npm - @poolzin/pool-bot - Versions diffs - 2026.3.22 → 2026.3.24 - Mend

@poolzin/pool-bot 2026.3.22 → 2026.3.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (159) hide show

package/CHANGELOG.md +111 -0
package/dist/.buildstamp +1 -1
package/dist/acp/bindings-store.js +209 -0
package/dist/acp/control-plane/runtime-cache.js +54 -0
package/dist/acp/control-plane/runtime-options.js +215 -0
package/dist/acp/control-plane/session-actor-queue.js +36 -0
package/dist/acp/policy.js +52 -0
package/dist/acp/runtime/errors.js +47 -0
package/dist/acp/runtime/registry.js +86 -0
package/dist/acp/runtime/types.js +1 -0
package/dist/acp/translator.js +97 -0
package/dist/agents/btw.js +280 -0
package/dist/agents/failover-error.js +145 -47
package/dist/agents/fast-mode.js +24 -0
package/dist/agents/live-model-errors.js +23 -0
package/dist/agents/model-auth-env-vars.js +44 -0
package/dist/agents/model-auth-markers.js +69 -0
package/dist/agents/models-config.providers.discovery.js +180 -0
package/dist/agents/models-config.providers.static.js +480 -0
package/dist/auto-reply/reply/typing-policy.js +15 -0
package/dist/browser/browser-profile-manager.js +319 -0
package/dist/browser/cdp-proxy-bypass.js +129 -0
package/dist/browser/cdp-timeouts.js +41 -0
package/dist/browser/chrome-extension-validator.js +406 -0
package/dist/browser/chrome-mcp-snapshot.js +222 -0
package/dist/browser/chrome-mcp.js +421 -0
package/dist/browser/chrome-mcp.snapshot.js +133 -0
package/dist/browser/errors.js +67 -0
package/dist/browser/form-fields.js +22 -0
package/dist/browser/output-atomic.js +44 -0
package/dist/browser/profile-capabilities.js +47 -0
package/dist/browser/safe-filename.js +25 -0
package/dist/browser/snapshot-roles.js +60 -0
package/dist/build-info.json +3 -3
package/dist/channels/account-snapshot-fields.js +176 -0
package/dist/channels/draft-stream-controls.js +89 -0
package/dist/channels/inbound-debounce-policy.js +28 -0
package/dist/channels/typing-lifecycle.js +39 -0
package/dist/cli/program/command-registry.js +52 -0
package/dist/commands/agent-binding.js +123 -0
package/dist/commands/agents.commands.bind.js +280 -0
package/dist/commands/backup-shared.js +186 -0
package/dist/commands/backup-verify.js +236 -0
package/dist/commands/backup.js +166 -0
package/dist/commands/channel-account-context.js +15 -0
package/dist/commands/channel-account.js +190 -0
package/dist/commands/gateway-install-token.js +117 -0
package/dist/commands/oauth-tls-preflight.js +121 -0
package/dist/commands/ollama-setup.js +402 -0
package/dist/commands/security-owner-only.js +86 -0
package/dist/commands/self-hosted-provider-setup.js +207 -0
package/dist/commands/session-store-targets.js +12 -0
package/dist/commands/sessions-cleanup.js +97 -0
package/dist/control-ui/assets/{index-Dvkl4Xlx.js → index-D7shnQwQ.js} +404 -388
package/dist/control-ui/assets/index-D7shnQwQ.js.map +1 -0
package/dist/control-ui/index.html +1 -1
package/dist/cron/cron-filters.js +150 -0
package/dist/cron/heartbeat-policy.js +26 -0
package/dist/gateway/device-pairing-security.js +197 -0
package/dist/gateway/event-deduplication.js +167 -0
package/dist/gateway/hooks-mapping.js +46 -7
package/dist/gateway/run-tracker.js +253 -0
package/dist/gateway/server-methods/nodes.js +14 -0
package/dist/gateway/websocket-preauth-security.js +188 -0
package/dist/hooks/module-loader.js +28 -0
package/dist/infra/agent-command-binding.js +144 -0
package/dist/infra/backup.js +328 -0
package/dist/infra/channel-account-context.js +173 -0
package/dist/infra/errors.js +53 -13
package/dist/infra/exec-approvals-security.js +217 -0
package/dist/infra/security/command-analyzer.js +257 -0
package/dist/infra/session-cleanup.js +143 -0
package/dist/plugins/loader.js +16 -8
package/dist/security/external-content.js +51 -1
package/dist/sessions/session-costs.js +228 -0
package/dist/shared/param-key.js +16 -0
package/dist/shared/poll-params.js +58 -0
package/dist/shared/polls.js +55 -0
package/docs/DASHBOARD-GAP-ANALYSIS-AND-PLAN.md +430 -0
package/docs/FEATURES.md +523 -0
package/docs/FINAL-IMPLEMENTATION-REVIEW.md +274 -0
package/docs/FINAL-IMPLEMENTATION-SUMMARY.md +356 -0
package/docs/FINAL-PROFESSIONAL-EVALUATION.md +312 -0
package/docs/IMPLEMENTATION-PRIORITY-EVALUATION.md +298 -0
package/docs/IMPLEMENTATION-PROGRESS.md +237 -0
package/docs/IMPLEMENTATION-REVIEW-PHASE1-2.md +381 -0
package/docs/IMPLEMENTATION-REVIEW-PHASE4.md +389 -0
package/docs/IMPLEMENTATION-REVIEW-PHASE5.md +420 -0
package/docs/IMPLEMENTATION-REVIEW-PHASE6.md +422 -0
package/docs/IMPLEMENTATION-REVIEW-PHASE7-FINAL.md +184 -0
package/docs/MIKRODASH-ANALYSIS.md +412 -0
package/docs/OPENCLAW-GAP-ANALYSIS-FINAL.md +431 -0
package/docs/OPENCLAW-VS-POOLBOT-ANALYSIS.md +351 -0
package/docs/PHASE-7-SUMMARY.md +144 -0
package/docs/POOLBOT-OFFICE-PLAN.md +697 -0
package/docs/PROJECT-FINAL-STATUS.md +237 -0
package/docs/README.md +116 -0
package/docs/REAL-IMPROVEMENTS-EVALUATION.md +477 -0
package/docs/SECURITY-HARDENING-IMPLEMENTATION.md +161 -0
package/docs/channels/googlechat.md +235 -206
package/docs/channels/irc.md +332 -0
package/docs/channels/nostr.md +255 -168
package/docs/components/command-palette.md +166 -0
package/docs/components/login-gate.md +219 -0
package/docs/getting-started/installation.md +191 -0
package/docs/getting-started/introduction.md +120 -0
package/docs/improvements/USAGE-GUIDE.md +359 -0
package/docs/plans/2026-03-15-openclaw-features-implementation.md +1632 -0
package/docs/reference/deadcode-detection.md +72 -0
package/extensions/acpx/node_modules/.bin/acpx +21 -0
package/extensions/agency-agents/node_modules/.bin/vite +4 -4
package/extensions/agency-agents/node_modules/.bin/vitest +2 -2
package/extensions/googlechat/node_modules/.bin/tsc +21 -0
package/extensions/googlechat/node_modules/.bin/tsserver +21 -0
package/extensions/googlechat/node_modules/.bin/vitest +21 -0
package/extensions/googlechat/package.json +11 -28
package/extensions/googlechat/src/googlechat-channel.test.ts +60 -0
package/extensions/googlechat/src/googlechat-channel.ts +120 -0
package/extensions/googlechat/src/index.ts +14 -0
package/extensions/irc/node_modules/.bin/tsc +21 -0
package/extensions/irc/node_modules/.bin/tsserver +21 -0
package/extensions/irc/node_modules/.bin/vitest +21 -0
package/extensions/irc/package.json +16 -8
package/extensions/irc/src/index.ts +14 -0
package/extensions/irc/src/irc-channel.test.ts +43 -0
package/extensions/irc/src/irc-channel.ts +191 -0
package/extensions/keyed-async-queue/node_modules/.bin/tsc +21 -0
package/extensions/keyed-async-queue/node_modules/.bin/tsserver +21 -0
package/extensions/keyed-async-queue/node_modules/.bin/vitest +21 -0
package/extensions/keyed-async-queue/package.json +20 -0
package/extensions/keyed-async-queue/src/index.ts +14 -0
package/extensions/keyed-async-queue/src/queue.test.ts +135 -0
package/extensions/keyed-async-queue/src/queue.ts +200 -0
package/extensions/memory-core/node_modules/.bin/tsc +21 -0
package/extensions/memory-core/node_modules/.bin/tsserver +21 -0
package/extensions/memory-core/node_modules/.bin/vitest +21 -0
package/extensions/memory-core/package.json +11 -8
package/extensions/memory-core/src/index.ts +14 -0
package/extensions/memory-core/src/memory-manager.test.ts +124 -0
package/extensions/memory-core/src/memory-manager.ts +186 -0
package/extensions/nostr/node_modules/.bin/tsc +2 -2
package/extensions/nostr/node_modules/.bin/tsserver +2 -2
package/extensions/nostr/node_modules/.bin/vitest +21 -0
package/extensions/nostr/package.json +15 -24
package/extensions/nostr/src/index.ts +14 -0
package/extensions/nostr/src/nostr-channel.test.ts +55 -0
package/extensions/nostr/src/nostr-channel.ts +228 -0
package/extensions/page-agent/node_modules/.bin/vitest +2 -2
package/extensions/test-utils/node_modules/.bin/jiti +21 -0
package/extensions/test-utils/node_modules/.bin/playwright +21 -0
package/extensions/test-utils/node_modules/.bin/tsx +21 -0
package/extensions/test-utils/node_modules/.bin/vite +21 -0
package/extensions/test-utils/node_modules/.bin/vitest +21 -0
package/extensions/test-utils/node_modules/.bin/yaml +21 -0
package/extensions/xyops/node_modules/.bin/vitest +2 -2
package/package.json +2 -1
package/dist/control-ui/assets/index-Dvkl4Xlx.js.map +0 -1
package/extensions/googlechat/node_modules/.bin/poolbot +0 -21
package/extensions/memory-core/node_modules/.bin/poolbot +0 -21

package/dist/control-ui/index.html CHANGED Viewed

@@ -6,7 +6,7 @@
     <title>Poolbot Control</title>
     <meta name="color-scheme" content="dark light" />
     <link rel="icon" href="./favicon.ico" sizes="any" />
-    <script type="module" crossorigin src="./assets/index-Dvkl4Xlx.js"></script>
+    <script type="module" crossorigin src="./assets/index-D7shnQwQ.js"></script>
     <link rel="stylesheet" crossorigin href="./assets/index-CSfXd2LO.css">
   </head>
   <body>

package/dist/cron/cron-filters.js ADDED Viewed

@@ -0,0 +1,150 @@
+/**
+ * Advanced Cron Filters
+ * Filter cron jobs by channel, user, session, and other criteria
+ */
+/**
+ * Check if a cron job matches a filter
+ */
+export function matchesFilter(job, filter) {
+    if (!filter.enabled) {
+        return true; // Disabled filters don't block
+    }
+    const criteria = filter.criteria;
+    // Channel filters
+    if (criteria.channelId && job.channelId !== criteria.channelId) {
+        return false;
+    }
+    if (criteria.channelIds && !criteria.channelIds.includes(job.channelId || "")) {
+        return false;
+    }
+    if (criteria.channelType) {
+        // Would need channel type from job metadata
+        const jobType = job.metadata?.channelType || "";
+        if (jobType !== criteria.channelType) {
+            return false;
+        }
+    }
+    // User filters
+    if (criteria.userId && job.userId !== criteria.userId) {
+        return false;
+    }
+    if (criteria.userIds && !criteria.userIds.includes(job.userId || "")) {
+        return false;
+    }
+    if (criteria.userRole) {
+        const jobRole = job.metadata?.userRole || "";
+        if (jobRole !== criteria.userRole) {
+            return false;
+        }
+    }
+    // Session filters
+    if (criteria.sessionId && job.sessionId !== criteria.sessionId) {
+        return false;
+    }
+    if (criteria.sessionIds && !criteria.sessionIds.includes(job.sessionId || "")) {
+        return false;
+    }
+    if (criteria.sessionMode) {
+        const jobMode = job.metadata?.sessionMode || "normal";
+        if (jobMode !== criteria.sessionMode) {
+            return false;
+        }
+    }
+    // Agent filters
+    if (criteria.agentId && job.agentId !== criteria.agentId) {
+        return false;
+    }
+    if (criteria.agentIds && !criteria.agentIds.includes(job.agentId || "")) {
+        return false;
+    }
+    // Custom filters
+    if (criteria.custom) {
+        for (const [key, value] of Object.entries(criteria.custom)) {
+            const jobValue = job.metadata?.[key];
+            if (jobValue !== value) {
+                return false;
+            }
+        }
+    }
+    return true;
+}
+/**
+ * Filter cron jobs by multiple filters
+ */
+export function filterCronJobs(jobs, filters) {
+    return jobs.filter((job) => {
+        // Job must match ALL enabled filters
+        for (const filter of filters) {
+            if (!matchesFilter(job, filter)) {
+                return false;
+            }
+        }
+        return true;
+    });
+}
+/**
+ * Create a new cron filter
+ */
+export function createCronFilter(type, criteria, enabled = true) {
+    return {
+        id: `filter_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`,
+        type,
+        enabled,
+        criteria,
+        createdAt: Date.now(),
+    };
+}
+/**
+ * Update an existing cron filter
+ */
+export function updateCronFilter(filter, updates) {
+    return {
+        ...filter,
+        ...updates,
+        updatedAt: Date.now(),
+    };
+}
+/**
+ * Validate a cron filter
+ */
+export function validateCronFilter(filter) {
+    const errors = [];
+    // Check required fields
+    if (!filter.id) {
+        errors.push("Filter ID is required");
+    }
+    if (!filter.type) {
+        errors.push("Filter type is required");
+    }
+    if (!["channel", "user", "session", "agent", "custom"].includes(filter.type)) {
+        errors.push(`Invalid filter type: ${filter.type}`);
+    }
+    // Check criteria based on type
+    if (filter.type === "channel" && !filter.criteria.channelId && !filter.criteria.channelIds) {
+        errors.push("Channel filter requires channelId or channelIds");
+    }
+    if (filter.type === "user" && !filter.criteria.userId && !filter.criteria.userIds) {
+        errors.push("User filter requires userId or userIds");
+    }
+    if (filter.type === "session" && !filter.criteria.sessionId && !filter.criteria.sessionIds) {
+        errors.push("Session filter requires sessionId or sessionIds");
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+    };
+}
+/**
+ * Get filter statistics
+ */
+export function getFilterStats(filters) {
+    return {
+        total: filters.length,
+        enabled: filters.filter((f) => f.enabled).length,
+        disabled: filters.filter((f) => !f.enabled).length,
+        byType: filters.reduce((acc, f) => {
+            acc[f.type] = (acc[f.type] || 0) + 1;
+            return acc;
+        }, {}),
+    };
+}

package/dist/cron/heartbeat-policy.js ADDED Viewed

@@ -0,0 +1,26 @@
+import { stripHeartbeatToken } from "../auto-reply/heartbeat.js";
+export function shouldSkipHeartbeatOnlyDelivery(payloads, ackMaxChars) {
+    if (payloads.length === 0) {
+        return true;
+    }
+    const hasAnyMedia = payloads.some((payload) => (payload.mediaUrls?.length ?? 0) > 0 || Boolean(payload.mediaUrl));
+    if (hasAnyMedia) {
+        return false;
+    }
+    return payloads.some((payload) => {
+        const result = stripHeartbeatToken(payload.text, {
+            mode: "heartbeat",
+            maxAckChars: ackMaxChars,
+        });
+        return result.shouldSkip;
+    });
+}
+export function shouldEnqueueCronMainSummary(params) {
+    const summaryText = params.summaryText?.trim();
+    return Boolean(summaryText &&
+        params.isCronSystemEvent(summaryText) &&
+        params.deliveryRequested &&
+        !params.delivered &&
+        params.deliveryAttempted !== true &&
+        !params.suppressMainSummary);
+}

package/dist/gateway/device-pairing-security.js ADDED Viewed

@@ -0,0 +1,197 @@
+/**
+ * Device Pairing Security Hardening
+ *
+ * Security fixes for device pairing:
+ * - Single-use bootstrap setup codes
+ * - Short-lived bootstrap tokens
+ * - Fail-closed for reused tokens
+ */
+import crypto from "node:crypto";
+const DEFAULT_EXPIRY_MS = 5 * 60 * 1000; // 5 minutes
+const CLEANUP_INTERVAL_MS = 60 * 1000; // 1 minute
+/**
+ * Generate a secure single-use setup code
+ *
+ * Format: XXXX-YYYY (8 chars, 2 groups for readability)
+ * Entropy: ~36 bits (sufficient for short-lived codes)
+ */
+export function generateSetupCode() {
+    const bytes = crypto.randomBytes(4);
+    const part1 = bytes.readUInt16BE(0) % 10000;
+    const part2 = bytes.readUInt16BE(2) % 10000;
+    return `${part1.toString().padStart(4, '0')}-${part2.toString().padStart(4, '0')}`;
+}
+/**
+ * Create a new single-use bootstrap token
+ */
+export function createBootstrapToken(params) {
+    const expiryMs = params?.expiryMs ?? DEFAULT_EXPIRY_MS;
+    const purpose = params?.purpose ?? "pairing";
+    const now = Date.now();
+    return {
+        id: crypto.randomUUID(),
+        code: generateSetupCode(),
+        createdAt: now,
+        expiresAt: now + expiryMs,
+        used: false,
+        purpose,
+    };
+}
+/**
+ * Initialize bootstrap token store with automatic cleanup
+ */
+export function createBootstrapTokenStore() {
+    const store = {
+        tokens: new Map(),
+    };
+    // Start automatic cleanup
+    store.cleanupInterval = setInterval(() => {
+        cleanupExpiredTokens(store);
+    }, CLEANUP_INTERVAL_MS);
+    // Cleanup on process exit
+    process.on("exit", () => {
+        if (store.cleanupInterval) {
+            clearInterval(store.cleanupInterval);
+        }
+    });
+    return store;
+}
+/**
+ * Add a bootstrap token to the store
+ */
+export function addBootstrapToken(store, token) {
+    store.tokens.set(token.id, token);
+}
+/**
+ * Validate and consume a bootstrap token (single-use)
+ *
+ * Returns true if token is valid and was consumed, false otherwise
+ * Marks token as used to prevent reuse
+ */
+export function validateAndConsumeBootstrapToken(params) {
+    const { store, tokenId, deviceId } = params;
+    const token = store.tokens.get(tokenId);
+    if (!token) {
+        return false;
+    }
+    const now = Date.now();
+    // Check if already used (single-use enforcement)
+    if (token.used) {
+        return false;
+    }
+    // Check if expired
+    if (now > token.expiresAt) {
+        // Remove expired token
+        store.tokens.delete(tokenId);
+        return false;
+    }
+    // Mark as used
+    token.used = true;
+    token.usedAt = now;
+    token.deviceId = deviceId; // Store for audit trail (marked as _deviceId to satisfy linter)
+    const _deviceId = deviceId; // Keep for future audit log expansion
+    return true;
+}
+/**
+ * Validate a bootstrap token without consuming it (for status checks)
+ */
+export function validateBootstrapToken(params) {
+    const { store, tokenId } = params;
+    const token = store.tokens.get(tokenId);
+    if (!token) {
+        return { valid: false, reason: "token_not_found" };
+    }
+    const now = Date.now();
+    if (token.used) {
+        return { valid: false, reason: "token_already_used" };
+    }
+    if (now > token.expiresAt) {
+        return { valid: false, reason: "token_expired" };
+    }
+    return { valid: true };
+}
+/**
+ * Remove a bootstrap token from the store
+ */
+export function removeBootstrapToken(store, tokenId) {
+    return store.tokens.delete(tokenId);
+}
+/**
+ * Cleanup expired and used tokens
+ */
+export function cleanupExpiredTokens(store) {
+    const now = Date.now();
+    let removed = 0;
+    for (const [tokenId, token] of store.tokens.entries()) {
+        // Remove if expired or used (single-use tokens are one-time only)
+        if (now > token.expiresAt || token.used) {
+            store.tokens.delete(tokenId);
+            removed++;
+        }
+    }
+    return removed;
+}
+/**
+ * Get statistics about bootstrap tokens
+ */
+export function getBootstrapTokenStats(store) {
+    const now = Date.now();
+    let unused = 0;
+    let used = 0;
+    let expired = 0;
+    for (const token of store.tokens.values()) {
+        if (token.used) {
+            used++;
+        }
+        else if (now > token.expiresAt) {
+            expired++;
+        }
+        else {
+            unused++;
+        }
+    }
+    return {
+        total: store.tokens.size,
+        unused,
+        used,
+        expired,
+    };
+}
+/**
+ * Create a secure device pairing session
+ */
+export function createSecureDevicePairing(store) {
+    const token = createBootstrapToken({
+        expiryMs: DEFAULT_EXPIRY_MS,
+        purpose: "pairing",
+    });
+    addBootstrapToken(store, token);
+    return {
+        setupCode: token.code,
+        tokenId: token.id,
+        expiresAt: token.expiresAt,
+        isSingleUse: true,
+        securityLevel: "high",
+    };
+}
+/**
+ * Validate device pairing request with security checks
+ */
+export function validateDevicePairingRequest(params) {
+    const { store, tokenId, deviceId, setupCode } = params;
+    // First validate the token
+    const tokenValidation = validateBootstrapToken({ store, tokenId });
+    if (!tokenValidation.valid) {
+        return tokenValidation;
+    }
+    // Get the token and verify setup code
+    const token = store.tokens.get(tokenId);
+    if (!token) {
+        return { valid: false, reason: "token_not_found" };
+    }
+    // Verify setup code matches
+    if (token.code !== setupCode) {
+        return { valid: false, reason: "setup_code_mismatch" };
+    }
+    return { valid: true };
+}

package/dist/gateway/event-deduplication.js ADDED Viewed

@@ -0,0 +1,167 @@
+/**
+ * Event Deduplication Layer
+ *
+ * Prevents duplicate event processing within a configurable time window.
+ * Uses LRU-style eviction to prevent memory leaks.
+ */
+export class EventDeduplicator {
+    seen = new Map();
+    TTL_MS;
+    MAX_SIZE;
+    cleanupInterval = null;
+    constructor(options) {
+        this.TTL_MS = options?.ttlMs ?? 5000; // 5 segundos default
+        this.MAX_SIZE = options?.maxSize ?? 10000;
+        if (options?.autoCleanup !== false) {
+            this.startCleanupInterval();
+        }
+    }
+    /**
+     * Check if event is duplicate and mark as seen
+     * @param eventId - Unique event identifier
+     * @returns true if duplicate (seen within TTL), false if new
+     */
+    isDuplicate(eventId) {
+        const now = Date.now();
+        const existing = this.seen.get(eventId);
+        if (existing && now - existing.timestamp < this.TTL_MS) {
+            existing.count++;
+            return true;
+        }
+        // Evict oldest if at capacity
+        if (this.seen.size >= this.MAX_SIZE) {
+            this.evictOldest();
+        }
+        this.seen.set(eventId, { timestamp: now, count: 1 });
+        return false;
+    }
+    /**
+     * Check if event was seen without marking it
+     */
+    hasSeen(eventId) {
+        const existing = this.seen.get(eventId);
+        if (!existing)
+            return false;
+        return Date.now() - existing.timestamp < this.TTL_MS;
+    }
+    /**
+     * Get duplicate count for an event
+     */
+    getDuplicateCount(eventId) {
+        const existing = this.seen.get(eventId);
+        return existing?.count ?? 0;
+    }
+    /**
+     * Clear specific event from seen set
+     */
+    clear(eventId) {
+        this.seen.delete(eventId);
+    }
+    /**
+     * Clear all seen events
+     */
+    clearAll() {
+        this.seen.clear();
+    }
+    /**
+     * Get statistics about deduplication
+     */
+    getStats() {
+        let duplicates = 0;
+        let oldest = null;
+        for (const event of this.seen.values()) {
+            if (event.count > 1) {
+                duplicates += event.count - 1;
+            }
+            if (!oldest || event.timestamp < oldest) {
+                oldest = event.timestamp;
+            }
+        }
+        return {
+            totalEvents: this.seen.size,
+            oldestEvent: oldest,
+            duplicates,
+        };
+    }
+    /**
+     * Cleanup expired events
+     */
+    cleanup() {
+        const now = Date.now();
+        let removed = 0;
+        for (const [eventId, event] of this.seen.entries()) {
+            if (now - event.timestamp > this.TTL_MS) {
+                this.seen.delete(eventId);
+                removed++;
+            }
+        }
+        return removed;
+    }
+    /**
+     * Get count of active events being tracked
+     */
+    get activeEventCount() {
+        return this.seen.size;
+    }
+    /**
+     * Destroy deduplicator and stop cleanup interval
+     */
+    destroy() {
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+            this.cleanupInterval = null;
+        }
+        this.clearAll();
+    }
+    startCleanupInterval() {
+        // Cleanup a cada 1/4 do TTL
+        const cleanupIntervalMs = Math.max(1000, this.TTL_MS / 4);
+        this.cleanupInterval = setInterval(() => {
+            this.cleanup();
+        }, cleanupIntervalMs);
+        // Unref para não impedir o processo de sair
+        this.cleanupInterval.unref();
+    }
+    evictOldest() {
+        let oldestId = null;
+        let oldestTime = Infinity;
+        for (const [eventId, event] of this.seen.entries()) {
+            if (event.timestamp < oldestTime) {
+                oldestTime = event.timestamp;
+                oldestId = eventId;
+            }
+        }
+        if (oldestId) {
+            this.seen.delete(oldestId);
+        }
+    }
+}
+/**
+ * Generate unique event ID for deduplication
+ */
+export function generateEventId(params) {
+    const { type, sessionId, runId, payload } = params;
+    const parts = [type];
+    if (sessionId)
+        parts.push(sessionId);
+    if (runId)
+        parts.push(runId);
+    // Include payload hash if available
+    if (payload) {
+        const hash = quickHash(JSON.stringify(payload));
+        parts.push(hash.toString());
+    }
+    return parts.join(":");
+}
+/**
+ * Quick hash function for strings (not cryptographically secure)
+ */
+function quickHash(str) {
+    let hash = 0;
+    for (let i = 0; i < str.length; i++) {
+        const char = str.charCodeAt(i);
+        hash = (hash << 5) - hash + char;
+        hash = hash & hash; // Convert to 32bit integer
+    }
+    return Math.abs(hash);
+}

package/dist/gateway/hooks-mapping.js CHANGED Viewed

@@ -1,6 +1,7 @@
+import fs from "node:fs";
 import path from "node:path";
-import { pathToFileURL } from "node:url";
 import { CONFIG_PATH } from "../config/config.js";
+import { importFileModule, resolveFunctionModuleExport } from "../hooks/module-loader.js";
 const hookPresetMappings = {
     gmail: [
         {
@@ -204,15 +205,18 @@ async function loadTransform(transform) {
     if (cached) {
         return cached;
     }
-    const url = pathToFileURL(transform.modulePath).href;
-    const mod = (await import(url));
+    const mod = await importFileModule({ modulePath: transform.modulePath });
     const fn = resolveTransformFn(mod, transform.exportName);
     transformCache.set(cacheKey, fn);
     return fn;
 }
 function resolveTransformFn(mod, exportName) {
-    const candidate = exportName ? mod[exportName] : (mod.default ?? mod.transform);
-    if (typeof candidate !== "function") {
+    const candidate = resolveFunctionModuleExport({
+        mod,
+        exportName,
+        fallbackExportNames: ["default", "transform"],
+    });
+    if (!candidate) {
         throw new Error("hook transform module must export a function");
     }
     return candidate;
@@ -223,6 +227,32 @@ function resolvePath(baseDir, target) {
     }
     return path.isAbsolute(target) ? path.resolve(target) : path.resolve(baseDir, target);
 }
+function escapesBase(baseDir, candidate) {
+    const relative = path.relative(baseDir, candidate);
+    return relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative);
+}
+function safeRealpathSync(candidate) {
+    try {
+        const nativeRealpath = fs.realpathSync.native;
+        return nativeRealpath ? nativeRealpath(candidate) : fs.realpathSync(candidate);
+    }
+    catch {
+        return null;
+    }
+}
+function resolveExistingAncestor(candidate) {
+    let current = path.resolve(candidate);
+    while (true) {
+        if (fs.existsSync(current)) {
+            return current;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return null;
+        }
+        current = parent;
+    }
+}
 function resolveContainedPath(baseDir, target, label) {
     const base = path.resolve(baseDir);
     const trimmed = target?.trim();
@@ -230,8 +260,17 @@ function resolveContainedPath(baseDir, target, label) {
         throw new Error(`${label} module path is required`);
     }
     const resolved = resolvePath(base, trimmed);
-    const relative = path.relative(base, resolved);
-    if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+    if (escapesBase(base, resolved)) {
+        throw new Error(`${label} module path must be within ${base}: ${target}`);
+    }
+    // Block symlink escapes for existing path segments while preserving current
+    // behavior for not-yet-created files.
+    const baseRealpath = safeRealpathSync(base);
+    const existingAncestor = resolveExistingAncestor(resolved);
+    const existingAncestorRealpath = existingAncestor ? safeRealpathSync(existingAncestor) : null;
+    if (baseRealpath &&
+        existingAncestorRealpath &&
+        escapesBase(baseRealpath, existingAncestorRealpath)) {
         throw new Error(`${label} module path must be within ${base}: ${target}`);
     }
     return resolved;