@elizaos/agent 2.0.0-alpha.98 → 2.0.0-beta.2

package/packages/agent/src/api/static-file-server.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Static file serving for the built React dashboard (production mode).
+ *
+ * Extracted from server.ts — serves packages/app/dist/ with SPA fallback,
+ * caching, and API-base injection for reverse-proxy deployments.
+ */
+import type http from "node:http";
+export declare function resolveUiDir(): string | null;
+export declare function sendStaticResponse(req: http.IncomingMessage, res: http.ServerResponse, status: number, headers: Record<string, string | number>, body?: Buffer): void;
+/**
+ * Serve built dashboard assets from packages/app/dist with SPA fallback.
+ * Returns true when the request is handled.
+ */
+export declare function injectApiBaseIntoHtml(html: Buffer, externalBase?: string | null, opts?: {
+    apiToken?: string | null;
+}): Buffer;
+export declare function serveStaticUi(req: http.IncomingMessage, res: http.ServerResponse, pathname: string): boolean;
+export declare function isAuthProtectedRoute(pathname: string): boolean;
+//# sourceMappingURL=static-file-server.d.ts.map

package/packages/agent/src/api/static-file-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-file-server.d.ts","sourceRoot":"","sources":["../../../../../src/api/static-file-server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAiDlC,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAiC5C;AAMD,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,EACxC,IAAI,CAAC,EAAE,MAAM,GACZ,IAAI,CAON;AAyBD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,EAC5B,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAClC,MAAM,CAuBR;AAMD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CA2GT;AAMD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAS9D"}

package/packages/agent/src/api/static-file-server.js

@@ -0,0 +1,234 @@
+/**
+ * Static file serving for the built React dashboard (production mode).
+ *
+ * Extracted from server.ts — serves packages/app/dist/ with SPA fallback,
+ * caching, and API-base injection for reverse-proxy deployments.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { logger, sendJsonError } from "@elizaos/core";
+import { isCloudProvisionedContainer } from "@elizaos/plugin-elizacloud";
+import { resolveApiToken } from "@elizaos/shared";
+import { getOrReadCachedFile } from "./memory-bounds.js";
+import { findOwnPackageRoot } from "./server-helpers.js";
+// ---------------------------------------------------------------------------
+// MIME types
+// ---------------------------------------------------------------------------
+const STATIC_MIME = {
+    ".css": "text/css; charset=utf-8",
+    ".gif": "image/gif",
+    ".gz": "application/octet-stream",
+    ".glb": "model/gltf-binary",
+    ".gltf": "model/gltf+json",
+    ".html": "text/html; charset=utf-8",
+    ".ico": "image/x-icon",
+    ".jpeg": "image/jpeg",
+    ".jpg": "image/jpeg",
+    ".js": "application/javascript; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".map": "application/json",
+    ".mjs": "application/javascript; charset=utf-8",
+    ".mp3": "audio/mpeg",
+    ".ogg": "audio/ogg",
+    ".png": "image/png",
+    ".svg": "image/svg+xml",
+    ".ttf": "font/ttf",
+    ".txt": "text/plain; charset=utf-8",
+    ".vrm": "model/gltf-binary",
+    ".wasm": "application/wasm",
+    ".wav": "audio/wav",
+    ".webp": "image/webp",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+};
+// ---------------------------------------------------------------------------
+// UI directory resolution
+// ---------------------------------------------------------------------------
+/** Resolved UI directory. Lazily computed once on first request. */
+let uiDir;
+let uiIndexHtml = null;
+export function resolveUiDir() {
+    if (uiDir !== undefined)
+        return uiDir;
+    if (process.env.NODE_ENV !== "production") {
+        uiDir = null;
+        return null;
+    }
+    const thisDir = path.dirname(fileURLToPath(import.meta.url));
+    const packageRoot = findOwnPackageRoot(thisDir);
+    const candidates = [
+        path.resolve("packages/app/dist"),
+        path.resolve("apps/app/dist"),
+        path.resolve(packageRoot, "packages", "app", "dist"),
+        path.resolve(packageRoot, "apps", "app", "dist"),
+    ];
+    for (const candidate of candidates) {
+        const indexPath = path.join(candidate, "index.html");
+        try {
+            if (fs.statSync(indexPath).isFile()) {
+                uiDir = candidate;
+                uiIndexHtml = fs.readFileSync(indexPath);
+                logger.info(`[eliza-api] Serving dashboard UI from ${candidate}`);
+                return uiDir;
+            }
+        }
+        catch {
+            // Candidate not present, keep searching.
+        }
+    }
+    uiDir = null;
+    logger.info("[eliza-api] No built UI found — dashboard routes are disabled");
+    return null;
+}
+// ---------------------------------------------------------------------------
+// Response helpers
+// ---------------------------------------------------------------------------
+export function sendStaticResponse(req, res, status, headers, body) {
+    res.writeHead(status, headers);
+    if (req.method === "HEAD") {
+        res.end();
+        return;
+    }
+    res.end(body);
+}
+// ---------------------------------------------------------------------------
+// Static file cache
+// ---------------------------------------------------------------------------
+const STATIC_CACHE_MAX = 50;
+const STATIC_CACHE_FILE_LIMIT = 512 * 1024; // 512 KB
+const staticFileCache = new Map();
+function getCachedFile(filePath, mtimeMs) {
+    return getOrReadCachedFile(staticFileCache, filePath, mtimeMs, (p) => fs.readFileSync(p), STATIC_CACHE_MAX, STATIC_CACHE_FILE_LIMIT);
+}
+// ---------------------------------------------------------------------------
+// API base injection (reverse-proxy support)
+// ---------------------------------------------------------------------------
+/**
+ * Serve built dashboard assets from packages/app/dist with SPA fallback.
+ * Returns true when the request is handled.
+ */
+export function injectApiBaseIntoHtml(html, externalBase, opts) {
+    const trimmedBase = externalBase?.trim();
+    const trimmedToken = opts?.apiToken?.trim();
+    if (!trimmedBase && !trimmedToken)
+        return html;
+    const headCloseTag = "</head>";
+    const headCloseIndex = html.indexOf(headCloseTag);
+    if (headCloseIndex < 0)
+        return html;
+    const parts = [];
+    if (trimmedBase) {
+        parts.push(`window.__ELIZA_API_BASE__=${JSON.stringify(trimmedBase)};`);
+    }
+    if (trimmedToken) {
+        parts.push(`window.__ELIZA_API_TOKEN__=${JSON.stringify(trimmedToken)};`);
+    }
+    const injection = Buffer.from(`<script>${parts.join("")}</script>`);
+    return Buffer.concat([
+        html.subarray(0, headCloseIndex),
+        injection,
+        html.subarray(headCloseIndex),
+    ]);
+}
+// ---------------------------------------------------------------------------
+// SPA serving
+// ---------------------------------------------------------------------------
+export function serveStaticUi(req, res, pathname) {
+    const root = resolveUiDir();
+    if (!root)
+        return false;
+    // Keep API and WebSocket namespaces exclusively owned by server handlers.
+    if (isAuthProtectedRoute(pathname))
+        return false;
+    let decodedPath;
+    try {
+        decodedPath = decodeURIComponent(pathname);
+    }
+    catch {
+        sendJsonError(res, "Invalid URL path encoding", 400);
+        return true;
+    }
+    const relativePath = decodedPath.replace(/^\/+/, "");
+    const candidatePath = path.resolve(root, relativePath);
+    if (candidatePath !== root &&
+        !candidatePath.startsWith(`${root}${path.sep}`)) {
+        sendJsonError(res, "Forbidden", 403);
+        return true;
+    }
+    try {
+        const stat = fs.statSync(candidatePath);
+        if (stat.isFile()) {
+            const ext = path.extname(candidatePath).toLowerCase();
+            const body = getCachedFile(candidatePath, stat.mtimeMs);
+            const isPreviewOrBinaryAsset = relativePath.startsWith("vrms/previews/") ||
+                relativePath.startsWith("vrms/backgrounds/") ||
+                [
+                    ".png",
+                    ".jpg",
+                    ".jpeg",
+                    ".gif",
+                    ".webp",
+                    ".avif",
+                    ".svg",
+                    ".mp3",
+                    ".wav",
+                    ".ogg",
+                    ".m4a",
+                    ".aac",
+                    ".flac",
+                    ".glb",
+                    ".spz",
+                ].includes(ext);
+            const cacheControl = relativePath.startsWith("assets/")
+                ? "public, max-age=31536000, immutable"
+                : ext === ".vrm" ||
+                    relativePath.endsWith(".vrm.gz") ||
+                    isPreviewOrBinaryAsset
+                    ? "public, max-age=86400"
+                    : "public, max-age=0, must-revalidate";
+            sendStaticResponse(req, res, 200, {
+                "Cache-Control": cacheControl,
+                "Content-Length": body.length,
+                "Content-Type": STATIC_MIME[ext] ?? "application/octet-stream",
+            }, body);
+            return true;
+        }
+    }
+    catch {
+        // Missing file falls through to SPA index fallback below.
+    }
+    // Only serve the SPA index.html for navigation-like requests (no file extension
+    // or .html). Asset requests (.vrm, .js, .png, etc.) that miss on disk should 404
+    // rather than silently returning HTML — which breaks binary loaders like GLTFLoader.
+    const reqExt = path.extname(decodedPath).toLowerCase();
+    if (reqExt && reqExt !== ".html")
+        return false;
+    if (!uiIndexHtml)
+        return false;
+    // When served behind a reverse proxy that rewrites the app under a path prefix,
+    // inject the API base so the UI client sends requests to the correct path prefix.
+    // For cloud-provisioned containers, also inject the API token so the browser
+    // client can authenticate without requiring a pairing flow.
+    const cloudToken = isCloudProvisionedContainer()
+        ? resolveApiToken(process.env)
+        : null;
+    const html = injectApiBaseIntoHtml(uiIndexHtml, process.env.ELIZA_EXTERNAL_BASE_URL, cloudToken ? { apiToken: cloudToken } : undefined);
+    sendStaticResponse(req, res, 200, {
+        "Cache-Control": "public, max-age=0, must-revalidate",
+        "Content-Length": html.length,
+        "Content-Type": "text/html; charset=utf-8",
+    }, html);
+    return true;
+}
+// ---------------------------------------------------------------------------
+// Route classification
+// ---------------------------------------------------------------------------
+export function isAuthProtectedRoute(pathname) {
+    return (pathname === "/api" ||
+        pathname.startsWith("/api/") ||
+        pathname === "/v1" ||
+        pathname.startsWith("/v1/") ||
+        pathname === "/ws" ||
+        pathname.startsWith("/ws/"));
+}

package/packages/agent/src/api/subscription-routes.d.ts

@@ -1,9 +1,9 @@
-import type { AnthropicFlow } from "../auth/anthropic";
-import type { CodexFlow } from "../auth/openai-codex";
-import type { ElizaConfig } from "../config/types.eliza";
-import type { RouteRequestContext } from "./route-helpers";
-type AuthModule = typeof import("../auth/index");
-export type SubscriptionAuthApi = Pick<AuthModule, "getSubscriptionStatus" | "startAnthropicLogin" | "startCodexLogin" | "saveCredentials" | "applySubscriptionCredentials" | "deleteCredentials">;
+import { type RouteRequestContext } from "@elizaos/core";
+import type { AnthropicFlow } from "../auth/anthropic.ts";
+import type { CodexFlow } from "../auth/openai-codex.ts";
+import type { ElizaConfig } from "../config/types.eliza.ts";
+type AuthModule = typeof import("../auth/index.ts");
+export type SubscriptionAuthApi = Pick<AuthModule, "getSubscriptionStatus" | "startAnthropicLogin" | "startCodexLogin" | "saveCredentials" | "applySubscriptionCredentials" | "deleteCredentials" | "deleteProviderCredentials">;
 export interface SubscriptionRouteState {
     config: ElizaConfig;
     _anthropicFlow?: AnthropicFlow;

package/packages/agent/src/api/subscription-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscription-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/subscription-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,KAAK,UAAU,GAAG,cAAc,eAAe,CAAC,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,UAAU,EACR,uBAAuB,GACvB,qBAAqB,GACrB,iBAAiB,GACjB,iBAAiB,GACjB,8BAA8B,GAC9B,mBAAmB,CACtB,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,WAAW,CAAC;IACpB,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB,eAAe,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,KAAK,EAAE,sBAAsB,CAAC;IAC9B,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;IAC1C,oBAAoB,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1D;AAED,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,wBAAwB,GAC5B,OAAO,CAAC,OAAO,CAAC,CAoOlB"}
+{"version":3,"file":"subscription-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/subscription-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAMjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,KAAK,UAAU,GAAG,cAAc,kBAAkB,CAAC,CAAC;AAEpD,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,UAAU,EACR,uBAAuB,GACvB,qBAAqB,GACrB,iBAAiB,GACjB,iBAAiB,GACjB,8BAA8B,GAC9B,mBAAmB,GACnB,2BAA2B,CAC9B,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,WAAW,CAAC;IACpB,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB,eAAe,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,KAAK,EAAE,sBAAsB,CAAC;IAC9B,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;IAC1C,oBAAoB,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1D;AAED,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,wBAAwB,GAC5B,OAAO,CAAC,OAAO,CAAC,CA0QlB"}

package/packages/agent/src/api/subscription-routes.js

@@ -6,10 +6,31 @@ export async function handleSubscriptionRoutes(ctx) {
     if (method === "GET" && pathname === "/api/subscription/status") {
         try {
             const { getSubscriptionStatus } = await loadSubscriptionAuth();
-            json(res, { providers: getSubscriptionStatus() });
+            const baseRows = getSubscriptionStatus();
+            // Join each per-account row with its rich LinkedAccountConfig
+            // entry from `eliza.json` (priority, enabled, health, usage).
+            // CLI / setup-token / Claude Code rows have synthetic accountIds
+            // and no config-level row — they pass through unchanged so the
+            // UI's existing `find(s => s.provider === ...)` keeps working.
+            const linkedAccounts = await readRichLinkedAccountsFromPool();
+            const rows = baseRows.map((row) => {
+                const linked = linkedAccounts[`${row.provider}:${row.accountId}`] ??
+                    linkedAccounts[row.accountId];
+                if (!linked || linked.providerId !== row.provider)
+                    return row;
+                const enriched = {
+                    ...row,
+                    priority: linked.priority,
+                    enabled: linked.enabled,
+                    health: linked.health,
+                    ...(linked.usage ? { usage: linked.usage } : {}),
+                };
+                return enriched;
+            });
+            json(res, { providers: rows });
         }
         catch (err) {
-            logger.error(`[api] Failed to get subscription status: ${err instanceof Error ? err.stack : err}`);
+            logger.error(`[api] Failed to get subscription status: ${String(err)}`);
             error(res, "Failed to get subscription status", 500);
         }
         return true;
@@ -22,7 +43,7 @@ export async function handleSubscriptionRoutes(ctx) {
             json(res, { authUrl: flow.authUrl });
         }
         catch (err) {
-            logger.error(`[api] Failed to start Anthropic login: ${err instanceof Error ? err.stack : err}`);
+            logger.error(`[api] Failed to start Anthropic login: ${String(err)}`);
             error(res, "Failed to start Anthropic login", 500);
         }
         return true;
@@ -52,7 +73,7 @@ export async function handleSubscriptionRoutes(ctx) {
         }
         catch (err) {
             delete state._anthropicFlow;
-            logger.error(`[api] Anthropic exchange failed: ${err instanceof Error ? err.stack : err}`);
+            logger.error(`[api] Anthropic exchange failed: ${String(err)}`);
             error(res, "Anthropic exchange failed", 500);
         }
         return true;
@@ -62,20 +83,26 @@ export async function handleSubscriptionRoutes(ctx) {
         const body = await readJsonBody(req, res);
         if (!body)
             return true;
-        if (!body.token || !body.token.startsWith("sk-ant-")) {
+        const trimmedToken = body.token?.trim();
+        if (!trimmedToken?.startsWith("sk-ant-")) {
             error(res, "Invalid token format — expected sk-ant-oat01-...", 400);
             return true;
         }
         try {
-            process.env.ANTHROPIC_API_KEY = body.token.trim();
+            // Store the setup token in config for task-agent discovery but do
+            // NOT inject it into process.env.ANTHROPIC_API_KEY.  Anthropic's
+            // TOS only permits subscription tokens through the Claude Code CLI.
+            // The task-agent orchestrator spawns `claude` CLI subprocesses
+            // which use the token legitimately.
             if (!state.config.env)
                 state.config.env = {};
-            state.config.env.ANTHROPIC_API_KEY = body.token.trim();
+            state.config.env.__anthropicSubscriptionToken = trimmedToken;
             ctx.saveConfig(state.config);
+            logger.info("[api] Saved Anthropic setup token for task agents (not applied to runtime — TOS restriction)");
             json(res, { success: true });
         }
         catch (err) {
-            logger.error(`[api] Failed to save setup token: ${err instanceof Error ? err.stack : err}`);
+            logger.error(`[api] Failed to save setup token: ${String(err)}`);
             error(res, "Failed to save setup token", 500);
         }
         return true;
@@ -111,7 +138,7 @@ export async function handleSubscriptionRoutes(ctx) {
             });
         }
         catch (err) {
-            logger.error(`[api] Failed to start OpenAI login: ${err instanceof Error ? err.stack : err}`);
+            logger.error(`[api] Failed to start OpenAI login: ${String(err)}`);
             error(res, "Failed to start OpenAI login", 500);
         }
         return true;
@@ -148,7 +175,7 @@ export async function handleSubscriptionRoutes(ctx) {
                 delete state._codexFlow;
                 clearTimeout(state._codexFlowTimer);
                 delete state._codexFlowTimer;
-                logger.error(`[api] OpenAI exchange failed: ${err instanceof Error ? err.stack : err}`);
+                logger.error(`[api] OpenAI exchange failed: ${String(err)}`);
                 error(res, "OpenAI exchange failed", 500);
                 return true;
             }
@@ -164,7 +191,7 @@ export async function handleSubscriptionRoutes(ctx) {
             });
         }
         catch (err) {
-            logger.error(`[api] OpenAI exchange failed: ${err instanceof Error ? err.stack : err}`);
+            logger.error(`[api] OpenAI exchange failed: ${String(err)}`);
             error(res, "OpenAI exchange failed", 500);
         }
         return true;
@@ -173,12 +200,28 @@ export async function handleSubscriptionRoutes(ctx) {
         const provider = pathname.split("/").pop();
         if (provider === "anthropic-subscription" || provider === "openai-codex") {
             try {
-                const { deleteCredentials } = await loadSubscriptionAuth();
-                deleteCredentials(provider);
+                const { deleteProviderCredentials } = await loadSubscriptionAuth();
+                deleteProviderCredentials(provider);
+                if (provider === "anthropic-subscription" && state.config.env) {
+                    delete state.config.env
+                        .__anthropicSubscriptionToken;
+                }
+                if (state.config.agents?.defaults?.subscriptionProvider === provider) {
+                    delete state.config.agents.defaults.subscriptionProvider;
+                }
+                const llmBackend = state.config.serviceRouting?.llmText?.backend;
+                const deletedProviderId = provider === "openai-codex" ? "openai-subscription" : provider;
+                if (llmBackend === deletedProviderId && state.config.serviceRouting) {
+                    delete state.config.serviceRouting.llmText;
+                    if (Object.keys(state.config.serviceRouting).length === 0) {
+                        delete state.config.serviceRouting;
+                    }
+                }
+                ctx.saveConfig(state.config);
                 json(res, { success: true });
             }
             catch (err) {
-                logger.error(`[api] Failed to delete credentials: ${err instanceof Error ? err.stack : err}`);
+                logger.error(`[api] Failed to delete credentials: ${String(err)}`);
                 error(res, "Failed to delete credentials", 500);
             }
         }
@@ -189,3 +232,30 @@ export async function handleSubscriptionRoutes(ctx) {
     }
     return false;
 }
+/**
+ * Read rich `LinkedAccountConfig` rows from the AccountPool singleton.
+ * The pool is the single source of truth — it joins on-disk credential
+ * records with the metadata overlay file. Loaded via dynamic import
+ * because `@elizaos/app-core` depends on `@elizaos/agent`, not the
+ * other way around.
+ */
+async function readRichLinkedAccountsFromPool() {
+    try {
+        // String-literal dynamic import — see comment in
+        // ../runtime/eliza.ts#importAppCoreRuntime for the AOSP bundle issue.
+        const mod = (await import(/* @vite-ignore */ "@elizaos/app-core"));
+        const pool = mod.getDefaultAccountPool();
+        const out = {};
+        for (const account of pool.list()) {
+            out[`${account.providerId}:${account.id}`] = account;
+            if (!(account.id in out)) {
+                out[account.id] = account;
+            }
+        }
+        return out;
+    }
+    catch (err) {
+        logger.debug(`[subscription] account pool unavailable: ${String(err)}`);
+        return {};
+    }
+}

package/packages/agent/src/api/task-agent-message-routing.d.ts

@@ -0,0 +1,10 @@
+import type { AgentRuntime } from "@elizaos/core";
+export interface TaskAgentChatRouting {
+    sessionId?: string;
+    threadId?: string;
+    roomId?: string | null;
+}
+type RoutingRuntime = Pick<AgentRuntime, "getRoom" | "getService" | "sendMessageToTarget">;
+export declare function routeTaskAgentTextToConnector(runtime: RoutingRuntime | null, text: string, source: string, routing?: TaskAgentChatRouting): Promise<boolean>;
+export {};
+//# sourceMappingURL=task-agent-message-routing.d.ts.map

package/packages/agent/src/api/task-agent-message-routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-agent-message-routing.d.ts","sourceRoot":"","sources":["../../../../../src/api/task-agent-message-routing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAQ,MAAM,eAAe,CAAC;AAExD,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAkBD,KAAK,cAAc,GAAG,IAAI,CACxB,YAAY,EACZ,SAAS,GAAG,YAAY,GAAG,qBAAqB,CACjD,CAAC;AAsCF,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,cAAc,GAAG,IAAI,EAC9B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,OAAO,CAAC,CA0ClB"}

package/packages/agent/src/api/task-agent-message-routing.js

@@ -0,0 +1,62 @@
+function getRoutingCoordinator(runtime) {
+    const coordinator = runtime.getService("SWARM_COORDINATOR");
+    return coordinator && typeof coordinator === "object"
+        ? coordinator
+        : null;
+}
+function inferTaskAgentRoutingFromMessage(text, coordinator) {
+    const taskContexts = coordinator?.getAllTaskContexts?.();
+    if (!Array.isArray(taskContexts) || taskContexts.length === 0) {
+        return undefined;
+    }
+    const loginLabelMatch = text.match(/^"([^"]+)" needs a provider login\b/);
+    const matchingTask = loginLabelMatch?.[1]
+        ? taskContexts.filter((task) => task.label === loginLabelMatch[1])
+        : taskContexts.length === 1
+            ? taskContexts
+            : [];
+    if (matchingTask.length !== 1) {
+        return undefined;
+    }
+    const [taskContext] = matchingTask;
+    return {
+        ...(taskContext.sessionId ? { sessionId: taskContext.sessionId } : {}),
+        ...(taskContext.threadId ? { threadId: taskContext.threadId } : {}),
+    };
+}
+export async function routeTaskAgentTextToConnector(runtime, text, source, routing) {
+    if (!runtime)
+        return false;
+    const coordinator = getRoutingCoordinator(runtime);
+    const resolvedRouting = {
+        ...(routing ?? inferTaskAgentRoutingFromMessage(text, coordinator)),
+    };
+    if (!resolvedRouting.threadId && resolvedRouting.sessionId) {
+        const taskContext = coordinator?.getTaskContext?.(resolvedRouting.sessionId);
+        if (taskContext?.threadId) {
+            resolvedRouting.threadId = taskContext.threadId;
+        }
+    }
+    let roomId = resolvedRouting.roomId ?? null;
+    if (!roomId && resolvedRouting.threadId) {
+        const thread = await coordinator?.getTaskThread?.(resolvedRouting.threadId);
+        roomId =
+            thread &&
+                typeof thread.roomId === "string" &&
+                thread.roomId.trim().length > 0
+                ? thread.roomId
+                : null;
+    }
+    if (!roomId)
+        return false;
+    const room = await runtime.getRoom(roomId).catch(() => null);
+    if (!room?.source)
+        return false;
+    await runtime.sendMessageToTarget({
+        source: room.source,
+        roomId: room.id,
+        channelId: room.channelId ?? room.id,
+        serverId: room.serverId ?? undefined,
+    }, { text, source });
+    return true;
+}

package/packages/agent/src/api/terminal-execution-routing.d.ts

@@ -0,0 +1,14 @@
+import type { SandboxManager } from "../services/sandbox-manager.ts";
+export interface TerminalExecutionRoute {
+    route: "host" | "sandbox";
+    sandboxManager: SandboxManager | null;
+    error?: string;
+}
+export declare function resolveTerminalExecutionRoute(args: {
+    runtime?: {
+        getSetting?: (key: string) => unknown;
+    } | null;
+    sandboxManager: SandboxManager | null;
+}): TerminalExecutionRoute;
+export declare function toSandboxWorkdir(hostWorkdir: string): string | undefined;
+//# sourceMappingURL=terminal-execution-routing.d.ts.map

package/packages/agent/src/api/terminal-execution-routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-execution-routing.d.ts","sourceRoot":"","sources":["../../../../../src/api/terminal-execution-routing.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3D,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;CACvC,GAAG,sBAAsB,CAWzB;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOxE"}

package/packages/agent/src/api/terminal-execution-routing.js

@@ -0,0 +1,23 @@
+import path from "node:path";
+import { logger } from "@elizaos/core";
+import { shouldUseSandboxExecution } from "../runtime/local-execution-mode.js";
+export function resolveTerminalExecutionRoute(args) {
+    if (!shouldUseSandboxExecution(args.runtime)) {
+        return { route: "host", sandboxManager: null };
+    }
+    if (!args.sandboxManager) {
+        const error = "local-safe mode requires SandboxManager, but no sandbox manager is available for terminal execution.";
+        logger.error(`[terminal:sandbox] ${error}`);
+        return { route: "sandbox", sandboxManager: null, error };
+    }
+    return { route: "sandbox", sandboxManager: args.sandboxManager };
+}
+export function toSandboxWorkdir(hostWorkdir) {
+    const relative = path.relative(process.cwd(), path.resolve(hostWorkdir));
+    if (relative === "")
+        return "/workspace";
+    if (!relative.startsWith("..") && !path.isAbsolute(relative)) {
+        return `/workspace/${relative}`;
+    }
+    return undefined;
+}

package/packages/agent/src/api/terminal-run-limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terminal-run-limits.d.ts","sourceRoot":"","sources":["../../../../../src/api/terminal-run-limits.ts"],"names":[],"mappings":"AAOA,wBAAgB,wBAAwB,IAAI;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB,CAoBA"}
+{"version":3,"file":"terminal-run-limits.d.ts","sourceRoot":"","sources":["../../../../../src/api/terminal-run-limits.ts"],"names":[],"mappings":"AAOA,wBAAgB,wBAAwB,IAAI;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB,CAgBA"}

package/packages/agent/src/api/terminal-run-limits.js

@@ -1,18 +1,16 @@
-import { parseClampedInteger } from "../utils/number-parsing";
+import { parseClampedInteger } from "../utils/number-parsing.js";
 const TERMINAL_RUN_MAX_CONCURRENT_DEFAULT = 2;
 const TERMINAL_RUN_MAX_CONCURRENT_CAP = 16;
 const TERMINAL_RUN_MAX_DURATION_MS_DEFAULT = 5 * 60 * 1000;
 const TERMINAL_RUN_MAX_DURATION_MS_CAP = 60 * 60 * 1000;
 export function resolveTerminalRunLimits() {
-    const maxConcurrentRaw = process.env.ELIZA_TERMINAL_MAX_CONCURRENT ??
-        process.env.ELIZA_TERMINAL_MAX_CONCURRENT;
+    const maxConcurrentRaw = process.env.ELIZA_TERMINAL_MAX_CONCURRENT;
     const maxConcurrent = parseClampedInteger(maxConcurrentRaw, {
         fallback: TERMINAL_RUN_MAX_CONCURRENT_DEFAULT,
         min: 1,
         max: TERMINAL_RUN_MAX_CONCURRENT_CAP,
     });
-    const maxDurationMsRaw = process.env.ELIZA_TERMINAL_MAX_DURATION_MS ??
-        process.env.ELIZA_TERMINAL_MAX_DURATION_MS;
+    const maxDurationMsRaw = process.env.ELIZA_TERMINAL_MAX_DURATION_MS;
     const maxDurationMs = parseClampedInteger(maxDurationMsRaw, {
         fallback: TERMINAL_RUN_MAX_DURATION_MS_DEFAULT,
         min: 1_000,

package/packages/agent/src/api/trade-safety.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Pure trade safety utilities — no heavy dependencies.
+ * Extracted so they can be unit-tested without pulling in the full server.
+ */
+/** Maximum number of autonomous agent trades allowed per calendar day. */
+export declare const AGENT_AUTO_MAX_DAILY_TRADES = 25;
+/** Maximum age of a trade quote before it is considered stale. */
+export declare const QUOTE_MAX_AGE_MS = 60000;
+/** Tracks autonomous trade count for rate-limiting in agent-auto mode. */
+export declare const agentAutoDailyTrades: {
+    count: number;
+    resetDate: string;
+};
+export declare function getAgentAutoTradeDate(): string;
+/**
+ * Record an autonomous agent trade. Returns true if allowed, false if
+ * the daily limit has been reached. Resets the counter on a new calendar day.
+ */
+export declare function recordAgentAutoTrade(log?: (msg: string) => void): boolean;
+export type TradePermissionMode = "user-sign-only" | "agent-auto" | "manual-local-key" | "disabled";
+type LocalTradeExecutionOptions = {
+    consumeAgentQuota?: boolean;
+};
+/**
+ * Returns true if local-key execution is permitted for the given actor.
+ */
+export declare function canUseLocalTradeExecution(mode: TradePermissionMode, isAgent: boolean, log?: (msg: string) => void, options?: LocalTradeExecutionOptions): boolean;
+/**
+ * Assert that a trade quote is still fresh. Throws if the quote is older
+ * than QUOTE_MAX_AGE_MS. Silently passes if `quotedAt` is undefined
+ * (backwards compatibility with quotes that lack the field).
+ */
+export declare function assertQuoteFresh(quotedAt: number | undefined, now?: number): void;
+export {};
+//# sourceMappingURL=trade-safety.d.ts.map

package/packages/agent/src/api/trade-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trade-safety.d.ts","sourceRoot":"","sources":["../../../../../src/api/trade-safety.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAEvC,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB;;;CAA8B,CAAC;AAEhE,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAiBzE;AAED,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,YAAY,GACZ,kBAAkB,GAClB,UAAU,CAAC;AAEf,KAAK,0BAA0B,GAAG;IAChC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAC3B,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAgBT;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,GAAG,GAAE,MAAmB,GACvB,IAAI,CAIN"}