@elizaos/app-core 2.0.0-alpha.85 → 2.0.0-beta.2

package/platforms/electrobun/src/desktop-http-request.ts

@@ -0,0 +1,103 @@
+import { isLoopbackBindHost, isWildcardBindHost } from "@elizaos/shared";
+
+function isExternalPlainHttpUrl(parsed: URL): boolean {
+	return (
+		parsed.protocol === "http:" &&
+		!isLoopbackBindHost(parsed.hostname) &&
+		!isWildcardBindHost(parsed.hostname)
+	);
+}
+
+export function normalizeDesktopHttpRequest(params: unknown): {
+	url: string;
+	method: string;
+	headers: Record<string, string>;
+	body: string | null;
+	timeoutMs?: number;
+} {
+	if (!params || typeof params !== "object") {
+		throw new Error("desktopHttpRequest params must be an object.");
+	}
+	const record = params as Record<string, unknown>;
+	if (typeof record.url !== "string") {
+		throw new Error("desktopHttpRequest url must be a string.");
+	}
+	const parsed = new URL(record.url);
+	if (!isExternalPlainHttpUrl(parsed)) {
+		throw new Error(
+			"desktopHttpRequest supports only external plain HTTP URLs.",
+		);
+	}
+	const method = typeof record.method === "string" ? record.method : "GET";
+	const headers =
+		record.headers && typeof record.headers === "object"
+			? Object.fromEntries(
+					Object.entries(record.headers as Record<string, unknown>)
+						.filter((entry): entry is [string, string] => {
+							return typeof entry[1] === "string";
+						})
+						.map(([key, value]) => [key, value]),
+				)
+			: {};
+	const body = typeof record.body === "string" ? record.body : null;
+	const timeoutMs =
+		typeof record.timeoutMs === "number" &&
+		Number.isFinite(record.timeoutMs) &&
+		record.timeoutMs > 0
+			? record.timeoutMs
+			: undefined;
+	return { url: parsed.toString(), method, headers, body, timeoutMs };
+}
+
+function responseHeadersToRecord(headers: Headers): Record<string, string> {
+	const record: Record<string, string> = {};
+	headers.forEach((value, key) => {
+		record[key] = value;
+	});
+	return record;
+}
+
+export async function desktopHttpRequest(params: unknown): Promise<{
+	status: number;
+	statusText?: string;
+	headers?: Record<string, string>;
+	body?: string | null;
+}> {
+	const request = normalizeDesktopHttpRequest(params);
+	const abortController = new AbortController();
+	const operation = (async () => {
+		const response = await fetch(request.url, {
+			method: request.method,
+			headers: request.headers,
+			body: request.body,
+			signal: abortController.signal,
+		});
+		const body = await response.text();
+		return {
+			status: response.status,
+			statusText: response.statusText,
+			headers: responseHeadersToRecord(response.headers),
+			body,
+		};
+	})();
+
+	if (!request.timeoutMs) {
+		return operation;
+	}
+
+	let timeoutId: ReturnType<typeof setTimeout> | undefined;
+	const timeout = new Promise<never>((_, reject) => {
+		timeoutId = setTimeout(() => {
+			abortController.abort();
+			reject(
+				new Error(`desktopHttpRequest timed out after ${request.timeoutMs}ms.`),
+			);
+		}, request.timeoutMs);
+	});
+
+	try {
+		return await Promise.race([operation, timeout]);
+	} finally {
+		if (timeoutId !== undefined) clearTimeout(timeoutId);
+	}
+}

package/platforms/electrobun/src/desktop-test-bridge-server.ts

@@ -0,0 +1,248 @@
+import crypto from "node:crypto";
+import http from "node:http";
+import { invokeApplicationMenuAction } from "./application-menu-action-registry";
+import {
+	evaluateInCurrentMainWindow,
+	getCurrentMainWindowSnapshot,
+} from "./main-window-runtime";
+import { getDesktopManager } from "./native/desktop";
+import { findFirstAvailableLoopbackPort } from "./native/loopback-port";
+import { getScreenCaptureManager } from "./native/screencapture";
+import type { WindowBounds } from "./rpc-schema";
+
+const DEFAULT_TEST_BRIDGE_PORT = 31_341;
+const MAX_BODY_BYTES = 1024 * 1024;
+
+type EvalBody = {
+	script?: string;
+};
+
+type BoundsBody = Partial<WindowBounds>;
+
+type MenuActionBody = {
+	action?: string;
+};
+
+function isLoopback(addr: string | undefined): boolean {
+	return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+}
+
+function json(
+	res: http.ServerResponse,
+	status: number,
+	body: Record<string, unknown>,
+): void {
+	res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
+	res.end(JSON.stringify(body));
+}
+
+async function readJsonBody<T>(req: http.IncomingMessage): Promise<T | null> {
+	const chunks: Buffer[] = [];
+	let size = 0;
+
+	for await (const chunk of req) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+		size += buffer.length;
+		if (size > MAX_BODY_BYTES) {
+			throw new Error("request body too large");
+		}
+		chunks.push(buffer);
+	}
+
+	if (chunks.length === 0) {
+		return null;
+	}
+
+	return JSON.parse(Buffer.concat(chunks).toString("utf8")) as T;
+}
+
+function isAuthorized(req: http.IncomingMessage, token: string): boolean {
+	if (!token) return false;
+	return req.headers.authorization === `Bearer ${token}`;
+}
+
+function isTruthyEnv(value: string | undefined): boolean {
+	const normalized = value?.trim().toLowerCase();
+	return normalized === "1" || normalized === "true" || normalized === "yes";
+}
+
+function pickFiniteNumber(
+	value: unknown,
+	fallback: number,
+	options: { min?: number } = {},
+): number {
+	if (typeof value !== "number" || !Number.isFinite(value)) {
+		return fallback;
+	}
+	if (typeof options.min === "number" && value < options.min) {
+		return fallback;
+	}
+	return value;
+}
+
+export async function startDesktopTestBridgeServer(): Promise<
+	(() => void) | undefined
+> {
+	if (
+		!isTruthyEnv(process.env.ELIZA_DESKTOP_TEST_BRIDGE_ENABLED) &&
+		!process.env.ELIZA_DESKTOP_TEST_BRIDGE_PORT &&
+		!process.env.ELIZA_DESKTOP_TEST_BRIDGE_TOKEN
+	) {
+		return undefined;
+	}
+
+	const requestedPort =
+		Number.parseInt(
+			(process.env.ELIZA_DESKTOP_TEST_BRIDGE_PORT ?? "").trim(),
+			10,
+		) || DEFAULT_TEST_BRIDGE_PORT;
+	const port = await findFirstAvailableLoopbackPort(requestedPort, {
+		host: "127.0.0.1",
+		maxHops: 32,
+	});
+	const token =
+		process.env.ELIZA_DESKTOP_TEST_BRIDGE_TOKEN?.trim() ||
+		crypto.randomBytes(18).toString("hex");
+	const baseUrl = `http://127.0.0.1:${port}`;
+
+	process.env.ELIZA_DESKTOP_TEST_BRIDGE_URL = baseUrl;
+	process.env.ELIZA_DESKTOP_TEST_BRIDGE_TOKEN = token;
+
+	const server = http.createServer(async (req, res) => {
+		try {
+			if (!isLoopback(req.socket.remoteAddress)) {
+				json(res, 403, { error: "forbidden" });
+				return;
+			}
+			if (!isAuthorized(req, token)) {
+				json(res, 401, { error: "unauthorized" });
+				return;
+			}
+
+			const url = new URL(req.url ?? "/", "http://127.0.0.1");
+			const pathname = url.pathname;
+			const method = req.method ?? "GET";
+
+			if (pathname === "/health" && method === "GET") {
+				json(res, 200, { ok: true });
+				return;
+			}
+
+			if (pathname === "/state" && method === "GET") {
+				const shellState = await getDesktopManager().getShellDiagnosticsState();
+				json(res, 200, {
+					mainWindow: getCurrentMainWindowSnapshot(),
+					shell: shellState,
+				});
+				return;
+			}
+
+			if (pathname === "/main-window/eval" && method === "POST") {
+				const body = await readJsonBody<EvalBody>(req);
+				if (!body?.script?.trim()) {
+					json(res, 400, { error: "script is required" });
+					return;
+				}
+				json(res, 200, {
+					result: await evaluateInCurrentMainWindow(body.script),
+				});
+				return;
+			}
+
+			if (pathname === "/main-window/close" && method === "POST") {
+				const desktop = getDesktopManager();
+				const shellState = await desktop.getShellDiagnosticsState();
+				if (!shellState.mainWindowPresent) {
+					json(res, 503, { error: "main window is not available" });
+					return;
+				}
+				await desktop.closeWindow();
+				json(res, 200, { ok: true });
+				return;
+			}
+
+			if (pathname === "/main-window/bounds") {
+				const snapshot = getCurrentMainWindowSnapshot();
+				if (!snapshot.present) {
+					json(res, 503, { error: "main window is not available" });
+					return;
+				}
+
+				const desktop = getDesktopManager();
+				const currentBounds = await desktop.getWindowBounds();
+
+				if (method === "GET") {
+					json(res, 200, { bounds: currentBounds });
+					return;
+				}
+
+				if (method === "POST") {
+					const body = (await readJsonBody<BoundsBody>(req)) ?? {};
+					const nextBounds: WindowBounds = {
+						x: pickFiniteNumber(body.x, currentBounds.x),
+						y: pickFiniteNumber(body.y, currentBounds.y),
+						width: pickFiniteNumber(body.width, currentBounds.width, {
+							min: 1,
+						}),
+						height: pickFiniteNumber(body.height, currentBounds.height, {
+							min: 1,
+						}),
+					};
+					await desktop.setWindowBounds(nextBounds);
+					json(res, 200, {
+						bounds: await desktop.getWindowBounds(),
+					});
+					return;
+				}
+			}
+
+			if (pathname === "/main-window/screenshot" && method === "GET") {
+				const shot = await getScreenCaptureManager().takeScreenshot();
+				if (!shot.available || !shot.data) {
+					json(res, 503, { error: "screenshot unavailable" });
+					return;
+				}
+				json(res, 200, { data: shot.data });
+				return;
+			}
+
+			if (pathname === "/menu-action" && method === "POST") {
+				const body = await readJsonBody<MenuActionBody>(req);
+				const action = body?.action?.trim();
+				if (!action) {
+					json(res, 400, { error: "action is required" });
+					return;
+				}
+				const invoked = await invokeApplicationMenuAction(action);
+				json(
+					res,
+					invoked ? 200 : 503,
+					invoked
+						? { ok: true }
+						: { error: "application menu handler unavailable" },
+				);
+				return;
+			}
+
+			json(res, 404, { error: "not found" });
+		} catch (error) {
+			json(res, 500, {
+				error: error instanceof Error ? error.message : "internal error",
+			});
+		}
+	});
+
+	await new Promise<void>((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(port, "127.0.0.1", () => {
+			server.off("error", reject);
+			resolve();
+		});
+	});
+
+	console.log(`[DesktopTestBridge] ${baseUrl} (loopback only; token required)`);
+
+	return () => {
+		server.close();
+	};
+}

package/platforms/electrobun/src/devtools-layout.ts

@@ -0,0 +1,63 @@
+type WindowFrame = {
+	x: number;
+	y: number;
+	width: number;
+	height: number;
+};
+
+export type DevtoolsRefreshWindow = {
+	getFrame?: () => WindowFrame;
+	setFrame?: (x: number, y: number, width: number, height: number) => void;
+};
+
+export type ScheduleFn = (callback: () => void, delayMs: number) => unknown;
+
+const DEVTOOLS_LAYOUT_REFRESH_DELAYS_MS = [0, 32, 96, 220, 900] as const;
+
+/**
+ * WKWebView devtools can leave the main content inset/blank after dock/undock.
+ * Re-applying the current frame alone is sometimes a no-op, so briefly nudge
+ * the height by 1 px and then restore the original frame.
+ */
+export function scheduleDevtoolsLayoutRefresh(
+	window: DevtoolsRefreshWindow | null | undefined,
+	schedule: ScheduleFn = (callback, delayMs) => setTimeout(callback, delayMs),
+): void {
+	if (
+		!window ||
+		typeof window.getFrame !== "function" ||
+		typeof window.setFrame !== "function"
+	) {
+		return;
+	}
+
+	let originalFrame: WindowFrame;
+	try {
+		const frame = window.getFrame();
+		if (!frame) return;
+		originalFrame = frame;
+	} catch {
+		return;
+	}
+
+	for (const delayMs of DEVTOOLS_LAYOUT_REFRESH_DELAYS_MS) {
+		schedule(() => {
+			try {
+				const shouldNudge = delayMs === 32;
+				const nextHeight = shouldNudge
+					? Math.max(1, originalFrame.height - 1)
+					: originalFrame.height;
+				window.setFrame?.(
+					originalFrame.x,
+					originalFrame.y,
+					originalFrame.width,
+					nextHeight,
+				);
+			} catch {
+				// Devtools/layout refresh is best-effort only.
+			}
+		}, delayMs);
+	}
+}
+
+export { DEVTOOLS_LAYOUT_REFRESH_DELAYS_MS };

package/platforms/electrobun/src/diagnostic-format.ts

@@ -0,0 +1,65 @@
+/**
+ * Renderer diagnostic formatting and secret redaction.
+ *
+ * Extracted from rpc-handlers.ts so these functions can be unit-tested
+ * without pulling in Electrobun native bindings.
+ */
+
+/**
+ * Redact sensitive tokens from a URL string so API keys, auth tokens, and
+ * secrets in query parameters never reach the log file.
+ *
+ * Patterns matched:
+ *  - `?key=<value>&...` or `&key=<value>` for known param names
+ *  - `sk-*`, `ghp_*`, `xox*` tokens anywhere in the string
+ */
+export function redactDiagnosticUrl(url: string): string {
+	let redacted = url.replace(
+		/([?&])(api[_-]?key|key|token|secret|access[_-]?token|authorization|auth|password|credential|client[_-]?secret)=([^&#]+)/gi,
+		"$1$2=[redacted]",
+	);
+	redacted = redacted.replace(
+		/\b(sk-[A-Za-z0-9_-]{20,}|ghp_[A-Za-z0-9]{36,}|gho_[A-Za-z0-9]{36,}|xox[bsrp]-[A-Za-z0-9-]+)\b/g,
+		"[redacted-token]",
+	);
+	return redacted;
+}
+
+/**
+ * Deep-walk a details object and redact any string value that looks like a URL
+ * containing sensitive query params or token patterns. Returns a new object
+ * (original is never mutated).
+ */
+export function redactDetailsSecrets(details: unknown): unknown {
+	if (typeof details === "string") {
+		return redactDiagnosticUrl(details);
+	}
+	if (Array.isArray(details)) {
+		return details.map(redactDetailsSecrets);
+	}
+	if (details && typeof details === "object") {
+		const out: Record<string, unknown> = {};
+		for (const [key, value] of Object.entries(details)) {
+			out[key] = typeof value === "string" ? redactDiagnosticUrl(value) : value;
+		}
+		return out;
+	}
+	return details;
+}
+
+export function formatRendererDiagnosticLine(
+	params?: {
+		source?: string;
+		message?: string;
+		details?: unknown;
+	} | null,
+): string {
+	const source = params?.source ?? "renderer";
+	const message = params?.message?.trim() || "(no message)";
+	const redactedDetails = redactDetailsSecrets(params?.details);
+	const details =
+		typeof redactedDetails === "undefined"
+			? ""
+			: ` ${JSON.stringify(redactedDetails)}`;
+	return `[Renderer:${source}] ${message}${details}`;
+}

package/platforms/electrobun/src/fatal-shutdown.test.ts

@@ -0,0 +1,30 @@
+import { Utils } from "electrobun/bun";
+import { describe, expect, it, vi } from "vitest";
+import { shutdownAfterFatalError } from "./fatal-shutdown";
+
+vi.mock("electrobun/bun", () => ({
+	Utils: {
+		quit: vi.fn(),
+	},
+}));
+
+// Rule (electrobun.md:601-610):
+//   Don't use process.exit() for shutdown — use Utils.quit() for graceful
+//   shutdown with CEF cleanup.
+//
+// Current code (src/fatal-shutdown.ts):
+//   export function shutdownAfterFatalError(): void {
+//     process.exit(1);
+//   }
+
+describe("fatal startup shutdown", () => {
+	it("does not call process.exit()", () => {
+		const processExitSpy = vi.spyOn(process, "exit");
+
+		shutdownAfterFatalError();
+
+		// RED: currently calls process.exit(1) — should call Utils.quit()
+		expect(processExitSpy).not.toHaveBeenCalled();
+		expect(Utils.quit).toHaveBeenCalledOnce();
+	});
+});

package/platforms/electrobun/src/fatal-shutdown.ts

@@ -0,0 +1,10 @@
+/**
+ * Called after shutdown cleanup completes in the fatal startup error path.
+ * Must use Utils.quit() — not process.exit() — so CEF/native destructors
+ * run to completion.
+ */
+import { Utils } from "electrobun/bun";
+
+export function shutdownAfterFatalError(): void {
+	Utils.quit();
+}