@poolzin/pool-bot 2026.2.24 → 2026.2.26

package/dist/config/schema.labels.js

@@ -113,7 +113,7 @@ export const FIELD_LABELS = {
     "gateway.controlUi.basePath": "Control UI Base Path",
     "gateway.controlUi.root": "Control UI Assets Root",
     "gateway.controlUi.allowedOrigins": "Control UI Allowed Origins",
-    "gateway.controlUi.allowInsecureAuth": "Allow Insecure Control UI Auth",
+    "gateway.controlUi.allowInsecureAuth": "Insecure Control UI Auth Toggle",
     "gateway.controlUi.dangerouslyDisableDeviceAuth": "Dangerously Disable Control UI Device Auth",
     "gateway.http.endpoints.chatCompletions.enabled": "OpenAI Chat Completions Endpoint",
     "gateway.reload.mode": "Config Reload Mode",
@@ -163,6 +163,10 @@ export const FIELD_LABELS = {
     "agents.defaults.memorySearch.query.hybrid.vectorWeight": "Memory Search Vector Weight",
     "agents.defaults.memorySearch.query.hybrid.textWeight": "Memory Search Text Weight",
     "agents.defaults.memorySearch.query.hybrid.candidateMultiplier": "Memory Search Hybrid Candidate Multiplier",
+    "agents.defaults.memorySearch.query.hybrid.mmr.enabled": "Memory Search MMR Re-ranking",
+    "agents.defaults.memorySearch.query.hybrid.mmr.lambda": "Memory Search MMR Lambda",
+    "agents.defaults.memorySearch.query.hybrid.temporalDecay.enabled": "Memory Search Temporal Decay",
+    "agents.defaults.memorySearch.query.hybrid.temporalDecay.halfLifeDays": "Memory Search Temporal Decay Half-life (Days)",
     "agents.defaults.memorySearch.cache.enabled": "Memory Search Embedding Cache",
     "agents.defaults.memorySearch.cache.maxEntries": "Memory Search Embedding Cache Max Entries",
     memory: "Memory",
@@ -216,19 +220,31 @@ export const FIELD_LABELS = {
     "commands.restart": "Allow Restart",
     "commands.useAccessGroups": "Use Access Groups",
     "commands.ownerAllowFrom": "Command Owners",
+    "commands.ownerDisplay": "Owner ID Display",
+    "commands.ownerDisplaySecret": "Owner ID Hash Secret",
     "ui.seamColor": "Accent Color",
     "ui.assistant.name": "Assistant Name",
     "ui.assistant.avatar": "Assistant Avatar",
     "browser.evaluateEnabled": "Browser Evaluate Enabled",
     "browser.snapshotDefaults": "Browser Snapshot Defaults",
     "browser.snapshotDefaults.mode": "Browser Snapshot Mode",
+    "browser.ssrfPolicy": "Browser SSRF Policy",
+    "browser.ssrfPolicy.allowPrivateNetwork": "Browser Allow Private Network",
+    "browser.ssrfPolicy.allowedHostnames": "Browser Allowed Hostnames",
+    "browser.ssrfPolicy.hostnameAllowlist": "Browser Hostname Allowlist",
     "browser.remoteCdpTimeoutMs": "Remote CDP Timeout (ms)",
     "browser.remoteCdpHandshakeTimeoutMs": "Remote CDP Handshake Timeout (ms)",
     "session.dmScope": "DM Session Scope",
+    "session.threadBindings.enabled": "Thread Binding Enabled",
+    "session.threadBindings.ttlHours": "Thread Binding TTL (hours)",
     "session.agentToAgent.maxPingPongTurns": "Agent-to-Agent Ping-Pong Turns",
     "messages.suppressToolErrors": "Suppress Tool Error Warnings",
     "messages.ackReaction": "Ack Reaction Emoji",
     "messages.ackReactionScope": "Ack Reaction Scope",
+    "messages.statusReactions": "Status Reactions",
+    "messages.statusReactions.enabled": "Enable Status Reactions",
+    "messages.statusReactions.emojis": "Status Reaction Emojis",
+    "messages.statusReactions.timing": "Status Reaction Timing",
     "messages.inbound.debounceMs": "Inbound Message Debounce (ms)",
     "talk.apiKey": "Talk API Key",
     "channels.whatsapp": "WhatsApp",
@@ -241,13 +257,11 @@ export const FIELD_LABELS = {
     "channels.imessage": "iMessage",
     "channels.bluebubbles": "BlueBubbles",
     "channels.msteams": "MS Teams",
+    "channels.modelByChannel": "Channel Model Overrides",
     ...IRC_FIELD_LABELS,
     "channels.telegram.botToken": "Telegram Bot Token",
     "channels.telegram.dmPolicy": "Telegram DM Policy",
-    "channels.telegram.streamMode": "Telegram Stream Mode",
-    "channels.telegram.draftChunk.minChars": "Telegram Draft Chunk Min Chars",
-    "channels.telegram.draftChunk.maxChars": "Telegram Draft Chunk Max Chars",
-    "channels.telegram.draftChunk.breakPreference": "Telegram Draft Chunk Break Preference",
+    "channels.telegram.streaming": "Telegram Streaming Mode",
     "channels.telegram.retry.attempts": "Telegram Retry Attempts",
     "channels.telegram.retry.minDelayMs": "Telegram Retry Min Delay (ms)",
     "channels.telegram.retry.maxDelayMs": "Telegram Retry Max Delay (ms)",
@@ -263,14 +277,24 @@ export const FIELD_LABELS = {
     "channels.bluebubbles.dmPolicy": "BlueBubbles DM Policy",
     "channels.discord.dmPolicy": "Discord DM Policy",
     "channels.discord.dm.policy": "Discord DM Policy",
+    "channels.discord.streaming": "Discord Streaming Mode",
+    "channels.discord.streamMode": "Discord Stream Mode (Legacy)",
+    "channels.discord.draftChunk.minChars": "Discord Draft Chunk Min Chars",
+    "channels.discord.draftChunk.maxChars": "Discord Draft Chunk Max Chars",
+    "channels.discord.draftChunk.breakPreference": "Discord Draft Chunk Break Preference",
     "channels.discord.retry.attempts": "Discord Retry Attempts",
     "channels.discord.retry.minDelayMs": "Discord Retry Min Delay (ms)",
     "channels.discord.retry.maxDelayMs": "Discord Retry Max Delay (ms)",
     "channels.discord.retry.jitter": "Discord Retry Jitter",
     "channels.discord.maxLinesPerMessage": "Discord Max Lines Per Message",
+    "channels.discord.threadBindings.enabled": "Discord Thread Binding Enabled",
+    "channels.discord.threadBindings.ttlHours": "Discord Thread Binding TTL (hours)",
+    "channels.discord.threadBindings.spawnSubagentSessions": "Discord Thread-Bound Subagent Spawn",
     "channels.discord.ui.components.accentColor": "Discord Component Accent Color",
     "channels.discord.intents.presence": "Discord Presence Intent",
     "channels.discord.intents.guildMembers": "Discord Guild Members Intent",
+    "channels.discord.voice.enabled": "Discord Voice Enabled",
+    "channels.discord.voice.autoJoin": "Discord Voice Auto-Join",
     "channels.discord.pluralkit.enabled": "Discord PluralKit Enabled",
     "channels.discord.pluralkit.token": "Discord PluralKit Token",
     "channels.discord.activity": "Discord Presence Activity",
@@ -285,7 +309,9 @@ export const FIELD_LABELS = {
     "channels.slack.appToken": "Slack App Token",
     "channels.slack.userToken": "Slack User Token",
     "channels.slack.userTokenReadOnly": "Slack User Token Read Only",
-    "channels.slack.streamMode": "Slack Stream Mode",
+    "channels.slack.streaming": "Slack Streaming Mode",
+    "channels.slack.nativeStreaming": "Slack Native Streaming",
+    "channels.slack.streamMode": "Slack Stream Mode (Legacy)",
     "channels.slack.thread.historyScope": "Slack Thread History Scope",
     "channels.slack.thread.inheritParent": "Slack Thread Parent Inheritance",
     "channels.slack.thread.initialHistoryLimit": "Slack Thread Initial History Limit",
@@ -314,5 +340,11 @@ export const FIELD_LABELS = {
     "plugins.installs.*.sourcePath": "Plugin Install Source Path",
     "plugins.installs.*.installPath": "Plugin Install Path",
     "plugins.installs.*.version": "Plugin Install Version",
+    "plugins.installs.*.resolvedName": "Plugin Resolved Package Name",
+    "plugins.installs.*.resolvedVersion": "Plugin Resolved Package Version",
+    "plugins.installs.*.resolvedSpec": "Plugin Resolved Package Spec",
+    "plugins.installs.*.integrity": "Plugin Resolved Integrity",
+    "plugins.installs.*.shasum": "Plugin Resolved Shasum",
+    "plugins.installs.*.resolvedAt": "Plugin Resolution Time",
     "plugins.installs.*.installedAt": "Plugin Install Time",
 };

package/dist/config/sessions/delivery-info.js

@@ -5,9 +5,9 @@ import { loadSessionStore } from "./store.js";
  * Extract deliveryContext and threadId from a sessionKey.
  * Supports both :thread: (most channels) and :topic: (Telegram).
  */
-export function extractDeliveryInfo(sessionKey) {
+export function parseSessionThreadInfo(sessionKey) {
     if (!sessionKey) {
-        return { deliveryContext: undefined, threadId: undefined };
+        return { baseSessionKey: undefined, threadId: undefined };
     }
     const topicIndex = sessionKey.lastIndexOf(":topic:");
     const threadIndex = sessionKey.lastIndexOf(":thread:");
@@ -16,13 +16,20 @@ export function extractDeliveryInfo(sessionKey) {
     const baseSessionKey = markerIndex === -1 ? sessionKey : sessionKey.slice(0, markerIndex);
     const threadIdRaw = markerIndex === -1 ? undefined : sessionKey.slice(markerIndex + marker.length);
     const threadId = threadIdRaw?.trim() || undefined;
+    return { baseSessionKey, threadId };
+}
+export function extractDeliveryInfo(sessionKey) {
+    const { baseSessionKey, threadId } = parseSessionThreadInfo(sessionKey);
+    if (!sessionKey || !baseSessionKey) {
+        return { deliveryContext: undefined, threadId };
+    }
     let deliveryContext;
     try {
         const cfg = loadConfig();
         const storePath = resolveStorePath(cfg.session?.store);
         const store = loadSessionStore(storePath);
         let entry = store[sessionKey];
-        if (!entry?.deliveryContext && markerIndex !== -1 && baseSessionKey) {
+        if (!entry?.deliveryContext && baseSessionKey !== sessionKey) {
             entry = store[baseSessionKey];
         }
         if (entry?.deliveryContext) {

package/dist/config/sessions/main-session.js

@@ -1,8 +1,9 @@
 import { buildAgentMainSessionKey, DEFAULT_AGENT_ID, normalizeAgentId, normalizeMainKey, resolveAgentIdFromSessionKey, } from "../../routing/session-key.js";
 import { loadConfig } from "../config.js";
 export function resolveMainSessionKey(cfg) {
-    if (cfg?.session?.scope === "global")
+    if (cfg?.session?.scope === "global") {
         return "global";
+    }
     const agents = cfg?.agents?.list ?? [];
     const defaultAgentId = agents.find((agent) => agent?.default)?.id ?? agents[0]?.id ?? DEFAULT_AGENT_ID;
     const agentId = normalizeAgentId(defaultAgentId);
@@ -19,14 +20,16 @@ export function resolveAgentMainSessionKey(params) {
 }
 export function resolveExplicitAgentSessionKey(params) {
     const agentId = params.agentId?.trim();
-    if (!agentId)
+    if (!agentId) {
         return undefined;
+    }
     return resolveAgentMainSessionKey({ cfg: params.cfg, agentId });
 }
 export function canonicalizeMainSessionAlias(params) {
     const raw = params.sessionKey.trim();
-    if (!raw)
+    if (!raw) {
         return raw;
+    }
     const agentId = normalizeAgentId(params.agentId);
     const mainKey = normalizeMainKey(params.cfg?.session?.mainKey);
     const agentMainSessionKey = buildAgentMainSessionKey({ agentId, mainKey });
@@ -35,9 +38,11 @@ export function canonicalizeMainSessionAlias(params) {
         mainKey: "main",
     });
     const isMainAlias = raw === "main" || raw === mainKey || raw === agentMainSessionKey || raw === agentMainAliasKey;
-    if (params.cfg?.session?.scope === "global" && isMainAlias)
+    if (params.cfg?.session?.scope === "global" && isMainAlias) {
         return "global";
-    if (isMainAlias)
+    }
+    if (isMainAlias) {
         return agentMainSessionKey;
+    }
     return raw;
 }

package/dist/config/sessions/session-file.js

@@ -0,0 +1,33 @@
+import { resolveSessionFilePath } from "./paths.js";
+import { updateSessionStore } from "./store.js";
+export async function resolveAndPersistSessionFile(params) {
+    const { sessionId, sessionKey, sessionStore, storePath } = params;
+    const baseEntry = params.sessionEntry ??
+        sessionStore[sessionKey] ?? { sessionId, updatedAt: Date.now() };
+    const fallbackSessionFile = params.fallbackSessionFile?.trim();
+    const entryForResolve = !baseEntry.sessionFile && fallbackSessionFile
+        ? { ...baseEntry, sessionFile: fallbackSessionFile }
+        : baseEntry;
+    const sessionFile = resolveSessionFilePath(sessionId, entryForResolve, {
+        agentId: params.agentId,
+        sessionsDir: params.sessionsDir,
+    });
+    const persistedEntry = {
+        ...baseEntry,
+        sessionId,
+        updatedAt: Date.now(),
+        sessionFile,
+    };
+    if (baseEntry.sessionId !== sessionId || baseEntry.sessionFile !== sessionFile) {
+        sessionStore[sessionKey] = persistedEntry;
+        await updateSessionStore(storePath, (store) => {
+            store[sessionKey] = {
+                ...store[sessionKey],
+                ...persistedEntry,
+            };
+        }, params.activeSessionKey ? { activeSessionKey: params.activeSessionKey } : undefined);
+        return { sessionFile, sessionEntry: persistedEntry };
+    }
+    sessionStore[sessionKey] = persistedEntry;
+    return { sessionFile, sessionEntry: persistedEntry };
+}

package/dist/config/sessions/session-key.js

@@ -3,11 +3,13 @@ import { normalizeE164 } from "../../utils.js";
 import { resolveGroupSessionKey } from "./group.js";
 // Decide which session bucket to use (per-sender vs global).
 export function deriveSessionKey(scope, ctx) {
-    if (scope === "global")
+    if (scope === "global") {
         return "global";
+    }
     const resolvedGroup = resolveGroupSessionKey(ctx);
-    if (resolvedGroup)
+    if (resolvedGroup) {
         return resolvedGroup.key;
+    }
     const from = ctx.From ? normalizeE164(ctx.From) : "";
     return from || "unknown";
 }
@@ -17,18 +19,21 @@ export function deriveSessionKey(scope, ctx) {
  */
 export function resolveSessionKey(scope, ctx, mainKey) {
     const explicit = ctx.SessionKey?.trim();
-    if (explicit)
+    if (explicit) {
         return explicit.toLowerCase();
+    }
     const raw = deriveSessionKey(scope, ctx);
-    if (scope === "global")
+    if (scope === "global") {
         return raw;
+    }
     const canonicalMainKey = normalizeMainKey(mainKey);
     const canonical = buildAgentMainSessionKey({
         agentId: DEFAULT_AGENT_ID,
         mainKey: canonicalMainKey,
     });
     const isGroup = raw.includes(":group:") || raw.includes(":channel:");
-    if (!isGroup)
+    if (!isGroup) {
         return canonical;
+    }
     return `agent:${DEFAULT_AGENT_ID}:${raw}`;
 }

package/dist/config/sessions/store.js

@@ -472,7 +472,7 @@ async function saveSessionStoreUnlocked(storePath, store, opts) {
                     // Final attempt failed — skip this save.  The write lock ensures
                     // the next save will retry with fresh data.  Log for diagnostics.
                     if (i === 4) {
-                        console.warn(`[session-store] rename failed after 5 attempts: ${storePath}`);
+                        log.warn(`rename failed after 5 attempts: ${storePath}`);
                     }
                 }
             }

package/dist/config/sessions.js

@@ -7,4 +7,5 @@ export * from "./sessions/session-key.js";
 export * from "./sessions/store.js";
 export * from "./sessions/types.js";
 export * from "./sessions/transcript.js";
+export * from "./sessions/session-file.js";
 export * from "./sessions/delivery-info.js";

package/dist/config/validation.js

@@ -4,6 +4,7 @@ import { CHANNEL_IDS, normalizeChatChannelId } from "../channels/registry.js";
 import { normalizePluginsConfig, resolveEnableState, resolveMemorySlotDecision, } from "../plugins/config-state.js";
 import { loadPluginManifestRegistry } from "../plugins/manifest-registry.js";
 import { validateJsonSchemaValue } from "../plugins/schema-validator.js";
+import { isRecord } from "../utils.js";
 import { findDuplicateAgentDirs, formatDuplicateAgentDirError } from "./agent-dirs.js";
 import { applyAgentDefaults, applyModelDefaults, applySessionDefaults } from "./defaults.js";
 import { findLegacyConfigIssues } from "./legacy.js";
@@ -16,28 +17,35 @@ function isWorkspaceAvatarPath(value, workspaceDir) {
     const workspaceRoot = path.resolve(workspaceDir);
     const resolved = path.resolve(workspaceRoot, value);
     const relative = path.relative(workspaceRoot, resolved);
-    if (relative === "")
+    if (relative === "") {
         return true;
-    if (relative.startsWith(".."))
+    }
+    if (relative.startsWith("..")) {
         return false;
+    }
     return !path.isAbsolute(relative);
 }
 function validateIdentityAvatar(config) {
     const agents = config.agents?.list;
-    if (!Array.isArray(agents) || agents.length === 0)
+    if (!Array.isArray(agents) || agents.length === 0) {
         return [];
+    }
     const issues = [];
     for (const [index, entry] of agents.entries()) {
-        if (!entry || typeof entry !== "object")
+        if (!entry || typeof entry !== "object") {
             continue;
+        }
         const avatarRaw = entry.identity?.avatar;
-        if (typeof avatarRaw !== "string")
+        if (typeof avatarRaw !== "string") {
             continue;
+        }
         const avatar = avatarRaw.trim();
-        if (!avatar)
+        if (!avatar) {
             continue;
-        if (AVATAR_DATA_RE.test(avatar) || AVATAR_HTTP_RE.test(avatar))
+        }
+        if (AVATAR_DATA_RE.test(avatar) || AVATAR_HTTP_RE.test(avatar)) {
             continue;
+        }
         if (avatar.startsWith("~")) {
             issues.push({
                 path: `agents.list.${index}.identity.avatar`,
@@ -63,7 +71,11 @@ function validateIdentityAvatar(config) {
     }
     return issues;
 }
-export function validateConfigObject(raw) {
+/**
+ * Validates config without applying runtime defaults.
+ * Use this when you need the raw validated config (e.g., for writing back to file).
+ */
+export function validateConfigObjectRaw(raw) {
     const legacyIssues = findLegacyConfigIssues(raw);
     if (legacyIssues.length > 0) {
         return {
@@ -102,42 +114,136 @@ export function validateConfigObject(raw) {
     }
     return {
         ok: true,
-        config: applyModelDefaults(applyAgentDefaults(applySessionDefaults(validated.data))),
+        config: validated.data,
     };
 }
-function isRecord(value) {
-    return Boolean(value && typeof value === "object" && !Array.isArray(value));
+export function validateConfigObject(raw) {
+    const result = validateConfigObjectRaw(raw);
+    if (!result.ok) {
+        return result;
+    }
+    return {
+        ok: true,
+        config: applyModelDefaults(applyAgentDefaults(applySessionDefaults(result.config))),
+    };
 }
 export function validateConfigObjectWithPlugins(raw) {
-    const base = validateConfigObject(raw);
+    return validateConfigObjectWithPluginsBase(raw, { applyDefaults: true });
+}
+export function validateConfigObjectRawWithPlugins(raw) {
+    return validateConfigObjectWithPluginsBase(raw, { applyDefaults: false });
+}
+function validateConfigObjectWithPluginsBase(raw, opts) {
+    const base = opts.applyDefaults ? validateConfigObject(raw) : validateConfigObjectRaw(raw);
     if (!base.ok) {
         return { ok: false, issues: base.issues, warnings: [] };
     }
     const config = base.config;
     const issues = [];
     const warnings = [];
-    const pluginsConfig = config.plugins;
-    const normalizedPlugins = normalizePluginsConfig(pluginsConfig);
-    const workspaceDir = resolveAgentWorkspaceDir(config, resolveDefaultAgentId(config));
-    const registry = loadPluginManifestRegistry({
-        config,
-        workspaceDir: workspaceDir ?? undefined,
-    });
-    const knownIds = new Set(registry.plugins.map((record) => record.id));
-    for (const diag of registry.diagnostics) {
-        let path = diag.pluginId ? `plugins.entries.${diag.pluginId}` : "plugins";
-        if (!diag.pluginId && diag.message.includes("plugin path not found")) {
-            path = "plugins.load.paths";
+    const hasExplicitPluginsConfig = isRecord(raw) && Object.prototype.hasOwnProperty.call(raw, "plugins");
+    let registryInfo = null;
+    const ensureRegistry = () => {
+        if (registryInfo) {
+            return registryInfo;
+        }
+        const workspaceDir = resolveAgentWorkspaceDir(config, resolveDefaultAgentId(config));
+        const registry = loadPluginManifestRegistry({
+            config,
+            workspaceDir: workspaceDir ?? undefined,
+        });
+        const knownIds = new Set(registry.plugins.map((record) => record.id));
+        const normalizedPlugins = normalizePluginsConfig(config.plugins);
+        for (const diag of registry.diagnostics) {
+            let path = diag.pluginId ? `plugins.entries.${diag.pluginId}` : "plugins";
+            if (!diag.pluginId && diag.message.includes("plugin path not found")) {
+                path = "plugins.load.paths";
+            }
+            const pluginLabel = diag.pluginId ? `plugin ${diag.pluginId}` : "plugin";
+            const message = `${pluginLabel}: ${diag.message}`;
+            if (diag.level === "error") {
+                issues.push({ path, message });
+            }
+            else {
+                warnings.push({ path, message });
+            }
+        }
+        registryInfo = { registry, knownIds, normalizedPlugins };
+        return registryInfo;
+    };
+    const allowedChannels = new Set(["defaults", ...CHANNEL_IDS]);
+    if (config.channels && isRecord(config.channels)) {
+        for (const key of Object.keys(config.channels)) {
+            const trimmed = key.trim();
+            if (!trimmed) {
+                continue;
+            }
+            if (!allowedChannels.has(trimmed)) {
+                const { registry } = ensureRegistry();
+                for (const record of registry.plugins) {
+                    for (const channelId of record.channels) {
+                        allowedChannels.add(channelId);
+                    }
+                }
+            }
+            if (!allowedChannels.has(trimmed)) {
+                issues.push({
+                    path: `channels.${trimmed}`,
+                    message: `unknown channel id: ${trimmed}`,
+                });
+            }
+        }
+    }
+    const heartbeatChannelIds = new Set();
+    for (const channelId of CHANNEL_IDS) {
+        heartbeatChannelIds.add(channelId.toLowerCase());
+    }
+    const validateHeartbeatTarget = (target, path) => {
+        if (typeof target !== "string") {
+            return;
+        }
+        const trimmed = target.trim();
+        if (!trimmed) {
+            issues.push({ path, message: "heartbeat target must not be empty" });
+            return;
+        }
+        const normalized = trimmed.toLowerCase();
+        if (normalized === "last" || normalized === "none") {
+            return;
+        }
+        if (normalizeChatChannelId(trimmed)) {
+            return;
         }
-        const pluginLabel = diag.pluginId ? `plugin ${diag.pluginId}` : "plugin";
-        const message = `${pluginLabel}: ${diag.message}`;
-        if (diag.level === "error") {
-            issues.push({ path, message });
+        if (!heartbeatChannelIds.has(normalized)) {
+            const { registry } = ensureRegistry();
+            for (const record of registry.plugins) {
+                for (const channelId of record.channels) {
+                    const pluginChannel = channelId.trim();
+                    if (pluginChannel) {
+                        heartbeatChannelIds.add(pluginChannel.toLowerCase());
+                    }
+                }
+            }
         }
-        else {
-            warnings.push({ path, message });
+        if (heartbeatChannelIds.has(normalized)) {
+            return;
+        }
+        issues.push({ path, message: `unknown heartbeat target: ${target}` });
+    };
+    validateHeartbeatTarget(config.agents?.defaults?.heartbeat?.target, "agents.defaults.heartbeat.target");
+    if (Array.isArray(config.agents?.list)) {
+        for (const [index, entry] of config.agents.list.entries()) {
+            validateHeartbeatTarget(entry?.heartbeat?.target, `agents.list.${index}.heartbeat.target`);
         }
     }
+    if (!hasExplicitPluginsConfig) {
+        if (issues.length > 0) {
+            return { ok: false, issues, warnings };
+        }
+        return { ok: true, config, warnings };
+    }
+    const { registry, knownIds, normalizedPlugins } = ensureRegistry();
+    const pluginsConfig = config.plugins;
     const entries = pluginsConfig?.entries;
     if (entries && isRecord(entries)) {
         for (const pluginId of Object.keys(entries)) {
@@ -151,8 +257,9 @@ export function validateConfigObjectWithPlugins(raw) {
     }
     const allow = pluginsConfig?.allow ?? [];
     for (const pluginId of allow) {
-        if (typeof pluginId !== "string" || !pluginId.trim())
+        if (typeof pluginId !== "string" || !pluginId.trim()) {
             continue;
+        }
         if (!knownIds.has(pluginId)) {
             issues.push({
                 path: "plugins.allow",
@@ -162,8 +269,9 @@ export function validateConfigObjectWithPlugins(raw) {
     }
     const deny = pluginsConfig?.deny ?? [];
     for (const pluginId of deny) {
-        if (typeof pluginId !== "string" || !pluginId.trim())
+        if (typeof pluginId !== "string" || !pluginId.trim()) {
             continue;
+        }
         if (!knownIds.has(pluginId)) {
             issues.push({
                 path: "plugins.deny",
@@ -178,59 +286,6 @@ export function validateConfigObjectWithPlugins(raw) {
             message: `plugin not found: ${memorySlot}`,
         });
     }
-    const allowedChannels = new Set(["defaults", ...CHANNEL_IDS]);
-    for (const record of registry.plugins) {
-        for (const channelId of record.channels) {
-            allowedChannels.add(channelId);
-        }
-    }
-    if (config.channels && isRecord(config.channels)) {
-        for (const key of Object.keys(config.channels)) {
-            const trimmed = key.trim();
-            if (!trimmed)
-                continue;
-            if (!allowedChannels.has(trimmed)) {
-                issues.push({
-                    path: `channels.${trimmed}`,
-                    message: `unknown channel id: ${trimmed}`,
-                });
-            }
-        }
-    }
-    const heartbeatChannelIds = new Set();
-    for (const channelId of CHANNEL_IDS) {
-        heartbeatChannelIds.add(channelId.toLowerCase());
-    }
-    for (const record of registry.plugins) {
-        for (const channelId of record.channels) {
-            const trimmed = channelId.trim();
-            if (trimmed)
-                heartbeatChannelIds.add(trimmed.toLowerCase());
-        }
-    }
-    const validateHeartbeatTarget = (target, path) => {
-        if (typeof target !== "string")
-            return;
-        const trimmed = target.trim();
-        if (!trimmed) {
-            issues.push({ path, message: "heartbeat target must not be empty" });
-            return;
-        }
-        const normalized = trimmed.toLowerCase();
-        if (normalized === "last" || normalized === "none")
-            return;
-        if (normalizeChatChannelId(trimmed))
-            return;
-        if (heartbeatChannelIds.has(normalized))
-            return;
-        issues.push({ path, message: `unknown heartbeat target: ${target}` });
-    };
-    validateHeartbeatTarget(config.agents?.defaults?.heartbeat?.target, "agents.defaults.heartbeat.target");
-    if (Array.isArray(config.agents?.list)) {
-        for (const [index, entry] of config.agents.list.entries()) {
-            validateHeartbeatTarget(entry?.heartbeat?.target, `agents.list.${index}.heartbeat.target`);
-        }
-    }
     let selectedMemoryPluginId = null;
     const seenPlugins = new Set();
     for (const record of registry.plugins) {

package/dist/config/zod-schema.agent-runtime.js

@@ -168,7 +168,9 @@ export const SandboxBrowserSchema = z
     enabled: z.boolean().optional(),
     image: z.string().optional(),
     containerPrefix: z.string().optional(),
+    network: z.string().optional(),
     cdpPort: z.number().int().positive().optional(),
+    cdpSourceRange: z.string().optional(),
     vncPort: z.number().int().positive().optional(),
     noVncPort: z.number().int().positive().optional(),
     headless: z.boolean().optional(),
@@ -177,6 +179,15 @@ export const SandboxBrowserSchema = z
     autoStart: z.boolean().optional(),
     autoStartTimeoutMs: z.number().int().positive().optional(),
     binds: z.array(z.string()).optional(),
+})
+    .superRefine((data, ctx) => {
+    if (data.network?.trim().toLowerCase() === "host") {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["network"],
+            message: 'Sandbox security: browser network mode "host" is blocked. Use "bridge" or a custom bridge network instead.',
+        });
+    }
 })
     .strict()
     .optional();