@elizaos/agent 2.0.3-beta.2 → 2.0.3-beta.4

package/api/nfa-routes.js

@@ -1,125 +0,0 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
-import { createHash } from "node:crypto";
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
-import { resolveStateDir } from "@elizaos/core";
-import { readJsonFile } from "../utils/atomic-json.js";
-function emptyMerkleRoot() {
-    return createHash("sha256").update("", "utf8").digest("hex");
-}
-let nfaPlugin;
-async function getNfaPlugin() {
-    if (nfaPlugin !== undefined)
-        return nfaPlugin;
-    try {
-        const pkgName = "@elizaos/plugin-bnb-identity";
-        const mod = await import(__rewriteRelativeImportExtension(/* @vite-ignore */ pkgName));
-        nfaPlugin =
-            typeof mod?.buildMerkleRoot === "function" &&
-                typeof mod?.parseLearnings === "function" &&
-                typeof mod?.sha256 === "function"
-                ? {
-                    buildMerkleRoot: mod.buildMerkleRoot,
-                    parseLearnings: mod.parseLearnings,
-                    sha256: mod.sha256,
-                }
-                : null;
-    }
-    catch {
-        nfaPlugin = null;
-    }
-    return nfaPlugin;
-}
-export async function handleNfaRoutes(ctx) {
-    const { res, method, pathname, json } = ctx;
-    if (method === "GET" && pathname === "/api/nfa/status") {
-        const elizaDir = resolveStateDir();
-        const [nfaRecord, identityRecord] = await Promise.all([
-            readJsonFile(join(elizaDir, "bap578-nfa.json")),
-            readJsonFile(join(elizaDir, "bnb-identity.json")),
-        ]);
-        const bscscanBase = (nfaRecord?.network ?? identityRecord?.network ?? "bsc-testnet") === "bsc"
-            ? "https://bscscan.com"
-            : "https://testnet.bscscan.com";
-        json(res, {
-            nfa: nfaRecord
-                ? {
-                    tokenId: nfaRecord.tokenId,
-                    contractAddress: nfaRecord.contractAddress,
-                    network: nfaRecord.network,
-                    ownerAddress: nfaRecord.ownerAddress,
-                    merkleRoot: nfaRecord.merkleRoot,
-                    mintTxHash: nfaRecord.mintTxHash,
-                    mintedAt: nfaRecord.mintedAt,
-                    lastUpdatedAt: nfaRecord.lastUpdatedAt,
-                    bscscanUrl: `${bscscanBase}/tx/${nfaRecord.mintTxHash}`,
-                }
-                : null,
-            identity: identityRecord
-                ? {
-                    agentId: identityRecord.agentId,
-                    network: identityRecord.network,
-                    ownerAddress: identityRecord.ownerAddress,
-                    agentURI: identityRecord.agentURI,
-                    registeredAt: identityRecord.registeredAt,
-                    scanUrl: `https://${identityRecord.network === "bsc" ? "www" : "testnet"}.8004scan.io/agent/${identityRecord.agentId}`,
-                }
-                : null,
-            configured: !!(nfaRecord || identityRecord),
-        });
-        return true;
-    }
-    if (method === "GET" && pathname === "/api/nfa/learnings") {
-        const learningsPaths = [
-            join(resolveStateDir(), "LEARNINGS.md"),
-            join(process.cwd(), "LEARNINGS.md"),
-        ];
-        let markdown = null;
-        let resolvedSource = null;
-        for (const path of learningsPaths) {
-            try {
-                markdown = await readFile(path, "utf8");
-                resolvedSource = path;
-                break;
-            }
-            catch { }
-        }
-        if (!markdown) {
-            json(res, {
-                entries: [],
-                merkleRoot: emptyMerkleRoot(),
-                totalEntries: 0,
-                source: null,
-            });
-            return true;
-        }
-        const plugin = await getNfaPlugin();
-        if (!plugin) {
-            json(res, {
-                entries: [],
-                merkleRoot: emptyMerkleRoot(),
-                totalEntries: 0,
-                source: null,
-            });
-            return true;
-        }
-        const entries = plugin.parseLearnings(markdown);
-        const leafHashes = entries.map((entry) => entry.hash);
-        const merkleRoot = plugin.buildMerkleRoot(leafHashes);
-        json(res, {
-            entries,
-            merkleRoot,
-            totalEntries: entries.length,
-            source: resolvedSource,
-        });
-        return true;
-    }
-    return false;
-}

package/api/server-auth.d.ts

@@ -1,46 +0,0 @@
-/**
- * Auth, security, and WebSocket authorization helpers extracted from server.ts.
- */
-import type http from "node:http";
-import type { AgentRuntime } from "@elizaos/core";
-import { type WalletExportRejection, type WalletExportRequestBody } from "@elizaos/shared";
-import type { ConversationMeta } from "./server-helpers.ts";
-export declare function extractAuthToken(req: http.IncomingMessage): string | null;
-export declare function tokenMatches(expected: string, provided: string): boolean;
-export declare function getConfiguredApiToken(): string | undefined;
-export declare function isLoopbackBindHost(host: string): boolean;
-export declare function isTrustedLocalRequest(req: http.IncomingMessage): boolean;
-export declare function ensureApiTokenForBindHost(host: string): void;
-export declare function isAuthorized(req: http.IncomingMessage): boolean;
-export interface PluginConfigMutationRejection {
-    field: string;
-    message: string;
-}
-export declare function resolvePluginConfigMutationRejections(pluginParams: Array<{
-    key: string;
-}>, config: Record<string, unknown>): PluginConfigMutationRejection[];
-export type { WalletExportRejection };
-export declare function resolveWalletExportRejection(req: http.IncomingMessage, body: WalletExportRequestBody): WalletExportRejection | null;
-interface TerminalRunRequestBody {
-    terminalToken?: string;
-}
-export interface TerminalRunRejection {
-    status: 401 | 403;
-    reason: string;
-}
-export declare function resolveTerminalRunRejection(req: http.IncomingMessage, body: TerminalRunRequestBody): TerminalRunRejection | null;
-export declare function extractWsQueryToken(url: URL): string | null;
-export declare function hasWsQueryToken(url: URL): boolean;
-export declare function extractWebSocketHandshakeToken(request: http.IncomingMessage, url: URL): string | null;
-export declare function isWebSocketAuthorized(request: http.IncomingMessage, url: URL): boolean;
-export interface WebSocketUpgradeRejection {
-    status: 401 | 403 | 404;
-    reason: string;
-}
-export declare function resolveWebSocketUpgradeRejection(req: http.IncomingMessage, wsUrl: URL, resolveCorsOrigin?: (origin?: string) => string | null): WebSocketUpgradeRejection | null;
-export declare function isSafeResetStateDir(resolvedState: string, homeDir: string): boolean;
-type ConversationRoomTitleRef = Pick<ConversationMeta, "id" | "title" | "roomId">;
-export declare function persistConversationRoomTitle(runtime: Pick<AgentRuntime, "getRoom" | "adapter"> | null | undefined, conversation: ConversationRoomTitleRef): Promise<boolean>;
-export declare function rejectWebSocketUpgrade(socket: import("node:stream").Duplex, statusCode: number, message: string): void;
-export declare function decodePathComponent(raw: string, res: http.ServerResponse, fieldName: string): string | null;
-//# sourceMappingURL=server-auth.d.ts.map

package/api/server-auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"server-auth.d.ts","sourceRoot":"","sources":["../../src/api/server-auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAM5D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,MAAM,GAAG,IAAI,CAyBzE;AAMD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKxE;AAED,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAE1D;AAiKD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAuCxD;AAuBD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAoBxE;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CA0B5D;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAQ/D;AAMD,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,qCAAqC,CACnD,YAAY,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,EACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,6BAA6B,EAAE,CA0BjC;AAMD,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAEtC,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,uBAAuB,GAC5B,qBAAqB,GAAG,IAAI,CAuC9B;AAMD,UAAU,sBAAsB;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,sBAAsB,GAC3B,oBAAoB,GAAG,IAAI,CA0C7B;AAMD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAS3D;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAMjD;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,IAAI,CAAC,eAAe,EAC7B,GAAG,EAAE,GAAG,GACP,MAAM,GAAG,IAAI,CAIf;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,eAAe,EAC7B,GAAG,EAAE,GAAG,GACP,OAAO,CAOT;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,KAAK,EAAE,GAAG,EACV,iBAAiB,GAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAiB,GACjE,yBAAyB,GAAG,IAAI,CAuClC;AAgBD,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAgBT;AAMD,KAAK,wBAAwB,GAAG,IAAI,CAClC,gBAAgB,EAChB,IAAI,GAAG,OAAO,GAAG,QAAQ,CAC1B,CAAC;AAEF,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,EACrE,YAAY,EAAE,wBAAwB,GACrC,OAAO,CAAC,OAAO,CAAC,CAalB;AAMD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,aAAa,EAAE,MAAM,EACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,IAAI,CAmBN;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAOf"}

package/api/server-auth.js

@@ -1,504 +0,0 @@
-/**
- * Auth, security, and WebSocket authorization helpers extracted from server.ts.
- */
-import crypto from "node:crypto";
-import { isIP } from "node:net";
-import path from "node:path";
-import { logger, sendJsonError } from "@elizaos/core";
-import { isCloudProvisionedContainer, resolveApiSecurityConfig, resolveApiToken, setApiToken, } from "@elizaos/shared";
-import { BLOCKED_ENV_KEYS } from "./plugin-discovery-helpers.js";
-// ---------------------------------------------------------------------------
-// Auth token extraction
-// ---------------------------------------------------------------------------
-export function extractAuthToken(req) {
-    const rawAuth = typeof req.headers.authorization === "string"
-        ? req.headers.authorization
-        : "";
-    const auth = rawAuth.length > 8192 ? rawAuth.slice(0, 8192).trim() : rawAuth.trim();
-    if (auth &&
-        auth.length >= 7 &&
-        auth.slice(0, 7).toLowerCase() === "bearer ") {
-        const token = auth.slice(7).trim();
-        if (token)
-            return token;
-    }
-    const header = (typeof req.headers["x-eliza-token"] === "string" &&
-        req.headers["x-eliza-token"]) ||
-        (typeof req.headers["x-eliza-token"] === "string" &&
-            req.headers["x-eliza-token"]) ||
-        (typeof req.headers["x-api-key"] === "string" && req.headers["x-api-key"]);
-    if (typeof header === "string" && header.trim())
-        return header.trim();
-    return null;
-}
-// ---------------------------------------------------------------------------
-// Token / API auth helpers
-// ---------------------------------------------------------------------------
-export function tokenMatches(expected, provided) {
-    const a = Buffer.from(expected, "utf8");
-    const b = Buffer.from(provided, "utf8");
-    if (a.length !== b.length)
-        return false;
-    return crypto.timingSafeEqual(a, b);
-}
-export function getConfiguredApiToken() {
-    return resolveApiToken(process.env) ?? undefined;
-}
-function firstHeaderValue(value) {
-    if (typeof value === "string")
-        return value;
-    if (Array.isArray(value) && typeof value[0] === "string")
-        return value[0];
-    return null;
-}
-const CLIENT_IP_PROXY_HEADERS = new Set([
-    "forwarded",
-    "forwarded-for",
-    "x-forwarded",
-    "x-forwarded-for",
-    "x-original-forwarded-for",
-    "x-real-ip",
-    "x-client-ip",
-    "x-forwarded-client-ip",
-    "x-cluster-client-ip",
-    "cf-connecting-ip",
-    "true-client-ip",
-    "fastly-client-ip",
-    "x-appengine-user-ip",
-    "x-azure-clientip",
-]);
-function headerValues(value) {
-    if (typeof value === "string")
-        return [value];
-    if (Array.isArray(value)) {
-        return value.filter((item) => typeof item === "string");
-    }
-    return [];
-}
-function isClientIpProxyHeaderName(name) {
-    const normalized = name.toLowerCase();
-    return (CLIENT_IP_PROXY_HEADERS.has(normalized) ||
-        normalized.endsWith("-client-ip") ||
-        normalized.endsWith("-connecting-ip") ||
-        normalized.endsWith("-real-ip"));
-}
-function extractForwardedForCandidates(raw) {
-    const candidates = [];
-    const pattern = /(?:^|[;,])\s*for=(?:"([^"]*)"|([^;,]*))/gi;
-    for (const match of raw.matchAll(pattern)) {
-        candidates.push(match[1] ?? match[2] ?? "");
-    }
-    return candidates;
-}
-function extractProxyClientAddressCandidates(headerName, raw) {
-    if (headerName === "forwarded") {
-        return extractForwardedForCandidates(raw);
-    }
-    const forwardedCandidates = raw.toLowerCase().includes("for=")
-        ? extractForwardedForCandidates(raw)
-        : [];
-    if (forwardedCandidates.length > 0)
-        return forwardedCandidates;
-    return raw.split(",");
-}
-function stripMatchingQuotes(value) {
-    const trimmed = value.trim();
-    if ((trimmed.startsWith('"') && trimmed.endsWith('"')) ||
-        (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
-        return trimmed.slice(1, -1);
-    }
-    return trimmed;
-}
-function isNeutralProxyClientAddress(raw) {
-    const normalized = stripMatchingQuotes(raw).trim().toLowerCase();
-    return (!normalized ||
-        normalized === "unknown" ||
-        normalized === "null" ||
-        normalized.startsWith("_"));
-}
-function normalizeProxyClientIp(raw) {
-    let normalized = stripMatchingQuotes(raw).trim();
-    if (!normalized)
-        return null;
-    if (normalized.startsWith("[")) {
-        const close = normalized.indexOf("]");
-        if (close > 0) {
-            normalized = normalized.slice(1, close);
-        }
-    }
-    else {
-        const ipv4HostPort = /^(\d{1,3}(?:\.\d{1,3}){3})(?::\d+)$/.exec(normalized);
-        if (ipv4HostPort?.[1]) {
-            normalized = ipv4HostPort[1];
-        }
-    }
-    const zoneIndex = normalized.indexOf("%");
-    if (zoneIndex >= 0) {
-        normalized = normalized.slice(0, zoneIndex);
-    }
-    normalized = normalized.trim().toLowerCase();
-    return isIP(normalized) ? normalized : null;
-}
-function isLoopbackProxyClientIp(ip) {
-    const normalized = ip.trim().toLowerCase();
-    return (normalized === "::1" ||
-        normalized === "0:0:0:0:0:0:0:1" ||
-        normalized.startsWith("127.") ||
-        normalized.startsWith("::ffff:127.") ||
-        normalized.startsWith("::ffff:0:127."));
-}
-function proxyClientHeaderBlocksLocalTrust(headers) {
-    for (const [rawName, rawValue] of Object.entries(headers)) {
-        const headerName = rawName.toLowerCase();
-        if (!isClientIpProxyHeaderName(headerName))
-            continue;
-        for (const value of headerValues(rawValue)) {
-            for (const candidate of extractProxyClientAddressCandidates(headerName, value)) {
-                if (isNeutralProxyClientAddress(candidate))
-                    continue;
-                const ip = normalizeProxyClientIp(candidate);
-                if (!ip || !isLoopbackProxyClientIp(ip))
-                    return true;
-            }
-        }
-    }
-    return false;
-}
-function isLoopbackRemoteAddress(remoteAddress) {
-    if (!remoteAddress)
-        return false;
-    const normalized = remoteAddress.trim().toLowerCase();
-    return (normalized === "127.0.0.1" ||
-        normalized === "::1" ||
-        normalized === "0:0:0:0:0:0:0:1" ||
-        normalized === "::ffff:127.0.0.1" ||
-        normalized === "::ffff:0:127.0.0.1");
-}
-export function isLoopbackBindHost(host) {
-    let normalized = host.trim().toLowerCase();
-    if (!normalized)
-        return true;
-    // Allow users to provide full URLs by mistake (e.g. http://localhost:2138)
-    if (normalized.startsWith("http://") || normalized.startsWith("https://")) {
-        try {
-            const parsed = new URL(normalized);
-            normalized = parsed.hostname.toLowerCase();
-        }
-        catch {
-            // Fall through and parse as raw host value.
-        }
-    }
-    // [::1]:2138 -> ::1
-    const bracketedIpv6 = /^\[([^\]]+)\](?::\d+)?$/.exec(normalized);
-    if (bracketedIpv6?.[1]) {
-        normalized = bracketedIpv6[1];
-    }
-    else {
-        // localhost:2138 -> localhost, 127.0.0.1:2138 -> 127.0.0.1
-        const singleColonHostPort = /^([^:]+):(\d+)$/.exec(normalized);
-        if (singleColonHostPort?.[1]) {
-            normalized = singleColonHostPort[1];
-        }
-    }
-    normalized = normalized.replace(/^\[|\]$/g, "");
-    if (!normalized)
-        return true;
-    if (normalized === "localhost" ||
-        normalized === "::1" ||
-        normalized === "0:0:0:0:0:0:0:1" ||
-        normalized === "::ffff:127.0.0.1") {
-        return true;
-    }
-    if (normalized.startsWith("127."))
-        return true;
-    return false;
-}
-function isTrustedLocalOrigin(raw) {
-    const trimmed = raw.trim();
-    if (!trimmed || trimmed === "null")
-        return true;
-    try {
-        const parsed = new URL(trimmed);
-        if (parsed.protocol === "file:" ||
-            parsed.protocol === "app:" ||
-            parsed.protocol === "tauri:" ||
-            parsed.protocol === "capacitor:" ||
-            parsed.protocol === "capacitor-electron:" ||
-            parsed.protocol === "electrobun:") {
-            return true;
-        }
-        return isLoopbackBindHost(parsed.hostname);
-    }
-    catch {
-        return false;
-    }
-}
-export function isTrustedLocalRequest(req) {
-    if (isCloudProvisionedContainer())
-        return false;
-    if (!isLoopbackRemoteAddress(req.socket.remoteAddress))
-        return false;
-    if (proxyClientHeaderBlocksLocalTrust(req.headers))
-        return false;
-    const host = firstHeaderValue(req.headers.host);
-    if (host && !isLoopbackBindHost(host))
-        return false;
-    const secFetchSite = firstHeaderValue(req.headers["sec-fetch-site"])?.toLowerCase();
-    if (secFetchSite === "cross-site")
-        return false;
-    const origin = firstHeaderValue(req.headers.origin);
-    if (origin && !isTrustedLocalOrigin(origin))
-        return false;
-    const referer = firstHeaderValue(req.headers.referer);
-    if (!origin && referer && !isTrustedLocalOrigin(referer))
-        return false;
-    return true;
-}
-export function ensureApiTokenForBindHost(host) {
-    if (resolveApiSecurityConfig(process.env).disableAutoApiToken) {
-        return;
-    }
-    const token = getConfiguredApiToken();
-    if (token)
-        return;
-    const cloudProvisioned = isCloudProvisionedContainer();
-    if (!cloudProvisioned && isLoopbackBindHost(host))
-        return;
-    const generated = crypto.randomBytes(32).toString("hex");
-    setApiToken(process.env, generated);
-    if (cloudProvisioned) {
-        logger.warn("[eliza-api] Steward-managed cloud container started without ELIZA_API_TOKEN; generated a temporary inbound API token for this process.");
-    }
-    else {
-        logger.warn(`[eliza-api] ELIZA_API_BIND=${host} is non-loopback and ELIZA_API_TOKEN is unset.`);
-    }
-    const tokenFingerprint = `${generated.slice(0, 4)}...${generated.slice(-4)}`;
-    logger.warn(`[eliza-api] Generated temporary API token (${tokenFingerprint}) for this process. Set ELIZA_API_TOKEN explicitly to override.`);
-}
-export function isAuthorized(req) {
-    if (isTrustedLocalRequest(req))
-        return true;
-    const expected = getConfiguredApiToken();
-    if (!expected)
-        return false;
-    const provided = extractAuthToken(req);
-    if (!provided)
-        return false;
-    return tokenMatches(expected, provided);
-}
-export function resolvePluginConfigMutationRejections(pluginParams, config) {
-    const allowedParamKeys = new Set(pluginParams.map((p) => p.key.toUpperCase().trim()));
-    const rejections = [];
-    for (const key of Object.keys(config)) {
-        const normalized = key.toUpperCase().trim();
-        if (!allowedParamKeys.has(normalized)) {
-            rejections.push({
-                field: key,
-                message: `${key} is not a declared config key for this plugin`,
-            });
-            continue;
-        }
-        if (BLOCKED_ENV_KEYS.has(normalized)) {
-            rejections.push({
-                field: key,
-                message: `${key} is blocked for security reasons`,
-            });
-        }
-    }
-    return rejections;
-}
-export function resolveWalletExportRejection(req, body) {
-    if (!body.confirm) {
-        return {
-            status: 403,
-            reason: 'Export requires explicit confirmation. Send { "confirm": true } in the request body.',
-        };
-    }
-    const expected = process.env.ELIZA_WALLET_EXPORT_TOKEN?.trim();
-    if (!expected) {
-        return {
-            status: 403,
-            reason: "Wallet export is disabled. Set ELIZA_WALLET_EXPORT_TOKEN to enable secure exports.",
-        };
-    }
-    const headerToken = typeof req.headers["x-eliza-export-token"] === "string"
-        ? req.headers["x-eliza-export-token"].trim()
-        : "";
-    const bodyToken = typeof body.exportToken === "string" ? body.exportToken.trim() : "";
-    const provided = headerToken || bodyToken;
-    if (!provided) {
-        return {
-            status: 401,
-            reason: "Missing export token. Provide X-Eliza-Export-Token header or exportToken in request body.",
-        };
-    }
-    if (!tokenMatches(expected, provided)) {
-        return { status: 401, reason: "Invalid export token." };
-    }
-    return null;
-}
-export function resolveTerminalRunRejection(req, body) {
-    const expected = process.env.ELIZA_TERMINAL_RUN_TOKEN?.trim();
-    const apiTokenEnabled = Boolean(getConfiguredApiToken());
-    // Compatibility mode: local loopback sessions without API token keep
-    // existing behavior unless an explicit terminal token is configured.
-    if (!expected && !apiTokenEnabled) {
-        return null;
-    }
-    if (!expected) {
-        return {
-            status: 403,
-            reason: "Terminal run is disabled for token-authenticated API sessions. Set ELIZA_TERMINAL_RUN_TOKEN to enable command execution.",
-        };
-    }
-    const headerToken = typeof req.headers["x-eliza-terminal-token"] === "string"
-        ? req.headers["x-eliza-terminal-token"].trim()
-        : "";
-    const bodyToken = typeof body.terminalToken === "string" ? body.terminalToken.trim() : "";
-    const provided = headerToken || bodyToken;
-    if (!provided) {
-        return {
-            status: 401,
-            reason: "Missing terminal token. Provide X-Eliza-Terminal-Token header or terminalToken in request body.",
-        };
-    }
-    if (!tokenMatches(expected, provided)) {
-        return {
-            status: 401,
-            reason: "Invalid terminal token.",
-        };
-    }
-    return null;
-}
-// ---------------------------------------------------------------------------
-// WebSocket auth helpers
-// ---------------------------------------------------------------------------
-export function extractWsQueryToken(url) {
-    const allowQueryToken = process.env.ELIZA_ALLOW_WS_QUERY_TOKEN === "1";
-    if (!allowQueryToken)
-        return null;
-    const token = url.searchParams.get("token") ??
-        url.searchParams.get("apiKey") ??
-        url.searchParams.get("api_key");
-    return token?.trim() || null;
-}
-export function hasWsQueryToken(url) {
-    return (url.searchParams.has("token") ||
-        url.searchParams.has("apiKey") ||
-        url.searchParams.has("api_key"));
-}
-export function extractWebSocketHandshakeToken(request, url) {
-    const headerToken = extractAuthToken(request);
-    if (headerToken)
-        return headerToken;
-    return extractWsQueryToken(url);
-}
-export function isWebSocketAuthorized(request, url) {
-    const expected = getConfiguredApiToken();
-    if (!expected)
-        return !isCloudProvisionedContainer();
-    const handshakeToken = extractWebSocketHandshakeToken(request, url);
-    if (!handshakeToken)
-        return false;
-    return tokenMatches(expected, handshakeToken);
-}
-export function resolveWebSocketUpgradeRejection(req, wsUrl, resolveCorsOrigin = () => null) {
-    if (wsUrl.pathname !== "/ws") {
-        return { status: 404, reason: "Not found" };
-    }
-    const origin = typeof req.headers.origin === "string" ? req.headers.origin : undefined;
-    const allowedOrigin = resolveCorsOrigin(origin);
-    if (origin && !allowedOrigin) {
-        return { status: 403, reason: "Origin not allowed" };
-    }
-    const expected = getConfiguredApiToken();
-    if (!expected) {
-        return isCloudProvisionedContainer()
-            ? { status: 401, reason: "Unauthorized" }
-            : null;
-    }
-    // Note: we used to reject upgrades when a query token was present but
-    // ELIZA_ALLOW_WS_QUERY_TOKEN was not "1". That veto was actively harmful —
-    // browsers cannot set Authorization on `new WebSocket(url)`, so SPAs have no
-    // option but to pass the token in the URL. extractWsQueryToken() already
-    // returns null when the flag is off, so handshakeToken simply falls through
-    // to header-or-null and the post-open `{type:"auth"}` fallback covers
-    // self-hosted setups behind header-aware upstream proxies.
-    const handshakeToken = extractWebSocketHandshakeToken(req, wsUrl);
-    if (handshakeToken && !tokenMatches(expected, handshakeToken)) {
-        return { status: 401, reason: "Unauthorized" };
-    }
-    // Cloud containers must authenticate at the handshake level because there is
-    // no trusted upstream proxy handling auth for the WebSocket path.
-    if (!handshakeToken && isCloudProvisionedContainer()) {
-        return { status: 401, reason: "Unauthorized" };
-    }
-    return null;
-}
-// ---------------------------------------------------------------------------
-// State dir safety check
-// ---------------------------------------------------------------------------
-const RESET_STATE_ALLOWED_SEGMENTS = new Set(["eliza"]);
-function hasAllowedResetSegment(resolvedState) {
-    return resolvedState
-        .split(path.sep)
-        .some((segment) => RESET_STATE_ALLOWED_SEGMENTS.has(segment.trim().toLowerCase()));
-}
-export function isSafeResetStateDir(resolvedState, homeDir) {
-    const normalizedState = path.resolve(resolvedState);
-    const normalizedHome = path.resolve(homeDir);
-    const parsedRoot = path.parse(normalizedState).root;
-    if (normalizedState === parsedRoot)
-        return false;
-    if (normalizedState === normalizedHome)
-        return false;
-    const relativeToHome = path.relative(normalizedHome, normalizedState);
-    const isUnderHome = relativeToHome.length > 0 &&
-        !relativeToHome.startsWith("..") &&
-        !path.isAbsolute(relativeToHome);
-    if (!isUnderHome)
-        return false;
-    return hasAllowedResetSegment(normalizedState);
-}
-export async function persistConversationRoomTitle(runtime, conversation) {
-    if (!runtime)
-        return false;
-    const room = await runtime.getRoom(conversation.roomId);
-    if (!room)
-        return false;
-    if (room.name === conversation.title)
-        return false;
-    const adapter = runtime.adapter;
-    if (typeof adapter.updateRoom !== "function")
-        return false;
-    await adapter.updateRoom({ ...room, name: conversation.title });
-    return true;
-}
-// ---------------------------------------------------------------------------
-// WebSocket rejection & path decoding
-// ---------------------------------------------------------------------------
-export function rejectWebSocketUpgrade(socket, statusCode, message) {
-    const statusText = statusCode === 401
-        ? "Unauthorized"
-        : statusCode === 403
-            ? "Forbidden"
-            : statusCode === 404
-                ? "Not Found"
-                : "Bad Request";
-    const body = `${message}\n`;
-    socket.write(`HTTP/1.1 ${statusCode} ${statusText}\r\n` +
-        "Connection: close\r\n" +
-        "Content-Type: text/plain; charset=utf-8\r\n" +
-        `Content-Length: ${Buffer.byteLength(body)}\r\n` +
-        "\r\n" +
-        body, () => socket.end());
-}
-export function decodePathComponent(raw, res, fieldName) {
-    try {
-        return decodeURIComponent(raw);
-    }
-    catch {
-        sendJsonError(res, `Invalid ${fieldName}: malformed URL encoding`, 400);
-        return null;
-    }
-}

package/runtime/restart.d.ts

@@ -1,9 +0,0 @@
-/**
- * Restart infrastructure for Eliza — thin re-export of `@elizaos/shared/restart`.
- *
- * The single source of truth lives in `@elizaos/shared` (browser-safe inert
- * default). This module preserves the historical import path used inside the
- * agent package so existing imports keep working.
- */
-export { RESTART_EXIT_CODE, type RestartHandler, requestRestart, setRestartHandler, } from "@elizaos/shared";
-//# sourceMappingURL=restart.d.ts.map