@elizaos/agent 2.0.0-beta.2 → 2.0.11-beta.6

package/services/capability-broker.js

@@ -0,0 +1,339 @@
+/**
+ * CapabilityBroker — single decision point for privileged tool access.
+ *
+ * Every tool that touches a privileged resource (filesystem, shell, network,
+ * camera, mic, location, screen, contacts, messages, health, browser, wallet)
+ * calls `broker.check(req)` before doing the work. The broker consults a
+ * static policy table keyed by `(runtime mode, distribution profile)` and
+ * returns an allow/deny decision with a stable `policyKey` for auditing.
+ *
+ * Two orthogonal axes drive policy:
+ *   1. RuntimeExecutionMode — `cloud` | `local-safe` | `local-yolo`
+ *      Where computation lives and how trusted the local machine is. Cloud
+ *      runtime never gets to touch native surfaces; local-safe routes
+ *      shell/exec through the sandbox; local-yolo is the developer mode.
+ *   2. DistributionProfile — `store` | `unrestricted`
+ *      Which storefront the binary will be submitted to. Store builds must
+ *      be containable inside Apple/Google/Microsoft sandbox guarantees, so
+ *      arbitrary host-fs writes and raw shell exec are denied even in
+ *      local-yolo. `unrestricted` is for direct-download / dev builds.
+ *
+ * Audit log lands at `<stateDir>/audit/capability.jsonl` as one JSON object
+ * per check. Writes are synchronous so a crash mid-action still leaves a
+ * record. The file is truncated at broker boot if it exceeds 50MB.
+ */
+import { appendFileSync, mkdirSync, statSync, truncateSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { logger } from "@elizaos/core";
+import { resolveDistributionProfile, } from "@elizaos/shared";
+import { resolveStateDir } from "../config/paths.js";
+const AUDIT_LOG_MAX_BYTES = 50 * 1024 * 1024;
+const RECENT_DECISION_BUFFER = 256;
+/**
+ * Cloud egress allowlist. The cloud runtime is sandboxed so it cannot reach
+ * arbitrary hosts; only the elizaOS Cloud control plane and inference
+ * surfaces are reachable. Any host outside this list must be denied.
+ */
+const CLOUD_NET_ALLOWED_HOSTS = [
+    "elizacloud.ai",
+    "api.elizacloud.ai",
+    "www.elizacloud.ai",
+];
+/**
+ * Tool-name prefix that signals a request is going through the local-safe
+ * sandbox engine (Docker / Apple Container). Tools without this prefix are
+ * touching the host directly, which `local-safe` mode forbids.
+ */
+const SANDBOX_TOOL_NAME_PREFIX = "sandbox.";
+const ALLOW = { allow: true, reason: null };
+function deny(reason) {
+    return { allow: false, reason };
+}
+function isHostFsTarget(target) {
+    if (typeof target !== "string" || target.length === 0)
+        return false;
+    // VFS targets are expressed as virtual paths: scheme `vfs://` or relative.
+    // Anything starting with `/`, `~`, or a drive letter is a host path.
+    if (target.startsWith("vfs://"))
+        return false;
+    return (target.startsWith("/") ||
+        target.startsWith("~") ||
+        /^[a-zA-Z]:[\\/]/.test(target));
+}
+function isCloudAllowedHost(target) {
+    if (typeof target !== "string" || target.length === 0)
+        return false;
+    let host;
+    try {
+        host = new URL(target).hostname.toLowerCase();
+    }
+    catch {
+        host = target.toLowerCase();
+    }
+    return CLOUD_NET_ALLOWED_HOSTS.includes(host);
+}
+function isSandboxedTool(toolName) {
+    return (typeof toolName === "string" &&
+        toolName.startsWith(SANDBOX_TOOL_NAME_PREFIX));
+}
+const fsHostWriteSandboxed = (req) => isHostFsTarget(req.target)
+    ? deny("Host filesystem writes require VFS targets in this profile")
+    : ALLOW;
+const fsHostWriteHardDenied = (req) => isHostFsTarget(req.target)
+    ? deny("Cloud runtime cannot touch host filesystem; route through VFS or Cloud APIs")
+    : ALLOW;
+const cloudNetConnect = (req) => isCloudAllowedHost(req.target)
+    ? ALLOW
+    : deny(`Cloud runtime can only reach allowlisted hosts: ${CLOUD_NET_ALLOWED_HOSTS.join(", ")}`);
+const sandboxedShell = (req) => isSandboxedTool(req.toolName)
+    ? ALLOW
+    : deny("local-safe denies host shell exec; invoke via sandbox.* tools (Docker / Apple Container)");
+const POLICY = {
+    cloud: {
+        store: cloudKindPolicy(),
+        unrestricted: cloudKindPolicy(),
+    },
+    "local-safe": {
+        store: localSafeStorePolicy(),
+        unrestricted: localSafeUnrestrictedPolicy(),
+    },
+    "local-yolo": {
+        store: localYoloStorePolicy(),
+        unrestricted: localYoloUnrestrictedPolicy(),
+    },
+};
+function cloudKindPolicy() {
+    return {
+        fs: {
+            read: fsHostWriteHardDenied,
+            write: fsHostWriteHardDenied,
+            list: fsHostWriteHardDenied,
+        },
+        shell: {
+            exec: "deny",
+        },
+        net: {
+            connect: cloudNetConnect,
+        },
+        camera: { capture: "deny" },
+        mic: { capture: "deny" },
+        location: { read: "deny" },
+        screen: { capture: "deny" },
+        contacts: { read: "deny", list: "deny" },
+        messages: { read: "deny", write: "deny" },
+        health: { read: "deny" },
+        browser: { exec: "deny" },
+        wallet: { read: "deny", write: "deny" },
+    };
+}
+function localSafeStorePolicy() {
+    return {
+        fs: {
+            read: fsHostWriteSandboxed,
+            write: fsHostWriteSandboxed,
+            list: fsHostWriteSandboxed,
+        },
+        shell: {
+            exec: sandboxedShell,
+        },
+        net: {
+            connect: "allow",
+        },
+        camera: { capture: "allow" },
+        mic: { capture: "allow" },
+        location: { read: "allow" },
+        screen: { capture: "deny" },
+        contacts: { read: "allow", list: "allow" },
+        messages: { read: "allow", write: "allow" },
+        health: { read: "allow" },
+        browser: { exec: "allow" },
+        wallet: { read: "allow", write: "deny" },
+    };
+}
+function localSafeUnrestrictedPolicy() {
+    return {
+        fs: {
+            read: "allow",
+            write: fsHostWriteSandboxed,
+            list: "allow",
+        },
+        shell: {
+            exec: sandboxedShell,
+        },
+        net: { connect: "allow" },
+        camera: { capture: "allow" },
+        mic: { capture: "allow" },
+        location: { read: "allow" },
+        screen: { capture: "allow" },
+        contacts: { read: "allow", list: "allow" },
+        messages: { read: "allow", write: "allow" },
+        health: { read: "allow" },
+        browser: { exec: "allow" },
+        wallet: { read: "allow", write: "allow" },
+    };
+}
+function localYoloStorePolicy() {
+    return {
+        fs: {
+            read: fsHostWriteSandboxed,
+            write: fsHostWriteSandboxed,
+            list: fsHostWriteSandboxed,
+        },
+        shell: {
+            exec: "deny",
+        },
+        net: { connect: "allow" },
+        camera: { capture: "allow" },
+        mic: { capture: "allow" },
+        location: { read: "allow" },
+        screen: { capture: "deny" },
+        contacts: { read: "allow", list: "allow" },
+        messages: { read: "allow", write: "allow" },
+        health: { read: "allow" },
+        browser: { exec: "allow" },
+        wallet: { read: "allow", write: "deny" },
+    };
+}
+function localYoloUnrestrictedPolicy() {
+    return {
+        fs: { read: "allow", write: "allow", list: "allow" },
+        shell: { exec: "allow" },
+        net: { connect: "allow" },
+        camera: { capture: "allow" },
+        mic: { capture: "allow" },
+        location: { read: "allow" },
+        screen: { capture: "allow" },
+        contacts: { read: "allow", list: "allow" },
+        messages: { read: "allow", write: "allow" },
+        health: { read: "allow" },
+        browser: { exec: "allow" },
+        wallet: { read: "allow", write: "allow" },
+    };
+}
+function policyKeyFor(mode, profile, req) {
+    return `${mode}:${profile}:${req.kind}:${req.op}`;
+}
+function evaluatePolicy(mode, profile, req) {
+    const opPolicy = POLICY[mode][profile][req.kind]?.[req.op];
+    if (opPolicy === undefined) {
+        return deny(`No policy entry for ${req.kind}.${req.op} in ${mode}/${profile}`);
+    }
+    if (opPolicy === "allow")
+        return ALLOW;
+    if (opPolicy === "deny") {
+        return deny(`${req.kind}.${req.op} is denied in ${mode}/${profile}`);
+    }
+    return opPolicy(req);
+}
+export class CapabilityBroker {
+    auditFilePath;
+    modeFn;
+    profileFn;
+    nowFn;
+    recent = [];
+    constructor(options = {}) {
+        const stateDir = options.stateDir ?? resolveStateDir(process.env, os.homedir);
+        this.auditFilePath =
+            options.auditFilePath ?? path.join(stateDir, "audit", "capability.jsonl");
+        this.modeFn = options.mode ?? (() => "local-safe");
+        this.profileFn = options.distributionProfile ?? resolveDistributionProfile;
+        this.nowFn = options.now ?? (() => new Date());
+        mkdirSync(path.dirname(this.auditFilePath), { recursive: true });
+        this.rotateIfOversized();
+    }
+    check(req) {
+        const mode = this.modeFn();
+        const profile = this.profileFn();
+        const policyKey = policyKeyFor(mode, profile, req);
+        const result = evaluatePolicy(mode, profile, req);
+        let decision;
+        if (result.allow) {
+            decision = { allowed: true, policyKey };
+        }
+        else {
+            // Invariant: deny() always supplies a non-null reason. Surface a
+            // structured error if a policy resolver violated that contract so the
+            // bug fails loud instead of writing `null` into the audit log.
+            if (result.reason === null) {
+                throw new Error(`[CapabilityBroker] Policy resolver returned deny without a reason for ${policyKey}`);
+            }
+            decision = { allowed: false, reason: result.reason, policyKey };
+        }
+        this.audit(req, decision, mode, profile, policyKey);
+        return decision;
+    }
+    snapshot() {
+        return {
+            mode: this.modeFn(),
+            profile: this.profileFn(),
+            auditFilePath: this.auditFilePath,
+            recent: [...this.recent],
+        };
+    }
+    recentDecisions(limit = 50) {
+        if (!Number.isFinite(limit) || limit <= 0)
+            return [];
+        const start = Math.max(0, this.recent.length - Math.floor(limit));
+        return this.recent.slice(start);
+    }
+    rotateIfOversized() {
+        let size;
+        try {
+            size = statSync(this.auditFilePath).size;
+        }
+        catch {
+            return;
+        }
+        if (size > AUDIT_LOG_MAX_BYTES) {
+            truncateSync(this.auditFilePath, 0);
+            logger.info(`[CapabilityBroker] Truncated audit log at ${this.auditFilePath} (was ${size} bytes)`);
+        }
+    }
+    audit(req, decision, mode, profile, policyKey) {
+        const denyReason = decision.allowed === true ? null : decision.reason;
+        const record = {
+            ts: this.nowFn().toISOString(),
+            kind: req.kind,
+            op: req.op,
+            target: req.target ?? null,
+            toolName: req.toolName ?? null,
+            reason: req.reason ?? null,
+            allowed: decision.allowed,
+            denyReason,
+            mode,
+            profile,
+            policyKey,
+        };
+        this.recent.push(record);
+        if (this.recent.length > RECENT_DECISION_BUFFER) {
+            this.recent.splice(0, this.recent.length - RECENT_DECISION_BUFFER);
+        }
+        try {
+            appendFileSync(this.auditFilePath, `${JSON.stringify(record)}\n`, "utf8");
+        }
+        catch (err) {
+            // The audit boundary is the only place we tolerate a catch — but we
+            // surface the failure structurally rather than swallowing it. A broken
+            // audit log is a security incident, not an ignorable path.
+            const message = err instanceof Error ? err.message : String(err);
+            logger.error(`[CapabilityBroker] Failed to append capability audit record at ${this.auditFilePath} (policyKey=${policyKey}): ${message}`);
+            throw err;
+        }
+    }
+}
+let cachedBroker = null;
+export function getCapabilityBroker() {
+    if (cachedBroker)
+        return cachedBroker;
+    cachedBroker = new CapabilityBroker();
+    return cachedBroker;
+}
+/**
+ * Test-only escape hatch — drops the cached singleton so the next call to
+ * `getCapabilityBroker()` re-reads env. Not exported to consumers via the
+ * package barrel.
+ */
+export function __resetCapabilityBrokerForTests() {
+    cachedBroker = null;
+}

package/services/character-history.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"character-history.d.ts","sourceRoot":"","sources":["../../src/services/character-history.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,MAAM,EAAc,MAAM,eAAe,CAAC;AAE5E,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AACjE,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE;QACN,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAEpE,KAAK,qBAAqB,GACtB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,qBAAqB,EAAE,GACvB;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAAA;CAAE,CAAC;AAEzD,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE;QACN,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,qBAAqB,EAAE,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,MAAM,wBAAwB,CAAC;AAEnE,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,KAAK,CAAC,EAAE,qBAAqB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,qBAAqB,EAAE,CAAC;IACvC,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC,MAAM,EAAE,wBAAwB,CAAC;IACjC,KAAK,EAAE,wBAAwB,CAAC;CACjC,CAAC;AAEF,KAAK,4BAA4B,GAAG;IAClC,iBAAiB,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAChD,aAAa,EAAE,oBAAoB,CAAC;IACpC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AA8HF,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,oBAAoB,GAC9B,wBAAwB,CAkD1B;AAED,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,wBAAwB,EAClC,IAAI,EAAE,wBAAwB,GAC7B,sBAAsB,EAAE,CAwB1B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAiDvC;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,GACb,qBAAqB,GAAG,IAAI,CAsE9B;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,aAAa,EACtB,KAAK,SAAK,GACT,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAiBlC"}

package/services/character-persistence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"character-persistence.d.ts","sourceRoot":"","sources":["../../src/services/character-persistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAU,OAAO,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EACL,KAAK,WAAW,EAGjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EAE1B,MAAM,wBAAwB,CAAC;AAEhC,eAAO,MAAM,6BAA6B,gCAAgC,CAAC;AAE3E,KAAK,sBAAsB,GAAG;IAC5B,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,iBAAiB,CAAC,EAAE,oBAAoB,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,sBAAsB,CAAC;CACjC,CAAC;AAEF,KAAK,sBAAsB,GAAG;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,eAAe,GAAG,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAC7D,KAAK,CAAC,MAAM,CAAC,CAAC,GACd,SAAS,GACT,CAAC,GACD,KAAK,CAAC;AAcV,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,oBAAoB,GAC9B,eAAe,CAoEjB;AA+CD,qBAAa,gCAAiC,SAAQ,OAAO;IAC3D,MAAM,CAAC,WAAW,SAAiC;WAEtC,KAAK,CAChB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,gCAAgC,CAAC;IAI5C,qBAAqB,SAC8D;IAE7E,gBAAgB,CACpB,MAAM,GAAE,sBAA2B,GAClC,OAAO,CAAC,sBAAsB,CAAC;IA0D5B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAC5B"}

package/services/client-chat-sender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-chat-sender.d.ts","sourceRoot":"","sources":["../../src/services/client-chat-sender.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAEL,KAAK,aAAa,EAEnB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAoB,WAAW,EAAE,MAAM,wBAAwB,CAAC;AA4C5E;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,WAAW,GACjB,IAAI,CA2CN"}

package/services/client-chat-sender.js

@@ -0,0 +1,88 @@
+/**
+ * Registers a send handler for the "client_chat" source so the agent can
+ * proactively push messages to connected Eliza app clients.
+ *
+ * The handler persists the message to the DB and broadcasts it over
+ * WebSocket so the UI updates in real time. If no WS clients are
+ * connected, the message is still persisted and will appear when the
+ * app reconnects.
+ */
+import crypto from "node:crypto";
+import { createMessageMemory, } from "@elizaos/core";
+/**
+ * Resolve the best conversation for a given roomId by scanning the
+ * server-side conversation map. Returns undefined when no match exists.
+ */
+function findConversationByRoomId(state, roomId) {
+    for (const conv of state.conversations.values()) {
+        if (conv.roomId === roomId)
+            return conv;
+    }
+    return undefined;
+}
+/**
+ * Resolve the target conversation using the same priority chain as
+ * {@link routeAutonomyTextToUser}: explicit roomId -> active conversation
+ * -> most-recently-updated conversation.
+ */
+function resolveConversation(state, roomId) {
+    // 1. Explicit room
+    if (roomId) {
+        const conv = findConversationByRoomId(state, roomId);
+        if (conv)
+            return conv;
+    }
+    // 2. Active conversation (set by the UI via WS "active-conversation" msg)
+    if (state.activeConversationId) {
+        const conv = state.conversations.get(state.activeConversationId);
+        if (conv)
+            return conv;
+    }
+    // 3. Most recently updated conversation
+    const sorted = Array.from(state.conversations.values()).sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime());
+    return sorted[0];
+}
+/**
+ * Register the `client_chat` send handler on the given runtime.
+ *
+ * Must be called after the WebSocket server is set up (so that
+ * `state.broadcastWs` is available).
+ */
+export function registerClientChatSendHandler(runtime, state) {
+    if (typeof runtime.registerSendHandler !== "function") {
+        return;
+    }
+    runtime.registerSendHandler("client_chat", async (_rt, target, content) => {
+        const conv = resolveConversation(state, target.roomId);
+        if (!conv) {
+            // No conversation exists to deliver into. Throw so the caller records a
+            // delivery failure (e.g. escalation falls through to the next channel)
+            // instead of treating a silently dropped message as a successful send.
+            throw new Error("client_chat send failed: no conversation available to deliver message");
+        }
+        const messageId = crypto.randomUUID();
+        const agentMessage = createMessageMemory({
+            id: messageId,
+            entityId: runtime.agentId,
+            roomId: conv.roomId,
+            content: {
+                ...content,
+                text: content.text ?? "",
+                source: "client_chat",
+            },
+        });
+        await runtime.createMemory(agentMessage, "messages");
+        conv.updatedAt = new Date().toISOString();
+        state.broadcastWs?.({
+            type: "proactive-message",
+            conversationId: conv.id,
+            message: {
+                id: messageId,
+                role: "assistant",
+                text: content.text ?? "",
+                timestamp: Date.now(),
+                source: "client_chat",
+            },
+        });
+    });
+}

package/services/config-plugin-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-plugin-manager.d.ts","sourceRoot":"","sources":["../../src/services/config-plugin-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAIV,iBAAiB,EAMlB,MAAM,2BAA2B,CAAC;AAOnC,KAAK,YAAY,GAAG,MAAM,WAAW,CAAC;AAqBtC,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,YAAY,GACtB,iBAAiB,CAiDnB"}

package/services/connector-setup-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-setup-service.d.ts","sourceRoot":"","sources":["../../src/services/connector-setup-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,aAAa,EAAU,OAAO,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EACL,KAAK,kBAAkB,EAExB,MAAM,iCAAiC,CAAC;AAKzC,YAAY,EAAE,kBAAkB,EAAE,CAAC;AAEnC,MAAM,WAAW,6BAA8B,SAAQ,OAAO;IAC5D,+CAA+C;IAC/C,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,qCAAqC;IACrC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrD,gFAAgF;IAChF,YAAY,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,IAAI,CAAC;IACvE,yEAAyE;IACzE,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IACxD,uDAAuD;IACvD,eAAe,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC;IACrD,qDAAqD;IACrD,eAAe,IAAI,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kFAAkF;IAClF,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;CAC3D;AAED,qBAAa,qBAAsB,SAAQ,OAAO;IAChD,MAAM,CAAC,WAAW,SAAqB;IACvC,qBAAqB,SAAkD;IAEvE,OAAO,CAAC,aAAa,CAAyC;WAEjD,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAIpC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAIpD,YAAY,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,IAAI;IAMtE,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAIvD,eAAe,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO;IAYpD,eAAe,IAAI,MAAM;IAIzB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI/B,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;CAG1D"}

package/services/cove-quote-x509.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Standard-format CoVE / AP-TEE evidence verifier: X.509 DER certificate chains
+ * carrying a TCG DICE `DiceTcbInfo` extension (OID 2.23.133.5.4), as emitted by
+ * real RISC-V CoVE TSMs (e.g. Salus via its `rice` DICE crate) through the
+ * COVG `get_evidence(DiceTcbInfo)` call.
+ *
+ * This is an ADDITIONAL accepted format alongside the bespoke canonical-JSON
+ * DICE path in `cove-quote.ts`; neither replaces the other. The canonical-JSON
+ * path is the reference the E1 silicon may reproduce without an ASN.1 encoder;
+ * this path is what interoperates with TSMs that already emit standard X.509.
+ *
+ * Real cryptography only. Each certificate's signature is verified with
+ * node:crypto (`X509Certificate.verify`/`createPublicKey`) — Ed25519 per the
+ * rice format (algorithm OID 1.3.101.112). The chain is anchored in a trusted
+ * RoT public key supplied out-of-band (the DeviceID / layer-0 key), exactly as
+ * a relying party must obtain a CoVE root anchor: it is not carried in the leaf.
+ *
+ * `DiceTcbInfo` FwId measurements are extracted with a minimal ASN.1 DER reader
+ * (node's `X509Certificate` does not surface custom extensions), keeping the
+ * SHA-384 (or other) digests and the optional SVN, then mapped into the
+ * normalized `TeeEvidence` shape so the same policy evaluator consumes them.
+ */
+import { type TeeEvidence } from "./tee-evidence.ts";
+/** TCG DICE `DiceTcbInfo` extension OID: tcg(2.23.133) platformClass(5) 4. */
+export declare const TCG_DICE_TCB_INFO_OID = "2.23.133.5.4";
+/** Ed25519 signature/key algorithm OID (RFC 8410). */
+export declare const ED25519_OID = "1.3.101.112";
+/** SHA-384 hash algorithm OID (the digest rice's FwIds use). */
+export declare const SHA384_OID = "2.16.840.1.101.3.4.2.2";
+/** A single FWID entry from a `DiceTcbInfo` extension. */
+export type DiceFwId = {
+    /** Hash algorithm OID (e.g. SHA-384 `2.16.840.1.101.3.4.2.2`). */
+    hashAlgOid: string;
+    /** Lowercase-hex digest bytes. */
+    digestHex: string;
+};
+/** Decoded `DiceTcbInfo` extension contents (only the fields rice emits). */
+export type DiceTcbInfo = {
+    /** FWID measurement list, in encoded order (TCG PCR-register order). */
+    fwids: DiceFwId[];
+    /** Security version number, when the `svn` field [3] is present. */
+    svn?: number;
+    vendor?: string;
+    model?: string;
+    version?: string;
+    /** Raw operational-flags byte, when the `flags` field [7] is present. */
+    flags?: number;
+    /**
+     * `vendorInfo` field [8] OCTET STRING, lowercase-hex, when present. A CoVE TSM
+     * MAY place the live-channel `report_data` (SHA256(nonce || epk)) here so the
+     * X.509 evidence is bound to the verifier's challenge. When the binding
+     * options are supplied, this field is what the verifier checks against.
+     */
+    reportDataHex?: string;
+};
+/** One verified link in the chain, with its decoded `DiceTcbInfo` (if any). */
+export type CoveX509Cert = {
+    subject: string;
+    issuer: string;
+    /** SHA-256 hex of the subject SPKI DER (DeviceID-style identity digest). */
+    spkiSha256: string;
+    notBefore: string;
+    notAfter: string;
+    /** Decoded `DiceTcbInfo` extension, present on the leaf for rice certs. */
+    tcbInfo?: DiceTcbInfo;
+};
+export type CoveX509VerifyOptions = {
+    /**
+     * The trusted RoT anchor: the issuer (DeviceID / layer-0) Ed25519 public key
+     * that signed `chain[0]`. Accepts SPKI DER (Buffer/Uint8Array), SPKI/PEM
+     * (string), or a raw 32-byte Ed25519 key (Buffer). Obtained out-of-band; a
+     * CoVE leaf is signed by but does not contain its issuer key.
+     */
+    trustedRotPublicKey: Buffer | Uint8Array | string;
+    /** Wall-clock for validity-window checks. Defaults to `Date.now()`. */
+    nowMs?: number;
+    /**
+     * Nonce this verifier issued for the live channel. When supplied together
+     * with `ephemeralPublicKey`, the leaf's `DiceTcbInfo` vendorInfo field MUST
+     * carry `report_data = SHA256(nonce || epk)` and equal it, or verification
+     * fails with `report-data-mismatch`. This is the anti-replay binding,
+     * consistent with the canonical-JSON CoVE path (`verifyCoveQuote`). A leaf
+     * that omits vendorInfo when a binding is required fails closed: the standard
+     * rice `DiceTcbInfo` does not emit report_data, so a TSM that interoperates
+     * with this binding MUST place it in vendorInfo [8]; otherwise the relying
+     * party cannot prove freshness and must reject.
+     */
+    expectedNonce?: string;
+    /** Ephemeral public key the verifier offered; bound with `expectedNonce`. */
+    ephemeralPublicKey?: Buffer;
+};
+export type CoveX509VerifyResult = {
+    verified: true;
+    /** Chain in input order: `chain[0]` is anchored, last is the leaf. */
+    chain: [CoveX509Cert, ...CoveX509Cert[]];
+    /** The leaf certificate (the one whose key attests the workload). */
+    leaf: CoveX509Cert;
+} | {
+    verified: false;
+    reason: CoveX509VerifyFailure;
+    detail: string;
+};
+export type CoveX509VerifyFailure = "malformed-chain" | "empty-chain" | "root-anchor-mismatch" | "chain-link-broken" | "cert-signature-invalid" | "cert-expired" | "tcb-info-malformed" | "report-data-mismatch";
+/**
+ * Verify an X.509 DICE certificate chain with real Ed25519 cryptography:
+ *   1. `chain[0]` (the highest cert provided) is verified against
+ *      `trustedRotPublicKey` — the out-of-band RoT/DeviceID anchor.
+ *   2. Each subsequent cert is verified against the previous cert's public key,
+ *      and `issuer === parent.subject`.
+ *   3. Every cert is inside its validity window.
+ *   4. The leaf's `DiceTcbInfo` extension is decoded (FwIds + SVN).
+ *   5. When `expectedNonce`/`ephemeralPublicKey` are supplied, the leaf's
+ *      vendorInfo report_data equals SHA256(nonce || epk) — the live-channel
+ *      binding that defeats replay. A leaf without vendorInfo fails closed.
+ *
+ * Never returns `verified:true` without a passing signature check at every link.
+ * A single self-signed leaf is a valid one-element chain when it verifies
+ * against the anchor (the anchor then IS the issuer key).
+ */
+export declare function verifyCoveX509Chain(derChain: ReadonlyArray<Buffer | Uint8Array>, options: CoveX509VerifyOptions): CoveX509VerifyResult;
+/**
+ * Map a verified X.509 DICE chain into the normalized `TeeEvidence` shape so
+ * `evaluateTeeEvidencePolicy` consumes it identically to the canonical-JSON
+ * CoVE path. The leaf's `DiceTcbInfo` FwIds populate `measurements` under the
+ * supplied register-name mapping; pass the result of a successful
+ * `verifyCoveX509Chain` — never an unverified chain.
+ *
+ * @param fwidNames Maps FwId list index -> `TeeEvidence` measurement name. CoVE
+ *   TSMs emit a fixed register layout (TCG PCR indices); the caller supplies the
+ *   platform's register-to-name map so unrelated platforms are not conflated.
+ */
+export declare function coveX509ToTeeEvidence(result: Extract<CoveX509VerifyResult, {
+    verified: true;
+}>, fwidNames: ReadonlyArray<string>): TeeEvidence;
+/**
+ * Decode the `DiceTcbInfo` extension from a single X.509 DER certificate
+ * WITHOUT verifying its signature. Use only for inspecting a cert's measurement
+ * claims (e.g. logging, fixture assertions); trust decisions must go through
+ * `verifyCoveX509Chain`. Returns `undefined` when the cert is unparseable or has
+ * no `DiceTcbInfo` extension, `"malformed"` when the extension cannot decode.
+ */
+export declare function decodeDiceTcbInfoFromCert(der: Buffer | Uint8Array): DiceTcbInfo | "malformed" | undefined;
+//# sourceMappingURL=cove-quote-x509.d.ts.map

package/services/cove-quote-x509.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cove-quote-x509.d.ts","sourceRoot":"","sources":["../../src/services/cove-quote-x509.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,OAAO,EAEL,KAAK,WAAW,EAEjB,MAAM,mBAAmB,CAAC;AAE3B,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AACpD,sDAAsD;AACtD,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,gEAAgE;AAChE,eAAO,MAAM,UAAU,2BAA2B,CAAC;AAEnD,0DAA0D;AAC1D,MAAM,MAAM,QAAQ,GAAG;IACrB,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG;IACxB,wEAAwE;IACxE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IAClD,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAC5B;IACE,QAAQ,EAAE,IAAI,CAAC;IACf,sEAAsE;IACtE,KAAK,EAAE,CAAC,YAAY,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;IACzC,qEAAqE;IACrE,IAAI,EAAE,YAAY,CAAC;CACpB,GACD;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE,MAAM,MAAM,qBAAqB,GAC7B,iBAAiB,GACjB,aAAa,GACb,sBAAsB,GACtB,mBAAmB,GACnB,wBAAwB,GACxB,cAAc,GACd,oBAAoB,GACpB,sBAAsB,CAAC;AAE3B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,aAAa,CAAC,MAAM,GAAG,UAAU,CAAC,EAC5C,OAAO,EAAE,qBAAqB,GAC7B,oBAAoB,CAwGtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,OAAO,CAAC,oBAAoB,EAAE;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAC,EACzD,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,GAC/B,WAAW,CAwBb;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,GAAG,UAAU,GACvB,WAAW,GAAG,WAAW,GAAG,SAAS,CAIvC"}