@poolzin/pool-bot 2026.2.25 → 2026.2.26

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (506) hide show
  1. package/dist/acp/event-mapper.js +87 -22
  2. package/dist/acp/meta.js +12 -6
  3. package/dist/agents/agent-paths.js +8 -9
  4. package/dist/agents/agent-scope.js +7 -5
  5. package/dist/agents/auth-profiles/oauth.js +148 -64
  6. package/dist/agents/auth-profiles/session-override.js +13 -7
  7. package/dist/agents/bash-tools.exec-host-gateway.js +14 -4
  8. package/dist/agents/bash-tools.exec-runtime.js +2 -25
  9. package/dist/agents/bedrock-discovery.js +3 -1
  10. package/dist/agents/byteplus-models.js +97 -0
  11. package/dist/agents/chutes-oauth.js +1 -0
  12. package/dist/agents/cli-runner/helpers.js +4 -0
  13. package/dist/agents/compaction.js +41 -14
  14. package/dist/agents/doubao-models.js +121 -0
  15. package/dist/agents/failover-error.js +2 -0
  16. package/dist/agents/huggingface-models.js +5 -3
  17. package/dist/agents/live-model-filter.js +5 -0
  18. package/dist/agents/minimax-vlm.js +10 -8
  19. package/dist/agents/model-auth.js +6 -0
  20. package/dist/agents/model-catalog.js +3 -1
  21. package/dist/agents/model-selection.js +7 -1
  22. package/dist/agents/models-config.providers.js +93 -11
  23. package/dist/agents/ollama-stream.js +117 -4
  24. package/dist/agents/opencode-zen-models.js +22 -11
  25. package/dist/agents/pi-embedded-helpers/errors.js +55 -33
  26. package/dist/agents/pi-embedded-helpers/messaging-dedupe.js +10 -5
  27. package/dist/agents/pi-embedded-helpers/thinking.js +10 -5
  28. package/dist/agents/pi-embedded-helpers.js +1 -1
  29. package/dist/agents/pi-embedded-runner/compact.js +29 -7
  30. package/dist/agents/pi-embedded-runner/extensions.js +28 -26
  31. package/dist/agents/pi-embedded-runner/google.js +20 -8
  32. package/dist/agents/pi-embedded-runner/run/attempt.js +95 -36
  33. package/dist/agents/pi-embedded-runner/run.js +71 -12
  34. package/dist/agents/pi-embedded-runner/run.overflow-compaction.mocks.shared.js +11 -2
  35. package/dist/agents/pi-embedded-runner/session-manager-cache.js +11 -7
  36. package/dist/agents/pi-embedded-runner/system-prompt.js +2 -0
  37. package/dist/agents/pi-embedded-runner/thinking.js +42 -0
  38. package/dist/agents/pi-embedded-runner/tool-name-allowlist.js +19 -0
  39. package/dist/agents/pi-embedded-runner/utils.js +7 -10
  40. package/dist/agents/pi-embedded-subscribe.handlers.lifecycle.js +45 -56
  41. package/dist/agents/pi-embedded-subscribe.handlers.tools.js +2 -2
  42. package/dist/agents/pi-embedded-subscribe.js +9 -4
  43. package/dist/agents/pi-embedded-subscribe.tools.js +68 -14
  44. package/dist/agents/pi-embedded-utils.js +3 -0
  45. package/dist/agents/pi-extensions/compaction-safeguard-runtime.js +4 -20
  46. package/dist/agents/pi-extensions/compaction-safeguard.js +75 -33
  47. package/dist/agents/pi-settings.js +40 -0
  48. package/dist/agents/pi-tools.policy.js +2 -1
  49. package/dist/agents/provider/config-loader.js +1 -1
  50. package/dist/agents/sandbox/browser.js +170 -33
  51. package/dist/agents/sandbox/config-hash.js +14 -27
  52. package/dist/agents/sandbox/config.js +21 -2
  53. package/dist/agents/sandbox/constants.js +2 -0
  54. package/dist/agents/sandbox/docker.js +16 -2
  55. package/dist/agents/sandbox/novnc-auth.js +62 -0
  56. package/dist/agents/sandbox/sanitize-env-vars.js +1 -1
  57. package/dist/agents/sandbox/shared.js +10 -6
  58. package/dist/agents/sandbox-paths.js +24 -11
  59. package/dist/agents/schema/clean-for-gemini.js +132 -85
  60. package/dist/agents/session-slug.js +10 -5
  61. package/dist/agents/session-tool-result-guard-wrapper.js +1 -0
  62. package/dist/agents/session-tool-result-guard.js +3 -1
  63. package/dist/agents/session-transcript-repair.js +40 -6
  64. package/dist/agents/skills/bundled-dir.js +19 -5
  65. package/dist/agents/skills/env-overrides.js +124 -43
  66. package/dist/agents/skills/frontmatter.js +6 -6
  67. package/dist/agents/skills/plugin-skills.js +14 -7
  68. package/dist/agents/skills/workspace.js +1 -0
  69. package/dist/agents/subagent-announce.js +251 -49
  70. package/dist/agents/subagent-lifecycle-events.js +19 -0
  71. package/dist/agents/subagent-registry-cleanup.js +31 -0
  72. package/dist/agents/subagent-registry-completion.js +68 -0
  73. package/dist/agents/subagent-registry-queries.js +117 -0
  74. package/dist/agents/subagent-registry-state.js +46 -0
  75. package/dist/agents/subagent-registry.js +252 -221
  76. package/dist/agents/subagent-registry.store.js +1 -0
  77. package/dist/agents/subagent-registry.types.js +1 -0
  78. package/dist/agents/subagent-spawn.js +195 -7
  79. package/dist/agents/system-prompt.js +22 -6
  80. package/dist/agents/test-helpers/fast-coding-tools.js +1 -18
  81. package/dist/agents/test-helpers/fast-core-tools.js +1 -17
  82. package/dist/agents/timeout.js +18 -6
  83. package/dist/agents/tool-call-id.js +1 -1
  84. package/dist/agents/tool-display-common.js +162 -29
  85. package/dist/agents/tool-images.js +82 -9
  86. package/dist/agents/tool-policy.js +51 -26
  87. package/dist/agents/tools/browser-tool.js +2 -2
  88. package/dist/agents/tools/canvas-tool.js +27 -1
  89. package/dist/agents/tools/common.js +45 -0
  90. package/dist/agents/tools/discord-actions-guild.js +4 -1
  91. package/dist/agents/tools/gateway-tool.js +3 -1
  92. package/dist/agents/tools/nodes-utils.js +1 -10
  93. package/dist/agents/tools/sessions-send-helpers.js +12 -6
  94. package/dist/agents/tools/sessions-spawn-tool.js +8 -2
  95. package/dist/agents/tools/subagents-tool.js +2 -1
  96. package/dist/agents/tools/whatsapp-actions.js +10 -2
  97. package/dist/agents/tools/whatsapp-target-auth.js +18 -0
  98. package/dist/agents/transcript-policy.js +22 -8
  99. package/dist/agents/venice-models.js +11 -3
  100. package/dist/auto-reply/commands-registry.data.js +51 -0
  101. package/dist/auto-reply/commands-registry.js +4 -3
  102. package/dist/auto-reply/group-activation.js +10 -5
  103. package/dist/auto-reply/inbound-debounce.js +10 -5
  104. package/dist/auto-reply/reply/abort.js +1 -1
  105. package/dist/auto-reply/reply/agent-runner-execution.js +4 -1
  106. package/dist/auto-reply/reply/bash-command.js +41 -39
  107. package/dist/auto-reply/reply/command-gates.js +25 -0
  108. package/dist/auto-reply/reply/commands-allowlist.js +111 -72
  109. package/dist/auto-reply/reply/commands-bash.js +6 -5
  110. package/dist/auto-reply/reply/commands-config.js +30 -28
  111. package/dist/auto-reply/reply/commands-core.js +2 -1
  112. package/dist/auto-reply/reply/commands-info.js +1 -0
  113. package/dist/auto-reply/reply/commands-models.js +65 -14
  114. package/dist/auto-reply/reply/commands-session.js +237 -82
  115. package/dist/auto-reply/reply/commands-setunset.js +45 -0
  116. package/dist/auto-reply/reply/commands-subagents/action-agents.js +44 -0
  117. package/dist/auto-reply/reply/commands-subagents/action-focus.js +64 -0
  118. package/dist/auto-reply/reply/commands-subagents/action-help.js +4 -0
  119. package/dist/auto-reply/reply/commands-subagents/action-info.js +45 -0
  120. package/dist/auto-reply/reply/commands-subagents/action-kill.js +60 -0
  121. package/dist/auto-reply/reply/commands-subagents/action-list.js +44 -0
  122. package/dist/auto-reply/reply/commands-subagents/action-log.js +29 -0
  123. package/dist/auto-reply/reply/commands-subagents/action-send.js +119 -0
  124. package/dist/auto-reply/reply/commands-subagents/action-spawn.js +52 -0
  125. package/dist/auto-reply/reply/commands-subagents/action-unfocus.js +30 -0
  126. package/dist/auto-reply/reply/commands-subagents/shared.js +303 -0
  127. package/dist/auto-reply/reply/commands-subagents.js +51 -587
  128. package/dist/auto-reply/reply/commands-tts.js +10 -5
  129. package/dist/auto-reply/reply/config-value.js +10 -5
  130. package/dist/auto-reply/reply/directive-handling.model-picker.js +12 -6
  131. package/dist/auto-reply/reply/directive-handling.persist.js +9 -21
  132. package/dist/auto-reply/reply/directive-handling.shared.js +24 -4
  133. package/dist/auto-reply/reply/followup-runner.js +1 -0
  134. package/dist/auto-reply/reply/get-reply-directives-utils.js +23 -14
  135. package/dist/auto-reply/reply/get-reply-directives.js +17 -28
  136. package/dist/auto-reply/reply/get-reply-inline-actions.js +1 -0
  137. package/dist/auto-reply/reply/get-reply.js +71 -12
  138. package/dist/auto-reply/reply/model-selection.js +80 -39
  139. package/dist/auto-reply/reply/queue/enqueue.js +10 -5
  140. package/dist/auto-reply/reply/queue/state.js +13 -12
  141. package/dist/auto-reply/reply/reply-payloads.js +67 -36
  142. package/dist/auto-reply/reply/reply-reference.js +9 -8
  143. package/dist/auto-reply/reply/route-reply.js +15 -8
  144. package/dist/auto-reply/reply/session-reset-prompt.js +1 -1
  145. package/dist/auto-reply/reply/session.js +22 -6
  146. package/dist/auto-reply/reply/strip-inbound-meta.js +147 -0
  147. package/dist/auto-reply/reply/subagents-utils.js +56 -30
  148. package/dist/auto-reply/reply/typing.js +46 -21
  149. package/dist/auto-reply/send-policy.js +14 -7
  150. package/dist/auto-reply/status.js +140 -16
  151. package/dist/auto-reply/templating.js +10 -5
  152. package/dist/auto-reply/thinking.js +7 -16
  153. package/dist/auto-reply/tokens.js +21 -5
  154. package/dist/browser/bridge-server.js +36 -20
  155. package/dist/browser/cdp.helpers.js +7 -14
  156. package/dist/browser/cdp.js +35 -15
  157. package/dist/browser/chrome.profile-decoration.js +7 -4
  158. package/dist/browser/config.js +4 -0
  159. package/dist/browser/extension-relay-auth.js +55 -0
  160. package/dist/browser/extension-relay.js +74 -29
  161. package/dist/browser/navigation-guard.js +9 -1
  162. package/dist/browser/paths.js +77 -0
  163. package/dist/browser/profiles.js +13 -8
  164. package/dist/browser/pw-ai-module.js +10 -5
  165. package/dist/browser/pw-session.js +76 -39
  166. package/dist/browser/pw-tools-core.interactions.js +14 -7
  167. package/dist/browser/pw-tools-core.state.js +12 -6
  168. package/dist/browser/routes/agent.act.js +2 -2
  169. package/dist/browser/server-context.js +7 -0
  170. package/dist/build-info.json +3 -3
  171. package/dist/channels/allow-from.js +2 -1
  172. package/dist/channels/allowlists/resolve-utils.js +43 -19
  173. package/dist/channels/channel-config.js +14 -7
  174. package/dist/channels/draft-stream-loop.js +7 -0
  175. package/dist/channels/model-overrides.js +82 -0
  176. package/dist/channels/plugins/normalize/imessage.js +14 -7
  177. package/dist/channels/plugins/normalize/slack.js +10 -5
  178. package/dist/channels/plugins/normalize/telegram.js +14 -7
  179. package/dist/channels/plugins/outbound/discord.js +80 -8
  180. package/dist/channels/plugins/outbound/signal.js +11 -11
  181. package/dist/channels/plugins/setup-helpers.js +10 -5
  182. package/dist/channels/sender-label.js +14 -7
  183. package/dist/channels/session.js +4 -2
  184. package/dist/channels/status-reactions.js +297 -0
  185. package/dist/cli/banner.js +1 -1
  186. package/dist/cli/browser-cli-actions-input/register.files-downloads.js +65 -56
  187. package/dist/cli/cli-name.js +11 -11
  188. package/dist/cli/cli-utils.js +13 -3
  189. package/dist/cli/command-format.js +1 -1
  190. package/dist/cli/config-cli.js +1 -1
  191. package/dist/cli/daemon-cli/lifecycle-core.js +31 -19
  192. package/dist/cli/daemon-cli/lifecycle.js +64 -2
  193. package/dist/cli/daemon-cli/restart-health.js +126 -0
  194. package/dist/cli/daemon-cli/status.gather.js +9 -13
  195. package/dist/cli/daemon-cli/status.print.js +2 -10
  196. package/dist/cli/deps.js +27 -22
  197. package/dist/cli/gateway-cli/run-loop.js +23 -5
  198. package/dist/cli/node-cli/register.js +14 -5
  199. package/dist/cli/nodes-media-utils.js +7 -2
  200. package/dist/cli/outbound-send-deps.js +2 -9
  201. package/dist/cli/outbound-send-mapping.js +11 -0
  202. package/dist/cli/pairing-cli.js +40 -14
  203. package/dist/cli/plugins-cli.js +34 -41
  204. package/dist/cli/ports.js +11 -10
  205. package/dist/cli/program/command-registry.js +2 -11
  206. package/dist/cli/program/command-tree.js +16 -0
  207. package/dist/cli/program/preaction.js +13 -9
  208. package/dist/cli/program/register.configure.js +3 -18
  209. package/dist/cli/program/register.maintenance.js +2 -2
  210. package/dist/cli/program/register.onboard.js +2 -0
  211. package/dist/cli/program/register.status-health-sessions.js +16 -17
  212. package/dist/cli/program/register.subclis.js +93 -52
  213. package/dist/cli/route.js +11 -7
  214. package/dist/cli/system-cli.js +36 -46
  215. package/dist/cli/update-cli/shared.js +22 -9
  216. package/dist/cli/update-cli/update-command.js +89 -14
  217. package/dist/cli/update-cli/wizard.js +6 -12
  218. package/dist/commands/agent/run-context.js +18 -5
  219. package/dist/commands/agent/session-store.js +17 -4
  220. package/dist/commands/agent.js +22 -2
  221. package/dist/commands/agents.bindings.js +14 -7
  222. package/dist/commands/agents.commands.add.js +13 -9
  223. package/dist/commands/agents.commands.identity.js +12 -6
  224. package/dist/commands/agents.commands.list.js +11 -6
  225. package/dist/commands/agents.config.js +8 -10
  226. package/dist/commands/agents.providers.js +12 -6
  227. package/dist/commands/auth-choice-options.js +103 -75
  228. package/dist/commands/auth-choice.apply.byteplus.js +55 -0
  229. package/dist/commands/auth-choice.apply.js +4 -0
  230. package/dist/commands/auth-choice.apply.minimax.js +61 -13
  231. package/dist/commands/auth-choice.apply.openai.js +3 -1
  232. package/dist/commands/auth-choice.apply.volcengine.js +55 -0
  233. package/dist/commands/auth-choice.preferred-provider.js +2 -0
  234. package/dist/commands/channels/remove.js +13 -6
  235. package/dist/commands/channels/shared.js +4 -14
  236. package/dist/commands/configure.commands.js +14 -0
  237. package/dist/commands/configure.gateway.js +2 -4
  238. package/dist/commands/configure.js +1 -1
  239. package/dist/commands/configure.shared.js +11 -0
  240. package/dist/commands/daemon-install-helpers.js +2 -2
  241. package/dist/commands/dashboard.js +12 -10
  242. package/dist/commands/docs.js +14 -8
  243. package/dist/commands/doctor-config-flow.js +11 -9
  244. package/dist/commands/doctor-legacy-config.js +281 -0
  245. package/dist/commands/doctor-state-integrity.js +99 -23
  246. package/dist/commands/doctor-update.js +12 -9
  247. package/dist/commands/models/list.list-command.js +7 -5
  248. package/dist/commands/models/set-image.js +2 -21
  249. package/dist/commands/node-daemon-install-helpers.js +10 -8
  250. package/dist/commands/onboard-auth.config-minimax.js +54 -80
  251. package/dist/commands/onboard-auth.config-opencode.js +2 -18
  252. package/dist/commands/onboard-auth.credentials.js +90 -13
  253. package/dist/commands/onboard-auth.js +1 -1
  254. package/dist/commands/onboard-auth.models.js +6 -5
  255. package/dist/commands/onboard-hooks.js +1 -1
  256. package/dist/commands/onboard-non-interactive/api-keys.js +14 -7
  257. package/dist/commands/onboard-non-interactive/local/auth-choice.js +64 -49
  258. package/dist/commands/onboard-provider-auth-flags.js +14 -0
  259. package/dist/commands/onboard-remote.js +14 -7
  260. package/dist/commands/onboard.js +11 -13
  261. package/dist/commands/sandbox-display.js +6 -5
  262. package/dist/commands/status-all/diagnosis.js +14 -10
  263. package/dist/commands/status-all/format.js +1 -0
  264. package/dist/commands/status.gateway-probe.js +1 -16
  265. package/dist/commands/systemd-linger.js +12 -6
  266. package/dist/config/agent-limits.js +2 -0
  267. package/dist/config/commands.js +30 -16
  268. package/dist/config/config-paths.js +9 -11
  269. package/dist/config/defaults.js +22 -2
  270. package/dist/config/discord-preview-streaming.js +104 -0
  271. package/dist/config/env-vars.js +37 -8
  272. package/dist/config/includes.js +4 -0
  273. package/dist/config/io.js +97 -12
  274. package/dist/config/legacy.migrations.part-1.js +189 -78
  275. package/dist/config/legacy.shared.js +3 -1
  276. package/dist/config/merge-patch.js +4 -0
  277. package/dist/config/prototype-keys.js +4 -0
  278. package/dist/config/schema.help.js +44 -7
  279. package/dist/config/schema.labels.js +38 -6
  280. package/dist/config/sessions/delivery-info.js +10 -3
  281. package/dist/config/sessions/main-session.js +10 -5
  282. package/dist/config/sessions/session-file.js +33 -0
  283. package/dist/config/sessions/session-key.js +10 -5
  284. package/dist/config/sessions/store.js +1 -1
  285. package/dist/config/sessions.js +1 -0
  286. package/dist/config/zod-schema.agent-runtime.js +11 -0
  287. package/dist/config/zod-schema.js +148 -13
  288. package/dist/config/zod-schema.providers-core.js +78 -4
  289. package/dist/config/zod-schema.providers.js +6 -1
  290. package/dist/config/zod-schema.session.js +41 -2
  291. package/dist/cron/run-log.js +3 -0
  292. package/dist/cron/schedule.js +21 -10
  293. package/dist/cron/service/ops.js +35 -21
  294. package/dist/cron/service/timer.js +116 -16
  295. package/dist/cron/stagger.js +3 -1
  296. package/dist/discord/api.js +12 -6
  297. package/dist/discord/draft-chunking.js +22 -0
  298. package/dist/discord/draft-stream.js +124 -0
  299. package/dist/discord/monitor/agent-components.js +1 -1
  300. package/dist/discord/monitor/commands.js +5 -0
  301. package/dist/discord/monitor/gateway-plugin.js +2 -1
  302. package/dist/discord/monitor/listeners.js +37 -27
  303. package/dist/discord/monitor/message-handler.js +4 -1
  304. package/dist/discord/monitor/message-handler.preflight.js +65 -8
  305. package/dist/discord/monitor/message-handler.process.js +246 -217
  306. package/dist/discord/monitor/message-utils.js +143 -6
  307. package/dist/discord/monitor/model-picker-preferences.js +143 -0
  308. package/dist/discord/monitor/model-picker.js +651 -0
  309. package/dist/discord/monitor/native-command.js +573 -16
  310. package/dist/discord/monitor/provider.allowlist.js +223 -0
  311. package/dist/discord/monitor/provider.js +275 -347
  312. package/dist/discord/monitor/provider.lifecycle.js +100 -0
  313. package/dist/discord/monitor/reply-delivery.js +123 -16
  314. package/dist/discord/monitor/thread-bindings.discord-api.js +215 -0
  315. package/dist/discord/monitor/thread-bindings.js +4 -0
  316. package/dist/discord/monitor/thread-bindings.lifecycle.js +177 -0
  317. package/dist/discord/monitor/thread-bindings.manager.js +423 -0
  318. package/dist/discord/monitor/thread-bindings.messages.js +55 -0
  319. package/dist/discord/monitor/thread-bindings.state.js +358 -0
  320. package/dist/discord/monitor/thread-bindings.types.js +6 -0
  321. package/dist/discord/resolve-users.js +33 -21
  322. package/dist/discord/send.channels.js +15 -0
  323. package/dist/discord/send.js +3 -2
  324. package/dist/discord/send.outbound.js +82 -26
  325. package/dist/discord/send.permissions.js +83 -30
  326. package/dist/discord/send.reactions.js +8 -4
  327. package/dist/discord/token.js +10 -5
  328. package/dist/discord/voice/command.js +263 -0
  329. package/dist/discord/voice/manager.js +531 -0
  330. package/dist/gateway/auth.js +34 -10
  331. package/dist/gateway/call.js +4 -16
  332. package/dist/gateway/client.js +28 -4
  333. package/dist/gateway/config-reload.js +3 -4
  334. package/dist/gateway/control-ui.js +219 -96
  335. package/dist/gateway/hooks-mapping.js +88 -38
  336. package/dist/gateway/http-auth-helpers.js +3 -2
  337. package/dist/gateway/http-endpoint-helpers.js +1 -0
  338. package/dist/gateway/net.js +54 -12
  339. package/dist/gateway/node-invoke-system-run-approval.js +14 -35
  340. package/dist/gateway/node-registry.js +10 -5
  341. package/dist/gateway/openai-http.js +1 -0
  342. package/dist/gateway/openresponses-http.js +1 -0
  343. package/dist/gateway/origin-check.js +1 -18
  344. package/dist/gateway/protocol/index.js +4 -3
  345. package/dist/gateway/protocol/schema/cron.js +1 -0
  346. package/dist/gateway/protocol/schema/devices.js +1 -0
  347. package/dist/gateway/protocol/schema/protocol-schemas.js +2 -1
  348. package/dist/gateway/protocol/schema/sessions.js +6 -0
  349. package/dist/gateway/role-policy.js +17 -0
  350. package/dist/gateway/server/ws-connection/connect-policy.js +37 -0
  351. package/dist/gateway/server/ws-connection/message-handler.js +175 -148
  352. package/dist/gateway/server-chat.js +83 -25
  353. package/dist/gateway/server-constants.js +10 -9
  354. package/dist/gateway/server-cron.js +1 -0
  355. package/dist/gateway/server-http.js +16 -7
  356. package/dist/gateway/server-maintenance.js +20 -5
  357. package/dist/gateway/server-methods/chat.js +10 -6
  358. package/dist/gateway/server-methods/config.js +12 -14
  359. package/dist/gateway/server-methods/devices.js +17 -3
  360. package/dist/gateway/server-methods/models.js +11 -1
  361. package/dist/gateway/server-methods/sessions.js +64 -8
  362. package/dist/gateway/server-methods/usage.js +162 -75
  363. package/dist/gateway/server-node-events.js +29 -0
  364. package/dist/gateway/server-runtime-config.js +34 -13
  365. package/dist/gateway/server-startup-memory.js +17 -11
  366. package/dist/gateway/session-utils.fs.js +32 -34
  367. package/dist/gateway/sessions-resolve.js +17 -5
  368. package/dist/gateway/test-helpers.openai-mock.js +14 -7
  369. package/dist/gateway/tools-invoke-http.js +21 -10
  370. package/dist/hooks/bundled/bootstrap-extra-files/handler.js +3 -1
  371. package/dist/hooks/bundled/command-logger/handler.js +7 -2
  372. package/dist/hooks/bundled/session-memory/handler.js +6 -5
  373. package/dist/hooks/frontmatter.js +6 -6
  374. package/dist/hooks/gmail-watcher.js +11 -6
  375. package/dist/hooks/internal-hooks.js +11 -1
  376. package/dist/hooks/llm-slug-generator.js +4 -1
  377. package/dist/hooks/workspace.js +47 -17
  378. package/dist/imessage/accounts.js +9 -20
  379. package/dist/imessage/monitor/inbound-processing.js +2 -1
  380. package/dist/infra/archive.js +174 -73
  381. package/dist/infra/control-ui-assets.js +14 -6
  382. package/dist/infra/device-pairing.js +108 -29
  383. package/dist/infra/env.js +10 -5
  384. package/dist/infra/exec-approvals-allowlist.js +122 -0
  385. package/dist/infra/exec-approvals-analysis.js +34 -3
  386. package/dist/infra/exec-approvals.js +5 -17
  387. package/dist/infra/exec-safe-bin-policy.js +53 -45
  388. package/dist/infra/fs-safe.js +71 -39
  389. package/dist/infra/gateway-lock.js +6 -2
  390. package/dist/infra/heartbeat-wake.js +6 -12
  391. package/dist/infra/host-env-security-policy.json +19 -0
  392. package/dist/infra/host-env-security.js +66 -0
  393. package/dist/infra/net/ssrf.js +131 -38
  394. package/dist/infra/outbound/bound-delivery-router.js +88 -0
  395. package/dist/infra/outbound/channel-selection.js +12 -6
  396. package/dist/infra/outbound/envelope.js +1 -1
  397. package/dist/infra/outbound/format.js +12 -6
  398. package/dist/infra/outbound/payloads.js +14 -7
  399. package/dist/infra/outbound/session-binding-service.js +123 -0
  400. package/dist/infra/path-guards.js +25 -0
  401. package/dist/infra/provider-usage.fetch.codex.js +7 -15
  402. package/dist/infra/provider-usage.fetch.gemini.js +14 -11
  403. package/dist/infra/provider-usage.fetch.shared.js +30 -1
  404. package/dist/infra/provider-usage.fetch.zai.js +10 -9
  405. package/dist/infra/retry-policy.js +4 -2
  406. package/dist/infra/retry.js +9 -5
  407. package/dist/infra/session-cost-usage.js +107 -59
  408. package/dist/infra/session-maintenance-warning.js +3 -1
  409. package/dist/infra/shell-env.js +98 -34
  410. package/dist/infra/ssh-config.js +12 -6
  411. package/dist/infra/system-run-command.js +49 -4
  412. package/dist/infra/update-channels.js +10 -5
  413. package/dist/line/accounts.js +5 -7
  414. package/dist/line/bot-access.js +8 -20
  415. package/dist/line/bot-handlers.js +3 -1
  416. package/dist/link-understanding/detect.js +15 -7
  417. package/dist/media/constants.js +15 -6
  418. package/dist/media/image-ops.js +7 -0
  419. package/dist/media/local-roots.js +3 -2
  420. package/dist/media-understanding/apply.js +4 -1
  421. package/dist/media-understanding/concurrency.js +8 -20
  422. package/dist/memory/backend-config.js +45 -6
  423. package/dist/memory/embeddings.js +10 -4
  424. package/dist/memory/fs-utils.js +23 -0
  425. package/dist/memory/manager-search.js +12 -6
  426. package/dist/memory/manager-sync-ops.js +12 -2
  427. package/dist/memory/qmd-manager.js +466 -53
  428. package/dist/memory/query-expansion.js +167 -3
  429. package/dist/memory/status-format.js +10 -5
  430. package/dist/memory/sync-memory-files.js +1 -1
  431. package/dist/node-host/invoke-system-run.js +281 -0
  432. package/dist/node-host/invoke.js +55 -337
  433. package/dist/pairing/pairing-store.js +22 -0
  434. package/dist/plugin-sdk/allow-from.js +1 -1
  435. package/dist/plugin-sdk/command-auth.js +3 -1
  436. package/dist/plugin-sdk/index.js +6 -3
  437. package/dist/plugin-sdk/webhook-targets.js +32 -0
  438. package/dist/plugins/bundled-dir.js +9 -6
  439. package/dist/plugins/hooks.js +50 -0
  440. package/dist/plugins/install.js +28 -16
  441. package/dist/plugins/runtime.js +3 -17
  442. package/dist/plugins/update.js +78 -12
  443. package/dist/process/spawn-utils.js +14 -7
  444. package/dist/providers/github-copilot-token.js +11 -6
  445. package/dist/providers/qwen-portal-oauth.js +14 -6
  446. package/dist/routing/account-id.js +30 -0
  447. package/dist/routing/resolve-route.js +3 -7
  448. package/dist/routing/session-key.js +2 -16
  449. package/dist/security/audit-channel.js +93 -2
  450. package/dist/security/audit-extra.async.js +159 -5
  451. package/dist/security/audit-extra.js +1 -1
  452. package/dist/security/audit-extra.sync.js +85 -6
  453. package/dist/security/audit.js +40 -4
  454. package/dist/security/dm-policy-shared.js +44 -0
  455. package/dist/security/external-content.js +26 -6
  456. package/dist/shared/entry-status.js +6 -0
  457. package/dist/shared/frontmatter.js +5 -5
  458. package/dist/shared/node-match.js +11 -4
  459. package/dist/shared/operator-scope-compat.js +8 -3
  460. package/dist/signal/accounts.js +7 -20
  461. package/dist/signal/monitor/event-handler.js +3 -1
  462. package/dist/slack/accounts.js +6 -19
  463. package/dist/slack/actions.js +11 -3
  464. package/dist/slack/monitor/auth.js +1 -1
  465. package/dist/slack/monitor/message-handler/dispatch.js +50 -29
  466. package/dist/slack/monitor/replies.js +15 -7
  467. package/dist/slack/monitor/slash.js +22 -13
  468. package/dist/slack/resolve-channels.js +10 -5
  469. package/dist/slack/send.js +102 -12
  470. package/dist/slack/stream-mode.js +10 -0
  471. package/dist/slack/streaming.js +4 -2
  472. package/dist/telegram/accounts.js +19 -14
  473. package/dist/telegram/bot/helpers.js +3 -5
  474. package/dist/telegram/bot-access.js +35 -36
  475. package/dist/telegram/bot-handlers.js +120 -148
  476. package/dist/telegram/bot-message-context.js +68 -9
  477. package/dist/telegram/bot-message-dispatch.js +155 -90
  478. package/dist/telegram/bot-native-commands.js +16 -0
  479. package/dist/telegram/draft-stream.js +14 -1
  480. package/dist/telegram/inline-buttons.js +5 -15
  481. package/dist/telegram/monitor.js +11 -7
  482. package/dist/telegram/network-config.js +19 -7
  483. package/dist/telegram/send.js +3 -2
  484. package/dist/telegram/sent-message-cache.js +5 -6
  485. package/dist/telegram/status-reaction-variants.js +208 -0
  486. package/dist/telegram/sticker-cache.js +11 -9
  487. package/dist/terminal/theme.js +12 -12
  488. package/dist/tts/tts.js +80 -567
  489. package/dist/tui/components/chat-log.js +41 -8
  490. package/dist/tui/theme/theme.js +10 -12
  491. package/dist/tui/tui-local-shell.js +16 -6
  492. package/dist/tui/tui.js +58 -6
  493. package/dist/utils/account-id.js +2 -4
  494. package/dist/utils/boolean.js +10 -5
  495. package/dist/utils/directive-tags.js +11 -0
  496. package/dist/utils/queue-helpers.js +67 -12
  497. package/dist/web/auto-reply/deliver-reply.js +8 -4
  498. package/dist/web/auto-reply/mentions.js +10 -5
  499. package/dist/web/auto-reply/monitor/group-members.js +14 -7
  500. package/dist/web/auto-reply/monitor/process-message.js +45 -24
  501. package/dist/web/inbound/access-control.js +5 -2
  502. package/dist/web/login-qr.js +12 -6
  503. package/dist/web/media.js +123 -16
  504. package/extensions/bluebubbles/src/monitor-processing.ts +580 -139
  505. package/extensions/bluebubbles/src/monitor.ts +208 -1950
  506. package/package.json +1 -1
@@ -26,18 +26,28 @@ export const GEMINI_UNSUPPORTED_SCHEMA_KEYWORDS = new Set([
26
26
  "minProperties",
27
27
  "maxProperties",
28
28
  ]);
29
+ const SCHEMA_META_KEYS = ["description", "title", "default"];
30
+ function copySchemaMeta(from, to) {
31
+ for (const key of SCHEMA_META_KEYS) {
32
+ if (key in from && from[key] !== undefined) {
33
+ to[key] = from[key];
34
+ }
35
+ }
36
+ }
29
37
  // Check if an anyOf/oneOf array contains only literal values that can be flattened.
30
38
  // TypeBox Type.Literal generates { const: "value", type: "string" }.
31
39
  // Some schemas may use { enum: ["value"], type: "string" }.
32
40
  // Both patterns are flattened to { type: "string", enum: ["a", "b", ...] }.
33
41
  function tryFlattenLiteralAnyOf(variants) {
34
- if (variants.length === 0)
42
+ if (variants.length === 0) {
35
43
  return null;
44
+ }
36
45
  const allValues = [];
37
46
  let commonType = null;
38
47
  for (const variant of variants) {
39
- if (!variant || typeof variant !== "object")
48
+ if (!variant || typeof variant !== "object") {
40
49
  return null;
50
+ }
41
51
  const v = variant;
42
52
  let literalValue;
43
53
  if ("const" in v) {
@@ -50,16 +60,20 @@ function tryFlattenLiteralAnyOf(variants) {
50
60
  return null;
51
61
  }
52
62
  const variantType = typeof v.type === "string" ? v.type : null;
53
- if (!variantType)
63
+ if (!variantType) {
54
64
  return null;
55
- if (commonType === null)
65
+ }
66
+ if (commonType === null) {
56
67
  commonType = variantType;
57
- else if (commonType !== variantType)
68
+ }
69
+ else if (commonType !== variantType) {
58
70
  return null;
71
+ }
59
72
  allValues.push(literalValue);
60
73
  }
61
- if (commonType && allValues.length > 0)
74
+ if (commonType && allValues.length > 0) {
62
75
  return { type: commonType, enum: allValues };
76
+ }
63
77
  return null;
64
78
  }
65
79
  function isNullSchema(variant) {
@@ -67,22 +81,25 @@ function isNullSchema(variant) {
67
81
  return false;
68
82
  }
69
83
  const record = variant;
70
- if ("const" in record && record.const === null)
84
+ if ("const" in record && record.const === null) {
71
85
  return true;
86
+ }
72
87
  if (Array.isArray(record.enum) && record.enum.length === 1) {
73
88
  return record.enum[0] === null;
74
89
  }
75
90
  const typeValue = record.type;
76
- if (typeValue === "null")
91
+ if (typeValue === "null") {
77
92
  return true;
93
+ }
78
94
  if (Array.isArray(typeValue) && typeValue.length === 1 && typeValue[0] === "null") {
79
95
  return true;
80
96
  }
81
97
  return false;
82
98
  }
83
99
  function stripNullVariants(variants) {
84
- if (variants.length === 0)
100
+ if (variants.length === 0) {
85
101
  return { variants, stripped: false };
102
+ }
86
103
  const nonNull = variants.filter((variant) => !isNullSchema(variant));
87
104
  return {
88
105
  variants: nonNull,
@@ -98,16 +115,19 @@ function extendSchemaDefs(defs, schema) {
98
115
  !Array.isArray(schema.definitions)
99
116
  ? schema.definitions
100
117
  : undefined;
101
- if (!defsEntry && !legacyDefsEntry)
118
+ if (!defsEntry && !legacyDefsEntry) {
102
119
  return defs;
120
+ }
103
121
  const next = defs ? new Map(defs) : new Map();
104
122
  if (defsEntry) {
105
- for (const [key, value] of Object.entries(defsEntry))
123
+ for (const [key, value] of Object.entries(defsEntry)) {
106
124
  next.set(key, value);
125
+ }
107
126
  }
108
127
  if (legacyDefsEntry) {
109
- for (const [key, value] of Object.entries(legacyDefsEntry))
128
+ for (const [key, value] of Object.entries(legacyDefsEntry)) {
110
129
  next.set(key, value);
130
+ }
111
131
  }
112
132
  return next;
113
133
  }
@@ -115,19 +135,48 @@ function decodeJsonPointerSegment(segment) {
115
135
  return segment.replaceAll("~1", "/").replaceAll("~0", "~");
116
136
  }
117
137
  function tryResolveLocalRef(ref, defs) {
118
- if (!defs)
138
+ if (!defs) {
119
139
  return undefined;
140
+ }
120
141
  const match = ref.match(/^#\/(?:\$defs|definitions)\/(.+)$/);
121
- if (!match)
142
+ if (!match) {
122
143
  return undefined;
144
+ }
123
145
  const name = decodeJsonPointerSegment(match[1] ?? "");
124
- if (!name)
146
+ if (!name) {
125
147
  return undefined;
148
+ }
126
149
  return defs.get(name);
127
150
  }
151
+ function simplifyUnionVariants(params) {
152
+ const { obj, variants } = params;
153
+ const { variants: nonNullVariants, stripped } = stripNullVariants(variants);
154
+ const flattened = tryFlattenLiteralAnyOf(nonNullVariants);
155
+ if (flattened) {
156
+ const result = {
157
+ type: flattened.type,
158
+ enum: flattened.enum,
159
+ };
160
+ copySchemaMeta(obj, result);
161
+ return { variants: nonNullVariants, simplified: result };
162
+ }
163
+ if (stripped && nonNullVariants.length === 1) {
164
+ const lone = nonNullVariants[0];
165
+ if (lone && typeof lone === "object" && !Array.isArray(lone)) {
166
+ const result = {
167
+ ...lone,
168
+ };
169
+ copySchemaMeta(obj, result);
170
+ return { variants: nonNullVariants, simplified: result };
171
+ }
172
+ return { variants: nonNullVariants, simplified: lone };
173
+ }
174
+ return { variants: stripped ? nonNullVariants : variants };
175
+ }
128
176
  function cleanSchemaForGeminiWithDefs(schema, defs, refStack) {
129
- if (!schema || typeof schema !== "object")
177
+ if (!schema || typeof schema !== "object") {
130
178
  return schema;
179
+ }
131
180
  if (Array.isArray(schema)) {
132
181
  return schema.map((item) => cleanSchemaForGeminiWithDefs(item, defs, refStack));
133
182
  }
@@ -135,8 +184,9 @@ function cleanSchemaForGeminiWithDefs(schema, defs, refStack) {
135
184
  const nextDefs = extendSchemaDefs(defs, obj);
136
185
  const refValue = typeof obj.$ref === "string" ? obj.$ref : undefined;
137
186
  if (refValue) {
138
- if (refStack?.has(refValue))
187
+ if (refStack?.has(refValue)) {
139
188
  return {};
189
+ }
140
190
  const resolved = tryResolveLocalRef(refValue, nextDefs);
141
191
  if (resolved) {
142
192
  const nextRefStack = refStack ? new Set(refStack) : new Set();
@@ -148,17 +198,11 @@ function cleanSchemaForGeminiWithDefs(schema, defs, refStack) {
148
198
  const result = {
149
199
  ...cleaned,
150
200
  };
151
- for (const key of ["description", "title", "default"]) {
152
- if (key in obj && obj[key] !== undefined)
153
- result[key] = obj[key];
154
- }
201
+ copySchemaMeta(obj, result);
155
202
  return result;
156
203
  }
157
204
  const result = {};
158
- for (const key of ["description", "title", "default"]) {
159
- if (key in obj && obj[key] !== undefined)
160
- result[key] = obj[key];
161
- }
205
+ copySchemaMeta(obj, result);
162
206
  return result;
163
207
  }
164
208
  const hasAnyOf = "anyOf" in obj && Array.isArray(obj.anyOf);
@@ -170,77 +214,31 @@ function cleanSchemaForGeminiWithDefs(schema, defs, refStack) {
170
214
  ? obj.oneOf.map((variant) => cleanSchemaForGeminiWithDefs(variant, nextDefs, refStack))
171
215
  : undefined;
172
216
  if (hasAnyOf) {
173
- const { variants: nonNullVariants, stripped } = stripNullVariants(cleanedAnyOf ?? []);
174
- if (stripped)
175
- cleanedAnyOf = nonNullVariants;
176
- const flattened = tryFlattenLiteralAnyOf(nonNullVariants);
177
- if (flattened) {
178
- const result = {
179
- type: flattened.type,
180
- enum: flattened.enum,
181
- };
182
- for (const key of ["description", "title", "default"]) {
183
- if (key in obj && obj[key] !== undefined)
184
- result[key] = obj[key];
185
- }
186
- return result;
187
- }
188
- if (stripped && nonNullVariants.length === 1) {
189
- const lone = nonNullVariants[0];
190
- if (lone && typeof lone === "object" && !Array.isArray(lone)) {
191
- const result = {
192
- ...lone,
193
- };
194
- for (const key of ["description", "title", "default"]) {
195
- if (key in obj && obj[key] !== undefined)
196
- result[key] = obj[key];
197
- }
198
- return result;
199
- }
200
- return lone;
217
+ const simplified = simplifyUnionVariants({ obj, variants: cleanedAnyOf ?? [] });
218
+ cleanedAnyOf = simplified.variants;
219
+ if ("simplified" in simplified) {
220
+ return simplified.simplified;
201
221
  }
202
222
  }
203
223
  if (hasOneOf) {
204
- const { variants: nonNullVariants, stripped } = stripNullVariants(cleanedOneOf ?? []);
205
- if (stripped)
206
- cleanedOneOf = nonNullVariants;
207
- const flattened = tryFlattenLiteralAnyOf(nonNullVariants);
208
- if (flattened) {
209
- const result = {
210
- type: flattened.type,
211
- enum: flattened.enum,
212
- };
213
- for (const key of ["description", "title", "default"]) {
214
- if (key in obj && obj[key] !== undefined)
215
- result[key] = obj[key];
216
- }
217
- return result;
218
- }
219
- if (stripped && nonNullVariants.length === 1) {
220
- const lone = nonNullVariants[0];
221
- if (lone && typeof lone === "object" && !Array.isArray(lone)) {
222
- const result = {
223
- ...lone,
224
- };
225
- for (const key of ["description", "title", "default"]) {
226
- if (key in obj && obj[key] !== undefined)
227
- result[key] = obj[key];
228
- }
229
- return result;
230
- }
231
- return lone;
224
+ const simplified = simplifyUnionVariants({ obj, variants: cleanedOneOf ?? [] });
225
+ cleanedOneOf = simplified.variants;
226
+ if ("simplified" in simplified) {
227
+ return simplified.simplified;
232
228
  }
233
229
  }
234
230
  const cleaned = {};
235
231
  for (const [key, value] of Object.entries(obj)) {
236
- if (GEMINI_UNSUPPORTED_SCHEMA_KEYWORDS.has(key))
232
+ if (GEMINI_UNSUPPORTED_SCHEMA_KEYWORDS.has(key)) {
237
233
  continue;
234
+ }
238
235
  if (key === "const") {
239
236
  cleaned.enum = [value];
240
237
  continue;
241
238
  }
242
- if (key === "type" && (hasAnyOf || hasOneOf))
239
+ if (key === "type" && (hasAnyOf || hasOneOf)) {
243
240
  continue;
241
+ }
244
242
  if (key === "type" &&
245
243
  Array.isArray(value) &&
246
244
  value.every((entry) => typeof entry === "string")) {
@@ -283,13 +281,62 @@ function cleanSchemaForGeminiWithDefs(schema, defs, refStack) {
283
281
  cleaned[key] = value;
284
282
  }
285
283
  }
284
+ // Cloud Code Assist API rejects anyOf/oneOf in nested schemas even after
285
+ // simplifyUnionVariants runs above. Flatten remaining unions as a fallback:
286
+ // pick the common type or use the first variant's type so the tool
287
+ // declaration is accepted by Google's validation layer.
288
+ if (cleaned.anyOf && Array.isArray(cleaned.anyOf)) {
289
+ const flattened = flattenUnionFallback(cleaned, cleaned.anyOf);
290
+ if (flattened) {
291
+ return flattened;
292
+ }
293
+ }
294
+ if (cleaned.oneOf && Array.isArray(cleaned.oneOf)) {
295
+ const flattened = flattenUnionFallback(cleaned, cleaned.oneOf);
296
+ if (flattened) {
297
+ return flattened;
298
+ }
299
+ }
286
300
  return cleaned;
287
301
  }
302
+ /**
303
+ * Last-resort flattening for anyOf/oneOf arrays that could not be simplified
304
+ * by `simplifyUnionVariants`. Picks a representative type so the schema is
305
+ * accepted by Google's restricted JSON Schema validation.
306
+ */
307
+ function flattenUnionFallback(obj, variants) {
308
+ const objects = variants.filter((v) => !!v && typeof v === "object");
309
+ if (objects.length === 0) {
310
+ return undefined;
311
+ }
312
+ const types = new Set(objects.map((v) => v.type).filter(Boolean));
313
+ if (objects.length === 1) {
314
+ const merged = { ...objects[0] };
315
+ copySchemaMeta(obj, merged);
316
+ return merged;
317
+ }
318
+ if (types.size === 1) {
319
+ const merged = { type: Array.from(types)[0] };
320
+ copySchemaMeta(obj, merged);
321
+ return merged;
322
+ }
323
+ const first = objects[0];
324
+ if (first?.type) {
325
+ const merged = { type: first.type };
326
+ copySchemaMeta(obj, merged);
327
+ return merged;
328
+ }
329
+ const merged = {};
330
+ copySchemaMeta(obj, merged);
331
+ return merged;
332
+ }
288
333
  export function cleanSchemaForGemini(schema) {
289
- if (!schema || typeof schema !== "object")
334
+ if (!schema || typeof schema !== "object") {
290
335
  return schema;
291
- if (Array.isArray(schema))
336
+ }
337
+ if (Array.isArray(schema)) {
292
338
  return schema.map(cleanSchemaForGemini);
339
+ }
293
340
  const defs = extendSchemaDefs(undefined, schema);
294
341
  return cleanSchemaForGeminiWithDefs(schema, defs, undefined);
295
342
  }
@@ -103,30 +103,35 @@ function randomChoice(values, fallback) {
103
103
  }
104
104
  function createSlugBase(words = 2) {
105
105
  const parts = [randomChoice(SLUG_ADJECTIVES, "steady"), randomChoice(SLUG_NOUNS, "harbor")];
106
- if (words > 2)
106
+ if (words > 2) {
107
107
  parts.push(randomChoice(SLUG_NOUNS, "reef"));
108
+ }
108
109
  return parts.join("-");
109
110
  }
110
111
  export function createSessionSlug(isTaken) {
111
112
  const isIdTaken = isTaken ?? (() => false);
112
113
  for (let attempt = 0; attempt < 12; attempt += 1) {
113
114
  const base = createSlugBase(2);
114
- if (!isIdTaken(base))
115
+ if (!isIdTaken(base)) {
115
116
  return base;
117
+ }
116
118
  for (let i = 2; i <= 12; i += 1) {
117
119
  const candidate = `${base}-${i}`;
118
- if (!isIdTaken(candidate))
120
+ if (!isIdTaken(candidate)) {
119
121
  return candidate;
122
+ }
120
123
  }
121
124
  }
122
125
  for (let attempt = 0; attempt < 12; attempt += 1) {
123
126
  const base = createSlugBase(3);
124
- if (!isIdTaken(base))
127
+ if (!isIdTaken(base)) {
125
128
  return base;
129
+ }
126
130
  for (let i = 2; i <= 12; i += 1) {
127
131
  const candidate = `${base}-${i}`;
128
- if (!isIdTaken(candidate))
132
+ if (!isIdTaken(candidate)) {
129
133
  return candidate;
134
+ }
130
135
  }
131
136
  }
132
137
  const fallback = `${createSlugBase(3)}-${Math.random().toString(36).slice(2, 5)}`;
@@ -39,6 +39,7 @@ export function guardSessionManager(sessionManager, opts) {
39
39
  transformMessageForPersistence: (message) => applyInputProvenanceToUserMessage(message, opts?.inputProvenance),
40
40
  transformToolResultForPersistence: transform,
41
41
  allowSyntheticToolResults: opts?.allowSyntheticToolResults,
42
+ allowedToolNames: opts?.allowedToolNames,
42
43
  beforeMessageWriteHook: beforeMessageWrite,
43
44
  });
44
45
  sessionManager.flushPendingToolResults = guard.flushPendingToolResults;
@@ -111,7 +111,9 @@ export function installSessionToolResultGuard(sessionManager, opts) {
111
111
  let nextMessage = message;
112
112
  const role = message.role;
113
113
  if (role === "assistant") {
114
- const sanitized = sanitizeToolCallInputs([message]);
114
+ const sanitized = sanitizeToolCallInputs([message], {
115
+ allowedToolNames: opts?.allowedToolNames,
116
+ });
115
117
  if (sanitized.length === 0) {
116
118
  if (allowSyntheticToolResults && pending.size > 0) {
117
119
  flushPendingToolResults();
@@ -1,4 +1,6 @@
1
1
  import { extractToolCallsFromAssistant, extractToolResultId } from "./tool-call-id.js";
2
+ const TOOL_CALL_NAME_MAX_CHARS = 64;
3
+ const TOOL_CALL_NAME_RE = /^[A-Za-z0-9_-]+$/;
2
4
  function isToolCallBlock(block) {
3
5
  if (!block || typeof block !== "object") {
4
6
  return false;
@@ -18,8 +20,37 @@ function hasNonEmptyStringField(value) {
18
20
  function hasToolCallId(block) {
19
21
  return hasNonEmptyStringField(block.id);
20
22
  }
21
- function hasToolCallName(block) {
22
- return hasNonEmptyStringField(block.name);
23
+ function normalizeAllowedToolNames(allowedToolNames) {
24
+ if (!allowedToolNames) {
25
+ return null;
26
+ }
27
+ const normalized = new Set();
28
+ for (const name of allowedToolNames) {
29
+ if (typeof name !== "string") {
30
+ continue;
31
+ }
32
+ const trimmed = name.trim();
33
+ if (trimmed) {
34
+ normalized.add(trimmed.toLowerCase());
35
+ }
36
+ }
37
+ return normalized.size > 0 ? normalized : null;
38
+ }
39
+ function hasToolCallName(block, allowedToolNames) {
40
+ if (typeof block.name !== "string") {
41
+ return false;
42
+ }
43
+ const trimmed = block.name.trim();
44
+ if (!trimmed || trimmed !== block.name) {
45
+ return false;
46
+ }
47
+ if (trimmed.length > TOOL_CALL_NAME_MAX_CHARS || !TOOL_CALL_NAME_RE.test(trimmed)) {
48
+ return false;
49
+ }
50
+ if (!allowedToolNames) {
51
+ return true;
52
+ }
53
+ return allowedToolNames.has(trimmed.toLowerCase());
23
54
  }
24
55
  function makeMissingToolResult(params) {
25
56
  return {
@@ -55,11 +86,12 @@ export function stripToolResultDetails(messages) {
55
86
  }
56
87
  return touched ? out : messages;
57
88
  }
58
- export function repairToolCallInputs(messages) {
89
+ export function repairToolCallInputs(messages, options) {
59
90
  let droppedToolCalls = 0;
60
91
  let droppedAssistantMessages = 0;
61
92
  let changed = false;
62
93
  const out = [];
94
+ const allowedToolNames = normalizeAllowedToolNames(options?.allowedToolNames);
63
95
  for (const msg of messages) {
64
96
  if (!msg || typeof msg !== "object") {
65
97
  out.push(msg);
@@ -73,7 +105,9 @@ export function repairToolCallInputs(messages) {
73
105
  let droppedInMessage = 0;
74
106
  for (const block of msg.content) {
75
107
  if (isToolCallBlock(block) &&
76
- (!hasToolCallInput(block) || !hasToolCallId(block) || !hasToolCallName(block))) {
108
+ (!hasToolCallInput(block) ||
109
+ !hasToolCallId(block) ||
110
+ !hasToolCallName(block, allowedToolNames))) {
77
111
  droppedToolCalls += 1;
78
112
  droppedInMessage += 1;
79
113
  changed = true;
@@ -98,8 +132,8 @@ export function repairToolCallInputs(messages) {
98
132
  droppedAssistantMessages,
99
133
  };
100
134
  }
101
- export function sanitizeToolCallInputs(messages) {
102
- return repairToolCallInputs(messages).messages;
135
+ export function sanitizeToolCallInputs(messages, options) {
136
+ return repairToolCallInputs(messages, options).messages;
103
137
  }
104
138
  export function sanitizeToolUseResultPairing(messages) {
105
139
  return repairToolUseResultPairing(messages).messages;
@@ -1,6 +1,7 @@
1
1
  import fs from "node:fs";
2
2
  import path from "node:path";
3
3
  import { fileURLToPath } from "node:url";
4
+ import { resolvePoolBotPackageRootSync } from "../../infra/poolbot-root.js";
4
5
  function looksLikeSkillsDir(dir) {
5
6
  try {
6
7
  const entries = fs.readdirSync(dir, { withFileTypes: true });
@@ -25,17 +26,18 @@ function looksLikeSkillsDir(dir) {
25
26
  return false;
26
27
  }
27
28
  export function resolveBundledSkillsDir(opts = {}) {
28
- const override = process.env.POOLBOT_BUNDLED_SKILLS_DIR?.trim() ||
29
- process.env.CLAWDBOT_BUNDLED_SKILLS_DIR?.trim();
30
- if (override)
29
+ const override = process.env.POOLBOT_BUNDLED_SKILLS_DIR?.trim();
30
+ if (override) {
31
31
  return override;
32
+ }
32
33
  // bun --compile: ship a sibling `skills/` next to the executable.
33
34
  try {
34
35
  const execPath = opts.execPath ?? process.execPath;
35
36
  const execDir = path.dirname(execPath);
36
37
  const sibling = path.join(execDir, "skills");
37
- if (fs.existsSync(sibling))
38
+ if (fs.existsSync(sibling)) {
38
39
  return sibling;
40
+ }
39
41
  }
40
42
  catch {
41
43
  // ignore
@@ -44,7 +46,19 @@ export function resolveBundledSkillsDir(opts = {}) {
44
46
  try {
45
47
  const moduleUrl = opts.moduleUrl ?? import.meta.url;
46
48
  const moduleDir = path.dirname(fileURLToPath(moduleUrl));
47
- // Walk up from this module to find the package root containing skills/
49
+ const argv1 = opts.argv1 ?? process.argv[1];
50
+ const cwd = opts.cwd ?? process.cwd();
51
+ const packageRoot = resolvePoolBotPackageRootSync({
52
+ argv1,
53
+ moduleUrl,
54
+ cwd,
55
+ });
56
+ if (packageRoot) {
57
+ const candidate = path.join(packageRoot, "skills");
58
+ if (looksLikeSkillsDir(candidate)) {
59
+ return candidate;
60
+ }
61
+ }
48
62
  let current = moduleDir;
49
63
  for (let depth = 0; depth < 6; depth += 1) {
50
64
  const candidate = path.join(current, "skills");