@elizaos/app-core 2.0.0-alpha.85 → 2.0.0-beta.2

package/api/server-onboarding-compat.js

@@ -0,0 +1,283 @@
+/**
+ * Onboarding compat helpers — API key persistence, onboarding defaults,
+ * cloud-mode detection, and cloud-provisioned container detection.
+ */
+import { applyOnboardingCredentialPersistence, loadElizaConfig, saveElizaConfig, } from "@elizaos/agent";
+import { logger, stringToUuid } from "@elizaos/core";
+import { deriveOnboardingCredentialPersistencePlan, getDefaultStylePreset, getStylePresets, migrateLegacyRuntimeConfig, normalizeCharacterLanguage, normalizeDeploymentTargetConfig, normalizeLinkedAccountFlagsConfig, normalizeOnboardingCredentialInputs, normalizeServiceRoutingConfig, PREMADE_VOICES, } from "@elizaos/shared";
+import { resolveProviderCredential } from "./credential-resolver";
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+/** Resolve the API token using app-first priority. */
+function getCompatApiToken() {
+    const token = process.env.ELIZA_API_TOKEN?.trim();
+    return token ? token : null;
+}
+// ---------------------------------------------------------------------------
+// Onboarding API key persistence
+// ---------------------------------------------------------------------------
+function trimToUndefined(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+const DEFAULT_ELEVENLABS_TTS_MODEL = "eleven_flash_v2_5";
+const ELEVENLABS_VOICE_ID_BY_PRESET = new Map(PREMADE_VOICES.map((voice) => [voice.id, voice.voiceId]));
+function resolveCompatOnboardingStyle(body, language) {
+    const presets = getStylePresets(language);
+    const requestedPresetId = trimToUndefined(body.presetId);
+    if (requestedPresetId) {
+        const byId = presets.find((preset) => preset.id === requestedPresetId);
+        if (byId)
+            return byId;
+    }
+    if (typeof body.avatarIndex === "number" &&
+        Number.isFinite(body.avatarIndex)) {
+        const byAvatar = presets.find((preset) => preset.avatarIndex === Number(body.avatarIndex));
+        if (byAvatar)
+            return byAvatar;
+    }
+    const requestedName = trimToUndefined(body.name);
+    if (requestedName) {
+        const byName = presets.find((preset) => preset.name === requestedName);
+        if (byName)
+            return byName;
+    }
+    return getDefaultStylePreset(language);
+}
+const LEGACY_ONBOARDING_REQUEST_KEYS = [
+    "connection",
+    "runMode",
+    "cloudProvider",
+    "provider",
+    "providerApiKey",
+    "primaryModel",
+    "smallModel",
+    "largeModel",
+];
+export function hasLegacyOnboardingRequestFields(body) {
+    return LEGACY_ONBOARDING_REQUEST_KEYS.some((key) => Object.hasOwn(body, key));
+}
+/**
+ * Extract canonical onboarding credential inputs from an onboarding request body
+ * and persist them to config + process.env. Returns the env key name if a local
+ * provider API key was persisted, or null.
+ */
+export async function extractAndPersistOnboardingApiKey(body) {
+    const credentialInputs = normalizeOnboardingCredentialInputs(body.credentialInputs);
+    const explicitDeploymentTarget = normalizeDeploymentTargetConfig(body.deploymentTarget);
+    const explicitServiceRouting = normalizeServiceRoutingConfig(body.serviceRouting);
+    logger.info(`[onboarding] extractAndPersistOnboardingApiKey: credentialInputs=${credentialInputs ? "present" : "missing"}, keys=${Object.keys(body).join(",")}`);
+    const initialPlan = deriveOnboardingCredentialPersistencePlan({
+        credentialInputs,
+        deploymentTarget: explicitDeploymentTarget,
+        serviceRouting: explicitServiceRouting,
+    });
+    let effectiveCredentialInputs = credentialInputs;
+    let effectiveServiceRouting = explicitServiceRouting;
+    let llmSelection = initialPlan.llmSelection;
+    if (!llmSelection && !initialPlan.cloudApiKey) {
+        logger.warn("[onboarding] No onboarding credentials resolved from request body");
+        return null;
+    }
+    logger.info(`[onboarding] Resolved selection: transport=${llmSelection?.transport ?? "none"}, provider=${llmSelection?.backend ?? "N/A"}, hasKey=${Boolean(llmSelection?.apiKey)}, hasCloudKey=${Boolean(initialPlan.cloudApiKey)}`);
+    // If the key is masked (from IPC) or missing, try to resolve the real
+    // key from local credential stores (files, keychain, env).
+    if (llmSelection?.transport === "direct" &&
+        llmSelection.backend !== "elizacloud" &&
+        !llmSelection.apiKey?.startsWith("****")) {
+        const resolved = resolveProviderCredential(llmSelection.backend);
+        if (resolved && resolved.authType === "subscription") {
+            effectiveCredentialInputs = {
+                ...(effectiveCredentialInputs ?? {}),
+                llmApiKey: resolved.apiKey,
+            };
+            effectiveServiceRouting = normalizeServiceRoutingConfig({
+                ...(effectiveServiceRouting ?? {}),
+                llmText: {
+                    ...(effectiveServiceRouting?.llmText ?? {}),
+                    backend: resolved.providerId,
+                    transport: "direct",
+                },
+            });
+            logger.info(`[onboarding] Using subscription auth for ${resolved.providerId}`);
+        }
+        else if (resolved) {
+            effectiveCredentialInputs = {
+                ...(effectiveCredentialInputs ?? {}),
+                llmApiKey: resolved.apiKey,
+            };
+            logger.info(`[onboarding] Resolved real key for ${llmSelection.backend} via credential-resolver`);
+        }
+        else if (!llmSelection.apiKey) {
+            logger.warn(`[onboarding] No key found for ${llmSelection.backend} — cannot persist`);
+            return null;
+        }
+        llmSelection = deriveOnboardingCredentialPersistencePlan({
+            credentialInputs: effectiveCredentialInputs,
+            deploymentTarget: explicitDeploymentTarget,
+            serviceRouting: effectiveServiceRouting,
+        }).llmSelection;
+    }
+    const config = loadElizaConfig();
+    const result = await applyOnboardingCredentialPersistence(config, {
+        credentialInputs: effectiveCredentialInputs,
+        deploymentTarget: explicitDeploymentTarget,
+        serviceRouting: effectiveServiceRouting,
+    });
+    saveElizaConfig(config);
+    if (result) {
+        logger.info(`[onboarding] Persisted ${result} from onboarding credentials`);
+    }
+    return result;
+}
+export function persistCompatOnboardingDefaults(body) {
+    const name = typeof body.name === "string" ? body.name.trim() : "";
+    if (!name) {
+        return null;
+    }
+    const config = loadElizaConfig();
+    const language = normalizeCharacterLanguage(body.language);
+    const stylePreset = resolveCompatOnboardingStyle(body, language);
+    if (!config.agents || typeof config.agents !== "object") {
+        config.agents = {};
+    }
+    const agents = config.agents;
+    if (!agents.defaults || typeof agents.defaults !== "object") {
+        agents.defaults = {};
+    }
+    const adminEntityId = stringToUuid(`${name}-admin-entity`);
+    agents.defaults.adminEntityId = adminEntityId;
+    if (!Array.isArray(agents.list) || agents.list.length === 0) {
+        agents.list = [{ id: "main", default: true }];
+    }
+    const agentEntry = agents.list[0];
+    agentEntry.name = name;
+    if (Array.isArray(body.bio)) {
+        agentEntry.bio = body.bio;
+    }
+    if (typeof body.systemPrompt === "string" && body.systemPrompt.trim()) {
+        agentEntry.system = body.systemPrompt.trim();
+    }
+    if (body.style && typeof body.style === "object") {
+        agentEntry.style = body.style;
+    }
+    if (Array.isArray(body.adjectives)) {
+        agentEntry.adjectives = body.adjectives;
+    }
+    if (Array.isArray(body.topics)) {
+        agentEntry.topics = body.topics;
+    }
+    if (Array.isArray(body.postExamples)) {
+        agentEntry.postExamples = body.postExamples;
+    }
+    if (Array.isArray(body.messageExamples)) {
+        agentEntry.messageExamples = body.messageExamples;
+    }
+    if (!config.ui || typeof config.ui !== "object") {
+        config.ui = {};
+    }
+    const ui = config.ui;
+    ui.assistant = {
+        ...(ui.assistant && typeof ui.assistant === "object"
+            ? ui.assistant
+            : {}),
+        name,
+    };
+    ui.language = language;
+    if (typeof body.avatarIndex === "number" &&
+        Number.isFinite(body.avatarIndex)) {
+        ui.avatarIndex = Number(body.avatarIndex);
+    }
+    else if (typeof stylePreset?.avatarIndex === "number") {
+        ui.avatarIndex = stylePreset.avatarIndex;
+    }
+    if (trimToUndefined(body.presetId)) {
+        ui.presetId = trimToUndefined(body.presetId);
+    }
+    else if (stylePreset?.id) {
+        ui.presetId = stylePreset.id;
+    }
+    const elevenLabsApiKey = process.env.ELEVENLABS_API_KEY?.trim();
+    const voicePresetId = stylePreset?.voicePresetId?.trim();
+    const voiceId = voicePresetId
+        ? ELEVENLABS_VOICE_ID_BY_PRESET.get(voicePresetId)
+        : undefined;
+    if (elevenLabsApiKey && voiceId) {
+        if (!config.messages || typeof config.messages !== "object") {
+            config.messages = {};
+        }
+        const messages = config.messages;
+        const existingTts = messages.tts && typeof messages.tts === "object"
+            ? messages.tts
+            : {};
+        const existingElevenlabs = existingTts.elevenlabs && typeof existingTts.elevenlabs === "object"
+            ? existingTts.elevenlabs
+            : {};
+        messages.tts = {
+            ...existingTts,
+            provider: "elevenlabs",
+            elevenlabs: {
+                ...existingElevenlabs,
+                voiceId,
+                modelId: typeof existingElevenlabs.modelId === "string" &&
+                    existingElevenlabs.modelId.trim()
+                    ? existingElevenlabs.modelId.trim()
+                    : DEFAULT_ELEVENLABS_TTS_MODEL,
+            },
+        };
+    }
+    migrateLegacyRuntimeConfig(config);
+    saveElizaConfig(config);
+    return adminEntityId;
+}
+export function deriveCompatOnboardingReplayBody(body) {
+    const explicitDeploymentTarget = normalizeDeploymentTargetConfig(body.deploymentTarget);
+    const explicitCredentialInputs = normalizeOnboardingCredentialInputs(body.credentialInputs);
+    const deploymentTarget = explicitDeploymentTarget ?? undefined;
+    const linkedAccounts = normalizeLinkedAccountFlagsConfig(body.linkedAccounts) ?? undefined;
+    const serviceRouting = normalizeServiceRoutingConfig(body.serviceRouting) ?? undefined;
+    const isCloudMode = deploymentTarget?.runtime === "cloud";
+    const replayBody = { ...body };
+    for (const key of LEGACY_ONBOARDING_REQUEST_KEYS) {
+        delete replayBody[key];
+    }
+    if (deploymentTarget) {
+        replayBody.deploymentTarget = deploymentTarget;
+    }
+    if (linkedAccounts) {
+        replayBody.linkedAccounts = linkedAccounts;
+    }
+    if (serviceRouting) {
+        replayBody.serviceRouting = serviceRouting;
+    }
+    if (explicitCredentialInputs) {
+        replayBody.credentialInputs = explicitCredentialInputs;
+    }
+    return { isCloudMode, replayBody };
+}
+/**
+ * Check if this is a cloud-provisioned container.
+ *
+ * METADATA-ONLY as of P0 of the remote-auth hardening. This function now
+ * exists strictly so unrelated routes (e.g. `/api/cloud/status`) can branch
+ * on cloud-provisioned shape. It does NOT authorise anything: callers must
+ * still pass through `ensureCompatApiAuthorized` (bearer token) or — once
+ * the dashboard mints sessions — `ensureAuthSessionOrBootstrap`. The
+ * audited bypasses at `auth-pairing-compat-routes.ts:124,140` and the
+ * onboarding-skip used to read this; both have been removed.
+ *
+ * See `docs/security/remote-auth-hardening-plan.md` §3.4.
+ */
+export function isCloudProvisioned() {
+    const hasCloudFlag = process.env.ELIZA_CLOUD_PROVISIONED === "1";
+    const hasCloudApiKeyProvisioning = process.env.ELIZAOS_CLOUD_ENABLED === "true" &&
+        Boolean(process.env.ELIZAOS_CLOUD_API_KEY?.trim());
+    const hasPlatformToken = Boolean(process.env.STEWARD_AGENT_TOKEN?.trim() ||
+        getCompatApiToken() ||
+        hasCloudApiKeyProvisioning);
+    return hasCloudFlag && hasPlatformToken;
+}

package/api/server-security.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Security / auth helpers — WebSocket upgrade rejection, terminal run
+ * rejection, MCP terminal authorization, and API token binding.
+ */
+import { ensureApiTokenForBindHost as upstreamEnsureApiTokenForBindHost, resolveMcpTerminalAuthorizationRejection as upstreamResolveMcpTerminalAuthorizationRejection, resolveTerminalRunClientId as upstreamResolveTerminalRunClientId, resolveTerminalRunRejection as upstreamResolveTerminalRunRejection, resolveWebSocketUpgradeRejection as upstreamResolveWebSocketUpgradeRejection } from "@elizaos/agent";
+export declare function resolveMcpTerminalAuthorizationRejection(...args: Parameters<typeof upstreamResolveMcpTerminalAuthorizationRejection>): ReturnType<typeof upstreamResolveMcpTerminalAuthorizationRejection>;
+export declare function resolveTerminalRunRejection(...args: Parameters<typeof upstreamResolveTerminalRunRejection>): ReturnType<typeof upstreamResolveTerminalRunRejection>;
+export declare function resolveWebSocketUpgradeRejection(...args: Parameters<typeof upstreamResolveWebSocketUpgradeRejection>): ReturnType<typeof upstreamResolveWebSocketUpgradeRejection>;
+export declare function resolveTerminalRunClientId(...args: Parameters<typeof upstreamResolveTerminalRunClientId>): ReturnType<typeof upstreamResolveTerminalRunClientId>;
+export declare function ensureApiTokenForBindHost(...args: Parameters<typeof upstreamEnsureApiTokenForBindHost>): ReturnType<typeof upstreamEnsureApiTokenForBindHost>;
+//# sourceMappingURL=server-security.d.ts.map

package/api/server-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-security.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-security.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,yBAAyB,IAAI,iCAAiC,EAC9D,wCAAwC,IAAI,gDAAgD,EAC5F,0BAA0B,IAAI,kCAAkC,EAChE,2BAA2B,IAAI,mCAAmC,EAClE,gCAAgC,IAAI,wCAAwC,EAC7E,MAAM,gBAAgB,CAAC;AAOxB,wBAAgB,wCAAwC,CACtD,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,gDAAgD,CAAC,GAC3E,UAAU,CAAC,OAAO,gDAAgD,CAAC,CAOrE;AAED,wBAAgB,2BAA2B,CACzC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,mCAAmC,CAAC,GAC9D,UAAU,CAAC,OAAO,mCAAmC,CAAC,CAKxD;AAED,wBAAgB,gCAAgC,CAC9C,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,wCAAwC,CAAC,GACnE,UAAU,CAAC,OAAO,wCAAwC,CAAC,CAK7D;AAED,wBAAgB,0BAA0B,CACxC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,kCAAkC,CAAC,GAC7D,UAAU,CAAC,OAAO,kCAAkC,CAAC,CAKvD;AAED,wBAAgB,yBAAyB,CACvC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,iCAAiC,CAAC,GAC5D,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAKtD"}

package/api/server-security.js

@@ -0,0 +1,29 @@
+/**
+ * Security / auth helpers — WebSocket upgrade rejection, terminal run
+ * rejection, MCP terminal authorization, and API token binding.
+ */
+import { ensureApiTokenForBindHost as upstreamEnsureApiTokenForBindHost, resolveMcpTerminalAuthorizationRejection as upstreamResolveMcpTerminalAuthorizationRejection, resolveTerminalRunClientId as upstreamResolveTerminalRunClientId, resolveTerminalRunRejection as upstreamResolveTerminalRunRejection, resolveWebSocketUpgradeRejection as upstreamResolveWebSocketUpgradeRejection, } from "@elizaos/agent";
+import { syncAppEnvToEliza, syncElizaEnvAliases } from "@elizaos/shared";
+import { normalizeCompatRejection, runWithCompatAuthContext, } from "./server-wallet-trade";
+export function resolveMcpTerminalAuthorizationRejection(...args) {
+    const [req] = args;
+    return runWithCompatAuthContext(req, () => normalizeCompatRejection(upstreamResolveMcpTerminalAuthorizationRejection(...args)));
+}
+export function resolveTerminalRunRejection(...args) {
+    const [req] = args;
+    return runWithCompatAuthContext(req, () => normalizeCompatRejection(upstreamResolveTerminalRunRejection(...args)));
+}
+export function resolveWebSocketUpgradeRejection(...args) {
+    const [req] = args;
+    return runWithCompatAuthContext(req, () => upstreamResolveWebSocketUpgradeRejection(...args));
+}
+export function resolveTerminalRunClientId(...args) {
+    const [req] = args;
+    return runWithCompatAuthContext(req, () => upstreamResolveTerminalRunClientId(...args));
+}
+export function ensureApiTokenForBindHost(...args) {
+    syncAppEnvToEliza();
+    const result = upstreamEnsureApiTokenForBindHost(...args);
+    syncElizaEnvAliases();
+    return result;
+}

package/api/server-startup.d.ts

@@ -0,0 +1,5 @@
+import { isSafeResetStateDir as upstreamIsSafeResetStateDir, resolveCorsOrigin as upstreamResolveCorsOrigin } from "@elizaos/agent";
+export declare function isSafeResetStateDir(...args: Parameters<typeof upstreamIsSafeResetStateDir>): ReturnType<typeof upstreamIsSafeResetStateDir>;
+export declare function findOwnPackageRoot(startDir: string): string;
+export declare function resolveCorsOrigin(...args: Parameters<typeof upstreamResolveCorsOrigin>): ReturnType<typeof upstreamResolveCorsOrigin>;
+//# sourceMappingURL=server-startup.d.ts.map

package/api/server-startup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-startup.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-startup.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,mBAAmB,IAAI,2BAA2B,EAClD,iBAAiB,IAAI,yBAAyB,EAC/C,MAAM,gBAAgB,CAAC;AAKxB,wBAAgB,mBAAmB,CACjC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,GACtD,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAgChD;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiC3D;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,GACpD,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAO9C"}

package/api/server-startup.js

@@ -0,0 +1,74 @@
+/**
+ * Server startup helpers — safe state dir check, package root resolution,
+ * and CORS origin resolution.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { isSafeResetStateDir as upstreamIsSafeResetStateDir, resolveCorsOrigin as upstreamResolveCorsOrigin, } from "@elizaos/agent";
+import { syncAppEnvToEliza, syncElizaEnvAliases } from "@elizaos/shared";
+const PACKAGE_ROOT_NAMES = new Set(["eliza", "elizaai", "elizaos", "eliza"]);
+export function isSafeResetStateDir(...args) {
+    if (upstreamIsSafeResetStateDir(...args)) {
+        return true;
+    }
+    const [resolvedState, homeDir] = args;
+    const normalizedState = path.resolve(resolvedState);
+    const normalizedHome = path.resolve(homeDir);
+    const parsedRoot = path.parse(normalizedState).root;
+    if (normalizedState === parsedRoot || normalizedState === normalizedHome) {
+        return false;
+    }
+    const relativeToHome = path.relative(normalizedHome, normalizedState);
+    const isUnderHome = relativeToHome.length > 0 &&
+        !relativeToHome.startsWith("..") &&
+        !path.isAbsolute(relativeToHome);
+    if (!isUnderHome) {
+        return false;
+    }
+    return normalizedState.split(path.sep).some((segment) => {
+        const lower = segment.trim().toLowerCase();
+        if (lower === ".eliza")
+            return true;
+        // Also accept brand-specific state dirs (e.g. ".eliza")
+        for (const name of PACKAGE_ROOT_NAMES) {
+            if (lower === `.${name}`)
+                return true;
+        }
+        return false;
+    });
+}
+export function findOwnPackageRoot(startDir) {
+    let dir = startDir;
+    for (let i = 0; i < 10; i += 1) {
+        const packageJsonPath = path.join(dir, "package.json");
+        if (fs.existsSync(packageJsonPath)) {
+            try {
+                const pkg = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+                const packageName = typeof pkg.name === "string" ? pkg.name.toLowerCase() : "";
+                if (PACKAGE_ROOT_NAMES.has(packageName)) {
+                    return dir;
+                }
+                if (fs.existsSync(path.join(dir, "plugins.json"))) {
+                    return dir;
+                }
+            }
+            catch {
+                // Keep walking upward until we find a readable package root.
+            }
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir) {
+            break;
+        }
+        dir = parent;
+    }
+    return startDir;
+}
+export function resolveCorsOrigin(...args) {
+    syncElizaEnvAliases();
+    syncAppEnvToEliza();
+    const result = upstreamResolveCorsOrigin(...args);
+    syncAppEnvToEliza();
+    syncElizaEnvAliases();
+    return result;
+}

package/api/server-wallet-trade.d.ts

@@ -0,0 +1,10 @@
+import type http from "node:http";
+import { resolveWalletExportRejection as upstreamResolveWalletExportRejection } from "@elizaos/agent";
+import type { WalletExportRejection as CompatWalletExportRejection } from "@elizaos/shared";
+export declare function normalizeCompatRejection<T extends {
+    status: number;
+    reason: string;
+} | null>(rejection: T): T;
+export declare function runWithCompatAuthContext<T>(req: Pick<http.IncomingMessage, "headers">, operation: () => T): T;
+export declare function resolveWalletExportRejection(...args: Parameters<typeof upstreamResolveWalletExportRejection>): CompatWalletExportRejection | null;
+//# sourceMappingURL=server-wallet-trade.d.ts.map

package/api/server-wallet-trade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-wallet-trade.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-wallet-trade.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,4BAA4B,IAAI,oCAAoC,EAAE,MAAM,gBAAgB,CAAC;AAEtG,OAAO,KAAK,EACV,qBAAqB,IAAI,2BAA2B,EAErD,MAAM,iBAAiB,CAAC;AAmEzB,wBAAgB,wBAAwB,CACtC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EACnD,SAAS,EAAE,CAAC,GAAG,CAAC,CAOjB;AAED,wBAAgB,wBAAwB,CAAC,CAAC,EACxC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,EAC1C,SAAS,EAAE,MAAM,CAAC,GACjB,CAAC,CAWH;AAiOD,wBAAgB,4BAA4B,CAC1C,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,oCAAoC,CAAC,GAC/D,2BAA2B,GAAG,IAAI,CAKpC"}

package/api/server-wallet-trade.js

@@ -0,0 +1,240 @@
+import crypto from "node:crypto";
+import { resolveWalletExportRejection as upstreamResolveWalletExportRejection } from "@elizaos/agent";
+import { logger } from "@elizaos/core";
+import { syncAppEnvToEliza, syncElizaEnvAliases } from "@elizaos/shared";
+const RATE_LIMIT_WINDOW_MS = 10 * 60 * 1000;
+const RATE_LIMIT_SWEEP_INTERVAL_MS = 15 * 60 * 1000;
+const EXPORT_DELAY_MS = 10_000;
+const MAX_PENDING_NONCES_PER_IP = 3;
+const NONCE_TTL_MS = 5 * 60 * 1000;
+const rateLimitMap = new Map();
+const pendingExportNonces = new Map();
+const sweepTimer = setInterval(() => {
+    const now = Date.now();
+    for (const [key, entry] of rateLimitMap) {
+        if (now - entry.lastExportAt > RATE_LIMIT_WINDOW_MS * 2) {
+            rateLimitMap.delete(key);
+        }
+    }
+}, RATE_LIMIT_SWEEP_INTERVAL_MS);
+if (typeof sweepTimer === "object" && "unref" in sweepTimer) {
+    sweepTimer.unref();
+}
+function normalizeCompatReason(reason) {
+    return reason;
+}
+function mirrorCompatHeaders(req) {
+    const headerAliases = [
+        ["x-elizaos-token", "x-eliza-token"],
+        ["x-elizaos-export-token", "x-eliza-export-token"],
+        ["x-elizaos-client-id", "x-eliza-client-id"],
+        ["x-elizaos-terminal-token", "x-eliza-terminal-token"],
+        ["x-elizaos-ui-language", "x-eliza-ui-language"],
+        ["x-elizaos-agent-action", "x-eliza-agent-action"],
+    ];
+    for (const [appHeader, elizaHeader] of headerAliases) {
+        const appValue = req.headers[appHeader];
+        const elizaValue = req.headers[elizaHeader];
+        if (appValue != null && elizaValue == null) {
+            req.headers[elizaHeader] = appValue;
+        }
+        if (elizaValue != null && appValue == null) {
+            req.headers[appHeader] = elizaValue;
+        }
+    }
+}
+export function normalizeCompatRejection(rejection) {
+    if (!rejection) {
+        return rejection;
+    }
+    rejection.reason = normalizeCompatReason(rejection.reason);
+    return rejection;
+}
+export function runWithCompatAuthContext(req, operation) {
+    syncElizaEnvAliases();
+    syncAppEnvToEliza();
+    mirrorCompatHeaders(req);
+    try {
+        return operation();
+    }
+    finally {
+        syncAppEnvToEliza();
+        syncElizaEnvAliases();
+    }
+}
+function getClientIp(req) {
+    return req.socket?.remoteAddress ?? null;
+}
+function getUserAgent(req) {
+    const userAgent = req.headers["user-agent"];
+    return typeof userAgent === "string" ? userAgent : "unknown";
+}
+function recordWalletExportAudit(entry) {
+    logger.warn({
+        src: "app-core:server-wallet-trade",
+        ...entry,
+    }, "[server-wallet-trade] Wallet export audit");
+}
+function issueExportNonce(ip) {
+    const now = Date.now();
+    for (const [key, value] of pendingExportNonces) {
+        if (now - value.issuedAt > NONCE_TTL_MS) {
+            pendingExportNonces.delete(key);
+        }
+    }
+    let countForIp = 0;
+    for (const entry of pendingExportNonces.values()) {
+        if (entry.ip === ip) {
+            countForIp++;
+        }
+    }
+    if (countForIp >= MAX_PENDING_NONCES_PER_IP) {
+        return null;
+    }
+    const nonce = `wxn_${crypto.randomBytes(16).toString("hex")}`;
+    pendingExportNonces.set(nonce, { issuedAt: now, ip });
+    return nonce;
+}
+function validateExportNonce(nonce, ip) {
+    const entry = pendingExportNonces.get(nonce);
+    if (!entry) {
+        return { valid: false, reason: "Invalid or expired export nonce." };
+    }
+    if (entry.ip !== ip) {
+        return {
+            valid: false,
+            reason: "Export nonce was issued to a different client.",
+        };
+    }
+    const elapsed = Date.now() - entry.issuedAt;
+    if (elapsed < EXPORT_DELAY_MS) {
+        const remaining = Math.ceil((EXPORT_DELAY_MS - elapsed) / 1000);
+        return {
+            valid: false,
+            reason: `Export confirmation delay not met. Wait ${remaining} more seconds.`,
+        };
+    }
+    pendingExportNonces.delete(nonce);
+    return { valid: true };
+}
+function createHardenedExportGuard(upstream) {
+    return (req, body) => {
+        const ip = getClientIp(req);
+        const userAgent = getUserAgent(req);
+        if (!ip) {
+            recordWalletExportAudit({
+                timestamp: new Date().toISOString(),
+                ip: "unknown",
+                userAgent,
+                outcome: "rejected",
+                reason: "No client IP available on socket",
+            });
+            return {
+                status: 400,
+                reason: "Unable to determine client IP; request rejected.",
+            };
+        }
+        const upstreamRejection = upstream(req, body);
+        if (upstreamRejection) {
+            recordWalletExportAudit({
+                timestamp: new Date().toISOString(),
+                ip,
+                userAgent,
+                outcome: "rejected",
+                reason: upstreamRejection.reason,
+            });
+            return upstreamRejection;
+        }
+        if (body.requestNonce) {
+            const nonce = issueExportNonce(ip);
+            if (!nonce) {
+                recordWalletExportAudit({
+                    timestamp: new Date().toISOString(),
+                    ip,
+                    userAgent,
+                    outcome: "rejected",
+                    reason: "Too many pending nonces for this IP",
+                });
+                return {
+                    status: 429,
+                    reason: "Too many pending export requests. Complete or wait for existing nonces to expire.",
+                };
+            }
+            recordWalletExportAudit({
+                timestamp: new Date().toISOString(),
+                ip,
+                userAgent,
+                outcome: "rejected",
+                reason: "Nonce issued, waiting for confirmation delay",
+            });
+            return {
+                status: 403,
+                reason: JSON.stringify({
+                    countdown: true,
+                    nonce,
+                    delaySeconds: EXPORT_DELAY_MS / 1000,
+                    message: `Export nonce issued. Wait ${EXPORT_DELAY_MS / 1000} seconds, then re-submit with exportNonce: "${nonce}".`,
+                }),
+            };
+        }
+        if (!body.exportNonce) {
+            recordWalletExportAudit({
+                timestamp: new Date().toISOString(),
+                ip,
+                userAgent,
+                outcome: "rejected",
+                reason: "Missing export nonce",
+            });
+            return {
+                status: 403,
+                reason: 'Export requires a confirmation delay. First send { "confirm": true, "exportToken": "...", "requestNonce": true } to start the countdown.',
+            };
+        }
+        const nonceResult = validateExportNonce(body.exportNonce, ip);
+        if (nonceResult.valid === false) {
+            recordWalletExportAudit({
+                timestamp: new Date().toISOString(),
+                ip,
+                userAgent,
+                outcome: "rejected",
+                reason: nonceResult.reason,
+            });
+            return { status: 403, reason: nonceResult.reason };
+        }
+        const rateLimitEntry = rateLimitMap.get(ip);
+        if (rateLimitEntry) {
+            const elapsed = Date.now() - rateLimitEntry.lastExportAt;
+            if (elapsed < RATE_LIMIT_WINDOW_MS) {
+                const retryAfter = Math.ceil((RATE_LIMIT_WINDOW_MS - elapsed) / 1000);
+                recordWalletExportAudit({
+                    timestamp: new Date().toISOString(),
+                    ip,
+                    userAgent,
+                    outcome: "rate-limited",
+                    reason: `Rate limited, retry after ${retryAfter}s`,
+                });
+                return {
+                    status: 429,
+                    reason: `Rate limit exceeded. One export per ${RATE_LIMIT_WINDOW_MS / 60_000} minutes. Retry after ${retryAfter} seconds.`,
+                };
+            }
+        }
+        rateLimitMap.set(ip, { lastExportAt: Date.now() });
+        recordWalletExportAudit({
+            timestamp: new Date().toISOString(),
+            ip,
+            userAgent,
+            outcome: "allowed",
+        });
+        return null;
+    };
+}
+function resolveCompatWalletExportRejection(...args) {
+    const [req] = args;
+    return runWithCompatAuthContext(req, () => normalizeCompatRejection(upstreamResolveWalletExportRejection(...args)));
+}
+const hardenedGuard = createHardenedExportGuard(resolveCompatWalletExportRejection);
+export function resolveWalletExportRejection(...args) {
+    const [req] = args;
+    return runWithCompatAuthContext(req, () => normalizeCompatRejection(hardenedGuard(...args)));
+}