@elizaos/app-core 2.0.0-alpha.85 → 2.0.0-beta.2

package/security/agent-vault-id.d.ts

@@ -0,0 +1,16 @@
+import type { SecureStoreSecretKind } from "./platform-secure-store";
+/** Fixed Keychain / Secret Service “service” identifier (see docs/guides/platform-secure-store.md). */
+export declare const ELIZA_AGENT_VAULT_SERVICE = "ai.elizaos.agent.vault";
+/**
+ * Canonical state directory for this process. Mirrors the canonical
+ * `MILADY_STATE_DIR` > `ELIZA_STATE_DIR` > `~/.${namespace}` precedence
+ * and uses `realpathSync` when the path exists so symlinks normalize
+ * consistently.
+ */
+export declare function resolveCanonicalStateDir(): string;
+/**
+ * Opaque vault id for OS secret stores: `mldy1-` + first 16 chars of base64url(sha256(canonicalStateDir)).
+ */
+export declare function deriveAgentVaultId(canonicalStateDir?: string): string;
+export declare function keychainAccountForSecretKind(vaultId: string, kind: SecureStoreSecretKind): string;
+//# sourceMappingURL=agent-vault-id.d.ts.map

package/security/agent-vault-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-vault-id.d.ts","sourceRoot":"","sources":["../../../../../src/security/agent-vault-id.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,uGAAuG;AACvG,eAAO,MAAM,yBAAyB,2BAA2B,CAAC;AAElE;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAOjD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,iBAAiB,SAA6B,GAC7C,MAAM,CAIR;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,qBAAqB,GAC1B,MAAM,CAER"}

package/security/agent-vault-id.js

@@ -0,0 +1,32 @@
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { resolveStateDir } from "@elizaos/core";
+/** Fixed Keychain / Secret Service “service” identifier (see docs/guides/platform-secure-store.md). */
+export const ELIZA_AGENT_VAULT_SERVICE = "ai.elizaos.agent.vault";
+/**
+ * Canonical state directory for this process. Mirrors the canonical
+ * `MILADY_STATE_DIR` > `ELIZA_STATE_DIR` > `~/.${namespace}` precedence
+ * and uses `realpathSync` when the path exists so symlinks normalize
+ * consistently.
+ */
+export function resolveCanonicalStateDir() {
+    const resolved = path.resolve(resolveStateDir());
+    try {
+        return fs.realpathSync(resolved);
+    }
+    catch {
+        return resolved;
+    }
+}
+/**
+ * Opaque vault id for OS secret stores: `mldy1-` + first 16 chars of base64url(sha256(canonicalStateDir)).
+ */
+export function deriveAgentVaultId(canonicalStateDir = resolveCanonicalStateDir()) {
+    const hash = createHash("sha256").update(canonicalStateDir, "utf8").digest();
+    const token = Buffer.from(hash).toString("base64url").slice(0, 16);
+    return `mldy1-${token}`;
+}
+export function keychainAccountForSecretKind(vaultId, kind) {
+    return `${vaultId}:${kind}`;
+}

package/security/cloud-secret-store.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Sealed, non-enumerable store for cloud API secrets.
+ *
+ * The upstream `@elizaos/agent` cloud-routes handler writes
+ * `ELIZAOS_CLOUD_API_KEY` directly to `process.env` on login, making it
+ * readable by any module and visible in crash dumps. This module provides:
+ *
+ * 1. A sealed store accessible only via `getCloudSecret()`.
+ * 2. `scrubCloudKeyFromEnv()` to delete the key from `process.env` after
+ *    each request while preserving access via the sealed store.
+ * 3. A Docker/entrypoint fallback: if the key was set in the environment
+ *    before the module loaded, `getCloudSecret()` still returns it.
+ */
+/**
+ * Store the cloud secret in the sealed object and remove it from
+ * `process.env` so it cannot leak via `JSON.stringify(process.env)`,
+ * `/proc/self/environ`, crash dumps, or child processes.
+ */
+export declare function scrubCloudKeyFromEnv(): void;
+/**
+ * Retrieve the cloud API key.
+ *
+ * Resolution order:
+ * 1. Sealed store (set via `scrubCloudKeyFromEnv`)
+ * 2. `process.env.ELIZAOS_CLOUD_API_KEY` (Docker entrypoint fallback)
+ * 3. Value captured at module load time
+ */
+export declare function getCloudSecret(): string | undefined;
+/**
+ * Check that the internal store is truly non-enumerable.
+ * Useful for assertions in tests.
+ */
+export declare function isStoreNonEnumerable(): boolean;
+//# sourceMappingURL=cloud-secret-store.d.ts.map

package/security/cloud-secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-secret-store.d.ts","sourceRoot":"","sources":["../../../../../src/security/cloud-secret-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAmBH;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAM3C;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,MAAM,GAAG,SAAS,CAMnD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C"}

package/security/cloud-secret-store.js

@@ -0,0 +1,65 @@
+/**
+ * Sealed, non-enumerable store for cloud API secrets.
+ *
+ * The upstream `@elizaos/agent` cloud-routes handler writes
+ * `ELIZAOS_CLOUD_API_KEY` directly to `process.env` on login, making it
+ * readable by any module and visible in crash dumps. This module provides:
+ *
+ * 1. A sealed store accessible only via `getCloudSecret()`.
+ * 2. `scrubCloudKeyFromEnv()` to delete the key from `process.env` after
+ *    each request while preserving access via the sealed store.
+ * 3. A Docker/entrypoint fallback: if the key was set in the environment
+ *    before the module loaded, `getCloudSecret()` still returns it.
+ */
+const CLOUD_KEY_NAME = "ELIZAOS_CLOUD_API_KEY";
+/**
+ * Internal sealed store.  The property is non-enumerable and non-configurable
+ * so `Object.keys()`, `JSON.stringify()`, and `for…in` never expose it.
+ */
+const _store = Object.create(null);
+Object.defineProperty(_store, "_secret", {
+    value: undefined,
+    writable: true,
+    enumerable: false,
+    configurable: false,
+});
+/** Capture any value that was already set before the module loaded (Docker). */
+const _dockerFallback = process.env[CLOUD_KEY_NAME];
+/**
+ * Store the cloud secret in the sealed object and remove it from
+ * `process.env` so it cannot leak via `JSON.stringify(process.env)`,
+ * `/proc/self/environ`, crash dumps, or child processes.
+ */
+export function scrubCloudKeyFromEnv() {
+    const current = process.env[CLOUD_KEY_NAME];
+    if (current !== undefined) {
+        _store._secret = current;
+        delete process.env[CLOUD_KEY_NAME];
+    }
+}
+/**
+ * Retrieve the cloud API key.
+ *
+ * Resolution order:
+ * 1. Sealed store (set via `scrubCloudKeyFromEnv`)
+ * 2. `process.env.ELIZAOS_CLOUD_API_KEY` (Docker entrypoint fallback)
+ * 3. Value captured at module load time
+ */
+export function getCloudSecret() {
+    return (_store._secret ??
+        process.env[CLOUD_KEY_NAME] ??
+        _dockerFallback);
+}
+/**
+ * Check that the internal store is truly non-enumerable.
+ * Useful for assertions in tests.
+ */
+export function isStoreNonEnumerable() {
+    return !Object.keys(_store).includes("_secret");
+}
+/** @internal — test-only reset */
+export function __resetCloudSecretStoreForTests() {
+    if (process.env.NODE_ENV === "production")
+        return;
+    _store._secret = undefined;
+}

package/security/export-guard.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Hardened export guard for `/api/wallet/export`.
+ *
+ * Wraps upstream `resolveWalletExportRejection` with:
+ * 1. 10-second mandatory confirmation delay (two-phase nonce flow).
+ * 2. 1-per-10-minute rate limit per IP on successful exports.
+ * 3. Audit log entry (IP, User-Agent, timestamp) for every attempt.
+ * 4. IP-bound, single-use nonces to prevent replay from different clients.
+ */
+export interface ExportGuardRejection {
+    status: number;
+    reason: string;
+}
+export interface NonceResult {
+    nonce: string;
+    expiresAt: number;
+}
+export interface AuditRecord {
+    ip: string;
+    userAgent: string;
+    timestamp: number;
+    action: string;
+    success: boolean;
+}
+export interface HardenedExportGuard {
+    requestNonce(ip: string): NonceResult;
+    validateNonce(nonce: string, ip: string): ExportGuardRejection | null;
+    checkRateLimit(ip: string): ExportGuardRejection | null;
+    recordSuccessfulExport(ip: string): void;
+    recordAudit(record: AuditRecord): void;
+    getAuditLog(): readonly AuditRecord[];
+}
+export declare function createHardenedExportGuard(): HardenedExportGuard;
+//# sourceMappingURL=export-guard.d.ts.map

package/security/export-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-guard.d.ts","sourceRoot":"","sources":["../../../../../src/security/export-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAqBD,MAAM,WAAW,mBAAmB;IAClC,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,WAAW,CAAC;IACtC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAAC;IACtE,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAAC;IACxD,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IACvC,WAAW,IAAI,SAAS,WAAW,EAAE,CAAC;CACvC;AAED,wBAAgB,yBAAyB,IAAI,mBAAmB,CAoI/D"}

package/security/export-guard.js

@@ -0,0 +1,127 @@
+/**
+ * Hardened export guard for `/api/wallet/export`.
+ *
+ * Wraps upstream `resolveWalletExportRejection` with:
+ * 1. 10-second mandatory confirmation delay (two-phase nonce flow).
+ * 2. 1-per-10-minute rate limit per IP on successful exports.
+ * 3. Audit log entry (IP, User-Agent, timestamp) for every attempt.
+ * 4. IP-bound, single-use nonces to prevent replay from different clients.
+ */
+import crypto from "node:crypto";
+const NONCE_DELAY_MS = 10_000;
+const NONCE_TTL_MS = 60_000;
+const RATE_LIMIT_WINDOW_MS = 10 * 60 * 1000;
+const RATE_LIMIT_MAX_EXPORTS = 1;
+const NONCE_MAP_SWEEP_THRESHOLD = 200;
+export function createHardenedExportGuard() {
+    const nonces = new Map();
+    const rateLimits = new Map();
+    const auditLog = [];
+    function sweepExpiredNonces(now) {
+        if (nonces.size <= NONCE_MAP_SWEEP_THRESHOLD)
+            return;
+        for (const [key, entry] of nonces) {
+            if (now > entry.expiresAt || entry.consumed) {
+                nonces.delete(key);
+            }
+        }
+    }
+    function sweepExpiredRateLimits(now) {
+        if (rateLimits.size <= NONCE_MAP_SWEEP_THRESHOLD)
+            return;
+        for (const [key, entry] of rateLimits) {
+            if (now > entry.resetAt) {
+                rateLimits.delete(key);
+            }
+        }
+    }
+    function requestNonce(ip) {
+        const now = Date.now();
+        sweepExpiredNonces(now);
+        const nonce = crypto.randomBytes(32).toString("hex");
+        const entry = {
+            ip,
+            createdAt: now,
+            readyAt: now + NONCE_DELAY_MS,
+            expiresAt: now + NONCE_TTL_MS,
+            consumed: false,
+        };
+        nonces.set(nonce, entry);
+        return { nonce, expiresAt: entry.expiresAt };
+    }
+    function validateNonce(nonce, ip) {
+        const entry = nonces.get(nonce);
+        const now = Date.now();
+        if (!entry) {
+            return { status: 403, reason: "Invalid or expired nonce." };
+        }
+        if (entry.consumed) {
+            return { status: 403, reason: "Nonce has already been used." };
+        }
+        if (entry.ip !== ip) {
+            return {
+                status: 403,
+                reason: "Nonce was issued for a different client.",
+            };
+        }
+        if (now > entry.expiresAt) {
+            nonces.delete(nonce);
+            return { status: 403, reason: "Invalid or expired nonce." };
+        }
+        if (now < entry.readyAt) {
+            const remainingSec = Math.ceil((entry.readyAt - now) / 1000);
+            return {
+                status: 429,
+                reason: `Confirmation delay not elapsed. Wait ${remainingSec} more second(s).`,
+            };
+        }
+        entry.consumed = true;
+        return null;
+    }
+    function checkRateLimit(ip) {
+        const now = Date.now();
+        sweepExpiredRateLimits(now);
+        const entry = rateLimits.get(ip);
+        if (!entry || now > entry.resetAt) {
+            return null;
+        }
+        if (entry.count >= RATE_LIMIT_MAX_EXPORTS) {
+            const retryAfterSec = Math.ceil((entry.resetAt - now) / 1000);
+            return {
+                status: 429,
+                reason: `Rate limit exceeded. Try again in ${retryAfterSec} second(s).`,
+            };
+        }
+        return null;
+    }
+    function recordSuccessfulExport(ip) {
+        const now = Date.now();
+        const entry = rateLimits.get(ip);
+        if (!entry || now > entry.resetAt) {
+            rateLimits.set(ip, {
+                count: 1,
+                resetAt: now + RATE_LIMIT_WINDOW_MS,
+            });
+        }
+        else {
+            entry.count += 1;
+        }
+    }
+    function recordAudit(record) {
+        auditLog.push(record);
+        if (auditLog.length > 5000) {
+            auditLog.splice(0, auditLog.length - 2500);
+        }
+    }
+    function getAuditLog() {
+        return auditLog;
+    }
+    return {
+        requestNonce,
+        validateNonce,
+        checkRateLimit,
+        recordSuccessfulExport,
+        recordAudit,
+        getAuditLog,
+    };
+}

package/security/hydrate-wallet-keys-from-platform-store.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Fills `process.env` wallet keys from the shared vault (now the source
+ * of truth). On first boot after the storage unification, copies any
+ * legacy OS-keystore values into the vault and then proceeds normally.
+ *
+ * Steward env vars stay on the OS-keystore path — the steward backend's
+ * lifecycle is independent of the unified wallet vault.
+ *
+ * Runs before upstream `startApiServer` merges `config.env`, so persisted
+ * config only fills gaps that neither vault nor OS keystore supplies.
+ */
+export declare function hydrateWalletKeysFromNodePlatformSecureStore(): Promise<void>;
+//# sourceMappingURL=hydrate-wallet-keys-from-platform-store.d.ts.map

package/security/hydrate-wallet-keys-from-platform-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hydrate-wallet-keys-from-platform-store.d.ts","sourceRoot":"","sources":["../../../../../src/security/hydrate-wallet-keys-from-platform-store.ts"],"names":[],"mappings":"AAoEA;;;;;;;;;;GAUG;AACH,wBAAsB,4CAA4C,IAAI,OAAO,CAAC,IAAI,CAAC,CAkDlF"}

package/security/hydrate-wallet-keys-from-platform-store.js

@@ -0,0 +1,116 @@
+import { logger } from "@elizaos/core";
+import { sharedVault } from "../services/vault-mirror";
+import { deriveAgentVaultId } from "./agent-vault-id";
+import { createNodePlatformSecureStore, isWalletOsStoreReadEnabled, } from "./platform-secure-store-node";
+const WALLET_VAULT_KEYS = [
+    "EVM_PRIVATE_KEY",
+    "SOLANA_PRIVATE_KEY",
+];
+/**
+ * Steward-only env vars (non-wallet) that still ride the OS keystore. They
+ * never moved into the unified vault because the steward backend has its
+ * own auth model — leave them on the keystore-only path.
+ */
+const STEWARD_OS_PAIRS = [
+    ["STEWARD_API_URL", "steward.api_url"],
+    ["STEWARD_AGENT_ID", "steward.agent_id"],
+    ["STEWARD_AGENT_TOKEN", "steward.agent_token"],
+];
+/**
+ * One-shot copy of legacy OS-keystore wallet keys into the shared vault.
+ * Returns the env keys that were copied across so the caller can log /
+ * surface a migration banner.
+ */
+async function migrateOsStoreWalletKeysIntoVault(envKeys) {
+    if (envKeys.length === 0)
+        return [];
+    if (!isWalletOsStoreReadEnabled())
+        return [];
+    const store = createNodePlatformSecureStore();
+    if (!(await store.isAvailable()))
+        return [];
+    const vault = sharedVault();
+    const vaultId = deriveAgentVaultId();
+    const keychainKindFor = {
+        EVM_PRIVATE_KEY: "wallet.evm_private_key",
+        SOLANA_PRIVATE_KEY: "wallet.solana_private_key",
+    };
+    const migrated = [];
+    for (const envKey of envKeys) {
+        const kind = keychainKindFor[envKey];
+        if (!kind)
+            continue;
+        const got = await store.get(vaultId, kind);
+        if (!got.ok)
+            continue;
+        process.env[envKey] = got.value;
+        if (!(await vault.has(envKey))) {
+            await vault.set(envKey, got.value, {
+                sensitive: true,
+                caller: "wallet-os-store-migrate",
+            });
+            migrated.push(String(envKey));
+        }
+    }
+    return migrated;
+}
+/**
+ * Fills `process.env` wallet keys from the shared vault (now the source
+ * of truth). On first boot after the storage unification, copies any
+ * legacy OS-keystore values into the vault and then proceeds normally.
+ *
+ * Steward env vars stay on the OS-keystore path — the steward backend's
+ * lifecycle is independent of the unified wallet vault.
+ *
+ * Runs before upstream `startApiServer` merges `config.env`, so persisted
+ * config only fills gaps that neither vault nor OS keystore supplies.
+ */
+export async function hydrateWalletKeysFromNodePlatformSecureStore() {
+    // ── 1. Vault read for wallet keys ────────────────────────────────
+    const vault = sharedVault();
+    const missingWalletKeys = [];
+    for (const envKey of WALLET_VAULT_KEYS) {
+        const cur = process.env[envKey];
+        if (typeof cur === "string" && cur.trim())
+            continue;
+        if (await vault.has(envKey)) {
+            const value = await vault.reveal(envKey, "wallet-hydrate-boot");
+            process.env[envKey] = value;
+            continue;
+        }
+        missingWalletKeys.push(envKey);
+    }
+    // ── 2. One-shot migration from OS keystore for any wallet keys
+    //      that the vault did not have. ──────────────────────────────
+    if (missingWalletKeys.length > 0) {
+        try {
+            const migrated = await migrateOsStoreWalletKeysIntoVault(missingWalletKeys);
+            if (migrated.length > 0) {
+                logger.info(`[wallet][vault] migrated ${migrated.length} key(s) from OS keystore: ${migrated.join(", ")}`);
+            }
+        }
+        catch (err) {
+            logger.warn(`[wallet][vault] os-store migration failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    // ── 3. Steward OS-keystore reads (unchanged) ─────────────────────
+    if (!isWalletOsStoreReadEnabled())
+        return;
+    try {
+        const store = createNodePlatformSecureStore();
+        if (!(await store.isAvailable()))
+            return;
+        const vaultId = deriveAgentVaultId();
+        for (const [envKey, kind] of STEWARD_OS_PAIRS) {
+            const cur = process.env[envKey];
+            if (typeof cur === "string" && cur.trim())
+                continue;
+            const got = await store.get(vaultId, kind);
+            if (got.ok)
+                process.env[envKey] = got.value;
+        }
+    }
+    catch (err) {
+        logger.warn(`[wallet][os-store] steward hydrate failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}

package/security/platform-secure-store-node.d.ts

@@ -0,0 +1,13 @@
+import type { PlatformSecureStore } from "./platform-secure-store";
+/**
+ * Node-side factory: macOS Keychain, Linux `secret-tool`, or unavailable placeholder.
+ * Windows Credential Manager is not wired yet (`none`).
+ */
+export declare function createNodePlatformSecureStore(): PlatformSecureStore;
+export declare function isNodePlatformSecureStoreDefaultAvailable(): boolean;
+/**
+ * Explicit override: `ELIZA_WALLET_OS_STORE=0|false|off|no` disables this path.
+ * When unset, default on for supported local secure stores.
+ */
+export declare function isWalletOsStoreReadEnabled(): boolean;
+//# sourceMappingURL=platform-secure-store-node.d.ts.map

package/security/platform-secure-store-node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-secure-store-node.d.ts","sourceRoot":"","sources":["../../../../../src/security/platform-secure-store-node.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,mBAAmB,EAKpB,MAAM,yBAAyB,CAAC;AAqUjC;;;GAGG;AACH,wBAAgB,6BAA6B,IAAI,mBAAmB,CAQnE;AAKD,wBAAgB,yCAAyC,IAAI,OAAO,CAInE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAOpD"}