@elizaos/agent 2.0.0-alpha.358 → 2.0.0-alpha.376

package/packages/agent/src/api/memory-routes.js

@@ -3,6 +3,7 @@ import { ChannelType, createMessageMemory, ModelType, stringToUuid, } from "@eli
 import { parsePositiveInteger } from "../utils/number-parsing.js";
 import { getKnowledgeService, } from "./knowledge-service-loader.js";
 const HASH_MEMORY_SOURCE = "hash_memory";
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const MEMORY_SEARCH_SCAN_LIMIT = 500;
 const MEMORY_SEARCH_DEFAULT_LIMIT = 10;
 const MEMORY_SEARCH_MAX_LIMIT = 50;
@@ -401,6 +402,68 @@ export async function handleMemoryRoutes(ctx) {
         });
         return true;
     }
+    // ── Memory mutation by id ─────────────────────────────────────────────
+    // DELETE /api/memories/:id and PATCH /api/memories/:id operate on the bare
+    // id segment. Path matching only fires when the segment looks like a UUID,
+    // which keeps the literal sibling routes (`feed`, `browse`, `stats`,
+    // `by-entity/...`) unambiguous.
+    const memoryIdMatch = /^\/api\/memories\/([^/]+)$/.exec(pathname);
+    if (memoryIdMatch && (method === "DELETE" || method === "PATCH")) {
+        const rawId = decodeURIComponent(memoryIdMatch[1] ?? "");
+        if (!UUID_REGEX.test(rawId)) {
+            error(res, "Invalid memory id.", 400);
+            return true;
+        }
+        const memoryId = rawId;
+        const existing = await runtime.getMemoryById(memoryId);
+        if (!existing) {
+            error(res, "Memory not found.", 404);
+            return true;
+        }
+        if (method === "DELETE") {
+            await runtime.deleteMemory(memoryId);
+            json(res, { deleted: true, id: memoryId });
+            return true;
+        }
+        // PATCH — update text, regenerate embedding, then atomically persist
+        // both via runtime.updateMemory (the SQL adapter writes content +
+        // embedding in a single transaction). If embedding generation fails we
+        // return 500 *before* touching the database, so there is nothing to roll
+        // back.
+        const body = await readJsonBody(req, res);
+        if (!body)
+            return true;
+        const text = typeof body.text === "string" ? body.text.trim() : "";
+        if (!text) {
+            error(res, "text is required", 400);
+            return true;
+        }
+        const existingContent = existing.content ?? {};
+        const nextContent = { ...existingContent, text };
+        let embedding;
+        try {
+            embedding = await runtime.useModel(ModelType.TEXT_EMBEDDING, {
+                text,
+            });
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            error(res, `Failed to regenerate embedding: ${detail}`, 500);
+            return true;
+        }
+        if (!Array.isArray(embedding) || embedding.length === 0) {
+            error(res, "Embedding model returned no vector.", 500);
+            return true;
+        }
+        await runtime.updateMemory({
+            id: memoryId,
+            content: nextContent,
+            embedding,
+        });
+        const updated = await runtime.getMemoryById(memoryId);
+        json(res, { updated: true, id: memoryId, memory: updated });
+        return true;
+    }
     if (method === "GET" && pathname === "/api/memories/stats") {
         const counts = {};
         let total = 0;

package/packages/agent/src/api/misc-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"misc-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/misc-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAKlC,OAAO,EAAE,KAAK,YAAY,EAAqB,MAAM,eAAe,CAAC;AAErE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAcvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAO7D,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,KAAK,sBAAsB,GAAG;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAwCF,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC;IAC1B,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,KAAK,EAAE;QACL,MAAM,EAAE,WAAW,CAAC;QACpB,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;QAClC,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;QAC9C,qBAAqB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QACjE,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,mBAAmB,EAAE,CAAC;QACnC,gBAAgB,EAAE,KAAK,CAAC;YACtB,EAAE,EAAE,MAAM,CAAC;YACX,MAAM,EAAE,MAAM,CAAC;YACf,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,GAAG,CAAC,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,eAAe,EAAE,MAAM,CAAC;YACxB,UAAU,EAAE,MAAM,CAAC;SACpB,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;QAC7B,qBAAqB,EAAE,MAAM,EAAE,CAAC;KACjC,CAAC;IACF,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzE,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5E,YAAY,EAAE,CAAC,CAAC,SAAS,MAAM,EAC7B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,OAAO,CAAC,EAAE,mBAAmB,KAC1B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,2BAA2B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,2BAA2B,EAAE,CAC3B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,sBAAsB,KACzB;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/C,0BAA0B,EAAE,CAC1B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,sBAAsB,KACzB,MAAM,GAAG,IAAI,CAAC;IACnB,wBAAwB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACxD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,yBAAyB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACpD;AAMD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,OAAO,CAAC,CAwrBlB"}
+{"version":3,"file":"misc-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/misc-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AASlC,OAAO,EAAE,KAAK,YAAY,EAAqB,MAAM,eAAe,CAAC;AAErE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAUvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAO7D,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,KAAK,sBAAsB,GAAG;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAwCF,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC;IAC1B,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,KAAK,EAAE;QACL,MAAM,EAAE,WAAW,CAAC;QACpB,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;QAClC,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;QAC9C,qBAAqB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QACjE,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,mBAAmB,EAAE,CAAC;QACnC,gBAAgB,EAAE,KAAK,CAAC;YACtB,EAAE,EAAE,MAAM,CAAC;YACX,MAAM,EAAE,MAAM,CAAC;YACf,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,GAAG,CAAC,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,eAAe,EAAE,MAAM,CAAC;YACxB,UAAU,EAAE,MAAM,CAAC;SACpB,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;QAC7B,qBAAqB,EAAE,MAAM,EAAE,CAAC;KACjC,CAAC;IACF,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzE,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5E,YAAY,EAAE,CAAC,CAAC,SAAS,MAAM,EAC7B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,OAAO,CAAC,EAAE,mBAAmB,KAC1B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,2BAA2B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,2BAA2B,EAAE,CAC3B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,sBAAsB,KACzB;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/C,0BAA0B,EAAE,CAC1B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,sBAAsB,KACzB,MAAM,GAAG,IAAI,CAAC;IACnB,wBAAwB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACxD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,yBAAyB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACpD;AAMD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,OAAO,CAAC,CAwrBlB"}

package/packages/agent/src/api/misc-routes.js

@@ -1,10 +1,10 @@
 import crypto from "node:crypto";
-import { EMOTE_BY_ID, EMOTE_CATALOG, } from "@elizaos/app-companion/emotes/catalog";
+import { EMOTE_BY_ID, EMOTE_CATALOG, } from "@elizaos/app-companion";
+import { ensurePrivyWalletsForCustomUser, isPrivyWalletProvisioningEnabled, } from "@elizaos/app-steward";
 import { logger, ModelType } from "@elizaos/core";
-import { asRecord } from "@elizaos/shared/type-guards";
+import { asRecord } from "@elizaos/shared";
 import { loadElizaConfig, saveElizaConfig } from "../config/config.js";
 import { buildTestHandler, registerCustomActionLive, } from "../runtime/custom-actions.js";
-import { ensurePrivyWalletsForCustomUser, isPrivyWalletProvisioningEnabled, } from "../services/privy-wallets.js";
 import { resolveTerminalRunLimits } from "./terminal-run-limits.js";
 function toTerminalRunRequestBody(body) {
     return {

package/packages/agent/src/api/onboarding-routes.js

@@ -1,5 +1,5 @@
 import { logger, stringToUuid } from "@elizaos/core";
-import { asRecord } from "@elizaos/shared/type-guards";
+import { asRecord } from "@elizaos/shared";
 import { configFileExists, loadElizaConfig } from "../config/config.js";
 import { isCloudInferenceSelectedInConfig, migrateLegacyRuntimeConfig, normalizeOnboardingCredentialInputs, } from "../contracts/onboarding.js";
 import { normalizeDeploymentTargetConfig, normalizeLinkedAccountsConfig, normalizeServiceRoutingConfig, } from "../contracts/service-routing.js";

package/packages/agent/src/api/parse-action-block.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-action-block.d.ts","sourceRoot":"","sources":["../../../../../src/api/parse-action-block.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IAChE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7D;AAED,+DAA+D;AAC/D,MAAM,WAAW,UAAU;IACzB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,WAAW,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AA+CD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkChE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,CA0B7E"}
+{"version":3,"file":"parse-action-block.d.ts","sourceRoot":"","sources":["../../../../../src/api/parse-action-block.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IAChE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7D;AAED,+DAA+D;AAC/D,MAAM,WAAW,UAAU;IACzB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,WAAW,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AA+CD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAmChE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,CA+B7E"}

package/packages/agent/src/api/parse-action-block.js

@@ -37,9 +37,10 @@ function isValidActionEnvelope(parsed) {
  * Handles both fenced (```json ... ```) and bare JSON formats.
  */
 export function stripActionBlockFromDisplay(text) {
+    const safeText = text.length > 100_000 ? text.slice(0, 100_000) : text;
     // First: fenced ```json action blocks — only strip if the action value is
     // one of our known orchestrator actions to avoid false-positive stripping.
-    let cleaned = text.replace(/```(?:json)?\s*\n?(\{[\s\S]*?"action"[\s\S]*?\})\s*\n?```/g, (_match, json) => {
+    let cleaned = safeText.replace(/```(?:json)?\s{0,32}\n?(\{[\s\S]{0,50000}?"action"[\s\S]{0,50000}?\})\s{0,32}\n?```/g, (_match, json) => {
         try {
             const parsed = JSON.parse(json);
             if (isValidActionEnvelope(parsed))
@@ -77,10 +78,12 @@ export function stripActionBlockFromDisplay(text) {
 export function parseActionBlock(text) {
     if (!text)
         return null;
+    const safeText = text.length > 100_000 ? text.slice(0, 100_000) : text;
     // Try fenced ```json block first
-    const fenced = text.match(/```(?:json)?\s*\n?(\{[\s\S]*?\})\s*\n?```/);
+    const fenced = safeText.match(/```(?:json)?\s{0,32}\n?(\{[\s\S]{0,50000}?\})\s{0,32}\n?```/);
     // Bare JSON fallback: non-greedy match from first { containing "action" to next }
-    const jsonStr = fenced?.[1] ?? text.match(/\{[^}]*"action"[^}]*\}/)?.[0];
+    const jsonStr = fenced?.[1] ??
+        safeText.match(/\{[^}]{0,50000}"action"[^}]{0,50000}\}/)?.[0];
     if (!jsonStr)
         return null;
     try {

package/packages/agent/src/api/permissions-routes.d.ts

@@ -1,5 +1,5 @@
 import type { AgentRuntime } from "@elizaos/core";
-import type { PermissionState } from "@elizaos/shared/contracts/permissions";
+import type { PermissionState } from "@elizaos/shared";
 import type { AutonomousConfigLike } from "../types/config-like.js";
 import type { RouteRequestContext } from "./route-helpers.js";
 interface PermissionAutonomousConfigLike extends AutonomousConfigLike {

package/packages/agent/src/api/permissions-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/permissions-routes.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,UAAU,8BAA+B,SAAQ,oBAAoB;IACnE,QAAQ,CAAC,EAAE;QACT,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;KACjD,CAAC;CACH;AAQD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,8BAA8B,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACnD,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,KAAK,EAAE,oBAAoB,CAAC;IAC5B,UAAU,EAAE,CAAC,MAAM,EAAE,8BAA8B,KAAK,IAAI,CAAC;IAC7D,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAClD;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,sBAAsB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAwNlB"}
+{"version":3,"file":"permissions-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/permissions-routes.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,UAAU,8BAA+B,SAAQ,oBAAoB;IACnE,QAAQ,CAAC,EAAE;QACT,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;KACjD,CAAC;CACH;AAQD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,8BAA8B,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACnD,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,KAAK,EAAE,oBAAoB,CAAC;IAC5B,UAAU,EAAE,CAAC,MAAM,EAAE,8BAA8B,KAAK,IAAI,CAAC;IAC7D,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAClD;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,sBAAsB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAwNlB"}

package/packages/agent/src/api/permissions-routes.js

@@ -1,4 +1,4 @@
-import { getSelfControlPermissionState, openSelfControlPermissionLocation, requestSelfControlPermission, } from "@elizaos/app-lifeops/public";
+import { getSelfControlPermissionState, openSelfControlPermissionLocation, requestSelfControlPermission, } from "@elizaos/app-lifeops";
 const WEBSITE_BLOCKING_PERMISSION_ID = "website-blocking";
 async function getWebsiteBlockingPermissionState() {
     return await getSelfControlPermissionState();

package/packages/agent/src/api/provider-switch-config.js

@@ -1,5 +1,5 @@
-import { applySubscriptionCredentials, deleteCredentials, } from "@elizaos/agent/auth";
-import { asNonEmptyString, asRecord } from "@elizaos/shared/type-guards";
+import { applySubscriptionCredentials, deleteCredentials, } from "@elizaos/agent";
+import { asNonEmptyString, asRecord } from "@elizaos/shared";
 import { SUBSCRIPTION_PROVIDER_MAP } from "../auth/types.js";
 import { deriveOnboardingCredentialPersistencePlan, getOnboardingProviderOption, getOnboardingProviderSignalEnvKeys, getStoredOnboardingProviderId, migrateLegacyRuntimeConfig, normalizeOnboardingCredentialInputs, normalizeOnboardingProviderId, requiresAdditionalRuntimeProvider, } from "../contracts/onboarding.js";
 import { buildDefaultElizaCloudServiceRouting, buildElizaCloudServiceRoute, normalizeDeploymentTargetConfig, normalizeServiceRoutingConfig, } from "../contracts/service-routing.js";

package/packages/agent/src/api/registry-service.d.ts

@@ -7,7 +7,7 @@
  * - Metadata (tokenURI) management
  * - Status queries
  */
-import type { TxService } from "@elizaos/app-steward/api/tx-service";
+import type { TxService } from "@elizaos/app-steward";
 export interface RegistryStatus {
     registered: boolean;
     tokenId: number;

package/packages/agent/src/api/registry-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-service.d.ts","sourceRoot":"","sources":["../../../../../src/api/registry-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAqCrE,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAQD,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;gBAE7B,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM;IAMzD,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,eAAe,IAAI,MAAM,CAE5B;IAEK,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAInC;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,CAAC;IA4C1C;;;OAGG;IACG,QAAQ,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA+C5E;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAqBrD;;OAEG;IACG,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAelB;;OAEG;IACH;;;OAGG;IACG,WAAW,CAAC,MAAM,EAAE;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,MAAM,CAAC;IAyBb,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIrD;;OAEG;IACH,MAAM,CAAC,uBAAuB,IAAI,MAAM;CAGzC"}
+{"version":3,"file":"registry-service.d.ts","sourceRoot":"","sources":["../../../../../src/api/registry-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAqCtD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAQD,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;gBAE7B,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM;IAMzD,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,eAAe,IAAI,MAAM,CAE5B;IAEK,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAInC;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,CAAC;IA4C1C;;;OAGG;IACG,QAAQ,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA+C5E;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAqBrD;;OAEG;IACG,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAelB;;OAEG;IACH;;;OAGG;IACG,WAAW,CAAC,MAAM,EAAE;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,MAAM,CAAC;IAyBb,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIrD;;OAEG;IACH,MAAM,CAAC,uBAAuB,IAAI,MAAM;CAGzC"}

package/packages/agent/src/api/runtime-plugin-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-plugin-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/runtime-plugin-routes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAA8B,MAAM,eAAe,CAAC;AAQ9E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAqB/B;AA4ED;;GAEG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,EAAE;IACzD,GAAG,EAAE,eAAe,CAAC;IACrB,GAAG,EAAE,cAAc,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,YAAY,EAAE,MAAM,OAAO,CAAC;CAC7B,GAAG,OAAO,CAAC,OAAO,CAAC,CAmDnB"}
+{"version":3,"file":"runtime-plugin-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/runtime-plugin-routes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAA8B,MAAM,eAAe,CAAC;AAS9E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAgC/B;AA8GD;;GAEG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,EAAE;IACzD,GAAG,EAAE,eAAe,CAAC;IACrB,GAAG,EAAE,cAAc,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,YAAY,EAAE,MAAM,OAAO,CAAC;CAC7B,GAAG,OAAO,CAAC,OAAO,CAAC,CAsDnB"}

package/packages/agent/src/api/runtime-plugin-routes.js

@@ -4,18 +4,32 @@
  * this bridge those handlers never run.
  */
 import { createPaymentAwareHandler, isRoutePaymentWrapped, } from "../middleware/x402/payment-wrapper.js";
+import { readJsonBody } from "./http-helpers.js";
 const EXPRESS_SHIM = Symbol("elizaExpressResponseShim");
 export function matchPluginRoutePath(pattern, pathname) {
     const norm = (p) => p.split("/").filter((s) => s.length > 0);
     const pSegs = norm(pattern);
     const pathSegs = norm(pathname);
-    if (pSegs.length !== pathSegs.length)
-        return null;
     const params = {};
     for (let i = 0; i < pSegs.length; i++) {
         const p = pSegs[i];
         const c = pathSegs[i];
-        if (!p || c === undefined)
+        if (!p)
+            return null;
+        if (p.startsWith(":") && p.endsWith("*")) {
+            const key = p.slice(1, -1);
+            const tail = pathSegs.slice(i).join("/");
+            if (!tail)
+                return null;
+            try {
+                params[key] = decodeURIComponent(tail);
+            }
+            catch {
+                params[key] = tail;
+            }
+            return params;
+        }
+        if (c === undefined)
             return null;
         if (p.startsWith(":")) {
             try {
@@ -29,7 +43,7 @@ export function matchPluginRoutePath(pattern, pathname) {
             return null;
         }
     }
-    return params;
+    return pSegs.length === pathSegs.length ? params : null;
 }
 function searchParamsToQuery(url) {
     const out = {};
@@ -86,6 +100,34 @@ function augmentRequest(req, url, params) {
     };
     return req;
 }
+function requestMayHaveJsonBody(req, method) {
+    if (method === "GET" || method === "HEAD") {
+        return false;
+    }
+    const contentType = req.headers["content-type"];
+    const contentTypeText = Array.isArray(contentType)
+        ? contentType.join(",")
+        : (contentType ?? "");
+    if (!contentTypeText.toLowerCase().includes("application/json")) {
+        return false;
+    }
+    const contentLength = req.headers["content-length"];
+    if (contentLength === "0") {
+        return false;
+    }
+    return Boolean(contentLength || req.headers["transfer-encoding"]);
+}
+async function attachJsonBodyIfPresent(req, res, method) {
+    if (!requestMayHaveJsonBody(req, method)) {
+        return true;
+    }
+    const body = await readJsonBody(req, res, { requireObject: true });
+    if (body === null) {
+        return false;
+    }
+    req.body = body;
+    return true;
+}
 /**
  * Runs the first matching runtime plugin route. Returns true if matched (even on handler error).
  */
@@ -114,6 +156,9 @@ export async function tryHandleRuntimePluginRoute(options) {
         }
         attachExpressResponseHelpers(res);
         augmentRequest(req, url, params);
+        if (!(await attachJsonBodyIfPresent(req, res, method))) {
+            return true;
+        }
         const effectiveHandler = route.x402 != null && !isRoutePaymentWrapped(route)
             ? createPaymentAwareHandler(route)
             : handler;

package/packages/agent/src/api/server-auth.d.ts

@@ -3,11 +3,13 @@
  */
 import type http from "node:http";
 import type { AgentRuntime } from "@elizaos/core";
+import { type WalletExportRejection, type WalletExportRequestBody } from "@elizaos/shared";
 import type { ConversationMeta } from "./server-helpers.js";
 export declare function extractAuthToken(req: http.IncomingMessage): string | null;
 export declare function tokenMatches(expected: string, provided: string): boolean;
 export declare function getConfiguredApiToken(): string | undefined;
 export declare function isLoopbackBindHost(host: string): boolean;
+export declare function isTrustedLocalRequest(req: http.IncomingMessage): boolean;
 export declare function ensureApiTokenForBindHost(host: string): void;
 export declare function isAuthorized(req: http.IncomingMessage): boolean;
 export interface PluginConfigMutationRejection {
@@ -17,7 +19,6 @@ export interface PluginConfigMutationRejection {
 export declare function resolvePluginConfigMutationRejections(pluginParams: Array<{
     key: string;
 }>, config: Record<string, unknown>): PluginConfigMutationRejection[];
-import type { WalletExportRejection, WalletExportRequestBody } from "@elizaos/shared/contracts";
 export type { WalletExportRejection };
 export declare function resolveWalletExportRejection(req: http.IncomingMessage, body: WalletExportRequestBody): WalletExportRejection | null;
 interface TerminalRunRequestBody {

package/packages/agent/src/api/server-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-auth.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAUlD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAM5D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,MAAM,GAAG,IAAI,CAmBzE;AAMD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKxE;AAED,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAE1D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAuCxD;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CA0B5D;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAM/D;AAMD,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,qCAAqC,CACnD,YAAY,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,EACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,6BAA6B,EAAE,CA0BjC;AAMD,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAEtC,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,uBAAuB,GAC5B,qBAAqB,GAAG,IAAI,CAyC9B;AAMD,UAAU,sBAAsB;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,sBAAsB,GAC3B,oBAAoB,GAAG,IAAI,CA0C7B;AAMD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAS3D;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAMjD;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,IAAI,CAAC,eAAe,EAC7B,GAAG,EAAE,GAAG,GACP,MAAM,GAAG,IAAI,CAIf;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,eAAe,EAC7B,GAAG,EAAE,GAAG,GACP,OAAO,CAOT;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,KAAK,EAAE,GAAG,EACV,iBAAiB,GAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAiB,GACjE,yBAAyB,GAAG,IAAI,CAsClC;AAqBD,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAgBT;AAMD,KAAK,wBAAwB,GAAG,IAAI,CAClC,gBAAgB,EAChB,IAAI,GAAG,OAAO,GAAG,QAAQ,CAC1B,CAAC;AAEF,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,EACrE,YAAY,EAAE,wBAAwB,GACrC,OAAO,CAAC,OAAO,CAAC,CAalB;AAMD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,aAAa,EAAE,MAAM,EACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,IAAI,CAmBN;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAOf"}
+{"version":3,"file":"server-auth.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AAIzB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAM5D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,MAAM,GAAG,IAAI,CAoBzE;AAMD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKxE;AAED,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAE1D;AAsBD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAuCxD;AAuBD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAmBxE;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CA0B5D;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAQ/D;AAMD,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,qCAAqC,CACnD,YAAY,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,EACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,6BAA6B,EAAE,CA0BjC;AAOD,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAEtC,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,uBAAuB,GAC5B,qBAAqB,GAAG,IAAI,CAyC9B;AAMD,UAAU,sBAAsB;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,sBAAsB,GAC3B,oBAAoB,GAAG,IAAI,CA0C7B;AAMD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAS3D;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAMjD;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,IAAI,CAAC,eAAe,EAC7B,GAAG,EAAE,GAAG,GACP,MAAM,GAAG,IAAI,CAIf;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,eAAe,EAC7B,GAAG,EAAE,GAAG,GACP,OAAO,CAOT;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,KAAK,EAAE,GAAG,EACV,iBAAiB,GAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAiB,GACjE,yBAAyB,GAAG,IAAI,CAsClC;AAqBD,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAgBT;AAMD,KAAK,wBAAwB,GAAG,IAAI,CAClC,gBAAgB,EAChB,IAAI,GAAG,OAAO,GAAG,QAAQ,CAC1B,CAAC;AAEF,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,EACrE,YAAY,EAAE,wBAAwB,GACrC,OAAO,CAAC,OAAO,CAAC,CAalB;AAMD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,aAAa,EAAE,MAAM,EACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,IAAI,CAmBN;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAOf"}

package/packages/agent/src/api/server-auth.js

@@ -4,7 +4,7 @@
 import crypto from "node:crypto";
 import path from "node:path";
 import { logger } from "@elizaos/core";
-import { resolveApiSecurityConfig, resolveApiToken, setApiToken, } from "@elizaos/shared/runtime-env";
+import { resolveApiSecurityConfig, resolveApiToken, setApiToken, } from "@elizaos/shared";
 import { isCloudProvisionedContainer } from "./cloud-provisioning.js";
 import { sendJsonError } from "./http-helpers.js";
 import { BLOCKED_ENV_KEYS } from "./plugin-discovery-helpers.js";
@@ -12,13 +12,14 @@ import { BLOCKED_ENV_KEYS } from "./plugin-discovery-helpers.js";
 // Auth token extraction
 // ---------------------------------------------------------------------------
 export function extractAuthToken(req) {
-    const auth = typeof req.headers.authorization === "string"
-        ? req.headers.authorization.trim()
+    const rawAuth = typeof req.headers.authorization === "string"
+        ? req.headers.authorization
         : "";
-    if (auth) {
-        const match = /^Bearer\s+(.+)$/i.exec(auth);
-        if (match?.[1])
-            return match[1].trim();
+    const auth = rawAuth.length > 8192 ? rawAuth.slice(0, 8192).trim() : rawAuth.trim();
+    if (auth && auth.length >= 7 && auth.slice(0, 7).toLowerCase() === "bearer ") {
+        const token = auth.slice(7).trim();
+        if (token)
+            return token;
     }
     const header = (typeof req.headers["x-eliza-token"] === "string" &&
         req.headers["x-eliza-token"]) ||
@@ -42,6 +43,23 @@ export function tokenMatches(expected, provided) {
 export function getConfiguredApiToken() {
     return resolveApiToken(process.env) ?? undefined;
 }
+function firstHeaderValue(value) {
+    if (typeof value === "string")
+        return value;
+    if (Array.isArray(value) && typeof value[0] === "string")
+        return value[0];
+    return null;
+}
+function isLoopbackRemoteAddress(remoteAddress) {
+    if (!remoteAddress)
+        return false;
+    const normalized = remoteAddress.trim().toLowerCase();
+    return (normalized === "127.0.0.1" ||
+        normalized === "::1" ||
+        normalized === "0:0:0:0:0:0:0:1" ||
+        normalized === "::ffff:127.0.0.1" ||
+        normalized === "::ffff:0:127.0.0.1");
+}
 export function isLoopbackBindHost(host) {
     let normalized = host.trim().toLowerCase();
     if (!normalized)
@@ -81,6 +99,45 @@ export function isLoopbackBindHost(host) {
         return true;
     return false;
 }
+function isTrustedLocalOrigin(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed === "null")
+        return true;
+    try {
+        const parsed = new URL(trimmed);
+        if (parsed.protocol === "file:" ||
+            parsed.protocol === "app:" ||
+            parsed.protocol === "tauri:" ||
+            parsed.protocol === "capacitor:" ||
+            parsed.protocol === "capacitor-electron:" ||
+            parsed.protocol === "electrobun:") {
+            return true;
+        }
+        return isLoopbackBindHost(parsed.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+export function isTrustedLocalRequest(req) {
+    if (isCloudProvisionedContainer())
+        return false;
+    if (!isLoopbackRemoteAddress(req.socket?.remoteAddress))
+        return false;
+    const host = firstHeaderValue(req.headers.host);
+    if (host && !isLoopbackBindHost(host))
+        return false;
+    const secFetchSite = firstHeaderValue(req.headers["sec-fetch-site"])?.toLowerCase();
+    if (secFetchSite === "cross-site")
+        return false;
+    const origin = firstHeaderValue(req.headers.origin);
+    if (origin && !isTrustedLocalOrigin(origin))
+        return false;
+    const referer = firstHeaderValue(req.headers.referer);
+    if (!origin && referer && !isTrustedLocalOrigin(referer))
+        return false;
+    return true;
+}
 export function ensureApiTokenForBindHost(host) {
     if (resolveApiSecurityConfig(process.env).disableAutoApiToken) {
         return;
@@ -103,9 +160,11 @@ export function ensureApiTokenForBindHost(host) {
     logger.warn(`[eliza-api] Generated temporary API token (${tokenFingerprint}) for this process. Set ELIZA_API_TOKEN or ELIZA_API_TOKEN explicitly to override.`);
 }
 export function isAuthorized(req) {
+    if (isTrustedLocalRequest(req))
+        return true;
     const expected = getConfiguredApiToken();
     if (!expected)
-        return !isCloudProvisionedContainer();
+        return false;
     const provided = extractAuthToken(req);
     if (!provided)
         return false;

package/packages/agent/src/api/server-helpers-auth.d.ts

@@ -7,6 +7,7 @@ export declare function resolveCorsOrigin(origin?: string): string | null;
 export declare function applyCors(req: http.IncomingMessage, res: http.ServerResponse, pathname: string): boolean;
 export declare function getConfiguredApiToken(): string | undefined;
 export declare function extractAuthToken(req: http.IncomingMessage): string | null;
+export declare function isTrustedLocalRequest(req: http.IncomingMessage): boolean;
 export declare function isAuthorized(req: http.IncomingMessage): boolean;
 export declare function ensureApiTokenForBindHost(host: string): void;
 export declare function pairingEnabled(): boolean;

package/packages/agent/src/api/server-helpers-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-helpers-auth.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-helpers-auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAmClC,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CA0ChE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA8BhE;AAgBD,wBAAgB,SAAS,CACvB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAgCT;AAaD,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAE1D;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,MAAM,GAAG,IAAI,CAmBzE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAM/D;AA2CD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAiC5D;AAeD,wBAAgB,cAAc,IAAI,OAAO,CAKxC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAWD,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAWjD;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAe3D;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAgB,YAAY,IAAI,IAAI,CAGnC;AAQD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAMjE;AAQD,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,EAC1C,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC9C,MAAM,GAAG,IAAI,CAMf;AAOD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAElE;AAMD,UAAU,sBAAsB;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,sBAAsB,GAC3B,oBAAoB,GAAG,IAAI,CA0C7B;AAkCD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,eAAe,EAC7B,GAAG,EAAE,GAAG,GACP,OAAO,CAOT;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,KAAK,EAAE,GAAG,GACT,yBAAyB,GAAG,IAAI,CAsClC;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,aAAa,EAAE,MAAM,EACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,IAAI,CAmBN"}
+{"version":3,"file":"server-helpers-auth.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-helpers-auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAmClC,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CA0ChE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA8BhE;AAgBD,wBAAgB,SAAS,CACvB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAgCT;AAaD,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAE1D;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,MAAM,GAAG,IAAI,CAoBzE;AA2CD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAmBxE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAQ/D;AA2CD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAiC5D;AAeD,wBAAgB,cAAc,IAAI,OAAO,CAKxC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAUD,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAWjD;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAe3D;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAgB,YAAY,IAAI,IAAI,CAGnC;AAQD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAMjE;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,EAC1C,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC9C,MAAM,GAAG,IAAI,CAMf;AAOD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAElE;AAMD,UAAU,sBAAsB;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,sBAAsB,GAC3B,oBAAoB,GAAG,IAAI,CA0C7B;AAkCD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,eAAe,EAC7B,GAAG,EAAE,GAAG,GACP,OAAO,CAOT;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,KAAK,EAAE,GAAG,GACT,yBAAyB,GAAG,IAAI,CAsClC;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,aAAa,EAAE,MAAM,EACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,IAAI,CAmBN"}

package/packages/agent/src/api/server-helpers-auth.js

@@ -2,7 +2,7 @@
  * Auth, CORS, pairing, terminal, and WebSocket auth helpers extracted from server.ts.
  */
 import crypto from "node:crypto";
-import { isNullOriginAllowed, resolveAllowedHosts, resolveAllowedOrigins, resolveApiBindHost, resolveApiSecurityConfig, resolveApiToken, setApiToken, stripOptionalHostPort, } from "@elizaos/shared/runtime-env";
+import { isNullOriginAllowed, resolveAllowedHosts, resolveAllowedOrigins, resolveApiBindHost, resolveApiSecurityConfig, resolveApiToken, setApiToken, stripOptionalHostPort, } from "@elizaos/shared";
 import { isCloudProvisionedContainer } from "./cloud-provisioning.js";
 import { sweepExpiredEntries } from "./memory-bounds.js";
 // ---------------------------------------------------------------------------
@@ -113,7 +113,7 @@ export function applyCors(req, res, pathname) {
         res.setHeader("Access-Control-Allow-Origin", allowed);
         res.setHeader("Vary", "Origin");
         res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
-        res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Eliza-Token, X-Api-Key, X-Eliza-Export-Token, X-Eliza-Client-Id, X-Eliza-Terminal-Token, X-Eliza-UI-Language, X-Browser-Bridge-Companion-Id, X-Eliza-Browser-Companion-Id");
+        res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Eliza-Token, X-Api-Key, X-Eliza-Export-Token, X-Eliza-Client-Id, X-Eliza-Terminal-Token, X-Eliza-UI-Language, X-Browser-Bridge-Companion-Id, X-Eliza-Browser-Companion-Id, X-Milady-CSRF");
     }
     // Security headers
     res.setHeader("X-Content-Type-Options", "nosniff");
@@ -136,13 +136,14 @@ export function getConfiguredApiToken() {
     return resolveApiToken(process.env) ?? undefined;
 }
 export function extractAuthToken(req) {
-    const auth = typeof req.headers.authorization === "string"
-        ? req.headers.authorization.trim()
+    const rawAuth = typeof req.headers.authorization === "string"
+        ? req.headers.authorization
         : "";
-    if (auth) {
-        const match = /^Bearer\s+(.+)$/i.exec(auth);
-        if (match?.[1])
-            return match[1].trim();
+    const auth = rawAuth.length > 8192 ? rawAuth.slice(0, 8192).trim() : rawAuth.trim();
+    if (auth && auth.length >= 7 && auth.slice(0, 7).toLowerCase() === "bearer ") {
+        const token = auth.slice(7).trim();
+        if (token)
+            return token;
     }
     const header = (typeof req.headers["x-eliza-token"] === "string" &&
         req.headers["x-eliza-token"]) ||
@@ -153,10 +154,68 @@ export function extractAuthToken(req) {
         return header.trim();
     return null;
 }
+function firstHeaderValue(value) {
+    if (typeof value === "string")
+        return value;
+    if (Array.isArray(value) && typeof value[0] === "string")
+        return value[0];
+    return null;
+}
+function isLoopbackRemoteAddress(remoteAddress) {
+    if (!remoteAddress)
+        return false;
+    const normalized = remoteAddress.trim().toLowerCase();
+    return (normalized === "127.0.0.1" ||
+        normalized === "::1" ||
+        normalized === "0:0:0:0:0:0:0:1" ||
+        normalized === "::ffff:127.0.0.1" ||
+        normalized === "::ffff:0:127.0.0.1");
+}
+function isTrustedLocalOrigin(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed === "null")
+        return true;
+    try {
+        const parsed = new URL(trimmed);
+        if (parsed.protocol === "file:" ||
+            parsed.protocol === "app:" ||
+            parsed.protocol === "tauri:" ||
+            parsed.protocol === "capacitor:" ||
+            parsed.protocol === "capacitor-electron:" ||
+            parsed.protocol === "electrobun:") {
+            return true;
+        }
+        return isLoopbackBindHost(parsed.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+export function isTrustedLocalRequest(req) {
+    if (isCloudProvisionedContainer())
+        return false;
+    if (!isLoopbackRemoteAddress(req.socket?.remoteAddress))
+        return false;
+    const host = firstHeaderValue(req.headers.host);
+    if (host && !isLoopbackBindHost(host))
+        return false;
+    const secFetchSite = firstHeaderValue(req.headers["sec-fetch-site"])?.toLowerCase();
+    if (secFetchSite === "cross-site")
+        return false;
+    const origin = firstHeaderValue(req.headers.origin);
+    if (origin && !isTrustedLocalOrigin(origin))
+        return false;
+    const referer = firstHeaderValue(req.headers.referer);
+    if (!origin && referer && !isTrustedLocalOrigin(referer))
+        return false;
+    return true;
+}
 export function isAuthorized(req) {
+    if (isTrustedLocalRequest(req))
+        return true;
     const expected = getConfiguredApiToken();
     if (!expected)
-        return !isCloudProvisionedContainer();
+        return false;
     const provided = extractAuthToken(req);
     if (!provided)
         return false;
@@ -245,10 +304,9 @@ export function normalizePairingCode(code) {
     return code.replace(/[^a-zA-Z0-9]/g, "").toUpperCase();
 }
 function generatePairingCode() {
-    const bytes = crypto.randomBytes(8);
     let raw = "";
-    for (let i = 0; i < bytes.length; i++) {
-        raw += PAIRING_ALPHABET[bytes[i] % PAIRING_ALPHABET.length];
+    for (let i = 0; i < 8; i++) {
+        raw += PAIRING_ALPHABET[crypto.randomInt(0, PAIRING_ALPHABET.length)];
     }
     return `${raw.slice(0, 4)}-${raw.slice(4, 8)}`;
 }
@@ -299,13 +357,6 @@ export function normalizeWsClientId(value) {
         return null;
     return trimmed;
 }
-function firstHeaderValue(value) {
-    if (typeof value === "string")
-        return value;
-    if (Array.isArray(value) && typeof value[0] === "string")
-        return value[0];
-    return null;
-}
 export function resolveTerminalRunClientId(req, body) {
     const headerClientId = normalizeWsClientId(firstHeaderValue(req.headers["x-eliza-client-id"]));
     if (headerClientId)

package/packages/agent/src/api/server-helpers-config.d.ts

@@ -16,7 +16,7 @@ export declare function stripRedactedPlaceholderValuesDeep(value: unknown): void
 export declare function validateSkillId(skillId: string, res: http.ServerResponse): string | null;
 export declare function readUiLanguageHeader(req: http.IncomingMessage | undefined): string | undefined;
 export declare function resolveConfiguredCharacterLanguage(config?: ElizaConfig, req?: http.IncomingMessage): "es" | "ko" | "pt" | "tl" | "vi" | "zh-CN" | "en";
-export declare function resolveOnboardingStylePreset(body: Record<string, unknown>, language: string): import("@elizaos/shared/contracts/onboarding.js").StylePreset;
+export declare function resolveOnboardingStylePreset(body: Record<string, unknown>, language: string): import("@elizaos/shared").StylePreset;
 export declare function applyOnboardingVoicePreset(config: ElizaConfig, body: Record<string, unknown>, language: string): void;
 export declare function resolveDefaultAgentName(config?: ElizaConfig, req?: http.IncomingMessage): string;
 export declare function getProviderOptions(): Array<{

package/packages/agent/src/api/server-helpers-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-helpers-config.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-helpers-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAQlC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAYvD;;GAEG;AACH,eAAO,MAAM,gBAAgB,QACuF,CAAC;AAErH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOvD;AAiBD,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAehD;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI7D;AAED,+FAA+F;AAC/F,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAiBvE;AAQD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,MAAM,GAAG,IAAI,CAYf;AAiCD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,SAAS,GACpC,MAAM,GAAG,SAAS,CAYpB;AAED,wBAAgB,kCAAkC,CAChD,MAAM,CAAC,EAAE,WAAW,EACpB,GAAG,CAAC,EAAE,IAAI,CAAC,eAAe,qDAQ3B;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,QAAQ,EAAE,MAAM,iEA2BjB;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,QAAQ,EAAE,MAAM,QA6CjB;AAED,wBAAgB,uBAAuB,CACrC,MAAM,CAAC,EAAE,WAAW,EACpB,GAAG,CAAC,EAAE,IAAI,CAAC,eAAe,GACzB,MAAM,CAUR;AAED,wBAAgB,kBAAkB,IAAI,KAAK,CAAC;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC,CASD;AAED,wBAAgB,uBAAuB,IAAI,KAAK,CAAC;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC,CAMD;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CA4C3E;AAqBD,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAgBT"}
+{"version":3,"file":"server-helpers-config.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-helpers-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAQlC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAYvD;;GAEG;AACH,eAAO,MAAM,gBAAgB,QACuF,CAAC;AAErH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOvD;AAiBD,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAehD;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI7D;AAED,+FAA+F;AAC/F,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAiBvE;AAQD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,MAAM,GAAG,IAAI,CAYf;AAiCD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,SAAS,GACpC,MAAM,GAAG,SAAS,CAYpB;AAED,wBAAgB,kCAAkC,CAChD,MAAM,CAAC,EAAE,WAAW,EACpB,GAAG,CAAC,EAAE,IAAI,CAAC,eAAe,qDAQ3B;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,QAAQ,EAAE,MAAM,yCA2BjB;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,QAAQ,EAAE,MAAM,QA6CjB;AAED,wBAAgB,uBAAuB,CACrC,MAAM,CAAC,EAAE,WAAW,EACpB,GAAG,CAAC,EAAE,IAAI,CAAC,eAAe,GACzB,MAAM,CAUR;AAED,wBAAgB,kBAAkB,IAAI,KAAK,CAAC;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC,CASD;AAED,wBAAgB,uBAAuB,IAAI,KAAK,CAAC;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC,CAMD;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CA4C3E;AAqBD,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAgBT"}