@elizaos/agent 2.0.0-alpha.98 → 2.0.0-beta.1

package/dist/packages/agent/src/api/plugin-routes.js

@@ -0,0 +1,1285 @@
+import { logger } from "@elizaos/core";
+import { asRecord, isElizaSettingsDebugEnabled, sanitizeForSettingsDebug, settingsDebugCloudSummary, } from "@elizaos/shared";
+import { loadElizaConfig, saveElizaConfig } from "../config/config.js";
+import { getPluginWidgets, } from "../config/plugin-widgets.js";
+import { applyAdvancedCapabilitiesConfig, isAdvancedCapabilityPluginId, resolveAdvancedCapabilitiesEnabled, } from "../runtime/advanced-capabilities-config.js";
+import { CORE_PLUGINS, OPTIONAL_CORE_PLUGINS, } from "../runtime/core-plugins.js";
+import { resolveDefaultAgentWorkspaceDir } from "../shared/workspace-resolution.js";
+import { applyPluginRuntimeMutation } from "./plugin-runtime-apply.js";
+import { validatePluginConfig, } from "./plugin-validation.js";
+/** Workspace packages use `@elizaos/plugin-*` or `@elizaos/app-*` — normalize list/toggle ids. */
+function optionalPluginListId(npmName) {
+    if (npmName.startsWith("@elizaos/app-")) {
+        return npmName.slice("@elizaos/".length);
+    }
+    return npmName.replace("@elizaos/plugin-", "");
+}
+const ADVANCED_CAPABILITY_SERVICE_BY_PLUGIN_ID = {
+    experience: "EXPERIENCE",
+    personality: "CHARACTER_MANAGEMENT",
+};
+function getPluginHealthProbe(plugin) {
+    if (!plugin || typeof plugin !== "object") {
+        return null;
+    }
+    const record = plugin;
+    for (const key of ["health", "healthCheck", "testConnection", "test"]) {
+        const candidate = record[key];
+        if (typeof candidate === "function") {
+            return candidate;
+        }
+    }
+    return null;
+}
+const pluginsListInFlight = new WeakMap();
+function readCompatEnabledFromConfig(config, pluginId) {
+    const container = asRecord(config.connectors)?.[pluginId] ??
+        asRecord(config.streaming)?.[pluginId];
+    const value = asRecord(container)?.enabled;
+    return typeof value === "boolean" ? value : null;
+}
+function buildCoreToggleDiagnostics(config, npmName) {
+    const pluginId = optionalPluginListId(npmName);
+    const isOptional = OPTIONAL_CORE_PLUGINS.includes(npmName);
+    if (!isOptional) {
+        return null;
+    }
+    const allowList = new Set(config.plugins?.allow ?? []);
+    const enabledAllowList = allowList.has(npmName) || allowList.has(pluginId);
+    const entryEnabledRaw = config.plugins?.entries?.[pluginId]?.enabled;
+    const enabledEntries = typeof entryEnabledRaw === "boolean" ? entryEnabledRaw : null;
+    const enabledCompat = readCompatEnabledFromConfig(config, pluginId);
+    const driftFlags = [];
+    if (enabledEntries !== null && enabledEntries !== enabledAllowList) {
+        driftFlags.push("entries_vs_allowlist");
+    }
+    if (enabledEntries !== null &&
+        enabledCompat !== null &&
+        enabledEntries !== enabledCompat) {
+        driftFlags.push("entries_vs_compat");
+    }
+    return {
+        pluginId,
+        npmName,
+        enabled_allowlist: enabledAllowList,
+        enabled_entries: enabledEntries,
+        enabled_compat: enabledCompat,
+        drift_flags: driftFlags,
+    };
+}
+// ---------------------------------------------------------------------------
+// Route handler
+// ---------------------------------------------------------------------------
+/**
+ * Handle plugin management routes (/api/plugins/*, /api/secrets, /api/core/*).
+ * Returns `true` if the request was handled.
+ */
+export async function handlePluginRoutes(ctx) {
+    const { req, res, method, pathname, state, json, error, readJsonBody, scheduleRuntimeRestart, restartRuntime, BLOCKED_ENV_KEYS, discoverInstalledPlugins, maskValue, aggregateSecrets, readProviderCache, paramKeyToCategory, buildPluginEvmDiagnosticEntry, EVM_PLUGIN_PACKAGE, applyWhatsAppQrOverride, applySignalQrOverride, resolvePluginConfigMutationRejections, requirePluginManager, requireCoreManager, } = ctx;
+    const buildPluginsListSnapshot = async () => {
+        let freshConfig;
+        try {
+            freshConfig = loadElizaConfig();
+        }
+        catch {
+            freshConfig = state.config;
+        }
+        const bundledIds = new Set(state.plugins.map((p) => p.id));
+        const installedEntries = discoverInstalledPlugins(freshConfig, bundledIds);
+        const allPlugins = [...state.plugins, ...installedEntries];
+        let installedMetadataByName = new Map();
+        try {
+            const pluginManager = requirePluginManager(state.runtime);
+            const installed = await pluginManager.listInstalledPlugins();
+            installedMetadataByName = new Map(installed.map((plugin) => [
+                plugin.name,
+                {
+                    version: plugin.version,
+                    releaseStream: plugin.releaseStream,
+                    requestedVersion: plugin.requestedVersion,
+                    latestVersion: plugin.latestVersion,
+                    betaVersion: plugin.betaVersion,
+                },
+            ]));
+        }
+        catch {
+            // Keep the plugin list working even when the plugin-manager service is unavailable.
+        }
+        const evmDiagnostic = buildPluginEvmDiagnosticEntry({
+            config: state.config,
+            runtime: state.runtime,
+        });
+        const existingEvmPlugin = allPlugins.find((plugin) => plugin.id === "evm" ||
+            plugin.id === "wallet" ||
+            plugin.npmName === EVM_PLUGIN_PACKAGE);
+        if (existingEvmPlugin) {
+            existingEvmPlugin.autoEnabled = evmDiagnostic.autoEnabled;
+            existingEvmPlugin.managementMode = "core-optional";
+            existingEvmPlugin.capabilityStatus = evmDiagnostic.capabilityStatus;
+            existingEvmPlugin.capabilityReason = evmDiagnostic.capabilityReason;
+            existingEvmPlugin.prerequisites = evmDiagnostic.prerequisites;
+            existingEvmPlugin.setupGuideUrl =
+                existingEvmPlugin.setupGuideUrl ?? evmDiagnostic.setupGuideUrl;
+            existingEvmPlugin.tags = Array.from(new Set([...(existingEvmPlugin.tags ?? []), ...evmDiagnostic.tags]));
+        }
+        else {
+            allPlugins.push(evmDiagnostic);
+        }
+        const configEntries = freshConfig.plugins?.entries;
+        const advancedCapabilitiesEnabled = resolveAdvancedCapabilitiesEnabled(freshConfig);
+        const loadedNames = state.runtime
+            ? state.runtime.plugins.map((p) => p.name)
+            : [];
+        for (const plugin of allPlugins) {
+            const installedMetadata = (plugin.npmName ? installedMetadataByName.get(plugin.npmName) : null) ??
+                installedMetadataByName.get(plugin.name);
+            if (installedMetadata) {
+                plugin.version = installedMetadata.version ?? plugin.version;
+                plugin.releaseStream =
+                    installedMetadata.releaseStream ?? plugin.releaseStream;
+                plugin.requestedVersion =
+                    installedMetadata.requestedVersion ?? plugin.requestedVersion;
+                plugin.latestVersion =
+                    installedMetadata.latestVersion ?? plugin.latestVersion ?? null;
+                plugin.betaVersion =
+                    installedMetadata.betaVersion ?? plugin.betaVersion ?? null;
+            }
+            if (isAdvancedCapabilityPluginId(plugin.id)) {
+                const serviceType = ADVANCED_CAPABILITY_SERVICE_BY_PLUGIN_ID[plugin.id];
+                plugin.enabled = advancedCapabilitiesEnabled;
+                plugin.isActive = advancedCapabilitiesEnabled
+                    ? serviceType
+                        ? Boolean(state.runtime?.getService(serviceType))
+                        : Boolean(state.runtime)
+                    : false;
+                plugin.autoEnabled = advancedCapabilitiesEnabled;
+                plugin.loadError = undefined;
+                continue;
+            }
+            const suffix = `plugin-${plugin.id}`;
+            const packageName = `@elizaos/plugin-${plugin.id}`;
+            const npmPkgName = plugin.npmName;
+            const isLoaded = loadedNames.length > 0 &&
+                loadedNames.some((name) => {
+                    return (name === plugin.id ||
+                        name === suffix ||
+                        name === packageName ||
+                        (npmPkgName != null && name === npmPkgName) ||
+                        name.endsWith(`/${suffix}`) ||
+                        name.includes(plugin.id));
+                });
+            plugin.isActive = isLoaded;
+            const configEntry = configEntries?.[plugin.id];
+            if (configEntry && typeof configEntry.enabled === "boolean") {
+                plugin.enabled = configEntry.enabled;
+            }
+            else {
+                plugin.enabled = isLoaded;
+            }
+            plugin.loadError = undefined;
+            if (plugin.enabled && !isLoaded && state.runtime) {
+                const installs = freshConfig.plugins?.installs;
+                const packageName = `@elizaos/plugin-${plugin.id}`;
+                const hasInstallRecord = installs?.[packageName] || installs?.[plugin.id];
+                if (hasInstallRecord) {
+                    plugin.loadError =
+                        "Plugin installed but failed to load — the package may be missing compiled files.";
+                }
+            }
+            if (plugin.id === "evm" ||
+                plugin.id === "wallet" ||
+                plugin.npmName === EVM_PLUGIN_PACKAGE) {
+                plugin.enabled = evmDiagnostic.enabled;
+                plugin.isActive = evmDiagnostic.isActive;
+                plugin.autoEnabled = evmDiagnostic.autoEnabled;
+                plugin.managementMode = "core-optional";
+                plugin.capabilityStatus = evmDiagnostic.capabilityStatus;
+                plugin.capabilityReason = evmDiagnostic.capabilityReason;
+                plugin.prerequisites = evmDiagnostic.prerequisites;
+            }
+        }
+        for (const plugin of allPlugins) {
+            for (const param of plugin.parameters) {
+                const envValue = process.env[param.key];
+                param.isSet = Boolean(envValue?.trim());
+                param.currentValue = param.isSet
+                    ? param.sensitive
+                        ? maskValue(envValue ?? "")
+                        : (envValue ?? "")
+                    : null;
+            }
+            const paramInfos = plugin.parameters.map((p) => ({
+                key: p.key,
+                required: p.required,
+                sensitive: p.sensitive,
+                type: p.type,
+                description: p.description,
+                default: p.default,
+            }));
+            const validation = validatePluginConfig(plugin.id, plugin.category, plugin.envKey, plugin.configKeys, undefined, paramInfos);
+            plugin.validationErrors = validation.errors;
+            plugin.validationWarnings = validation.warnings;
+        }
+        applyWhatsAppQrOverride(allPlugins, resolveDefaultAgentWorkspaceDir());
+        applySignalQrOverride(allPlugins, resolveDefaultAgentWorkspaceDir());
+        for (const plugin of allPlugins) {
+            const providerModels = readProviderCache(plugin.id)?.models ?? [];
+            for (const param of plugin.parameters) {
+                if (!param.key.toUpperCase().includes("MODEL"))
+                    continue;
+                const expectedCat = paramKeyToCategory(param.key);
+                const filtered = providerModels.filter((m) => m.category === expectedCat);
+                if (!plugin.configUiHints)
+                    plugin.configUiHints = {};
+                plugin.configUiHints[param.key] = {
+                    ...plugin.configUiHints[param.key],
+                    type: "select",
+                    options: filtered.map((m) => ({
+                        value: m.id,
+                        label: m.name !== m.id ? `${m.name} (${m.id})` : m.id,
+                    })),
+                };
+            }
+        }
+        // Attach widget declarations: prefer each plugin instance's own
+        // `widgets` field (canonical), fall back to the static map for plugins
+        // that have not migrated yet.
+        const runtimePlugins = state.runtime?.plugins ?? [];
+        const normalizeId = (value) => {
+            let v = value.trim();
+            if (v.startsWith("@")) {
+                const slash = v.indexOf("/");
+                if (slash > 0)
+                    v = v.slice(slash + 1);
+            }
+            if (v.startsWith("plugin-"))
+                v = v.slice("plugin-".length);
+            if (v.startsWith("app-"))
+                v = v.slice("app-".length);
+            return v;
+        };
+        for (const plugin of allPlugins) {
+            const widgets = getPluginWidgets(plugin.id, runtimePlugins);
+            if (widgets.length > 0) {
+                plugin.widgets = widgets;
+            }
+            const normalizedPluginId = normalizeId(plugin.id);
+            const matchedRuntime = runtimePlugins.find((p) => normalizeId(p.name) === normalizedPluginId);
+            if (matchedRuntime?.app) {
+                const a = matchedRuntime.app;
+                plugin.app = {
+                    displayName: a.displayName,
+                    category: a.category,
+                    icon: a.icon,
+                    developerOnly: a.developerOnly,
+                    visibleInAppStore: a.visibleInAppStore,
+                    navTabs: a.navTabs?.map((t) => ({
+                        id: t.id,
+                        label: t.label,
+                        icon: t.icon,
+                        path: t.path,
+                        order: t.order,
+                        developerOnly: t.developerOnly,
+                        group: t.group,
+                        componentExport: t.componentExport,
+                    })),
+                };
+            }
+        }
+        return allPlugins;
+    };
+    const resolvePluginsSnapshot = async (config) => {
+        const { resolvePlugins } = await import("../runtime/plugin-resolver.js");
+        return await resolvePlugins(config, { quiet: true });
+    };
+    const resolvePluginsSnapshotSafe = async (config, reason) => {
+        try {
+            return await resolvePluginsSnapshot(config);
+        }
+        catch (err) {
+            logger.warn(`[plugin-routes] Failed to resolve plugin snapshot for ${reason}: ${err instanceof Error ? err.message : String(err)}`);
+            return undefined;
+        }
+    };
+    const npmNamePattern = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+    const validateRegistryPluginPackageName = (pluginName) => {
+        const trimmedName = pluginName.trim();
+        if (!trimmedName) {
+            return "Request body must include 'name' (plugin package name)";
+        }
+        if (!npmNamePattern.test(trimmedName)) {
+            return "Invalid plugin name format";
+        }
+        return null;
+    };
+    // ── GET /api/plugins ────────────────────────────────────────────────────
+    if (method === "GET" && pathname === "/api/plugins") {
+        let inFlight = pluginsListInFlight.get(state);
+        if (!inFlight) {
+            inFlight = buildPluginsListSnapshot();
+            pluginsListInFlight.set(state, inFlight);
+        }
+        const allPlugins = await inFlight.finally(() => {
+            pluginsListInFlight.delete(state);
+        });
+        json(res, { plugins: allPlugins });
+        return true;
+    }
+    // ── PUT /api/plugins/:id ────────────────────────────────────────────────
+    if (method === "PUT" && pathname.startsWith("/api/plugins/")) {
+        const pluginId = pathname.slice("/api/plugins/".length);
+        const body = await readJsonBody(req, res);
+        if (!body)
+            return true;
+        if (isElizaSettingsDebugEnabled()) {
+            logger.debug(`[eliza][settings][api] PUT /api/plugins/${pluginId} body=${JSON.stringify(sanitizeForSettingsDebug({
+                enabled: body.enabled,
+                configKeys: body.config ? Object.keys(body.config).sort() : [],
+                config: body.config ?? {},
+            }))}`);
+        }
+        // Search both bundled plugins AND store-installed plugins
+        let plugin = state.plugins.find((p) => p.id === pluginId);
+        if (!plugin) {
+            // Check store-installed plugins from config
+            let freshCfg;
+            try {
+                freshCfg = loadElizaConfig();
+            }
+            catch {
+                freshCfg = state.config;
+            }
+            const bundledIds = new Set(state.plugins.map((p) => p.id));
+            const installed = discoverInstalledPlugins(freshCfg, bundledIds);
+            const found = installed.find((p) => p.id === pluginId);
+            if (found) {
+                // Temporarily add to state.plugins so toggle logic works the same way
+                state.plugins.push(found);
+                plugin = found;
+            }
+        }
+        if (!plugin) {
+            error(res, `Plugin "${pluginId}" not found`, 404);
+            return true;
+        }
+        const previousConfig = structuredClone(state.config);
+        const previousResolvedPlugins = state.runtime
+            ? await resolvePluginsSnapshotSafe(previousConfig, "plugin update")
+            : undefined;
+        if (body.enabled !== undefined) {
+            plugin.enabled = body.enabled;
+        }
+        if (body.config) {
+            const configRejections = resolvePluginConfigMutationRejections(plugin.parameters, body.config);
+            if (configRejections.length > 0) {
+                json(res, { ok: false, plugin, validationErrors: configRejections }, 422);
+                return true;
+            }
+            // Only validate the fields actually being submitted — not all required
+            // fields. Users may save partial config (e.g. just the API key) from
+            // the Settings page; blocking the save because OTHER required fields
+            // aren't set yet is counterproductive.
+            const configObj = body.config;
+            const submittedParamInfos = plugin.parameters
+                .filter((p) => p.key in configObj)
+                .map((p) => ({
+                key: p.key,
+                required: p.required,
+                sensitive: p.sensitive,
+                type: p.type,
+                description: p.description,
+                default: p.default,
+            }));
+            const configValidation = validatePluginConfig(pluginId, plugin.category, plugin.envKey, plugin.configKeys, body.config, submittedParamInfos);
+            if (!configValidation.valid) {
+                json(res, { ok: false, plugin, validationErrors: configValidation.errors }, 422);
+                return true;
+            }
+            const allowedParamKeys = new Set(plugin.parameters.map((p) => p.key));
+            // Persist config values to state.config.env so they survive restarts
+            if (!state.config.env) {
+                state.config.env = {};
+            }
+            for (const [key, value] of Object.entries(body.config)) {
+                if (allowedParamKeys.has(key) &&
+                    !BLOCKED_ENV_KEYS.has(key.toUpperCase()) &&
+                    typeof value === "string" &&
+                    value.trim()) {
+                    process.env[key] = value;
+                    state.config.env[key] = value;
+                }
+            }
+            plugin.configured = true;
+            // Save config even when only config values changed (no enable toggle)
+            if (body.enabled === undefined) {
+                try {
+                    saveElizaConfig(state.config);
+                }
+                catch (err) {
+                    logger.warn(`[eliza-api] Failed to save config: ${err instanceof Error ? err.message : err}`);
+                }
+            }
+        }
+        // Refresh validation
+        const refreshParamInfos = plugin.parameters.map((p) => ({
+            key: p.key,
+            required: p.required,
+            sensitive: p.sensitive,
+            type: p.type,
+            description: p.description,
+            default: p.default,
+        }));
+        const updated = validatePluginConfig(pluginId, plugin.category, plugin.envKey, plugin.configKeys, undefined, refreshParamInfos);
+        plugin.validationErrors = updated.errors;
+        plugin.validationWarnings = updated.warnings;
+        // Update config.plugins.entries so the runtime loads/skips this plugin
+        if (body.enabled !== undefined) {
+            if (isAdvancedCapabilityPluginId(pluginId)) {
+                applyAdvancedCapabilitiesConfig(state.config, body.enabled);
+                for (const candidate of state.plugins) {
+                    if (isAdvancedCapabilityPluginId(candidate.id)) {
+                        candidate.enabled = body.enabled;
+                    }
+                }
+                logger.info(`[eliza-api] ${body.enabled ? "Enabled" : "Disabled"} advanced capabilities via plugin alias: ${pluginId}`);
+            }
+            else {
+                const packageName = `@elizaos/plugin-${pluginId}`;
+                if (!state.config.plugins) {
+                    state.config.plugins = {};
+                }
+                if (!state.config.plugins.entries) {
+                    state.config.plugins.entries = {};
+                }
+                const entries = state.config.plugins
+                    .entries;
+                entries[pluginId] = { enabled: body.enabled };
+                // Keep plugins.allow aligned with entries[pluginId].enabled so the
+                // enable-state drift check in buildCoreToggleDiagnostics() stays clean.
+                state.config.plugins.allow = state.config.plugins.allow ?? [];
+                const allow = state.config.plugins.allow;
+                if (body.enabled) {
+                    if (!allow.includes(pluginId) && !allow.includes(packageName)) {
+                        allow.push(pluginId);
+                    }
+                }
+                else {
+                    state.config.plugins.allow = allow.filter((p) => p !== pluginId && p !== packageName);
+                }
+                logger.info(`[eliza-api] ${body.enabled ? "Enabled" : "Disabled"} plugin: ${packageName}`);
+            }
+            // Persist capability toggle state in config.features so the runtime
+            // can gate related behaviour (e.g. disabling image description when
+            // vision is toggled off).
+            const CAPABILITY_FEATURE_IDS = new Set([
+                "vision",
+                "browser",
+                "computeruse",
+                "coding-agent",
+            ]);
+            if (CAPABILITY_FEATURE_IDS.has(pluginId)) {
+                if (!state.config.features) {
+                    state.config.features = {};
+                }
+                state.config.features[pluginId] = body.enabled;
+            }
+            // Save updated config
+            try {
+                saveElizaConfig(state.config);
+            }
+            catch (err) {
+                logger.warn(`[eliza-api] Failed to save config: ${err instanceof Error ? err.message : err}`);
+            }
+        }
+        const runtimeApply = await applyPluginRuntimeMutation({
+            runtime: state.runtime,
+            previousConfig,
+            nextConfig: state.config,
+            previousResolvedPlugins,
+            changedPluginId: pluginId,
+            changedPluginPackage: plugin.npmName,
+            config: body.config,
+            expectRuntimeGraphChange: body.enabled !== undefined,
+            reason: body.enabled !== undefined
+                ? `Plugin toggle: ${pluginId}`
+                : `Plugin config updated: ${pluginId}`,
+            restartRuntime,
+        });
+        if (runtimeApply.requiresRestart) {
+            scheduleRuntimeRestart(runtimeApply.reason);
+        }
+        if (isElizaSettingsDebugEnabled()) {
+            const cloud = state.config.cloud;
+            logger.debug(`[eliza][settings][api] PUT /api/plugins/${pluginId} → done configured=${plugin.configured} enabled=${plugin.enabled} cloud=${JSON.stringify(settingsDebugCloudSummary(cloud))}`);
+        }
+        json(res, {
+            ok: true,
+            plugin,
+            applied: runtimeApply.mode,
+            requiresRestart: runtimeApply.requiresRestart,
+            restartedRuntime: runtimeApply.restartedRuntime,
+            loadedPackages: runtimeApply.loadedPackages,
+            unloadedPackages: runtimeApply.unloadedPackages,
+            reloadedPackages: runtimeApply.reloadedPackages,
+        });
+        return true;
+    }
+    // ── GET /api/secrets ─────────────────────────────────────────────────
+    if (method === "GET" && pathname === "/api/secrets") {
+        // Merge bundled + installed plugins for full parameter coverage
+        const bundledIds = new Set(state.plugins.map((p) => p.id));
+        const installedEntries = discoverInstalledPlugins(state.config, bundledIds);
+        const allPlugins = [...state.plugins, ...installedEntries];
+        // Sync enabled status from runtime (same logic as GET /api/plugins)
+        if (state.runtime) {
+            const loadedNames = state.runtime.plugins.map((p) => p.name);
+            for (const plugin of allPlugins) {
+                const suffix = `plugin-${plugin.id}`;
+                const packageName = `@elizaos/plugin-${plugin.id}`;
+                plugin.enabled = loadedNames.some((name) => name === plugin.id ||
+                    name === suffix ||
+                    name === packageName ||
+                    name.endsWith(`/${suffix}`) ||
+                    name.includes(plugin.id));
+            }
+        }
+        const secrets = aggregateSecrets(allPlugins);
+        json(res, { secrets });
+        return true;
+    }
+    // ── PUT /api/secrets ─────────────────────────────────────────────────
+    if (method === "PUT" && pathname === "/api/secrets") {
+        const body = await readJsonBody(req, res);
+        if (!body)
+            return true;
+        if (!body.secrets || typeof body.secrets !== "object") {
+            error(res, "Missing or invalid 'secrets' object", 400);
+            return true;
+        }
+        // Build allowlist from all plugin-declared sensitive params
+        const bundledIds = new Set(state.plugins.map((p) => p.id));
+        const installedEntries = discoverInstalledPlugins(state.config, bundledIds);
+        const allPlugins = [...state.plugins, ...installedEntries];
+        const allowedKeys = new Set();
+        for (const plugin of allPlugins) {
+            for (const param of plugin.parameters) {
+                if (param.sensitive)
+                    allowedKeys.add(param.key);
+            }
+        }
+        const updatedKeys = [];
+        for (const [key, value] of Object.entries(body.secrets)) {
+            if (typeof value !== "string" || !value.trim())
+                continue;
+            if (!allowedKeys.has(key))
+                continue;
+            if (BLOCKED_ENV_KEYS.has(key.toUpperCase()))
+                continue;
+            process.env[key] = value;
+            updatedKeys.push(key);
+        }
+        // Mark affected plugins as configured
+        for (const plugin of allPlugins) {
+            const pluginKeys = new Set(plugin.parameters.map((p) => p.key));
+            if (updatedKeys.some((k) => pluginKeys.has(k))) {
+                plugin.configured = true;
+            }
+        }
+        json(res, { ok: true, updated: updatedKeys });
+        return true;
+    }
+    // ── POST /api/plugins/:id/test ────────────────────────────────────────
+    // Test a plugin's connection / configuration validity.
+    const pluginTestMatch = method === "POST" && pathname.match(/^\/api\/plugins\/([^/]+)\/test$/);
+    if (pluginTestMatch) {
+        const pluginId = decodeURIComponent(pluginTestMatch[1]);
+        const startMs = Date.now();
+        try {
+            // Find the plugin in the runtime
+            const allPlugins = state.runtime?.plugins ?? [];
+            const normalizePluginId = (value) => {
+                const scopedPackage = value.match(/^@[^/]+\/plugin-(.+)$/);
+                if (scopedPackage) {
+                    return scopedPackage[1] ?? value;
+                }
+                return value.replace(/^@[^/]+\//, "").replace(/^plugin-/, "");
+            };
+            const normalizedPluginId = normalizePluginId(pluginId);
+            const plugin = allPlugins.find((p) => {
+                const runtimeName = p.name ?? "";
+                const runtimeId = normalizePluginId(runtimeName);
+                return (p.id === pluginId ||
+                    p.name === pluginId ||
+                    runtimeId === pluginId ||
+                    runtimeId === normalizedPluginId);
+            });
+            if (!plugin) {
+                json(res, {
+                    success: false,
+                    pluginId,
+                    error: "Plugin not found or not loaded",
+                    durationMs: Date.now() - startMs,
+                }, 404);
+                return true;
+            }
+            // Check if plugin exposes a test/health method
+            const testFn = getPluginHealthProbe(plugin);
+            if (typeof testFn === "function") {
+                const result = await testFn();
+                json(res, {
+                    success: result.ok !== false,
+                    pluginId,
+                    message: result.message ??
+                        (result.ok !== false
+                            ? "Connection successful"
+                            : "Connection failed"),
+                    durationMs: Date.now() - startMs,
+                });
+                return true;
+            }
+            // No test function — return a basic "plugin is loaded" status
+            json(res, {
+                success: true,
+                pluginId,
+                message: "Plugin is loaded and active (no custom test available)",
+                durationMs: Date.now() - startMs,
+            });
+        }
+        catch (err) {
+            json(res, {
+                success: false,
+                pluginId,
+                error: err instanceof Error ? err.message : String(err),
+                durationMs: Date.now() - startMs,
+            }, 500);
+        }
+        return true;
+    }
+    // ── POST /api/plugins/install ───────────────────────────────────────────
+    // Install a plugin from the registry and restart the agent.
+    if (method === "POST" && pathname === "/api/plugins/install") {
+        const body = await readJsonBody(req, res);
+        if (!body)
+            return true;
+        const pluginName = body.name?.trim();
+        if (!pluginName) {
+            error(res, "Request body must include 'name' (plugin package name)", 400);
+            return true;
+        }
+        const installValidationError = validateRegistryPluginPackageName(pluginName);
+        if (installValidationError) {
+            error(res, installValidationError, 400);
+            return true;
+        }
+        try {
+            const previousConfig = structuredClone(state.config);
+            const previousResolvedPlugins = state.runtime
+                ? await resolvePluginsSnapshotSafe(previousConfig, "plugin install")
+                : undefined;
+            const pluginManager = requirePluginManager(state.runtime);
+            const result = await pluginManager.installPlugin(pluginName, (progress) => {
+                logger.info(`[install] ${progress.phase}: ${progress.message}`);
+                state.broadcastWs?.({
+                    type: "install-progress",
+                    pluginName: progress.pluginName,
+                    phase: progress.phase,
+                    message: progress.message,
+                });
+            }, {
+                releaseStream: body.stream,
+                version: body.version,
+            });
+            if (!result.success) {
+                json(res, { ok: false, error: result.error }, 422);
+                return true;
+            }
+            // Auto-enable the newly installed plugin so the runtime loads it after restart.
+            const installedId = (result.pluginName ?? pluginName)
+                .replace(/^@[^/]+\/plugin-/, "")
+                .replace(/^@[^/]+\//, "")
+                .replace(/^plugin-/, "");
+            if (!state.config.plugins) {
+                state.config.plugins = {};
+            }
+            if (!state.config.plugins.entries) {
+                state.config.plugins.entries = {};
+            }
+            const pluginEntries = state.config.plugins
+                .entries;
+            pluginEntries[installedId] = { enabled: true };
+            // Record the install path so plugin-resolver can find the package.
+            // Without this, the downloaded package in ~/.eliza/plugins/installed/
+            // is invisible to the runtime loader.
+            if (result.installPath) {
+                if (!state.config.plugins.installs ||
+                    typeof state.config.plugins.installs !==
+                        "object") {
+                    state.config.plugins.installs = {};
+                }
+                const installs = state.config.plugins
+                    .installs;
+                installs[result.pluginName ?? pluginName] = {
+                    source: "npm",
+                    requestedVersion: result.requestedVersion,
+                    releaseStream: result.releaseStream,
+                    installPath: result.installPath,
+                    version: result.version ?? "unknown",
+                    installedAt: new Date().toISOString(),
+                };
+            }
+            try {
+                saveElizaConfig(state.config);
+            }
+            catch (err) {
+                logger.warn(`[eliza-api] Failed to save config after install: ${err instanceof Error ? err.message : err}`);
+            }
+            const runtimeApply = await applyPluginRuntimeMutation({
+                runtime: state.runtime,
+                previousConfig,
+                nextConfig: state.config,
+                previousResolvedPlugins,
+                changedPluginId: installedId,
+                changedPluginPackage: result.pluginName,
+                expectRuntimeGraphChange: true,
+                reason: `Plugin ${result.pluginName} installed`,
+                restartRuntime,
+            });
+            if (runtimeApply.requiresRestart && body.autoRestart !== false) {
+                scheduleRuntimeRestart(runtimeApply.reason);
+            }
+            json(res, {
+                ok: true,
+                pluginName: result.pluginName,
+                plugin: {
+                    name: result.pluginName,
+                    version: result.version,
+                    installPath: result.installPath,
+                },
+                applied: runtimeApply.mode,
+                requiresRestart: runtimeApply.requiresRestart,
+                restartedRuntime: runtimeApply.restartedRuntime,
+                loadedPackages: runtimeApply.loadedPackages,
+                unloadedPackages: runtimeApply.unloadedPackages,
+                reloadedPackages: runtimeApply.reloadedPackages,
+                releaseStream: result.releaseStream,
+                requestedVersion: result.requestedVersion,
+                latestVersion: result.latestVersion,
+                betaVersion: result.betaVersion,
+                message: runtimeApply.requiresRestart
+                    ? `${result.pluginName} installed. Restart required to activate.`
+                    : `${result.pluginName} installed.`,
+            });
+        }
+        catch (err) {
+            error(res, `Install failed: ${err instanceof Error ? err.message : String(err)}`, 500);
+        }
+        return true;
+    }
+    // ── POST /api/plugins/update ────────────────────────────────────────────
+    if (method === "POST" && pathname === "/api/plugins/update") {
+        const body = await readJsonBody(req, res);
+        if (!body)
+            return true;
+        const pluginName = body.name?.trim();
+        const updateValidationError = validateRegistryPluginPackageName(pluginName ?? "");
+        if (updateValidationError) {
+            error(res, updateValidationError, 400);
+            return true;
+        }
+        try {
+            const previousConfig = structuredClone(state.config);
+            const previousResolvedPlugins = state.runtime
+                ? await resolvePluginsSnapshotSafe(previousConfig, "plugin update")
+                : undefined;
+            const pluginManager = requirePluginManager(state.runtime);
+            const updatePlugin = typeof pluginManager.updatePlugin === "function"
+                ? pluginManager.updatePlugin.bind(pluginManager)
+                : pluginManager.installPlugin.bind(pluginManager);
+            const result = await updatePlugin(pluginName, (progress) => {
+                logger.info(`[update] ${progress.phase}: ${progress.message}`);
+                state.broadcastWs?.({
+                    type: "install-progress",
+                    pluginName: progress.pluginName,
+                    phase: progress.phase,
+                    message: progress.message,
+                });
+            }, {
+                releaseStream: body.stream,
+                version: body.version,
+            });
+            if (!result.success) {
+                json(res, { ok: false, error: result.error }, 422);
+                return true;
+            }
+            if (!state.config.plugins) {
+                state.config.plugins = {};
+            }
+            if (!state.config.plugins.entries) {
+                state.config.plugins.entries = {};
+            }
+            const updatedId = (result.pluginName ?? pluginName)
+                .replace(/^@[^/]+\/plugin-/, "")
+                .replace(/^@[^/]+\//, "")
+                .replace(/^plugin-/, "");
+            state.config.plugins.entries[updatedId] = { enabled: true };
+            state.config.plugins.installs = state.config.plugins.installs ?? {};
+            state.config.plugins.installs[result.pluginName ?? pluginName] = {
+                source: "npm",
+                requestedVersion: result.requestedVersion,
+                releaseStream: result.releaseStream,
+                installPath: result.installPath,
+                version: result.version ?? "unknown",
+                installedAt: new Date().toISOString(),
+            };
+            try {
+                saveElizaConfig(state.config);
+            }
+            catch (err) {
+                logger.warn(`[eliza-api] Failed to save config after update: ${err instanceof Error ? err.message : err}`);
+            }
+            const runtimeApply = await applyPluginRuntimeMutation({
+                runtime: state.runtime,
+                previousConfig,
+                nextConfig: state.config,
+                previousResolvedPlugins,
+                changedPluginId: updatedId,
+                changedPluginPackage: result.pluginName,
+                forceReloadPackages: [result.pluginName],
+                expectRuntimeGraphChange: true,
+                reason: `Plugin ${result.pluginName} updated`,
+                restartRuntime,
+            });
+            if (runtimeApply.requiresRestart && body.autoRestart !== false) {
+                scheduleRuntimeRestart(runtimeApply.reason);
+            }
+            json(res, {
+                ok: true,
+                pluginName: result.pluginName,
+                plugin: {
+                    name: result.pluginName,
+                    version: result.version,
+                    installPath: result.installPath,
+                },
+                applied: runtimeApply.mode,
+                requiresRestart: runtimeApply.requiresRestart,
+                restartedRuntime: runtimeApply.restartedRuntime,
+                loadedPackages: runtimeApply.loadedPackages,
+                unloadedPackages: runtimeApply.unloadedPackages,
+                reloadedPackages: runtimeApply.reloadedPackages,
+                releaseStream: result.releaseStream,
+                requestedVersion: result.requestedVersion,
+                latestVersion: result.latestVersion,
+                betaVersion: result.betaVersion,
+                message: runtimeApply.requiresRestart
+                    ? `${result.pluginName} updated. Restart required to activate.`
+                    : `${result.pluginName} updated.`,
+            });
+        }
+        catch (err) {
+            error(res, `Update failed: ${err instanceof Error ? err.message : String(err)}`, 500);
+        }
+        return true;
+    }
+    // ── POST /api/plugins/uninstall ─────────────────────────────────────────
+    if (method === "POST" && pathname === "/api/plugins/uninstall") {
+        const body = await readJsonBody(req, res);
+        if (!body)
+            return true;
+        const pluginName = body.name?.trim();
+        const uninstallValidationError = validateRegistryPluginPackageName(pluginName ?? "");
+        if (uninstallValidationError) {
+            error(res, uninstallValidationError, 400);
+            return true;
+        }
+        try {
+            const previousConfig = structuredClone(state.config);
+            const previousResolvedPlugins = state.runtime
+                ? await resolvePluginsSnapshotSafe(previousConfig, "plugin uninstall")
+                : undefined;
+            const pluginManager = requirePluginManager(state.runtime);
+            const result = await pluginManager.uninstallPlugin(pluginName);
+            if (!result.success) {
+                json(res, { ok: false, error: result.error }, 422);
+                return true;
+            }
+            const removedId = (result.pluginName ?? pluginName)
+                .replace(/^@[^/]+\/plugin-/, "")
+                .replace(/^@[^/]+\//, "")
+                .replace(/^plugin-/, "");
+            const installs = state.config.plugins?.installs;
+            if (installs && typeof installs === "object") {
+                delete installs[result.pluginName ?? pluginName];
+            }
+            const entries = state.config.plugins?.entries;
+            if (entries && typeof entries === "object") {
+                delete entries[removedId];
+            }
+            try {
+                saveElizaConfig(state.config);
+            }
+            catch (err) {
+                logger.warn(`[eliza-api] Failed to save config after uninstall: ${err instanceof Error ? err.message : err}`);
+            }
+            const runtimeApply = await applyPluginRuntimeMutation({
+                runtime: state.runtime,
+                previousConfig,
+                nextConfig: state.config,
+                previousResolvedPlugins,
+                changedPluginId: removedId,
+                changedPluginPackage: result.pluginName,
+                expectRuntimeGraphChange: true,
+                reason: `Plugin ${pluginName} uninstalled`,
+                restartRuntime,
+            });
+            if (runtimeApply.requiresRestart && body.autoRestart !== false) {
+                scheduleRuntimeRestart(runtimeApply.reason);
+            }
+            json(res, {
+                ok: true,
+                pluginName: result.pluginName,
+                applied: runtimeApply.mode,
+                requiresRestart: runtimeApply.requiresRestart,
+                restartedRuntime: runtimeApply.restartedRuntime,
+                loadedPackages: runtimeApply.loadedPackages,
+                unloadedPackages: runtimeApply.unloadedPackages,
+                reloadedPackages: runtimeApply.reloadedPackages,
+                message: runtimeApply.requiresRestart
+                    ? `${pluginName} uninstalled. Restart required.`
+                    : `${pluginName} uninstalled.`,
+            });
+        }
+        catch (err) {
+            error(res, `Uninstall failed: ${err instanceof Error ? err.message : String(err)}`, 500);
+        }
+        return true;
+    }
+    // ── POST /api/plugins/:id/eject ─────────────────────────────────────────
+    if (method === "POST" && pathname.match(/^\/api\/plugins\/[^/]+\/eject$/)) {
+        const pluginName = decodeURIComponent(pathname.slice("/api/plugins/".length, pathname.length - "/eject".length));
+        try {
+            const previousConfig = structuredClone(state.config);
+            const previousResolvedPlugins = state.runtime
+                ? await resolvePluginsSnapshotSafe(previousConfig, "plugin eject")
+                : undefined;
+            const pluginManager = requirePluginManager(state.runtime);
+            // Ensure the method exists on the service (it should)
+            if (typeof pluginManager.ejectPlugin !== "function") {
+                throw new Error("Plugin manager does not support ejecting plugins");
+            }
+            const result = await pluginManager.ejectPlugin(pluginName);
+            if (!result.success) {
+                json(res, { ok: false, error: result.error }, 422);
+                return true;
+            }
+            const runtimeApply = await applyPluginRuntimeMutation({
+                runtime: state.runtime,
+                previousConfig,
+                nextConfig: state.config,
+                previousResolvedPlugins,
+                changedPluginId: pluginName,
+                changedPluginPackage: result.pluginName,
+                forceReloadPackages: [result.pluginName],
+                expectRuntimeGraphChange: true,
+                reason: `Plugin ${pluginName} ejected`,
+                restartRuntime,
+            });
+            if (runtimeApply.requiresRestart) {
+                scheduleRuntimeRestart(runtimeApply.reason);
+            }
+            json(res, {
+                ok: true,
+                pluginName: result.pluginName,
+                applied: runtimeApply.mode,
+                requiresRestart: runtimeApply.requiresRestart,
+                restartedRuntime: runtimeApply.restartedRuntime,
+                loadedPackages: runtimeApply.loadedPackages,
+                unloadedPackages: runtimeApply.unloadedPackages,
+                reloadedPackages: runtimeApply.reloadedPackages,
+                message: `${pluginName} ejected to local source.`,
+            });
+        }
+        catch (err) {
+            error(res, `Eject failed: ${err instanceof Error ? err.message : String(err)}`, 500);
+        }
+        return true;
+    }
+    // ── POST /api/plugins/:id/sync ──────────────────────────────────────────
+    if (method === "POST" && pathname.match(/^\/api\/plugins\/[^/]+\/sync$/)) {
+        const pluginName = decodeURIComponent(pathname.slice("/api/plugins/".length, pathname.length - "/sync".length));
+        try {
+            const previousConfig = structuredClone(state.config);
+            const previousResolvedPlugins = state.runtime
+                ? await resolvePluginsSnapshotSafe(previousConfig, "plugin sync")
+                : undefined;
+            const pluginManager = requirePluginManager(state.runtime);
+            if (typeof pluginManager.syncPlugin !== "function") {
+                throw new Error("Plugin manager does not support syncing plugins");
+            }
+            const result = await pluginManager.syncPlugin(pluginName);
+            if (!result.success) {
+                json(res, { ok: false, error: result.error }, 422);
+                return true;
+            }
+            const runtimeApply = await applyPluginRuntimeMutation({
+                runtime: state.runtime,
+                previousConfig,
+                nextConfig: state.config,
+                previousResolvedPlugins,
+                changedPluginId: pluginName,
+                changedPluginPackage: result.pluginName,
+                forceReloadPackages: result.requiresRestart ? [result.pluginName] : [],
+                expectRuntimeGraphChange: true,
+                reason: `Plugin ${pluginName} synced`,
+                restartRuntime,
+            });
+            if (runtimeApply.requiresRestart) {
+                scheduleRuntimeRestart(runtimeApply.reason);
+            }
+            json(res, {
+                ok: true,
+                pluginName: result.pluginName,
+                applied: runtimeApply.mode,
+                requiresRestart: runtimeApply.requiresRestart,
+                restartedRuntime: runtimeApply.restartedRuntime,
+                loadedPackages: runtimeApply.loadedPackages,
+                unloadedPackages: runtimeApply.unloadedPackages,
+                reloadedPackages: runtimeApply.reloadedPackages,
+                message: `${pluginName} synced with upstream.`,
+            });
+        }
+        catch (err) {
+            error(res, `Sync failed: ${err instanceof Error ? err.message : String(err)}`, 500);
+        }
+        return true;
+    }
+    // ── POST /api/plugins/:id/reinject ──────────────────────────────────────
+    if (method === "POST" &&
+        pathname.match(/^\/api\/plugins\/[^/]+\/reinject$/)) {
+        const pluginName = decodeURIComponent(pathname.slice("/api/plugins/".length, pathname.length - "/reinject".length));
+        try {
+            const previousConfig = structuredClone(state.config);
+            const previousResolvedPlugins = state.runtime
+                ? await resolvePluginsSnapshotSafe(previousConfig, "plugin reinject")
+                : undefined;
+            const pluginManager = requirePluginManager(state.runtime);
+            if (typeof pluginManager.reinjectPlugin !== "function") {
+                throw new Error("Plugin manager does not support reinjecting plugins");
+            }
+            const result = await pluginManager.reinjectPlugin(pluginName);
+            if (!result.success) {
+                json(res, { ok: false, error: result.error }, 422);
+                return true;
+            }
+            const runtimeApply = await applyPluginRuntimeMutation({
+                runtime: state.runtime,
+                previousConfig,
+                nextConfig: state.config,
+                previousResolvedPlugins,
+                changedPluginId: pluginName,
+                changedPluginPackage: result.pluginName,
+                forceReloadPackages: [result.pluginName],
+                expectRuntimeGraphChange: true,
+                reason: `Plugin ${pluginName} reinjected`,
+                restartRuntime,
+            });
+            if (runtimeApply.requiresRestart) {
+                scheduleRuntimeRestart(runtimeApply.reason);
+            }
+            json(res, {
+                ok: true,
+                pluginName: result.pluginName,
+                applied: runtimeApply.mode,
+                requiresRestart: runtimeApply.requiresRestart,
+                restartedRuntime: runtimeApply.restartedRuntime,
+                loadedPackages: runtimeApply.loadedPackages,
+                unloadedPackages: runtimeApply.unloadedPackages,
+                reloadedPackages: runtimeApply.reloadedPackages,
+                message: `${pluginName} restored to registry version.`,
+            });
+        }
+        catch (err) {
+            error(res, `Reinject failed: ${err instanceof Error ? err.message : String(err)}`, 500);
+        }
+        return true;
+    }
+    // ── GET /api/plugins/installed ──────────────────────────────────────────
+    // List plugins that were installed from the registry at runtime.
+    if (method === "GET" && pathname === "/api/plugins/installed") {
+        try {
+            const pluginManager = requirePluginManager(state.runtime);
+            const installed = await pluginManager.listInstalledPlugins();
+            json(res, { count: installed.length, plugins: installed });
+        }
+        catch (err) {
+            error(res, `Failed to list installed plugins: ${err instanceof Error ? err.message : String(err)}`, 500);
+        }
+        return true;
+    }
+    // ── GET /api/plugins/ejected ────────────────────────────────────────────
+    // List plugins ejected to local source checkouts with upstream metadata.
+    if (method === "GET" && pathname === "/api/plugins/ejected") {
+        try {
+            const pluginManager = requirePluginManager(state.runtime);
+            if (typeof pluginManager.listEjectedPlugins !== "function") {
+                throw new Error("Plugin manager does not support listing ejected plugins");
+            }
+            const plugins = await pluginManager.listEjectedPlugins();
+            json(res, { count: plugins.length, plugins });
+        }
+        catch (err) {
+            error(res, `Failed to list ejected plugins: ${err instanceof Error ? err.message : String(err)}`, 500);
+        }
+        return true;
+    }
+    // ── GET /api/core/status ────────────────────────────────────────────────
+    // Returns whether @elizaos/core is ejected or resolved from npm.
+    if (method === "GET" && pathname === "/api/core/status") {
+        try {
+            const coreManager = requireCoreManager(state.runtime);
+            const coreStatus = await coreManager.getCoreStatus();
+            json(res, coreStatus);
+        }
+        catch (err) {
+            error(res, `Failed to get core status: ${err instanceof Error ? err.message : String(err)}`, 500);
+        }
+        return true;
+    }
+    // ── GET /api/plugins/core ────────────────────────────────────────────
+    // Returns all core and optional core plugins with their loaded/running status.
+    if (method === "GET" && pathname === "/api/plugins/core") {
+        // Build a set of loaded plugin names for robust matching.
+        // Plugin internal names vary wildly (e.g. "local-ai" for plugin-local-embedding,
+        // "coding-tools" for plugin-coding-tools), so we check loaded names against multiple
+        // derived forms of the npm package name.
+        const loadedNames = state.runtime
+            ? new Set(state.runtime.plugins.map((p) => p.name))
+            : new Set();
+        const isLoaded = (npmName) => {
+            if (loadedNames.has(npmName))
+                return true;
+            // @elizaos/plugin-foo -> plugin-foo
+            const withoutScope = npmName.replace("@elizaos/", "");
+            if (loadedNames.has(withoutScope))
+                return true;
+            // plugin-foo -> foo
+            const shortId = withoutScope.replace("plugin-", "");
+            if (loadedNames.has(shortId))
+                return true;
+            // Check if ANY loaded name contains the short id or vice versa
+            for (const n of loadedNames) {
+                if (n.includes(shortId) || shortId.includes(n))
+                    return true;
+            }
+            return false;
+        };
+        // Check which optional plugins are currently in the allow list
+        const allowList = new Set(state.config.plugins?.allow ?? []);
+        const makeEntry = (npm, isCore) => {
+            const id = optionalPluginListId(npm);
+            return {
+                npmName: npm,
+                id,
+                name: id
+                    .split("-")
+                    .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
+                    .join(" "),
+                isCore,
+                loaded: isLoaded(npm),
+                enabled: isCore || allowList.has(npm) || allowList.has(id),
+            };
+        };
+        const coreList = CORE_PLUGINS.map((npm) => makeEntry(npm, true));
+        const optionalList = OPTIONAL_CORE_PLUGINS.map((npm) => makeEntry(npm, false));
+        json(res, { core: coreList, optional: optionalList });
+        return true;
+    }
+    // ── POST /api/plugins/core/toggle ─────────────────────────────────────
+    // Enable or disable an optional core plugin by updating the allow list.
+    if (method === "POST" && pathname === "/api/plugins/core/toggle") {
+        const body = await readJsonBody(req, res);
+        if (!body?.npmName)
+            return true;
+        // Only allow toggling optional plugins, not core
+        const isCorePlugin = CORE_PLUGINS.includes(body.npmName);
+        if (isCorePlugin) {
+            error(res, "Core plugins cannot be disabled");
+            return true;
+        }
+        const isOptional = OPTIONAL_CORE_PLUGINS.includes(body.npmName);
+        if (!isOptional) {
+            error(res, "Unknown optional plugin");
+            return true;
+        }
+        const previousConfig = structuredClone(state.config);
+        const previousResolvedPlugins = state.runtime
+            ? await resolvePluginsSnapshotSafe(previousConfig, "core plugin toggle")
+            : undefined;
+        // Update the allow list in config
+        state.config.plugins = state.config.plugins ?? {};
+        state.config.plugins.allow = state.config.plugins.allow ?? [];
+        const allow = state.config.plugins.allow;
+        const shortId = optionalPluginListId(body.npmName);
+        if (body.enabled) {
+            if (!allow.includes(body.npmName) && !allow.includes(shortId)) {
+                allow.push(body.npmName);
+            }
+        }
+        else {
+            state.config.plugins.allow = allow.filter((p) => p !== body.npmName && p !== shortId);
+        }
+        // Keep plugins.entries.enabled aligned with the toggle so optional baked-in
+        // plugins that use strict `enabled === true` entry rules stay consistent.
+        const pluginsRoot = state.config.plugins;
+        const prevEntries = pluginsRoot.entries ?? {};
+        pluginsRoot.entries = {
+            ...prevEntries,
+            [shortId]: {
+                ...prevEntries[shortId],
+                enabled: body.enabled,
+            },
+        };
+        try {
+            saveElizaConfig(state.config);
+        }
+        catch (err) {
+            logger.warn(`[api] Config save failed: ${err instanceof Error ? err.message : err}`);
+        }
+        const runtimeApply = await applyPluginRuntimeMutation({
+            runtime: state.runtime,
+            previousConfig,
+            nextConfig: state.config,
+            previousResolvedPlugins,
+            changedPluginId: shortId,
+            changedPluginPackage: body.npmName,
+            expectRuntimeGraphChange: true,
+            reason: `Plugin ${shortId} ${body.enabled ? "enabled" : "disabled"}`,
+            restartRuntime,
+        });
+        if (runtimeApply.requiresRestart) {
+            scheduleRuntimeRestart(runtimeApply.reason);
+        }
+        json(res, {
+            ok: true,
+            applied: runtimeApply.mode,
+            requiresRestart: runtimeApply.requiresRestart,
+            restartedRuntime: runtimeApply.restartedRuntime,
+            loadedPackages: runtimeApply.loadedPackages,
+            unloadedPackages: runtimeApply.unloadedPackages,
+            reloadedPackages: runtimeApply.reloadedPackages,
+            diagnostics: (() => {
+                const diagnostic = buildCoreToggleDiagnostics(state.config, body.npmName);
+                return diagnostic && diagnostic.drift_flags.length > 0
+                    ? {
+                        withDrift: true,
+                        plugin: diagnostic,
+                    }
+                    : undefined;
+            })(),
+            message: runtimeApply.requiresRestart
+                ? `${shortId} ${body.enabled ? "enabled" : "disabled"}. Restart required.`
+                : `${shortId} ${body.enabled ? "enabled" : "disabled"}.`,
+        });
+        return true;
+    }
+    return false;
+}