@elizaos/app-core 2.0.0-beta.3 → 2.0.3-beta.2

package/services/coding-account-bridge.js

@@ -0,0 +1,267 @@
+/**
+ * Coding-agent account-selector bridge.
+ *
+ * The orchestrator plugin (`@elizaos/plugin-agent-orchestrator`) spawns Claude
+ * Code / Codex / OpenCode sub-agents but depends only on `@elizaos/core` — it
+ * cannot import the `AccountPool` or the credential store. So, exactly like the
+ * Anthropic and subscription-selector bridges in `account-pool.ts`, we publish a
+ * narrow contract on a `globalThis` symbol that the plugin reads at spawn time.
+ *
+ * Responsibilities:
+ *  - Map a coding-agent type ("claude" / "codex" / …) to its candidate provider
+ *    ids and pick one account from the pool (default `least-used`).
+ *  - Resolve that account's credential and return the env vars the spawned
+ *    coding-agent subprocess needs to authenticate AS THAT ACCOUNT:
+ *      claude  → `CLAUDE_CODE_OAUTH_TOKEN`
+ *      codex   → a per-account `CODEX_HOME` dir holding an `auth.json`
+ *      *-api   → the provider's direct API-key env var
+ *  - Record usage + health back into the pool keyed by the serving account.
+ *
+ * Subscription tokens only ever leave this layer to flow into the first-party
+ * coding subprocess (which IS Claude Code / Codex) — never into the runtime's
+ * own `process.env`. That respects the providers' TOS the same way
+ * `applySubscriptionCredentialsLocal` does.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { loadAccount } from "@elizaos/agent/auth/account-storage";
+import { getAccessToken } from "@elizaos/agent/auth/credentials";
+import { DIRECT_ACCOUNT_PROVIDER_ENV, isSubscriptionProvider, } from "@elizaos/agent/auth/types";
+import { writeJsonAtomicSync } from "@elizaos/agent/utils/atomic-json";
+import { logger, resolveStateDir } from "@elizaos/core";
+const CODING_AGENT_SELECTOR_BRIDGE_SYMBOL = Symbol.for("eliza.account-pool.coding-agent.v1");
+const VALID_CODING_STRATEGIES = new Set([
+    "priority",
+    "round-robin",
+    "least-used",
+    "quota-aware",
+]);
+/** Default selection strategy — overridable via ELIZA_CODING_ACCOUNT_STRATEGY env var. */
+function getDefaultCodingStrategy() {
+    const env = typeof process !== "undefined"
+        ? process.env.ELIZA_CODING_ACCOUNT_STRATEGY?.trim()
+        : undefined;
+    if (!env)
+        return "least-used";
+    if (VALID_CODING_STRATEGIES.has(env))
+        return env;
+    logger.warn(`[coding-account-bridge] ignoring invalid ELIZA_CODING_ACCOUNT_STRATEGY=${JSON.stringify(env)}; using least-used`);
+    return "least-used";
+}
+/**
+ * Ordered provider candidates per coding-agent type. The first provider with an
+ * eligible account wins; a subscription provider is preferred over its direct
+ * API equivalent (subscriptions are the primary use case here).
+ *
+ * claude (claude-agent-acp) and codex (codex-acp) are first-party CLIs.
+ * opencode authenticates through its configured backend; the only backend it
+ * resolves from a pooled key is Cerebras (`CEREBRAS_API_KEY`, see
+ * buildOpencodeSpawnConfig), so opencode pool-rotates across `cerebras-api`
+ * accounts and no-ops otherwise. z.ai / Kimi / GLM have no first-party coding
+ * CLI — their accounts serve the main runtime's API-key routing — so they are
+ * deliberately absent (advertising them would offer an unspawnable path).
+ */
+const AGENT_PROVIDER_CANDIDATES = {
+    claude: ["anthropic-subscription", "anthropic-api"],
+    codex: ["openai-codex", "openai-api"],
+    opencode: ["cerebras-api"],
+};
+function candidatesFor(agentType) {
+    return AGENT_PROVIDER_CANDIDATES[agentType.toLowerCase()] ?? [];
+}
+/**
+ * Whether a token-resolve failure is a genuine auth problem (→ needs-reauth)
+ * vs a transient network/5xx blip. A transient failure must NOT sideline a
+ * healthy account — that would exclude it from the pool until the next
+ * keep-alive sweep (~5 min). `undefined` (getAccessToken returned null without
+ * throwing) means no credential is present at all → genuine needs-reauth.
+ */
+const AUTH_FAILURE_PATTERN = /\b(40[13]|invalid[_ ]?grant|invalid[_ ]?token|unauthor|forbidden|re-?auth|revoked|expired)\b/i;
+export function isAuthFailure(err) {
+    if (err === undefined)
+        return true;
+    const msg = err instanceof Error ? err.message : String(err);
+    return AUTH_FAILURE_PATTERN.test(msg);
+}
+function codexHomeDir(accountId) {
+    return path.join(process.env.ELIZA_HOME || resolveStateDir(), "auth", "_codex-home", accountId);
+}
+/**
+ * Materialize a per-account `CODEX_HOME` so Codex authenticates as the selected
+ * account instead of the machine's single `~/.codex` login. Writes the
+ * ChatGPT-login `auth.json` shape Codex reads; the account_id is the OAuth
+ * account id baked into the credential record (`organizationId`).
+ */
+function materializeCodexHome(accountId, accessToken) {
+    const dir = codexHomeDir(accountId);
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    const record = loadAccount("openai-codex", accountId);
+    const refreshToken = record?.credentials.refresh ?? "";
+    const chatgptAccountId = record?.organizationId;
+    // Codex's chatgpt-mode auth loader requires `tokens.id_token`; omitting it
+    // fails with "Authentication required" even when access_token is valid (an
+    // expired id_token is tolerated — Codex refreshes — but it must be present).
+    const idToken = record?.credentials.idToken;
+    const authJson = {
+        auth_mode: "chatgpt",
+        OPENAI_API_KEY: null,
+        tokens: {
+            ...(idToken ? { id_token: idToken } : {}),
+            access_token: accessToken,
+            refresh_token: refreshToken,
+            ...(chatgptAccountId ? { account_id: chatgptAccountId } : {}),
+        },
+        last_refresh: new Date().toISOString(),
+    };
+    writeJsonAtomicSync(path.join(dir, "auth.json"), authJson);
+    // Codex reads its model from CODEX_HOME/config.toml; with none, codex-acp
+    // falls back to a built-in default (e.g. gpt-5.3-codex) that ChatGPT-account
+    // auth rejects ("model is not supported when using Codex with a ChatGPT
+    // account"). Write a MINIMAL config.toml with just the model — reusing the
+    // operator's working model (extracted from ~/.codex/config.toml) but NOT the
+    // rest of their config, which can carry fields the pinned codex-acp rejects
+    // (e.g. newer reasoning-effort variants). Falls back to a compatible default.
+    const targetConfig = path.join(dir, "config.toml");
+    try {
+        let model = process.env.ELIZA_CODEX_MODEL?.trim();
+        // Validate the operator-supplied model: it is interpolated into TOML, so a
+        // stray quote/newline would break out of the string (corrupt config) — and
+        // a model name is a conservative token anyway. Reject anything else.
+        if (model && !/^[\w.:/-]+$/.test(model)) {
+            logger.warn(`[coding-account-bridge] ignoring malformed ELIZA_CODEX_MODEL=${JSON.stringify(model)}`);
+            model = undefined;
+        }
+        if (!model) {
+            const machineConfig = path.join(os.homedir(), ".codex", "config.toml");
+            if (existsSync(machineConfig)) {
+                // Accept both double- and single-quoted TOML strings (both are valid +
+                // common); the captured value can't contain the quote char so it's
+                // safe to re-emit double-quoted.
+                const m = readFileSync(machineConfig, "utf-8").match(/^\s*model\s*=\s*["']([^"']+)["']/m);
+                if (m?.[1])
+                    model = m[1];
+            }
+        }
+        writeFileSync(targetConfig, `model = "${model || "gpt-5.1-codex"}"\n`, {
+            mode: 0o600,
+        });
+    }
+    catch (err) {
+        logger.warn(`[coding-account-bridge] could not materialize codex config.toml: ${String(err)}`);
+    }
+    return dir;
+}
+async function buildEnvPatch(providerId, accountId, accessToken) {
+    switch (providerId) {
+        case "anthropic-subscription":
+            return { CLAUDE_CODE_OAUTH_TOKEN: accessToken };
+        case "openai-codex":
+            return { CODEX_HOME: materializeCodexHome(accountId, accessToken) };
+        default: {
+            // Direct API providers (e.g. cerebras-api → CEREBRAS_API_KEY for opencode)
+            // inject under their canonical env key; run-main.ts normalizes aliases
+            // (Z_AI_API_KEY → ZAI_API_KEY, KIMI_API_KEY → MOONSHOT_API_KEY).
+            const envKey = DIRECT_ACCOUNT_PROVIDER_ENV[providerId];
+            return envKey ? { [envKey]: accessToken } : {};
+        }
+    }
+}
+function makeBridge(pool) {
+    return {
+        describe() {
+            const out = {};
+            for (const [agentType, providers] of Object.entries(AGENT_PROVIDER_CANDIDATES)) {
+                out[agentType] = providers.map((providerId) => {
+                    const accounts = pool.list(providerId);
+                    return {
+                        providerId,
+                        total: accounts.length,
+                        enabled: accounts.filter((a) => a.enabled).length,
+                        healthy: accounts.filter((a) => a.enabled && a.health === "ok")
+                            .length,
+                    };
+                });
+            }
+            return out;
+        },
+        async select(agentType, opts) {
+            const candidates = candidatesFor(agentType);
+            if (candidates.length === 0)
+                return null;
+            const strategy = opts?.strategy ?? getDefaultCodingStrategy();
+            for (const providerId of candidates) {
+                const account = await pool.select({
+                    providerId,
+                    strategy,
+                    ...(opts?.sessionKey ? { sessionKey: opts.sessionKey } : {}),
+                    ...(opts?.exclude ? { exclude: opts.exclude } : {}),
+                });
+                if (!account)
+                    continue;
+                let accessToken = null;
+                let resolveError;
+                try {
+                    accessToken = await getAccessToken(providerId, account.id);
+                }
+                catch (err) {
+                    resolveError = err;
+                    logger.warn(`[coding-account-bridge] token resolve failed for ${providerId}/${account.id}: ${String(err)}`);
+                }
+                if (!accessToken) {
+                    // Only flag for re-auth on a genuine auth failure; a transient
+                    // network/5xx blip must not pull a healthy account out of rotation.
+                    if (isAuthFailure(resolveError)) {
+                        await pool.markNeedsReauth(account.id, "No valid credential / token refresh failed", { providerId });
+                    }
+                    continue;
+                }
+                const envPatch = await buildEnvPatch(providerId, account.id, accessToken);
+                if (Object.keys(envPatch).length === 0)
+                    continue;
+                const source = isSubscriptionProvider(providerId)
+                    ? "oauth"
+                    : "api-key";
+                logger.info(`[coding-account-bridge] ${agentType} → ${providerId} account "${account.label}" (${account.id}) via ${strategy}`);
+                return {
+                    providerId,
+                    accountId: account.id,
+                    label: account.label,
+                    source,
+                    strategy,
+                    ...(account.usage ? { usage: account.usage } : {}),
+                    envPatch,
+                };
+            }
+            return null;
+        },
+        markRateLimited(providerId, accountId, untilMs, detail) {
+            return pool.markRateLimited(accountId, untilMs, detail, { providerId });
+        },
+        markNeedsReauth(providerId, accountId, detail) {
+            return pool.markNeedsReauth(accountId, detail, { providerId });
+        },
+        recordUsage(providerId, accountId, result) {
+            return pool.recordCall(accountId, result, { providerId });
+        },
+    };
+}
+/**
+ * Install the coding-agent selector bridge on `globalThis`. Idempotent — called
+ * from `getDefaultAccountPool()` so it is present before the first spawn.
+ */
+export function installCodingAgentSelectorBridge(pool) {
+    if (typeof globalThis === "undefined")
+        return;
+    globalThis[CODING_AGENT_SELECTOR_BRIDGE_SYMBOL] =
+        makeBridge(pool);
+}
+/** Read the installed bridge (null when no pool has been constructed yet). */
+export function getCodingAgentSelectorBridge() {
+    if (typeof globalThis === "undefined")
+        return null;
+    const bridge = globalThis[CODING_AGENT_SELECTOR_BRIDGE_SYMBOL];
+    return bridge ?? null;
+}

package/services/connector-target-catalog.d.ts

@@ -4,9 +4,9 @@
  * quick-pick servers, channels, recipients, and chats without making the
  * end-user paste raw IDs.
  *
- * Discord is the only wired source in slice 2. Slack, Telegram, and Gmail
- * are placeholders so the host can stack them onto this framework without
- * a route or UI rewrite.
+ * Discord is the wired source in this catalog. Slack, Telegram, and Gmail keep
+ * typed config slots so host integrations can add enumerators without a route
+ * or UI rewrite.
  *
  * The Discord enumeration shares its 5-minute REST cache with the workflow
  * runtime-context provider when the host wires both with the same
@@ -36,6 +36,13 @@ export interface ListGroupsOptions {
 }
 export interface ConnectorTargetCatalog {
     listGroups(opts?: ListGroupsOptions): Promise<TargetGroup[]>;
+    /**
+     * No-op lifecycle hook so the runtime service-stop loop (core/runtime.ts)
+     * does not warn "Service instance is missing stop(); skipping" on every
+     * restart. The catalog holds no own resources — its Discord REST cache is
+     * owned by the shared `discordCache` passed in by the host.
+     */
+    stop(): Promise<void>;
 }
 /**
  * Subset of the host config the catalog reads. Mirrors the runtime-context

package/services/connector-target-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connector-target-catalog.d.ts","sourceRoot":"","sources":["../../../../../src/services/connector-target-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EAEzB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;CAC9D;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAChD,QAAQ,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACpD,KAAK,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC9C,KAAK,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrD,CAAC;CACH;AAED,MAAM,WAAW,kCAAkC;IACjD,yEAAyE;IACzE,SAAS,EAAE,MAAM,mBAAmB,CAAC;IACrC,+CAA+C;IAC/C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,oEAAoE;IACpE,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,sCAAsC;IACtC,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAED,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,kCAAkC,GAC1C,sBAAsB,CAqDxB"}
+{"version":3,"file":"connector-target-catalog.d.ts","sourceRoot":"","sources":["../../../../../src/services/connector-target-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EAEzB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7D;;;;;OAKG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAChD,QAAQ,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACpD,KAAK,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC9C,KAAK,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrD,CAAC;CACH;AAED,MAAM,WAAW,kCAAkC;IACjD,yEAAyE;IACzE,SAAS,EAAE,MAAM,mBAAmB,CAAC;IACrC,+CAA+C;IAC/C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,oEAAoE;IACpE,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,sCAAsC;IACtC,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAED,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,kCAAkC,GAC1C,sBAAsB,CAwDxB"}

package/services/connector-target-catalog.js

@@ -4,16 +4,16 @@
  * quick-pick servers, channels, recipients, and chats without making the
  * end-user paste raw IDs.
  *
- * Discord is the only wired source in slice 2. Slack, Telegram, and Gmail
- * are placeholders so the host can stack them onto this framework without
- * a route or UI rewrite.
+ * Discord is the wired source in this catalog. Slack, Telegram, and Gmail keep
+ * typed config slots so host integrations can add enumerators without a route
+ * or UI rewrite.
  *
  * The Discord enumeration shares its 5-minute REST cache with the workflow
  * runtime-context provider when the host wires both with the same
  * `discordCache` instance — a "generate" call that already primed the
  * runtime-context cache pays no extra REST cost when the user picks.
  */
-import { createDiscordSourceCache, fetchDiscordEnumeration, } from "./discord-target-source";
+import { createDiscordSourceCache, fetchDiscordEnumeration, } from "./discord-target-source.js";
 export function createElizaConnectorTargetCatalog(options) {
     const fetchImpl = options.fetchImpl ?? fetch;
     const now = options.now ?? Date.now;
@@ -60,5 +60,8 @@ export function createElizaConnectorTargetCatalog(options) {
             // back to a free-text input when no catalog entries are available.
             return all;
         },
+        async stop() {
+            // No own resources; the shared discordCache is host-owned.
+        },
     };
 }

package/services/credential-tunnel-service.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Credential tunnel service — parent-side scoped credential delivery.
+ *
+ * When a spawned coding sub-agent needs a credential it cannot see (e.g.
+ * `OPENAI_API_KEY` for a task that requires hitting the OpenAI API), the
+ * orchestrator declares a *scope* on the parent runtime: a short-lived,
+ * single-use bearer token that names exactly which keys the child is allowed
+ * to pull. The parent's owner-only sensitive-request flow then collects the
+ * value(s) from the user, encrypts each one with the scope's symmetric key
+ * (AES-256-GCM), and the child redeems via the bridge HTTP endpoint by
+ * presenting the bearer token. The ciphertext is deleted on redemption.
+ *
+ * Threat model:
+ *   - Only `sha256(scopedToken)` is stored, so a memory snapshot of this
+ *     process cannot reveal the bearer token.
+ *   - Each scope has a 30-minute TTL.
+ *   - One-shot per key: on first retrieve, the ciphertext is wiped and the
+ *     key state is marked redeemed. A second retrieve rejects with
+ *     `already_redeemed`.
+ *   - Tunneling a key not pre-declared at scope creation is rejected.
+ *   - The childSessionId is checked on both tunnel and retrieve.
+ *
+ * Crypto: AES-256-GCM with a per-tunnel random 12-byte IV. The auth tag is
+ * appended to the ciphertext for transport. Only `node:crypto`.
+ *
+ * Logs intentionally exclude scoped tokens, ciphertexts, and credential
+ * values. Only the scope id, child session id, and key names are logged.
+ */
+export interface DeclareScopeInput {
+    childSessionId: string;
+    credentialKeys: readonly string[];
+}
+export interface DeclareScopeResult {
+    credentialScopeId: string;
+    scopedToken: string;
+    /** epoch ms */
+    expiresAt: number;
+}
+export interface TunnelCredentialInput {
+    childSessionId: string;
+    credentialScopeId: string;
+    key: string;
+    value: string;
+}
+export interface RetrieveCredentialInput {
+    childSessionId: string;
+    key: string;
+    scopedToken: string;
+}
+export declare class CredentialScopeError extends Error {
+    readonly code: "invalid_input" | "unknown_scope" | "scope_expired" | "session_mismatch" | "key_not_in_scope" | "already_redeemed" | "no_ciphertext" | "invalid_token";
+    constructor(code: "invalid_input" | "unknown_scope" | "scope_expired" | "session_mismatch" | "key_not_in_scope" | "already_redeemed" | "no_ciphertext" | "invalid_token", message: string);
+}
+export interface CredentialTunnelService {
+    declareScope(input: DeclareScopeInput): DeclareScopeResult;
+    tunnelCredential(input: TunnelCredentialInput): void;
+    retrieveCredential(input: RetrieveCredentialInput): string;
+    expireScopes(now?: number): number;
+    /** Test-only: peek at whether a scope still has ciphertext for a key. */
+    hasCiphertext(credentialScopeId: string, key: string): boolean;
+}
+export declare function createCredentialTunnelService(options?: {
+    ttlMs?: number;
+    now?: () => number;
+}): CredentialTunnelService;
+//# sourceMappingURL=credential-tunnel-service.d.ts.map

package/services/credential-tunnel-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-tunnel-service.d.ts","sourceRoot":"","sources":["../../../../../src/services/credential-tunnel-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAcH,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;CACrB;AAkBD,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,IAAI,EACT,eAAe,GACf,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,eAAe,GACf,eAAe;gBARV,IAAI,EACT,eAAe,GACf,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,eAAe,GACf,eAAe,EACnB,OAAO,EAAE,MAAM;CAKlB;AAiCD,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,CAAC;IAC3D,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACrD,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAAC;IAC3D,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,yEAAyE;IACzE,aAAa,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAChE;AAED,wBAAgB,6BAA6B,CAAC,OAAO,CAAC,EAAE;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,uBAAuB,CAsN1B"}

package/services/credential-tunnel-service.js

@@ -0,0 +1,227 @@
+/**
+ * Credential tunnel service — parent-side scoped credential delivery.
+ *
+ * When a spawned coding sub-agent needs a credential it cannot see (e.g.
+ * `OPENAI_API_KEY` for a task that requires hitting the OpenAI API), the
+ * orchestrator declares a *scope* on the parent runtime: a short-lived,
+ * single-use bearer token that names exactly which keys the child is allowed
+ * to pull. The parent's owner-only sensitive-request flow then collects the
+ * value(s) from the user, encrypts each one with the scope's symmetric key
+ * (AES-256-GCM), and the child redeems via the bridge HTTP endpoint by
+ * presenting the bearer token. The ciphertext is deleted on redemption.
+ *
+ * Threat model:
+ *   - Only `sha256(scopedToken)` is stored, so a memory snapshot of this
+ *     process cannot reveal the bearer token.
+ *   - Each scope has a 30-minute TTL.
+ *   - One-shot per key: on first retrieve, the ciphertext is wiped and the
+ *     key state is marked redeemed. A second retrieve rejects with
+ *     `already_redeemed`.
+ *   - Tunneling a key not pre-declared at scope creation is rejected.
+ *   - The childSessionId is checked on both tunnel and retrieve.
+ *
+ * Crypto: AES-256-GCM with a per-tunnel random 12-byte IV. The auth tag is
+ * appended to the ciphertext for transport. Only `node:crypto`.
+ *
+ * Logs intentionally exclude scoped tokens, ciphertexts, and credential
+ * values. Only the scope id, child session id, and key names are logged.
+ */
+import { createCipheriv, createDecipheriv, createHash, randomBytes, } from "node:crypto";
+const TOKEN_BYTES = 32; // 256-bit
+const IV_BYTES = 12;
+const AUTH_TAG_BYTES = 16;
+const SCOPE_TTL_MS = 30 * 60 * 1000;
+export class CredentialScopeError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "CredentialScopeError";
+    }
+}
+function sha256(input) {
+    return createHash("sha256").update(input).digest();
+}
+function encrypt(value, key) {
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv("aes-256-gcm", key, iv);
+    const ciphertext = Buffer.concat([
+        cipher.update(value, "utf8"),
+        cipher.final(),
+    ]);
+    const authTag = cipher.getAuthTag();
+    return Buffer.concat([iv, ciphertext, authTag]).toString("hex");
+}
+function decrypt(encryptedHex, key) {
+    const buf = Buffer.from(encryptedHex, "hex");
+    if (buf.length < IV_BYTES + AUTH_TAG_BYTES + 1) {
+        throw new Error("ciphertext_too_short");
+    }
+    const iv = buf.subarray(0, IV_BYTES);
+    const authTag = buf.subarray(buf.length - AUTH_TAG_BYTES);
+    const ciphertext = buf.subarray(IV_BYTES, buf.length - AUTH_TAG_BYTES);
+    const decipher = createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(authTag);
+    return Buffer.concat([
+        decipher.update(ciphertext),
+        decipher.final(),
+    ]).toString("utf8");
+}
+export function createCredentialTunnelService(options) {
+    const ttlMs = options?.ttlMs ?? SCOPE_TTL_MS;
+    const now = options?.now ?? (() => Date.now());
+    // Primary index: sha256(scopedToken) hex → scope. The plaintext token is
+    // never persisted in this process.
+    const byTokenHash = new Map();
+    // Secondary index: scope id → scope. Used by tunnelCredential which only
+    // has the scope id (the orchestrator that issued the token is the one
+    // calling tunnel; it identifies the scope by id, not by re-presenting the
+    // bearer token).
+    const byId = new Map();
+    function dropScope(entry) {
+        byTokenHash.delete(entry.scopedTokenHash);
+        byId.delete(entry.credentialScopeId);
+    }
+    function expiredAndDropped(entry, currentTime) {
+        if (entry.expiresAt <= currentTime) {
+            dropScope(entry);
+            return true;
+        }
+        return false;
+    }
+    return {
+        declareScope({ childSessionId, credentialKeys }) {
+            if (typeof childSessionId !== "string" ||
+                childSessionId.trim().length === 0) {
+                throw new CredentialScopeError("invalid_input", "childSessionId is required");
+            }
+            if (!Array.isArray(credentialKeys) || credentialKeys.length === 0) {
+                throw new CredentialScopeError("invalid_input", "credentialKeys must be a non-empty array");
+            }
+            const normalized = new Set();
+            for (const raw of credentialKeys) {
+                if (typeof raw !== "string" || raw.trim().length === 0) {
+                    throw new CredentialScopeError("invalid_input", "credentialKeys entries must be non-empty strings");
+                }
+                normalized.add(raw.trim());
+            }
+            const tokenBytes = randomBytes(TOKEN_BYTES);
+            const scopedToken = tokenBytes.toString("hex");
+            const scopedTokenHash = sha256(tokenBytes).toString("hex");
+            // The encryption key is sha256(token). Derived deterministically from
+            // the bearer token, but kept on the scope entry so that
+            // `tunnelCredential` (which does not see the token) can still encrypt.
+            // Anyone who can read this Map already has memory access to the
+            // ciphertexts, so colocating the key with the scope entry does not
+            // weaken the threat model: the token hash is what gates retrieval.
+            const encryptionKey = sha256(tokenBytes);
+            const credentialScopeId = `cred_scope_${randomBytes(8).toString("hex")}`;
+            const expiresAt = now() + ttlMs;
+            const keys = new Map();
+            for (const key of normalized) {
+                keys.set(key, { encrypted: null, redeemed: false });
+            }
+            const entry = {
+                credentialScopeId,
+                childSessionId: childSessionId.trim(),
+                scopedTokenHash,
+                encryptionKey,
+                expiresAt,
+                keys,
+            };
+            byTokenHash.set(scopedTokenHash, entry);
+            byId.set(credentialScopeId, entry);
+            return { credentialScopeId, scopedToken, expiresAt };
+        },
+        tunnelCredential({ childSessionId, credentialScopeId, key, value }) {
+            if (typeof value !== "string" || value.length === 0) {
+                throw new CredentialScopeError("invalid_input", "value must be a non-empty string");
+            }
+            const entry = byId.get(credentialScopeId);
+            if (!entry) {
+                throw new CredentialScopeError("unknown_scope", "credentialScopeId not found");
+            }
+            if (expiredAndDropped(entry, now())) {
+                throw new CredentialScopeError("scope_expired", "scope expired");
+            }
+            if (entry.childSessionId !== childSessionId) {
+                throw new CredentialScopeError("session_mismatch", "childSessionId does not match scope owner");
+            }
+            const state = entry.keys.get(key);
+            if (!state) {
+                throw new CredentialScopeError("key_not_in_scope", `key ${key} not declared in scope`);
+            }
+            if (state.redeemed) {
+                throw new CredentialScopeError("already_redeemed", `key ${key} already redeemed`);
+            }
+            state.encrypted = encrypt(value, entry.encryptionKey);
+        },
+        retrieveCredential({ childSessionId, key, scopedToken }) {
+            if (typeof scopedToken !== "string" || scopedToken.length === 0) {
+                throw new CredentialScopeError("invalid_token", "scopedToken is required");
+            }
+            let tokenBytes;
+            try {
+                tokenBytes = Buffer.from(scopedToken, "hex");
+            }
+            catch {
+                throw new CredentialScopeError("invalid_token", "scopedToken invalid");
+            }
+            if (tokenBytes.length !== TOKEN_BYTES) {
+                throw new CredentialScopeError("invalid_token", "scopedToken length invalid");
+            }
+            const tokenHash = sha256(tokenBytes).toString("hex");
+            const entry = byTokenHash.get(tokenHash);
+            if (!entry) {
+                throw new CredentialScopeError("invalid_token", "scopedToken does not match a known scope");
+            }
+            if (expiredAndDropped(entry, now())) {
+                throw new CredentialScopeError("scope_expired", "scope expired");
+            }
+            if (entry.childSessionId !== childSessionId) {
+                throw new CredentialScopeError("session_mismatch", "childSessionId does not match scope owner");
+            }
+            const state = entry.keys.get(key);
+            if (!state) {
+                throw new CredentialScopeError("key_not_in_scope", `key ${key} not in scope`);
+            }
+            if (state.redeemed) {
+                throw new CredentialScopeError("already_redeemed", `key ${key} already redeemed`);
+            }
+            if (!state.encrypted) {
+                throw new CredentialScopeError("no_ciphertext", `no value tunneled for ${key} yet`);
+            }
+            const plaintext = decrypt(state.encrypted, entry.encryptionKey);
+            state.encrypted = null;
+            state.redeemed = true;
+            // If every declared key has been redeemed, drop the scope so the
+            // bearer token cannot be reused.
+            let allRedeemed = true;
+            for (const v of entry.keys.values()) {
+                if (!v.redeemed) {
+                    allRedeemed = false;
+                    break;
+                }
+            }
+            if (allRedeemed)
+                dropScope(entry);
+            return plaintext;
+        },
+        expireScopes(currentTime = now()) {
+            let swept = 0;
+            for (const entry of [...byTokenHash.values()]) {
+                if (entry.expiresAt <= currentTime) {
+                    dropScope(entry);
+                    swept += 1;
+                }
+            }
+            return swept;
+        },
+        hasCiphertext(credentialScopeId, key) {
+            const entry = byId.get(credentialScopeId);
+            if (!entry)
+                return false;
+            return entry.keys.get(key)?.encrypted != null;
+        },
+    };
+}

package/services/github-credentials.d.ts

@@ -14,7 +14,7 @@
  * rest is a deliberately separate concern and would land in a follow-up.
  *
  * Cloud users (Eliza Cloud session active) are out of scope here — they
- * use the `platformCredentials` table in `cloud/packages/db/schemas/` via
+ * use the `platformCredentials` table in `packages/cloud-shared/src/db/schemas/` via
  * the dedicated OAuth flow. This module is the local-first surface only.
  */
 export interface GitHubCredentials {

package/services/github-credentials.js

@@ -14,7 +14,7 @@
  * rest is a deliberately separate concern and would land in a follow-up.
  *
  * Cloud users (Eliza Cloud session active) are out of scope here — they
- * use the `platformCredentials` table in `cloud/packages/db/schemas/` via
+ * use the `platformCredentials` table in `packages/cloud-shared/src/db/schemas/` via
  * the dedicated OAuth flow. This module is the local-first surface only.
  */
 import fs from "node:fs/promises";