@elizaos/agent 2.0.0-alpha.173 → 2.0.0-alpha.192

package/packages/agent/src/runtime/trajectory-storage.js

@@ -6,7 +6,7 @@
  */
 import path from "node:path";
 import { logger as coreLogger, Service, } from "@elizaos/core";
-import { asRecord, computeBySource, createBaseTrajectory, enqueueStepWrite, enrichTrajectoryLlmCall, ensureStep, ensureTrajectoriesTable, executeRawSql, extractInsightsFromResponse, extractRows, hasRuntimeDb, lastWritePromises, loadTrajectoryById, mergeMetadata, normalizeLlmCallPayload, normalizeProviderAccessPayload, normalizeStatus, normalizeStepId, normalizeTrajectoryMetadata, parseMetadata, patchedLoggers, pushChatExchange, readOrchestratorTrajectoryContext, resolveTrajectoryArchiveDirectory, resolveTrajectoryLogger, saveTrajectory, shouldEnableTrajectoryLoggingByDefault, shouldRunObservationExtraction, shouldSuppressNoInputEmbeddingCall, sqlQuote, stepWriteQueues, toArchiveSafeTimestamp, toNumber, toOptionalNumber, toText, truncateRecord, warnRuntime, writeCompressedJsonlRows, } from "./trajectory-internals.js";
+import { asRecord, capScriptForPersistence, computeBySource, createBaseTrajectory, enqueueStepWrite, enrichTrajectoryLlmCall, ensureStep, ensureTrajectoriesTable, executeRawSql, extractInsightsFromResponse, extractRows, hasRuntimeDb, lastWritePromises, loadTrajectoryById, mergeMetadata, normalizeLlmCallPayload, normalizeProviderAccessPayload, normalizeStatus, normalizeStepId, normalizeTrajectoryMetadata, parseMetadata, patchedLoggers, pushChatExchange, readOrchestratorTrajectoryContext, resolveTrajectoryArchiveDirectory, resolveTrajectoryLogger, saveTrajectory, shouldEnableTrajectoryLoggingByDefault, shouldRunObservationExtraction, shouldSuppressNoInputEmbeddingCall, sqlQuote, stepWriteQueues, toArchiveSafeTimestamp, toNumber, toOptionalNumber, toText, truncateRecord, warnRuntime, writeCompressedJsonlRows, } from "./trajectory-internals.js";
 // ---------------------------------------------------------------------------
 // appendLlmCall / appendProviderAccess
 // ---------------------------------------------------------------------------
@@ -117,6 +117,35 @@ async function appendProviderAccess(runtime, stepId, params) {
     trajectory.updatedAt = new Date(now).toISOString();
     await saveTrajectory(runtime, trajectory);
 }
+/**
+ * Fire-and-forget notification to the optional TrainingTriggerService.
+ *
+ * Registered by `@elizaos/app-core` when `@elizaos/app-training` is installed
+ * (see `runtime/eliza.ts` → `registerTrackCTrainingCrons`). Slim installs
+ * never register the service and this resolves to a no-op.
+ *
+ * Errors are logged at debug level only — auto-train counter increments
+ * must never block or break trajectory persistence.
+ */
+function notifyTrainingTrigger(runtime, trajectoryId) {
+    const services = runtime.services;
+    if (!services)
+        return;
+    const entries = services.get("TRAINING_TRIGGER_SERVICE");
+    if (!Array.isArray(entries) || entries.length === 0)
+        return;
+    const entry = entries[0];
+    if (!entry ||
+        typeof entry !== "object" ||
+        typeof entry
+            .notifyTrajectoryCompleted !== "function") {
+        return;
+    }
+    const trigger = entry;
+    void trigger.notifyTrajectoryCompleted(trajectoryId).catch((err) => {
+        coreLogger.debug?.(`[trajectory-storage] training trigger notify failed for ${trajectoryId}: ${err instanceof Error ? err.message : String(err)}`);
+    });
+}
 // ---------------------------------------------------------------------------
 // writeStartedTrajectoryStep / writeCompletedTrajectoryStep
 // ---------------------------------------------------------------------------
@@ -339,6 +368,12 @@ export async function installDatabaseTrajectoryLogger(runtime) {
                 stepId: stepIdOrTrajectoryId,
                 status: status,
             });
+            // Notify the auto-train trigger service (registered by app-core when
+            // app-training is installed). Optional — the chain is a no-op if the
+            // service was never registered, which is the case for slim installs.
+            if (status === "completed") {
+                notifyTrainingTrigger(runtime, stepIdOrTrajectoryId);
+            }
         });
         const runtimeKey = runtime;
         lastWritePromises.set(runtimeKey, writePromise);
@@ -395,6 +430,17 @@ export async function installDatabaseTrajectoryLogger(runtime) {
                 timestamp: step.timestamp,
                 llmCalls: step.llmCalls.map((call) => enrichTrajectoryLlmCall(call)),
                 providerAccesses: step.providerAccesses,
+                ...(step.kind !== undefined ? { kind: step.kind } : {}),
+                ...(step.childSteps !== undefined
+                    ? { childSteps: step.childSteps }
+                    : {}),
+                ...(step.script !== undefined ? { script: step.script } : {}),
+                ...(step.scriptHash !== undefined
+                    ? { scriptHash: step.scriptHash }
+                    : {}),
+                ...(step.usedSkills !== undefined
+                    ? { usedSkills: step.usedSkills }
+                    : {}),
             })),
             metrics: { finalStatus: persisted.status },
             metadata: persisted.metadata,
@@ -556,6 +602,64 @@ export async function startTrajectoryStepInDatabase({ runtime, stepId, source, m
     });
     return true;
 }
+/**
+ * Annotate an existing trajectory step with the structural metadata Track A
+ * relies on (kind discriminator, executeCode script, child step IDs, used
+ * skills). Safe to call for any of the new trajectory step fields; passing
+ * `undefined` for a field leaves the existing value alone, while passing an
+ * explicit value overwrites.
+ */
+export async function annotateTrajectoryStep({ runtime, stepId, kind, script, childSteps, appendChildSteps, usedSkills, }) {
+    if (!hasRuntimeDb(runtime))
+        return false;
+    const normalizedStepId = normalizeStepId(stepId);
+    if (!normalizedStepId)
+        return false;
+    const tableReady = await ensureTrajectoriesTable(runtime);
+    if (!tableReady)
+        return false;
+    await enqueueStepWrite(runtime, normalizedStepId, async () => {
+        const now = Date.now();
+        const trajectory = (await loadTrajectoryById(runtime, normalizedStepId)) ??
+            createBaseTrajectory(normalizedStepId, now);
+        const step = ensureStep(trajectory, normalizedStepId, now);
+        if (kind !== undefined) {
+            step.kind = kind;
+        }
+        if (script !== undefined) {
+            const capped = capScriptForPersistence(script);
+            step.script = capped.script;
+            if (capped.scriptHash !== undefined) {
+                step.scriptHash = capped.scriptHash;
+            }
+            else {
+                step.scriptHash = undefined;
+            }
+        }
+        if (childSteps !== undefined) {
+            step.childSteps = [...childSteps];
+        }
+        if (appendChildSteps && appendChildSteps.length > 0) {
+            const seen = new Set(step.childSteps ?? []);
+            const merged = step.childSteps ? [...step.childSteps] : [];
+            for (const child of appendChildSteps) {
+                const trimmed = typeof child === "string" ? child.trim() : "";
+                if (!trimmed || seen.has(trimmed))
+                    continue;
+                seen.add(trimmed);
+                merged.push(trimmed);
+            }
+            step.childSteps = merged;
+        }
+        if (usedSkills !== undefined) {
+            step.usedSkills = [...usedSkills];
+        }
+        trajectory.endTime = Math.max(trajectory.endTime ?? now, now);
+        trajectory.updatedAt = new Date(now).toISOString();
+        await saveTrajectory(runtime, trajectory);
+    });
+    return true;
+}
 export async function completeTrajectoryStepInDatabase({ runtime, stepId, status = "completed", source, metadata, }) {
     if (!hasRuntimeDb(runtime))
         return false;
@@ -705,6 +809,14 @@ export class DatabaseTrajectoryLogger extends Service {
     startStep(trajectoryId) {
         return trajectoryId;
     }
+    async annotateStep(params) {
+        if (!this.enabled)
+            return;
+        await annotateTrajectoryStep({
+            runtime: this.runtime,
+            ...params,
+        });
+    }
     async endTrajectory(stepIdOrTrajectoryId, status = "completed") {
         if (!this.enabled)
             return;
@@ -808,6 +920,17 @@ export class DatabaseTrajectoryLogger extends Service {
                 timestamp: step.timestamp,
                 llmCalls: step.llmCalls.map((call) => enrichTrajectoryLlmCall(call)),
                 providerAccesses: step.providerAccesses,
+                ...(step.kind !== undefined ? { kind: step.kind } : {}),
+                ...(step.childSteps !== undefined
+                    ? { childSteps: step.childSteps }
+                    : {}),
+                ...(step.script !== undefined ? { script: step.script } : {}),
+                ...(step.scriptHash !== undefined
+                    ? { scriptHash: step.scriptHash }
+                    : {}),
+                ...(step.usedSkills !== undefined
+                    ? { usedSkills: step.usedSkills }
+                    : {}),
             })),
             metrics: { finalStatus: persisted.status },
             metadata: persisted.metadata,

package/packages/agent/src/runtime/web-search-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-search-tools.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/web-search-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAiIlD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CA8CrE"}
+{"version":3,"file":"web-search-tools.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/web-search-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AA6HlD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CA8CrE"}

package/packages/agent/src/security/access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../../../src/security/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAG3D,sDAAsD;AACtD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAkChE,wBAAgB,WAAW,CACzB,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAMT;AA0BD,wBAAsB,cAAc,CAClC,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAAC,OAAO,CAAC,CAgClB;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAAC,OAAO,CAAC,CAgClB;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAAC,OAAO,CAAC,CAgClB;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,OAAO,CAAC,CA2ClB"}
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../../../src/security/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAO3D,sDAAsD;AACtD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAkChE,wBAAgB,WAAW,CACzB,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAMT;AAcD,wBAAsB,cAAc,CAClC,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,OAAO,CAAC,CA+BlB"}

package/packages/agent/src/security/access.js

@@ -1,4 +1,4 @@
-import * as roles from "@elizaos/core";
+import { checkSenderPrivateAccess, checkSenderRole, resolveCanonicalOwnerIdForMessage, } from "@elizaos/core";
 const ROLE_RANK = {
     GUEST: 0,
     USER: 1,
@@ -26,12 +26,8 @@ export function isAgentSelf(runtime, message) {
     return context.message.entityId === context.runtime.agentId;
 }
 async function isCanonicalOwner(runtime, message) {
-    const resolveOwner = roles.resolveCanonicalOwnerIdForMessage;
-    if (typeof resolveOwner !== "function") {
-        return false;
-    }
     try {
-        const ownerId = await resolveOwner(runtime, message);
+        const ownerId = await resolveCanonicalOwnerIdForMessage(runtime, message);
         return typeof ownerId === "string" && ownerId === message.entityId;
     }
     catch {
@@ -49,12 +45,8 @@ export async function hasOwnerAccess(runtime, message) {
     if (await isCanonicalOwner(context.runtime, context.message)) {
         return true;
     }
-    const checkRole = roles.checkSenderRole;
-    if (typeof checkRole !== "function") {
-        return false;
-    }
     try {
-        const role = await checkRole(context.runtime, context.message);
+        const role = await checkSenderRole(context.runtime, context.message);
         return role?.isOwner === true;
     }
     catch {
@@ -72,12 +64,8 @@ export async function hasAdminAccess(runtime, message) {
     if (await isCanonicalOwner(context.runtime, context.message)) {
         return true;
     }
-    const checkRole = roles.checkSenderRole;
-    if (typeof checkRole !== "function") {
-        return false;
-    }
     try {
-        const role = await checkRole(context.runtime, context.message);
+        const role = await checkSenderRole(context.runtime, context.message);
         return role?.isAdmin === true;
     }
     catch {
@@ -95,12 +83,8 @@ export async function hasPrivateAccess(runtime, message) {
     if (await isCanonicalOwner(context.runtime, context.message)) {
         return true;
     }
-    const checkPrivateAccess = roles.checkSenderPrivateAccess;
-    if (typeof checkPrivateAccess !== "function") {
-        return false;
-    }
     try {
-        const access = await checkPrivateAccess(context.runtime, context.message);
+        const access = await checkSenderPrivateAccess(context.runtime, context.message);
         return access?.hasPrivateAccess === true;
     }
     catch {
@@ -129,12 +113,8 @@ export async function hasRoleAccess(runtime, message, requiredRole) {
     if (await isCanonicalOwner(context.runtime, context.message)) {
         return true;
     }
-    const checkRole = roles.checkSenderRole;
-    if (typeof checkRole !== "function") {
-        return false;
-    }
     try {
-        const result = await checkRole(context.runtime, context.message);
+        const result = await checkSenderRole(context.runtime, context.message);
         if (!result) {
             // No world context — allow through (same lenient fallback as plugin-role-gating)
             return true;

package/packages/agent/src/security/audit-log.d.ts

@@ -29,8 +29,6 @@ export type AuditFeedSubscriber = (entry: AuditEntry) => void;
 export declare function queryAuditFeed(query?: AuditFeedQuery): AuditEntry[];
 export declare function getAuditFeedSize(): number;
 export declare function subscribeAuditFeed(subscriber: AuditFeedSubscriber): () => void;
-/** @internal Test-only helper to isolate process-wide audit state between specs. */
-export declare function __resetAuditFeedForTests(): void;
 export declare class SandboxAuditLog {
     private entries;
     private consoleEnabled;

package/packages/agent/src/security/audit-log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../../src/security/audit-log.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,iBAAiB,mVAapB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChE,eAAO,MAAM,gBAAgB,gDAAiD,CAAC;AAC/E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAQ9D,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IAC5D,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;AAoC9D,wBAAgB,cAAc,CAAC,KAAK,GAAE,cAAmB,GAAG,UAAU,EAAE,CAoBvE;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,mBAAmB,GAC9B,MAAM,IAAI,CAKZ;AAED,oFAAoF;AACpF,wBAAgB,wBAAwB,IAAI,IAAI,CAG/C;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAoB;IACnC,OAAO,CAAC,cAAc,CAAU;IAChC,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,IAAI,CAAC,CAA8B;gBAE/B,MAAM,GAAE,cAAmB;IAMvC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,IAAI;IAkBlD,sBAAsB,CACpB,SAAS,EAAE,UAAU,GAAG,SAAS,EACjC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAAE,GACjB,IAAI;IAiBP,0BAA0B,CACxB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GACnD,IAAI;IASP,oBAAoB,CAClB,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GACnD,IAAI;IASP,SAAS,CAAC,KAAK,SAAM,GAAG,UAAU,EAAE;IAIpC,SAAS,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,SAAK,GAAG,UAAU,EAAE;IAIzD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,KAAK,IAAI,IAAI;CAGd"}
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../../src/security/audit-log.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,iBAAiB,mVAapB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChE,eAAO,MAAM,gBAAgB,gDAAiD,CAAC;AAC/E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAQ9D,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IAC5D,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;AAoC9D,wBAAgB,cAAc,CAAC,KAAK,GAAE,cAAmB,GAAG,UAAU,EAAE,CAoBvE;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,mBAAmB,GAC9B,MAAM,IAAI,CAKZ;AAQD,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAoB;IACnC,OAAO,CAAC,cAAc,CAAU;IAChC,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,IAAI,CAAC,CAA8B;gBAE/B,MAAM,GAAE,cAAmB;IAMvC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,IAAI;IAkBlD,sBAAsB,CACpB,SAAS,EAAE,UAAU,GAAG,SAAS,EACjC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAAE,GACjB,IAAI;IAiBP,0BAA0B,CACxB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GACnD,IAAI;IASP,oBAAoB,CAClB,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GACnD,IAAI;IASP,SAAS,CAAC,KAAK,SAAM,GAAG,UAAU,EAAE;IAIpC,SAAS,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,SAAK,GAAG,UAAU,EAAE;IAIzD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,KAAK,IAAI,IAAI;CAGd"}

package/packages/agent/src/security/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./access.js";
 export * from "./audit-log.js";
 export * from "./network-policy.js";
 //# sourceMappingURL=index.d.ts.map

package/packages/agent/src/security/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/security/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/security/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC"}

package/packages/agent/src/security/index.js

@@ -1,2 +1,3 @@
+export * from "./access.js";
 export * from "./audit-log.js";
 export * from "./network-policy.js";

package/packages/agent/src/services/app-manager.d.ts

@@ -14,6 +14,19 @@ import type { InstallProgressLike, PluginManagerLike, RegistryPluginInfo, Regist
 export type { AppLaunchResult, AppRunActionResult, AppRunSummary, AppStopResult, AppViewerAuthMessage, InstalledAppInfo, } from "../contracts/apps.js";
 interface AppManagerOptions {
     stateDir?: string;
+    /**
+     * How long a run can go without a heartbeat before the sweeper reaps it.
+     * Defaults to {@link RUN_HEARTBEAT_TIMEOUT_MS}. Tests override to a small
+     * value to exercise the sweeper deterministically.
+     */
+    heartbeatTimeoutMs?: number;
+    /**
+     * How often the sweeper wakes. Defaults to
+     * {@link RUN_HEARTBEAT_SWEEP_INTERVAL_MS}. Tests can use a small value or
+     * call {@link AppManager.reapStaleRuns} directly instead of starting the
+     * sweeper interval.
+     */
+    heartbeatSweepIntervalMs?: number;
 }
 export declare class AppManager {
     private readonly activeSessions;
@@ -21,8 +34,47 @@ export declare class AppManager {
     private readonly runRefreshAt;
     private readonly runRefreshInFlight;
     private readonly stateDir?;
+    private readonly heartbeatTimeoutMs;
+    private readonly heartbeatSweepIntervalMs;
     private appRuns;
+    private sweeperTimer;
+    private sweeperRuntimeFn;
+    private sweeperReapInFlight;
     constructor(options?: AppManagerOptions);
+    /**
+     * Bump a run's `lastHeartbeatAt` to "now" without invoking any plugin
+     * routes. Returns the updated run, or `null` if the runId is unknown.
+     *
+     * The UI calls this on a short interval while the GameView is mounted so
+     * the sweeper knows the tab is still alive. When the tab goes away the
+     * heartbeat stops and {@link reapStaleRuns} reclaims the run after
+     * `heartbeatTimeoutMs`.
+     */
+    recordHeartbeat(runId: string): AppRunSummary | null;
+    /**
+     * Stop and remove every run whose last heartbeat is older than
+     * `heartbeatTimeoutMs`. Runs that never received a heartbeat (no UI ever
+     * attached) are reaped only once they are also older than the timeout to
+     * avoid racing with the launch -> first-poll window.
+     *
+     * For each reaped run the route module's `stopRun` hook is invoked the
+     * same way the explicit Stop button does — so plugins get a single,
+     * uniform shutdown path regardless of why a run is going away.
+     */
+    reapStaleRuns(runtime: IAgentRuntime | null, nowMs?: number): Promise<AppRunSummary[]>;
+    /**
+     * Start the periodic stale-run sweeper. Idempotent — calling twice does
+     * not start two timers. The runtime is resolved lazily via `getRuntime`
+     * so the sweeper picks up runtime changes (e.g. agent restart) without
+     * needing to be re-wired.
+     *
+     * The interval is wrapped in `unref()` so a stuck sweeper never keeps a
+     * Node process alive on shutdown.
+     */
+    startStaleRunSweeper(getRuntime: () => IAgentRuntime | null): void;
+    /** Stop the periodic stale-run sweeper. Safe to call multiple times. */
+    stopStaleRunSweeper(): void;
+    private runSweeperTick;
     private persistRuns;
     private listRunsSorted;
     private storeRun;
@@ -49,7 +101,7 @@ export declare class AppManager {
      * handle this by showing "connecting..." while the runtime restarts.
      */
     launch(pluginManager: PluginManagerLike, name: string, onProgress?: (progress: InstallProgressLike) => void, _runtime?: IAgentRuntime | null): Promise<AppLaunchResult>;
-    stop(pluginManager: PluginManagerLike, name: string, runId?: string): Promise<AppStopResult>;
+    stop(pluginManager: PluginManagerLike, name: string, runId?: string, runtime?: IAgentRuntime | null): Promise<AppStopResult>;
     /** List apps whose plugins are currently installed on the agent. */
     listInstalled(pluginManager: PluginManagerLike): Promise<InstalledAppInfo[]>;
 }

package/packages/agent/src/services/app-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-manager.d.ts","sourceRoot":"","sources":["../../../../../src/services/app-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EAIvB,KAAK,aAAa,EAGlB,KAAK,aAAa,EAKlB,KAAK,gBAAgB,EAItB,MAAM,sBAAsB,CAAC;AAU9B,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,2BAA2B,CAAC;AAUnC,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAoE9B,UAAU,iBAAiB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAm9DD,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuC;IACtE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAG/B;IACJ,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,OAAO,CAAC,OAAO,CAAoC;gBAEvC,OAAO,GAAE,iBAAsB;IAQ3C,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,SAAS;IAWjB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,eAAe;IAavB,OAAO,CAAC,oBAAoB;YAMd,iBAAiB;YA+FjB,UAAU;IAuBlB,aAAa,CACjB,aAAa,EAAE,iBAAiB,GAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAS1B,MAAM,CACV,aAAa,EAAE,iBAAiB,EAChC,KAAK,EAAE,MAAM,EACb,KAAK,SAAK,GACT,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAkB5B,OAAO,CACX,aAAa,EAAE,iBAAiB,EAChC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAO/B,QAAQ,CACZ,OAAO,GAAE,aAAa,GAAG,IAAW,GACnC,OAAO,CAAC,aAAa,EAAE,CAAC;IAYrB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,aAAa,GAAG,IAAW,GACnC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAQ1B,SAAS,CACb,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,aAAa,GAAG,IAAW,GACnC,OAAO,CAAC,kBAAkB,CAAC;IAuCxB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAoC3D;;;;;;;;OAQG;IACG,MAAM,CACV,aAAa,EAAE,iBAAiB,EAChC,IAAI,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,mBAAmB,KAAK,IAAI,EACpD,QAAQ,CAAC,EAAE,aAAa,GAAG,IAAI,GAC9B,OAAO,CAAC,eAAe,CAAC;IA4LrB,IAAI,CACR,aAAa,EAAE,iBAAiB,EAChC,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,aAAa,CAAC;IA2EzB,oEAAoE;IAC9D,aAAa,CACjB,aAAa,EAAE,iBAAiB,GAC/B,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAuC/B"}
+{"version":3,"file":"app-manager.d.ts","sourceRoot":"","sources":["../../../../../src/services/app-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAU,MAAM,eAAe,CAAC;AAE3D,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EAIvB,KAAK,aAAa,EAGlB,KAAK,aAAa,EAKlB,KAAK,gBAAgB,EAItB,MAAM,sBAAsB,CAAC;AAU9B,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,2BAA2B,CAAC;AAcnC,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AA6E9B,UAAU,iBAAiB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAkgED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuC;IACtE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAG/B;IACJ,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAS;IAClD,OAAO,CAAC,OAAO,CAAoC;IACnD,OAAO,CAAC,YAAY,CAA+C;IACnE,OAAO,CAAC,gBAAgB,CAA6C;IACrE,OAAO,CAAC,mBAAmB,CAAS;gBAExB,OAAO,GAAE,iBAAsB;IAY3C;;;;;;;;OAQG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAapD;;;;;;;;;OASG;IACG,aAAa,CACjB,OAAO,EAAE,aAAa,GAAG,IAAI,EAC7B,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,aAAa,EAAE,CAAC;IAsB3B;;;;;;;;OAQG;IACH,oBAAoB,CAAC,UAAU,EAAE,MAAM,aAAa,GAAG,IAAI,GAAG,IAAI;IAWlE,wEAAwE;IACxE,mBAAmB,IAAI,IAAI;YAMb,cAAc;IAc5B,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,SAAS;IAWjB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,eAAe;IAavB,OAAO,CAAC,oBAAoB;YAMd,iBAAiB;YA+FjB,UAAU;IAuBlB,aAAa,CACjB,aAAa,EAAE,iBAAiB,GAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAS1B,MAAM,CACV,aAAa,EAAE,iBAAiB,EAChC,KAAK,EAAE,MAAM,EACb,KAAK,SAAK,GACT,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAkB5B,OAAO,CACX,aAAa,EAAE,iBAAiB,EAChC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAO/B,QAAQ,CACZ,OAAO,GAAE,aAAa,GAAG,IAAW,GACnC,OAAO,CAAC,aAAa,EAAE,CAAC;IAYrB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,aAAa,GAAG,IAAW,GACnC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAQ1B,SAAS,CACb,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,aAAa,GAAG,IAAW,GACnC,OAAO,CAAC,kBAAkB,CAAC;IAuCxB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAoC3D;;;;;;;;OAQG;IACG,MAAM,CACV,aAAa,EAAE,iBAAiB,EAChC,IAAI,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,mBAAmB,KAAK,IAAI,EACpD,QAAQ,CAAC,EAAE,aAAa,GAAG,IAAI,GAC9B,OAAO,CAAC,eAAe,CAAC;IA4PrB,IAAI,CACR,aAAa,EAAE,iBAAiB,EAChC,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,GAC7B,OAAO,CAAC,aAAa,CAAC;IA8EzB,oEAAoE;IAC9D,aAAa,CACjB,aAAa,EAAE,iBAAiB,GAC/B,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAuC/B"}