@elizaos/agent 0.25.9 → 2.0.0-alpha.144

package/apps/app-steward/src/services/steward-evm-account.js

@@ -0,0 +1,302 @@
+/**
+ * Steward EVM Account — a viem-compatible Account that routes all signing
+ * through the Steward API. No private keys touch the container.
+ *
+ * Used when ELIZA_CLOUD_PROVISIONED=1 and STEWARD_AGENT_TOKEN is set.
+ *
+ * Implements viem's CustomAccount interface:
+ *   - address
+ *   - signMessage({ message })
+ *   - signTransaction({ ... })
+ *   - signTypedData({ domain, types, primaryType, message })
+ *
+ * The Steward API endpoints used:
+ *   POST /vault/:agentId/sign          — sign + optionally broadcast EVM tx
+ *   POST /vault/:agentId/sign-message  — sign arbitrary message (EIP-191)
+ *   POST /vault/:agentId/sign-typed-data — sign EIP-712 typed data
+ *
+ * Auth: Bearer token (STEWARD_AGENT_TOKEN JWT) in Authorization header.
+ */
+import { toAccount } from "viem/accounts";
+// ─── Steward API Client (minimal, signing-only) ──────────────────────────────
+class StewardSigningClient {
+    baseUrl;
+    agentToken;
+    agentId;
+    constructor(config) {
+        this.baseUrl = config.apiUrl.replace(/\/+$/, "");
+        this.agentToken = config.agentToken;
+        this.agentId = config.agentId;
+    }
+    async request(path, body) {
+        const url = `${this.baseUrl}${path}`;
+        const response = await fetch(url, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json",
+                Authorization: `Bearer ${this.agentToken}`,
+            },
+            body: JSON.stringify(body),
+        });
+        const text = await response.text();
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            throw new Error(`[StewardAccount] Invalid JSON from Steward API (${response.status}): ${text.slice(0, 200)}`);
+        }
+        if (!parsed.ok) {
+            // 202 with pending_approval is a special case
+            if (response.status === 202 &&
+                parsed.data &&
+                typeof parsed.data === "object" &&
+                "status" in parsed.data &&
+                parsed.data.status === "pending_approval") {
+                throw new Error(`[StewardAccount] Transaction requires manual approval (txId: ${parsed.data.txId})`);
+            }
+            throw new Error(`[StewardAccount] API error (${response.status}): ${parsed.error || "Unknown error"}`);
+        }
+        return parsed.data;
+    }
+    /**
+     * Sign an EVM transaction.
+     * Returns the signed transaction hex (when broadcast=false) or txHash (when broadcast=true).
+     */
+    async signTransaction(tx) {
+        return this.request(`/vault/${encodeURIComponent(this.agentId)}/sign`, {
+            ...tx,
+            broadcast: tx.broadcast ?? false,
+        });
+    }
+    /**
+     * Sign an arbitrary message (EIP-191 personal_sign).
+     */
+    async signMessage(message) {
+        return this.request(`/vault/${encodeURIComponent(this.agentId)}/sign-message`, { message });
+    }
+    /**
+     * Sign EIP-712 typed data.
+     */
+    async signTypedData(input) {
+        return this.request(`/vault/${encodeURIComponent(this.agentId)}/sign-typed-data`, input);
+    }
+}
+// ─── Fetch wallet address from Steward ───────────────────────────────────────
+/**
+ * Fetch the EVM wallet address for an agent from the Steward API.
+ * Tries /vault/:agentId/addresses first (multi-chain), falls back to /agents/:agentId.
+ */
+export async function fetchStewardWalletAddress(apiUrl, agentToken, agentId) {
+    const baseUrl = apiUrl.replace(/\/+$/, "");
+    const timeoutMs = 10_000;
+    const headers = {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        Authorization: `Bearer ${agentToken}`,
+    };
+    // Try /vault/:agentId/addresses first (returns { evm: "0x...", solana: "..." })
+    try {
+        const addrResp = await fetch(`${baseUrl}/vault/${encodeURIComponent(agentId)}/addresses`, {
+            headers,
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        if (addrResp.ok) {
+            const addrData = (await addrResp.json());
+            if (addrData.ok && addrData.data?.evm) {
+                return addrData.data.evm;
+            }
+        }
+    }
+    catch {
+        // fall through
+    }
+    // Fallback: /agents/:agentId
+    try {
+        const agentResp = await fetch(`${baseUrl}/agents/${encodeURIComponent(agentId)}`, {
+            headers,
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        if (agentResp.ok) {
+            const agentData = (await agentResp.json());
+            if (agentData.ok && agentData.data?.walletAddress) {
+                return agentData.data.walletAddress;
+            }
+        }
+    }
+    catch {
+        // fall through
+    }
+    throw new Error(`[StewardAccount] Could not fetch wallet address for agent "${agentId}" from ${baseUrl}`);
+}
+// ─── Create viem Account ─────────────────────────────────────────────────────
+/**
+ * Create a viem-compatible Account that routes signing through Steward API.
+ *
+ * Usage:
+ *   const account = createStewardEvmAccount({ apiUrl, agentToken, agentId, address });
+ *   const walletProvider = new WalletProvider(account, runtime, chains);
+ */
+export function createStewardEvmAccount(config) {
+    const client = new StewardSigningClient({
+        apiUrl: config.apiUrl,
+        agentToken: config.agentToken,
+        agentId: config.agentId,
+    });
+    const signTypedData = async (typedData) => {
+        const td = typedData;
+        const domain = td.domain && typeof td.domain === "object"
+            ? td.domain
+            : {};
+        const types = {
+            ...(td.types && typeof td.types === "object" ? td.types : {}),
+        };
+        const primaryType = typeof td.primaryType === "string" ? td.primaryType : "";
+        const value = td.message && typeof td.message === "object"
+            ? td.message
+            : {};
+        // Remove the EIP712Domain type if present (Steward expects raw types)
+        delete types.EIP712Domain;
+        const result = await client.signTypedData({
+            domain,
+            types,
+            primaryType,
+            value,
+        });
+        return result.signature;
+    };
+    return toAccount({
+        address: config.address,
+        async signMessage({ message }) {
+            // Normalize message to string
+            let msgStr;
+            if (typeof message === "string") {
+                msgStr = message;
+            }
+            else if (typeof message === "object" && "raw" in message) {
+                // Raw bytes
+                const raw = message.raw;
+                if (typeof raw === "string") {
+                    msgStr = raw; // already hex
+                }
+                else {
+                    // Uint8Array → hex
+                    msgStr = `0x${Buffer.from(raw).toString("hex")}`;
+                }
+            }
+            else {
+                msgStr = String(message);
+            }
+            const result = await client.signMessage(msgStr);
+            return result.signature;
+        },
+        async signTransaction(transaction) {
+            // Build a signing request for Steward
+            const to = transaction.to ?? "0x0000000000000000000000000000000000000000";
+            const value = transaction.value?.toString() ?? "0";
+            // Serialize calldata if present
+            const data = transaction.data;
+            const result = await client.signTransaction({
+                to,
+                value,
+                data,
+                chainId: transaction.chainId,
+                nonce: transaction.nonce,
+                gas: transaction.gas?.toString(),
+                maxFeePerGas: transaction.maxFeePerGas?.toString(),
+                maxPriorityFeePerGas: transaction.maxPriorityFeePerGas?.toString(),
+                broadcast: false, // We want the signed tx back, not a broadcast
+            });
+            if (result.signedTx) {
+                return result.signedTx;
+            }
+            // If Steward returned a txHash instead (auto-broadcast), wrap it
+            if (result.txHash) {
+                console.warn("[StewardAccount] Steward auto-broadcast tx despite broadcast=false. Hash:", result.txHash);
+                // Return the hash — callers will need to handle this edge case
+                return result.txHash;
+            }
+            throw new Error("[StewardAccount] signTransaction returned neither signedTx nor txHash");
+        },
+        signTypedData: signTypedData,
+    });
+}
+// ─── Integration helper ──────────────────────────────────────────────────────
+/**
+ * Check if this runtime is a cloud-provisioned container that should use Steward signing.
+ */
+export function isStewardCloudProvisioned() {
+    return (process.env.ELIZA_CLOUD_PROVISIONED === "1" &&
+        !!process.env.STEWARD_AGENT_TOKEN &&
+        !!process.env.STEWARD_API_URL);
+}
+/**
+ * Resolve Steward config from environment variables.
+ * Returns null if not in cloud-provisioned mode.
+ */
+export function resolveStewardEvmConfig() {
+    if (!isStewardCloudProvisioned())
+        return null;
+    const apiUrl = process.env.STEWARD_API_URL;
+    const agentToken = process.env.STEWARD_AGENT_TOKEN;
+    if (!apiUrl || !agentToken)
+        return null;
+    // Agent ID can come from the JWT payload or env var
+    const agentId = process.env.STEWARD_AGENT_ID ||
+        process.env.ELIZA_STEWARD_AGENT_ID ||
+        extractAgentIdFromJwt(agentToken) ||
+        "";
+    if (!agentId) {
+        console.warn("[StewardAccount] No agent ID found in env or JWT token");
+        return null;
+    }
+    // Address will be fetched later from API
+    return {
+        apiUrl,
+        agentToken,
+        agentId,
+        address: "0x0000000000000000000000000000000000000000", // placeholder
+    };
+}
+/**
+ * Extract agentId from a JWT token's payload (without verification).
+ * Steward JWTs typically have { sub: agentId, ... } or { agentId: "..." }.
+ */
+function extractAgentIdFromJwt(token) {
+    try {
+        const parts = token.split(".");
+        if (parts.length !== 3)
+            return null;
+        const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
+        return payload.agentId || payload.sub || null;
+    }
+    catch {
+        return null;
+    }
+}
+// ─── Full initialization helper ──────────────────────────────────────────────
+/**
+ * Initialize a Steward-backed viem Account. Fetches the wallet address from the API.
+ * Returns null if Steward is unavailable (allows fallback to local key).
+ */
+export async function initStewardEvmAccount() {
+    const config = resolveStewardEvmConfig();
+    if (!config)
+        return null;
+    try {
+        console.log("[StewardAccount] Cloud-provisioned mode detected, fetching wallet address...");
+        const address = await fetchStewardWalletAddress(config.apiUrl, config.agentToken, config.agentId);
+        config.address = address;
+        console.log(`[StewardAccount] Wallet address: ${address}`);
+        const account = createStewardEvmAccount(config);
+        console.log("[StewardAccount] ✓ Steward signing proxy ready");
+        return account;
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`[StewardAccount] Failed to initialize: ${msg}`);
+        console.warn("[StewardAccount] Falling back to local key signing");
+        return null;
+    }
+}

package/apps/app-steward/src/services/steward-evm-bridge.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Steward EVM Bridge — intercepts plugin-evm initialization in cloud-provisioned
+ * containers to route signing through Steward API instead of local private keys.
+ *
+ * Strategy:
+ *   1. Before the runtime starts plugins, check if we're in cloud-provisioned mode
+ *   2. If so, create a Steward viem Account
+ *   3. Inject a synthetic EVM_PRIVATE_KEY setting so initWalletProvider doesn't
+ *      generate a random key, then immediately replace the account on the
+ *      WalletProvider after EVMService starts
+ *
+ * This module exports a boot hook that should be called early in the runtime
+ * initialization, before plugins are loaded.
+ */
+import type { IAgentRuntime } from "@elizaos/core";
+/**
+ * Pre-boot hook: call before plugins are loaded.
+ * Sets a dummy EVM_PRIVATE_KEY if in Steward cloud mode so that initWalletProvider
+ * doesn't auto-generate and persist a random key.
+ */
+export declare function stewardEvmPreBoot(runtime: IAgentRuntime): Promise<void>;
+/**
+ * Post-boot hook: call after plugins have started.
+ * Replaces the WalletProvider's account on the EVMService with the Steward account.
+ */
+export declare function stewardEvmPostBoot(runtime: IAgentRuntime): Promise<void>;
+/**
+ * Get the Steward account if initialized (for use by other services).
+ */
+export declare function getStewardEvmAccount(): import("viem").Account;
+/**
+ * Check if Steward EVM bridge is active.
+ */
+export declare function isStewardEvmBridgeActive(): boolean;
+//# sourceMappingURL=steward-evm-bridge.d.ts.map

package/apps/app-steward/src/services/steward-evm-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steward-evm-bridge.d.ts","sourceRoot":"","sources":["../../../../../../../apps/app-steward/src/services/steward-evm-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAgBnD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC7E;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAuCf;AAED;;GAEG;AACH,wBAAgB,oBAAoB,2BAEnC;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,OAAO,CAElD"}

package/apps/app-steward/src/services/steward-evm-bridge.js

@@ -0,0 +1,99 @@
+/**
+ * Steward EVM Bridge — intercepts plugin-evm initialization in cloud-provisioned
+ * containers to route signing through Steward API instead of local private keys.
+ *
+ * Strategy:
+ *   1. Before the runtime starts plugins, check if we're in cloud-provisioned mode
+ *   2. If so, create a Steward viem Account
+ *   3. Inject a synthetic EVM_PRIVATE_KEY setting so initWalletProvider doesn't
+ *      generate a random key, then immediately replace the account on the
+ *      WalletProvider after EVMService starts
+ *
+ * This module exports a boot hook that should be called early in the runtime
+ * initialization, before plugins are loaded.
+ */
+import { initStewardEvmAccount, isStewardCloudProvisioned, } from "./steward-evm-account";
+// A dummy private key that satisfies validation but won't be used for actual signing.
+// This is a well-known "zero" key — funds sent to its address are unrecoverable.
+// It's only used as a placeholder so initWalletProvider doesn't generate a random key.
+const DUMMY_PRIVATE_KEY = "0x0000000000000000000000000000000000000000000000000000000000000001";
+/** Stash the account globally so we can retrieve it in the post-start hook. */
+let _stewardAccount = null;
+let _initialized = false;
+/**
+ * Pre-boot hook: call before plugins are loaded.
+ * Sets a dummy EVM_PRIVATE_KEY if in Steward cloud mode so that initWalletProvider
+ * doesn't auto-generate and persist a random key.
+ */
+export async function stewardEvmPreBoot(runtime) {
+    if (!isStewardCloudProvisioned()) {
+        return;
+    }
+    console.log("[StewardEvmBridge] Cloud-provisioned mode detected");
+    try {
+        _stewardAccount = await initStewardEvmAccount();
+        if (_stewardAccount) {
+            // Set the dummy key so initWalletProvider doesn't generate a random one
+            // and doesn't try to persist it to the database
+            const existing = runtime.getSetting("EVM_PRIVATE_KEY");
+            if (!existing) {
+                runtime.setSetting("EVM_PRIVATE_KEY", DUMMY_PRIVATE_KEY);
+                console.log("[StewardEvmBridge] Set dummy EVM_PRIVATE_KEY placeholder");
+            }
+            // Expose the steward-managed address so getWalletAddresses() and
+            // resolveWalletCapabilityStatus() can discover it synchronously,
+            // even before initStewardWalletCache() runs.
+            const addr = _stewardAccount.address;
+            if (addr && addr !== "0x0000000000000000000000000000000000000000") {
+                process.env.ELIZA_MANAGED_EVM_ADDRESS = addr;
+                console.log(`[StewardEvmBridge] Set ELIZA_MANAGED_EVM_ADDRESS=${addr}`);
+            }
+            _initialized = true;
+        }
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`[StewardEvmBridge] Pre-boot failed: ${msg}`);
+        console.warn("[StewardEvmBridge] Plugin-evm will use default key behavior");
+    }
+}
+/**
+ * Post-boot hook: call after plugins have started.
+ * Replaces the WalletProvider's account on the EVMService with the Steward account.
+ */
+export async function stewardEvmPostBoot(runtime) {
+    if (!_initialized || !_stewardAccount) {
+        return;
+    }
+    try {
+        const evmService = runtime.getService("evm");
+        if (!evmService?.walletProvider) {
+            console.warn("[StewardEvmBridge] EVMService not found or no walletProvider — cannot inject Steward account");
+            return;
+        }
+        // Replace the account on the WalletProvider instance.
+        // WalletProvider stores the account as `this._account` (see initializeAccount).
+        // TypeScript doesn't expose it, but it's a simple property assignment.
+        const wp = evmService.walletProvider;
+        const oldAddress = evmService.walletProvider.getAddress?.();
+        wp._account = _stewardAccount;
+        const newAddress = evmService.walletProvider.getAddress?.();
+        console.log(`[StewardEvmBridge] ✓ Replaced EVM account: ${oldAddress} → ${newAddress} (Steward-backed)`);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`[StewardEvmBridge] Post-boot failed: ${msg}`);
+    }
+}
+/**
+ * Get the Steward account if initialized (for use by other services).
+ */
+export function getStewardEvmAccount() {
+    return _stewardAccount;
+}
+/**
+ * Check if Steward EVM bridge is active.
+ */
+export function isStewardEvmBridgeActive() {
+    return _initialized && _stewardAccount !== null;
+}

package/apps/app-training/src/core/cli.d.ts

@@ -0,0 +1,11 @@
+/**
+ * CLI entry point for the training data pipeline.
+ *
+ * Usage:
+ *   bun run packages/agent/src/training/cli.ts generate --variants 5 --output ./training-data
+ *   bun run packages/agent/src/training/cli.ts validate --input ./training-data/raw_samples.json
+ *   bun run packages/agent/src/training/cli.ts export-trajectories --output ./training-data/trajectories.jsonl
+ *   bun run packages/agent/src/training/cli.ts tune --project my-gcp-project --bucket my-bucket --model flash-lite --data ./training-data/should_respond_training.jsonl
+ */
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/apps/app-training/src/core/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../../../../../../apps/app-training/src/core/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}