@poolzin/pool-bot 2026.3.27 → 2026.3.28

package/dist/tui/utils/text-sanitization.js

@@ -1,284 +0,0 @@
-/**
- * Text sanitization utilities for safe terminal rendering
- *
- * Features:
- * - Control character stripping
- * - ANSI sequence handling
- * - Path and URL preservation
- * - RTL text isolation
- * - Binary data redaction
- * - Safe truncation
- */
-import { createSubsystemLogger } from "../../logging/subsystem.js";
-const sanitizeLog = createSubsystemLogger("sanitize");
-/**
- * Maximum safe length for a single token (word)
- * Tokens longer than this will be chunked
- */
-const MAX_TOKEN_LENGTH = 4096;
-/**
- * Characters to strip (control characters except common whitespace)
- */
-const CONTROL_CHARS_TO_STRIP = new Set([
-    0x00, // NUL - null
-    0x01, // SOH - start of heading
-    0x02, // STX - start of text
-    0x03, // ETX - end of text
-    0x04, // EOT - end of transmission
-    0x05, // ENQ - enquiry
-    0x06, // ACK - acknowledge
-    0x07, // BEL - bell
-    0x08, // BS - backspace
-    0x0b, // VT - vertical tab
-    0x0c, // FF - form feed
-    0x0e, // SO - shift out
-    0x0f, // SI - shift in
-    0x10, // DLE - data link escape
-    0x11, // DC1 - device control 1
-    0x12, // DC2 - device control 2
-    0x13, // DC3 - device control 3
-    0x14, // DC4 - device control 4
-    0x15, // NAK - negative acknowledge
-    0x16, // SYN - synchronous idle
-    0x17, // ETB - end of transmission block
-    0x18, // CAN - cancel
-    0x19, // EM - end of medium
-    0x1a, // SUB - substitute
-    0x1b, // ESC - escape (handled separately)
-    0x1c, // FS - file separator
-    0x1d, // GS - group separator
-    0x1e, // RS - record separator
-    0x1f, // US - unit separator
-    0x7f, // DEL - delete
-]);
-/**
- * Check if a character is a control character that should be stripped
- */
-function shouldStripControlChar(codePoint) {
-    return CONTROL_CHARS_TO_STRIP.has(codePoint);
-}
-/**
- * Check if text contains binary/null bytes
- */
-function containsBinaryData(text) {
-    for (let i = 0; i < Math.min(text.length, 1024); i++) {
-        const code = text.charCodeAt(i);
-        if (code === 0x00 || (code < 0x20 && !isCommonWhitespace(code))) {
-            return true;
-        }
-    }
-    return false;
-}
-/**
- * Check if character is common whitespace (preserved)
- */
-function isCommonWhitespace(codePoint) {
-    return (codePoint === 0x09 || // TAB
-        codePoint === 0x0a || // LF
-        codePoint === 0x0d || // CR
-        codePoint === 0x20); // SPACE
-}
-/**
- * Check if character is RTL (right-to-left)
- */
-function isRtlChar(codePoint) {
-    // Hebrew: U+0590 - U+05FF
-    if (codePoint >= 0x0590 && codePoint <= 0x05ff)
-        return true;
-    // Arabic: U+0600 - U+06FF
-    if (codePoint >= 0x0600 && codePoint <= 0x06ff)
-        return true;
-    // Arabic Supplement: U+0750 - U+077F
-    if (codePoint >= 0x0750 && codePoint <= 0x077f)
-        return true;
-    // RTL marks
-    if (codePoint === 0x200f || codePoint === 0x202e)
-        return true;
-    return false;
-}
-/**
- * Check if text contains RTL characters
- */
-function containsRtl(text) {
-    for (const char of text) {
-        if (isRtlChar(char.codePointAt(0) ?? 0)) {
-            return true;
-        }
-    }
-    return false;
-}
-/**
- * URL pattern for detection
- */
-const URL_PATTERN = /https?:\/\/[^\s<>"{}|\\^`[\]]+/gi;
-/**
- * Path pattern for detection (Unix and Windows)
- */
-const PATH_PATTERN = /(?:~\/|\/|[a-zA-Z]:\\)[^\s<>"{}|\\^`[\]]*/g;
-/**
- * Truncate a long token while preserving meaning
- */
-function truncateToken(token, maxLength) {
-    if (token.length <= maxLength)
-        return token;
-    // For URLs, try to preserve the domain and endpoint
-    if (token.startsWith("http")) {
-        try {
-            const url = new URL(token);
-            const domain = url.hostname;
-            const path = url.pathname;
-            const search = url.search;
-            // Calculate available space for path
-            const prefix = `${url.protocol}//${domain}`;
-            const suffix = "…";
-            const available = maxLength - prefix.length - suffix.length;
-            if (available > 10) {
-                const truncatedPath = path.slice(0, Math.max(0, available - search.length)) + (search ? "?…" : "") + suffix;
-                return prefix + truncatedPath;
-            }
-        }
-        catch {
-            // Not a valid URL, fall through to default truncation
-        }
-    }
-    // Default truncation
-    return token.slice(0, maxLength - 1) + "…";
-}
-/**
- * Sanitize text for safe terminal rendering
- *
- * @param text - Raw text to sanitize
- * @param options - Sanitization options
- * @returns Sanitized text safe for terminal rendering
- */
-export function sanitizeRenderableText(text, options = {}) {
-    const { maxTokenLength = MAX_TOKEN_LENGTH, preserveUrls = true, isolateRtl = true, redactBinary = true, maxTotalLength, } = options;
-    if (!text || typeof text !== "string") {
-        return "";
-    }
-    let result = text;
-    // Check for binary data
-    if (redactBinary && containsBinaryData(result)) {
-        sanitizeLog.debug("Redacting binary data from text");
-        return "[binary data redacted]";
-    }
-    // Strip control characters
-    result = result
-        .split("")
-        .map((char) => {
-        const code = char.codePointAt(0) ?? 0;
-        if (shouldStripControlChar(code)) {
-            return "";
-        }
-        return char;
-    })
-        .join("");
-    // Handle very long tokens (preserve URLs/paths)
-    if (preserveUrls) {
-        // First identify URLs and paths to preserve
-        const preserved = [];
-        let preservedIndex = 0;
-        result = result.replace(URL_PATTERN, (url) => {
-            if (url.length > maxTokenLength) {
-                url = truncateToken(url, maxTokenLength);
-            }
-            const placeholder = `\x00PRESERVED_${preservedIndex++}\x00`;
-            preserved.push(url);
-            return placeholder;
-        });
-        result = result.replace(PATH_PATTERN, (path) => {
-            if (path.length > maxTokenLength) {
-                path = truncateToken(path, maxTokenLength);
-            }
-            const placeholder = `\x00PRESERVED_${preservedIndex++}\x00`;
-            preserved.push(path);
-            return placeholder;
-        });
-        // Truncate remaining long tokens
-        result = result
-            .split(/\s+/)
-            .map((token) => {
-            if (token.length > maxTokenLength) {
-                return truncateToken(token, maxTokenLength);
-            }
-            return token;
-        })
-            .join(" ");
-        // Restore preserved URLs/paths
-        for (let i = 0; i < preserved.length; i++) {
-            result = result.replace(`\x00PRESERVED_${i}\x00`, preserved[i]);
-        }
-    }
-    else {
-        // Simple token truncation
-        result = result
-            .split(/\s+/)
-            .map((token) => {
-            if (token.length > maxTokenLength) {
-                return truncateToken(token, maxTokenLength);
-            }
-            return token;
-        })
-            .join(" ");
-    }
-    // Isolate RTL text with Unicode marks
-    if (isolateRtl && containsRtl(result)) {
-        // Add LTR mark at start and end to ensure proper display
-        result = "\u200e" + result + "\u200e";
-    }
-    // Apply total length limit
-    if (maxTotalLength && result.length > maxTotalLength) {
-        result = result.slice(0, maxTotalLength - 3) + "...";
-    }
-    return result;
-}
-/**
- * Sanitize error message for display
- */
-export function sanitizeErrorMessage(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return sanitizeRenderableText(message, {
-        maxTokenLength: 1024,
-        maxTotalLength: 8192,
-    });
-}
-/**
- * Strip ANSI escape sequences from text
- */
-export function stripAnsi(text) {
-    // eslint-disable-next-line no-control-regex
-    return text.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
-}
-/**
- * Check if text is safe to render (no sanitization needed)
- */
-export function isSafeToRender(text) {
-    if (!text || text.length === 0)
-        return true;
-    // Check length
-    if (text.length > MAX_TOKEN_LENGTH)
-        return false;
-    // Check for control characters
-    for (let i = 0; i < text.length; i++) {
-        const code = text.charCodeAt(i);
-        if (shouldStripControlChar(code)) {
-            return false;
-        }
-        if (code === 0x00)
-            return false; // Null bytes
-    }
-    return true;
-}
-/**
- * Create a sanitized preview of text (for logging/debugging)
- */
-export function createTextPreview(text, maxLength = 200) {
-    const sanitized = sanitizeRenderableText(text, {
-        maxTokenLength: maxLength,
-        maxTotalLength: maxLength,
-    });
-    if (text.length > maxLength) {
-        return sanitized + ` [+${text.length - maxLength} chars]`;
-    }
-    return sanitized;
-}

package/dist/ui-plugins/ui-plugins-improvements.js

@@ -1,191 +0,0 @@
-/**
- * UI/UX & Plugins Enhancements
- *
- * Implements OpenClaw improvements:
- * - Cron editor with clone functionality
- * - Sessions cleanup UI
- * - Scoped plugin SDK imports
- * - Hook session lifecycle (session_start/session_end)
- * - HTTP route registration API
- *
- * OpenClaw #30951, #32384
- */
-export const DEFAULT_CRON_EDITOR_CONFIG = {
-    enabled: true,
-    enableClone: true,
-    enableRichValidation: true,
-    validationRules: [
-        {
-            name: "no-past-schedule",
-            pattern: "^(\\*|[0-9]+)\\s+(\\*|[0-9]+)\\s+(\\*|[0-9]+)\\s+(\\*|[0-9]+)\\s+(\\*|[0-9]+)$",
-            errorMessage: "Invalid cron expression",
-            severity: "error",
-        },
-        {
-            name: "reasonable-frequency",
-            pattern: "^(\\*/[1-9][0-9]*|\\*|[0-9]+)\\s+.*$",
-            errorMessage: "Schedule runs too frequently (consider increasing interval)",
-            severity: "warning",
-        },
-    ],
-    defaultTimezone: "UTC",
-    showCronExpressions: true,
-    showNextRunTimes: true,
-    maxNextRunsToShow: 5,
-};
-export const DEFAULT_CRON_CLONE_CONFIG = {
-    nameSuffix: " (copy)",
-    enabledByDefault: false, // Start disabled to allow configuration
-    preserveSchedule: true,
-    preserveDelivery: true,
-    resetFailureCount: true,
-};
-/**
- * Validate cron expression
- */
-export function validateCronExpression(expression, config = DEFAULT_CRON_EDITOR_CONFIG) {
-    if (!config.enableRichValidation) {
-        // Basic validation only
-        const parts = expression.trim().split(/\s+/);
-        if (parts.length !== 5) {
-            return { valid: false, errors: ["Cron expression must have 5 parts"], warnings: [] };
-        }
-        return { valid: true, errors: [], warnings: [] };
-    }
-    const errors = [];
-    const warnings = [];
-    // Check against validation rules
-    for (const rule of config.validationRules) {
-        const regex = new RegExp(rule.pattern);
-        if (!regex.test(expression)) {
-            if (rule.severity === "error") {
-                errors.push(rule.errorMessage);
-            }
-            else if (rule.severity === "warning") {
-                warnings.push(rule.errorMessage);
-            }
-        }
-    }
-    if (errors.length === 0) {
-        return { valid: true, errors: [], warnings: [] };
-    }
-    return { valid: false, errors, warnings };
-}
-export const DEFAULT_SESSIONS_CLEANUP_CONFIG = {
-    enabled: true,
-    showSessionAge: true,
-    showSessionSize: true,
-    showLastActivity: true,
-    enableBulkDelete: true,
-    enableSearch: true,
-    enableExport: true,
-    autoCleanup: false, // Disabled by default for safety
-    autoCleanupAgeDays: 30,
-    confirmBeforeDelete: true,
-};
-export const DEFAULT_SCOPED_PLUGIN_SDK_CONFIG = {
-    enabled: true,
-    allowedModules: [
-        "@poolbot/plugin-sdk",
-        "@poolbot/plugin-sdk/tools",
-        "@poolbot/plugin-sdk/providers",
-        "@poolbot/plugin-sdk/hooks",
-    ],
-    blockedMethods: [
-        "require",
-        "eval",
-        "Function",
-        "vm.runInContext",
-        "child_process.exec",
-        "child_process.spawn",
-    ],
-    requireExplicitImports: true,
-    logViolations: true,
-};
-/**
- * Validate plugin SDK import
- */
-export function validatePluginSdkImport(params) {
-    const { importPath, config } = params;
-    if (!config.enabled) {
-        return { allowed: true };
-    }
-    // Check if module is allowed
-    if (!config.allowedModules.some((mod) => importPath.startsWith(mod))) {
-        return { allowed: false, reason: `Module "${importPath}" is not in allowed list` };
-    }
-    return { allowed: true };
-}
-export const DEFAULT_HOOK_SESSION_LIFECYCLE_CONFIG = {
-    enabled: true,
-    callSessionStart: true,
-    callSessionEnd: true,
-    includeSessionKey: true,
-    includeAgentMetadata: true,
-    hookTimeoutMs: 5000,
-    continueOnFailure: true,
-};
-export const DEFAULT_HTTP_ROUTE_REGISTRATION_CONFIG = {
-    enabled: true,
-    routePrefix: "/api/plugins",
-    requireAuth: true,
-    rateLimitPerMinute: 60,
-    maxRoutesPerPlugin: 10,
-    allowedMethods: ["GET", "POST"],
-    blockedPaths: ["/admin", "/config", "/auth", "/internal", "/gateway", "/system"],
-};
-const registeredRoutes = new Map();
-/**
- * Register HTTP route for plugin
- */
-export function registerHttpRoute(params) {
-    const { path, method, pluginId, handler, config } = params;
-    if (!config.enabled) {
-        return { success: false, reason: "HTTP route registration is disabled" };
-    }
-    // Check if path is blocked
-    if (config.blockedPaths.some((blocked) => path.startsWith(blocked))) {
-        return { success: false, reason: `Path "${path}" is blocked` };
-    }
-    // Check if method is allowed
-    if (!config.allowedMethods.includes(method.toUpperCase())) {
-        return { success: false, reason: `Method "${method}" is not allowed` };
-    }
-    // Check route count for plugin
-    const pluginRoutes = registeredRoutes.get(pluginId) ?? [];
-    if (pluginRoutes.length >= config.maxRoutesPerPlugin) {
-        return {
-            success: false,
-            reason: `Max routes (${config.maxRoutesPerPlugin}) exceeded for plugin`,
-        };
-    }
-    const fullPath = `${config.routePrefix}${path}`;
-    const route = {
-        path: fullPath,
-        method: method.toUpperCase(),
-        pluginId,
-        handler,
-        registeredAt: Date.now(),
-    };
-    pluginRoutes.push(route);
-    registeredRoutes.set(pluginId, pluginRoutes);
-    return { success: true, fullPath };
-}
-/**
- * Get registered routes for plugin
- */
-export function getPluginRoutes(pluginId) {
-    return registeredRoutes.get(pluginId) ?? [];
-}
-/**
- * Unregister all routes for plugin
- */
-export function unregisterPluginRoutes(pluginId) {
-    const routes = registeredRoutes.get(pluginId);
-    if (!routes) {
-        return 0;
-    }
-    const count = routes.length;
-    registeredRoutes.delete(pluginId);
-    return count;
-}

package/dist/utils/account-id.js

@@ -1,4 +0,0 @@
-import { normalizeOptionalAccountId } from "../routing/account-id.js";
-export function normalizeAccountId(value) {
-    return normalizeOptionalAccountId(value);
-}

package/dist/utils/boolean.js

@@ -1,27 +0,0 @@
-const DEFAULT_TRUTHY = ["true", "1", "yes", "on"];
-const DEFAULT_FALSY = ["false", "0", "no", "off"];
-const DEFAULT_TRUTHY_SET = new Set(DEFAULT_TRUTHY);
-const DEFAULT_FALSY_SET = new Set(DEFAULT_FALSY);
-export function parseBooleanValue(value, options = {}) {
-    if (typeof value === "boolean") {
-        return value;
-    }
-    if (typeof value !== "string") {
-        return undefined;
-    }
-    const normalized = value.trim().toLowerCase();
-    if (!normalized) {
-        return undefined;
-    }
-    const truthy = options.truthy ?? DEFAULT_TRUTHY;
-    const falsy = options.falsy ?? DEFAULT_FALSY;
-    const truthySet = truthy === DEFAULT_TRUTHY ? DEFAULT_TRUTHY_SET : new Set(truthy);
-    const falsySet = falsy === DEFAULT_FALSY ? DEFAULT_FALSY_SET : new Set(falsy);
-    if (truthySet.has(normalized)) {
-        return true;
-    }
-    if (falsySet.has(normalized)) {
-        return false;
-    }
-    return undefined;
-}

package/dist/utils/chunk-items.js

@@ -1,10 +0,0 @@
-export function chunkItems(items, size) {
-    if (size <= 0) {
-        return [Array.from(items)];
-    }
-    const rows = [];
-    for (let i = 0; i < items.length; i += size) {
-        rows.push(items.slice(i, i + size));
-    }
-    return rows;
-}

package/dist/utils/delivery-context.js

@@ -1,84 +0,0 @@
-import { normalizeAccountId } from "./account-id.js";
-import { normalizeMessageChannel } from "./message-channel.js";
-export function normalizeDeliveryContext(context) {
-    if (!context)
-        return undefined;
-    const channel = typeof context.channel === "string"
-        ? (normalizeMessageChannel(context.channel) ?? context.channel.trim())
-        : undefined;
-    const to = typeof context.to === "string" ? context.to.trim() : undefined;
-    const accountId = normalizeAccountId(context.accountId);
-    const threadId = typeof context.threadId === "number" && Number.isFinite(context.threadId)
-        ? Math.trunc(context.threadId)
-        : typeof context.threadId === "string"
-            ? context.threadId.trim()
-            : undefined;
-    const normalizedThreadId = typeof threadId === "string" ? (threadId ? threadId : undefined) : threadId;
-    if (!channel && !to && !accountId && normalizedThreadId == null)
-        return undefined;
-    const normalized = {
-        channel: channel || undefined,
-        to: to || undefined,
-        accountId,
-    };
-    if (normalizedThreadId != null)
-        normalized.threadId = normalizedThreadId;
-    return normalized;
-}
-export function normalizeSessionDeliveryFields(source) {
-    if (!source) {
-        return {
-            deliveryContext: undefined,
-            lastChannel: undefined,
-            lastTo: undefined,
-            lastAccountId: undefined,
-            lastThreadId: undefined,
-        };
-    }
-    const merged = mergeDeliveryContext(normalizeDeliveryContext({
-        channel: source.lastChannel ?? source.channel,
-        to: source.lastTo,
-        accountId: source.lastAccountId,
-        threadId: source.lastThreadId,
-    }), normalizeDeliveryContext(source.deliveryContext));
-    if (!merged) {
-        return {
-            deliveryContext: undefined,
-            lastChannel: undefined,
-            lastTo: undefined,
-            lastAccountId: undefined,
-            lastThreadId: undefined,
-        };
-    }
-    return {
-        deliveryContext: merged,
-        lastChannel: merged.channel,
-        lastTo: merged.to,
-        lastAccountId: merged.accountId,
-        lastThreadId: merged.threadId,
-    };
-}
-export function deliveryContextFromSession(entry) {
-    if (!entry)
-        return undefined;
-    return normalizeSessionDeliveryFields(entry).deliveryContext;
-}
-export function mergeDeliveryContext(primary, fallback) {
-    const normalizedPrimary = normalizeDeliveryContext(primary);
-    const normalizedFallback = normalizeDeliveryContext(fallback);
-    if (!normalizedPrimary && !normalizedFallback)
-        return undefined;
-    return normalizeDeliveryContext({
-        channel: normalizedPrimary?.channel ?? normalizedFallback?.channel,
-        to: normalizedPrimary?.to ?? normalizedFallback?.to,
-        accountId: normalizedPrimary?.accountId ?? normalizedFallback?.accountId,
-        threadId: normalizedPrimary?.threadId ?? normalizedFallback?.threadId,
-    });
-}
-export function deliveryContextKey(context) {
-    const normalized = normalizeDeliveryContext(context);
-    if (!normalized?.channel || !normalized?.to)
-        return undefined;
-    const threadId = normalized.threadId != null && normalized.threadId !== "" ? String(normalized.threadId) : "";
-    return `${normalized.channel}|${normalized.to}|${normalized.accountId ?? ""}|${threadId}`;
-}

package/dist/utils/directive-tags.js

@@ -1,65 +0,0 @@
-const AUDIO_TAG_RE = /\[\[\s*audio_as_voice\s*\]\]/gi;
-const REPLY_TAG_RE = /\[\[\s*(?:reply_to_current|reply_to\s*:\s*([^\]\n]+))\s*\]\]/gi;
-function normalizeDirectiveWhitespace(text) {
-    return text
-        .replace(/[ \t]+/g, " ")
-        .replace(/[ \t]*\n[ \t]*/g, "\n")
-        .trim();
-}
-export function stripInlineDirectiveTagsForDisplay(text) {
-    if (!text) {
-        return { text, changed: false };
-    }
-    const withoutAudio = text.replace(AUDIO_TAG_RE, "");
-    const stripped = withoutAudio.replace(REPLY_TAG_RE, "");
-    return {
-        text: stripped,
-        changed: stripped !== text,
-    };
-}
-export function parseInlineDirectives(text, options = {}) {
-    const { currentMessageId, stripAudioTag = true, stripReplyTags = true } = options;
-    if (!text) {
-        return {
-            text: "",
-            audioAsVoice: false,
-            replyToCurrent: false,
-            hasAudioTag: false,
-            hasReplyTag: false,
-        };
-    }
-    let cleaned = text;
-    let audioAsVoice = false;
-    let hasAudioTag = false;
-    let hasReplyTag = false;
-    let sawCurrent = false;
-    let lastExplicitId;
-    cleaned = cleaned.replace(AUDIO_TAG_RE, (match) => {
-        audioAsVoice = true;
-        hasAudioTag = true;
-        return stripAudioTag ? " " : match;
-    });
-    cleaned = cleaned.replace(REPLY_TAG_RE, (match, idRaw) => {
-        hasReplyTag = true;
-        if (idRaw === undefined) {
-            sawCurrent = true;
-        }
-        else {
-            const id = idRaw.trim();
-            if (id)
-                lastExplicitId = id;
-        }
-        return stripReplyTags ? " " : match;
-    });
-    cleaned = normalizeDirectiveWhitespace(cleaned);
-    const replyToId = lastExplicitId ?? (sawCurrent ? currentMessageId?.trim() || undefined : undefined);
-    return {
-        text: cleaned,
-        audioAsVoice,
-        replyToId,
-        replyToExplicitId: lastExplicitId,
-        replyToCurrent: sawCurrent,
-        hasAudioTag,
-        hasReplyTag,
-    };
-}

package/dist/utils/fetch-timeout.js

@@ -1,31 +0,0 @@
-/**
- * Relay abort without forwarding the Event argument as the abort reason.
- * Using .bind() avoids closure scope capture (memory leak prevention).
- */
-function relayAbort() {
-    this.abort();
-}
-/** Returns a bound abort relay for use as an event listener. */
-export function bindAbortRelay(controller) {
-    return relayAbort.bind(controller);
-}
-/**
- * Fetch wrapper that adds timeout support via AbortController.
- *
- * @param url - The URL to fetch
- * @param init - RequestInit options (headers, method, body, etc.)
- * @param timeoutMs - Timeout in milliseconds
- * @param fetchFn - The fetch implementation to use (defaults to global fetch)
- * @returns The fetch Response
- * @throws AbortError if the request times out
- */
-export async function fetchWithTimeout(url, init, timeoutMs, fetchFn = fetch) {
-    const controller = new AbortController();
-    const timer = setTimeout(controller.abort.bind(controller), Math.max(1, timeoutMs));
-    try {
-        return await fetchFn(url, { ...init, signal: controller.signal });
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}