@elizaos/agent 2.0.3-beta.2 → 2.0.3-beta.4

package/api/index.d.ts

@@ -1,43 +1,44 @@
 export { type AppManagerLike, type AppsRouteContext, type FavoriteAppsStore, handleAppsRoutes, } from "@elizaos/plugin-app-manager";
 export type { WalletAddressesSnapshot, WalletRouteContext, WalletRouteDependencies, WalletRpcReadinessSnapshot, } from "@elizaos/plugin-wallet";
 export declare const handleWalletRoutes: typeof import("@elizaos/plugin-wallet").handleWalletRoutes;
-export * from "./accounts-routes.ts";
-export * from "./agent-admin-routes.ts";
-export * from "./agent-lifecycle-routes.ts";
-export * from "./agent-model.ts";
-export * from "./agent-transfer-routes.ts";
-export * from "./auth-routes.ts";
-export * from "./bug-report-routes.ts";
-export * from "./character-routes.ts";
-export * from "./compat-utils.ts";
-export * from "./connector-health.ts";
-export * from "./credit-detection.ts";
-export * from "./database.ts";
-export * from "./diagnostics-routes.ts";
-export { type DispatchRouteArgs, dispatchRoute, } from "./dispatch-route.ts";
-export * from "./documents-service-loader.ts";
-export * from "./early-logs.ts";
-export * from "./memory-bounds.ts";
-export * from "./memory-routes.ts";
-export * from "./models-routes.ts";
-export * from "./parse-action-block.ts";
-export * from "./permission-request-prompt.ts";
-export * from "./permissions-routes.ts";
-export * from "./plugin-validation.ts";
-export * from "./provider-switch-config.ts";
-export * from "./rate-limiter.ts";
-export * from "./registry-routes.ts";
-export * from "./registry-service.ts";
-export { matchPluginRoutePath, tryHandleRuntimePluginRoute, } from "./runtime-plugin-routes.ts";
-export * from "./subscription-routes.ts";
-export * from "./terminal-run-limits.ts";
-export * from "./training-backend-check.ts";
-export * from "./training-service-like.ts";
-export * from "./tx-service.ts";
-export * from "./wallet.ts";
-export * from "./wallet-evm-balance.ts";
-export * from "./wallet-rpc.ts";
-export * from "./wallet-trading-profile.ts";
-export * from "./workbench-vfs-routes.ts";
-export * from "./zip-utils.ts";
+export * from "./accounts-routes.js";
+export * from "./agent-admin-routes.js";
+export * from "./agent-lifecycle-routes.js";
+export * from "./agent-model.js";
+export * from "./agent-transfer-routes.js";
+export * from "./approval-routes.js";
+export * from "./auth-routes.js";
+export * from "./bug-report-routes.js";
+export * from "./character-routes.js";
+export * from "./compat-utils.js";
+export * from "./connector-health.js";
+export * from "./credit-detection.js";
+export * from "./database.js";
+export * from "./diagnostics-routes.js";
+export { type DispatchRouteArgs, dispatchRoute, } from "./dispatch-route.js";
+export * from "./documents-service-loader.js";
+export * from "./early-logs.js";
+export * from "./memory-bounds.js";
+export * from "./memory-routes.js";
+export * from "./models-routes.js";
+export * from "./parse-action-block.js";
+export * from "./permission-request-prompt.js";
+export * from "./permissions-routes.js";
+export * from "./plugin-validation.js";
+export * from "./provider-switch-config.js";
+export * from "./rate-limiter.js";
+export * from "./registry-routes.js";
+export * from "./registry-service.js";
+export { matchPluginRoutePath, tryHandleRuntimePluginRoute, } from "./runtime-plugin-routes.js";
+export * from "./subscription-routes.js";
+export * from "./terminal-run-limits.js";
+export * from "./training-backend-check.js";
+export * from "./training-service-like.js";
+export * from "./tx-service.js";
+export * from "./wallet.js";
+export * from "./wallet-evm-balance.js";
+export * from "./wallet-rpc.js";
+export * from "./wallet-trading-profile.js";
+export * from "./workbench-vfs-routes.js";
+export * from "./zip-utils.js";
 //# sourceMappingURL=index.d.ts.map

package/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAMrC,YAAY,EACV,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,eAAO,MAAM,kBAAkB,EAAE,cAAc,wBAAwB,EAAE,kBAItE,CAAC;AACJ,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,yBAAyB,CAAC;AACxC,OAAO,EACL,KAAK,iBAAiB,EACtB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AAKtC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAMrC,YAAY,EACV,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,eAAO,MAAM,kBAAkB,EAAE,cAAc,wBAAwB,EAAE,kBAItE,CAAC;AACJ,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,yBAAyB,CAAC;AACxC,OAAO,EACL,KAAK,iBAAiB,EACtB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AAKtC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gBAAgB,CAAC"}

package/api/index.js

@@ -12,6 +12,7 @@ export * from "./agent-admin-routes.js";
 export * from "./agent-lifecycle-routes.js";
 export * from "./agent-model.js";
 export * from "./agent-transfer-routes.js";
+export * from "./approval-routes.js";
 export * from "./auth-routes.js";
 export * from "./bug-report-routes.js";
 export * from "./character-routes.js";

package/api/interactions-routes.d.ts

@@ -0,0 +1,33 @@
+/**
+ * POST /api/interactions/shortcut — report a user-fired UI/keyboard shortcut so
+ * the agent observes it as a first-class interaction (#8792).
+ *
+ * The view-switch half of this contract lives in `views-routes.ts`
+ * (`POST /api/views/:id/navigate` → `VIEW_SWITCHED`). This is the keyboard /
+ * command-palette half: the client reports a stable `shortcutId` and the route
+ * emits `EventType.SHORTCUT_FIRED`, which the proactive-interaction decider
+ * consumes (governed by debounce / cooldown / daily-cap / model-judge-silent).
+ *
+ * Emission is fire-and-forget: a dropped event must never break the shortcut the
+ * user actually pressed. This route is auth+proxy thin — it records nothing and
+ * computes nothing beyond input validation.
+ */
+import type http from "node:http";
+import { type AgentRuntime } from "@elizaos/core";
+export interface InteractionsRouteContext {
+    req: http.IncomingMessage;
+    res: http.ServerResponse;
+    method: string;
+    pathname: string;
+    json: (res: http.ServerResponse, data: unknown, status?: number) => void;
+    error: (res: http.ServerResponse, message: string, status?: number) => void;
+    runtime: AgentRuntime | null | undefined;
+}
+export interface ShortcutInteractionRequest {
+    shortcutId: string;
+    context?: string;
+}
+/** Parse + validate the shortcut report body; null on anything malformed. */
+export declare function parseShortcutBody(raw: string): ShortcutInteractionRequest | null;
+export declare function handleInteractionsRoutes(ctx: InteractionsRouteContext): Promise<boolean>;
+//# sourceMappingURL=interactions-routes.d.ts.map

package/api/interactions-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactions-routes.d.ts","sourceRoot":"","sources":["../../src/api/interactions-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,KAAK,YAAY,EAGlB,MAAM,eAAe,CAAC;AAQvB,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC;IAC1B,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzE,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5E,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,GACV,0BAA0B,GAAG,IAAI,CAoBnC;AAED,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,wBAAwB,GAC5B,OAAO,CAAC,OAAO,CAAC,CAuClB"}

package/api/interactions-routes.js

@@ -0,0 +1,63 @@
+import { EventType, readRequestBodyBuffer, } from "@elizaos/core";
+const MAX_BODY_BYTES = 4 * 1024;
+/** Stable shortcut id: kebab-case, bounded length (e.g. "open-command-palette"). */
+const SHORTCUT_ID_PATTERN = /^[a-z][a-z0-9-]{1,48}$/;
+const MAX_CONTEXT_CHARS = 120;
+/** Parse + validate the shortcut report body; null on anything malformed. */
+export function parseShortcutBody(raw) {
+    if (!raw.trim())
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return null;
+    }
+    const body = parsed;
+    const shortcutId = typeof body.shortcutId === "string" ? body.shortcutId.trim() : "";
+    if (!SHORTCUT_ID_PATTERN.test(shortcutId))
+        return null;
+    const context = typeof body.context === "string" && body.context.trim()
+        ? body.context.trim().slice(0, MAX_CONTEXT_CHARS)
+        : undefined;
+    return { shortcutId, ...(context ? { context } : {}) };
+}
+export async function handleInteractionsRoutes(ctx) {
+    const { req, res, method, pathname, json, error, runtime } = ctx;
+    if (pathname !== "/api/interactions/shortcut")
+        return false;
+    if (method !== "POST") {
+        error(res, "Method not allowed", 405);
+        return true;
+    }
+    const buffer = await readRequestBodyBuffer(req, {
+        maxBytes: MAX_BODY_BYTES,
+        returnNullOnTooLarge: true,
+    });
+    const request = parseShortcutBody(buffer?.toString("utf8") ?? "");
+    if (!request) {
+        error(res, "Invalid shortcut interaction body", 400);
+        return true;
+    }
+    // Emit the first-class SHORTCUT_FIRED interaction event (#8792). Fire-and-forget
+    // so the proactive decider can react without ever blocking the response.
+    if (runtime) {
+        void runtime
+            .emitEvent(EventType.SHORTCUT_FIRED, {
+            runtime,
+            source: "shortcut-interaction",
+            shortcutId: request.shortcutId,
+            ...(request.context ? { context: request.context } : {}),
+            initiatedBy: "user",
+        })
+            .catch((err) => {
+            runtime.logger?.debug?.({ src: "InteractionsRoutes", err }, "[InteractionsRoutes] SHORTCUT_FIRED emit failed");
+        });
+    }
+    json(res, { ok: true, shortcutId: request.shortcutId });
+    return true;
+}

package/api/media-runtime.d.ts

@@ -7,7 +7,7 @@
  * The pure store lives in `./media-store.ts`; this module only connects it to
  * the runtime (routes / pipeline hooks / tasks).
  */
-import type { IAgentRuntime, Route } from "@elizaos/core";
+import type { IAgentRuntime, Memory, Route } from "@elizaos/core";
 /**
  * Public GET route for stored media. On HTTP platforms (browser, desktop,
  * Android) the pre-auth `serveMediaFile` handler answers first and this route
@@ -26,6 +26,7 @@ export declare const mediaFileRoute: Route;
  * to both the wire response and the saved memory.
  */
 export declare function registerMediaPipelineHook(runtime: IAgentRuntime): void;
+export declare function collectReferencedMedia(memories: Memory[]): Set<string>;
 /**
  * Register the orphan-media GC: a daily task that diffs every live message
  * attachment URL against the store and deletes files no message references

package/api/media-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media-runtime.d.ts","sourceRoot":"","sources":["../../src/api/media-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAU,KAAK,EAAE,MAAM,eAAe,CAAC;AAYlE;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,KAmB5B,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAyBtE;AAsBD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CA2ChE"}
+{"version":3,"file":"media-runtime.d.ts","sourceRoot":"","sources":["../../src/api/media-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAkDlE;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,KAmB5B,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAyCtE;AAMD,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAyBtE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CA2ChE"}

package/api/media-runtime.js

@@ -7,7 +7,38 @@
  * The pure store lives in `./media-store.ts`; this module only connects it to
  * the runtime (routes / pipeline hooks / tasks).
  */
-import { ensureThumbnailForStoredFile, gcUnreferencedMedia, handleMediaRouteRequest, isStoredMediaUrl, mediaFileNameFromUrl, persistAttachmentUrlIfInline, } from "./media-store.js";
+import { fetchRemoteMedia, logger } from "@elizaos/core";
+import { ensureThumbnailForStoredFile, gcUnreferencedMedia, handleMediaRouteRequest, isStoredMediaUrl, mediaFileNameFromUrl, persistAttachmentUrlIfInline, persistMediaBytes, } from "./media-store.js";
+/** Cap on bytes pulled while rehosting a remote attachment into the store. */
+const REHOST_MAX_BYTES = 50 * 1024 * 1024;
+/** Media content types worth rehosting (skip `link` and unknown). */
+const REHOSTABLE_CONTENT_TYPES = new Set([
+    "image",
+    "video",
+    "audio",
+    "document",
+]);
+/**
+ * Rehost a remote (http/https) media URL into the content-addressed store via
+ * the SSRF-guarded fetcher (blocks private/loopback) with a hard size cap, so an
+ * agent-generated/provider URL that may expire becomes a durable, same-origin
+ * `/api/media/<hash>` URL. Returns the served URL, or null on any failure
+ * (blocked host, too large, unreachable) so the caller can keep the original.
+ */
+async function rehostRemoteMediaUrl(url) {
+    try {
+        const { buffer, contentType } = await fetchRemoteMedia({
+            url,
+            maxBytes: REHOST_MAX_BYTES,
+        });
+        return persistMediaBytes(buffer, contentType ?? "application/octet-stream")
+            .url;
+    }
+    catch (err) {
+        logger.warn(`[media-persist] failed to rehost ${url}: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}
 const MEDIA_URL_PREFIX = "/api/media/";
 /**
  * Public GET route for stored media. On HTTP platforms (browser, desktop,
@@ -58,6 +89,22 @@ export function registerMediaPipelineHook(runtime) {
                 if (attachment.url.startsWith("data:")) {
                     attachment.url = persistAttachmentUrlIfInline(attachment.url);
                 }
+                else if (/^https?:\/\//i.test(attachment.url) &&
+                    !isStoredMediaUrl(attachment.url) &&
+                    typeof attachment.contentType === "string" &&
+                    REHOSTABLE_CONTENT_TYPES.has(attachment.contentType)) {
+                    // Rehost remote agent-generated/outgoing media into the durable store
+                    // so a provider URL that may expire doesn't leave a broken tile in
+                    // history. SSRF-guarded + size-capped; on failure keep the original
+                    // URL and mark it ephemeral so the UI can offer a retry.
+                    const rehosted = await rehostRemoteMediaUrl(attachment.url);
+                    if (rehosted) {
+                        attachment.url = rehosted;
+                    }
+                    else {
+                        attachment.ephemeral = true;
+                    }
+                }
                 // Pre-compute a thumbnail for stored images lacking one (generated
                 // media). `ensureThumbnailForStoredFile` self-gates on image mime/size.
                 if (!attachment.thumbnailUrl && isStoredMediaUrl(attachment.url)) {
@@ -75,15 +122,25 @@ export function registerMediaPipelineHook(runtime) {
 const MEDIA_GC_TASK_NAME = "MEDIA_GC";
 const MEDIA_GC_TAGS = ["queue", "repeat", "media-gc"];
 const MEDIA_GC_INTERVAL_MS = 24 * 60 * 60 * 1000; // daily
-function collectReferencedMedia(memories) {
+export function collectReferencedMedia(memories) {
     const referenced = new Set();
     for (const memory of memories) {
         const attachments = memory.content?.attachments;
-        if (!Array.isArray(attachments))
-            continue;
-        for (const attachment of attachments) {
-            const url = typeof attachment?.url === "string" ? attachment.url : "";
-            const name = mediaFileNameFromUrl(url);
+        if (Array.isArray(attachments)) {
+            for (const attachment of attachments) {
+                const url = typeof attachment?.url === "string" ? attachment.url : "";
+                const name = mediaFileNameFromUrl(url);
+                if (name)
+                    referenced.add(name);
+            }
+        }
+        // Document-linked original-bytes files: a knowledge document references its
+        // stored original via `metadata.mediaUrl` (no content.attachments entry).
+        // Collect it so the file survives GC while the document still references it.
+        const mediaUrl = memory.metadata
+            ?.mediaUrl;
+        if (typeof mediaUrl === "string") {
+            const name = mediaFileNameFromUrl(mediaUrl);
             if (name)
                 referenced.add(name);
         }

package/api/media-store.d.ts

@@ -14,6 +14,22 @@
  * content-addressed pattern from the dedicated media directory.
  */
 import type http from "node:http";
+/**
+ * MIME types that are safe to render inline in a browser context. Everything
+ * else — notably `image/svg+xml`, `text/html`, and unknown/active types — is
+ * served with `Content-Disposition: attachment` so it can never execute script
+ * on the dashboard origin (stored-XSS defence). SVG is deliberately excluded:
+ * it is an XML document that can carry `<script>` and event handlers.
+ */
+export declare function isInlineSafeMime(mime: string): boolean;
+/**
+ * Sniff the leading bytes for active XML/HTML markup. Returns the TRUE dangerous
+ * mime when the content is SVG or HTML, else null. Used to reconcile a declared
+ * "safe image" mime against bytes that are really markup, so the store records
+ * (and later serves) the truthful, attachment-served type — defence in depth on
+ * top of the strict extension map and the nosniff header.
+ */
+export declare function sniffMarkupMime(buffer: Buffer): string | null;
 export interface MediaFileStat {
     name: string;
     size: number;
@@ -50,6 +66,26 @@ export declare function gcUnreferencedMedia(referenced: Set<string>): {
     removed: number;
     scanned: number;
 };
+export interface MediaFileInfo {
+    fileName: string;
+    url: string;
+    hash: string;
+    mimeType: string;
+    size: number;
+    createdAt: number;
+}
+/**
+ * List every stored media file with derived metadata (size, mime, mtime) for
+ * the Files surface. Read-only directory scan; never throws (returns [] on
+ * failure). Metadata is derived (no separate index), matching the
+ * content-addressed model — original filenames aren't retained here.
+ */
+export declare function listMediaFiles(): MediaFileInfo[];
+/**
+ * Delete a stored media file by its strict content-addressed name. Returns true
+ * when removed. Validates the name + dir to defend against traversal.
+ */
+export declare function deleteMediaFile(fileName: string): boolean;
 /**
  * Serve a media file for the IN-PROCESS route path (iOS, where no HTTP server
  * runs and requests are dispatched over `runtime.routes`). Returns a

package/api/media-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media-store.d.ts","sourceRoot":"","sources":["../../src/api/media-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAoGlC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,aAAa,EAAE,EACtB,GAAG,EAAE,MAAM,GACV,MAAM,EAAE,CAYV;AAiDD,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yFAAyF;AACzF,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,cAAc,CAShB;AAID,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAgBrE;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,yFAAyF;AACzF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI/D;AAMD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAgCA;AA4DD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CA0BpE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAiET;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB;AAED;;;;GAIG;AACH,wBAAsB,4BAA4B,CAChD,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB;AAED,kFAAkF;AAClF,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAahE"}
+{"version":3,"file":"media-store.d.ts","sourceRoot":"","sources":["../../src/api/media-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAsElC;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAStD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiC7D;AAsDD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,aAAa,EAAE,EACtB,GAAG,EAAE,MAAM,GACV,MAAM,EAAE,CAYV;AAiDD,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yFAAyF;AACzF,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,cAAc,CAuBhB;AAID,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAgBrE;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,yFAAyF;AACzF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI/D;AAMD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAgCA;AAOD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,aAAa,EAAE,CA6BhD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAWzD;AAwDD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CA2BpE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAkET;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB;AAED;;;;GAIG;AACH,wBAAsB,4BAA4B,CAChD,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB;AAED,kFAAkF;AAClF,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAahE"}

package/api/media-store.js

@@ -79,6 +79,76 @@ const MIME_BY_EXT = {
 /** Strict content-addressed name: 64-hex sha256 + short alphanumeric extension. */
 const MEDIA_FILE_NAME = /^[a-f0-9]{64}\.[a-z0-9]{1,8}$/;
 const MEDIA_URL_PREFIX = "/api/media/";
+/**
+ * MIME types that are safe to render inline in a browser context. Everything
+ * else — notably `image/svg+xml`, `text/html`, and unknown/active types — is
+ * served with `Content-Disposition: attachment` so it can never execute script
+ * on the dashboard origin (stored-XSS defence). SVG is deliberately excluded:
+ * it is an XML document that can carry `<script>` and event handlers.
+ */
+export function isInlineSafeMime(mime) {
+    const m = (mime.split(";")[0] ?? "").trim().toLowerCase();
+    if (m === "image/svg+xml")
+        return false;
+    return ((m.startsWith("image/") && m !== "image/svg+xml") ||
+        m.startsWith("audio/") ||
+        m.startsWith("video/") ||
+        m === "application/pdf");
+}
+/**
+ * Sniff the leading bytes for active XML/HTML markup. Returns the TRUE dangerous
+ * mime when the content is SVG or HTML, else null. Used to reconcile a declared
+ * "safe image" mime against bytes that are really markup, so the store records
+ * (and later serves) the truthful, attachment-served type — defence in depth on
+ * top of the strict extension map and the nosniff header.
+ */
+export function sniffMarkupMime(buffer) {
+    // Skip a leading UTF-8 BOM / whitespace before peeking at the first token.
+    let i = 0;
+    if (buffer.length >= 3 &&
+        buffer[0] === 0xef &&
+        buffer[1] === 0xbb &&
+        buffer[2] === 0xbf) {
+        i = 3;
+    }
+    while (i < buffer.length && i < 64) {
+        const c = buffer[i];
+        if (c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d) {
+            i += 1;
+            continue;
+        }
+        break;
+    }
+    const head = buffer
+        .subarray(i, Math.min(buffer.length, i + 512))
+        .toString("utf8")
+        .toLowerCase();
+    if (head.startsWith("<svg") ||
+        (head.startsWith("<?xml") && head.includes("<svg"))) {
+        return "image/svg+xml";
+    }
+    if (head.startsWith("<!doctype html") || head.startsWith("<html")) {
+        return "text/html";
+    }
+    return null;
+}
+/**
+ * Build the security headers for a served media response. Always sets
+ * `X-Content-Type-Options: nosniff` (so a mislabelled image is never sniffed to
+ * HTML) and a fully-sandboxed CSP (applies when the URL is navigated to as a
+ * document). Inline-safe types render inline; everything else (SVG, HTML,
+ * unknown/active) is forced to download so it cannot execute on this origin.
+ */
+function mediaSecurityHeaders(fileName, contentType) {
+    const disposition = isInlineSafeMime(contentType)
+        ? "inline"
+        : `attachment; filename="${fileName}"`;
+    return {
+        "X-Content-Type-Options": "nosniff",
+        "Content-Disposition": disposition,
+        "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox",
+    };
+}
 let cachedMediaDir = null;
 function mediaDir() {
     if (cachedMediaDir)
@@ -173,8 +243,20 @@ function maybeEvict() {
 }
 /** Write bytes to the content-addressed store (idempotent) and return the served URL. */
 export function persistMediaBytes(buffer, mimeType) {
+    // Reconcile a declared "safe image" mime against bytes that are really active
+    // markup (SVG/HTML), so the store records the truthful type and the serve path
+    // forces an attachment download instead of inline rendering. Truthful active
+    // types declared up front are left as-is (still served as attachments).
+    let effectiveMime = mimeType;
+    if (isInlineSafeMime(mimeType)) {
+        const sniffed = sniffMarkupMime(buffer);
+        if (sniffed) {
+            logger.warn(`[media-store] declared ${mimeType} but content sniffed as ${sniffed}; storing as ${sniffed} (served as download)`);
+            effectiveMime = sniffed;
+        }
+    }
     const hash = crypto.createHash("sha256").update(buffer).digest("hex");
-    const fileName = `${hash}.${extForMime(mimeType)}`;
+    const fileName = `${hash}.${extForMime(effectiveMime)}`;
     const filePath = path.join(mediaDir(), fileName);
     if (!fs.existsSync(filePath)) {
         fs.writeFileSync(filePath, buffer);
@@ -260,6 +342,61 @@ function mimeForFile(fileName) {
     const ext = fileName.split(".").pop()?.toLowerCase() ?? "bin";
     return MIME_BY_EXT[ext] ?? "application/octet-stream";
 }
+/**
+ * List every stored media file with derived metadata (size, mime, mtime) for
+ * the Files surface. Read-only directory scan; never throws (returns [] on
+ * failure). Metadata is derived (no separate index), matching the
+ * content-addressed model — original filenames aren't retained here.
+ */
+export function listMediaFiles() {
+    const out = [];
+    try {
+        const dir = mediaDir();
+        for (const name of fs.readdirSync(dir)) {
+            if (!MEDIA_FILE_NAME.test(name))
+                continue;
+            try {
+                const stat = fs.statSync(path.join(dir, name));
+                if (!stat.isFile())
+                    continue;
+                out.push({
+                    fileName: name,
+                    url: `${MEDIA_URL_PREFIX}${name}`,
+                    hash: name.split(".")[0] ?? name,
+                    mimeType: mimeForFile(name),
+                    size: stat.size,
+                    createdAt: stat.mtimeMs,
+                });
+            }
+            catch {
+                // file vanished mid-scan — skip
+            }
+        }
+    }
+    catch (err) {
+        logger.warn(`[media-store] list failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return out;
+}
+/**
+ * Delete a stored media file by its strict content-addressed name. Returns true
+ * when removed. Validates the name + dir to defend against traversal.
+ */
+export function deleteMediaFile(fileName) {
+    if (!MEDIA_FILE_NAME.test(fileName))
+        return false;
+    try {
+        const dir = mediaDir();
+        const filePath = path.join(dir, fileName);
+        if (path.dirname(filePath) !== dir)
+            return false;
+        fs.unlinkSync(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 // Touch-on-serve → LRU: bump the file's mtime when it's served so eviction
 // (oldest-mtime-first) keeps frequently-viewed media and drops the truly cold
 // files. Throttled per file so a burst of range requests doesn't thrash the fs.
@@ -307,7 +444,7 @@ function resolveMediaFile(pathname) {
         return { error: 404 };
     }
     touchOnServe(filePath);
-    return { filePath, size: stat.size, contentType: mimeForFile(name) };
+    return { filePath, size: stat.size, contentType: mimeForFile(name), name };
 }
 /**
  * Serve a media file for the IN-PROCESS route path (iOS, where no HTTP server
@@ -337,6 +474,7 @@ export function handleMediaRouteRequest(pathname, method) {
         "Content-Type": resolved.contentType,
         "Cache-Control": "public, max-age=31536000, immutable",
         "Content-Length": String(resolved.size),
+        ...mediaSecurityHeaders(resolved.name, resolved.contentType),
     };
     if (method === "HEAD")
         return { status: 200, headers };
@@ -367,6 +505,7 @@ export function serveMediaFile(req, res, pathname) {
         "Content-Type": contentType,
         "Cache-Control": "public, max-age=31536000, immutable",
         "Accept-Ranges": "bytes",
+        ...mediaSecurityHeaders(resolved.name, contentType),
     };
     const range = req.headers.range;
     if (range && method === "GET") {

package/api/memory-bounds.d.ts

@@ -1,6 +1,5 @@
 /**
  * Pure helper functions for bounded in-memory data structures.
- * Extracted from server.ts so they can be unit-tested in isolation.
  *
  * @module
  */

package/api/memory-bounds.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory-bounds.d.ts","sourceRoot":"","sources":["../../src/api/memory-bounds.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,UAAU,cAAc;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EAChC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,GAChB,IAAI,CAKN;AAID,UAAU,gBAAgB;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,gBAAgB,EAChE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EACnB,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,IAAI,CAcf;AAID;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,MAAM,EAAE,CAAC,EAAE,EACX,KAAK,EAAE,CAAC,EACR,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,MAAM,CAMR;AAID,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAC9B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,EAC/B,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACpB,MAAM,CAaR"}
+{"version":3,"file":"memory-bounds.d.ts","sourceRoot":"","sources":["../../src/api/memory-bounds.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,UAAU,cAAc;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EAChC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,GAChB,IAAI,CAKN;AAID,UAAU,gBAAgB;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,gBAAgB,EAChE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EACnB,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,IAAI,CAcf;AAID;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,MAAM,EAAE,CAAC,EAAE,EACX,KAAK,EAAE,CAAC,EACR,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,MAAM,CAMR;AAID,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAC9B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,EAC/B,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACpB,MAAM,CAaR"}

package/api/memory-bounds.js

@@ -1,6 +1,5 @@
 /**
  * Pure helper functions for bounded in-memory data structures.
- * Extracted from server.ts so they can be unit-tested in isolation.
  *
  * @module
  */

package/api/misc-routes.d.ts

@@ -1,7 +1,7 @@
 import type http from "node:http";
 import { type AgentRuntime } from "@elizaos/core";
 import type { ReadJsonBodyOptions } from "@elizaos/shared";
-import type { ElizaConfig } from "../config/config.ts";
+import type { ElizaConfig } from "../config/config.js";
 interface StreamEventEnvelope {
     type: string;
     version: number;

package/api/model-provider-helpers.d.ts

@@ -1,8 +1,8 @@
 /**
  * Model and provider discovery helpers.
  *
- * Extracted from server.ts. Handles model listing, provider caching,
- * and inventory (chain/RPC) option resolution.
+ * Handles model listing, provider caching, and inventory (chain/RPC)
+ * option resolution.
  */
 type ModelOption = {
     id: string;

package/api/model-provider-helpers.js

@@ -1,8 +1,8 @@
 /**
  * Model and provider discovery helpers.
  *
- * Extracted from server.ts. Handles model listing, provider caching,
- * and inventory (chain/RPC) option resolution.
+ * Handles model listing, provider caching, and inventory (chain/RPC)
+ * option resolution.
  */
 import fs from "node:fs";
 import path from "node:path";

package/api/permissions-routes-extra.d.ts

@@ -1,6 +1,6 @@
 import type http from "node:http";
 import type { AgentAutomationMode, ReadJsonBodyOptions } from "@elizaos/shared";
-import type { ElizaConfig } from "../config/config.ts";
+import type { ElizaConfig } from "../config/config.js";
 export interface PermissionsExtraRouteContext {
     req: http.IncomingMessage;
     res: http.ServerResponse;

package/api/permissions-routes.d.ts

@@ -1,6 +1,6 @@
 import type { AgentRuntime, RouteRequestContext } from "@elizaos/core";
 import type { PermissionState } from "@elizaos/shared";
-import type { AutonomousConfigLike } from "../types/config-like.ts";
+import type { AutonomousConfigLike } from "../types/config-like.js";
 interface PermissionAutonomousConfigLike extends AutonomousConfigLike {
     features?: {
         shellEnabled?: boolean;