@elizaos/agent 2.0.0-beta.2 → 2.0.3-beta.3

package/services/shell-execution-router.js

@@ -0,0 +1,346 @@
+/**
+ * Single chokepoint for shell execution.
+ *
+ * The runtime has a 3-mode switch via `ELIZA_RUNTIME_MODE`:
+ *  - `cloud`        — agent code runs in the hosted backend; local exec is
+ *                     refused with a clear error.
+ *  - `local-safe`   — every shell exec is routed through `SandboxManager`
+ *                     (Docker / Apple Container) so the host filesystem is
+ *                     not directly touched.
+ *  - `local-yolo`   — direct host exec (the historical default).
+ *
+ * Plugins, services, and CLI helpers that previously called `child_process.spawn`
+ * for one-shot command execution should call `runShell()` instead. This keeps
+ * the mode dispatch in one place and lets the privacy/sandbox guarantees of
+ * `local-safe` actually hold.
+ */
+import { spawn } from "node:child_process";
+import fsp from "node:fs/promises";
+import path from "node:path";
+import process from "node:process";
+import { sanitizeSpawnEnv } from "@elizaos/core";
+import { resolveRuntimeExecutionMode, } from "@elizaos/shared";
+import { CapabilityBroker } from "./capability-broker.js";
+import { isVfsUri, runVfsBuiltinShell } from "./vfs-builtin-shell.js";
+import { createVirtualFilesystemService } from "./virtual-filesystem.js";
+export function resolveShellExecutionMode(ctx) {
+    if (ctx?.mode)
+        return ctx.mode;
+    return resolveRuntimeExecutionMode(ctx?.runtime ?? null);
+}
+function backendForSandboxManager(manager) {
+    // "auto" only appears in config; a constructed engine is always concrete.
+    const engineType = manager.engineType;
+    if (engineType === "docker")
+        return "docker";
+    if (engineType === "apple-container")
+        return "apple-container";
+    return "none";
+}
+async function resolveSandboxManager(ctx) {
+    if (ctx?.sandboxManager !== undefined)
+        return ctx.sandboxManager;
+    if (ctx?.resolveSandboxManager)
+        return await ctx.resolveSandboxManager();
+    return null;
+}
+// Router-scoped broker so the shell.exec policy is driven by the same mode
+// resolver runShell uses for dispatch. The broker singleton in
+// capability-broker.ts hardcodes `local-safe` as its default mode, which is
+// correct for cloud-side callers but wrong for host-side runShell — those
+// must follow ELIZA_RUNTIME_MODE/RUNTIME_MODE/LOCAL_RUNTIME_MODE. The
+// internal mutable holder lets the broker re-read mode on every call without
+// constructing a new CapabilityBroker per runShell invocation.
+const routerModeHolder = {
+    current: "local-yolo",
+};
+let cachedRouterBroker = null;
+function getRouterBroker(modeSource) {
+    routerModeHolder.current = modeSource();
+    if (cachedRouterBroker)
+        return cachedRouterBroker;
+    cachedRouterBroker = new CapabilityBroker({
+        mode: () => routerModeHolder.current,
+    });
+    return cachedRouterBroker;
+}
+/** Test-only escape hatch — drops the cached router broker. */
+export function __resetShellRouterBrokerForTests() {
+    cachedRouterBroker = null;
+    routerModeHolder.current = "local-yolo";
+}
+/**
+ * Strip dangerous keys (LD_PRELOAD, NODE_OPTIONS, DYLD_*, proxy + package-manager
+ * config prefixes, ...) from a caller-supplied child environment before it
+ * reaches a spawned process. Delegates to the core spawn-env policy and narrows
+ * the result back to a string map (the policy only removes keys, never values).
+ */
+function sanitizeChildEnv(env) {
+    const out = {};
+    for (const [key, value] of Object.entries(sanitizeSpawnEnv(env))) {
+        if (value !== undefined)
+            out[key] = value;
+    }
+    return out;
+}
+async function runOnHost(req) {
+    const start = Date.now();
+    return await new Promise((resolve) => {
+        const timeoutMs = req.timeoutMs ?? 30_000;
+        const useDetachedProcessGroup = process.platform !== "win32";
+        const child = spawn(req.command, req.args.slice(), {
+            cwd: req.cwd,
+            env: req.env
+                ? { ...process.env, ...sanitizeChildEnv(req.env) }
+                : process.env,
+            detached: useDetachedProcessGroup,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        let timedOut = false;
+        const killChildTree = () => {
+            try {
+                if (useDetachedProcessGroup && child.pid !== undefined) {
+                    process.kill(-child.pid, "SIGKILL");
+                    return;
+                }
+            }
+            catch {
+                // Fall back to killing the direct child below.
+            }
+            try {
+                child.kill("SIGKILL");
+            }
+            catch {
+                // child may already have exited
+            }
+        };
+        const timer = setTimeout(() => {
+            timedOut = true;
+            killChildTree();
+        }, timeoutMs);
+        if (typeof timer.unref === "function")
+            timer.unref();
+        child.stdout.on("data", (chunk) => {
+            const text = chunk.toString("utf8");
+            stdout += text;
+            req.onStdout?.(text);
+        });
+        child.stderr.on("data", (chunk) => {
+            const text = chunk.toString("utf8");
+            stderr += text;
+            req.onStderr?.(text);
+        });
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            resolve({
+                exitCode: -1,
+                stdout,
+                stderr: stderr.length > 0 ? `${stderr}\n${err.message}` : err.message,
+                durationMs: Date.now() - start,
+                sandbox: "host",
+            });
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            const exitCode = timedOut ? 124 : (code ?? -1);
+            resolve({
+                exitCode,
+                stdout,
+                stderr: timedOut
+                    ? `${stderr}${stderr.endsWith("\n") || stderr.length === 0 ? "" : "\n"}[shell-router] command timed out after ${timeoutMs}ms`
+                    : stderr,
+                durationMs: Date.now() - start,
+                sandbox: "host",
+            });
+        });
+    });
+}
+async function runInSandbox(req, manager) {
+    const result = await manager.run({
+        cmd: req.command,
+        args: req.args,
+        workdir: req.cwd,
+        env: req.env ? sanitizeChildEnv(req.env) : undefined,
+        timeoutMs: req.timeoutMs,
+    });
+    if (result.stdout)
+        req.onStdout?.(result.stdout);
+    if (result.stderr)
+        req.onStderr?.(result.stderr);
+    return {
+        exitCode: result.exitCode,
+        stdout: result.stdout,
+        stderr: result.stderr,
+        durationMs: result.durationMs,
+        sandbox: backendForSandboxManager(manager),
+    };
+}
+async function runVfsInSandbox(req, cwd, manager) {
+    const workspaceRoot = manager.getWorkspaceRoot();
+    if (!workspaceRoot) {
+        throw new Error("[shell-router] VFS sandbox execution requires SandboxManager.getWorkspaceRoot()");
+    }
+    const vfs = createVirtualFilesystemService({ projectId: cwd.projectId });
+    await vfs.initialize();
+    const normalizedCwd = vfs.resolveVirtualPath(cwd.virtualPath);
+    const materializedRoot = path.join(workspaceRoot, "vfs-projects", vfs.projectId, "files");
+    await fsp.rm(materializedRoot, { recursive: true, force: true });
+    await fsp.mkdir(materializedRoot, { recursive: true, mode: 0o700 });
+    await materializeVfsTree(vfs, materializedRoot);
+    const hostCwd = path.resolve(materializedRoot, normalizedCwd.replace(/^\/+/, ""));
+    if (!isInsideOrEqual(materializedRoot, hostCwd)) {
+        throw new Error("[shell-router] vfs:// cwd escapes materialized root");
+    }
+    await fsp.mkdir(hostCwd, { recursive: true, mode: 0o700 });
+    const sandboxCwd = manager.getContainerWorkspacePath(hostCwd) ??
+        `/workspace/${path
+            .relative(workspaceRoot, hostCwd)
+            .replace(/\\/g, "/")
+            .replace(/^\/+/, "")}`;
+    try {
+        return await runInSandbox({
+            ...req,
+            cwd: sandboxCwd,
+        }, manager);
+    }
+    finally {
+        await importMaterializedTree(vfs, materializedRoot);
+    }
+}
+async function materializeVfsTree(vfs, root) {
+    for (const file of await vfs.exportFiles()) {
+        const target = path.resolve(root, file.path.replace(/^\/+/, ""));
+        if (!isInsideOrEqual(root, target)) {
+            throw new Error(`[shell-router] VFS export path escapes materialized root: ${file.path}`);
+        }
+        await fsp.mkdir(path.dirname(target), { recursive: true, mode: 0o700 });
+        await fsp.writeFile(target, file.bytes, { mode: 0o600 });
+    }
+}
+async function importMaterializedTree(vfs, root) {
+    const nextFiles = new Map();
+    await walkMaterialized(root, root, nextFiles);
+    const currentFiles = await vfs.exportFiles();
+    for (const file of currentFiles) {
+        const normalized = file.path.replace(/^\/+/, "");
+        if (!nextFiles.has(normalized)) {
+            await vfs.delete(normalized);
+        }
+    }
+    for (const [virtualPath, bytes] of nextFiles) {
+        await vfs.writeFile(virtualPath, bytes);
+    }
+}
+async function walkMaterialized(root, dir, files) {
+    let entries;
+    try {
+        entries = await fsp.readdir(dir, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return;
+        throw error;
+    }
+    for (const entry of entries) {
+        const absolute = path.join(dir, entry.name);
+        if (entry.isSymbolicLink()) {
+            throw new Error(`VFS sandbox import rejects symlink: ${absolute}`);
+        }
+        if (entry.isDirectory()) {
+            await walkMaterialized(root, absolute, files);
+            continue;
+        }
+        if (!entry.isFile())
+            continue;
+        const virtualPath = path.relative(root, absolute).replace(/\\/g, "/");
+        files.set(virtualPath, await fsp.readFile(absolute));
+    }
+}
+function parseVfsShellCwd(value) {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "vfs:" || !parsed.hostname) {
+        throw new Error(`Invalid VFS uri: ${value}`);
+    }
+    return {
+        projectId: parsed.hostname,
+        virtualPath: decodeURIComponent(parsed.pathname || "/"),
+    };
+}
+function assertShellCapability(req, mode, toolName) {
+    const decision = getRouterBroker(() => mode).check({
+        kind: "shell",
+        op: "exec",
+        target: req.command,
+        toolName,
+    });
+    if (decision.allowed !== true) {
+        throw new Error(`[shell] capability denied: ${decision.reason}`);
+    }
+}
+/**
+ * Single entry point for one-shot shell execution. Mode dispatch:
+ *   - `cloud`      → throws.
+ *   - `local-safe` → routed through SandboxManager.run; if no manager is
+ *                    available the call throws so callers cannot silently
+ *                    fall back to the host.
+ *   - `local-yolo` → direct host exec via child_process.spawn.
+ *
+ * Platform support is determined by the resolved SandboxManager backend; the
+ * router does not silently downgrade `local-safe` to host execution.
+ */
+export async function runShell(req, ctx) {
+    if (!req.command || req.command.length === 0) {
+        throw new Error("[shell-router] runShell requires a non-empty command");
+    }
+    if (!req.toolName || req.toolName.length === 0) {
+        throw new Error("[shell-router] runShell requires toolName for audit");
+    }
+    const mode = resolveShellExecutionMode(ctx);
+    if (mode === "cloud") {
+        throw new Error("Local shell execution disabled in cloud mode.");
+    }
+    if (isVfsUri(req.cwd)) {
+        const vfsCwd = parseVfsShellCwd(req.cwd);
+        if (mode === "local-yolo") {
+            throw new Error("[shell-router] local-yolo uses the normal host filesystem; pass a real cwd path instead of vfs://");
+        }
+        const manager = await resolveSandboxManager(ctx);
+        if (manager) {
+            assertShellCapability(req, mode, `sandbox.${req.toolName}`);
+            return await runVfsInSandbox(req, vfsCwd, manager);
+        }
+        if (mode === "local-safe" && !isIosPlatform()) {
+            throw new Error("[shell-router] local-safe mode requires SandboxManager but none is available");
+        }
+        const result = await runVfsBuiltinShell({
+            cwdUri: req.cwd,
+            command: req.command,
+            args: req.args,
+            ...(req.timeoutMs ? { timeoutMs: req.timeoutMs } : {}),
+        });
+        if (result.stdout)
+            req.onStdout?.(result.stdout);
+        if (result.stderr)
+            req.onStderr?.(result.stderr);
+        return result;
+    }
+    if (mode === "local-safe") {
+        assertShellCapability(req, mode, `sandbox.${req.toolName}`);
+        const manager = await resolveSandboxManager(ctx);
+        if (!manager) {
+            throw new Error("[shell-router] local-safe mode requires SandboxManager but none is available");
+        }
+        return await runInSandbox(req, manager);
+    }
+    assertShellCapability(req, mode, req.toolName);
+    return await runOnHost(req);
+}
+function isInsideOrEqual(root, target) {
+    const relative = path.relative(path.resolve(root), path.resolve(target));
+    return (!relative || (!relative.startsWith("..") && !path.isAbsolute(relative)));
+}
+function isIosPlatform() {
+    return process.env.ELIZA_PLATFORM?.trim().toLowerCase() === "ios";
+}

package/services/signing-policy.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Transaction signing policy engine.
+ * Evaluates requests against chain/contract/value/rate/method/replay rules.
+ */
+export interface SigningPolicy {
+    allowedChainIds: number[];
+    allowedContracts: string[];
+    deniedContracts: string[];
+    maxTransactionValueWei: string;
+    maxTransactionsPerHour: number;
+    maxTransactionsPerDay: number;
+    allowedMethodSelectors: string[];
+    humanConfirmationThresholdWei: string;
+    requireHumanConfirmation: boolean;
+}
+export interface SigningRequest {
+    requestId: string;
+    chainId: number;
+    to: string;
+    value: string;
+    data: string;
+    nonce?: number;
+    gasLimit?: string;
+    maxFeePerGas?: string;
+    maxPriorityFeePerGas?: string;
+    createdAt: number;
+}
+export type PolicyDecision = {
+    allowed: boolean;
+    reason: string;
+    requiresHumanConfirmation: boolean;
+    matchedRule: string;
+};
+export declare function createDefaultPolicy(): SigningPolicy;
+export declare class SigningPolicyEvaluator {
+    private policy;
+    private requestLog;
+    private processedRequestIds;
+    constructor(policy?: SigningPolicy);
+    updatePolicy(policy: SigningPolicy): void;
+    getPolicy(): SigningPolicy;
+    evaluate(request: SigningRequest): PolicyDecision;
+    /** Record after signing completes (for replay + rate tracking). */
+    recordRequest(requestId: string): void;
+}
+//# sourceMappingURL=signing-policy.d.ts.map

package/services/signing-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-policy.d.ts","sourceRoot":"","sources":["../../src/services/signing-policy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,6BAA6B,EAAE,MAAM,CAAC;IACtC,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB,EAAE,OAAO,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wBAAgB,mBAAmB,IAAI,aAAa,CAYnD;AAED,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,UAAU,CAAuD;IACzE,OAAO,CAAC,mBAAmB,CAAqB;gBAEpC,MAAM,CAAC,EAAE,aAAa;IAIlC,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAIzC,SAAS,IAAI,aAAa;IAI1B,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc;IAsJjD,mEAAmE;IACnE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;CAYvC"}

package/services/task-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-executor.d.ts","sourceRoot":"","sources":["../../src/services/task-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE3D,8CAA8C;AAC9C,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,mCAAmC;AACnC,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,uDAAuD;IACvD,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC;IAE3D,0CAA0C;IAC1C,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAErE,2BAA2B;IAC3B,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED,kCAAkC;AAClC,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,SAAS,CAAwC;IAEzD,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI;IAItC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI9B,6CAA6C;IAC7C,YAAY,CACV,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,aAAa,GACrB,YAAY,GAAG,SAAS;IAa3B,MAAM,IAAI,YAAY,EAAE;IAIxB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;CAG5C"}

package/services/tee-boot-gate-state.d.ts

@@ -0,0 +1,29 @@
+/**
+ * In-process holder for the one-time TEE boot-gate decision (plan §4.1).
+ *
+ * The boot path evaluates the gate exactly once (see
+ * `runtime/eliza.ts` → `runTeeBootGate`). Modules that guard real secret
+ * paths — agent-wallet key reveal/bridge, remote plugin sync — cannot reach
+ * that closure-local decision, so the boot path publishes it here and those
+ * modules consult `teeBootGateBlocksSecrets()`.
+ *
+ * Inert by default: the singleton starts unset. Non-TEE / local-only boots
+ * either never set a gate or set one whose `required === false`, so
+ * `teeBootGateBlocksSecrets()` returns false and gated paths behave exactly as
+ * they did before TEE gating existed.
+ */
+import type { TeeBootGate } from "./tee-boot-gate.js";
+/** Publish the one-time boot-gate decision for cross-module consumption. */
+export declare function setTeeBootGateState(gate: TeeBootGate): void;
+/** The published boot-gate decision, or undefined when none has been set. */
+export declare function getTeeBootGateState(): TeeBootGate | undefined;
+/** Reset the singleton. Tests only — production sets the gate exactly once. */
+export declare function clearTeeBootGateState(): void;
+/**
+ * True ONLY when a gate is set, the policy requires trusted TEE evidence, and
+ * that evidence is not trusted (secrets disabled). When no gate is set, or the
+ * policy is not required, or secrets are enabled, this returns false — so the
+ * default (non-TEE) case is fully inert.
+ */
+export declare function teeBootGateBlocksSecrets(): boolean;
+//# sourceMappingURL=tee-boot-gate-state.d.ts.map

package/services/tee-boot-gate-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-boot-gate-state.d.ts","sourceRoot":"","sources":["../../src/services/tee-boot-gate-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAItD,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAE3D;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,IAAI,WAAW,GAAG,SAAS,CAE7D;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAAI,OAAO,CAMlD"}

package/services/tee-boot-gate-state.js

@@ -0,0 +1,38 @@
+/**
+ * In-process holder for the one-time TEE boot-gate decision (plan §4.1).
+ *
+ * The boot path evaluates the gate exactly once (see
+ * `runtime/eliza.ts` → `runTeeBootGate`). Modules that guard real secret
+ * paths — agent-wallet key reveal/bridge, remote plugin sync — cannot reach
+ * that closure-local decision, so the boot path publishes it here and those
+ * modules consult `teeBootGateBlocksSecrets()`.
+ *
+ * Inert by default: the singleton starts unset. Non-TEE / local-only boots
+ * either never set a gate or set one whose `required === false`, so
+ * `teeBootGateBlocksSecrets()` returns false and gated paths behave exactly as
+ * they did before TEE gating existed.
+ */
+let currentGate;
+/** Publish the one-time boot-gate decision for cross-module consumption. */
+export function setTeeBootGateState(gate) {
+    currentGate = gate;
+}
+/** The published boot-gate decision, or undefined when none has been set. */
+export function getTeeBootGateState() {
+    return currentGate;
+}
+/** Reset the singleton. Tests only — production sets the gate exactly once. */
+export function clearTeeBootGateState() {
+    currentGate = undefined;
+}
+/**
+ * True ONLY when a gate is set, the policy requires trusted TEE evidence, and
+ * that evidence is not trusted (secrets disabled). When no gate is set, or the
+ * policy is not required, or secrets are enabled, this returns false — so the
+ * default (non-TEE) case is fully inert.
+ */
+export function teeBootGateBlocksSecrets() {
+    return (currentGate !== undefined &&
+        currentGate.required === true &&
+        currentGate.secretsEnabled === false);
+}

package/services/tee-boot-gate.d.ts

@@ -0,0 +1,45 @@
+import type { TeeEvidenceProvider } from "./tee-evidence.js";
+import { type TeeEvidencePolicy, type TeeEvidencePolicyDecision } from "./tee-policy.js";
+import { type TeeProductionProfileOptions } from "./tee-production-profile.js";
+import { type ResolveTeeRuntimePolicyOptions } from "./tee-runtime-config.js";
+/**
+ * Boot-time TEE gate (plan §4.1). Consumes the resolved runtime policy, applies
+ * the production profile when configured, collects evidence via the provider,
+ * and evaluates trust ONCE at startup. The result tells the boot path which
+ * high-value capabilities may be enabled.
+ *
+ * Fail-closed contract: when the policy requires TEE and the decision is not
+ * trusted, NONE of model-key release, signing, agent-session secrets, or remote
+ * plugin sync may be enabled. The agent may still boot in a degraded,
+ * secret-less mode, but it must surface the failed decision via the structured
+ * logger ([TeeBootGate]) and never silently proceed with secrets.
+ */
+export type TeeBootGate = {
+    /** Resolved + production-merged policy actually evaluated (undefined ⇒ TEE not configured). */
+    policy: TeeEvidencePolicy | undefined;
+    /** True when no TEE policy is configured at all (local-only, no gating). */
+    teeConfigured: boolean;
+    /** True when the configured policy demands trusted evidence. */
+    required: boolean;
+    /** True when the production profile was merged in. */
+    productionProfile: boolean;
+    /** The single boot-time trust decision, when a policy was evaluated. */
+    decision?: TeeEvidencePolicyDecision;
+    /** Whether high-value secret/key/signing/sync capabilities may be enabled. */
+    secretsEnabled: boolean;
+};
+export type EvaluateTeeBootGateOptions = {
+    env?: Record<string, string | undefined>;
+    evidenceProvider?: TeeEvidenceProvider;
+    resolveOptions?: ResolveTeeRuntimePolicyOptions;
+    profileOptions?: TeeProductionProfileOptions;
+    nowMs?: number;
+};
+export declare function evaluateTeeBootGate(options?: EvaluateTeeBootGateOptions): Promise<TeeBootGate>;
+/**
+ * Guard a high-value capability behind the boot gate. Throws fail-closed when
+ * secrets are disabled, so a caller cannot accidentally release a key/secret or
+ * sync plugins after a failed attestation.
+ */
+export declare function assertTeeBootGateAllowsSecrets(gate: TeeBootGate, capability: string): void;
+//# sourceMappingURL=tee-boot-gate.d.ts.map

package/services/tee-boot-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-boot-gate.d.ts","sourceRoot":"","sources":["../../src/services/tee-boot-gate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC/B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,8BAA8B,EAEpC,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,+FAA+F;IAC/F,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACtC,4EAA4E;IAC5E,aAAa,EAAE,OAAO,CAAC;IACvB,gEAAgE;IAChE,QAAQ,EAAE,OAAO,CAAC;IAClB,sDAAsD;IACtD,iBAAiB,EAAE,OAAO,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IACrC,8EAA8E;IAC9E,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC,cAAc,CAAC,EAAE,8BAA8B,CAAC;IAChD,cAAc,CAAC,EAAE,2BAA2B,CAAC;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,WAAW,CAAC,CA+EtB;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,GACjB,IAAI,CAQN"}

package/services/tee-boot-gate.js

@@ -0,0 +1,80 @@
+import { logger } from "@elizaos/core";
+import { evaluateTeeEvidencePolicy, } from "./tee-policy.js";
+import { mergeTeeProductionProfile, } from "./tee-production-profile.js";
+import { resolveTeeRuntimePolicy, } from "./tee-runtime-config.js";
+export async function evaluateTeeBootGate(options = {}) {
+    const env = options.env ?? process.env;
+    const resolved = await resolveTeeRuntimePolicy({
+        env,
+        ...(options.nowMs === undefined ? {} : { nowMs: options.nowMs }),
+        ...(options.resolveOptions ?? {}),
+    });
+    const useProductionProfile = env.ELIZA_TEE_PRODUCTION_PROFILE === "true";
+    if (resolved === undefined && !useProductionProfile) {
+        return {
+            policy: undefined,
+            teeConfigured: false,
+            required: false,
+            productionProfile: false,
+            secretsEnabled: true,
+        };
+    }
+    const policy = useProductionProfile
+        ? mergeTeeProductionProfile(resolved, options.profileOptions ?? {})
+        : resolved;
+    const required = policy?.required === true;
+    if (!required) {
+        return {
+            policy,
+            teeConfigured: policy !== undefined,
+            required: false,
+            productionProfile: useProductionProfile,
+            secretsEnabled: true,
+        };
+    }
+    if (!options.evidenceProvider) {
+        logger.error("[TeeBootGate] ELIZA_TEE_REQUIRED is set but no evidence provider is configured; refusing to enable secrets.");
+        return {
+            policy,
+            teeConfigured: true,
+            required: true,
+            productionProfile: useProductionProfile,
+            secretsEnabled: false,
+        };
+    }
+    const evidence = await options.evidenceProvider.collectEvidence();
+    const decision = evaluateTeeEvidencePolicy(evidence, policy);
+    if (!decision.trusted) {
+        logger.error({ reason: decision.reason, detail: decision.detail }, "[TeeBootGate] TEE evidence is not trusted; secrets, model-key release, signing, and remote plugin sync are disabled.");
+        return {
+            policy,
+            teeConfigured: true,
+            required: true,
+            productionProfile: useProductionProfile,
+            decision,
+            secretsEnabled: false,
+        };
+    }
+    logger.info({
+        reason: decision.reason,
+        productionProfile: useProductionProfile,
+    }, "[TeeBootGate] TEE evidence trusted; high-value capabilities enabled.");
+    return {
+        policy,
+        teeConfigured: true,
+        required: true,
+        productionProfile: useProductionProfile,
+        decision,
+        secretsEnabled: true,
+    };
+}
+/**
+ * Guard a high-value capability behind the boot gate. Throws fail-closed when
+ * secrets are disabled, so a caller cannot accidentally release a key/secret or
+ * sync plugins after a failed attestation.
+ */
+export function assertTeeBootGateAllowsSecrets(gate, capability) {
+    if (!gate.secretsEnabled) {
+        throw new Error(`[TeeBootGate] ${capability} blocked: TEE evidence is not trusted (${gate.decision?.detail ?? gate.decision?.reason ?? "no evidence provider"}).`);
+    }
+}