@elizaos/app-core 2.0.0-beta.3 → 2.0.3-beta.3

package/api/automations-compat-routes.js

@@ -15,8 +15,8 @@
 import { loadElizaConfig } from "@elizaos/agent";
 import { stringToUuid } from "@elizaos/core";
 import { ensureRouteAuthorized } from "./auth.js";
-import { listAutomationNodeContributors } from "./automation-node-contributors";
-import { sendJsonError as sendJsonErrorResponse, sendJson as sendJsonResponse, } from "./response";
+import { listAutomationNodeContributors } from "./automation-node-contributors.js";
+import { sendJsonError as sendJsonErrorResponse, sendJson as sendJsonResponse, } from "./response.js";
 const BLOCKED_AUTOMATION_PROVIDER_NODES = new Set([
     "recent-conversations",
     "relevant-conversations",
@@ -150,7 +150,7 @@ function normalizeCapabilityName(value) {
 }
 function getRuntimeActionCapabilityNames(runtime) {
     const names = new Set();
-    for (const action of runtime.actions) {
+    for (const action of runtime.actions ?? []) {
         names.add(normalizeCapabilityName(action.name));
         for (const simile of action.similes ?? []) {
             names.add(normalizeCapabilityName(simile));
@@ -193,7 +193,7 @@ async function buildAutomationNodeCatalog(state) {
     const config = loadElizaConfig();
     const agentName = resolveAgentName(runtime, config);
     const adminEntityId = resolveAdminEntityId(config, agentName);
-    const runtimeActionNodes = runtime.actions
+    const runtimeActionNodes = (runtime.actions ?? [])
         .slice()
         .sort((left, right) => left.name.localeCompare(right.name))
         .map((action) => ({
@@ -211,7 +211,7 @@ async function buildAutomationNodeCatalog(state) {
         requiresSetup: false,
         availability: "enabled",
     }));
-    const runtimeProviderNodes = runtime.providers
+    const runtimeProviderNodes = (runtime.providers ?? [])
         .slice()
         .filter((provider) => !BLOCKED_AUTOMATION_PROVIDER_NODES.has(provider.name))
         .sort((left, right) => left.name.localeCompare(right.name))

package/api/background-tasks-routes.d.ts

@@ -0,0 +1,4 @@
+import type http from "node:http";
+import type { CompatRuntimeState } from "./compat-route-shared.js";
+export declare function handleBackgroundTasksRoute(req: http.IncomingMessage, res: http.ServerResponse, state: CompatRuntimeState): Promise<boolean>;
+//# sourceMappingURL=background-tasks-routes.d.ts.map

package/api/background-tasks-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"background-tasks-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/background-tasks-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAmChE,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CA4ClB"}

package/api/background-tasks-routes.js

@@ -0,0 +1,63 @@
+import { ServiceType } from "@elizaos/core";
+import { ensureRouteAuthorized } from "./auth.js";
+import { sendJson } from "./response.js";
+function isTaskServiceLike(service) {
+    return (service !== null &&
+        typeof Reflect.get(service, "runDueTasks") === "function");
+}
+let runDueTasksInFlight = null;
+async function runDueTasksOnce(service) {
+    if (runDueTasksInFlight !== null) {
+        await runDueTasksInFlight;
+        return { coalesced: true };
+    }
+    runDueTasksInFlight = service.runDueTasks();
+    try {
+        await runDueTasksInFlight;
+        return { coalesced: false };
+    }
+    finally {
+        runDueTasksInFlight = null;
+    }
+}
+export async function handleBackgroundTasksRoute(req, res, state) {
+    const method = (req.method ?? "GET").toUpperCase();
+    const url = new URL(req.url ?? "/", "http://localhost");
+    if (method !== "POST" || url.pathname !== "/api/background/run-due-tasks") {
+        return false;
+    }
+    if (!(await ensureRouteAuthorized(req, res, state))) {
+        return true;
+    }
+    const runtime = state.current;
+    if (!runtime) {
+        sendJson(res, 503, {
+            ok: false,
+            error: "runtime_unavailable",
+        });
+        return true;
+    }
+    const service = runtime.getService(ServiceType.TASK);
+    if (!isTaskServiceLike(service)) {
+        sendJson(res, 503, {
+            ok: false,
+            error: "task_service_unavailable",
+        });
+        return true;
+    }
+    try {
+        const result = await runDueTasksOnce(service);
+        sendJson(res, 200, {
+            ok: true,
+            ranAt: new Date().toISOString(),
+            coalesced: result.coalesced,
+        });
+    }
+    catch (error) {
+        sendJson(res, 500, {
+            ok: false,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+    return true;
+}

package/api/catalog-routes.d.ts

@@ -1,4 +1,4 @@
 import type http from "node:http";
-import type { CompatRuntimeState } from "./compat-route-shared";
+import type { CompatRuntimeState } from "./compat-route-shared.js";
 export declare function handleCatalogRoutes(req: http.IncomingMessage, res: http.ServerResponse, state: CompatRuntimeState): Promise<boolean>;
 //# sourceMappingURL=catalog-routes.d.ts.map

package/api/catalog-routes.js

@@ -9,9 +9,9 @@
 // apps (runtime-registered) are still merged on the frontend; this endpoint
 // covers the static, declared catalog only.
 import { resolveAppHeroImage } from "@elizaos/agent";
-import { getApps, loadRegistry } from "../registry";
+import { getApps, loadRegistry } from "../registry/index.js";
 import { ensureRouteAuthorized } from "./auth.js";
-import { sendJson as sendJsonResponse } from "./response";
+import { sendJson as sendJsonResponse } from "./response.js";
 function appEntryToRegistryAppInfo(entry) {
     const launchType = entry.launch.type === "server-launch" ? "server" : entry.launch.type;
     const packageName = entry.npmName ?? entry.id;
@@ -29,7 +29,7 @@ function appEntryToRegistryAppInfo(entry) {
         launchUrl: entry.launch.url ?? null,
         icon: entry.render.icon ?? null,
         heroImage,
-        capabilities: entry.launch.capabilities ?? [],
+        capabilities: entry.launch.capabilities,
         stars: 0,
         repository: entry.resources.repository ?? "",
         latestVersion: entry.version ?? null,

package/api/cloud-pair-route.d.ts

@@ -0,0 +1,26 @@
+/**
+ * GET /pair — server-side relay for the Eliza Cloud SSO popup.
+ *
+ * Flow:
+ *   1. Cloud dashboard mints a 60s pairing token via
+ *      POST /api/v1/eliza/agents/<id>/pairing-token and navigates a popup to
+ *      `<agent>/pair?token=<X>`.
+ *   2. This handler reads the token, calls cloud-api `POST /api/auth/pair`
+ *      server-side (origin header = the agent's own origin, so cloud-api's
+ *      origin gate matches what was baked into the token).
+ *   3. Cloud-api validates + consumes the token, returns
+ *      `{ apiKey: <ELIZA_API_TOKEN> }`.
+ *   4. This handler serves an HTML page with an inline script that stores the
+ *      apiKey in sessionStorage and pins it on the page globals
+ *      `window.__ELIZAOS_API_TOKEN__` / `window.__ELIZA_API_TOKEN__` (the
+ *      globals the SPA's ElizaClient reads on hydrate), then redirects to `/`.
+ *      The SPA consumes that same-tab session handoff on boot.
+ *
+ * Why server-side relay: the agent web UI runs on the docker node's public
+ * IP, which is not in cloud-api's CORS allowlist. A direct browser fetch to
+ * `api.elizacloud.ai` would fail preflight. Doing the exchange from the
+ * agent's Node process sidesteps CORS entirely.
+ */
+import type http from "node:http";
+export declare function handleCloudPairRoute(req: http.IncomingMessage, res: http.ServerResponse): Promise<boolean>;
+//# sourceMappingURL=cloud-pair-route.d.ts.map

package/api/cloud-pair-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-pair-route.d.ts","sourceRoot":"","sources":["../../../../../src/api/cloud-pair-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AA8JlC,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,OAAO,CAAC,OAAO,CAAC,CA+HlB"}

package/api/cloud-pair-route.js

@@ -0,0 +1,222 @@
+/**
+ * GET /pair — server-side relay for the Eliza Cloud SSO popup.
+ *
+ * Flow:
+ *   1. Cloud dashboard mints a 60s pairing token via
+ *      POST /api/v1/eliza/agents/<id>/pairing-token and navigates a popup to
+ *      `<agent>/pair?token=<X>`.
+ *   2. This handler reads the token, calls cloud-api `POST /api/auth/pair`
+ *      server-side (origin header = the agent's own origin, so cloud-api's
+ *      origin gate matches what was baked into the token).
+ *   3. Cloud-api validates + consumes the token, returns
+ *      `{ apiKey: <ELIZA_API_TOKEN> }`.
+ *   4. This handler serves an HTML page with an inline script that stores the
+ *      apiKey in sessionStorage and pins it on the page globals
+ *      `window.__ELIZAOS_API_TOKEN__` / `window.__ELIZA_API_TOKEN__` (the
+ *      globals the SPA's ElizaClient reads on hydrate), then redirects to `/`.
+ *      The SPA consumes that same-tab session handoff on boot.
+ *
+ * Why server-side relay: the agent web UI runs on the docker node's public
+ * IP, which is not in cloud-api's CORS allowlist. A direct browser fetch to
+ * `api.elizacloud.ai` would fail preflight. Doing the exchange from the
+ * agent's Node process sidesteps CORS entirely.
+ */
+import { logger } from "@elizaos/core";
+import { getSensitiveLimiter } from "./auth/sensitive-rate-limit.js";
+const RELAY_TIMEOUT_MS = 15_000;
+const pairingRelayLimiter = getSensitiveLimiter("cloud.pair.relay");
+function resolveCloudApiBaseUrl() {
+    const raw = process.env.ELIZAOS_CLOUD_BASE_URL ||
+        process.env.NEXT_PUBLIC_API_URL ||
+        "https://api.elizacloud.ai/api/v1";
+    return raw.replace(/\/+$/, "");
+}
+function resolveCloudAuthRoot() {
+    // Cloud-api mounts `/api/auth/pair` at the site root, not under `/api/v1`.
+    // ELIZAOS_CLOUD_BASE_URL is the `/api/v1` URL, so strip the suffix to land
+    // on the site root.
+    const base = resolveCloudApiBaseUrl();
+    return base.replace(/\/api\/v1\/?$/, "");
+}
+function resolveRequestOrigin(req) {
+    // Honor the proxy headers a control-plane front (Cloudflared, nginx) adds,
+    // then fall back to the Host header. The cloud-api side uses this origin
+    // verbatim to look up the pairing-token row (which was baked with the same
+    // shape at generate time).
+    const proto = req.headers["x-forwarded-proto"] ||
+        (req.socket && "encrypted" in req.socket && req.socket.encrypted
+            ? "https"
+            : "http");
+    const host = req.headers["x-forwarded-host"] || req.headers.host;
+    return host ? `${proto}://${host}` : "";
+}
+function renderRedirectHtml(apiKey) {
+    // JSON.stringify gives us a JS-string literal that safely escapes quotes,
+    // but it does NOT escape `</script>` — which would break us out of the
+    // inline script tag. Replace `<` with the `<` escape so any
+    // `</script>` payload in a malicious key becomes inert literal text.
+    const safeKey = JSON.stringify(apiKey).replace(/</g, "\\u003c");
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="referrer" content="no-referrer">
+  <title>Signing in…</title>
+  <style>
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      font-family: system-ui, -apple-system, BlinkMacSystemFont, sans-serif;
+      background: #0a0a0a;
+      color: #e5e5e5;
+    }
+    p { margin: 0; font-size: 0.9rem; opacity: 0.8 }
+  </style>
+</head>
+<body>
+  <p>Signing in to your agent…</p>
+  <script>
+    (function () {
+      try {
+        var key = ${safeKey};
+        window.sessionStorage.setItem("eliza:cloud-pair:api-token", key);
+        window.__ELIZAOS_API_TOKEN__ = key;
+        window.__ELIZA_API_TOKEN__ = key;
+      } catch (e) {}
+      window.location.replace("/");
+    })();
+  </script>
+</body>
+</html>`;
+}
+function renderErrorHtml(title, message) {
+    // Static error page — no token, no inline data, just a back link to the
+    // dashboard so the user can re-trigger the popup.
+    const safeTitle = title.replace(/[<>&]/g, (c) => c === "<" ? "&lt;" : c === ">" ? "&gt;" : "&amp;");
+    const safeMessage = message.replace(/[<>&]/g, (c) => c === "<" ? "&lt;" : c === ">" ? "&gt;" : "&amp;");
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="referrer" content="no-referrer">
+  <title>${safeTitle}</title>
+  <style>
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      font-family: system-ui, -apple-system, BlinkMacSystemFont, sans-serif;
+      background: #0a0a0a;
+      color: #e5e5e5;
+    }
+    .card {
+      max-width: 28rem;
+      padding: 2rem;
+      border-radius: 0.75rem;
+      background: rgba(255, 255, 255, 0.04);
+      text-align: center;
+    }
+    h1 { font-size: 1.1rem; margin: 0 0 0.75rem; font-weight: 600 }
+    p { margin: 0 0 1.25rem; opacity: 0.8; font-size: 0.9rem; line-height: 1.5 }
+    a {
+      color: #e5e5e5;
+      text-decoration: none;
+      font-size: 0.85rem;
+      opacity: 0.7;
+    }
+    a:hover { opacity: 1 }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <h1>${safeTitle}</h1>
+    <p>${safeMessage}</p>
+    <a href="https://www.elizacloud.ai/dashboard/agents" target="_top" rel="noopener">Back to Eliza Cloud →</a>
+  </div>
+</body>
+</html>`;
+}
+function sendHtml(res, status, body) {
+    res.writeHead(status, {
+        "content-type": "text/html; charset=utf-8",
+        "cache-control": "no-store, no-cache, must-revalidate, proxy-revalidate",
+        pragma: "no-cache",
+        expires: "0",
+        "x-frame-options": "DENY",
+        "referrer-policy": "no-referrer",
+        "x-content-type-options": "nosniff",
+    });
+    res.end(body);
+}
+export async function handleCloudPairRoute(req, res) {
+    const method = (req.method ?? "GET").toUpperCase();
+    const url = new URL(req.url ?? "/", "http://localhost");
+    if (method !== "GET" || url.pathname !== "/pair") {
+        return false;
+    }
+    const ip = req.socket.remoteAddress ?? null;
+    if (!pairingRelayLimiter.consume(ip)) {
+        sendHtml(res, 429, renderErrorHtml("Too many sign-in attempts", "Wait a minute and click 'Open Web UI' again from the dashboard."));
+        return true;
+    }
+    const token = url.searchParams.get("token")?.trim();
+    if (!token) {
+        sendHtml(res, 400, renderErrorHtml("Missing pairing token", "Open the agent from the Eliza Cloud dashboard so a fresh sign-in link is generated."));
+        return true;
+    }
+    const origin = resolveRequestOrigin(req);
+    if (!origin) {
+        sendHtml(res, 400, renderErrorHtml("Missing origin", "Your browser did not send a Host header. Try again from a standard browser."));
+        return true;
+    }
+    const exchangeUrl = `${resolveCloudAuthRoot()}/api/auth/pair`;
+    let exchanged = null;
+    let status = 0;
+    try {
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), RELAY_TIMEOUT_MS);
+        const resp = await fetch(exchangeUrl, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                origin,
+            },
+            body: JSON.stringify({ token }),
+            signal: controller.signal,
+        });
+        clearTimeout(timeoutId);
+        status = resp.status;
+        if (resp.ok) {
+            exchanged = (await resp.json().catch(() => null));
+        }
+        else {
+            logger.warn(`[cloud-pair] exchange returned non-2xx status=${status} url=${exchangeUrl}`);
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        logger.error(`[cloud-pair] exchange failed url=${exchangeUrl} error=${message}`);
+        sendHtml(res, 503, renderErrorHtml("Eliza Cloud is unreachable", "We couldn't reach Eliza Cloud to verify your sign-in link. Try again in a minute."));
+        return true;
+    }
+    if (status === 401 || status === 403 || status === 410) {
+        sendHtml(res, 403, renderErrorHtml("Sign-in link expired", "Pairing links are single-use and only valid for a minute. Click 'Open Web UI' again from the dashboard."));
+        return true;
+    }
+    if (status === 429) {
+        sendHtml(res, 429, renderErrorHtml("Too many sign-in attempts", "Wait a minute and click 'Open Web UI' again from the dashboard."));
+        return true;
+    }
+    if (!exchanged || typeof exchanged.apiKey !== "string" || !exchanged.apiKey) {
+        sendHtml(res, 502, renderErrorHtml("Sign-in failed", "Eliza Cloud accepted the link but did not return a key. Try again from the dashboard."));
+        return true;
+    }
+    logger.info(`[cloud-pair] exchange ok agent=${exchanged.agentName ?? "agent"}`);
+    sendHtml(res, 200, renderRedirectHtml(exchanged.apiKey));
+    return true;
+}

package/api/cloud-voice-routes.d.ts

@@ -0,0 +1,52 @@
+/**
+ * HTTP routes for the cloud-routed ElevenLabs voice catalog.
+ *
+ * Exposes a single read-only endpoint:
+ *
+ *   GET /api/cloud/voices  → { voices: CloudVoiceCatalogEntry[] }
+ *
+ * The handler always returns `200 OK`. When Eliza Cloud is not connected
+ * (no API key, `ELIZAOS_CLOUD_ENABLED` falsy) the response carries an
+ * empty `voices` array rather than 5xx-ing — callers (the dashboard
+ * voice picker, the agent's voice settings sheet) treat the empty list
+ * as "no cloud voices available" and surface a connect-cloud hint if
+ * appropriate.
+ *
+ * The catalog itself is cached for 1 hour in memory by the
+ * plugin-elizacloud module; this route is a thin authenticated proxy.
+ */
+import type http from "node:http";
+import type { AgentRuntime } from "@elizaos/core";
+import type { CompatRuntimeState } from "./compat-route-shared.js";
+export interface CloudVoiceCatalogEntry {
+    id: string;
+    name: string;
+    gender?: string;
+    preview?: string;
+    category?: string;
+    language?: string;
+}
+export interface CloudVoiceRouteDeps {
+    /**
+     * Catalog fetcher; defaults to the production
+     * `@elizaos/plugin-elizacloud:fetchCloudVoiceCatalog`. Tests inject a
+     * deterministic implementation instead of mocking modules.
+     */
+    fetchCatalog?: (runtime: AgentRuntime) => Promise<CloudVoiceCatalogEntry[]>;
+    /**
+     * Auth gate; defaults to `ensureRouteAuthorized` from
+     * `./auth`. Tests pass a test double to drive 401 / pass cases.
+     */
+    ensureAuthorized?: (req: http.IncomingMessage, res: http.ServerResponse, state: CompatRuntimeState) => Promise<boolean>;
+}
+/**
+ * Returns `true` when this handler dispatched the request. Returns
+ * `false` to let the rest of the route chain run.
+ *
+ * Auth: callers must be authorized as for any `/api/cloud/*` read; the
+ * underlying voice catalog will refuse to reach upstream when cloud is
+ * not connected, so leaking the empty-array case is fine — it does not
+ * imply a valid cloud session.
+ */
+export declare function handleCloudVoiceRoutes(req: http.IncomingMessage, res: http.ServerResponse, state: CompatRuntimeState, deps?: CloudVoiceRouteDeps): Promise<boolean>;
+//# sourceMappingURL=cloud-voice-routes.d.ts.map

package/api/cloud-voice-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-voice-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/cloud-voice-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAQhE,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAC5E;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CACjB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,KACtB,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,EACzB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,OAAO,CAAC,CA2ClB"}

package/api/cloud-voice-routes.js

@@ -0,0 +1,50 @@
+import { ensureRouteAuthorized as defaultEnsureRouteAuthorized } from "./auth.js";
+import { sendJsonError as sendJsonErrorResponse, sendJson as sendJsonResponse, } from "./response.js";
+const ROUTE_PATH = "/api/cloud/voices";
+/**
+ * Returns `true` when this handler dispatched the request. Returns
+ * `false` to let the rest of the route chain run.
+ *
+ * Auth: callers must be authorized as for any `/api/cloud/*` read; the
+ * underlying voice catalog will refuse to reach upstream when cloud is
+ * not connected, so leaking the empty-array case is fine — it does not
+ * imply a valid cloud session.
+ */
+export async function handleCloudVoiceRoutes(req, res, state, deps = {}) {
+    const fetchCatalog = deps.fetchCatalog ??
+        (async (rt) => {
+            const { fetchCloudVoiceCatalog } = await import("@elizaos/plugin-elizacloud");
+            return fetchCloudVoiceCatalog(rt);
+        });
+    const ensureAuthorized = deps.ensureAuthorized ?? defaultEnsureRouteAuthorized;
+    const method = (req.method ?? "GET").toUpperCase();
+    const url = new URL(req.url ?? "/", "http://localhost");
+    if (url.pathname !== ROUTE_PATH)
+        return false;
+    if (method !== "GET") {
+        sendJsonErrorResponse(res, 405, "Method Not Allowed");
+        return true;
+    }
+    if (!(await ensureAuthorized(req, res, state)))
+        return true;
+    const runtime = state.current;
+    if (!runtime) {
+        // Runtime not booted yet → no cloud-connected check is possible. Treat
+        // as "no voices available" instead of 503 so the UI can render its
+        // empty-state hint without an alarming error toast.
+        const empty = [];
+        sendJsonResponse(res, 200, { voices: empty });
+        return true;
+    }
+    try {
+        const voices = await fetchCatalog(runtime);
+        sendJsonResponse(res, 200, { voices });
+    }
+    catch {
+        // The catalog already swallows per-endpoint failures and returns an empty
+        // list, but keep this route fail-closed if an exception escapes.
+        const empty = [];
+        sendJsonResponse(res, 200, { voices: empty });
+    }
+    return true;
+}

package/api/compat-route-shared.d.ts

@@ -1,6 +1,6 @@
 import type http from "node:http";
-import { type ElizaConfig } from "@elizaos/agent";
 import type { AgentRuntime } from "@elizaos/core";
+import { type ElizaConfig, isLoopbackRemoteAddress } from "@elizaos/shared";
 export interface CompatRuntimeState {
     current: AgentRuntime | null;
     pendingAgentName: string | null;
@@ -9,19 +9,26 @@ export interface CompatRuntimeState {
 export declare function clearCompatRuntimeRestart(state: CompatRuntimeState): void;
 export declare function scheduleCompatRuntimeRestart(state: CompatRuntimeState, reason: string): void;
 export declare const DATABASE_UNAVAILABLE_MESSAGE = "Database not available. The agent may not be running or the database adapter is not initialized.";
-export declare function isLoopbackRemoteAddress(remoteAddress: string | null | undefined): boolean;
+export { isLoopbackRemoteAddress };
 /**
- * Same-machine dashboard access. This is intentionally stricter than just
- * checking `remoteAddress`: the browser must also be targeting a loopback Host
- * and must not present cross-site browser metadata.
+ * Same-machine dashboard access for the app-core compat API. Delegates to the
+ * canonical `@elizaos/shared` parser with app-core's exact policy gates:
+ *  - cloudCheck "env": the raw `ELIZA_CLOUD_PROVISIONED === "1"` flag (NOT the
+ *    agent's stricter `isCloudProvisionedContainer()`).
+ *  - requireLocalAuthEnv: honour `ELIZA_REQUIRE_LOCAL_AUTH=1`.
+ *  - devAuthBypassEnv: `ELIZA_DEV_AUTH_BYPASS=1` in a dev `NODE_ENV` restores
+ *    local trust (dev-ui sets this for the local dashboard).
+ *
+ * Intentionally stricter than a bare `remoteAddress` check: the browser must
+ * also target a loopback Host and must not present cross-site browser metadata.
  */
 export declare function isTrustedLocalRequest(req: Pick<http.IncomingMessage, "headers" | "socket">): boolean;
 export declare function readCompatJsonBody(req: http.IncomingMessage, res: http.ServerResponse): Promise<Record<string, unknown> | null>;
-export declare function hasCompatPersistedOnboardingState(config: ElizaConfig): boolean;
+export declare function hasCompatPersistedFirstRunState(config: ElizaConfig): boolean;
 export declare function getConfiguredCompatAgentName(): string | null;
 /**
  * Best-effort grab of the Drizzle DB handle off the live runtime adapter.
- * Returns null when the runtime is not yet up or the adapter has not
+ * Returns null when the runtime is unavailable or the adapter has not
  * exposed a `db` field. Callers MUST treat null as "service unavailable"
  * — it is never authentication.
  */

package/api/compat-route-shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compat-route-shared.d.ts","sourceRoot":"","sources":["../../../../../src/api/compat-route-shared.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,gBAAgB,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAWlD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAEzE;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,kBAAkB,EACzB,MAAM,EAAE,MAAM,GACb,IAAI,CAaN;AAED,eAAO,MAAM,4BAA4B,qGAC2D,CAAC;AAErG,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,OAAO,CAUT;AAgLD;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,GACpD,OAAO,CAqBT;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CA+CzC;AAED,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,WAAW,GAClB,OAAO,CAoCT;AAED,wBAAgB,4BAA4B,IAAI,MAAM,GAAG,IAAI,CAc5D;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,GAAG,IAAI,CAM5E"}
+{"version":3,"file":"compat-route-shared.d.ts","sourceRoot":"","sources":["../../../../../src/api/compat-route-shared.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EACL,KAAK,WAAW,EAChB,uBAAuB,EAKxB,MAAM,iBAAiB,CAAC;AAKzB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAEzE;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,kBAAkB,EACzB,MAAM,EAAE,MAAM,GACb,IAAI,CAaN;AAED,eAAO,MAAM,4BAA4B,qGAC2D,CAAC;AAMrG,OAAO,EAAE,uBAAuB,EAAE,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,GACpD,OAAO,CAMT;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CA+CzC;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAoC5E;AAED,wBAAgB,4BAA4B,IAAI,MAAM,GAAG,IAAI,CAc5D;AAMD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,GAAG,IAAI,CAM5E"}