@elizaos/agent 2.0.0-alpha.98 → 2.0.0-beta.2

package/packages/agent/src/cli/benchmark.js

@@ -0,0 +1,293 @@
+/**
+ * CLI subcommand for headless benchmark execution.
+ *
+ * Accepts a task as JSON (from --task <file> or stdin), boots the runtime
+ * in headless mode, sends the prompt through handleMessage (the real agent
+ * loop including action selection), captures the response, and writes a
+ * JSON result to stdout.
+ *
+ * Task prompts are augmented with type-aware instructions so the agent
+ * produces thorough, structured responses through its normal flow.
+ *
+ * Server mode (--server) keeps the runtime alive and reads line-delimited
+ * JSON from stdin, writing one result line per task.
+ */
+import crypto from "node:crypto";
+import { readFileSync } from "node:fs";
+import process from "node:process";
+import * as readline from "node:readline";
+import { ChannelType, createMessageMemory, logger, stringToUuid, } from "@elizaos/core";
+// ---------------------------------------------------------------------------
+// Prompt augmentation — steers the agent via the normal message flow
+// ---------------------------------------------------------------------------
+const RESEARCH_AUGMENTATION = "\n\nPlease give a thorough, structured answer with ## headings, bullet points, and a conclusion. Be detailed and comprehensive.";
+const CODING_AUGMENTATION = "\n\nPlease write the complete code implementation directly in your response using ```typescript blocks. Include all imports, types, and error handling. Do not delegate — write the code yourself.";
+const DEFAULT_AUGMENTATION = "\n\nPlease give a detailed, structured answer with headings and bullet points.";
+function detectTaskType(task) {
+    if (task.type)
+        return task.type;
+    if (/\b(implement|build|create|write|code|function|class|module|component|api|endpoint|cli|test suite|refactor|debug|fix.*bug)\b/i.test(task.prompt)) {
+        return "coding";
+    }
+    return "research";
+}
+function augmentPrompt(task) {
+    const taskType = detectTaskType(task);
+    switch (taskType) {
+        case "research":
+            return task.prompt + RESEARCH_AUGMENTATION;
+        case "coding":
+            return task.prompt + CODING_AUGMENTATION;
+        default:
+            return task.prompt + DEFAULT_AUGMENTATION;
+    }
+}
+// ---------------------------------------------------------------------------
+// Task execution — uses handleMessage (the real agent loop)
+// ---------------------------------------------------------------------------
+async function runTask(runtime, task, timeoutMs) {
+    const start = performance.now();
+    const taskType = detectTaskType(task);
+    const userId = crypto.randomUUID();
+    const roomId = stringToUuid(`benchmark-${task.id}`);
+    const worldId = stringToUuid(`benchmark-world-${task.id}`);
+    const messageServerId = stringToUuid(`benchmark-server-${task.id}`);
+    try {
+        await runtime.ensureConnection({
+            entityId: userId,
+            roomId,
+            worldId,
+            userName: "Benchmark",
+            source: "benchmark",
+            channelId: `benchmark-${task.id}`,
+            type: ChannelType.DM,
+            messageServerId,
+            metadata: { ownership: { ownerId: userId } },
+        });
+        const augmentedPrompt = augmentPrompt(task);
+        const message = createMessageMemory({
+            id: crypto.randomUUID(),
+            entityId: userId,
+            roomId,
+            content: {
+                text: augmentedPrompt,
+                source: "benchmark",
+                channelType: ChannelType.DM,
+            },
+        });
+        if (!runtime.messageService) {
+            return {
+                id: task.id,
+                response: "",
+                actions_taken: [taskType],
+                duration_ms: Math.round(performance.now() - start),
+                success: false,
+                error: "runtime.messageService is not available",
+            };
+        }
+        let callbackText = "";
+        let streamText = "";
+        const actionsTaken = [taskType];
+        // Race message handling against the timeout.
+        // Text can arrive via three channels:
+        //   1. callback — action handler results
+        //   2. onStreamChunk — streamed LLM tokens
+        //   3. result.responseContent — final composed response
+        // We capture all three and deduplicate.
+        const result = (await Promise.race([
+            (async () => {
+                const handleResult = await runtime.messageService?.handleMessage(runtime, message, async (content) => {
+                    if (content?.text) {
+                        callbackText += content.text;
+                    }
+                    // Track actions taken
+                    const action = content?.action;
+                    if (typeof action === "string" && !actionsTaken.includes(action)) {
+                        actionsTaken.push(action);
+                    }
+                    return [];
+                }, {
+                    onStreamChunk: async (chunk) => {
+                        if (chunk)
+                            streamText += chunk;
+                    },
+                });
+                return handleResult;
+            })(),
+            new Promise((resolve) => setTimeout(() => resolve("timeout"), timeoutMs)),
+        ]));
+        if (result === "timeout") {
+            const responseText = streamText || callbackText;
+            return {
+                id: task.id,
+                response: responseText,
+                actions_taken: actionsTaken,
+                duration_ms: Math.round(performance.now() - start),
+                success: false,
+                error: `Timeout after ${timeoutMs}ms`,
+            };
+        }
+        // Extract text from all channels, preferring the richest source.
+        // result.responseContent has the final composed text from the LLM.
+        const resultRecord = typeof result === "object" && result !== null
+            ? result
+            : null;
+        const responseContent = resultRecord?.responseContent &&
+            typeof resultRecord.responseContent === "object"
+            ? resultRecord.responseContent
+            : null;
+        const resultText = responseContent && typeof responseContent.text === "string"
+            ? responseContent.text
+            : "";
+        // Also check responseMessages for additional text
+        const responseMessages = Array.isArray(resultRecord?.responseMessages)
+            ? resultRecord.responseMessages
+            : [];
+        const messagesText = responseMessages
+            .map((m) => m.content?.text ?? "")
+            .filter(Boolean)
+            .join("\n");
+        // Pick the best source — longest non-empty wins, since the same
+        // text may appear in multiple channels.
+        const candidates = [
+            resultText,
+            messagesText,
+            streamText,
+            callbackText,
+        ].filter(Boolean);
+        const responseText = candidates.sort((a, b) => b.length - a.length)[0] ?? "";
+        return {
+            id: task.id,
+            response: responseText,
+            actions_taken: actionsTaken,
+            duration_ms: Math.round(performance.now() - start),
+            success: true,
+        };
+    }
+    catch (err) {
+        return {
+            id: task.id,
+            response: "",
+            actions_taken: [taskType],
+            duration_ms: Math.round(performance.now() - start),
+            success: false,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+/** Parse a JSON string into a BenchmarkTask, throwing on invalid input. */
+function parseTask(raw) {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" ||
+        parsed === null ||
+        !("id" in parsed) ||
+        !("prompt" in parsed)) {
+        throw new Error('Invalid task JSON: must contain at minimum "id" and "prompt" fields');
+    }
+    return parsed;
+}
+/** Write a result as a single JSON line to stdout. */
+function writeResult(result) {
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+/**
+ * Server mode: read line-delimited JSON tasks from stdin, process each
+ * against the running runtime, and write results to stdout.
+ */
+async function runServerMode(runtime, timeoutMs) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        terminal: false,
+    });
+    for await (const line of rl) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            const task = parseTask(trimmed);
+            const result = await runTask(runtime, task, timeoutMs);
+            writeResult(result);
+        }
+        catch (err) {
+            const errorResult = {
+                id: "unknown",
+                response: "",
+                actions_taken: [],
+                duration_ms: 0,
+                success: false,
+                error: `Failed to parse task: ${err instanceof Error ? err.message : String(err)}`,
+            };
+            writeResult(errorResult);
+        }
+    }
+}
+/**
+ * Entry point for the `benchmark` CLI subcommand.
+ */
+export async function runBenchmark(opts) {
+    const timeoutMs = Number.parseInt(opts.timeout, 10);
+    if (Number.isNaN(timeoutMs) || timeoutMs <= 0) {
+        console.error("[benchmark] Invalid timeout value");
+        process.exit(2);
+    }
+    // Suppress noisy runtime logs — benchmark output must be clean JSON on stdout
+    if (!process.env.LOG_LEVEL) {
+        process.env.LOG_LEVEL = "error";
+    }
+    process.env.ELIZA_HEADLESS = "1";
+    const { bootElizaRuntime } = await import("../runtime/eliza.js");
+    let runtime;
+    try {
+        runtime = await bootElizaRuntime();
+    }
+    catch (err) {
+        const errorResult = {
+            id: opts.task ? "file" : "stdin",
+            response: "",
+            actions_taken: [],
+            duration_ms: 0,
+            success: false,
+            error: `Runtime boot failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+        writeResult(errorResult);
+        process.exit(1);
+    }
+    if (opts.server) {
+        await runServerMode(runtime, timeoutMs);
+        logger.info("[benchmark] EOF on stdin, shutting down");
+        process.exit(0);
+    }
+    // Single-task mode
+    let taskJson;
+    if (opts.task) {
+        try {
+            taskJson = readFileSync(opts.task, "utf-8");
+        }
+        catch (err) {
+            console.error(`[benchmark] Failed to read task file: ${err instanceof Error ? err.message : String(err)}`);
+            process.exit(2);
+        }
+    }
+    else {
+        const chunks = [];
+        for await (const chunk of process.stdin) {
+            chunks.push(chunk);
+        }
+        taskJson = Buffer.concat(chunks).toString("utf-8").trim();
+        if (!taskJson) {
+            console.error("[benchmark] No task provided. Use --task <file> or pipe JSON to stdin.");
+            process.exit(2);
+        }
+    }
+    let task;
+    try {
+        task = parseTask(taskJson);
+    }
+    catch (err) {
+        console.error(`[benchmark] Invalid task JSON: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(2);
+    }
+    const result = await runTask(runtime, task, timeoutMs);
+    writeResult(result);
+    process.exit(result.success ? 0 : 1);
+}

package/packages/agent/src/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/cli/index.ts"],"names":[],"mappings":"AAuBA,wBAAsB,gBAAgB,CACpC,IAAI,GAAE,MAAM,EAAiB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAwBf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/cli/index.ts"],"names":[],"mappings":"AA6BA,wBAAsB,gBAAgB,CACpC,IAAI,GAAE,MAAM,EAAiB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAkFf"}

package/packages/agent/src/cli/index.js

@@ -1,16 +1,22 @@
 import { createRequire } from "node:module";
 import process from "node:process";
-import { bootElizaRuntime, startEliza } from "../runtime";
 function printHelp() {
     console.log(`eliza-autonomous
 
 Usage:
   eliza-autonomous serve
   eliza-autonomous runtime
+  eliza-autonomous benchmark [options]
 
 Commands:
-  serve    Start the autonomous backend in server-only mode
-  runtime  Boot the runtime without entering the API/CLI wrapper
+  serve      Start the autonomous backend in server-only mode
+  runtime    Boot the runtime without entering the API/CLI wrapper
+  benchmark  Run a benchmark task headlessly against the agent
+
+Benchmark options:
+  --task <path>    Path to task JSON file
+  --server         Keep runtime alive and accept tasks via stdin (line-delimited JSON)
+  --timeout <ms>   Timeout per task in milliseconds (default: 120000)
 `);
 }
 function printVersion() {
@@ -29,11 +35,59 @@ export async function runAutonomousCli(argv = process.argv) {
         return;
     }
     if (command === "runtime") {
+        const { bootElizaRuntime } = await import("../runtime/index.js");
         await bootElizaRuntime();
         return;
     }
     if (command === "serve" || command === "start") {
-        await startEliza({ serverOnly: true });
+        const { startEliza } = await import("../runtime/index.js");
+        const runtime = await startEliza({ serverOnly: true });
+        console.log(`[cli] startEliza returned: runtime=${runtime ? "present" : "null"}, ELIZA_LOCAL_LLAMA=${process.env.ELIZA_LOCAL_LLAMA ?? "(unset)"}`);
+        // AOSP-only post-boot wiring. The upstream `startEliza` does not
+        // register local-inference handlers — that lives in the
+        // `@elizaos/app-core` runtime wrapper, which the mobile agent
+        // bundle cannot import (would create an `agent → app-core →
+        // agent` workspace cycle). Bootstrapping the AOSP llama loader
+        // and ModelType handlers here keeps the registration in the
+        // agent package and out of the bundler's cycle path. No-op when
+        // `ELIZA_LOCAL_LLAMA !== "1"`.
+        if (runtime && process.env.ELIZA_LOCAL_LLAMA?.trim() === "1") {
+            console.log("[cli] importing aosp-local-inference-bootstrap…");
+            const { ensureAospLocalInferenceHandlers } = await import("@elizaos/plugin-aosp-local-inference");
+            console.log("[cli] calling ensureAospLocalInferenceHandlers(runtime)…");
+            const ok = await ensureAospLocalInferenceHandlers(runtime);
+            console.log(`[cli] ensureAospLocalInferenceHandlers returned ${ok}`);
+        }
+        else if (runtime &&
+            process.env.ELIZA_DEVICE_BRIDGE_ENABLED?.trim() === "1") {
+            console.log("[cli] importing mobile-device-bridge-bootstrap…");
+            const { ensureMobileDeviceBridgeInferenceHandlers } = await import("@elizaos/plugin-capacitor-bridge");
+            console.log("[cli] calling ensureMobileDeviceBridgeInferenceHandlers(runtime)…");
+            const ok = await ensureMobileDeviceBridgeInferenceHandlers(runtime);
+            console.log(`[cli] ensureMobileDeviceBridgeInferenceHandlers returned ${ok}`);
+        }
+        return;
+    }
+    if (command === "benchmark") {
+        const { runBenchmark } = await import("./benchmark.js");
+        // Parse benchmark-specific flags from argv
+        const opts = {
+            task: undefined,
+            server: false,
+            timeout: "120000",
+        };
+        for (let i = 3; i < argv.length; i++) {
+            if (argv[i] === "--task" && argv[i + 1]) {
+                opts.task = argv[++i];
+            }
+            else if (argv[i] === "--server") {
+                opts.server = true;
+            }
+            else if (argv[i] === "--timeout" && argv[i + 1]) {
+                opts.timeout = argv[++i];
+            }
+        }
+        await runBenchmark(opts);
         return;
     }
     throw new Error(`Unknown command: ${command}`);

package/packages/agent/src/config/config.d.ts

@@ -1,5 +1,5 @@
-import type { ElizaConfig } from "./types";
-export * from "./types";
+import type { ElizaConfig } from "@elizaos/shared";
+export type { ElizaConfig } from "@elizaos/shared";
 export declare function loadElizaConfig(): ElizaConfig;
 export declare function saveElizaConfig(config: ElizaConfig): void;
 export declare function configFileExists(): boolean;

package/packages/agent/src/config/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../../src/config/config.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,cAAc,SAAS,CAAC;AAExB,wBAAgB,eAAe,IAAI,WAAW,CAsF7C;AAeD,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAiCzD;AAED,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../../src/config/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAqBnD,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAyEnD,wBAAgB,eAAe,IAAI,WAAW,CAwH7C;AAwDD,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CA8EzD;AAED,wBAAgB,gBAAgB,IAAI,OAAO,CAQ1C"}

package/packages/agent/src/config/config.js

@@ -1,25 +1,84 @@
 import fs from "node:fs";
 import path from "node:path";
+import { logger } from "@elizaos/core";
+import { isElizaSettingsDebugEnabled, isPlainObject, migrateLegacyRuntimeConfig, sanitizeForSettingsDebug, settingsDebugCloudSummary, } from "@elizaos/shared";
 import JSON5 from "json5";
-import { collectConfigEnvVars } from "./env-vars";
-import { resolveConfigIncludes } from "./includes";
-import { resolveConfigPath, resolveUserPath } from "./paths";
-export * from "./types";
-export function loadElizaConfig() {
-    const configPath = resolveConfigPath();
+import { readConfigEnvSync } from "../api/config-env.js";
+import { syncSolanaPublicKeyEnv } from "../api/wallet-env-sync.js";
+import { isVaultRef } from "../runtime/operations/vault-bridge.js";
+import { collectConfigEnvVars, collectConnectorEnvVars } from "./env-vars.js";
+import { resolveConfigIncludes } from "./includes.js";
+import { normalizeModelMetadataInConfig } from "./model-metadata.js";
+import { resolveConfigPath, resolveStateDir, resolveUserPath, } from "./paths.js";
+function resolveConfigWritePath(env = process.env) {
+    const persistPath = env.ELIZA_PERSIST_CONFIG_PATH?.trim();
+    return persistPath ? resolveUserPath(persistPath) : resolveConfigPath();
+}
+function applyConfigEnvToProcessEnv(entries) {
+    for (const [key, value] of Object.entries(entries)) {
+        // Skip unresolved vault sentinels. The boot-time vault hydration
+        // (resolveConfigEnvForProcess + applyCloudConfigToEnv) writes the resolved
+        // plaintext to process.env once at startup. Many services call
+        // loadElizaConfig() again later for unrelated reads; without this guard the
+        // sentinel literal `vault://KEY` would overwrite the real plaintext on
+        // every such call, and downstream `runtime.getSetting()` would hand the
+        // sentinel to consumers like plugin-elizacloud, producing 401s.
+        if (isVaultRef(value))
+            continue;
+        process.env[key] = value;
+    }
+}
+function getConfigEnvString(config, key) {
+    const envConfig = config.env;
+    const nestedVars = envConfig?.vars &&
+        typeof envConfig.vars === "object" &&
+        !Array.isArray(envConfig.vars)
+        ? envConfig.vars
+        : undefined;
+    const value = nestedVars?.[key] ?? envConfig?.[key];
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function mergeConfigRecords(base, overlay) {
+    if (overlay === undefined) {
+        return base;
+    }
+    if (Array.isArray(overlay)) {
+        return overlay.slice();
+    }
+    if (isPlainObject(base) && isPlainObject(overlay)) {
+        const merged = { ...base };
+        for (const [key, value] of Object.entries(overlay)) {
+            merged[key] = mergeConfigRecords(base[key], value);
+        }
+        return merged;
+    }
+    return overlay;
+}
+function readConfigFile(configPath) {
     let raw;
     try {
         raw = fs.readFileSync(configPath, "utf-8");
     }
     catch (err) {
         if (err.code === "ENOENT") {
-            return { logging: { level: "error" } };
+            return null;
         }
         throw err;
     }
     const parsed = JSON5.parse(raw);
-    const resolved = resolveConfigIncludes(parsed, configPath);
-    const skillsJsonPath = resolveUserPath("~/.eliza/skills.json");
+    return resolveConfigIncludes(parsed, configPath);
+}
+export function loadElizaConfig() {
+    const configPath = resolveConfigPath();
+    const persistPath = resolveConfigWritePath();
+    const baseConfig = readConfigFile(configPath);
+    const persistedConfig = persistPath !== configPath ? readConfigFile(persistPath) : null;
+    const resolved = (baseConfig || persistedConfig
+        ? mergeConfigRecords(baseConfig ?? {}, persistedConfig ?? {})
+        : { logging: { level: "error" } });
+    migrateLegacyRuntimeConfig(resolved);
+    normalizeModelMetadataInConfig(resolved);
+    const skillsJsonPath = path.join(resolveStateDir(), "skills.json");
     if (!fs.existsSync(skillsJsonPath)) {
         try {
             const skillsDir = path.dirname(skillsJsonPath);
@@ -29,7 +88,7 @@ export function loadElizaConfig() {
             fs.writeFileSync(skillsJsonPath, JSON.stringify({ extraDirs: [] }, null, 2), "utf-8");
         }
         catch (err) {
-            console.warn(`[eliza] Failed to auto-create ~/.eliza/skills.json: ${err instanceof Error ? err.message : String(err)}`);
+            logger.warn(`[eliza] Failed to auto-create ~/.eliza/skills.json: ${String(err)}`);
         }
     }
     if (fs.existsSync(skillsJsonPath)) {
@@ -57,7 +116,7 @@ export function loadElizaConfig() {
             }
         }
         catch (err) {
-            console.warn(`[eliza] Failed to load ~/.eliza/skills.json: ${err instanceof Error ? err.message : String(err)}`);
+            logger.warn(`[eliza] Failed to load ~/.eliza/skills.json: ${String(err)}`);
         }
     }
     if (!resolved.logging) {
@@ -66,11 +125,42 @@ export function loadElizaConfig() {
     else if (!resolved.logging.level) {
         resolved.logging.level = "error";
     }
+    const persistedConfigEnv = readConfigEnvSync(resolveStateDir());
+    // SECURITY: Do NOT merge persistedConfigEnv into resolved.env — config.env
+    // is the designated escape hatch for secrets that must NOT be serialized to
+    // eliza.json (e.g. ELIZA_CLOUD_CLIENT_ADDRESS_KEY, WALLET_SOURCE_*).
+    // Merging would create a sensitive-data boundary violation.
+    // Instead, apply directly to process.env (below).
     const envVars = collectConfigEnvVars(resolved);
-    for (const [key, value] of Object.entries(envVars)) {
-        if (process.env[key] === undefined) {
-            process.env[key] = value;
-        }
+    const connectorEnvVars = collectConnectorEnvVars(resolved);
+    // Saved config is the source of truth for settings edited in the app.
+    // If a key is persisted here, it should override any stale value that
+    // arrived from .env or the parent shell.
+    applyConfigEnvToProcessEnv(envVars);
+    applyConfigEnvToProcessEnv(connectorEnvVars);
+    applyConfigEnvToProcessEnv(persistedConfigEnv);
+    const discordToken = process.env.DISCORD_API_TOKEN?.trim() ||
+        process.env.DISCORD_BOT_TOKEN?.trim();
+    if (discordToken) {
+        process.env.DISCORD_API_TOKEN = discordToken;
+        process.env.DISCORD_BOT_TOKEN = discordToken;
+    }
+    // Keep public-key aliases available when only the private key is configured.
+    syncSolanaPublicKeyEnv(getConfigEnvString(resolved, "SOLANA_PRIVATE_KEY"));
+    if (isElizaSettingsDebugEnabled()) {
+        const cloud = resolved.cloud;
+        logger.debug({
+            path: configPath,
+            persistPath: persistPath !== configPath ? persistPath : undefined,
+            topLevelKeys: Object.keys(resolved).sort(),
+            cloud: settingsDebugCloudSummary(cloud),
+            envVarKeysHydrated: Object.keys({
+                ...persistedConfigEnv,
+                ...envVars,
+                ...connectorEnvVars,
+            }).sort(),
+            snapshot: sanitizeForSettingsDebug(resolved),
+        }, "[eliza][settings][loadElizaConfig]");
     }
     return resolved;
 }
@@ -89,21 +179,82 @@ function stripIncludeDirectives(value) {
     }
     return result;
 }
+function isWalletOsStoreEnabledInConfig(config) {
+    const envConfig = config.env;
+    if (!envConfig || typeof envConfig !== "object" || Array.isArray(envConfig)) {
+        return false;
+    }
+    const raw = envConfig.ELIZA_WALLET_OS_STORE;
+    if (typeof raw !== "string") {
+        return false;
+    }
+    const normalized = raw.trim().toLowerCase();
+    return (normalized === "1" ||
+        normalized === "true" ||
+        normalized === "on" ||
+        normalized === "yes");
+}
+function stripWalletPrivateKeysFromConfig(config) {
+    const envConfig = config.env;
+    if (!envConfig || typeof envConfig !== "object" || Array.isArray(envConfig)) {
+        return;
+    }
+    delete envConfig.EVM_PRIVATE_KEY;
+    delete envConfig.SOLANA_PRIVATE_KEY;
+    const nestedVars = envConfig.vars &&
+        typeof envConfig.vars === "object" &&
+        !Array.isArray(envConfig.vars)
+        ? envConfig.vars
+        : undefined;
+    if (nestedVars) {
+        delete nestedVars.EVM_PRIVATE_KEY;
+        delete nestedVars.SOLANA_PRIVATE_KEY;
+    }
+}
 export function saveElizaConfig(config) {
-    const configPath = resolveConfigPath();
+    const configPath = resolveConfigWritePath();
     const dir = path.dirname(configPath);
     if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
     }
+    migrateLegacyRuntimeConfig(config);
+    if (isWalletOsStoreEnabledInConfig(config)) {
+        stripWalletPrivateKeysFromConfig(config);
+    }
     const sanitized = stripIncludeDirectives(config);
     if (!sanitized || typeof sanitized !== "object") {
         throw new Error(`[eliza-config] stripIncludeDirectives returned invalid result: ${typeof sanitized}`);
     }
+    migrateLegacyRuntimeConfig(sanitized);
+    if (isWalletOsStoreEnabledInConfig(sanitized)) {
+        stripWalletPrivateKeysFromConfig(sanitized);
+    }
     const content = `${JSON.stringify(sanitized, null, 2)}\n`;
-    fs.writeFileSync(configPath, content, {
+    // Atomic write: write to a temp file then rename. If the process crashes
+    // during writeFileSync, only the temp file is corrupted — the original
+    // config remains intact. rename() is atomic on POSIX filesystems when
+    // source and destination are on the same filesystem.
+    //
+    // Resolve symlinks so dotfile-managed setups (symlinked config) update
+    // the target file instead of replacing the symlink with a regular file.
+    const realConfigPath = fs.existsSync(configPath)
+        ? fs.realpathSync(configPath)
+        : configPath;
+    const tmpPath = `${realConfigPath}.tmp.${process.pid}`;
+    fs.writeFileSync(tmpPath, content, {
         encoding: "utf-8",
         mode: 0o600,
     });
+    fs.renameSync(tmpPath, realConfigPath);
+    // Enforce 600 on every write — writeFileSync's mode only applies on
+    // creation, so files created by older versions retain their original
+    // (potentially world-readable) permissions.
+    try {
+        fs.chmodSync(configPath, 0o600);
+    }
+    catch {
+        // chmodSync may fail on some platforms (e.g. Windows). Non-fatal.
+    }
     if (!fs.existsSync(configPath)) {
         throw new Error(`[eliza-config] Config file missing after write: ${configPath}`);
     }
@@ -111,8 +262,24 @@ export function saveElizaConfig(config) {
     if (stat.size === 0) {
         throw new Error(`[eliza-config] Config file is empty after write: ${configPath}`);
     }
+    if (isElizaSettingsDebugEnabled()) {
+        const c = sanitized;
+        const cloud = c.cloud;
+        logger.debug({
+            path: configPath,
+            bytes: stat.size,
+            topLevelKeys: Object.keys(c).sort(),
+            cloud: settingsDebugCloudSummary(cloud),
+            snapshot: sanitizeForSettingsDebug(sanitized),
+        }, "[eliza][settings][saveElizaConfig]");
+    }
 }
 export function configFileExists() {
-    return fs.existsSync(resolveConfigPath());
+    const configPath = resolveConfigPath();
+    if (fs.existsSync(configPath)) {
+        return true;
+    }
+    const persistPath = resolveConfigWritePath();
+    return persistPath !== configPath && fs.existsSync(persistPath);
 }
 // Backward-compat aliases for downstream forks using the old name

package/packages/agent/src/config/env-vars.d.ts

@@ -1,3 +1,9 @@
-import type { ElizaConfig } from "./types";
+import type { ElizaConfig } from "./types.ts";
+/**
+ * Maps connector config fields to the environment variables expected by
+ * elizaOS plugins. Keep this aligned with runtime/eliza.ts.
+ */
+export declare const CONNECTOR_ENV_MAP: Readonly<Record<string, Readonly<Record<string, string>>>>;
 export declare function collectConfigEnvVars(cfg?: ElizaConfig): Record<string, string>;
+export declare function collectConnectorEnvVars(cfg?: ElizaConfig): Record<string, string>;
 //# sourceMappingURL=env-vars.d.ts.map