.js +9 -5
  507. package/dist/infra/scp-host.js +54 -0
  508. package/dist/infra/session-cost-usage.js +107 -59
  509. package/dist/infra/session-maintenance-warning.js +3 -1
  510. package/dist/infra/shell-env.js +98 -34
  511. package/dist/infra/ssh-config.js +12 -6
  512. package/dist/infra/system-run-command.js +49 -4
  513. package/dist/infra/update-channels.js +10 -5
  514. package/dist/infra/update-startup.js +86 -9
  515. package/dist/line/accounts.js +5 -7
  516. package/dist/line/bot-access.js +8 -20
  517. package/dist/line/bot-handlers.js +3 -1
  518. package/dist/link-understanding/detect.js +15 -7
  519. package/dist/media/constants.js +15 -6
  520. package/dist/media/image-ops.js +7 -0
  521. package/dist/media/inbound-path-policy.js +114 -0
  522. package/dist/media/input-files.js +16 -0
  523. package/dist/media/local-roots.js +3 -2
  524. package/dist/media-understanding/apply.js +4 -1
  525. package/dist/media-understanding/concurrency.js +8 -20
  526. package/dist/memory/backend-config.js +45 -6
  527. package/dist/memory/embeddings.js +10 -4
  528. package/dist/memory/fs-utils.js +23 -0
  529. package/dist/memory/manager-search.js +12 -6
  530. package/dist/memory/manager-sync-ops.js +12 -2
  531. package/dist/memory/qmd-manager.js +466 -53
  532. package/dist/memory/query-expansion.js +167 -3
  533. package/dist/memory/status-format.js +10 -5
  534. package/dist/memory/sync-memory-files.js +1 -1
  535. package/dist/memory/test-manager.js +8 -0
  536. package/dist/node-host/invoke-system-run.js +281 -0
  537. package/dist/node-host/invoke.js +55 -337
  538. package/dist/pairing/pairing-store.js +22 -0
  539. package/dist/plugin-sdk/allow-from.js +1 -1
  540. package/dist/plugin-sdk/command-auth.js +3 -1
  541. package/dist/plugin-sdk/index.js +6 -3
  542. package/dist/plugin-sdk/temp-path.js +47 -0
  543. package/dist/plugin-sdk/webhook-targets.js +32 -0
  544. package/dist/plugins/bundled-dir.js +9 -6
  545. package/dist/plugins/discovery.js +217 -23
  546. package/dist/plugins/hook-runner-global.js +16 -0
  547. package/dist/plugins/hooks.js +50 -0
  548. package/dist/plugins/install.js +28 -16
  549. package/dist/plugins/loader.js +192 -26
  550. package/dist/plugins/logger.js +8 -0
  551. package/dist/plugins/manifest-registry.js +3 -0
  552. package/dist/plugins/path-safety.js +34 -0
  553. package/dist/plugins/registry.js +5 -2
  554. package/dist/plugins/runtime/index.js +271 -206
  555. package/dist/plugins/runtime.js +3 -17
  556. package/dist/plugins/update.js +78 -12
  557. package/dist/process/spawn-utils.js +14 -7
  558. package/dist/providers/github-copilot-models.js +4 -1
  559. package/dist/providers/github-copilot-token.js +11 -6
  560. package/dist/providers/qwen-portal-oauth.js +14 -6
  561. package/dist/routing/account-id.js +30 -0
  562. package/dist/routing/resolve-route.js +3 -7
  563. package/dist/routing/session-key.js +2 -16
  564. package/dist/security/audit-channel.js +100 -20
  565. package/dist/security/audit-extra.async.js +505 -179
  566. package/dist/security/audit-extra.js +12 -2
  567. package/dist/security/audit-extra.sync.js +421 -35
  568. package/dist/security/audit-fs.js +31 -13
  569. package/dist/security/audit.js +180 -370
  570. package/dist/security/dm-policy-shared.js +68 -0
  571. package/dist/security/external-content.js +46 -14
  572. package/dist/security/fix.js +49 -85
  573. package/dist/security/scan-paths.js +20 -0
  574. package/dist/security/secret-equal.js +3 -7
  575. package/dist/security/windows-acl.js +30 -15
  576. package/dist/shared/entry-status.js +6 -0
  577. package/dist/shared/frontmatter.js +5 -5
  578. package/dist/shared/node-list-parse.js +13 -0
  579. package/dist/shared/node-match.js +11 -4
  580. package/dist/shared/operator-scope-compat.js +42 -0
  581. package/dist/shared/text-chunking.js +29 -0
  582. package/dist/signal/accounts.js +7 -20
  583. package/dist/signal/monitor/event-handler.js +3 -1
  584. package/dist/slack/accounts.js +6 -19
  585. package/dist/slack/actions.js +11 -3
  586. package/dist/slack/blocks.test-helpers.js +31 -0
  587. package/dist/slack/monitor/auth.js +1 -1
  588. package/dist/slack/monitor/message-handler/dispatch.js +50 -29
  589. package/dist/slack/monitor/mrkdwn.js +8 -0
  590. package/dist/slack/monitor/replies.js +15 -7
  591. package/dist/slack/monitor/slash.js +22 -13
  592. package/dist/slack/resolve-channels.js +10 -5
  593. package/dist/slack/send.js +102 -12
  594. package/dist/slack/stream-mode.js +10 -0
  595. package/dist/slack/streaming.js +4 -2
  596. package/dist/telegram/accounts.js +19 -14
  597. package/dist/telegram/bot/helpers.js +3 -5
  598. package/dist/telegram/bot-access.js +35 -36
  599. package/dist/telegram/bot-handlers.js +120 -148
  600. package/dist/telegram/bot-message-context.js +68 -9
  601. package/dist/telegram/bot-message-dispatch.js +477 -210
  602. package/dist/telegram/bot-native-commands.js +16 -0
  603. package/dist/telegram/draft-stream.js +44 -8
  604. package/dist/telegram/inline-buttons.js +5 -15
  605. package/dist/telegram/monitor.js +11 -7
  606. package/dist/telegram/network-config.js +19 -7
  607. package/dist/telegram/reasoning-lane-coordinator.js +128 -0
  608. package/dist/telegram/send.js +3 -2
  609. package/dist/telegram/sent-message-cache.js +5 -6
  610. package/dist/telegram/status-reaction-variants.js +208 -0
  611. package/dist/telegram/sticker-cache.js +11 -9
  612. package/dist/terminal/prompt-select-styled.js +9 -0
  613. package/dist/terminal/theme.js +12 -12
  614. package/dist/test-utils/command-runner.js +6 -0
  615. package/dist/test-utils/internal-hook-event-payload.js +10 -0
  616. package/dist/test-utils/model-auth-mock.js +12 -0
  617. package/dist/test-utils/provider-usage-fetch.js +14 -0
  618. package/dist/test-utils/temp-home.js +33 -0
  619. package/dist/tts/tts.js +80 -567
  620. package/dist/tui/components/chat-log.js +50 -8
  621. package/dist/tui/theme/theme.js +10 -12
  622. package/dist/tui/tui-command-handlers.js +36 -27
  623. package/dist/tui/tui-event-handlers.js +122 -32
  624. package/dist/tui/tui-local-shell.js +16 -6
  625. package/dist/tui/tui.js +236 -48
  626. package/dist/utils/account-id.js +2 -4
  627. package/dist/utils/boolean.js +10 -5
  628. package/dist/utils/directive-tags.js +11 -0
  629. package/dist/utils/mask-api-key.js +10 -0
  630. package/dist/utils/queue-helpers.js +67 -12
  631. package/dist/utils/run-with-concurrency.js +39 -0
  632. package/dist/web/auto-reply/deliver-reply.js +8 -4
  633. package/dist/web/auto-reply/mentions.js +10 -5
  634. package/dist/web/auto-reply/monitor/group-members.js +14 -7
  635. package/dist/web/auto-reply/monitor/process-message.js +45 -24
  636. package/dist/web/inbound/access-control.js +5 -2
  637. package/dist/web/login-qr.js +12 -6
  638. package/dist/web/media.js +126 -15
  639. package/docs/tools/slash-commands.md +5 -1
  640. package/extensions/bluebubbles/src/monitor-processing.ts +580 -139
  641. package/extensions/bluebubbles/src/monitor.ts +208 -1950
  642. package/extensions/feishu/src/external-keys.ts +19 -0
  643. package/extensions/lobster/src/windows-spawn.ts +193 -0
  644. package/extensions/matrix/src/matrix/actions/limits.ts +6 -0
  645. package/extensions/mattermost/src/mattermost/reactions.test-helpers.ts +83 -0
  646. package/package.json +1 -1
@@ -2,44 +2,102 @@ import { Type } from "@sinclair/typebox";
2
2
  import { loadConfig } from "../../config/config.js";
3
3
  import { callGateway } from "../../gateway/call.js";
4
4
  import { capArrayByJsonBytes } from "../../gateway/session-utils.fs.js";
5
- import { isSubagentSessionKey, resolveAgentIdFromSessionKey } from "../../routing/session-key.js";
6
5
  import { truncateUtf16Safe } from "../../utils.js";
7
6
  import { jsonResult, readStringParam } from "./common.js";
8
- import { createAgentToAgentPolicy, resolveSessionReference, resolveMainSessionAlias, resolveInternalSessionKey, stripToolMessages, } from "./sessions-helpers.js";
7
+ import { createSessionVisibilityGuard, createAgentToAgentPolicy, isRequesterSpawnedSessionVisible, resolveEffectiveSessionToolsVisibility, resolveSessionReference, resolveSandboxedSessionToolContext, stripToolMessages, } from "./sessions-helpers.js";
9
8
  const SessionsHistoryToolSchema = Type.Object({
10
9
  sessionKey: Type.String(),
11
10
  limit: Type.Optional(Type.Number({ minimum: 1 })),
12
11
  includeTools: Type.Optional(Type.Boolean()),
13
12
  });
14
- /** Hard cap on the serialized JSON size of the returned messages array. */
15
- const SESSIONS_HISTORY_MAX_BYTES = 512 * 1024;
16
- /** Per-block text truncation limit (in UTF-16 chars). */
17
- const SESSIONS_HISTORY_TEXT_MAX_CHARS = 32_000;
18
- function truncateHistoryText(text, maxChars) {
19
- if (text.length <= maxChars)
20
- return text;
21
- return `${truncateUtf16Safe(text, maxChars)}…(truncated)`;
13
+ const SESSIONS_HISTORY_MAX_BYTES = 80 * 1024;
14
+ const SESSIONS_HISTORY_TEXT_MAX_CHARS = 4000;
15
+ // sandbox policy handling is shared with sessions-list-tool via sessions-helpers.ts
16
+ function truncateHistoryText(text) {
17
+ if (text.length <= SESSIONS_HISTORY_TEXT_MAX_CHARS) {
18
+ return { text, truncated: false };
19
+ }
20
+ const cut = truncateUtf16Safe(text, SESSIONS_HISTORY_TEXT_MAX_CHARS);
21
+ return { text: `${cut}\n…(truncated)…`, truncated: true };
22
22
  }
23
23
  function sanitizeHistoryContentBlock(block) {
24
- if (!block || typeof block !== "object")
25
- return block;
26
- const rec = block;
27
- if (typeof rec.text === "string") {
28
- return { ...rec, text: truncateHistoryText(rec.text, SESSIONS_HISTORY_TEXT_MAX_CHARS) };
24
+ if (!block || typeof block !== "object") {
25
+ return { block, truncated: false };
26
+ }
27
+ const entry = { ...block };
28
+ let truncated = false;
29
+ const type = typeof entry.type === "string" ? entry.type : "";
30
+ if (typeof entry.text === "string") {
31
+ const res = truncateHistoryText(entry.text);
32
+ entry.text = res.text;
33
+ truncated ||= res.truncated;
34
+ }
35
+ if (type === "thinking") {
36
+ if (typeof entry.thinking === "string") {
37
+ const res = truncateHistoryText(entry.thinking);
38
+ entry.thinking = res.text;
39
+ truncated ||= res.truncated;
40
+ }
41
+ // The encrypted signature can be extremely large and is not useful for history recall.
42
+ if ("thinkingSignature" in entry) {
43
+ delete entry.thinkingSignature;
44
+ truncated = true;
45
+ }
29
46
  }
30
- return block;
47
+ if (typeof entry.partialJson === "string") {
48
+ const res = truncateHistoryText(entry.partialJson);
49
+ entry.partialJson = res.text;
50
+ truncated ||= res.truncated;
51
+ }
52
+ if (type === "image") {
53
+ const data = typeof entry.data === "string" ? entry.data : undefined;
54
+ const bytes = data ? data.length : undefined;
55
+ if ("data" in entry) {
56
+ delete entry.data;
57
+ truncated = true;
58
+ }
59
+ entry.omitted = true;
60
+ if (bytes !== undefined) {
61
+ entry.bytes = bytes;
62
+ }
63
+ }
64
+ return { block: entry, truncated };
31
65
  }
32
- function sanitizeHistoryMessage(msg) {
33
- if (!msg || typeof msg !== "object")
34
- return msg;
35
- const rec = msg;
36
- if (typeof rec.content === "string") {
37
- return { ...rec, content: truncateHistoryText(rec.content, SESSIONS_HISTORY_TEXT_MAX_CHARS) };
66
+ function sanitizeHistoryMessage(message) {
67
+ if (!message || typeof message !== "object") {
68
+ return { message, truncated: false };
69
+ }
70
+ const entry = { ...message };
71
+ let truncated = false;
72
+ // Tool result details often contain very large nested payloads.
73
+ if ("details" in entry) {
74
+ delete entry.details;
75
+ truncated = true;
38
76
  }
39
- if (Array.isArray(rec.content)) {
40
- return { ...rec, content: rec.content.map(sanitizeHistoryContentBlock) };
77
+ if ("usage" in entry) {
78
+ delete entry.usage;
79
+ truncated = true;
41
80
  }
42
- return msg;
81
+ if ("cost" in entry) {
82
+ delete entry.cost;
83
+ truncated = true;
84
+ }
85
+ if (typeof entry.content === "string") {
86
+ const res = truncateHistoryText(entry.content);
87
+ entry.content = res.text;
88
+ truncated ||= res.truncated;
89
+ }
90
+ else if (Array.isArray(entry.content)) {
91
+ const updated = entry.content.map((block) => sanitizeHistoryContentBlock(block));
92
+ entry.content = updated.map((item) => item.block);
93
+ truncated ||= updated.some((item) => item.truncated);
94
+ }
95
+ if (typeof entry.text === "string") {
96
+ const res = truncateHistoryText(entry.text);
97
+ entry.text = res.text;
98
+ truncated ||= res.truncated;
99
+ }
100
+ return { message: entry, truncated };
43
101
  }
44
102
  function jsonUtf8Bytes(value) {
45
103
  try {
@@ -49,45 +107,23 @@ function jsonUtf8Bytes(value) {
49
107
  return Buffer.byteLength(String(value), "utf8");
50
108
  }
51
109
  }
52
- function enforceSessionsHistoryHardCap(messages) {
53
- const sanitized = messages.map(sanitizeHistoryMessage);
54
- const { items, bytes } = capArrayByJsonBytes(sanitized, SESSIONS_HISTORY_MAX_BYTES);
55
- const droppedMessages = sanitized.length - items.length;
56
- // Count how many messages had content truncated by comparing original vs sanitized text.
57
- let contentTruncated = 0;
58
- for (let i = 0; i < messages.length; i++) {
59
- if (jsonUtf8Bytes(messages[i]) !== jsonUtf8Bytes(sanitized[i])) {
60
- contentTruncated++;
61
- }
62
- }
63
- return {
64
- messages: items,
65
- truncated: droppedMessages > 0 || contentTruncated > 0,
66
- droppedMessages,
67
- contentTruncated,
68
- bytes,
69
- };
70
- }
71
- function resolveSandboxSessionToolsVisibility(cfg) {
72
- return cfg.agents?.defaults?.sandbox?.sessionToolsVisibility ?? "spawned";
73
- }
74
- async function isSpawnedSessionAllowed(params) {
75
- try {
76
- const list = (await callGateway({
77
- method: "sessions.list",
78
- params: {
79
- includeGlobal: false,
80
- includeUnknown: false,
81
- limit: 500,
82
- spawnedBy: params.requesterSessionKey,
83
- },
84
- }));
85
- const sessions = Array.isArray(list?.sessions) ? list.sessions : [];
86
- return sessions.some((entry) => entry?.key === params.targetSessionKey);
110
+ function enforceSessionsHistoryHardCap(params) {
111
+ if (params.bytes <= params.maxBytes) {
112
+ return { items: params.items, bytes: params.bytes, hardCapped: false };
87
113
  }
88
- catch {
89
- return false;
114
+ const last = params.items.at(-1);
115
+ const lastOnly = last ? [last] : [];
116
+ const lastBytes = jsonUtf8Bytes(lastOnly);
117
+ if (lastBytes <= params.maxBytes) {
118
+ return { items: lastOnly, bytes: lastBytes, hardCapped: true };
90
119
  }
120
+ const placeholder = [
121
+ {
122
+ role: "assistant",
123
+ content: "[sessions_history omitted: message too large]",
124
+ },
125
+ ];
126
+ return { items: placeholder, bytes: jsonUtf8Bytes(placeholder), hardCapped: true };
91
127
  }
92
128
  export function createSessionsHistoryTool(opts) {
93
129
  return {
@@ -101,24 +137,16 @@ export function createSessionsHistoryTool(opts) {
101
137
  required: true,
102
138
  });
103
139
  const cfg = loadConfig();
104
- const { mainKey, alias } = resolveMainSessionAlias(cfg);
105
- const visibility = resolveSandboxSessionToolsVisibility(cfg);
106
- const requesterInternalKey = typeof opts?.agentSessionKey === "string" && opts.agentSessionKey.trim()
107
- ? resolveInternalSessionKey({
108
- key: opts.agentSessionKey,
109
- alias,
110
- mainKey,
111
- })
112
- : undefined;
113
- const restrictToSpawned = opts?.sandboxed === true &&
114
- visibility === "spawned" &&
115
- !!requesterInternalKey &&
116
- !isSubagentSessionKey(requesterInternalKey);
140
+ const { mainKey, alias, effectiveRequesterKey, restrictToSpawned } = resolveSandboxedSessionToolContext({
141
+ cfg,
142
+ agentSessionKey: opts?.agentSessionKey,
143
+ sandboxed: opts?.sandboxed,
144
+ });
117
145
  const resolvedSession = await resolveSessionReference({
118
146
  sessionKey: sessionKeyParam,
119
147
  alias,
120
148
  mainKey,
121
- requesterInternalKey,
149
+ requesterInternalKey: effectiveRequesterKey,
122
150
  restrictToSpawned,
123
151
  });
124
152
  if (!resolvedSession.ok) {
@@ -128,9 +156,9 @@ export function createSessionsHistoryTool(opts) {
128
156
  const resolvedKey = resolvedSession.key;
129
157
  const displayKey = resolvedSession.displayKey;
130
158
  const resolvedViaSessionId = resolvedSession.resolvedViaSessionId;
131
- if (restrictToSpawned && !resolvedViaSessionId) {
132
- const ok = await isSpawnedSessionAllowed({
133
- requesterSessionKey: requesterInternalKey,
159
+ if (restrictToSpawned && !resolvedViaSessionId && resolvedKey !== effectiveRequesterKey) {
160
+ const ok = await isRequesterSpawnedSessionVisible({
161
+ requesterSessionKey: effectiveRequesterKey,
134
162
  targetSessionKey: resolvedKey,
135
163
  });
136
164
  if (!ok) {
@@ -141,45 +169,49 @@ export function createSessionsHistoryTool(opts) {
141
169
  }
142
170
  }
143
171
  const a2aPolicy = createAgentToAgentPolicy(cfg);
144
- const requesterAgentId = resolveAgentIdFromSessionKey(requesterInternalKey);
145
- const targetAgentId = resolveAgentIdFromSessionKey(resolvedKey);
146
- const isCrossAgent = requesterAgentId !== targetAgentId;
147
- if (isCrossAgent) {
148
- if (!a2aPolicy.enabled) {
149
- return jsonResult({
150
- status: "forbidden",
151
- error: "Agent-to-agent history is disabled. Set tools.agentToAgent.enabled=true to allow cross-agent access.",
152
- });
153
- }
154
- if (!a2aPolicy.isAllowed(requesterAgentId, targetAgentId)) {
155
- return jsonResult({
156
- status: "forbidden",
157
- error: "Agent-to-agent history denied by tools.agentToAgent.allow.",
158
- });
159
- }
172
+ const visibility = resolveEffectiveSessionToolsVisibility({
173
+ cfg,
174
+ sandboxed: opts?.sandboxed === true,
175
+ });
176
+ const visibilityGuard = await createSessionVisibilityGuard({
177
+ action: "history",
178
+ requesterSessionKey: effectiveRequesterKey,
179
+ visibility,
180
+ a2aPolicy,
181
+ });
182
+ const access = visibilityGuard.check(resolvedKey);
183
+ if (!access.allowed) {
184
+ return jsonResult({
185
+ status: access.status,
186
+ error: access.error,
187
+ });
160
188
  }
161
189
  const limit = typeof params.limit === "number" && Number.isFinite(params.limit)
162
190
  ? Math.max(1, Math.floor(params.limit))
163
191
  : undefined;
164
192
  const includeTools = Boolean(params.includeTools);
165
- const result = (await callGateway({
193
+ const result = await callGateway({
166
194
  method: "chat.history",
167
195
  params: { sessionKey: resolvedKey, limit },
168
- }));
196
+ });
169
197
  const rawMessages = Array.isArray(result?.messages) ? result.messages : [];
170
- const messages = includeTools ? rawMessages : stripToolMessages(rawMessages);
171
- const capped = enforceSessionsHistoryHardCap(messages);
198
+ const selectedMessages = includeTools ? rawMessages : stripToolMessages(rawMessages);
199
+ const sanitizedMessages = selectedMessages.map((message) => sanitizeHistoryMessage(message));
200
+ const contentTruncated = sanitizedMessages.some((entry) => entry.truncated);
201
+ const cappedMessages = capArrayByJsonBytes(sanitizedMessages.map((entry) => entry.message), SESSIONS_HISTORY_MAX_BYTES);
202
+ const droppedMessages = cappedMessages.items.length < selectedMessages.length;
203
+ const hardened = enforceSessionsHistoryHardCap({
204
+ items: cappedMessages.items,
205
+ bytes: cappedMessages.bytes,
206
+ maxBytes: SESSIONS_HISTORY_MAX_BYTES,
207
+ });
172
208
  return jsonResult({
173
209
  sessionKey: displayKey,
174
- messages: capped.messages,
175
- ...(capped.truncated
176
- ? {
177
- truncated: true,
178
- droppedMessages: capped.droppedMessages,
179
- contentTruncated: capped.contentTruncated,
180
- bytes: capped.bytes,
181
- }
182
- : {}),
210
+ messages: hardened.items,
211
+ truncated: droppedMessages || contentTruncated || hardened.hardCapped,
212
+ droppedMessages: droppedMessages || hardened.hardCapped,
213
+ contentTruncated,
214
+ bytes: hardened.bytes,
183
215
  });
184
216
  },
185
217
  };
@@ -7,11 +7,13 @@ const MAX_PING_PONG_TURNS = 5;
7
7
  export function resolveAnnounceTargetFromKey(sessionKey) {
8
8
  const rawParts = sessionKey.split(":").filter(Boolean);
9
9
  const parts = rawParts.length >= 3 && rawParts[0] === "agent" ? rawParts.slice(2) : rawParts;
10
- if (parts.length < 3)
10
+ if (parts.length < 3) {
11
11
  return null;
12
+ }
12
13
  const [channelRaw, kind, ...rest] = parts;
13
- if (kind !== "group" && kind !== "channel")
14
+ if (kind !== "group" && kind !== "channel") {
14
15
  return null;
16
+ }
15
17
  // Extract topic/thread ID from rest (supports both :topic: and :thread:)
16
18
  // Telegram uses :topic:, other platforms use :thread:
17
19
  let threadId;
@@ -24,15 +26,18 @@ export function resolveAnnounceTargetFromKey(sessionKey) {
24
26
  }
25
27
  // Remove :topic:N or :thread:N suffix from ID for target
26
28
  const id = match ? restJoined.replace(/:(topic|thread):\d+$/, "") : restJoined.trim();
27
- if (!id)
29
+ if (!id) {
28
30
  return null;
29
- if (!channelRaw)
31
+ }
32
+ if (!channelRaw) {
30
33
  return null;
34
+ }
31
35
  const normalizedChannel = normalizeAnyChannelId(channelRaw) ?? normalizeChatChannelId(channelRaw);
32
36
  const channel = normalizedChannel ?? channelRaw.toLowerCase();
33
37
  const kindTarget = (() => {
34
- if (!normalizedChannel)
38
+ if (!normalizedChannel) {
35
39
  return id;
40
+ }
36
41
  if (normalizedChannel === "discord" || normalizedChannel === "slack") {
37
42
  return `channel:${id}`;
38
43
  }
@@ -109,8 +114,9 @@ export function isReplySkip(text) {
109
114
  export function resolvePingPongTurns(cfg) {
110
115
  const raw = cfg?.session?.agentToAgent?.maxPingPongTurns;
111
116
  const fallback = DEFAULT_PING_PONG_TURNS;
112
- if (typeof raw !== "number" || !Number.isFinite(raw))
117
+ if (typeof raw !== "number" || !Number.isFinite(raw)) {
113
118
  return fallback;
119
+ }
114
120
  const rounded = Math.floor(raw);
115
121
  return Math.max(0, Math.min(MAX_PING_PONG_TURNS, rounded));
116
122
  }
@@ -1,6 +1,6 @@
1
1
  import { Type } from "@sinclair/typebox";
2
2
  import { optionalStringEnum } from "../schema/typebox.js";
3
- import { spawnSubagentDirect } from "../subagent-spawn.js";
3
+ import { SUBAGENT_SPAWN_MODES, spawnSubagentDirect } from "../subagent-spawn.js";
4
4
  import { jsonResult, readStringParam } from "./common.js";
5
5
  const SessionsSpawnToolSchema = Type.Object({
6
6
  task: Type.String(),
@@ -11,13 +11,15 @@ const SessionsSpawnToolSchema = Type.Object({
11
11
  runTimeoutSeconds: Type.Optional(Type.Number({ minimum: 0 })),
12
12
  // Back-compat: older callers used timeoutSeconds for this tool.
13
13
  timeoutSeconds: Type.Optional(Type.Number({ minimum: 0 })),
14
+ thread: Type.Optional(Type.Boolean()),
15
+ mode: optionalStringEnum(SUBAGENT_SPAWN_MODES),
14
16
  cleanup: optionalStringEnum(["delete", "keep"]),
15
17
  });
16
18
  export function createSessionsSpawnTool(opts) {
17
19
  return {
18
20
  label: "Sessions",
19
21
  name: "sessions_spawn",
20
- description: "Spawn a background sub-agent run in an isolated session and announce the result back to the requester chat.",
22
+ description: 'Spawn a sub-agent in an isolated session (mode="run" one-shot or mode="session" persistent) and route results back to the requester chat/thread.',
21
23
  parameters: SessionsSpawnToolSchema,
22
24
  execute: async (_toolCallId, args) => {
23
25
  const params = args;
@@ -26,6 +28,7 @@ export function createSessionsSpawnTool(opts) {
26
28
  const requestedAgentId = readStringParam(params, "agentId");
27
29
  const modelOverride = readStringParam(params, "model");
28
30
  const thinkingOverrideRaw = readStringParam(params, "thinking");
31
+ const mode = params.mode === "run" || params.mode === "session" ? params.mode : undefined;
29
32
  const cleanup = params.cleanup === "keep" || params.cleanup === "delete" ? params.cleanup : "keep";
30
33
  // Back-compat: older callers used timeoutSeconds for this tool.
31
34
  const timeoutSecondsCandidate = typeof params.runTimeoutSeconds === "number"
@@ -36,6 +39,7 @@ export function createSessionsSpawnTool(opts) {
36
39
  const runTimeoutSeconds = typeof timeoutSecondsCandidate === "number" && Number.isFinite(timeoutSecondsCandidate)
37
40
  ? Math.max(0, Math.floor(timeoutSecondsCandidate))
38
41
  : undefined;
42
+ const thread = params.thread === true;
39
43
  const result = await spawnSubagentDirect({
40
44
  task,
41
45
  label: label || undefined,
@@ -43,6 +47,8 @@ export function createSessionsSpawnTool(opts) {
43
47
  model: modelOverride,
44
48
  thinking: thinkingOverrideRaw,
45
49
  runTimeoutSeconds,
50
+ thread,
51
+ mode,
46
52
  cleanup,
47
53
  expectsCompletionMessage: true,
48
54
  }, {
@@ -1,6 +1,7 @@
1
1
  import crypto from "node:crypto";
2
2
  import { Type } from "@sinclair/typebox";
3
3
  import { clearSessionQueues } from "../../auto-reply/reply/queue.js";
4
+ import { DEFAULT_SUBAGENT_MAX_SPAWN_DEPTH } from "../../config/agent-limits.js";
4
5
  import { loadConfig } from "../../config/config.js";
5
6
  import { loadSessionStore, resolveStorePath, updateSessionStore } from "../../config/sessions.js";
6
7
  import { callGateway } from "../../gateway/call.js";
@@ -181,7 +182,7 @@ function resolveRequesterKey(params) {
181
182
  // Check if this sub-agent can spawn children (orchestrator).
182
183
  // If so, it should see its own children, not its parent's children.
183
184
  const callerDepth = getSubagentDepthFromSessionStore(callerSessionKey, { cfg: params.cfg });
184
- const maxSpawnDepth = params.cfg.agents?.defaults?.subagents?.maxSpawnDepth ?? 1;
185
+ const maxSpawnDepth = params.cfg.agents?.defaults?.subagents?.maxSpawnDepth ?? DEFAULT_SUBAGENT_MAX_SPAWN_DEPTH;
185
186
  if (callerDepth < maxSpawnDepth) {
186
187
  // Orchestrator sub-agent: use its own session key as requester
187
188
  // so it sees children it spawned.
@@ -1,5 +1,6 @@
1
1
  import { sendReactionWhatsApp } from "../../web/outbound.js";
2
2
  import { createActionGate, jsonResult, readReactionParams, readStringParam } from "./common.js";
3
+ import { resolveAuthorizedWhatsAppOutboundTarget } from "./whatsapp-target-auth.js";
3
4
  export async function handleWhatsAppAction(params, cfg) {
4
5
  const action = readStringParam(params, "action", { required: true });
5
6
  const isActionEnabled = createActionGate(cfg.channels?.whatsapp?.actions);
@@ -16,12 +17,19 @@ export async function handleWhatsAppAction(params, cfg) {
16
17
  const accountId = readStringParam(params, "accountId");
17
18
  const fromMeRaw = params.fromMe;
18
19
  const fromMe = typeof fromMeRaw === "boolean" ? fromMeRaw : undefined;
20
+ // Resolve account + allowFrom via shared account logic so auth and routing stay aligned.
21
+ const resolved = resolveAuthorizedWhatsAppOutboundTarget({
22
+ cfg,
23
+ chatJid,
24
+ accountId,
25
+ actionLabel: "reaction",
26
+ });
19
27
  const resolvedEmoji = remove ? "" : emoji;
20
- await sendReactionWhatsApp(chatJid, messageId, resolvedEmoji, {
28
+ await sendReactionWhatsApp(resolved.to, messageId, resolvedEmoji, {
21
29
  verbose: false,
22
30
  fromMe,
23
31
  participant: participant ?? undefined,
24
- accountId: accountId ?? undefined,
32
+ accountId: resolved.accountId,
25
33
  });
26
34
  if (!remove && !isEmpty) {
27
35
  return jsonResult({ ok: true, added: emoji });
@@ -0,0 +1,18 @@
1
+ import { resolveWhatsAppAccount } from "../../web/accounts.js";
2
+ import { resolveWhatsAppOutboundTarget } from "../../whatsapp/resolve-outbound-target.js";
3
+ import { ToolAuthorizationError } from "./common.js";
4
+ export function resolveAuthorizedWhatsAppOutboundTarget(params) {
5
+ const account = resolveWhatsAppAccount({
6
+ cfg: params.cfg,
7
+ accountId: params.accountId,
8
+ });
9
+ const resolution = resolveWhatsAppOutboundTarget({
10
+ to: params.chatJid,
11
+ allowFrom: account.allowFrom ?? [],
12
+ mode: "implicit",
13
+ });
14
+ if (!resolution.ok) {
15
+ throw new ToolAuthorizationError(`WhatsApp ${params.actionLabel} blocked: chatJid "${params.chatJid}" is not in the configured allowFrom list for account "${account.accountId}".`);
16
+ }
17
+ return { to: resolution.to, accountId: account.accountId };
18
+ }
@@ -1,5 +1,5 @@
1
- import { isAntigravityClaude, isGoogleModelApi } from "./pi-embedded-helpers/google.js";
2
1
  import { normalizeProviderId } from "./model-selection.js";
2
+ import { isAntigravityClaude, isGoogleModelApi } from "./pi-embedded-helpers/google.js";
3
3
  const MISTRAL_MODEL_HINTS = [
4
4
  "mistral",
5
5
  "mixtral",
@@ -17,28 +17,34 @@ const OPENAI_MODEL_APIS = new Set([
17
17
  ]);
18
18
  const OPENAI_PROVIDERS = new Set(["openai", "openai-codex"]);
19
19
  function isOpenAiApi(modelApi) {
20
- if (!modelApi)
20
+ if (!modelApi) {
21
21
  return false;
22
+ }
22
23
  return OPENAI_MODEL_APIS.has(modelApi);
23
24
  }
24
25
  function isOpenAiProvider(provider) {
25
- if (!provider)
26
+ if (!provider) {
26
27
  return false;
28
+ }
27
29
  return OPENAI_PROVIDERS.has(normalizeProviderId(provider));
28
30
  }
29
31
  function isAnthropicApi(modelApi, provider) {
30
- if (modelApi === "anthropic-messages")
32
+ if (modelApi === "anthropic-messages") {
31
33
  return true;
34
+ }
32
35
  const normalized = normalizeProviderId(provider ?? "");
33
- return normalized === "anthropic" || normalized === "minimax";
36
+ // MiniMax now uses openai-completions API, not anthropic-messages
37
+ return normalized === "anthropic";
34
38
  }
35
39
  function isMistralModel(params) {
36
40
  const provider = normalizeProviderId(params.provider ?? "");
37
- if (provider === "mistral")
41
+ if (provider === "mistral") {
38
42
  return true;
43
+ }
39
44
  const modelId = (params.modelId ?? "").toLowerCase();
40
- if (!modelId)
45
+ if (!modelId) {
41
46
  return false;
47
+ }
42
48
  return MISTRAL_MODEL_HINTS.some((hint) => modelId.includes(hint));
43
49
  }
44
50
  export function resolveTranscriptPolicy(params) {
@@ -55,8 +61,13 @@ export function resolveTranscriptPolicy(params) {
55
61
  provider,
56
62
  modelId,
57
63
  });
64
+ const isCopilotClaude = provider === "github-copilot" && modelId.toLowerCase().includes("claude");
65
+ // GitHub Copilot's Claude endpoints can reject persisted `thinking` blocks with
66
+ // non-binary/non-base64 signatures (e.g. thinkingSignature: "reasoning_text").
67
+ // Drop these blocks at send-time to keep sessions usable.
68
+ const dropThinkingBlocks = isCopilotClaude;
58
69
  const needsNonImageSanitize = isGoogle || isAnthropic || isMistral || isOpenRouterGemini;
59
- const sanitizeToolCallIds = isGoogle || isMistral;
70
+ const sanitizeToolCallIds = isGoogle || isMistral || isAnthropic;
60
71
  const toolCallIdMode = isMistral
61
72
  ? "strict9"
62
73
  : sanitizeToolCallIds
@@ -67,6 +78,7 @@ export function resolveTranscriptPolicy(params) {
67
78
  ? { allowBase64Only: true, includeCamelCase: true }
68
79
  : undefined;
69
80
  const normalizeAntigravityThinkingBlocks = isAntigravityClaudeModel;
81
+ const sanitizeThinkingSignatures = isAntigravityClaudeModel;
70
82
  return {
71
83
  sanitizeMode: isOpenAi ? "images-only" : needsNonImageSanitize ? "full" : "images-only",
72
84
  sanitizeToolCallIds: !isOpenAi && sanitizeToolCallIds,
@@ -75,6 +87,8 @@ export function resolveTranscriptPolicy(params) {
75
87
  preserveSignatures: isAntigravityClaudeModel,
76
88
  sanitizeThoughtSignatures: isOpenAi ? undefined : sanitizeThoughtSignatures,
77
89
  normalizeAntigravityThinkingBlocks,
90
+ sanitizeThinkingSignatures,
91
+ dropThinkingBlocks,
78
92
  applyGoogleTurnOrdering: !isOpenAi && isGoogle,
79
93
  validateGeminiTurns: !isOpenAi && isGoogle,
80
94
  validateAnthropicTurns: !isOpenAi && isAnthropic,
@@ -1,3 +1,5 @@
1
+ import { createSubsystemLogger } from "../logging/subsystem.js";
2
+ const log = createSubsystemLogger("venice-models");
1
3
  export const VENICE_BASE_URL = "https://api.venice.ai/api/v1";
2
4
  export const VENICE_DEFAULT_MODEL_ID = "llama-3.3-70b";
3
5
  export const VENICE_DEFAULT_MODEL_REF = `venice/${VENICE_DEFAULT_MODEL_ID}`;
@@ -282,6 +284,11 @@ export function buildVeniceModelDefinition(entry) {
282
284
  cost: VENICE_DEFAULT_COST,
283
285
  contextWindow: entry.contextWindow,
284
286
  maxTokens: entry.maxTokens,
287
+ // Avoid usage-only streaming chunks that can break OpenAI-compatible parsers.
288
+ // See: https://github.com/openclaw/openclaw/issues/15819
289
+ compat: {
290
+ supportsUsageInStreaming: false,
291
+ },
285
292
  };
286
293
  }
287
294
  /**
@@ -298,12 +305,12 @@ export async function discoverVeniceModels() {
298
305
  signal: AbortSignal.timeout(5000),
299
306
  });
300
307
  if (!response.ok) {
301
- console.warn(`[venice-models] Failed to discover models: HTTP ${response.status}, using static catalog`);
308
+ log.warn(`Failed to discover models: HTTP ${response.status}, using static catalog`);
302
309
  return VENICE_MODEL_CATALOG.map(buildVeniceModelDefinition);
303
310
  }
304
311
  const data = (await response.json());
305
312
  if (!Array.isArray(data.data) || data.data.length === 0) {
306
- console.warn("[venice-models] No models found from API, using static catalog");
313
+ log.warn("No models found from API, using static catalog");
307
314
  return VENICE_MODEL_CATALOG.map(buildVeniceModelDefinition);
308
315
  }
309
316
  // Merge discovered models with catalog metadata
@@ -330,13 +337,14 @@ export async function discoverVeniceModels() {
330
337
  cost: VENICE_DEFAULT_COST,
331
338
  contextWindow: apiModel.model_spec.availableContextTokens || 128000,
332
339
  maxTokens: 8192,
340
+ compat: { supportsUsageInStreaming: false },
333
341
  });
334
342
  }
335
343
  }
336
344
  return models.length > 0 ? models : VENICE_MODEL_CATALOG.map(buildVeniceModelDefinition);
337
345
  }
338
346
  catch (error) {
339
- console.warn(`[venice-models] Discovery failed: ${String(error)}, using static catalog`);
347
+ log.warn(`Discovery failed: ${String(error)}, using static catalog`);
340
348
  return VENICE_MODEL_CATALOG.map(buildVeniceModelDefinition);
341
349
  }
342
350
  }