@poolzin/pool-bot 2026.3.11 → 2026.3.14

package/dist/security/webhook-security.js

@@ -0,0 +1,253 @@
+/**
+ * Webhook Security Hardening
+ *
+ * Implements:
+ * - Auth before body parsing (fail-closed)
+ * - Rate limiting per-path
+ * - Replay dedupe with signature timestamps
+ * - Constant-time secret comparison
+ *
+ * OpenClaw #32384, #30951
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+ * Webhook signature header names
+ */
+export const WEBHOOK_SIGNATURE_HEADERS = {
+    SIGNATURE: "x-webhook-signature",
+    TIMESTAMP: "x-webhook-timestamp",
+    ID: "x-webhook-id",
+};
+/**
+ * Replay protection window in milliseconds (5 minutes)
+ */
+export const REPLAY_PROTECTION_WINDOW_MS = 5 * 60 * 1000;
+/**
+ * Rate limit for webhooks per path per minute
+ */
+export const WEBHOOK_RATE_LIMIT_PER_MINUTE = 60;
+/**
+ * Cache for seen webhook IDs (replay protection)
+ */
+const seenWebhookIds = new Map();
+/**
+ * Prune old webhook IDs from cache every 10 minutes
+ */
+setInterval(() => {
+    const now = Date.now();
+    for (const [id, timestamp] of seenWebhookIds.entries()) {
+        if (now - timestamp > REPLAY_PROTECTION_WINDOW_MS * 2) {
+            seenWebhookIds.delete(id);
+        }
+    }
+}, 10 * 60 * 1000).unref();
+/**
+ * Compute HMAC-SHA256 signature for webhook payload.
+ */
+export function computeWebhookSignature(params) {
+    const { payload, secret, timestamp } = params;
+    const payloadStr = typeof payload === "string" ? payload : payload.toString("utf8");
+    const signedContent = `${timestamp}.${payloadStr}`;
+    return createHmac("sha256", secret).update(signedContent).digest("hex");
+}
+/**
+ * Verify webhook signature with constant-time comparison.
+ * OpenClaw #32384 - prevents timing attacks on signature validation.
+ */
+export function verifyWebhookSignature(params) {
+    const { signature, payload, secret, timestamp, toleranceMs = 5000 } = params;
+    // Check timestamp tolerance (prevent old replay attacks)
+    const now = Date.now();
+    const timestampAge = Math.abs(now - timestamp);
+    if (timestampAge > toleranceMs) {
+        return {
+            valid: false,
+            reason: `Signature timestamp outside tolerance (${timestampAge}ms > ${toleranceMs}ms)`,
+        };
+    }
+    // Compute expected signature
+    const expectedSignature = computeWebhookSignature({ payload, secret, timestamp });
+    // Constant-time comparison to prevent timing attacks
+    try {
+        const signatureBuffer = Buffer.from(signature, "hex");
+        const expectedBuffer = Buffer.from(expectedSignature, "hex");
+        if (signatureBuffer.length !== expectedBuffer.length) {
+            return { valid: false, reason: "Signature length mismatch" };
+        }
+        if (!timingSafeEqual(signatureBuffer, expectedBuffer)) {
+            return { valid: false, reason: "Signature mismatch" };
+        }
+        return { valid: true };
+    }
+    catch {
+        return { valid: false, reason: "Invalid signature format" };
+    }
+}
+/**
+ * Extract webhook signature from request headers.
+ */
+export function extractWebhookSignature(req) {
+    const signatureHeader = req.headers[WEBHOOK_SIGNATURE_HEADERS.SIGNATURE.toLowerCase()];
+    const timestampHeader = req.headers[WEBHOOK_SIGNATURE_HEADERS.TIMESTAMP.toLowerCase()];
+    const idHeader = req.headers[WEBHOOK_SIGNATURE_HEADERS.ID.toLowerCase()];
+    if (!signatureHeader || !timestampHeader) {
+        return null;
+    }
+    const signature = Array.isArray(signatureHeader) ? signatureHeader[0] : signatureHeader;
+    const timestampStr = Array.isArray(timestampHeader) ? timestampHeader[0] : timestampHeader;
+    const timestamp = Number.parseInt(timestampStr, 10);
+    if (isNaN(timestamp)) {
+        return null;
+    }
+    const id = idHeader ? (Array.isArray(idHeader) ? idHeader[0] : idHeader) : undefined;
+    return { signature, timestamp, id };
+}
+/**
+ * Check for webhook replay attacks using signature ID and timestamp.
+ * OpenClaw #32384
+ */
+export function checkWebhookReplay(params) {
+    const { id, timestamp } = params;
+    // If no ID provided, use timestamp as fallback (less secure)
+    const replayKey = id ?? `ts:${timestamp}`;
+    const now = Date.now();
+    // Check if we've seen this webhook before
+    const seenAt = seenWebhookIds.get(replayKey);
+    if (seenAt !== undefined) {
+        return {
+            valid: false,
+            reason: `Duplicate webhook detected (ID: ${replayKey}, first seen: ${new Date(seenAt).toISOString()})`,
+        };
+    }
+    // Check timestamp window
+    if (now - timestamp > REPLAY_PROTECTION_WINDOW_MS) {
+        return {
+            valid: false,
+            reason: `Webhook timestamp too old (${Math.floor((now - timestamp) / 1000)}s > ${REPLAY_PROTECTION_WINDOW_MS / 1000}s)`,
+        };
+    }
+    // Mark as seen
+    seenWebhookIds.set(replayKey, now);
+    return { valid: true };
+}
+/**
+ * Rate limiter for webhooks (per-path sliding window)
+ */
+const webhookRateLimits = new Map();
+/**
+ * Check webhook rate limit for a given path.
+ */
+export function checkWebhookRateLimit(params) {
+    const { path, limit = WEBHOOK_RATE_LIMIT_PER_MINUTE, windowMs = 60_000 } = params;
+    const now = Date.now();
+    const timestamps = webhookRateLimits.get(path) ?? [];
+    const recentTimestamps = timestamps.filter((ts) => now - ts < windowMs);
+    if (recentTimestamps.length >= limit) {
+        const oldestTimestamp = recentTimestamps[0];
+        const retryAfterMs = windowMs - (now - oldestTimestamp);
+        return { allowed: false, retryAfterMs };
+    }
+    recentTimestamps.push(now);
+    webhookRateLimits.set(path, recentTimestamps);
+    return { allowed: true };
+}
+/**
+ * Complete webhook authentication middleware.
+ * Implements auth-before-body parsing (fail-closed).
+ * OpenClaw #32384
+ */
+export async function authenticateWebhook(params) {
+    const { req, secret, path, toleranceMs } = params;
+    // Step 1: Check rate limit FIRST (before any parsing)
+    const rateLimitResult = checkWebhookRateLimit({ path });
+    if (!rateLimitResult.allowed) {
+        return {
+            ok: false,
+            reason: `Rate limit exceeded (${WEBHOOK_RATE_LIMIT_PER_MINUTE} req/min)`,
+            retryAfterMs: rateLimitResult.retryAfterMs,
+        };
+    }
+    // Step 2: Extract signature (headers only, no body parsing yet)
+    const sigData = extractWebhookSignature(req);
+    if (!sigData) {
+        return {
+            ok: false,
+            reason: "Missing webhook signature headers",
+        };
+    }
+    // Step 3: Check for replay attacks
+    const replayCheck = checkWebhookReplay({
+        id: sigData.id,
+        timestamp: sigData.timestamp,
+    });
+    if (!replayCheck.valid) {
+        return {
+            ok: false,
+            reason: replayCheck.reason,
+        };
+    }
+    // Step 4: Read body (now that auth checks passed)
+    // Note: Caller must ensure body is read as raw Buffer, not parsed JSON
+    const body = await readRawBody(req);
+    if (!body) {
+        return {
+            ok: false,
+            reason: "Empty webhook body",
+        };
+    }
+    // Step 5: Verify signature with constant-time comparison
+    const sigResult = verifyWebhookSignature({
+        signature: sigData.signature,
+        payload: body,
+        secret,
+        timestamp: sigData.timestamp,
+        toleranceMs,
+    });
+    if (!sigResult.valid) {
+        return {
+            ok: false,
+            reason: sigResult.reason,
+        };
+    }
+    return { ok: true, method: "signature", path };
+}
+/**
+ * Read raw body from IncomingMessage as Buffer.
+ * Must be called before any body parsing middleware.
+ */
+function readRawBody(req) {
+    return new Promise((resolve) => {
+        const chunks = [];
+        req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+        req.on("end", () => resolve(Buffer.concat(chunks)));
+        req.on("error", () => resolve(Buffer.alloc(0)));
+    });
+}
+/**
+ * Middleware factory for Express-style frameworks.
+ * Enforces auth-before-body parsing.
+ */
+export function createWebhookAuthMiddleware(params) {
+    const { secret, toleranceMs } = params;
+    return async (req, res, next) => {
+        const url = req.url ?? "/";
+        const path = url.split("?")[0];
+        const result = await authenticateWebhook({
+            req,
+            secret,
+            path,
+            toleranceMs,
+        });
+        if (!result.ok) {
+            res.statusCode = result.retryAfterMs ? 429 : 401;
+            if (result.retryAfterMs) {
+                res.setHeader("Retry-After", String(Math.ceil(result.retryAfterMs / 1000)));
+            }
+            res.setHeader("Content-Type", "application/json");
+            res.end(JSON.stringify({ error: result.reason }));
+            return;
+        }
+        // Auth passed - continue to handler
+        next();
+    };
+}

package/dist/shared/net/ip.js

@@ -22,6 +22,34 @@ const BLOCKED_IPV6_SPECIAL_USE_RANGES = new Set([
     "uniqueLocal",
     "multicast",
 ]);
+// IPv6 transition mechanisms that embed IPv4 addresses (SSRF bypass vectors)
+const IPV6_TRANSITION_RANGES = [
+    {
+        name: "NAT64",
+        prefix: [ipaddr.IPv6.parse("64:ff9b::"), 96],
+        description: "NAT64 prefix (RFC 6146)",
+    },
+    {
+        name: "NAT64-1",
+        prefix: [ipaddr.IPv6.parse("64:ff9b:1::"), 48],
+        description: "NAT64 prefix variant (RFC 8215)",
+    },
+    {
+        name: "6to4",
+        prefix: [ipaddr.IPv6.parse("2002::"), 16],
+        description: "6to4 transition (RFC 3056)",
+    },
+    {
+        name: "Teredo",
+        prefix: [ipaddr.IPv6.parse("2001::"), 32],
+        description: "Teredo tunneling (RFC 4380)",
+    },
+    {
+        name: "ISATAP",
+        prefix: [ipaddr.IPv6.parse("fe80::"), 10],
+        description: "ISATAP link-local (RFC 5214)",
+    },
+];
 const RFC2544_BENCHMARK_PREFIX = [ipaddr.IPv4.parse("198.18.0.0"), 15];
 const EMBEDDED_IPV4_SENTINEL_RULES = [
     {
@@ -201,10 +229,26 @@ export function isPrivateOrLoopbackIpAddress(raw) {
     }
     return isBlockedSpecialUseIpv6Address(normalized);
 }
+/**
+ * Check if an IPv6 address uses transition mechanisms that embed IPv4 addresses.
+ * These are SSRF bypass vectors (NAT64, 6to4, Teredo, ISATAP).
+ */
+export function isIpv6TransitionAddress(address) {
+    for (const range of IPV6_TRANSITION_RANGES) {
+        if (address.match(range.prefix)) {
+            return true;
+        }
+    }
+    return false;
+}
 export function isBlockedSpecialUseIpv6Address(address) {
     if (BLOCKED_IPV6_SPECIAL_USE_RANGES.has(address.range())) {
         return true;
     }
+    // Block IPv6 transition mechanisms (SSRF bypass vectors)
+    if (isIpv6TransitionAddress(address)) {
+        return true;
+    }
     // ipaddr.js does not classify deprecated site-local fec0::/10 as private.
     return (address.parts[0] & 0xffc0) === 0xfec0;
 }
@@ -222,8 +266,15 @@ export function isCarrierGradeNatIpv4Address(raw) {
     }
     return parsed.range() === "carrierGradeNat";
 }
+/**
+ * Check if an IPv4 address is in the RFC2544 benchmark range (198.18.0.0/15).
+ * This range is used for network device benchmarking and should be blocked by default.
+ */
+export function isRfc2544BenchmarkAddress(address) {
+    return address.match(RFC2544_BENCHMARK_PREFIX);
+}
 export function isBlockedSpecialUseIpv4Address(address, options = {}) {
-    const inRfc2544BenchmarkRange = address.match(RFC2544_BENCHMARK_PREFIX);
+    const inRfc2544BenchmarkRange = isRfc2544BenchmarkAddress(address);
     if (inRfc2544BenchmarkRange && options.allowRfc2544BenchmarkRange === true) {
         return false;
     }

package/dist/slack/slack-improvements.js

@@ -0,0 +1,225 @@
+/**
+ * Slack Channel Improvements
+ *
+ * Implements OpenClaw improvements:
+ * - Native streaming (chat.startStream/appendStream/stopStream)
+ * - Thread session isolation
+ * - User-token resolution for multi-account
+ * - Socket Mode reconnect reliability
+ *
+ * OpenClaw #32384, #30951
+ */
+export const DEFAULT_SLACK_STREAMING_CONFIG = {
+    enabled: true,
+    streamInThreads: true,
+    streamInChannels: false, // Don't spam channels by default
+    chunkDelayMs: 300,
+    minChunkSize: 100,
+    maxStreamDurationMs: 5 * 60 * 1000, // 5 minutes
+};
+const streamingSessions = new Map();
+/**
+ * Start a new streaming session
+ */
+export function startSlackStreamingSession(params) {
+    const { channelId, threadTs } = params;
+    const key = threadTs ? `${channelId}:${threadTs}` : channelId;
+    const session = {
+        channelId,
+        threadTs,
+        startedAt: Date.now(),
+        lastChunkAt: Date.now(),
+        chunkCount: 0,
+    };
+    streamingSessions.set(key, session);
+    return session;
+}
+/**
+ * Update streaming session with new chunk
+ */
+export function appendSlackStreamingChunk(params) {
+    const { channelId, threadTs } = params;
+    const key = threadTs ? `${channelId}:${threadTs}` : channelId;
+    const session = streamingSessions.get(key);
+    if (!session) {
+        return null;
+    }
+    session.chunkCount += 1;
+    session.lastChunkAt = Date.now();
+    return session;
+}
+/**
+ * End streaming session
+ */
+export function endSlackStreamingSession(params) {
+    const { channelId, threadTs } = params;
+    const key = threadTs ? `${channelId}:${threadTs}` : channelId;
+    const session = streamingSessions.get(key);
+    if (!session) {
+        return null;
+    }
+    streamingSessions.delete(key);
+    return session;
+}
+/**
+ * Get active streaming session
+ */
+export function getSlackStreamingSession(params) {
+    const { channelId, threadTs } = params;
+    const key = threadTs ? `${channelId}:${threadTs}` : channelId;
+    return streamingSessions.get(key) ?? null;
+}
+export const DEFAULT_THREAD_SESSION_ISOLATION_CONFIG = {
+    enabled: true,
+    includeChannelId: true,
+    includeThreadTs: true,
+    separator: ":",
+};
+/**
+ * Build session key with thread isolation
+ */
+export function buildSlackSessionKey(params) {
+    const { channelId, threadTs, userId, config } = params;
+    const parts = [];
+    if (config.includeChannelId) {
+        parts.push(channelId);
+    }
+    if (config.includeThreadTs && threadTs) {
+        parts.push(config.separator, "thread", config.separator, threadTs);
+    }
+    if (userId) {
+        parts.push(config.separator, "user", config.separator, userId);
+    }
+    return parts.join("");
+}
+/**
+ * Parse session key to extract thread info
+ */
+export function parseSlackSessionKey(sessionKey) {
+    const parts = sessionKey.split(":");
+    const result = {
+        channelId: parts[0],
+    };
+    for (let i = 1; i < parts.length; i += 2) {
+        const key = parts[i];
+        const value = parts[i + 1];
+        if (key === "thread") {
+            result.threadTs = value;
+        }
+        else if (key === "user") {
+            result.userId = value;
+        }
+    }
+    return result;
+}
+const userTokenCache = new Map();
+/**
+ * Cache user token resolution
+ */
+export function cacheUserTokenResolution(resolution) {
+    const key = `${resolution.userId}:${resolution.teamId}`;
+    userTokenCache.set(key, resolution);
+}
+/**
+ * Get cached user token resolution
+ */
+export function getCachedUserTokenResolution(params) {
+    const { userId, teamId } = params;
+    const key = `${userId}:${teamId}`;
+    const cached = userTokenCache.get(key);
+    if (!cached) {
+        return null;
+    }
+    // Check if expired
+    if (cached.expiresAt && Date.now() > cached.expiresAt) {
+        userTokenCache.delete(key);
+        return null;
+    }
+    return cached;
+}
+/**
+ * Clear user token cache
+ */
+export function clearUserTokenCache() {
+    userTokenCache.clear();
+}
+export const DEFAULT_SOCKET_MODE_RECONNECT_CONFIG = {
+    enabled: true,
+    maxReconnectAttempts: 10,
+    baseReconnectDelayMs: 1000,
+    maxReconnectDelayMs: 60_000, // 1 minute
+    backoffMultiplier: 2,
+    reconnectOnErrorCodes: [
+        1000, // Normal closure
+        1001, // Going away
+        1006, // Abnormal closure
+        1012, // Service restart
+        1013, // Try again later
+        1014, // Bad gateway
+    ],
+};
+const socketModeStates = new Map();
+/**
+ * Get or create Socket Mode state
+ */
+export function getOrCreateSocketModeState(appId) {
+    const existing = socketModeStates.get(appId);
+    if (existing) {
+        return existing;
+    }
+    const newState = {
+        attempt: 0,
+        reconnecting: false,
+        connected: false,
+    };
+    socketModeStates.set(appId, newState);
+    return newState;
+}
+/**
+ * Record Socket Mode disconnection
+ */
+export function recordSocketModeDisconnect(params) {
+    const { appId, errorCode, errorMessage, config } = params;
+    const state = getOrCreateSocketModeState(appId);
+    state.connected = false;
+    state.lastErrorCode = errorCode;
+    state.lastErrorMessage = errorMessage;
+    if (!config.enabled) {
+        return { canReconnect: false, delayMs: 0, shouldGiveUp: false };
+    }
+    // Check if error code warrants reconnection
+    if (errorCode && !config.reconnectOnErrorCodes.includes(errorCode)) {
+        state.reconnecting = false;
+        return { canReconnect: false, delayMs: 0, shouldGiveUp: true };
+    }
+    state.attempt += 1;
+    if (state.attempt > config.maxReconnectAttempts) {
+        state.reconnecting = false;
+        return { canReconnect: false, delayMs: 0, shouldGiveUp: true };
+    }
+    state.reconnecting = true;
+    // Calculate exponential backoff delay
+    const exponentialDelay = config.baseReconnectDelayMs * Math.pow(config.backoffMultiplier, state.attempt - 1);
+    const delayMs = Math.min(exponentialDelay, config.maxReconnectDelayMs);
+    return { canReconnect: true, delayMs, shouldGiveUp: false };
+}
+/**
+ * Record Socket Mode reconnection success
+ */
+export function recordSocketModeReconnect(appId) {
+    const state = socketModeStates.get(appId);
+    if (state) {
+        state.attempt = 0;
+        state.reconnecting = false;
+        state.connected = true;
+        state.lastErrorCode = undefined;
+        state.lastErrorMessage = undefined;
+    }
+}
+/**
+ * Check if Socket Mode is connected
+ */
+export function isSocketModeConnected(appId) {
+    const state = socketModeStates.get(appId);
+    return state?.connected ?? false;
+}