@poolzin/pool-bot 2026.2.25 → 2026.2.26

package/dist/gateway/server-methods/sessions.js

@@ -6,8 +6,10 @@ import { stopSubagentsForRequester } from "../../auto-reply/reply/abort.js";
 import { clearSessionQueues } from "../../auto-reply/reply/queue.js";
 import { loadConfig } from "../../config/config.js";
 import { loadSessionStore, snapshotSessionOrigin, resolveMainSessionKey, updateSessionStore, } from "../../config/sessions.js";
+import { unbindThreadBindingsBySessionKey } from "../../discord/monitor/thread-bindings.js";
 import { createInternalHookEvent, triggerInternalHook } from "../../hooks/internal-hooks.js";
-import { normalizeAgentId, parseAgentSessionKey } from "../../routing/session-key.js";
+import { getGlobalHookRunner } from "../../plugins/hook-runner-global.js";
+import { isSubagentSessionKey, normalizeAgentId, parseAgentSessionKey, } from "../../routing/session-key.js";
 import { ErrorCodes, errorShape, validateSessionsCompactParams, validateSessionsDeleteParams, validateSessionsListParams, validateSessionsPatchParams, validateSessionsPreviewParams, validateSessionsResetParams, validateSessionsResolveParams, } from "../protocol/index.js";
 import { archiveFileOnDisk, archiveSessionTranscripts, listSessionsFromStore, loadCombinedSessionStoreForGateway, loadSessionEntry, pruneLegacyStoreKeys, readSessionPreviewItemsFromTranscript, resolveGatewaySessionStoreTarget, resolveSessionModelRef, resolveSessionTranscriptCandidates, } from "../session-utils.js";
 import { applySessionsPatchToStore } from "../sessions-patch.js";
@@ -33,6 +35,13 @@ function resolveGatewaySessionTargetFromKey(key) {
     const target = resolveGatewaySessionStoreTarget({ cfg, key });
     return { cfg, target, storePath: target.storePath };
 }
+function rejectWebchatSessionMutation(params) {
+    if (!params.client?.connect || !params.isWebchatConnect(params.client.connect)) {
+        return false;
+    }
+    params.respond(false, undefined, errorShape(ErrorCodes.INVALID_REQUEST, `webchat clients cannot ${params.action} sessions; use chat.send for session-scoped updates`));
+    return true;
+}
 function migrateAndPruneSessionStoreKey(params) {
     const target = resolveGatewaySessionStoreTarget({
         cfg: params.cfg,
@@ -65,6 +74,31 @@ function archiveSessionTranscriptsForSession(params) {
         reason: params.reason,
     });
 }
+async function emitSessionUnboundLifecycleEvent(params) {
+    const targetKind = isSubagentSessionKey(params.targetSessionKey) ? "subagent" : "acp";
+    unbindThreadBindingsBySessionKey({
+        targetSessionKey: params.targetSessionKey,
+        targetKind,
+        reason: params.reason,
+        sendFarewell: true,
+    });
+    if (params.emitHooks === false) {
+        return;
+    }
+    const hookRunner = getGlobalHookRunner();
+    if (!hookRunner?.hasHooks("subagent_ended")) {
+        return;
+    }
+    await hookRunner.runSubagentEnded({
+        targetSessionKey: params.targetSessionKey,
+        targetKind,
+        reason: params.reason,
+        sendFarewell: true,
+        outcome: params.reason === "session-reset" ? "reset" : "deleted",
+    }, {
+        childSessionKey: params.targetSessionKey,
+    });
+}
 async function ensureSessionRuntimeCleanup(params) {
     const queueKeys = new Set(params.target.storeKeys);
     queueKeys.add(params.target.canonicalKey);
@@ -161,7 +195,7 @@ export const sessionsHandlers = {
         }
         respond(true, { ok: true, key: resolved.key }, undefined);
     },
-    "sessions.patch": async ({ params, respond, context }) => {
+    "sessions.patch": async ({ params, respond, context, client, isWebchatConnect }) => {
         if (!assertValidParams(params, validateSessionsPatchParams, "sessions.patch", respond)) {
             return;
         }
@@ -170,6 +204,9 @@ export const sessionsHandlers = {
         if (!key) {
             return;
         }
+        if (rejectWebchatSessionMutation({ action: "patch", client, isWebchatConnect, respond })) {
+            return;
+        }
         const { cfg, target, storePath } = resolveGatewaySessionTargetFromKey(key);
         const applied = await updateSessionStore(storePath, async (store) => {
             const { primaryKey } = migrateAndPruneSessionStoreKey({ cfg, key, store });
@@ -211,6 +248,7 @@ export const sessionsHandlers = {
         }
         const { cfg, target, storePath } = resolveGatewaySessionTargetFromKey(key);
         const { entry } = loadSessionEntry(key);
+        const hadExistingEntry = Boolean(entry);
         const commandReason = p.reason === "new" ? "new" : "reset";
         const hookEvent = createInternalHookEvent("command", commandReason, target.canonicalKey ?? key, {
             sessionEntry: entry,
@@ -267,9 +305,15 @@ export const sessionsHandlers = {
             agentId: target.agentId,
             reason: "reset",
         });
+        if (hadExistingEntry) {
+            await emitSessionUnboundLifecycleEvent({
+                targetSessionKey: target.canonicalKey ?? key,
+                reason: "session-reset",
+            });
+        }
         respond(true, { ok: true, key: target.canonicalKey, entry: next }, undefined);
     },
-    "sessions.delete": async ({ params, respond }) => {
+    "sessions.delete": async ({ params, respond, client, isWebchatConnect }) => {
         if (!assertValidParams(params, validateSessionsDeleteParams, "sessions.delete", respond)) {
             return;
         }
@@ -278,6 +322,9 @@ export const sessionsHandlers = {
         if (!key) {
             return;
         }
+        if (rejectWebchatSessionMutation({ action: "delete", client, isWebchatConnect, respond })) {
+            return;
+        }
         const { cfg, target, storePath } = resolveGatewaySessionTargetFromKey(key);
         const mainKey = resolveMainSessionKey(cfg);
         if (target.canonicalKey === mainKey) {
@@ -287,19 +334,20 @@ export const sessionsHandlers = {
         const deleteTranscript = typeof p.deleteTranscript === "boolean" ? p.deleteTranscript : true;
         const { entry } = loadSessionEntry(key);
         const sessionId = entry?.sessionId;
-        const existed = Boolean(entry);
         const cleanupError = await ensureSessionRuntimeCleanup({ cfg, key, target, sessionId });
         if (cleanupError) {
             respond(false, undefined, cleanupError);
             return;
         }
-        await updateSessionStore(storePath, (store) => {
+        const deleted = await updateSessionStore(storePath, (store) => {
             const { primaryKey } = migrateAndPruneSessionStoreKey({ cfg, key, store });
-            if (store[primaryKey]) {
+            const hadEntry = Boolean(store[primaryKey]);
+            if (hadEntry) {
                 delete store[primaryKey];
             }
+            return hadEntry;
         });
-        const archived = deleteTranscript
+        const archived = deleted && deleteTranscript
             ? archiveSessionTranscriptsForSession({
                 sessionId,
                 storePath,
@@ -308,7 +356,15 @@ export const sessionsHandlers = {
                 reason: "deleted",
             })
             : [];
-        respond(true, { ok: true, key: target.canonicalKey, deleted: existed, archived }, undefined);
+        if (deleted) {
+            const emitLifecycleHooks = p.emitLifecycleHooks !== false;
+            await emitSessionUnboundLifecycleEvent({
+                targetSessionKey: target.canonicalKey ?? key,
+                reason: "session-delete",
+                emitHooks: emitLifecycleHooks,
+            });
+        }
+        respond(true, { ok: true, key: target.canonicalKey, deleted, archived }, undefined);
     },
     "sessions.compact": async ({ params, respond }) => {
         if (!assertValidParams(params, validateSessionsCompactParams, "sessions.compact", respond)) {

package/dist/gateway/server-methods/usage.js

@@ -1,32 +1,122 @@
 import fs from "node:fs";
 import { loadConfig } from "../../config/config.js";
-import { resolveSessionFilePath } from "../../config/sessions/paths.js";
+import { resolveSessionFilePath, resolveSessionFilePathOptions, } from "../../config/sessions/paths.js";
 import { loadProviderUsageSummary } from "../../infra/provider-usage.js";
 import { loadCostUsageSummary, loadSessionCostSummary, loadSessionUsageTimeSeries, discoverAllSessions, } from "../../infra/session-cost-usage.js";
 import { parseAgentSessionKey } from "../../routing/session-key.js";
+import { buildUsageAggregateTail } from "../../shared/usage-aggregates.js";
 import { ErrorCodes, errorShape, formatValidationErrors, validateSessionsUsageParams, } from "../protocol/index.js";
 import { listAgentsForGateway, loadCombinedSessionStoreForGateway, loadSessionEntry, } from "../session-utils.js";
 const COST_USAGE_CACHE_TTL_MS = 30_000;
+const DAY_MS = 24 * 60 * 60 * 1000;
 const costUsageCache = new Map();
+function resolveSessionUsageFileOrRespond(key, respond) {
+    const config = loadConfig();
+    const { entry, storePath } = loadSessionEntry(key);
+    // For discovered sessions (not in store), try using key as sessionId directly
+    const parsed = parseAgentSessionKey(key);
+    const agentId = parsed?.agentId;
+    const rawSessionId = parsed?.rest ?? key;
+    const sessionId = entry?.sessionId ?? rawSessionId;
+    let sessionFile;
+    try {
+        const pathOpts = resolveSessionFilePathOptions({ storePath, agentId });
+        sessionFile = resolveSessionFilePath(sessionId, entry, pathOpts);
+    }
+    catch {
+        respond(false, undefined, errorShape(ErrorCodes.INVALID_REQUEST, `Invalid session key: ${key}`));
+        return null;
+    }
+    return { config, entry, agentId, sessionId, sessionFile };
+}
+const parseDateParts = (raw) => {
+    if (typeof raw !== "string" || !raw.trim()) {
+        return undefined;
+    }
+    const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(raw.trim());
+    if (!match) {
+        return undefined;
+    }
+    const [, yearStr, monthStr, dayStr] = match;
+    const year = Number(yearStr);
+    const monthIndex = Number(monthStr) - 1;
+    const day = Number(dayStr);
+    if (!Number.isFinite(year) || !Number.isFinite(monthIndex) || !Number.isFinite(day)) {
+        return undefined;
+    }
+    return { year, monthIndex, day };
+};
 /**
- * Parse a date string (YYYY-MM-DD) to start of day timestamp in UTC.
- * Returns undefined if invalid.
+ * Parse a UTC offset string in the format UTC+H, UTC-H, UTC+HH, UTC-HH, UTC+H:MM, UTC-HH:MM.
+ * Returns the UTC offset in minutes (east-positive), or undefined if invalid.
  */
-const parseDateToMs = (raw) => {
+const parseUtcOffsetToMinutes = (raw) => {
     if (typeof raw !== "string" || !raw.trim()) {
         return undefined;
     }
-    const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(raw.trim());
+    const match = /^UTC([+-])(\d{1,2})(?::([0-5]\d))?$/.exec(raw.trim());
     if (!match) {
         return undefined;
     }
-    const [, year, month, day] = match;
-    // Use UTC to ensure consistent behavior across timezones
-    const ms = Date.UTC(parseInt(year), parseInt(month) - 1, parseInt(day));
-    if (Number.isNaN(ms)) {
+    const sign = match[1] === "+" ? 1 : -1;
+    const hours = Number(match[2]);
+    const minutes = Number(match[3] ?? "0");
+    if (!Number.isInteger(hours) || !Number.isInteger(minutes)) {
+        return undefined;
+    }
+    if (hours > 14 || (hours === 14 && minutes !== 0)) {
+        return undefined;
+    }
+    const totalMinutes = sign * (hours * 60 + minutes);
+    if (totalMinutes < -12 * 60 || totalMinutes > 14 * 60) {
+        return undefined;
+    }
+    return totalMinutes;
+};
+const resolveDateInterpretation = (params) => {
+    if (params.mode === "gateway") {
+        return { mode: "gateway" };
+    }
+    if (params.mode === "specific") {
+        const utcOffsetMinutes = parseUtcOffsetToMinutes(params.utcOffset);
+        if (utcOffsetMinutes !== undefined) {
+            return { mode: "specific", utcOffsetMinutes };
+        }
+    }
+    // Backward compatibility: when mode is missing (or invalid), keep current UTC interpretation.
+    return { mode: "utc" };
+};
+/**
+ * Parse a date string (YYYY-MM-DD) to start-of-day timestamp based on interpretation mode.
+ * Returns undefined if invalid.
+ */
+const parseDateToMs = (raw, interpretation = { mode: "utc" }) => {
+    const parts = parseDateParts(raw);
+    if (!parts) {
         return undefined;
     }
-    return ms;
+    const { year, monthIndex, day } = parts;
+    if (interpretation.mode === "gateway") {
+        const ms = new Date(year, monthIndex, day).getTime();
+        return Number.isNaN(ms) ? undefined : ms;
+    }
+    if (interpretation.mode === "specific") {
+        const ms = Date.UTC(year, monthIndex, day) - interpretation.utcOffsetMinutes * 60 * 1000;
+        return Number.isNaN(ms) ? undefined : ms;
+    }
+    const ms = Date.UTC(year, monthIndex, day);
+    return Number.isNaN(ms) ? undefined : ms;
+};
+const getTodayStartMs = (now, interpretation) => {
+    if (interpretation.mode === "gateway") {
+        return new Date(now.getFullYear(), now.getMonth(), now.getDate()).getTime();
+    }
+    if (interpretation.mode === "specific") {
+        const shifted = new Date(now.getTime() + interpretation.utcOffsetMinutes * 60 * 1000);
+        return (Date.UTC(shifted.getUTCFullYear(), shifted.getUTCMonth(), shifted.getUTCDate()) -
+            interpretation.utcOffsetMinutes * 60 * 1000);
+    }
+    return Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
 };
 const parseDays = (raw) => {
     if (typeof raw === "number" && Number.isFinite(raw)) {
@@ -46,25 +136,34 @@ const parseDays = (raw) => {
  */
 const parseDateRange = (params) => {
     const now = new Date();
-    // Use UTC for consistent date handling
-    const todayStartMs = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
-    const todayEndMs = todayStartMs + 24 * 60 * 60 * 1000 - 1;
-    const startMs = parseDateToMs(params.startDate);
-    const endMs = parseDateToMs(params.endDate);
+    const interpretation = resolveDateInterpretation(params);
+    const todayStartMs = getTodayStartMs(now, interpretation);
+    const todayEndMs = todayStartMs + DAY_MS - 1;
+    const startMs = parseDateToMs(params.startDate, interpretation);
+    const endMs = parseDateToMs(params.endDate, interpretation);
     if (startMs !== undefined && endMs !== undefined) {
         // endMs should be end of day
-        return { startMs, endMs: endMs + 24 * 60 * 60 * 1000 - 1 };
+        return { startMs, endMs: endMs + DAY_MS - 1 };
     }
     const days = parseDays(params.days);
     if (days !== undefined) {
         const clampedDays = Math.max(1, days);
-        const start = todayStartMs - (clampedDays - 1) * 24 * 60 * 60 * 1000;
+        const start = todayStartMs - (clampedDays - 1) * DAY_MS;
         return { startMs: start, endMs: todayEndMs };
     }
     // Default to last 30 days
-    const defaultStartMs = todayStartMs - 29 * 24 * 60 * 60 * 1000;
+    const defaultStartMs = todayStartMs - 29 * DAY_MS;
     return { startMs: defaultStartMs, endMs: todayEndMs };
 };
+function buildStoreBySessionId(store) {
+    const storeBySessionId = new Map();
+    for (const [key, entry] of Object.entries(store)) {
+        if (entry?.sessionId) {
+            storeBySessionId.set(entry.sessionId, { key, entry });
+        }
+    }
+    return storeBySessionId;
+}
 async function discoverAllSessionsForUsage(params) {
     const agents = listAgentsForGateway(params.config).agents;
     const results = await Promise.all(agents.map(async (agent) => {
@@ -122,7 +221,11 @@ async function loadCostUsageSummaryCached(params) {
 }
 // Exposed for unit tests (kept as a single export to avoid widening the public API surface).
 export const __test = {
+    parseDateParts,
+    parseUtcOffsetToMinutes,
+    resolveDateInterpretation,
     parseDateToMs,
+    getTodayStartMs,
     parseDays,
     parseDateRange,
     discoverAllSessionsForUsage,
@@ -140,6 +243,8 @@ export const usageHandlers = {
             startDate: params?.startDate,
             endDate: params?.endDate,
             days: params?.days,
+            mode: params?.mode,
+            utcOffset: params?.utcOffset,
         });
         const summary = await loadCostUsageSummaryCached({ startMs, endMs, config });
         respond(true, summary, undefined);
@@ -154,12 +259,14 @@ export const usageHandlers = {
         const { startMs, endMs } = parseDateRange({
             startDate: p.startDate,
             endDate: p.endDate,
+            mode: p.mode,
+            utcOffset: p.utcOffset,
         });
         const limit = typeof p.limit === "number" && Number.isFinite(p.limit) ? p.limit : 50;
         const includeContextWeight = p.includeContextWeight ?? false;
         const specificKey = typeof p.key === "string" ? p.key.trim() : null;
         // Load session store for named sessions
-        const { store } = loadCombinedSessionStoreForGateway(config);
+        const { storePath, store } = loadCombinedSessionStoreForGateway(config);
         const now = Date.now();
         const mergedEntries = [];
         // Optimization: If a specific key is requested, skip full directory scan
@@ -169,12 +276,7 @@ export const usageHandlers = {
             const keyRest = parsed?.rest ?? specificKey;
             // Prefer the store entry when available, even if the caller provides a discovered key
             // (`agent:<id>:<sessionId>`) for a session that now has a canonical store key.
-            const storeBySessionId = new Map();
-            for (const [key, entry] of Object.entries(store)) {
-                if (entry?.sessionId) {
-                    storeBySessionId.set(entry.sessionId, { key, entry });
-                }
-            }
+            const storeBySessionId = buildStoreBySessionId(store);
             const storeMatch = store[specificKey]
                 ? { key: specificKey, entry: store[specificKey] }
                 : null;
@@ -183,9 +285,18 @@ export const usageHandlers = {
             const storeEntry = storeMatch?.entry ?? storeByIdMatch?.entry;
             const sessionId = storeEntry?.sessionId ?? keyRest;
             // Resolve the session file path
-            const sessionFile = resolveSessionFilePath(sessionId, storeEntry, {
-                agentId: agentIdFromKey,
-            });
+            let sessionFile;
+            try {
+                const pathOpts = resolveSessionFilePathOptions({
+                    storePath: storePath !== "(multiple)" ? storePath : undefined,
+                    agentId: agentIdFromKey,
+                });
+                sessionFile = resolveSessionFilePath(sessionId, storeEntry, pathOpts);
+            }
+            catch {
+                respond(false, undefined, errorShape(ErrorCodes.INVALID_REQUEST, `Invalid session reference: ${specificKey}`));
+                return;
+            }
             try {
                 const stats = fs.statSync(sessionFile);
                 if (stats.isFile()) {
@@ -211,12 +322,7 @@ export const usageHandlers = {
                 endMs,
             });
             // Build a map of sessionId -> store entry for quick lookup
-            const storeBySessionId = new Map();
-            for (const [key, entry] of Object.entries(store)) {
-                if (entry?.sessionId) {
-                    storeBySessionId.set(entry.sessionId, { key, entry });
-                }
-            }
+            const storeBySessionId = buildStoreBySessionId(store);
             for (const discovered of discoveredSessions) {
                 const storeMatch = storeBySessionId.get(discovered.sessionId);
                 if (storeMatch) {
@@ -312,11 +418,13 @@ export const usageHandlers = {
             target.missingCostEntries += source.missingCostEntries;
         };
         for (const merged of limitedEntries) {
+            const agentId = parseAgentSessionKey(merged.key)?.agentId;
             const usage = await loadSessionCostSummary({
                 sessionId: merged.sessionId,
                 sessionEntry: merged.storeEntry,
                 sessionFile: merged.sessionFile,
                 config,
+                agentId,
                 startMs,
                 endMs,
             });
@@ -333,7 +441,6 @@ export const usageHandlers = {
                 aggregateTotals.cacheWriteCost += usage.cacheWriteCost;
                 aggregateTotals.missingCostEntries += usage.missingCostEntries;
             }
-            const agentId = parseAgentSessionKey(merged.key)?.agentId;
             const channel = merged.storeEntry?.channel ?? merged.storeEntry?.origin?.provider;
             const chatType = merged.storeEntry?.chatType ?? merged.storeEntry?.origin?.chatType;
             if (usage) {
@@ -488,6 +595,13 @@ export const usageHandlers = {
             const d = new Date(ms);
             return `${d.getUTCFullYear()}-${String(d.getUTCMonth() + 1).padStart(2, "0")}-${String(d.getUTCDate()).padStart(2, "0")}`;
         };
+        const tail = buildUsageAggregateTail({
+            byChannelMap: byChannelMap,
+            latencyTotals,
+            dailyLatencyMap,
+            modelDailyMap,
+            dailyMap: dailyAggregateMap,
+        });
         const aggregates = {
             messages: aggregateMessages,
             tools: {
@@ -514,30 +628,7 @@ export const usageHandlers = {
             byAgent: Array.from(byAgentMap.entries())
                 .map(([id, totals]) => ({ agentId: id, totals }))
                 .toSorted((a, b) => b.totals.totalCost - a.totals.totalCost),
-            byChannel: Array.from(byChannelMap.entries())
-                .map(([name, totals]) => ({ channel: name, totals }))
-                .toSorted((a, b) => b.totals.totalCost - a.totals.totalCost),
-            latency: latencyTotals.count > 0
-                ? {
-                    count: latencyTotals.count,
-                    avgMs: latencyTotals.sum / latencyTotals.count,
-                    minMs: latencyTotals.min === Number.POSITIVE_INFINITY ? 0 : latencyTotals.min,
-                    maxMs: latencyTotals.max,
-                    p95Ms: latencyTotals.p95Max,
-                }
-                : undefined,
-            dailyLatency: Array.from(dailyLatencyMap.values())
-                .map((entry) => ({
-                date: entry.date,
-                count: entry.count,
-                avgMs: entry.count ? entry.sum / entry.count : 0,
-                minMs: entry.min === Number.POSITIVE_INFINITY ? 0 : entry.min,
-                maxMs: entry.max,
-                p95Ms: entry.p95Max,
-            }))
-                .toSorted((a, b) => a.date.localeCompare(b.date)),
-            modelDaily: Array.from(modelDailyMap.values()).toSorted((a, b) => a.date.localeCompare(b.date) || b.cost - a.cost),
-            daily: Array.from(dailyAggregateMap.values()).toSorted((a, b) => a.date.localeCompare(b.date)),
+            ...tail,
         };
         const result = {
             updatedAt: now,
@@ -555,19 +646,17 @@ export const usageHandlers = {
             respond(false, undefined, errorShape(ErrorCodes.INVALID_REQUEST, "key is required for timeseries"));
             return;
         }
-        const config = loadConfig();
-        const { entry } = loadSessionEntry(key);
-        // For discovered sessions (not in store), try using key as sessionId directly
-        const parsed = parseAgentSessionKey(key);
-        const agentId = parsed?.agentId;
-        const rawSessionId = parsed?.rest ?? key;
-        const sessionId = entry?.sessionId ?? rawSessionId;
-        const sessionFile = entry?.sessionFile ?? resolveSessionFilePath(rawSessionId, entry, { agentId });
+        const resolved = resolveSessionUsageFileOrRespond(key, respond);
+        if (!resolved) {
+            return;
+        }
+        const { config, entry, agentId, sessionId, sessionFile } = resolved;
         const timeseries = await loadSessionUsageTimeSeries({
             sessionId,
             sessionEntry: entry,
             sessionFile,
             config,
+            agentId,
             maxPoints: 200,
         });
         if (!timeseries) {
@@ -585,20 +674,18 @@ export const usageHandlers = {
         const limit = typeof params?.limit === "number" && Number.isFinite(params.limit)
             ? Math.min(params.limit, 1000)
             : 200;
-        const config = loadConfig();
-        const { entry } = loadSessionEntry(key);
-        // For discovered sessions (not in store), try using key as sessionId directly
-        const parsed = parseAgentSessionKey(key);
-        const agentId = parsed?.agentId;
-        const rawSessionId = parsed?.rest ?? key;
-        const sessionId = entry?.sessionId ?? rawSessionId;
-        const sessionFile = entry?.sessionFile ?? resolveSessionFilePath(rawSessionId, entry, { agentId });
+        const resolved = resolveSessionUsageFileOrRespond(key, respond);
+        if (!resolved) {
+            return;
+        }
+        const { config, entry, agentId, sessionId, sessionFile } = resolved;
         const { loadSessionLogs } = await import("../../infra/session-cost-usage.js");
         const logs = await loadSessionLogs({
             sessionId,
             sessionEntry: entry,
             sessionFile,
             config,
+            agentId,
             limit,
         });
         respond(true, { logs: logs ?? [] }, undefined);

package/dist/gateway/server-node-events.js

@@ -8,6 +8,7 @@ import { updateSessionStore } from "../config/sessions.js";
 import { requestHeartbeatNow } from "../infra/heartbeat-wake.js";
 import { deliverOutboundPayloads } from "../infra/outbound/deliver.js";
 import { resolveOutboundTarget } from "../infra/outbound/targets.js";
+import { registerApnsToken } from "../infra/push-apns.js";
 import { enqueueSystemEvent } from "../infra/system-events.js";
 import { normalizeMainKey } from "../routing/session-key.js";
 import { defaultRuntime } from "../runtime.js";
@@ -410,6 +411,34 @@ export const handleNodeEvent = async (ctx, nodeId, evt) => {
             requestHeartbeatNow({ reason: "exec-event" });
             return;
         }
+        case "push.apns.register": {
+            if (!evt.payloadJSON) {
+                return;
+            }
+            let payload;
+            try {
+                payload = JSON.parse(evt.payloadJSON);
+            }
+            catch {
+                return;
+            }
+            const obj = typeof payload === "object" && payload !== null ? payload : {};
+            const token = typeof obj.token === "string" ? obj.token : "";
+            const topic = typeof obj.topic === "string" ? obj.topic : "";
+            const environment = obj.environment;
+            try {
+                await registerApnsToken({
+                    nodeId,
+                    token,
+                    topic,
+                    environment,
+                });
+            }
+            catch (err) {
+                ctx.logGateway.warn(`push apns register failed node=${nodeId}: ${formatForLog(err)}`);
+            }
+            return;
+        }
         default:
             return;
     }

package/dist/gateway/server-runtime-config.js

@@ -1,11 +1,27 @@
 import { assertGatewayAuthConfigured, resolveGatewayAuth, } from "./auth.js";
 import { normalizeControlUiBasePath } from "./control-ui-shared.js";
 import { resolveHooksConfig } from "./hooks.js";
-import { isLoopbackHost, resolveGatewayBindHost } from "./net.js";
+import { isLoopbackHost, isTrustedProxyAddress, isValidIPv4, resolveGatewayBindHost, } from "./net.js";
+import { mergeGatewayTailscaleConfig } from "./startup-auth.js";
 export async function resolveGatewayRuntimeConfig(params) {
     const bindMode = params.bind ?? params.cfg.gateway?.bind ?? "loopback";
     const customBindHost = params.cfg.gateway?.customBindHost;
     const bindHost = params.host ?? (await resolveGatewayBindHost(bindMode, customBindHost));
+    if (bindMode === "loopback" && !isLoopbackHost(bindHost)) {
+        throw new Error(`gateway bind=loopback resolved to non-loopback host ${bindHost}; refusing fallback to a network bind`);
+    }
+    if (bindMode === "custom") {
+        const configuredCustomBindHost = customBindHost?.trim();
+        if (!configuredCustomBindHost) {
+            throw new Error("gateway.bind=custom requires gateway.customBindHost");
+        }
+        if (!isValidIPv4(configuredCustomBindHost)) {
+            throw new Error(`gateway.bind=custom requires a valid IPv4 customBindHost (got ${configuredCustomBindHost})`);
+        }
+        if (bindHost !== configuredCustomBindHost) {
+            throw new Error(`gateway bind=custom requested ${configuredCustomBindHost} but resolved ${bindHost}; refusing fallback`);
+        }
+    }
     const controlUiEnabled = params.controlUiEnabled ?? params.cfg.gateway?.controlUi?.enabled ?? true;
     const openAiChatCompletionsEnabled = params.openAiChatCompletionsEnabled ??
         params.cfg.gateway?.http?.endpoints?.chatCompletions?.enabled ??
@@ -17,21 +33,13 @@ export async function resolveGatewayRuntimeConfig(params) {
     const controlUiRoot = typeof controlUiRootRaw === "string" && controlUiRootRaw.trim().length > 0
         ? controlUiRootRaw.trim()
         : undefined;
-    const authBase = params.cfg.gateway?.auth ?? {};
-    const authOverrides = params.auth ?? {};
-    const authConfig = {
-        ...authBase,
-        ...authOverrides,
-    };
     const tailscaleBase = params.cfg.gateway?.tailscale ?? {};
     const tailscaleOverrides = params.tailscale ?? {};
-    const tailscaleConfig = {
-        ...tailscaleBase,
-        ...tailscaleOverrides,
-    };
+    const tailscaleConfig = mergeGatewayTailscaleConfig(tailscaleBase, tailscaleOverrides);
     const tailscaleMode = tailscaleConfig.mode ?? "off";
     const resolvedAuth = resolveGatewayAuth({
-        authConfig,
+        authConfig: params.cfg.gateway?.auth,
+        authOverride: params.auth,
         env: process.env,
         tailscaleMode,
     });
@@ -41,6 +49,7 @@ export async function resolveGatewayRuntimeConfig(params) {
     const hasSharedSecret = (authMode === "token" && hasToken) || (authMode === "password" && hasPassword);
     const hooksConfig = resolveHooksConfig(params.cfg);
     const canvasHostEnabled = process.env.CLAWDBOT_SKIP_CANVAS_HOST !== "1" && params.cfg.canvasHost?.enabled !== false;
+    const trustedProxies = params.cfg.gateway?.trustedProxies ?? [];
     assertGatewayAuthConfigured(resolvedAuth);
     if (tailscaleMode === "funnel" && authMode !== "password") {
         throw new Error("tailscale funnel requires gateway auth mode=password (set gateway.auth.password or POOLBOT_GATEWAY_PASSWORD)");
@@ -48,9 +57,21 @@ export async function resolveGatewayRuntimeConfig(params) {
     if (tailscaleMode !== "off" && !isLoopbackHost(bindHost)) {
         throw new Error("tailscale serve/funnel requires gateway bind=loopback (127.0.0.1)");
     }
-    if (!isLoopbackHost(bindHost) && !hasSharedSecret) {
+    if (!isLoopbackHost(bindHost) && !hasSharedSecret && authMode !== "trusted-proxy") {
         throw new Error(`refusing to bind gateway to ${bindHost}:${params.port} without auth (set gateway.auth.token/password, or set POOLBOT_GATEWAY_TOKEN/POOLBOT_GATEWAY_PASSWORD)`);
     }
+    if (authMode === "trusted-proxy") {
+        if (trustedProxies.length === 0) {
+            throw new Error("gateway auth mode=trusted-proxy requires gateway.trustedProxies to be configured with at least one proxy IP");
+        }
+        if (isLoopbackHost(bindHost)) {
+            const hasLoopbackTrustedProxy = isTrustedProxyAddress("127.0.0.1", trustedProxies) ||
+                isTrustedProxyAddress("::1", trustedProxies);
+            if (!hasLoopbackTrustedProxy) {
+                throw new Error("gateway auth mode=trusted-proxy with bind=loopback requires gateway.trustedProxies to include 127.0.0.1, ::1, or a loopback CIDR");
+            }
+        }
+    }
     return {
         bindHost,
         controlUiEnabled,