@elizaos/agent 2.0.0-alpha.98 → 2.0.0-beta.2

package/packages/agent/src/api/server-helpers-config.js

@@ -0,0 +1,293 @@
+/**
+ * Config redaction, onboarding, and skill validation helpers extracted from server.ts.
+ */
+import path from "node:path";
+import { logger, sendJsonError } from "@elizaos/core";
+import { getDefaultStylePreset, getStylePresets, normalizeCharacterLanguage, ONBOARDING_CLOUD_PROVIDER_OPTIONS, ONBOARDING_PROVIDER_CATALOG, } from "@elizaos/shared";
+import { generateWalletKeys, setSolanaWalletEnv } from "./wallet.js";
+// ---------------------------------------------------------------------------
+// Config redaction
+// ---------------------------------------------------------------------------
+/**
+ * Key patterns that indicate a value is sensitive and must be redacted.
+ */
+export const SENSITIVE_KEY_RE = /password|secret|api.?key|private.?key|seed.?phrase|authorization|connection.?string|credential|(?<!max)tokens?$/i;
+export function isBlockedObjectKey(key) {
+    return (key === "__proto__" ||
+        key === "constructor" ||
+        key === "prototype" ||
+        key === "$include");
+}
+function redactValue(val) {
+    if (val === null || val === undefined)
+        return val;
+    if (typeof val === "string")
+        return val.length > 0 ? "[REDACTED]" : "";
+    if (typeof val === "number" || typeof val === "boolean")
+        return "[REDACTED]";
+    if (Array.isArray(val))
+        return val.map(redactValue);
+    if (typeof val === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(val)) {
+            out[k] = redactValue(v);
+        }
+        return out;
+    }
+    return "[REDACTED]";
+}
+export function redactDeep(val) {
+    if (val === null || val === undefined)
+        return val;
+    if (Array.isArray(val))
+        return val.map(redactDeep);
+    if (typeof val === "object") {
+        const out = {};
+        for (const [key, child] of Object.entries(val)) {
+            if (SENSITIVE_KEY_RE.test(key)) {
+                out[key] = redactValue(child);
+            }
+            else {
+                out[key] = redactDeep(child);
+            }
+        }
+        return out;
+    }
+    return val;
+}
+export function redactConfigSecrets(config) {
+    return redactDeep(config);
+}
+export function isRedactedSecretValue(value) {
+    return (typeof value === "string" && value.trim().toUpperCase() === "[REDACTED]");
+}
+/** Remove UI round-trip placeholders so GET /api/config -> PUT never persists "[REDACTED]". */
+export function stripRedactedPlaceholderValuesDeep(value) {
+    if (value === null || typeof value !== "object")
+        return;
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            stripRedactedPlaceholderValuesDeep(item);
+        }
+        return;
+    }
+    const obj = value;
+    for (const key of Object.keys(obj)) {
+        const v = obj[key];
+        if (isRedactedSecretValue(v)) {
+            delete obj[key];
+        }
+        else if (v !== null && typeof v === "object") {
+            stripRedactedPlaceholderValuesDeep(v);
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Skill-ID path-traversal guard
+// ---------------------------------------------------------------------------
+const SAFE_SKILL_ID_RE = /^[a-zA-Z0-9._-]+$/;
+export function validateSkillId(skillId, res) {
+    if (!skillId ||
+        !SAFE_SKILL_ID_RE.test(skillId) ||
+        skillId === "." ||
+        skillId.includes("..")) {
+        const safeDisplay = skillId.slice(0, 80).replace(/[^\x20-\x7e]/g, "?");
+        sendJsonError(res, `Invalid skill ID: "${safeDisplay}"`, 400);
+        return null;
+    }
+    return skillId;
+}
+// ---------------------------------------------------------------------------
+// Onboarding helpers
+// ---------------------------------------------------------------------------
+const DEFAULT_ELEVENLABS_TTS_MODEL = "eleven_flash_v2_5";
+const ELEVENLABS_VOICE_ID_BY_PRESET = {
+    rachel: "21m00Tcm4TlvDq8ikWAM",
+    sarah: "EXAVITQu4vr4xnSDxMaL",
+    matilda: "XrExE9yKIg1WjnnlVkGX",
+    lily: "pFZP5JQG7iQjIQuC4Bku",
+    alice: "Xb7hH8MSUJpSbSDYk0k2",
+    brian: "nPczCjzI2devNBz1zQrb",
+    adam: "pNInz6obpgDQGcFmaJgB",
+    josh: "TxGEqnHWrfWFTfGW9XjX",
+    daniel: "onwK4e9ZLuTAKqWW03F9",
+    liam: "TX3LPaxmHKxFdv7VOQHJ",
+    gigi: "jBpfuIE2acCO8z3wKNLl",
+    mimi: "zrHiDhphv9ZnVXBqCLjz",
+    dorothy: "ThT5KcBeYPX3keUQqHPh",
+    glinda: "z9fAnlkpzviPz146aGWa",
+    charlotte: "XB0fDUnXU5powFXDhCwa",
+    callum: "N2lVS1w4EtoT3dr4eOWO",
+    momo: "n7Wi4g1bhpw4Bs8HK5ph",
+    yuki: "4tRn1lSkEn13EVTuqb0g",
+    rin: "cNYrMw9glwJZXR8RwbuR",
+    kei: "eadgjmk4R4uojdsheG9t",
+    jin: "6IwYbsNENZgAB1dtBZDp",
+    satoshi: "7cOBG34AiHrAzs842Rdi",
+    ryu: "QzTKubutNn9TjrB7Xb2Q",
+};
+export function readUiLanguageHeader(req) {
+    if (!req) {
+        return undefined;
+    }
+    const header = req.headers["x-eliza-ui-language"] ?? req.headers["x-eliza-ui-language"];
+    if (Array.isArray(header)) {
+        return header.find((value) => value.trim())?.trim();
+    }
+    return typeof header === "string" && header.trim()
+        ? header.trim()
+        : undefined;
+}
+export function resolveConfiguredCharacterLanguage(config, req) {
+    const uiLanguage = readUiLanguageHeader(req) ??
+        config?.ui?.language;
+    return normalizeCharacterLanguage(uiLanguage);
+}
+export function resolveOnboardingStylePreset(body, language) {
+    const presets = getStylePresets(language);
+    const requestedPresetId = typeof body.presetId === "string" ? body.presetId.trim() : "";
+    if (requestedPresetId) {
+        const byId = presets.find((preset) => preset.id === requestedPresetId);
+        if (byId)
+            return byId;
+    }
+    if (typeof body.avatarIndex === "number" &&
+        Number.isFinite(body.avatarIndex)) {
+        const byAvatar = presets.find((preset) => preset.avatarIndex === Number(body.avatarIndex));
+        if (byAvatar)
+            return byAvatar;
+    }
+    const requestedName = typeof body.name === "string" ? body.name.trim() : "";
+    if (requestedName) {
+        const byName = presets.find((preset) => preset.name === requestedName);
+        if (byName)
+            return byName;
+    }
+    return getDefaultStylePreset(language);
+}
+export function applyOnboardingVoicePreset(config, body, language) {
+    const elevenLabsApiKey = process.env.ELEVENLABS_API_KEY?.trim();
+    if (!elevenLabsApiKey) {
+        return;
+    }
+    const stylePreset = resolveOnboardingStylePreset(body, language);
+    const voicePresetId = stylePreset?.voicePresetId?.trim();
+    if (!voicePresetId) {
+        return;
+    }
+    const voiceId = ELEVENLABS_VOICE_ID_BY_PRESET[voicePresetId];
+    if (!voiceId) {
+        return;
+    }
+    if (!config.messages || typeof config.messages !== "object") {
+        config.messages = {};
+    }
+    const messages = config.messages;
+    const existingTts = messages.tts && typeof messages.tts === "object"
+        ? messages.tts
+        : {};
+    const existingElevenlabs = existingTts.elevenlabs && typeof existingTts.elevenlabs === "object"
+        ? existingTts.elevenlabs
+        : {};
+    messages.tts = {
+        ...existingTts,
+        provider: "elevenlabs",
+        elevenlabs: {
+            ...existingElevenlabs,
+            voiceId,
+            modelId: typeof existingElevenlabs.modelId === "string" &&
+                existingElevenlabs.modelId.trim()
+                ? existingElevenlabs.modelId.trim()
+                : DEFAULT_ELEVENLABS_TTS_MODEL,
+        },
+    };
+}
+export function resolveDefaultAgentName(config, req) {
+    const configuredName = config?.ui?.assistant?.name?.trim() ??
+        config?.agents?.list?.[0]?.name?.trim();
+    if (configuredName) {
+        return configuredName;
+    }
+    return getDefaultStylePreset(resolveConfiguredCharacterLanguage(config, req))
+        .name;
+}
+export function getProviderOptions() {
+    return ONBOARDING_PROVIDER_CATALOG.map((provider) => ({
+        id: provider.id,
+        name: provider.name,
+        envKey: provider.envKey,
+        pluginName: provider.pluginName,
+        keyPrefix: provider.keyPrefix,
+        description: provider.description,
+    }));
+}
+export function getCloudProviderOptions() {
+    return ONBOARDING_CLOUD_PROVIDER_OPTIONS.map((provider) => ({
+        id: provider.id,
+        name: provider.name,
+        description: provider.description,
+    }));
+}
+export function ensureWalletKeysInEnvAndConfig(config) {
+    const missingEvm = typeof process.env.EVM_PRIVATE_KEY !== "string" ||
+        !process.env.EVM_PRIVATE_KEY.trim();
+    const missingSolana = typeof process.env.SOLANA_PRIVATE_KEY !== "string" ||
+        !process.env.SOLANA_PRIVATE_KEY.trim();
+    if (!missingEvm && !missingSolana) {
+        return false;
+    }
+    try {
+        const walletKeys = generateWalletKeys();
+        if (!config.env ||
+            typeof config.env !== "object" ||
+            Array.isArray(config.env)) {
+            config.env = {};
+        }
+        const envConfig = config.env;
+        if (missingEvm) {
+            envConfig.EVM_PRIVATE_KEY = walletKeys.evmPrivateKey;
+            process.env.EVM_PRIVATE_KEY = walletKeys.evmPrivateKey;
+            logger.info(`[eliza-api] Generated EVM wallet: ${walletKeys.evmAddress}`);
+        }
+        if (missingSolana) {
+            envConfig.SOLANA_PRIVATE_KEY = walletKeys.solanaPrivateKey;
+            setSolanaWalletEnv(walletKeys.solanaPrivateKey);
+            logger.info(`[eliza-api] Generated Solana wallet: ${walletKeys.solanaAddress}`);
+        }
+        return true;
+    }
+    catch (err) {
+        logger.warn(`[eliza-api] Failed to generate wallet keys: ${err instanceof Error ? err.message : String(err)}`);
+        return false;
+    }
+}
+// ---------------------------------------------------------------------------
+// State dir safety
+// ---------------------------------------------------------------------------
+const RESET_STATE_ALLOWED_SEGMENTS = new Set([
+    ".eliza",
+    "eliza",
+    ".eliza",
+    "eliza",
+]);
+function hasAllowedResetSegment(resolvedState) {
+    return resolvedState
+        .split(path.sep)
+        .some((segment) => RESET_STATE_ALLOWED_SEGMENTS.has(segment.trim().toLowerCase()));
+}
+export function isSafeResetStateDir(resolvedState, homeDir) {
+    const normalizedState = path.resolve(resolvedState);
+    const normalizedHome = path.resolve(homeDir);
+    const parsedRoot = path.parse(normalizedState).root;
+    if (normalizedState === parsedRoot)
+        return false;
+    if (normalizedState === normalizedHome)
+        return false;
+    const relativeToHome = path.relative(normalizedHome, normalizedState);
+    const isUnderHome = relativeToHome.length > 0 &&
+        !relativeToHome.startsWith("..") &&
+        !path.isAbsolute(relativeToHome);
+    if (!isUnderHome)
+        return false;
+    return hasAllowedResetSegment(normalizedState);
+}

package/packages/agent/src/api/server-helpers-fetch.d.ts

@@ -0,0 +1,15 @@
+/**
+ * HTTP fetch/streaming helpers extracted from server.ts.
+ */
+import type http from "node:http";
+type StreamableServerResponse = Pick<http.ServerResponse, "write" | "once" | "off" | "removeListener" | "writableEnded" | "destroyed">;
+export declare function responseContentLength(headers: Pick<Headers, "get">): number | null;
+export declare function isAbortError(error: unknown): boolean;
+export declare function fetchWithTimeoutGuard(input: string | URL, init: RequestInit, timeoutMs: number): Promise<Response>;
+/**
+ * Stream a web Response body to an HTTP response while enforcing a strict byte cap.
+ * Returns the number of bytes forwarded.
+ */
+export declare function streamResponseBodyWithByteLimit(upstream: Response, res: StreamableServerResponse, maxBytes: number, timeoutMs?: number): Promise<number>;
+export {};
+//# sourceMappingURL=server-helpers-fetch.d.ts.map

package/packages/agent/src/api/server-helpers-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-helpers-fetch.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-helpers-fetch.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,KAAK,wBAAwB,GAAG,IAAI,CAClC,IAAI,CAAC,cAAc,EACnB,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,gBAAgB,GAAG,eAAe,GAAG,WAAW,CAC5E,CAAC;AAgBF,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,GAC5B,MAAM,GAAG,IAAI,CAMf;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKpD;AAQD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,GAAG,GAAG,EACnB,IAAI,EAAE,WAAW,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,QAAQ,CAAC,CAwCnB;AA8BD;;;GAGG;AACH,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,wBAAwB,EAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAmEjB"}

package/packages/agent/src/api/server-helpers-fetch.js

@@ -0,0 +1,149 @@
+/**
+ * HTTP fetch/streaming helpers extracted from server.ts.
+ */
+function removeResponseListener(res, event, handler) {
+    if (typeof res.off === "function") {
+        res.off(event, handler);
+        return;
+    }
+    if (typeof res.removeListener === "function") {
+        res.removeListener(event, handler);
+    }
+}
+export function responseContentLength(headers) {
+    const raw = headers.get("content-length");
+    if (!raw)
+        return null;
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isFinite(parsed) || parsed < 0)
+        return null;
+    return parsed;
+}
+export function isAbortError(error) {
+    return error instanceof DOMException
+        ? error.name === "AbortError" || error.name === "TimeoutError"
+        : error instanceof Error &&
+            (error.name === "AbortError" || error.name === "TimeoutError");
+}
+function createTimeoutError(message) {
+    const timeoutError = new Error(message);
+    timeoutError.name = "TimeoutError";
+    return timeoutError;
+}
+export async function fetchWithTimeoutGuard(input, init, timeoutMs) {
+    const controller = new AbortController();
+    const upstreamSignal = init.signal;
+    let timedOut = false;
+    const onAbort = () => {
+        controller.abort();
+    };
+    if (upstreamSignal) {
+        if (upstreamSignal.aborted) {
+            controller.abort();
+        }
+        else {
+            upstreamSignal.addEventListener("abort", onAbort, { once: true });
+        }
+    }
+    const timeoutHandle = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+    }, timeoutMs);
+    try {
+        return await fetch(input, {
+            ...init,
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        if (timedOut && isAbortError(err)) {
+            throw createTimeoutError(`Upstream request timed out after ${timeoutMs}ms`);
+        }
+        throw err;
+    }
+    finally {
+        clearTimeout(timeoutHandle);
+        if (upstreamSignal) {
+            upstreamSignal.removeEventListener("abort", onAbort);
+        }
+    }
+}
+async function waitForDrain(res) {
+    await new Promise((resolve, reject) => {
+        const onDrain = () => {
+            cleanup();
+            resolve();
+        };
+        const onError = (err) => {
+            cleanup();
+            reject(err instanceof Error ? err : new Error(String(err)));
+        };
+        const cleanup = () => {
+            removeResponseListener(res, "drain", onDrain);
+            removeResponseListener(res, "error", onError);
+        };
+        res.once("drain", onDrain);
+        res.once("error", onError);
+    });
+}
+/**
+ * Stream a web Response body to an HTTP response while enforcing a strict byte cap.
+ * Returns the number of bytes forwarded.
+ */
+export async function streamResponseBodyWithByteLimit(upstream, res, maxBytes, timeoutMs) {
+    const declaredLength = responseContentLength(upstream.headers);
+    if (declaredLength !== null && declaredLength > maxBytes) {
+        throw new Error(`Upstream response exceeds maximum size of ${maxBytes} bytes`);
+    }
+    if (!upstream.body) {
+        throw new Error("Upstream response did not include a body stream");
+    }
+    const reader = upstream.body.getReader();
+    let totalBytes = 0;
+    let streamTimeoutHandle = null;
+    const streamTimeoutPromise = typeof timeoutMs === "number" && timeoutMs > 0
+        ? new Promise((_resolve, reject) => {
+            streamTimeoutHandle = setTimeout(() => {
+                reject(createTimeoutError(`Upstream response body timed out after ${timeoutMs}ms`));
+            }, timeoutMs);
+        })
+        : null;
+    try {
+        while (true) {
+            const { done, value } = streamTimeoutPromise
+                ? await Promise.race([reader.read(), streamTimeoutPromise])
+                : await reader.read();
+            if (done)
+                break;
+            if (!value || value.byteLength === 0)
+                continue;
+            totalBytes += value.byteLength;
+            if (totalBytes > maxBytes) {
+                throw new Error(`Upstream response exceeds maximum size of ${maxBytes} bytes`);
+            }
+            if (res.writableEnded || res.destroyed) {
+                throw new Error("Client connection closed while streaming response");
+            }
+            const canContinue = res.write(Buffer.from(value));
+            if (!canContinue) {
+                await waitForDrain(res);
+            }
+        }
+    }
+    catch (err) {
+        try {
+            await reader.cancel(err);
+        }
+        catch {
+            // Best effort cleanup; keep original error.
+        }
+        throw err;
+    }
+    finally {
+        if (streamTimeoutHandle !== null) {
+            clearTimeout(streamTimeoutHandle);
+        }
+        reader.releaseLock();
+    }
+    return totalBytes;
+}

package/packages/agent/src/api/server-helpers-mcp.d.ts

@@ -0,0 +1,12 @@
+/**
+ * MCP server configuration validation helpers extracted from server.ts.
+ */
+import type http from "node:http";
+import type { TerminalRunRejection } from "./server-helpers-auth.ts";
+export declare function validateMcpServerConfig(config: Record<string, unknown>): Promise<string | null>;
+export declare function resolveMcpServersRejection(servers: Record<string, unknown>): Promise<string | null>;
+export declare function mcpServersIncludeStdio(servers: Record<string, unknown>): boolean;
+export declare function resolveMcpTerminalAuthorizationRejection(req: Pick<http.IncomingMessage, "headers">, servers: Record<string, unknown>, body: {
+    terminalToken?: string;
+}): TerminalRunRejection | null;
+//# sourceMappingURL=server-helpers-mcp.d.ts.map

package/packages/agent/src/api/server-helpers-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-helpers-mcp.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-helpers-mcp.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAOlC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AA+MrE,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4GxB;AAED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuBxB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAWT;AAED,wBAAgB,wCAAwC,CACtD,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,EAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/B,oBAAoB,GAAG,IAAI,CAK7B"}