@elizaos/agent 2.0.0-alpha.97 → 2.0.0-beta.1

package/dist/packages/agent/src/api/auth-routes.d.ts

@@ -0,0 +1,11 @@
+import type { RouteRequestContext } from "@elizaos/shared";
+export interface AuthRouteContext extends RouteRequestContext {
+    pairingEnabled: () => boolean;
+    ensurePairingCode: () => string | null;
+    normalizePairingCode: (code: string) => string;
+    rateLimitPairing: (ip: string | null) => boolean;
+    getPairingExpiresAt: () => number;
+    clearPairing: () => void;
+}
+export declare function handleAuthRoutes(ctx: AuthRouteContext): Promise<boolean>;
+//# sourceMappingURL=auth-routes.d.ts.map

package/dist/packages/agent/src/api/auth-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth-routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAQ3D,MAAM,WAAW,gBAAiB,SAAQ,mBAAmB;IAC3D,cAAc,EAAE,MAAM,OAAO,CAAC;IAC9B,iBAAiB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACvC,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/C,gBAAgB,EAAE,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC;IACjD,mBAAmB,EAAE,MAAM,MAAM,CAAC;IAClC,YAAY,EAAE,MAAM,IAAI,CAAC;CAC1B;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,OAAO,CAAC,CA8IlB"}

package/dist/packages/agent/src/api/auth-routes.js

@@ -0,0 +1,119 @@
+import crypto from "node:crypto";
+import { isCloudProvisionedContainer } from "@elizaos/plugin-elizacloud";
+import { resolveApiToken } from "@elizaos/shared";
+import { isAuthorized, isTrustedLocalRequest } from "./server-helpers-auth.js";
+function getConfiguredApiToken() {
+    return resolveApiToken(process.env) ?? undefined;
+}
+export async function handleAuthRoutes(ctx) {
+    const { req, res, method, pathname, readJsonBody, json, error, pairingEnabled, ensurePairingCode, normalizePairingCode, rateLimitPairing, getPairingExpiresAt, clearPairing, } = ctx;
+    if (!pathname.startsWith("/api/auth/"))
+        return false;
+    if (method === "GET" && pathname === "/api/auth/me") {
+        const authorized = isAuthorized(req);
+        const localAccess = process.env.ELIZA_REQUIRE_LOCAL_AUTH === "1" ||
+            isTrustedLocalRequest(req);
+        if (!authorized) {
+            json(res, {
+                reason: getConfiguredApiToken()
+                    ? "remote_auth_required"
+                    : "remote_password_not_configured",
+                access: {
+                    mode: localAccess ? "local" : "remote",
+                    passwordConfigured: Boolean(getConfiguredApiToken()),
+                    ownerConfigured: false,
+                },
+            }, 401);
+            return true;
+        }
+        json(res, {
+            identity: {
+                id: localAccess ? "local-agent" : "bearer-agent",
+                displayName: localAccess ? "Local Agent" : "API User",
+                kind: "machine",
+            },
+            session: {
+                id: localAccess ? "local" : "bearer",
+                kind: localAccess ? "local" : "machine",
+                expiresAt: null,
+            },
+            access: {
+                mode: localAccess ? "local" : "bearer",
+                passwordConfigured: !localAccess && Boolean(getConfiguredApiToken()),
+                ownerConfigured: false,
+            },
+        });
+        return true;
+    }
+    if (method === "GET" && pathname === "/api/auth/status") {
+        if (isCloudProvisionedContainer()) {
+            // Steward-managed cloud containers enforce API auth upstream, but the
+            // local pairing flow is intentionally unavailable there. Reporting
+            // required=true would strand app-core clients in PairingView.
+            json(res, {
+                required: false,
+                pairingEnabled: false,
+                expiresAt: null,
+            });
+            return true;
+        }
+        const required = Boolean(getConfiguredApiToken());
+        const enabled = pairingEnabled();
+        if (enabled)
+            ensurePairingCode();
+        json(res, {
+            required,
+            pairingEnabled: enabled,
+            expiresAt: enabled ? getPairingExpiresAt() : null,
+        });
+        return true;
+    }
+    if (method === "POST" && pathname === "/api/auth/pair") {
+        // NOTE: this handler is shadowed by `handleAuthPairingCompatRoutes` in
+        // `@elizaos/app-core` (the compat route mints a real machine session
+        // bound to an identity, which authenticates against
+        // `ensureCompatApiAuthorizedAsync`). This agent-only path is kept for
+        // standalone agent-server usage; it returns the static connection key,
+        // which only authenticates routes that explicitly accept the static
+        // token (e.g. `/api/auth/status`). For full route coverage, run via
+        // app-core so the compat handler intercepts first.
+        const body = await readJsonBody(req, res);
+        if (!body)
+            return true;
+        if (isCloudProvisionedContainer()) {
+            error(res, "Pairing disabled", 403);
+            return true;
+        }
+        const token = getConfiguredApiToken();
+        if (!token) {
+            error(res, "Pairing not enabled", 400);
+            return true;
+        }
+        if (!pairingEnabled()) {
+            error(res, "Pairing disabled", 403);
+            return true;
+        }
+        if (!rateLimitPairing(req.socket.remoteAddress ?? null)) {
+            error(res, "Too many attempts. Try again later.", 429);
+            return true;
+        }
+        const provided = normalizePairingCode(body.code ?? "");
+        const current = ensurePairingCode();
+        if (!current || Date.now() > getPairingExpiresAt()) {
+            ensurePairingCode();
+            error(res, "Pairing code expired. Check server logs for a new code.", 410);
+            return true;
+        }
+        const expected = normalizePairingCode(current);
+        const a = Buffer.from(expected, "utf8");
+        const b = Buffer.from(provided, "utf8");
+        if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
+            error(res, "Invalid pairing code", 403);
+            return true;
+        }
+        clearPairing();
+        json(res, { token });
+        return true;
+    }
+    return false;
+}

package/dist/packages/agent/src/api/avatar-routes.d.ts

@@ -0,0 +1,11 @@
+import type http from "node:http";
+export interface AvatarRouteContext {
+    req: http.IncomingMessage;
+    res: http.ServerResponse;
+    method: string;
+    pathname: string;
+    json: (res: http.ServerResponse, data: unknown, status?: number) => void;
+    error: (res: http.ServerResponse, message: string, status?: number) => void;
+}
+export declare function handleAvatarRoutes(ctx: AvatarRouteContext): Promise<boolean>;
+//# sourceMappingURL=avatar-routes.d.ts.map

package/dist/packages/agent/src/api/avatar-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"avatar-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/avatar-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAalC,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC;IAC1B,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzE,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7E;AAMD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,OAAO,CAAC,CAoNlB"}

package/dist/packages/agent/src/api/avatar-routes.js

@@ -0,0 +1,205 @@
+import fs from "node:fs";
+import path from "node:path";
+import { readRequestBodyBuffer } from "@elizaos/core";
+import { getDiscordAvatarCacheDir, getDiscordAvatarCachePath, } from "@elizaos/plugin-discord";
+import { resolveStateDir } from "../config/paths.js";
+// ---------------------------------------------------------------------------
+// Route handler
+// ---------------------------------------------------------------------------
+export async function handleAvatarRoutes(ctx) {
+    const { req, res, method, pathname, json, error } = ctx;
+    if ((method === "GET" || method === "HEAD") &&
+        pathname.startsWith("/api/avatar/discord/")) {
+        const encodedFileName = pathname.slice("/api/avatar/discord/".length);
+        const fileName = decodeURIComponent(encodedFileName);
+        if (!fileName ||
+            fileName !== path.basename(fileName) ||
+            !/^[a-zA-Z0-9._-]+$/.test(fileName)) {
+            error(res, "Invalid Discord avatar path", 400);
+            return true;
+        }
+        const filePath = getDiscordAvatarCachePath(fileName);
+        if (path.dirname(filePath) !== getDiscordAvatarCacheDir() ||
+            !filePath.startsWith(getDiscordAvatarCacheDir())) {
+            error(res, "Invalid Discord avatar path", 400);
+            return true;
+        }
+        try {
+            const stat = fs.statSync(filePath);
+            if (!stat.isFile()) {
+                error(res, "Discord avatar not found", 404);
+                return true;
+            }
+            const extension = path.extname(filePath).slice(1).toLowerCase();
+            const mimeType = extension === "jpg" || extension === "jpeg"
+                ? "image/jpeg"
+                : extension === "gif"
+                    ? "image/gif"
+                    : extension === "webp"
+                        ? "image/webp"
+                        : "image/png";
+            const headers = {
+                "Cache-Control": "public, max-age=31536000, immutable",
+                "Content-Length": stat.size,
+                "Content-Type": mimeType,
+            };
+            if (method === "HEAD") {
+                res.writeHead(200, headers);
+                res.end();
+                return true;
+            }
+            const body = fs.readFileSync(filePath);
+            res.writeHead(200, headers);
+            res.end(body);
+            return true;
+        }
+        catch {
+            error(res, "Discord avatar not found", 404);
+            return true;
+        }
+    }
+    // ── POST /api/avatar/vrm ─────────────────────────────────────────────
+    if (method === "POST" && pathname === "/api/avatar/vrm") {
+        const MAX_VRM_BYTES = 50 * 1024 * 1024; // 50 MB
+        const rawBody = await readRequestBodyBuffer(req, {
+            maxBytes: MAX_VRM_BYTES,
+            returnNullOnTooLarge: true,
+        });
+        if (!rawBody || rawBody.length === 0) {
+            error(res, "Request body is empty or exceeds 50 MB", 400);
+            return true;
+        }
+        const GLB_MAGIC = Buffer.from([0x67, 0x6c, 0x54, 0x46]); // "glTF"
+        if (rawBody.length < 4 || !rawBody.subarray(0, 4).equals(GLB_MAGIC)) {
+            error(res, "Invalid VRM file: not a valid glTF/GLB file", 400);
+            return true;
+        }
+        const avatarDir = path.join(resolveStateDir(), "avatars");
+        fs.mkdirSync(avatarDir, { recursive: true });
+        const vrmPath = path.join(avatarDir, "custom.vrm");
+        fs.writeFileSync(vrmPath, rawBody);
+        json(res, { ok: true, size: rawBody.length });
+        return true;
+    }
+    // ── GET /api/avatar/vrm ──────────────────────────────────────────────
+    if ((method === "GET" || method === "HEAD") &&
+        pathname === "/api/avatar/vrm") {
+        const vrmPath = path.join(resolveStateDir(), "avatars", "custom.vrm");
+        try {
+            const stat = fs.statSync(vrmPath);
+            if (!stat.isFile()) {
+                error(res, "No custom avatar found", 404);
+                return true;
+            }
+            const headers = {
+                "Content-Type": "model/gltf-binary",
+                "Content-Length": stat.size,
+                "Cache-Control": "no-cache",
+            };
+            if (method === "HEAD") {
+                res.writeHead(200, headers);
+                res.end();
+                return true;
+            }
+            const body = fs.readFileSync(vrmPath);
+            res.writeHead(200, headers);
+            res.end(body);
+        }
+        catch {
+            error(res, "No custom avatar found", 404);
+        }
+        return true;
+    }
+    // ── POST /api/avatar/background ──────────────────────────────────────
+    if (method === "POST" && pathname === "/api/avatar/background") {
+        const MAX_BG_BYTES = 10 * 1024 * 1024; // 10 MB
+        const rawBody = await readRequestBodyBuffer(req, {
+            maxBytes: MAX_BG_BYTES,
+            returnNullOnTooLarge: true,
+        });
+        if (!rawBody || rawBody.length === 0) {
+            error(res, "Request body is empty or exceeds 10 MB", 400);
+            return true;
+        }
+        let ext = "";
+        if (rawBody[0] === 0x89 &&
+            rawBody[1] === 0x50 &&
+            rawBody[2] === 0x4e &&
+            rawBody[3] === 0x47) {
+            ext = "png";
+        }
+        else if (rawBody[0] === 0xff && rawBody[1] === 0xd8) {
+            ext = "jpg";
+        }
+        else if (rawBody[0] === 0x52 &&
+            rawBody[1] === 0x49 &&
+            rawBody[2] === 0x46 &&
+            rawBody[3] === 0x46 &&
+            rawBody.length >= 12 &&
+            rawBody[8] === 0x57 &&
+            rawBody[9] === 0x45 &&
+            rawBody[10] === 0x42 &&
+            rawBody[11] === 0x50) {
+            ext = "webp";
+        }
+        else {
+            error(res, "Invalid image file: expected PNG, JPEG, or WebP", 400);
+            return true;
+        }
+        const avatarDir = path.join(resolveStateDir(), "avatars");
+        fs.mkdirSync(avatarDir, { recursive: true });
+        for (const old of ["png", "jpg", "webp"]) {
+            const p = path.join(avatarDir, `custom-background.${old}`);
+            try {
+                fs.unlinkSync(p);
+            }
+            catch { }
+        }
+        const bgPath = path.join(avatarDir, `custom-background.${ext}`);
+        fs.writeFileSync(bgPath, rawBody);
+        json(res, { ok: true, size: rawBody.length });
+        return true;
+    }
+    // ── GET /api/avatar/background ─────────────────────────────────────────
+    if ((method === "GET" || method === "HEAD") &&
+        pathname === "/api/avatar/background") {
+        const avatarDir = path.join(resolveStateDir(), "avatars");
+        const MIME = {
+            png: "image/png",
+            jpg: "image/jpeg",
+            webp: "image/webp",
+        };
+        let found = "";
+        for (const ext of ["png", "jpg", "webp"]) {
+            const p = path.join(avatarDir, `custom-background.${ext}`);
+            try {
+                if (fs.statSync(p).isFile()) {
+                    found = p;
+                    break;
+                }
+            }
+            catch { }
+        }
+        if (!found) {
+            error(res, "No custom background found", 404);
+            return true;
+        }
+        const stat = fs.statSync(found);
+        const fileExt = path.extname(found).slice(1);
+        const headers = {
+            "Content-Type": MIME[fileExt] || "application/octet-stream",
+            "Content-Length": stat.size,
+            "Cache-Control": "no-cache",
+        };
+        if (method === "HEAD") {
+            res.writeHead(200, headers);
+            res.end();
+            return true;
+        }
+        const body = fs.readFileSync(found);
+        res.writeHead(200, headers);
+        res.end(body);
+        return true;
+    }
+    return false;
+}

package/dist/packages/agent/src/api/binance-skill-helpers.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Binance direct-skill request helpers.
+ *
+ * Extracted from server.ts. Handles direct dispatch of Binance DeFi skills
+ * (meme-rush, trading-signal, token-info, etc.) and fallback action parsing.
+ */
+import { type ActionParameters, type AgentRuntime, type createMessageMemory } from "@elizaos/core";
+export type FallbackParsedAction = {
+    name: string;
+    parameters?: ActionParameters;
+};
+export declare function inferBalanceChainFromText(input: string): "all" | "solana" | "bsc" | "base" | "ethereum";
+export declare function shouldForceCheckBalanceFallback(parsedActions: FallbackParsedAction[], userText: string, responseText: string): boolean;
+export declare function isBalanceIntent(input: string): boolean;
+export declare function parseFallbackActionBlocks(value: unknown, _responseText?: string): FallbackParsedAction[];
+export declare function executeFallbackParsedActions(runtime: AgentRuntime, message: ReturnType<typeof createMessageMemory>, parsedActions: FallbackParsedAction[], appendIncomingText: (incoming: string) => void, onActionCallback: (actionTag: string, hasText: boolean) => void, options?: {
+    getCurrentText?: () => string;
+    onCallbackText?: (incoming: string) => void;
+}): Promise<void>;
+export declare function maybeHandleDirectBinanceSkillRequest(runtime: AgentRuntime, message: ReturnType<typeof createMessageMemory>, appendIncomingText: (incoming: string) => void, replaceText?: (text: string) => void): Promise<string | null>;
+//# sourceMappingURL=binance-skill-helpers.d.ts.map

package/dist/packages/agent/src/api/binance-skill-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binance-skill-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/api/binance-skill-helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAEjB,KAAK,mBAAmB,EAEzB,MAAM,eAAe,CAAC;AAkBvB,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B,CAAC;AA+BF,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,GACZ,KAAK,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,UAAU,CAOhD;AAED,wBAAgB,+BAA+B,CAC7C,aAAa,EAAE,oBAAoB,EAAE,EACrC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAWT;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKtD;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,EACd,aAAa,CAAC,EAAE,MAAM,GACrB,oBAAoB,EAAE,CAqBxB;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,EAC/C,aAAa,EAAE,oBAAoB,EAAE,EACrC,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,EAC9C,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,EAC/D,OAAO,CAAC,EAAE;IACR,cAAc,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7C,GACA,OAAO,CAAC,IAAI,CAAC,CAyGf;AAmnBD,wBAAsB,oCAAoC,CACxD,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,EAC/C,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,EAC9C,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA6HxB"}