@elizaos/app-core 2.0.3-beta.2 → 2.0.3-beta.3

package/api/server.js

@@ -45,6 +45,7 @@ import { handleCatalogRoutes } from "./catalog-routes.js";
 import { handleCloudPairRoute } from "./cloud-pair-route.js";
 import { handleDatabaseRowsCompatRoute } from "./database-rows-compat-routes.js";
 import { handleDevCompatRoutes } from "./dev-compat-routes.js";
+import { handleDropStatusCompatRoute } from "./drop-status-compat-route.js";
 import { handleFirstRunRoute } from "./first-run-routes.js";
 import { handleFirstRunTtsRoute } from "./first-run-tts-route.js";
 import { handleInternalWakeRoute } from "./internal-routes.js";
@@ -53,11 +54,6 @@ import { handleSecretsInventoryRoute } from "./secrets-inventory-routes.js";
 import { handleSecretsManagerRoute } from "./secrets-manager-routes.js";
 import { handleSensitiveRequestRoutes } from "./sensitive-request-routes.js";
 import { getCorsAllowedPorts, isAllowedOrigin } from "./server-cors.js";
-// Wallet market overview route extracted to @elizaos/plugin-wallet/routes/wallet-market-overview-route.
-// Now served via walletRoutePlugin.routes (rawPath) on the runtime plugin route system.
-// Phase 2 extraction: Steward compat routes → app-steward/src/plugin.ts (stewardPlugin)
-// Includes: handleWalletBrowserCompatRoutes, handleWalletTradeCompatRoutes,
-//           handleStewardCompatRoutes, handleWalletCompatRoutes
 import { handleWorkbenchCompatRoutes } from "./workbench-compat-routes.js";
 const _require = createRequire(import.meta.url);
 import { syncAppEnvToEliza, syncElizaEnvAliases, } from "@elizaos/shared/utils/env";
@@ -199,7 +195,7 @@ async function clearCompatPgliteDataDir(runtime, config) {
         let timeoutHandle = null;
         try {
             await Promise.race([
-                Promise.resolve(runtime.stop()),
+                Promise.resolve(runtime.stop({ fast: true })),
                 new Promise((resolve) => {
                     timeoutHandle = setTimeout(() => {
                         stopTimedOut = true;
@@ -353,11 +349,6 @@ async function _getTableColumnNames(runtime, tableName, schemaName = "public") {
     }
     return columns;
 }
-// normalizePluginCategory, normalizePluginId, titleCasePluginId,
-// buildPluginParamDefs, findNearestFile, resolvePluginManifestPath,
-// resolveInstalledPackageVersion, resolveLoadedPluginNames, isPluginLoaded,
-// buildPluginListResponse, validateCompatPluginConfig, persistCompatPluginMutation
-// — extracted to ./plugins-routes
 /**
  * Load config from disk and backfill `cloud.apiKey` from sealed secrets when the
  * user is still linked to Eliza Cloud but a stale write dropped the key.
@@ -472,7 +463,7 @@ async function handleCompatRouteInner(req, res, state) {
             runtime: state.current,
         });
     }
-    // Dev observability routes — extracted to dev-compat-routes.ts
+    // Dev observability routes.
     if (await handleDevCompatRoutes(req, res, state))
         return true;
     // Cloud SSO popup landing — `/pair?token=X` calls cloud-api server-side,
@@ -486,7 +477,7 @@ async function handleCompatRouteInner(req, res, state) {
     // Cookie + CSRF session lifecycle (setup, login, logout, me, sessions).
     if (await handleAuthSessionRoutes(req, res, state))
         return true;
-    // Auth / pairing / first-run status — extracted to auth-pairing-routes.ts
+    // Auth / pairing / first-run status.
     if (await handleAuthPairingCompatRoutes(req, res, state))
         return true;
     // Sensitive-request REST surface (create/get/submit/cancel) for owner secret
@@ -519,11 +510,6 @@ async function handleCompatRouteInner(req, res, state) {
     }
     if (await handleAutomationsCompatRoutes(req, res, state))
         return true;
-    // workflow routes — extracted to plugins/plugin-workflow/src/plugin-routes.ts.
-    // Now served via workflowRoutePlugin.routes (rawPath) on the runtime
-    // plugin route system.
-    // GitHub PAT routes — extracted to plugins/plugin-github/src/routes/github-routes.ts.
-    // Now served via githubPlugin.routes (rawPath) on the runtime plugin route system.
     if (method === "POST" && url.pathname === "/api/tts/cloud") {
         if (!(await ensureRouteAuthorized(req, res, state)))
             return true;
@@ -545,11 +531,9 @@ async function handleCompatRouteInner(req, res, state) {
         // lets the request fall through to the next handler in the chain.
         return false;
     }
-    // Workbench / todos routes — extracted to workbench-compat-routes.ts
+    // Workbench / todos routes.
     if (await handleWorkbenchCompatRoutes(req, res, state))
         return true;
-    // Public cached market overview for wallet empty states and cloud feeds —
-    // now served via @elizaos/plugin-wallet:routes Plugin.routes (rawPath).
     if (url.pathname.startsWith("/api/secrets/")) {
         if (!(await ensureRouteAuthorized(req, res, state)))
             return true;
@@ -560,38 +544,12 @@ async function handleCompatRouteInner(req, res, state) {
             return true;
         }
     }
-    // ── /api/cloud/* routes — extracted to plugins/plugin-elizacloud ──────
-    // (cloud-routes, cloud-status-routes). Now served via
-    // elizaCloudRoutePlugin.routes (rawPath) on the runtime plugin route
-    // system. The plugin handlers carry the cloud-provisioned auth exemption
-    // for `/api/cloud/status` and the post-dispatch loopback sync that keeps
-    // the upstream state.config in agreement with disk on login / disconnect.
-    // Note: /api/cloud/compat/* and /api/cloud/billing/* still dispatch
-    // above this point through @elizaos/agent (intentional — those are thin
-    // proxies to Eliza Cloud, not local cloud-connection management).
-    if (method === "GET" && url.pathname === "/api/drop/status") {
-        const config = loadElizaConfig();
-        if (config.features?.dropEnabled === true) {
-            return false;
-        }
-        sendJsonResponse(res, 200, {
-            dropEnabled: false,
-            publicMintOpen: false,
-            whitelistMintOpen: false,
-            mintedOut: false,
-            currentSupply: 0,
-            maxSupply: 0,
-            shinyPrice: "0",
-            userHasMinted: false,
-        });
+    // `/api/cloud/compat/*` and `/api/cloud/billing/*` dispatch above this
+    // point through @elizaos/agent — thin proxies to Eliza Cloud, not local
+    // cloud-connection management. `/api/cloud/*` connection management is
+    // served by elizaCloudRoutePlugin.routes on the runtime plugin route system.
+    if (handleDropStatusCompatRoute(req, res, method, url.pathname))
         return true;
-    }
-    // ── Vincent OAuth routes — extracted to app-vincent/src/plugin.ts ──
-    // Now served via vincentPlugin.routes (rawPath) on the runtime plugin
-    // route system.  /callback/vincent is marked public: true.
-    // ── Shopify routes — extracted to app-shopify/src/plugin.ts ───────
-    // Now served via shopifyPlugin.routes (rawPath) on the runtime plugin
-    // route system.
     if (method === "POST" && url.pathname === "/api/agent/reset") {
         if (!ensureCompatSensitiveRouteAuthorized(req, res)) {
             logger.warn("[eliza][reset] POST /api/agent/reset rejected (sensitive route not authorized)");
@@ -623,13 +581,9 @@ async function handleCompatRouteInner(req, res, state) {
         }
         return true;
     }
-    // ── Steward wallet compat routes — extracted to app-steward/src/plugin.ts ──
-    // All four handler groups (wallet-compat, wallet-browser-compat,
-    // steward-compat, wallet-trade-compat) are now served via
-    // stewardPlugin.routes (rawPath) on the runtime plugin route system.
-    // Plugin routes — extracted to @elizaos/plugin-registry. That package pulls
-    // in heavyweight registry/install code, so keep it out of the startup path
-    // and only load it for plugin-management requests.
+    // Plugin routes load @elizaos/plugin-registry lazily: that package pulls in
+    // heavyweight registry/install code, so keep it out of the startup path and
+    // only load it for plugin-management requests.
     if (url.pathname.startsWith("/api/plugins")) {
         const { handlePluginsCompatRoutes } = await getPluginRegistryApi();
         if (await handlePluginsCompatRoutes(req, res, state))

package/api/training-benchmarks.d.ts

@@ -36,7 +36,7 @@
  *   coordinated change across the Python store and these routes.
  */
 import type http from "node:http";
-import type { CompatRuntimeState } from "./compat-route-shared";
+import type { CompatRuntimeState } from "./compat-route-shared.js";
 export declare const ELIZA_BENCHMARK_SCORES_SCHEMA: "elizaos.training.benchmark-scores/v1";
 export declare const ELIZA_BENCHMARK_COMPARE_SCHEMA: "elizaos.training.benchmark-compare/v1";
 export interface BenchmarkRunDTO {

package/api/training-benchmarks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"training-benchmarks.d.ts","sourceRoot":"","sources":["../../../../../src/api/training-benchmarks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAgFlC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAmBhE,eAAO,MAAM,6BAA6B,EACxC,sCAA+C,CAAC;AAClD,eAAO,MAAM,8BAA8B,EACzC,uCAAgD,CAAC;AAEnD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,OAAO,6BAA6B,CAAC;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,eAAe,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,OAAO,8BAA8B,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1B,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAMD,wBAAgB,6BAA6B,CAC3C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAMR;AAmCD,UAAU,sBAAsB;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,IAAI,EAAE;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,eAAe,EAAE,CAAC;IACtB,SAAS,CAAC,IAAI,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,eAAe,GAAG,IAAI,CAAC;IAC3B,KAAK,IAAI,IAAI,CAAC;CACf;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,GACb,sBAAsB,CAwDxB;AAgDD,MAAM,WAAW,8BAA8B;IAC7C,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,sBAAsB,CAAC;CACzD;AAED,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE,8BAAmC,GAC3C,OAAO,CAAC,OAAO,CAAC,CA6BlB"}
+{"version":3,"file":"training-benchmarks.d.ts","sourceRoot":"","sources":["../../../../../src/api/training-benchmarks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAkFlC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAmBhE,eAAO,MAAM,6BAA6B,EACxC,sCAA+C,CAAC;AAClD,eAAO,MAAM,8BAA8B,EACzC,uCAAgD,CAAC;AAEnD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,OAAO,6BAA6B,CAAC;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,eAAe,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,OAAO,8BAA8B,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1B,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAMD,wBAAgB,6BAA6B,CAC3C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAMR;AAyBD,UAAU,sBAAsB;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,IAAI,EAAE;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,eAAe,EAAE,CAAC;IACtB,SAAS,CAAC,IAAI,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,eAAe,GAAG,IAAI,CAAC;IAC3B,KAAK,IAAI,IAAI,CAAC;CACf;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,GACb,sBAAsB,CAmDxB;AA+ED,MAAM,WAAW,8BAA8B;IAC7C,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,sBAAsB,CAAC;CACzD;AAED,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE,8BAAmC,GAC3C,OAAO,CAAC,OAAO,CAAC,CA6BlB"}

package/api/training-benchmarks.js

@@ -164,8 +164,7 @@ export function openBenchmarkResultsReader(dbPath) {
     return {
         ready: true,
         getHistory({ modelId, benchmark, limit }) {
-            const rows = historyStmt.all(modelId, benchmark, limit);
-            return rows.map(rowToDto);
+            return historyStmt.all(modelId, benchmark, limit).map(rowToDto);
         },
         getLatest({ modelId, benchmark }) {
             const rows = latestStmt.all(modelId, benchmark);
@@ -180,15 +179,38 @@ export function openBenchmarkResultsReader(dbPath) {
 }
 function rowToDto(row) {
     return {
-        id: Number(row.id),
-        modelId: row.model_id,
-        benchmark: row.benchmark,
-        score: row.score,
-        ts: Number(row.ts),
-        datasetVersion: row.dataset_version,
-        codeCommit: row.code_commit,
+        id: readSqliteInteger(row, "id"),
+        modelId: readSqliteString(row, "model_id"),
+        benchmark: readSqliteString(row, "benchmark"),
+        score: readSqliteNumber(row, "score"),
+        ts: readSqliteInteger(row, "ts"),
+        datasetVersion: readSqliteString(row, "dataset_version"),
+        codeCommit: readSqliteString(row, "code_commit"),
     };
 }
+function readSqliteString(row, column) {
+    const value = row[column];
+    if (typeof value === "string")
+        return value;
+    throw new Error(`Invalid benchmark row: ${column} must be a string`);
+}
+function readSqliteNumber(row, column) {
+    const value = row[column];
+    if (typeof value === "number" && Number.isFinite(value))
+        return value;
+    throw new Error(`Invalid benchmark row: ${column} must be a finite number`);
+}
+function readSqliteInteger(row, column) {
+    const value = row[column];
+    if (typeof value === "number" && Number.isSafeInteger(value))
+        return value;
+    if (typeof value === "bigint") {
+        const asNumber = Number(value);
+        if (Number.isSafeInteger(asNumber))
+            return asNumber;
+    }
+    throw new Error(`Invalid benchmark row: ${column} must be a safe integer`);
+}
 // ---------------------------------------------------------------------------
 // Query-parameter helpers
 // ---------------------------------------------------------------------------

package/api/workbench-compat-routes.d.ts

@@ -5,7 +5,7 @@
  */
 import type http from "node:http";
 import { type AgentRuntime } from "@elizaos/core";
-import { type CompatRuntimeState } from "./compat-route-shared";
+import { type CompatRuntimeState } from "./compat-route-shared.js";
 export declare function runtimeHasTodoDatabase(runtime: AgentRuntime | null): boolean;
 export declare function handleWorkbenchCompatRoutes(req: http.IncomingMessage, res: http.ServerResponse, state: CompatRuntimeState): Promise<boolean>;
 //# sourceMappingURL=workbench-compat-routes.d.ts.map

package/benchmark/server-utils.d.ts

@@ -1,6 +1,6 @@
 import { type AgentRuntime, type Plugin, type RoleName, type UUID } from "@elizaos/core";
-import type { BenchmarkContext, CapturedAction } from "./plugin";
-export { coerceParams } from "./params";
+import type { BenchmarkContext, CapturedAction } from "./plugin.js";
+export { coerceParams } from "./params.js";
 export declare const DEFAULT_PORT = 3939;
 export declare const DEFAULT_HOST = "127.0.0.1";
 export declare const BENCHMARK_WORLD_ID: string;

package/browser.d.ts

@@ -17,10 +17,10 @@ export { Input } from "@elizaos/ui/components/ui/input";
 export { Spinner } from "@elizaos/ui/components/ui/spinner";
 export { type IosRuntimeConfig, resolveIosRuntimeConfig, } from "@elizaos/ui/platform/ios-runtime";
 export { useApp } from "@elizaos/ui/state/useApp";
-export { type AutomationNodeContributorContext, registerAutomationNodeContributor, } from "./api/automation-node-contributors";
-export { buildLocalizedTrayMenu, DESKTOP_TRAY_MENU_ITEMS, DesktopSurfaceNavigationRuntime, DesktopTrayRuntime, DetachedShellRoot, } from "./runtime/desktop";
-export { AppWindowRenderer } from "./runtime/desktop/AppWindowRenderer";
-export { getHostExecutionCapabilities } from "./services/task-host-capabilities";
+export { type AutomationNodeContributorContext, registerAutomationNodeContributor, } from "./api/automation-node-contributors.js";
+export { buildLocalizedTrayMenu, DESKTOP_TRAY_MENU_ITEMS, DesktopSurfaceNavigationRuntime, DesktopTrayRuntime, DetachedShellRoot, } from "./runtime/desktop/index.js";
+export { AppWindowRenderer } from "./runtime/desktop/AppWindowRenderer.js";
+export { getHostExecutionCapabilities } from "./services/task-host-capabilities.js";
 export type CompatRuntimeState = {
     current: unknown;
     pendingAgentName?: string | null;

package/cli/plugins-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugins-cli.d.ts","sourceRoot":"","sources":["../../../../../src/cli/plugins-cli.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAczD;AAwCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAYxD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CA4BA;AAwED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAw9BzD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAsD9C"}
+{"version":3,"file":"plugins-cli.d.ts","sourceRoot":"","sources":["../../../../../src/cli/plugins-cli.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAczD;AAwCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAYxD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CA4BA;AAwED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA69BzD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAsD9C"}

package/cli/plugins-cli.js

@@ -875,6 +875,11 @@ export function registerPluginsCli(program) {
             try {
                 const result = spawnSync(editorCmd, [...editorArgs, targetDir], {
                     stdio: "inherit",
+                    // Editors are usually `.cmd`/`.bat` shims on Windows (e.g. `code`),
+                    // which Node cannot spawn without a shell (ENOENT) — the editor would
+                    // silently never open. Route through the shell on win32 so EDITOR
+                    // actually launches. EDITOR is local, user-controlled config.
+                    shell: process.platform === "win32",
                 });
                 if (result.error)
                     throw result.error;

package/cli/program/register.auth.d.ts

@@ -25,7 +25,7 @@ interface RunResetParams {
     /** Override the proof reader for tests. */
     proofReader?: () => Promise<string | null>;
     /** Pre-resolved store; if omitted the CLI opens its own. */
-    store?: import("../../services/auth-store").AuthStore;
+    store?: import("../../services/auth-store.js").AuthStore;
     /** Cleanup hook when the CLI opened its own store. */
     cleanup?: () => Promise<void>;
     /** Skip the file-deletion step (tests). */
@@ -46,6 +46,32 @@ export interface RunResetResult {
  * Test-callable entry point. Real CLI action wraps this in commander glue.
  */
 export declare function runElizaAuthReset(params?: RunResetParams): Promise<RunResetResult>;
+export interface DevWalletLoginResult {
+    ok: boolean;
+    apiKey?: string;
+    address?: string;
+    isNewAccount?: boolean;
+    organizationId?: string | null;
+    savedTo?: string | null;
+    message?: string;
+}
+interface DevWalletLoginParams {
+    cloudApiBase?: string;
+    /** Persist the minted key as ELIZAOS_CLOUD_API_KEY in the eliza config. Default true. */
+    save?: boolean;
+    /** Reuse a fixed private key instead of generating one (tests / reproducible runs). */
+    privateKey?: string;
+    log?: (line: string) => void;
+    /** Test override for fetch. */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * DEV/TEST cloud login with no browser/OAuth: generate an ephemeral Ethereum
+ * wallet, sign the SIWE challenge, and exchange it for an Eliza Cloud API key.
+ * Optionally persists the key as ELIZAOS_CLOUD_API_KEY so the local agent uses
+ * Eliza Cloud for inference. Test-callable; the CLI action wraps it.
+ */
+export declare function runDevWalletLogin(params?: DevWalletLoginParams): Promise<DevWalletLoginResult>;
 export declare function registerAuthCommand(program: Command): void;
 export {};
 //# sourceMappingURL=register.auth.d.ts.map

package/cli/program/register.auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.auth.d.ts","sourceRoot":"","sources":["../../../../../../src/cli/program/register.auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiHzC,UAAU,cAAc;IACtB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,8BAA8B;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3C,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,2BAA2B,EAAE,SAAS,CAAC;IACtD,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,sDAAsD;IACtD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,GAAG,aAAa,CAAC;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,GAAE,cAAmB,GAC1B,OAAO,CAAC,cAAc,CAAC,CAmGzB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,QAenD"}
+{"version":3,"file":"register.auth.d.ts","sourceRoot":"","sources":["../../../../../../src/cli/program/register.auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiHzC,UAAU,cAAc;IACtB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,8BAA8B;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3C,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,2BAA2B,EAAE,SAAS,CAAC;IACtD,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,sDAAsD;IACtD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,GAAG,aAAa,CAAC;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,GAAE,cAAmB,GAC1B,OAAO,CAAC,cAAc,CAAC,CAmGzB;AAwDD,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,oBAAoB;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,uFAAuF;IACvF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,+BAA+B;IAC/B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,GAAE,oBAAyB,GAChC,OAAO,CAAC,oBAAoB,CAAC,CAqI/B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,QAkEnD"}

package/cli/program/register.auth.js

@@ -180,6 +180,156 @@ export async function runElizaAuthReset(params = {}) {
     log(theme.success(`auth reset complete — revoked ${revoked} session(s)`));
     return { ok: true };
 }
+const DEFAULT_CLOUD_API_BASE = "https://api.elizacloud.ai";
+/**
+ * Rewrite any elizacloud.ai web host to the API host, mirroring the app's
+ * `resolveDirectCloudAuthApiBase`. Keeps a non-elizacloud (self-hosted) base as-is.
+ */
+function resolveCloudApiBase(input) {
+    const raw = (input ||
+        process.env.ELIZAOS_CLOUD_BASE_URL ||
+        DEFAULT_CLOUD_API_BASE).trim();
+    try {
+        const u = new URL(raw);
+        if (/(^|\.)elizacloud\.ai$/.test(u.hostname) &&
+            u.hostname !== "api.elizacloud.ai") {
+            u.hostname = "api.elizacloud.ai";
+        }
+        // Strip a trailing /api/v1 etc. — the SIWE endpoints live at the origin.
+        return `${u.protocol}//${u.host}`;
+    }
+    catch {
+        return raw.replace(/\/+$/, "");
+    }
+}
+/**
+ * Build the EIP-4361 (SIWE) message string the way viem's `createSiweMessage`
+ * does, so the cloud's `verifyMessage` parses it. `ethers.Wallet.signMessage`
+ * applies the EIP-191 personal_sign prefix the server expects.
+ */
+function buildSiweMessage(args) {
+    const head = `${args.domain} wants you to sign in with your Ethereum account:\n${args.address}\n`;
+    const body = `\nURI: ${args.uri}\n` +
+        `Version: ${args.version}\n` +
+        `Chain ID: ${args.chainId}\n` +
+        `Nonce: ${args.nonce}\n` +
+        `Issued At: ${args.issuedAt}`;
+    return args.statement
+        ? `${head}\n${args.statement}\n${body}`
+        : `${head}${body}`;
+}
+/**
+ * DEV/TEST cloud login with no browser/OAuth: generate an ephemeral Ethereum
+ * wallet, sign the SIWE challenge, and exchange it for an Eliza Cloud API key.
+ * Optionally persists the key as ELIZAOS_CLOUD_API_KEY so the local agent uses
+ * Eliza Cloud for inference. Test-callable; the CLI action wraps it.
+ */
+export async function runDevWalletLogin(params = {}) {
+    const log = params.log ?? ((line) => console.log(line));
+    const doFetch = params.fetchImpl ?? fetch;
+    const apiBase = resolveCloudApiBase(params.cloudApiBase);
+    let ethers;
+    try {
+        ethers = await import("ethers");
+    }
+    catch {
+        return {
+            ok: false,
+            message: "ethers is required for dev-login but could not be loaded. Install it or run from the workspace.",
+        };
+    }
+    let nonce = null;
+    let lastNonceErr = "";
+    for (let attempt = 0; attempt < 6; attempt++) {
+        try {
+            const nonceRes = await doFetch(`${apiBase}/api/auth/siwe/nonce?chainId=1`, { headers: { accept: "application/json" } });
+            if (nonceRes.ok) {
+                const body = (await nonceRes.json());
+                if (body?.nonce && body?.domain && body?.uri) {
+                    nonce = body;
+                    break;
+                }
+                lastNonceErr = "malformed nonce response";
+            }
+            else {
+                lastNonceErr = `status ${nonceRes.status}`;
+            }
+        }
+        catch (err) {
+            lastNonceErr = err instanceof Error ? err.message : String(err);
+        }
+        if (attempt < 5)
+            await new Promise((r) => setTimeout(r, 2500));
+    }
+    if (!nonce) {
+        return {
+            ok: false,
+            message: `SIWE nonce request failed at ${apiBase} (${lastNonceErr})`,
+        };
+    }
+    // 2. Wallet + signed SIWE message
+    const wallet = params.privateKey
+        ? new ethers.Wallet(params.privateKey)
+        : ethers.Wallet.createRandom();
+    const message = buildSiweMessage({
+        domain: nonce.domain,
+        address: wallet.address,
+        statement: nonce.statement,
+        uri: nonce.uri,
+        version: nonce.version || "1",
+        chainId: nonce.chainId || 1,
+        nonce: nonce.nonce,
+        issuedAt: new Date().toISOString(),
+    });
+    const signature = await wallet.signMessage(message);
+    // 3. Verify → API key
+    const verifyRes = await doFetch(`${apiBase}/api/auth/siwe/verify`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ message, signature }),
+    });
+    if (!verifyRes.ok) {
+        const txt = await verifyRes.text().catch(() => "");
+        return {
+            ok: false,
+            message: `SIWE verify failed (${verifyRes.status}): ${txt.slice(0, 160)}`,
+        };
+    }
+    const verified = (await verifyRes.json());
+    const apiKey = verified.apiKey;
+    if (!apiKey) {
+        return { ok: false, message: "SIWE verify returned no apiKey" };
+    }
+    const orgId = verified.organization?.id ?? verified.user?.organization_id ?? null;
+    // 4. Persist (default) so the local agent routes to Eliza Cloud.
+    let savedTo = null;
+    if (params.save !== false) {
+        try {
+            const { resolveConfigPath, loadConfig, saveConfig } = await import("./register.setup.js");
+            const configPath = resolveConfigPath();
+            const config = loadConfig(configPath);
+            const envSection = config.env && typeof config.env === "object"
+                ? config.env
+                : {};
+            envSection.ELIZAOS_CLOUD_API_KEY = apiKey;
+            envSection.ELIZAOS_CLOUD_ENABLED = "true";
+            config.env = envSection;
+            saveConfig(configPath, config);
+            savedTo = configPath;
+        }
+        catch (err) {
+            log(theme.muted(`(could not persist key to config: ${err instanceof Error ? err.message : String(err)})`));
+        }
+    }
+    return {
+        ok: true,
+        apiKey,
+        address: wallet.address,
+        isNewAccount: verified.isNewAccount,
+        organizationId: orgId,
+        savedTo,
+    };
+}
 export function registerAuthCommand(program) {
     const auth = program.command("auth").description("Manage Eliza auth state");
     auth
@@ -194,4 +344,41 @@ export function registerAuthCommand(program) {
             }
         });
     });
+    auth
+        .command("dev-login")
+        .description("DEV: generate an ephemeral Ethereum wallet, SIWE sign-in, and mint an Eliza Cloud API key (no browser/OAuth)")
+        .option("--cloud <url>", "Cloud API base (default https://api.elizacloud.ai or $ELIZAOS_CLOUD_BASE_URL)")
+        .option("--no-save", "Print the key only; do not persist it to the config")
+        .option("--json", "Emit the result as JSON (for scripting)")
+        .action(async (opts) => {
+        await runCommandWithRuntime(defaultRuntime, async () => {
+            const result = await runDevWalletLogin({
+                cloudApiBase: opts.cloud,
+                save: opts.save,
+            });
+            if (opts.json) {
+                console.log(JSON.stringify(result));
+                if (!result.ok)
+                    process.exitCode = 1;
+                return;
+            }
+            if (!result.ok) {
+                console.error(theme.error(result.message ?? "dev-login failed"));
+                process.exitCode = 1;
+                return;
+            }
+            console.log(theme.heading("Eliza Cloud dev-login"));
+            console.log(`${theme.success("✓")} wallet ${theme.command(result.address ?? "?")}${result.isNewAccount ? " (new account)" : ""}`);
+            console.log(`${theme.success("✓")} API key ${theme.command(result.apiKey ?? "?")}`);
+            if (result.organizationId) {
+                console.log(`${theme.muted("→")} org ${result.organizationId}`);
+            }
+            if (result.savedTo) {
+                console.log(`${theme.success("✓")} saved ELIZAOS_CLOUD_API_KEY to ${theme.command(result.savedTo)} — the agent will use Eliza Cloud`);
+            }
+            else {
+                console.log(`${theme.muted("→")} not saved (use without --no-save to persist, or export ELIZAOS_CLOUD_API_KEY=<key>)`);
+            }
+        });
+    });
 }

package/cli/program/register.dashboard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.dashboard.d.ts","sourceRoot":"","sources":["../../../../../../src/cli/program/register.dashboard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4CzC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,QAsHxD"}
+{"version":3,"file":"register.dashboard.d.ts","sourceRoot":"","sources":["../../../../../../src/cli/program/register.dashboard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4CzC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,QAgIxD"}

package/cli/program/register.dashboard.js

@@ -84,11 +84,15 @@ export function registerDashboardCommand(program) {
             process.exitCode = 1;
             return;
         }
-        const { spawn } = await import("node:child_process");
+        const { spawn, spawnSync } = await import("node:child_process");
         const child = spawn("npx", ["vite"], {
             cwd: appDir,
             stdio: ["ignore", "pipe", "pipe"],
             env: { ...process.env },
+            // npx is `npx.cmd` on Windows; Node cannot spawn a .cmd without a
+            // shell (ENOENT), so the dev dashboard never started there. The args
+            // are constant, so enabling the shell on Windows is injection-safe.
+            shell: process.platform === "win32",
         });
         let opened = false;
         const tryOpen = () => {
@@ -115,6 +119,12 @@ export function registerDashboardCommand(program) {
         });
         setTimeout(tryOpen, 10_000);
         const cleanup = () => {
+            if (process.platform === "win32" && child.pid) {
+                // shell:true ran npx inside cmd.exe; a SIGTERM to the shell would
+                // orphan the vite grandchild, so kill the whole tree by PID.
+                spawnSync("taskkill", ["/pid", String(child.pid), "/t", "/f"]);
+                return;
+            }
             child.kill("SIGTERM");
         };
         process.on("SIGINT", cleanup);

package/cli/program.d.ts

@@ -1,2 +1,2 @@
-export { buildProgram } from "./program/build-program";
+export { buildProgram } from "./program/build-program.js";
 //# sourceMappingURL=program.d.ts.map

package/first-run/first-run-config.d.ts

@@ -1,5 +1,5 @@
 import { type DeploymentTargetConfig, type FirstRunCredentialInputs, type LinkedAccountFlagsConfig, type ServiceRoutingConfig } from "@elizaos/shared";
-import { type FirstRunRuntimeTarget } from "./runtime-target";
+import { type FirstRunRuntimeTarget } from "./runtime-target.js";
 export interface BuildFirstRunConnectionArgs {
     firstRunRuntimeTarget?: FirstRunRuntimeTarget;
     firstRunCloudApiKey: string;