@poolzin/pool-bot 2026.2.24 → 2026.2.26

package/dist/browser/routes/tabs.js

@@ -1,120 +1,174 @@
 import { getProfileContext, jsonError, toNumber, toStringOrEmpty } from "./utils.js";
+function resolveTabsProfileContext(req, res, ctx) {
+    const profileCtx = getProfileContext(req, ctx);
+    if ("error" in profileCtx) {
+        jsonError(res, profileCtx.status, profileCtx.error);
+        return null;
+    }
+    return profileCtx;
+}
+function handleTabsRouteError(ctx, res, err, opts) {
+    if (opts?.mapTabError) {
+        const mapped = ctx.mapTabError(err);
+        if (mapped) {
+            return jsonError(res, mapped.status, mapped.message);
+        }
+    }
+    return jsonError(res, 500, String(err));
+}
+async function withTabsProfileRoute(params) {
+    const profileCtx = resolveTabsProfileContext(params.req, params.res, params.ctx);
+    if (!profileCtx) {
+        return;
+    }
+    try {
+        await params.run(profileCtx);
+    }
+    catch (err) {
+        handleTabsRouteError(params.ctx, params.res, err, { mapTabError: params.mapTabError });
+    }
+}
+async function ensureBrowserRunning(profileCtx, res) {
+    if (!(await profileCtx.isReachable(300))) {
+        jsonError(res, 409, "browser not running");
+        return false;
+    }
+    return true;
+}
+function resolveIndexedTab(tabs, index) {
+    return typeof index === "number" ? tabs[index] : tabs.at(0);
+}
+function parseRequiredTargetId(res, rawTargetId) {
+    const targetId = toStringOrEmpty(rawTargetId);
+    if (!targetId) {
+        jsonError(res, 400, "targetId is required");
+        return null;
+    }
+    return targetId;
+}
+async function runTabTargetMutation(params) {
+    await withTabsProfileRoute({
+        req: params.req,
+        res: params.res,
+        ctx: params.ctx,
+        mapTabError: true,
+        run: async (profileCtx) => {
+            if (!(await ensureBrowserRunning(profileCtx, params.res))) {
+                return;
+            }
+            await params.mutate(profileCtx, params.targetId);
+            params.res.json({ ok: true });
+        },
+    });
+}
 export function registerBrowserTabRoutes(app, ctx) {
     app.get("/tabs", async (req, res) => {
-        const profileCtx = getProfileContext(req, ctx);
-        if ("error" in profileCtx)
-            return jsonError(res, profileCtx.status, profileCtx.error);
-        try {
-            const reachable = await profileCtx.isReachable(300);
-            if (!reachable)
-                return res.json({ running: false, tabs: [] });
-            const tabs = await profileCtx.listTabs();
-            res.json({ running: true, tabs });
-        }
-        catch (err) {
-            jsonError(res, 500, String(err));
-        }
+        await withTabsProfileRoute({
+            req,
+            res,
+            ctx,
+            run: async (profileCtx) => {
+                const reachable = await profileCtx.isReachable(300);
+                if (!reachable) {
+                    return res.json({ running: false, tabs: [] });
+                }
+                const tabs = await profileCtx.listTabs();
+                res.json({ running: true, tabs });
+            },
+        });
     });
     app.post("/tabs/open", async (req, res) => {
-        const profileCtx = getProfileContext(req, ctx);
-        if ("error" in profileCtx)
-            return jsonError(res, profileCtx.status, profileCtx.error);
         const url = toStringOrEmpty(req.body?.url);
-        if (!url)
+        if (!url) {
             return jsonError(res, 400, "url is required");
-        try {
-            await profileCtx.ensureBrowserAvailable();
-            const tab = await profileCtx.openTab(url);
-            res.json(tab);
-        }
-        catch (err) {
-            jsonError(res, 500, String(err));
         }
+        await withTabsProfileRoute({
+            req,
+            res,
+            ctx,
+            mapTabError: true,
+            run: async (profileCtx) => {
+                await profileCtx.ensureBrowserAvailable();
+                const tab = await profileCtx.openTab(url);
+                res.json(tab);
+            },
+        });
     });
     app.post("/tabs/focus", async (req, res) => {
-        const profileCtx = getProfileContext(req, ctx);
-        if ("error" in profileCtx)
-            return jsonError(res, profileCtx.status, profileCtx.error);
-        const targetId = toStringOrEmpty(req.body?.targetId);
-        if (!targetId)
-            return jsonError(res, 400, "targetId is required");
-        try {
-            if (!(await profileCtx.isReachable(300)))
-                return jsonError(res, 409, "browser not running");
-            await profileCtx.focusTab(targetId);
-            res.json({ ok: true });
-        }
-        catch (err) {
-            const mapped = ctx.mapTabError(err);
-            if (mapped)
-                return jsonError(res, mapped.status, mapped.message);
-            jsonError(res, 500, String(err));
+        const targetId = parseRequiredTargetId(res, req.body?.targetId);
+        if (!targetId) {
+            return;
         }
+        await runTabTargetMutation({
+            req,
+            res,
+            ctx,
+            targetId,
+            mutate: async (profileCtx, id) => {
+                await profileCtx.focusTab(id);
+            },
+        });
     });
     app.delete("/tabs/:targetId", async (req, res) => {
-        const profileCtx = getProfileContext(req, ctx);
-        if ("error" in profileCtx)
-            return jsonError(res, profileCtx.status, profileCtx.error);
-        const targetId = toStringOrEmpty(req.params.targetId);
-        if (!targetId)
-            return jsonError(res, 400, "targetId is required");
-        try {
-            if (!(await profileCtx.isReachable(300)))
-                return jsonError(res, 409, "browser not running");
-            await profileCtx.closeTab(targetId);
-            res.json({ ok: true });
-        }
-        catch (err) {
-            const mapped = ctx.mapTabError(err);
-            if (mapped)
-                return jsonError(res, mapped.status, mapped.message);
-            jsonError(res, 500, String(err));
+        const targetId = parseRequiredTargetId(res, req.params.targetId);
+        if (!targetId) {
+            return;
         }
+        await runTabTargetMutation({
+            req,
+            res,
+            ctx,
+            targetId,
+            mutate: async (profileCtx, id) => {
+                await profileCtx.closeTab(id);
+            },
+        });
     });
     app.post("/tabs/action", async (req, res) => {
-        const profileCtx = getProfileContext(req, ctx);
-        if ("error" in profileCtx)
-            return jsonError(res, profileCtx.status, profileCtx.error);
         const action = toStringOrEmpty(req.body?.action);
         const index = toNumber(req.body?.index);
-        try {
-            if (action === "list") {
-                const reachable = await profileCtx.isReachable(300);
-                if (!reachable)
-                    return res.json({ ok: true, tabs: [] });
-                const tabs = await profileCtx.listTabs();
-                return res.json({ ok: true, tabs });
-            }
-            if (action === "new") {
-                await profileCtx.ensureBrowserAvailable();
-                const tab = await profileCtx.openTab("about:blank");
-                return res.json({ ok: true, tab });
-            }
-            if (action === "close") {
-                const tabs = await profileCtx.listTabs();
-                const target = typeof index === "number" ? tabs[index] : tabs.at(0);
-                if (!target)
-                    return jsonError(res, 404, "tab not found");
-                await profileCtx.closeTab(target.targetId);
-                return res.json({ ok: true, targetId: target.targetId });
-            }
-            if (action === "select") {
-                if (typeof index !== "number")
-                    return jsonError(res, 400, "index is required");
-                const tabs = await profileCtx.listTabs();
-                const target = tabs[index];
-                if (!target)
-                    return jsonError(res, 404, "tab not found");
-                await profileCtx.focusTab(target.targetId);
-                return res.json({ ok: true, targetId: target.targetId });
-            }
-            return jsonError(res, 400, "unknown tab action");
-        }
-        catch (err) {
-            const mapped = ctx.mapTabError(err);
-            if (mapped)
-                return jsonError(res, mapped.status, mapped.message);
-            jsonError(res, 500, String(err));
-        }
+        await withTabsProfileRoute({
+            req,
+            res,
+            ctx,
+            mapTabError: true,
+            run: async (profileCtx) => {
+                if (action === "list") {
+                    const reachable = await profileCtx.isReachable(300);
+                    if (!reachable) {
+                        return res.json({ ok: true, tabs: [] });
+                    }
+                    const tabs = await profileCtx.listTabs();
+                    return res.json({ ok: true, tabs });
+                }
+                if (action === "new") {
+                    await profileCtx.ensureBrowserAvailable();
+                    const tab = await profileCtx.openTab("about:blank");
+                    return res.json({ ok: true, tab });
+                }
+                if (action === "close") {
+                    const tabs = await profileCtx.listTabs();
+                    const target = resolveIndexedTab(tabs, index);
+                    if (!target) {
+                        return jsonError(res, 404, "tab not found");
+                    }
+                    await profileCtx.closeTab(target.targetId);
+                    return res.json({ ok: true, targetId: target.targetId });
+                }
+                if (action === "select") {
+                    if (typeof index !== "number") {
+                        return jsonError(res, 400, "index is required");
+                    }
+                    const tabs = await profileCtx.listTabs();
+                    const target = tabs[index];
+                    if (!target) {
+                        return jsonError(res, 404, "tab not found");
+                    }
+                    await profileCtx.focusTab(target.targetId);
+                    return res.json({ ok: true, targetId: target.targetId });
+                }
+                return jsonError(res, 400, "unknown tab action");
+            },
+        });
     });
 }

package/dist/browser/server-context.js

@@ -6,6 +6,13 @@ import { ensureChromeExtensionRelayServer, stopChromeExtensionRelayServer, } fro
 import { getPwAiModule } from "./pw-ai-module.js";
 import { resolveTargetIdFromTabs } from "./target-id.js";
 import { movePathToTrash } from "./trash.js";
+export function listKnownProfileNames(state) {
+    const names = new Set(Object.keys(state.resolved.profiles));
+    for (const name of state.profiles.keys()) {
+        names.add(name);
+    }
+    return [...names];
+}
 /**
  * Normalize a CDP WebSocket URL to use the correct base URL.
  */

package/dist/browser/server-lifecycle.js

@@ -0,0 +1,37 @@
+import { resolveProfile } from "./config.js";
+import { ensureChromeExtensionRelayServer } from "./extension-relay.js";
+import { createBrowserRouteContext, listKnownProfileNames, } from "./server-context.js";
+export async function ensureExtensionRelayForProfiles(params) {
+    for (const name of Object.keys(params.resolved.profiles)) {
+        const profile = resolveProfile(params.resolved, name);
+        if (!profile || profile.driver !== "extension") {
+            continue;
+        }
+        await ensureChromeExtensionRelayServer({ cdpUrl: profile.cdpUrl }).catch((err) => {
+            params.onWarn(`Chrome extension relay init failed for profile "${name}": ${String(err)}`);
+        });
+    }
+}
+export async function stopKnownBrowserProfiles(params) {
+    const current = params.getState();
+    if (!current) {
+        return;
+    }
+    const ctx = createBrowserRouteContext({
+        getState: params.getState,
+        refreshConfigFromDisk: true,
+    });
+    try {
+        for (const name of listKnownProfileNames(current)) {
+            try {
+                await ctx.forProfile(name).stopRunningBrowser();
+            }
+            catch {
+                // ignore
+            }
+        }
+    }
+    catch (err) {
+        params.onWarn(`poolbot browser stop failed: ${String(err)}`);
+    }
+}

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "2026.2.24",
-  "commit": "a3b56c572623e2b952ab704d7f46ed94c14fbcac",
-  "builtAt": "2026-02-19T05:48:26.554Z"
+  "version": "2026.2.26",
+  "commit": "4b0f04755a273f9f6ddec872bab5513127fc7eb3",
+  "builtAt": "2026-02-24T13:30:29.081Z"
 }

package/dist/channels/allow-from.js

@@ -0,0 +1,26 @@
+export function mergeAllowFromSources(params) {
+    const storeEntries = params.dmPolicy === "allowlist" ? [] : (params.storeAllowFrom ?? []);
+    return [...(params.allowFrom ?? []), ...storeEntries]
+        .map((value) => String(value).trim())
+        .filter(Boolean);
+}
+export function firstDefined(...values) {
+    for (const value of values) {
+        if (typeof value !== "undefined") {
+            return value;
+        }
+    }
+    return undefined;
+}
+export function isSenderIdAllowed(allow, senderId, allowWhenEmpty) {
+    if (!allow.hasEntries) {
+        return allowWhenEmpty;
+    }
+    if (allow.hasWildcard) {
+        return true;
+    }
+    if (!senderId) {
+        return false;
+    }
+    return allow.entries.includes(senderId);
+}

package/dist/channels/allowlists/resolve-utils.js

@@ -1,25 +1,25 @@
-export function mergeAllowlist(params) {
+function dedupeAllowlistEntries(entries) {
     const seen = new Set();
-    const merged = [];
-    const push = (value) => {
-        const normalized = value.trim();
+    const deduped = [];
+    for (const entry of entries) {
+        const normalized = entry.trim();
         if (!normalized) {
-            return;
+            continue;
         }
         const key = normalized.toLowerCase();
         if (seen.has(key)) {
-            return;
+            continue;
         }
         seen.add(key);
-        merged.push(normalized);
-    };
-    for (const entry of params.existing ?? []) {
-        push(String(entry));
+        deduped.push(normalized);
     }
-    for (const entry of params.additions) {
-        push(entry);
-    }
-    return merged;
+    return deduped;
+}
+export function mergeAllowlist(params) {
+    return dedupeAllowlistEntries([
+        ...(params.existing ?? []).map((entry) => String(entry)),
+        ...params.additions,
+    ]);
 }
 export function buildAllowlistResolutionSummary(resolvedUsers, opts) {
     const resolvedMap = new Map(resolvedUsers.map((entry) => [entry.input, entry]));
@@ -46,6 +46,22 @@ export function resolveAllowlistIdAdditions(params) {
     }
     return additions;
 }
+export function canonicalizeAllowlistWithResolvedIds(params) {
+    const canonicalized = [];
+    for (const entry of params.existing ?? []) {
+        const trimmed = String(entry).trim();
+        if (!trimmed) {
+            continue;
+        }
+        if (trimmed === "*") {
+            canonicalized.push(trimmed);
+            continue;
+        }
+        const resolved = params.resolvedMap.get(trimmed);
+        canonicalized.push(resolved?.resolved && resolved.id ? resolved.id : trimmed);
+    }
+    return dedupeAllowlistEntries(canonicalized);
+}
 export function patchAllowlistUsersInConfigEntries(params) {
     const nextEntries = { ...params.entries };
     for (const [entryKey, entryConfig] of Object.entries(params.entries)) {
@@ -56,13 +72,21 @@ export function patchAllowlistUsersInConfigEntries(params) {
         if (!Array.isArray(users) || users.length === 0) {
             continue;
         }
-        const additions = resolveAllowlistIdAdditions({
-            existing: users,
-            resolvedMap: params.resolvedMap,
-        });
+        const resolvedUsers = params.strategy === "canonicalize"
+            ? canonicalizeAllowlistWithResolvedIds({
+                existing: users,
+                resolvedMap: params.resolvedMap,
+            })
+            : mergeAllowlist({
+                existing: users,
+                additions: resolveAllowlistIdAdditions({
+                    existing: users,
+                    resolvedMap: params.resolvedMap,
+                }),
+            });
         nextEntries[entryKey] = {
             ...entryConfig,
-            users: mergeAllowlist({ existing: users, additions }),
+            users: resolvedUsers,
         };
     }
     return nextEntries;

package/dist/channels/channel-config.js

@@ -6,8 +6,9 @@ export function applyChannelMatchMeta(result, match) {
     return result;
 }
 export function resolveChannelMatchConfig(match, resolveEntry) {
-    if (!match.entry)
+    if (!match.entry) {
         return null;
+    }
     return applyChannelMatchMeta(resolveEntry(match.entry), match);
 }
 export function normalizeChannelSlug(value) {
@@ -22,11 +23,13 @@ export function buildChannelKeyCandidates(...keys) {
     const seen = new Set();
     const candidates = [];
     for (const key of keys) {
-        if (typeof key !== "string")
+        if (typeof key !== "string") {
             continue;
+        }
         const trimmed = key.trim();
-        if (!trimmed || seen.has(trimmed))
+        if (!trimmed || seen.has(trimmed)) {
             continue;
+        }
         seen.add(trimmed);
         candidates.push(trimmed);
     }
@@ -36,8 +39,9 @@ export function resolveChannelEntryMatch(params) {
     const entries = params.entries ?? {};
     const match = {};
     for (const key of params.keys) {
-        if (!Object.prototype.hasOwnProperty.call(entries, key))
+        if (!Object.prototype.hasOwnProperty.call(entries, key)) {
             continue;
+        }
         match.entry = entries[key];
         match.key = key;
         break;
@@ -121,11 +125,14 @@ export function resolveChannelEntryMatchWithFallback(params) {
     return direct;
 }
 export function resolveNestedAllowlistDecision(params) {
-    if (!params.outerConfigured)
+    if (!params.outerConfigured) {
         return true;
-    if (!params.outerMatched)
+    }
+    if (!params.outerMatched) {
         return false;
-    if (!params.innerConfigured)
+    }
+    if (!params.innerConfigured) {
         return true;
+    }
     return params.innerMatched;
 }

package/dist/channels/draft-stream-loop.js

@@ -72,6 +72,13 @@ export function createDraftStreamLoop(params) {
         resetPending: () => {
             pendingText = "";
         },
+        resetThrottleWindow: () => {
+            lastSentAt = 0;
+            if (timer) {
+                clearTimeout(timer);
+                timer = undefined;
+            }
+        },
         waitForInFlight: async () => {
             if (inFlightPromise) {
                 await inFlightPromise;

package/dist/channels/model-overrides.js

@@ -0,0 +1,82 @@
+import { parseAgentSessionKey } from "../sessions/session-key-utils.js";
+import { normalizeMessageChannel } from "../utils/message-channel.js";
+import { buildChannelKeyCandidates, normalizeChannelSlug, resolveChannelEntryMatchWithFallback, } from "./channel-config.js";
+const THREAD_SUFFIX_REGEX = /:(?:thread|topic):[^:]+$/i;
+function resolveProviderEntry(modelByChannel, channel) {
+    const normalized = normalizeMessageChannel(channel) ?? channel.trim().toLowerCase();
+    return (modelByChannel?.[normalized] ??
+        modelByChannel?.[Object.keys(modelByChannel ?? {}).find((key) => {
+            const normalizedKey = normalizeMessageChannel(key) ?? key.trim().toLowerCase();
+            return normalizedKey === normalized;
+        }) ?? ""]);
+}
+function resolveParentGroupId(groupId) {
+    const raw = groupId?.trim();
+    if (!raw || !THREAD_SUFFIX_REGEX.test(raw)) {
+        return undefined;
+    }
+    const parent = raw.replace(THREAD_SUFFIX_REGEX, "").trim();
+    return parent && parent !== raw ? parent : undefined;
+}
+function resolveGroupIdFromSessionKey(sessionKey) {
+    const raw = sessionKey?.trim();
+    if (!raw) {
+        return undefined;
+    }
+    const parsed = parseAgentSessionKey(raw);
+    const candidate = parsed?.rest ?? raw;
+    const match = candidate.match(/(?:^|:)(?:group|channel):([^:]+)(?::|$)/i);
+    const id = match?.[1]?.trim();
+    return id || undefined;
+}
+function buildChannelCandidates(params) {
+    const groupId = params.groupId?.trim();
+    const parentGroupId = resolveParentGroupId(groupId);
+    const parentGroupIdFromSession = resolveGroupIdFromSessionKey(params.parentSessionKey);
+    const parentGroupIdResolved = resolveParentGroupId(parentGroupIdFromSession) ?? parentGroupIdFromSession;
+    const groupChannel = params.groupChannel?.trim();
+    const groupSubject = params.groupSubject?.trim();
+    const channelBare = groupChannel ? groupChannel.replace(/^#/, "") : undefined;
+    const subjectBare = groupSubject ? groupSubject.replace(/^#/, "") : undefined;
+    const channelSlug = channelBare ? normalizeChannelSlug(channelBare) : undefined;
+    const subjectSlug = subjectBare ? normalizeChannelSlug(subjectBare) : undefined;
+    return buildChannelKeyCandidates(groupId, parentGroupId, parentGroupIdResolved, groupChannel, channelBare, channelSlug, groupSubject, subjectBare, subjectSlug);
+}
+export function resolveChannelModelOverride(params) {
+    const channel = params.channel?.trim();
+    if (!channel) {
+        return null;
+    }
+    const modelByChannel = params.cfg.channels?.modelByChannel;
+    if (!modelByChannel) {
+        return null;
+    }
+    const providerEntries = resolveProviderEntry(modelByChannel, channel);
+    if (!providerEntries) {
+        return null;
+    }
+    const candidates = buildChannelCandidates(params);
+    if (candidates.length === 0) {
+        return null;
+    }
+    const match = resolveChannelEntryMatchWithFallback({
+        entries: providerEntries,
+        keys: candidates,
+        wildcardKey: "*",
+        normalizeKey: (value) => value.trim().toLowerCase(),
+    });
+    const raw = match.entry ?? match.wildcardEntry;
+    if (typeof raw !== "string") {
+        return null;
+    }
+    const model = raw.trim();
+    if (!model) {
+        return null;
+    }
+    return {
+        channel: normalizeMessageChannel(channel) ?? channel.trim().toLowerCase(),
+        model,
+        matchKey: match.matchKey,
+        matchSource: match.matchSource,
+    };
+}

package/dist/channels/plugins/account-action-gate.js

@@ -0,0 +1,13 @@
+export function createAccountActionGate(params) {
+    return (key, defaultValue = true) => {
+        const accountValue = params.accountActions?.[key];
+        if (accountValue !== undefined) {
+            return accountValue;
+        }
+        const baseValue = params.baseActions?.[key];
+        if (baseValue !== undefined) {
+            return baseValue;
+        }
+        return defaultValue;
+    };
+}

package/dist/channels/plugins/message-actions.js

@@ -1,4 +1,11 @@
 import { getChannelPlugin, listChannelPlugins } from "./index.js";
+const trustedRequesterRequiredByChannel = {
+    discord: new Set(["timeout", "kick", "ban"]),
+};
+function requiresTrustedRequesterSender(ctx) {
+    const actions = trustedRequesterRequiredByChannel[ctx.channel];
+    return Boolean(actions?.has(ctx.action) && ctx.toolContext);
+}
 export function listChannelMessageActions(cfg) {
     const actions = new Set(["send", "broadcast"]);
     for (const plugin of listChannelPlugins()) {
@@ -43,6 +50,9 @@ export function supportsChannelMessageCardsForChannel(params) {
     return plugin?.actions?.supportsCards?.({ cfg: params.cfg }) === true;
 }
 export async function dispatchChannelMessageAction(ctx) {
+    if (requiresTrustedRequesterSender(ctx) && !ctx.requesterSenderId?.trim()) {
+        throw new Error(`Trusted sender identity is required for ${ctx.channel}:${ctx.action} in tool-driven contexts.`);
+    }
     const plugin = getChannelPlugin(ctx.channel);
     if (!plugin?.actions?.handleAction) {
         return null;