@poolzin/pool-bot 2026.2.25 → 2026.2.26

package/dist/gateway/hooks-mapping.js

@@ -15,16 +15,18 @@ const hookPresetMappings = {
     ],
 };
 const transformCache = new Map();
-export function resolveHookMappings(hooks) {
+export function resolveHookMappings(hooks, opts) {
     const presets = hooks?.presets ?? [];
     const gmailAllowUnsafe = hooks?.gmail?.allowUnsafeExternalContent;
     const mappings = [];
-    if (hooks?.mappings)
+    if (hooks?.mappings) {
         mappings.push(...hooks.mappings);
+    }
     for (const preset of presets) {
         const presetMappings = hookPresetMappings[preset];
-        if (!presetMappings)
+        if (!presetMappings) {
             continue;
+        }
         if (preset === "gmail" && typeof gmailAllowUnsafe === "boolean") {
             mappings.push(...presetMappings.map((mapping) => ({
                 ...mapping,
@@ -34,23 +36,26 @@ export function resolveHookMappings(hooks) {
         }
         mappings.push(...presetMappings);
     }
-    if (mappings.length === 0)
+    if (mappings.length === 0) {
         return [];
-    const configDir = path.dirname(CONFIG_PATH);
-    const transformsDir = hooks?.transformsDir
-        ? resolvePath(configDir, hooks.transformsDir)
-        : configDir;
+    }
+    const configDir = path.resolve(opts?.configDir ?? path.dirname(CONFIG_PATH));
+    const transformsRootDir = path.join(configDir, "hooks", "transforms");
+    const transformsDir = resolveOptionalContainedPath(transformsRootDir, hooks?.transformsDir, "Hook transformsDir");
     return mappings.map((mapping, index) => normalizeHookMapping(mapping, index, transformsDir));
 }
 export async function applyHookMappings(mappings, ctx) {
-    if (mappings.length === 0)
+    if (mappings.length === 0) {
         return null;
+    }
     for (const mapping of mappings) {
-        if (!mappingMatches(mapping, ctx))
+        if (!mappingMatches(mapping, ctx)) {
             continue;
+        }
         const base = buildActionFromMapping(mapping, ctx);
-        if (!base.ok)
+        if (!base.ok) {
             return base;
+        }
         let override = null;
         if (mapping.transform) {
             const transform = await loadTransform(mapping.transform);
@@ -59,11 +64,13 @@ export async function applyHookMappings(mappings, ctx) {
                 return { ok: true, action: null, skipped: true };
             }
         }
-        if (!base.action)
+        if (!base.action) {
             return { ok: true, action: null, skipped: true };
+        }
         const merged = mergeAction(base.action, override, mapping.action);
-        if (!merged.ok)
+        if (!merged.ok) {
             return merged;
+        }
         return merged;
     }
     return null;
@@ -76,7 +83,7 @@ function normalizeHookMapping(mapping, index, transformsDir) {
     const wakeMode = mapping.wakeMode ?? "now";
     const transform = mapping.transform
         ? {
-            modulePath: resolvePath(transformsDir, mapping.transform.module),
+            modulePath: resolveContainedPath(transformsDir, mapping.transform.module, "Hook transform"),
             exportName: mapping.transform.export?.trim() || undefined,
         }
         : undefined;
@@ -103,13 +110,15 @@ function normalizeHookMapping(mapping, index, transformsDir) {
 }
 function mappingMatches(mapping, ctx) {
     if (mapping.matchPath) {
-        if (mapping.matchPath !== normalizeMatchPath(ctx.path))
+        if (mapping.matchPath !== normalizeMatchPath(ctx.path)) {
             return false;
+        }
     }
     if (mapping.matchSource) {
         const source = typeof ctx.payload.source === "string" ? ctx.payload.source : undefined;
-        if (!source || source !== mapping.matchSource)
+        if (!source || source !== mapping.matchSource) {
             return false;
+        }
     }
     return true;
 }
@@ -149,7 +158,7 @@ function mergeAction(base, override, defaultAction) {
     if (!override) {
         return validateAction(base);
     }
-    const kind = (override.kind ?? base.kind ?? defaultAction);
+    const kind = override.kind ?? base.kind ?? defaultAction;
     if (kind === "wake") {
         const baseWake = base.kind === "wake" ? base : undefined;
         const text = typeof override.text === "string" ? override.text : (baseWake?.text ?? "");
@@ -190,13 +199,15 @@ function validateAction(action) {
     return { ok: true, action };
 }
 async function loadTransform(transform) {
-    const cached = transformCache.get(transform.modulePath);
-    if (cached)
+    const cacheKey = `${transform.modulePath}::${transform.exportName ?? "default"}`;
+    const cached = transformCache.get(cacheKey);
+    if (cached) {
         return cached;
+    }
     const url = pathToFileURL(transform.modulePath).href;
     const mod = (await import(url));
     const fn = resolveTransformFn(mod, transform.exportName);
-    transformCache.set(transform.modulePath, fn);
+    transformCache.set(cacheKey, fn);
     return fn;
 }
 function resolveTransformFn(mod, exportName) {
@@ -207,45 +218,73 @@ function resolveTransformFn(mod, exportName) {
     return candidate;
 }
 function resolvePath(baseDir, target) {
-    if (!target)
-        return baseDir;
-    if (path.isAbsolute(target))
-        return target;
-    return path.join(baseDir, target);
+    if (!target) {
+        return path.resolve(baseDir);
+    }
+    return path.isAbsolute(target) ? path.resolve(target) : path.resolve(baseDir, target);
+}
+function resolveContainedPath(baseDir, target, label) {
+    const base = path.resolve(baseDir);
+    const trimmed = target?.trim();
+    if (!trimmed) {
+        throw new Error(`${label} module path is required`);
+    }
+    const resolved = resolvePath(base, trimmed);
+    const relative = path.relative(base, resolved);
+    if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        throw new Error(`${label} module path must be within ${base}: ${target}`);
+    }
+    return resolved;
+}
+function resolveOptionalContainedPath(baseDir, target, label) {
+    const trimmed = target?.trim();
+    if (!trimmed) {
+        return path.resolve(baseDir);
+    }
+    return resolveContainedPath(baseDir, trimmed, label);
 }
 function normalizeMatchPath(raw) {
-    if (!raw)
+    if (!raw) {
         return undefined;
+    }
     const trimmed = raw.trim();
-    if (!trimmed)
+    if (!trimmed) {
         return undefined;
+    }
     return trimmed.replace(/^\/+/, "").replace(/\/+$/, "");
 }
 function renderOptional(value, ctx) {
-    if (!value)
+    if (!value) {
         return undefined;
+    }
     const rendered = renderTemplate(value, ctx).trim();
     return rendered ? rendered : undefined;
 }
 function renderTemplate(template, ctx) {
-    if (!template)
+    if (!template) {
         return "";
+    }
     return template.replace(/\{\{\s*([^}]+)\s*\}\}/g, (_, expr) => {
         const value = resolveTemplateExpr(expr.trim(), ctx);
-        if (value === undefined || value === null)
+        if (value === undefined || value === null) {
             return "";
-        if (typeof value === "string")
+        }
+        if (typeof value === "string") {
             return value;
-        if (typeof value === "number" || typeof value === "boolean")
+        }
+        if (typeof value === "number" || typeof value === "boolean") {
             return String(value);
+        }
         return JSON.stringify(value);
     });
 }
 function resolveTemplateExpr(expr, ctx) {
-    if (expr === "path")
+    if (expr === "path") {
         return ctx.path;
-    if (expr === "now")
+    }
+    if (expr === "now") {
         return new Date().toISOString();
+    }
     if (expr.startsWith("headers.")) {
         return getByPath(ctx.headers, expr.slice("headers.".length));
     }
@@ -257,9 +296,14 @@ function resolveTemplateExpr(expr, ctx) {
     }
     return getByPath(ctx.payload, expr);
 }
+// Block traversal into prototype-chain properties on attacker-controlled
+// webhook payloads.  Mirrors the same blocklist used by config-paths.ts
+// for config path traversal.
+const BLOCKED_PATH_KEYS = new Set(["__proto__", "prototype", "constructor"]);
 function getByPath(input, pathExpr) {
-    if (!pathExpr)
+    if (!pathExpr) {
         return undefined;
+    }
     const parts = [];
     const re = /([^.[\]]+)|(\[(\d+)\])/g;
     let match = re.exec(pathExpr);
@@ -274,16 +318,22 @@ function getByPath(input, pathExpr) {
     }
     let current = input;
     for (const part of parts) {
-        if (current === null || current === undefined)
+        if (current === null || current === undefined) {
             return undefined;
+        }
         if (typeof part === "number") {
-            if (!Array.isArray(current))
+            if (!Array.isArray(current)) {
                 return undefined;
+            }
             current = current[part];
             continue;
         }
-        if (typeof current !== "object")
+        if (BLOCKED_PATH_KEYS.has(part)) {
+            return undefined;
+        }
+        if (typeof current !== "object") {
             return undefined;
+        }
         current = current[part];
     }
     return current;

package/dist/gateway/http-auth-helpers.js

@@ -1,13 +1,14 @@
-import { authorizeGatewayConnect } from "./auth.js";
+import { authorizeHttpGatewayConnect } from "./auth.js";
 import { sendGatewayAuthFailure } from "./http-common.js";
 import { getBearerToken } from "./http-utils.js";
 export async function authorizeGatewayBearerRequestOrReply(params) {
     const token = getBearerToken(params.req);
-    const authResult = await authorizeGatewayConnect({
+    const authResult = await authorizeHttpGatewayConnect({
         auth: params.auth,
         connectAuth: token ? { token, password: token } : null,
         req: params.req,
         trustedProxies: params.trustedProxies,
+        allowRealIpFallback: params.allowRealIpFallback,
         rateLimiter: params.rateLimiter,
     });
     if (!authResult.ok) {

package/dist/gateway/http-endpoint-helpers.js

@@ -14,6 +14,7 @@ export async function handleGatewayPostJsonEndpoint(req, res, opts) {
         res,
         auth: opts.auth,
         trustedProxies: opts.trustedProxies,
+        allowRealIpFallback: opts.allowRealIpFallback,
         rateLimiter: opts.rateLimiter,
     });
     if (!authorized) {

package/dist/gateway/net.js

@@ -135,19 +135,44 @@ function stripOptionalPort(ip) {
     }
     return ip;
 }
-export function parseForwardedForClientIp(forwardedFor) {
-    const raw = forwardedFor?.split(",")[0]?.trim();
-    if (!raw) {
+function parseIpLiteral(raw) {
+    const trimmed = raw?.trim();
+    if (!trimmed) {
+        return undefined;
+    }
+    const stripped = stripOptionalPort(trimmed);
+    const normalized = normalizeIp(stripped);
+    if (!normalized || net.isIP(normalized) === 0) {
         return undefined;
     }
-    return normalizeIp(stripOptionalPort(raw));
+    return normalized;
 }
 function parseRealIp(realIp) {
-    const raw = realIp?.trim();
-    if (!raw) {
+    return parseIpLiteral(realIp);
+}
+function resolveForwardedClientIp(params) {
+    const { forwardedFor, trustedProxies } = params;
+    if (!trustedProxies?.length) {
         return undefined;
     }
-    return normalizeIp(stripOptionalPort(raw));
+    const forwardedChain = [];
+    for (const entry of forwardedFor?.split(",") ?? []) {
+        const normalized = parseIpLiteral(entry);
+        if (normalized) {
+            forwardedChain.push(normalized);
+        }
+    }
+    if (forwardedChain.length === 0) {
+        return undefined;
+    }
+    // Walk right-to-left and return the first untrusted hop.
+    for (let index = forwardedChain.length - 1; index >= 0; index -= 1) {
+        const hop = forwardedChain[index];
+        if (!isTrustedProxyAddress(hop, trustedProxies)) {
+            return hop;
+        }
+    }
+    return undefined;
 }
 /**
  * Check if an IP address matches a CIDR block.
@@ -202,7 +227,7 @@ export function isTrustedProxyAddress(ip, trustedProxies) {
         return normalizeIp(candidate) === normalized;
     });
 }
-export function resolveGatewayClientIp(params) {
+export function resolveClientIp(params) {
     const remote = normalizeIp(params.remoteAddr);
     if (!remote) {
         return undefined;
@@ -210,7 +235,20 @@ export function resolveGatewayClientIp(params) {
     if (!isTrustedProxyAddress(remote, params.trustedProxies)) {
         return remote;
     }
-    return parseForwardedForClientIp(params.forwardedFor) ?? parseRealIp(params.realIp) ?? remote;
+    // Fail closed when traffic comes from a trusted proxy but client-origin headers
+    // are missing or invalid. Falling back to the proxy's own IP can accidentally
+    // treat unrelated requests as local/trusted.
+    const forwardedIp = resolveForwardedClientIp({
+        forwardedFor: params.forwardedFor,
+        trustedProxies: params.trustedProxies,
+    });
+    if (forwardedIp) {
+        return forwardedIp;
+    }
+    if (params.allowRealIpFallback) {
+        return parseRealIp(params.realIp);
+    }
+    return undefined;
 }
 export function isLocalGatewayAddress(ip) {
     if (isLoopbackAddress(ip)) {
@@ -348,9 +386,13 @@ export function isLoopbackHost(host) {
     return isLoopbackAddress(unbracket);
 }
 /**
- * Returns true if the URL uses wss:// (encrypted) OR ws:// to a loopback address.
- * Plaintext ws:// to non-loopback addresses is insecure (CWE-319, CVSS 9.8):
- * both credentials (gateway token/password) and chat/conversation data
+ * Security check for WebSocket URLs (CWE-319: Cleartext Transmission of Sensitive Information).
+ *
+ * Returns true if the URL is secure for transmitting data:
+ * - wss:// (TLS) is always secure
+ * - ws:// is only secure for loopback addresses (localhost, 127.x.x.x, ::1)
+ *
+ * All other ws:// URLs are considered insecure because both credentials
  * AND chat/conversation data would be exposed to network interception.
  */
 export function isSecureWebSocketUrl(url) {

package/dist/gateway/node-invoke-system-run-approval.js

@@ -1,4 +1,4 @@
-import { formatExecCommand, validateSystemRunCommandConsistency, } from "../infra/system-run-command.js";
+import { resolveSystemRunCommand } from "../infra/system-run-command.js";
 function asRecord(value) {
     if (!value || typeof value !== "object" || Array.isArray(value)) {
         return null;
@@ -20,24 +20,10 @@ function clientHasApprovals(client) {
     const scopes = Array.isArray(client?.connect?.scopes) ? client?.connect?.scopes : [];
     return scopes.includes("operator.admin") || scopes.includes("operator.approvals");
 }
-function getCmdText(params) {
-    const raw = normalizeString(params.rawCommand);
-    if (raw) {
-        return raw;
-    }
-    if (Array.isArray(params.command)) {
-        const parts = params.command.map((v) => String(v));
-        if (parts.length > 0) {
-            return formatExecCommand(parts);
-        }
-    }
-    return "";
-}
-function approvalMatchesRequest(params, record) {
+function approvalMatchesRequest(cmdText, params, record) {
     if (record.request.host !== "node") {
         return false;
     }
-    const cmdText = getCmdText(params);
     if (!cmdText || record.request.command !== cmdText) {
         return false;
     }
@@ -90,25 +76,18 @@ export function sanitizeSystemRunParamsForForwarding(opts) {
         return { ok: true, params: opts.rawParams };
     }
     const p = obj;
-    const argv = Array.isArray(p.command) ? p.command.map((v) => String(v)) : [];
-    const raw = normalizeString(p.rawCommand);
-    if (raw) {
-        if (!Array.isArray(p.command) || argv.length === 0) {
-            return {
-                ok: false,
-                message: "rawCommand requires params.command",
-                details: { code: "MISSING_COMMAND" },
-            };
-        }
-        const validation = validateSystemRunCommandConsistency({ argv, rawCommand: raw });
-        if (!validation.ok) {
-            return {
-                ok: false,
-                message: validation.message,
-                details: validation.details ?? { code: "RAW_COMMAND_MISMATCH" },
-            };
-        }
+    const cmdTextResolution = resolveSystemRunCommand({
+        command: p.command,
+        rawCommand: p.rawCommand,
+    });
+    if (!cmdTextResolution.ok) {
+        return {
+            ok: false,
+            message: cmdTextResolution.message,
+            details: cmdTextResolution.details,
+        };
     }
+    const cmdText = cmdTextResolution.cmdText;
     const approved = p.approved === true;
     const requestedDecision = normalizeApprovalDecision(p.approvalDecision);
     const wantsApprovalOverride = approved || requestedDecision !== null;
@@ -171,7 +150,7 @@ export function sanitizeSystemRunParamsForForwarding(opts) {
             details: { code: "APPROVAL_CLIENT_MISMATCH", runId },
         };
     }
-    if (!approvalMatchesRequest(p, snapshot)) {
+    if (!approvalMatchesRequest(cmdText, p, snapshot)) {
         return {
             ok: false,
             message: "approval id does not match request",

package/dist/gateway/node-registry.js

@@ -40,13 +40,15 @@ export class NodeRegistry {
     }
     unregister(connId) {
         const nodeId = this.nodesByConn.get(connId);
-        if (!nodeId)
+        if (!nodeId) {
             return null;
+        }
         this.nodesByConn.delete(connId);
         this.nodesById.delete(nodeId);
         for (const [id, pending] of this.pendingInvokes.entries()) {
-            if (pending.nodeId !== nodeId)
+            if (pending.nodeId !== nodeId) {
                 continue;
+            }
             clearTimeout(pending.timer);
             pending.reject(new Error(`node disconnected (${pending.command})`));
             this.pendingInvokes.delete(id);
@@ -103,10 +105,12 @@ export class NodeRegistry {
     }
     handleInvokeResult(params) {
         const pending = this.pendingInvokes.get(params.id);
-        if (!pending)
+        if (!pending) {
             return false;
-        if (pending.nodeId !== params.nodeId)
+        }
+        if (pending.nodeId !== params.nodeId) {
             return false;
+        }
         clearTimeout(pending.timer);
         this.pendingInvokes.delete(params.id);
         pending.resolve({
@@ -119,8 +123,9 @@ export class NodeRegistry {
     }
     sendEvent(nodeId, event, payload) {
         const node = this.nodesById.get(nodeId);
-        if (!node)
+        if (!node) {
             return false;
+        }
         return this.sendEventToSession(node, event, payload);
     }
     sendEventInternal(node, event, payload) {

package/dist/gateway/openai-http.js

@@ -124,6 +124,7 @@ export async function handleOpenAiHttpRequest(req, res, opts) {
         connectAuth: { token, password: token },
         req,
         trustedProxies: opts.trustedProxies,
+        allowRealIpFallback: opts.allowRealIpFallback,
     });
     if (!authResult.ok) {
         sendUnauthorized(res);

package/dist/gateway/openresponses-http.js

@@ -215,6 +215,7 @@ export async function handleOpenResponsesHttpRequest(req, res, opts) {
         pathname: "/v1/responses",
         auth: opts.auth,
         trustedProxies: opts.trustedProxies,
+        allowRealIpFallback: opts.allowRealIpFallback,
         rateLimiter: opts.rateLimiter,
         maxBodyBytes,
     });

package/dist/gateway/origin-check.js

@@ -1,21 +1,4 @@
-import { isLoopbackHost } from "./net.js";
-function normalizeHostHeader(hostHeader) {
-    return (hostHeader ?? "").trim().toLowerCase();
-}
-function resolveHostName(hostHeader) {
-    const host = normalizeHostHeader(hostHeader);
-    if (!host) {
-        return "";
-    }
-    if (host.startsWith("[")) {
-        const end = host.indexOf("]");
-        if (end !== -1) {
-            return host.slice(1, end);
-        }
-    }
-    const [name] = host.split(":");
-    return name ?? "";
-}
+import { isLoopbackHost, normalizeHostHeader, resolveHostName } from "./net.js";
 function parseOrigin(originRaw) {
     const trimmed = (originRaw ?? "").trim();
     if (!trimmed || trimmed === "null") {

package/dist/gateway/protocol/index.js

@@ -1,5 +1,5 @@
 import AjvPkg from "ajv";
-import { AgentEventSchema, AgentIdentityParamsSchema, AgentIdentityResultSchema, AgentParamsSchema, AgentSummarySchema, AgentsFileEntrySchema, AgentsCreateParamsSchema, AgentsCreateResultSchema, AgentsUpdateParamsSchema, AgentsUpdateResultSchema, AgentsDeleteParamsSchema, AgentsDeleteResultSchema, AgentsFilesGetParamsSchema, AgentsFilesGetResultSchema, AgentsFilesListParamsSchema, AgentsFilesListResultSchema, AgentsFilesSetParamsSchema, AgentsFilesSetResultSchema, AgentsListParamsSchema, AgentsListResultSchema, AgentWaitParamsSchema, ChannelsLogoutParamsSchema, TalkConfigParamsSchema, TalkConfigResultSchema, ChannelsStatusParamsSchema, ChannelsStatusResultSchema, ChatAbortParamsSchema, ChatEventSchema, ChatHistoryParamsSchema, ChatInjectParamsSchema, ChatSendParamsSchema, ConfigApplyParamsSchema, ConfigGetParamsSchema, ConfigPatchParamsSchema, ConfigSchemaParamsSchema, ConfigSchemaResponseSchema, ConfigSetParamsSchema, ConnectParamsSchema, CronAddParamsSchema, CronJobSchema, CronListParamsSchema, CronRemoveParamsSchema, CronRunParamsSchema, CronRunsParamsSchema, CronStatusParamsSchema, CronUpdateParamsSchema, DevicePairApproveParamsSchema, DevicePairListParamsSchema, DevicePairRejectParamsSchema, DeviceTokenRevokeParamsSchema, DeviceTokenRotateParamsSchema, ExecApprovalsGetParamsSchema, ExecApprovalsNodeGetParamsSchema, ExecApprovalsNodeSetParamsSchema, ExecApprovalsSetParamsSchema, ExecApprovalRequestParamsSchema, ExecApprovalResolveParamsSchema, ErrorCodes, ErrorShapeSchema, EventFrameSchema, errorShape, GatewayFrameSchema, HelloOkSchema, LogsTailParamsSchema, LogsTailResultSchema, ModelsListParamsSchema, NodeDescribeParamsSchema, NodeEventParamsSchema, NodeInvokeParamsSchema, NodeInvokeResultParamsSchema, NodeListParamsSchema, NodePairApproveParamsSchema, NodePairListParamsSchema, NodePairRejectParamsSchema, NodePairRequestParamsSchema, NodePairVerifyParamsSchema, NodeRenameParamsSchema, PollParamsSchema, PROTOCOL_VERSION, PresenceEntrySchema, ProtocolSchemas, PushTestParamsSchema, RequestFrameSchema, ResponseFrameSchema, SendParamsSchema, SessionsCompactParamsSchema, SessionsDeleteParamsSchema, SessionsListParamsSchema, SessionsPatchParamsSchema, SessionsPreviewParamsSchema, SessionsResetParamsSchema, SessionsResolveParamsSchema, SessionsUsageParamsSchema, ShutdownEventSchema, SkillsBinsParamsSchema, SkillsInstallParamsSchema, SkillsStatusParamsSchema, SkillsUpdateParamsSchema, SnapshotSchema, StateVersionSchema, TalkModeParamsSchema, TickEventSchema, UpdateRunParamsSchema, WakeParamsSchema, WebLoginStartParamsSchema, WebLoginWaitParamsSchema, WizardCancelParamsSchema, WizardNextParamsSchema, WizardNextResultSchema, WizardStartParamsSchema, WizardStartResultSchema, WizardStatusParamsSchema, WizardStatusResultSchema, WizardStepSchema, } from "./schema.js";
+import { AgentEventSchema, AgentIdentityParamsSchema, AgentIdentityResultSchema, AgentParamsSchema, AgentSummarySchema, AgentsFileEntrySchema, AgentsCreateParamsSchema, AgentsCreateResultSchema, AgentsUpdateParamsSchema, AgentsUpdateResultSchema, AgentsDeleteParamsSchema, AgentsDeleteResultSchema, AgentsFilesGetParamsSchema, AgentsFilesGetResultSchema, AgentsFilesListParamsSchema, AgentsFilesListResultSchema, AgentsFilesSetParamsSchema, AgentsFilesSetResultSchema, AgentsListParamsSchema, AgentsListResultSchema, AgentWaitParamsSchema, ChannelsLogoutParamsSchema, TalkConfigParamsSchema, TalkConfigResultSchema, ChannelsStatusParamsSchema, ChannelsStatusResultSchema, ChatAbortParamsSchema, ChatEventSchema, ChatHistoryParamsSchema, ChatInjectParamsSchema, ChatSendParamsSchema, ConfigApplyParamsSchema, ConfigGetParamsSchema, ConfigPatchParamsSchema, ConfigSchemaParamsSchema, ConfigSchemaResponseSchema, ConfigSetParamsSchema, ConnectParamsSchema, CronAddParamsSchema, CronJobSchema, CronListParamsSchema, CronRemoveParamsSchema, CronRunParamsSchema, CronRunsParamsSchema, CronStatusParamsSchema, CronUpdateParamsSchema, DevicePairApproveParamsSchema, DevicePairListParamsSchema, DevicePairRemoveParamsSchema, DevicePairRejectParamsSchema, DeviceTokenRevokeParamsSchema, DeviceTokenRotateParamsSchema, ExecApprovalsGetParamsSchema, ExecApprovalsNodeGetParamsSchema, ExecApprovalsNodeSetParamsSchema, ExecApprovalsSetParamsSchema, ExecApprovalRequestParamsSchema, ExecApprovalResolveParamsSchema, ErrorCodes, ErrorShapeSchema, EventFrameSchema, errorShape, GatewayFrameSchema, HelloOkSchema, LogsTailParamsSchema, LogsTailResultSchema, ModelsListParamsSchema, NodeDescribeParamsSchema, NodeEventParamsSchema, NodeInvokeParamsSchema, NodeInvokeResultParamsSchema, NodeListParamsSchema, NodePairApproveParamsSchema, NodePairListParamsSchema, NodePairRejectParamsSchema, NodePairRequestParamsSchema, NodePairVerifyParamsSchema, NodeRenameParamsSchema, PollParamsSchema, PROTOCOL_VERSION, PushTestParamsSchema, PushTestResultSchema, PresenceEntrySchema, ProtocolSchemas, RequestFrameSchema, ResponseFrameSchema, SendParamsSchema, SessionsCompactParamsSchema, SessionsDeleteParamsSchema, SessionsListParamsSchema, SessionsPatchParamsSchema, SessionsPreviewParamsSchema, SessionsResetParamsSchema, SessionsResolveParamsSchema, SessionsUsageParamsSchema, ShutdownEventSchema, SkillsBinsParamsSchema, SkillsInstallParamsSchema, SkillsStatusParamsSchema, SkillsUpdateParamsSchema, SnapshotSchema, StateVersionSchema, TalkModeParamsSchema, TickEventSchema, UpdateRunParamsSchema, WakeParamsSchema, WebLoginStartParamsSchema, WebLoginWaitParamsSchema, WizardCancelParamsSchema, WizardNextParamsSchema, WizardNextResultSchema, WizardStartParamsSchema, WizardStartResultSchema, WizardStatusParamsSchema, WizardStatusResultSchema, WizardStepSchema, } from "./schema.js";
 const ajv = new AjvPkg({
     allErrors: true,
     strict: false,
@@ -33,6 +33,7 @@ export const validateNodeDescribeParams = ajv.compile(NodeDescribeParamsSchema);
 export const validateNodeInvokeParams = ajv.compile(NodeInvokeParamsSchema);
 export const validateNodeInvokeResultParams = ajv.compile(NodeInvokeResultParamsSchema);
 export const validateNodeEventParams = ajv.compile(NodeEventParamsSchema);
+export const validatePushTestParams = ajv.compile(PushTestParamsSchema);
 export const validateSessionsListParams = ajv.compile(SessionsListParamsSchema);
 export const validateSessionsPreviewParams = ajv.compile(SessionsPreviewParamsSchema);
 export const validateSessionsResolveParams = ajv.compile(SessionsResolveParamsSchema);
@@ -69,6 +70,7 @@ export const validateCronRunsParams = ajv.compile(CronRunsParamsSchema);
 export const validateDevicePairListParams = ajv.compile(DevicePairListParamsSchema);
 export const validateDevicePairApproveParams = ajv.compile(DevicePairApproveParamsSchema);
 export const validateDevicePairRejectParams = ajv.compile(DevicePairRejectParamsSchema);
+export const validateDevicePairRemoveParams = ajv.compile(DevicePairRemoveParamsSchema);
 export const validateDeviceTokenRotateParams = ajv.compile(DeviceTokenRotateParamsSchema);
 export const validateDeviceTokenRevokeParams = ajv.compile(DeviceTokenRevokeParamsSchema);
 export const validateExecApprovalsGetParams = ajv.compile(ExecApprovalsGetParamsSchema);
@@ -84,7 +86,6 @@ export const validateChatAbortParams = ajv.compile(ChatAbortParamsSchema);
 export const validateChatInjectParams = ajv.compile(ChatInjectParamsSchema);
 export const validateChatEvent = ajv.compile(ChatEventSchema);
 export const validateUpdateRunParams = ajv.compile(UpdateRunParamsSchema);
-export const validatePushTestParams = ajv.compile(PushTestParamsSchema);
 export const validateWebLoginStartParams = ajv.compile(WebLoginStartParamsSchema);
 export const validateWebLoginWaitParams = ajv.compile(WebLoginWaitParamsSchema);
 export function formatValidationErrors(errors) {
@@ -116,4 +117,4 @@ export function formatValidationErrors(errors) {
     }
     return unique.join("; ");
 }
-export { ConnectParamsSchema, HelloOkSchema, RequestFrameSchema, ResponseFrameSchema, EventFrameSchema, GatewayFrameSchema, PresenceEntrySchema, SnapshotSchema, ErrorShapeSchema, StateVersionSchema, AgentEventSchema, ChatEventSchema, SendParamsSchema, PollParamsSchema, AgentParamsSchema, AgentIdentityParamsSchema, AgentIdentityResultSchema, WakeParamsSchema, NodePairRequestParamsSchema, NodePairListParamsSchema, NodePairApproveParamsSchema, NodePairRejectParamsSchema, NodePairVerifyParamsSchema, NodeListParamsSchema, NodeInvokeParamsSchema, SessionsListParamsSchema, SessionsPreviewParamsSchema, SessionsPatchParamsSchema, SessionsResetParamsSchema, SessionsDeleteParamsSchema, SessionsCompactParamsSchema, SessionsUsageParamsSchema, ConfigGetParamsSchema, ConfigSetParamsSchema, ConfigApplyParamsSchema, ConfigPatchParamsSchema, ConfigSchemaParamsSchema, ConfigSchemaResponseSchema, WizardStartParamsSchema, WizardNextParamsSchema, WizardCancelParamsSchema, WizardStatusParamsSchema, WizardStepSchema, WizardNextResultSchema, WizardStartResultSchema, WizardStatusResultSchema, TalkConfigParamsSchema, TalkConfigResultSchema, ChannelsStatusParamsSchema, ChannelsStatusResultSchema, ChannelsLogoutParamsSchema, WebLoginStartParamsSchema, WebLoginWaitParamsSchema, AgentSummarySchema, AgentsFileEntrySchema, AgentsCreateParamsSchema, AgentsCreateResultSchema, AgentsUpdateParamsSchema, AgentsUpdateResultSchema, AgentsDeleteParamsSchema, AgentsDeleteResultSchema, AgentsFilesListParamsSchema, AgentsFilesListResultSchema, AgentsFilesGetParamsSchema, AgentsFilesGetResultSchema, AgentsFilesSetParamsSchema, AgentsFilesSetResultSchema, AgentsListParamsSchema, AgentsListResultSchema, ModelsListParamsSchema, SkillsStatusParamsSchema, SkillsInstallParamsSchema, SkillsUpdateParamsSchema, CronJobSchema, CronListParamsSchema, CronStatusParamsSchema, CronAddParamsSchema, CronUpdateParamsSchema, CronRemoveParamsSchema, CronRunParamsSchema, CronRunsParamsSchema, LogsTailParamsSchema, LogsTailResultSchema, ChatHistoryParamsSchema, ChatSendParamsSchema, ChatInjectParamsSchema, UpdateRunParamsSchema, PushTestParamsSchema, TickEventSchema, ShutdownEventSchema, ProtocolSchemas, PROTOCOL_VERSION, ErrorCodes, errorShape, };
+export { ConnectParamsSchema, HelloOkSchema, RequestFrameSchema, ResponseFrameSchema, EventFrameSchema, GatewayFrameSchema, PresenceEntrySchema, SnapshotSchema, ErrorShapeSchema, StateVersionSchema, AgentEventSchema, ChatEventSchema, SendParamsSchema, PollParamsSchema, AgentParamsSchema, AgentIdentityParamsSchema, AgentIdentityResultSchema, WakeParamsSchema, PushTestParamsSchema, PushTestResultSchema, NodePairRequestParamsSchema, NodePairListParamsSchema, NodePairApproveParamsSchema, NodePairRejectParamsSchema, NodePairVerifyParamsSchema, NodeListParamsSchema, NodeInvokeParamsSchema, SessionsListParamsSchema, SessionsPreviewParamsSchema, SessionsPatchParamsSchema, SessionsResetParamsSchema, SessionsDeleteParamsSchema, SessionsCompactParamsSchema, SessionsUsageParamsSchema, ConfigGetParamsSchema, ConfigSetParamsSchema, ConfigApplyParamsSchema, ConfigPatchParamsSchema, ConfigSchemaParamsSchema, ConfigSchemaResponseSchema, WizardStartParamsSchema, WizardNextParamsSchema, WizardCancelParamsSchema, WizardStatusParamsSchema, WizardStepSchema, WizardNextResultSchema, WizardStartResultSchema, WizardStatusResultSchema, TalkConfigParamsSchema, TalkConfigResultSchema, ChannelsStatusParamsSchema, ChannelsStatusResultSchema, ChannelsLogoutParamsSchema, WebLoginStartParamsSchema, WebLoginWaitParamsSchema, AgentSummarySchema, AgentsFileEntrySchema, AgentsCreateParamsSchema, AgentsCreateResultSchema, AgentsUpdateParamsSchema, AgentsUpdateResultSchema, AgentsDeleteParamsSchema, AgentsDeleteResultSchema, AgentsFilesListParamsSchema, AgentsFilesListResultSchema, AgentsFilesGetParamsSchema, AgentsFilesGetResultSchema, AgentsFilesSetParamsSchema, AgentsFilesSetResultSchema, AgentsListParamsSchema, AgentsListResultSchema, ModelsListParamsSchema, SkillsStatusParamsSchema, SkillsInstallParamsSchema, SkillsUpdateParamsSchema, CronJobSchema, CronListParamsSchema, CronStatusParamsSchema, CronAddParamsSchema, CronUpdateParamsSchema, CronRemoveParamsSchema, CronRunParamsSchema, CronRunsParamsSchema, LogsTailParamsSchema, LogsTailResultSchema, ChatHistoryParamsSchema, ChatSendParamsSchema, ChatInjectParamsSchema, UpdateRunParamsSchema, TickEventSchema, ShutdownEventSchema, ProtocolSchemas, PROTOCOL_VERSION, ErrorCodes, errorShape, };

package/dist/gateway/protocol/schema/cron.js

@@ -82,6 +82,7 @@ export const CronJobStateSchema = Type.Object({
     lastError: Type.Optional(Type.String()),
     lastDurationMs: Type.Optional(Type.Integer({ minimum: 0 })),
     consecutiveErrors: Type.Optional(Type.Integer({ minimum: 0 })),
+    lastDelivered: Type.Optional(Type.Boolean()),
 }, { additionalProperties: false });
 export const CronJobSchema = Type.Object({
     id: NonEmptyString,

package/dist/gateway/protocol/schema/devices.js

@@ -3,6 +3,7 @@ import { NonEmptyString } from "./primitives.js";
 export const DevicePairListParamsSchema = Type.Object({}, { additionalProperties: false });
 export const DevicePairApproveParamsSchema = Type.Object({ requestId: NonEmptyString }, { additionalProperties: false });
 export const DevicePairRejectParamsSchema = Type.Object({ requestId: NonEmptyString }, { additionalProperties: false });
+export const DevicePairRemoveParamsSchema = Type.Object({ deviceId: NonEmptyString }, { additionalProperties: false });
 export const DeviceTokenRotateParamsSchema = Type.Object({
     deviceId: NonEmptyString,
     role: NonEmptyString,

package/dist/gateway/protocol/schema/protocol-schemas.js

@@ -3,7 +3,7 @@ import { AgentSummarySchema, AgentsCreateParamsSchema, AgentsCreateResultSchema,
 import { ChannelsLogoutParamsSchema, TalkConfigParamsSchema, TalkConfigResultSchema, ChannelsStatusParamsSchema, ChannelsStatusResultSchema, TalkModeParamsSchema, WebLoginStartParamsSchema, WebLoginWaitParamsSchema, } from "./channels.js";
 import { ConfigApplyParamsSchema, ConfigGetParamsSchema, ConfigPatchParamsSchema, ConfigSchemaParamsSchema, ConfigSchemaResponseSchema, ConfigSetParamsSchema, UpdateRunParamsSchema, } from "./config.js";
 import { CronAddParamsSchema, CronJobSchema, CronListParamsSchema, CronRemoveParamsSchema, CronRunLogEntrySchema, CronRunParamsSchema, CronRunsParamsSchema, CronStatusParamsSchema, CronUpdateParamsSchema, } from "./cron.js";
-import { DevicePairApproveParamsSchema, DevicePairListParamsSchema, DevicePairRejectParamsSchema, DevicePairRequestedEventSchema, DevicePairResolvedEventSchema, DeviceTokenRevokeParamsSchema, DeviceTokenRotateParamsSchema, } from "./devices.js";
+import { DevicePairApproveParamsSchema, DevicePairListParamsSchema, DevicePairRejectParamsSchema, DevicePairRemoveParamsSchema, DevicePairRequestedEventSchema, DevicePairResolvedEventSchema, DeviceTokenRevokeParamsSchema, DeviceTokenRotateParamsSchema, } from "./devices.js";
 import { ExecApprovalsGetParamsSchema, ExecApprovalsNodeGetParamsSchema, ExecApprovalsNodeSetParamsSchema, ExecApprovalsSetParamsSchema, ExecApprovalsSnapshotSchema, ExecApprovalRequestParamsSchema, ExecApprovalResolveParamsSchema, } from "./exec-approvals.js";
 import { ConnectParamsSchema, ErrorShapeSchema, EventFrameSchema, GatewayFrameSchema, HelloOkSchema, RequestFrameSchema, ResponseFrameSchema, ShutdownEventSchema, TickEventSchema, } from "./frames.js";
 import { ChatAbortParamsSchema, ChatEventSchema, ChatHistoryParamsSchema, ChatInjectParamsSchema, ChatSendParamsSchema, LogsTailParamsSchema, LogsTailResultSchema, } from "./logs-chat.js";
@@ -118,6 +118,7 @@ export const ProtocolSchemas = {
     DevicePairListParams: DevicePairListParamsSchema,
     DevicePairApproveParams: DevicePairApproveParamsSchema,
     DevicePairRejectParams: DevicePairRejectParamsSchema,
+    DevicePairRemoveParams: DevicePairRemoveParamsSchema,
     DeviceTokenRotateParams: DeviceTokenRotateParamsSchema,
     DeviceTokenRevokeParams: DeviceTokenRevokeParamsSchema,
     DevicePairRequestedEvent: DevicePairRequestedEventSchema,

package/dist/gateway/protocol/schema/sessions.js

@@ -66,6 +66,8 @@ export const SessionsResetParamsSchema = Type.Object({
 export const SessionsDeleteParamsSchema = Type.Object({
     key: NonEmptyString,
     deleteTranscript: Type.Optional(Type.Boolean()),
+    // Internal control: when false, still unbind thread bindings but skip hook emission.
+    emitLifecycleHooks: Type.Optional(Type.Boolean()),
 }, { additionalProperties: false });
 export const SessionsCompactParamsSchema = Type.Object({
     key: NonEmptyString,
@@ -78,6 +80,10 @@ export const SessionsUsageParamsSchema = Type.Object({
     startDate: Type.Optional(Type.String({ pattern: "^\\d{4}-\\d{2}-\\d{2}$" })),
     /** End date for range filter (YYYY-MM-DD). */
     endDate: Type.Optional(Type.String({ pattern: "^\\d{4}-\\d{2}-\\d{2}$" })),
+    /** How start/end dates should be interpreted. Defaults to UTC when omitted. */
+    mode: Type.Optional(Type.Union([Type.Literal("utc"), Type.Literal("gateway"), Type.Literal("specific")])),
+    /** UTC offset to use when mode is `specific` (for example, UTC-4 or UTC+5:30). */
+    utcOffset: Type.Optional(Type.String({ pattern: "^UTC[+-]\\d{1,2}(?::[0-5]\\d)?$" })),
     /** Maximum sessions to return (default 50). */
     limit: Type.Optional(Type.Integer({ minimum: 1 })),
     /** Include context weight breakdown (systemPromptReport). */