@elizaos/autonomous 2.0.0-alpha.37

package/dist/packages/autonomous/src/services/registry-client-app-meta.js

@@ -0,0 +1,164 @@
+import { logger } from "@elizaos/core";
+export const LOCAL_APP_DEFAULT_SANDBOX = "allow-scripts allow-same-origin allow-popups";
+const ALLOWED_SANDBOX_TOKENS = new Set([
+    "allow-downloads",
+    "allow-forms",
+    "allow-modals",
+    "allow-orientation-lock",
+    "allow-pointer-lock",
+    "allow-popups",
+    "allow-popups-to-escape-sandbox",
+    "allow-presentation",
+    "allow-same-origin",
+    "allow-scripts",
+    "allow-storage-access-by-user-activation",
+    "allow-top-navigation-by-user-activation",
+]);
+const LOCAL_APP_OVERRIDES = {
+    "@elizaos/app-babylon": {
+        launchType: "url",
+        launchUrl: "http://localhost:3000",
+        viewer: {
+            url: "http://localhost:3000",
+            sandbox: "allow-scripts allow-same-origin allow-popups allow-forms",
+        },
+    },
+    "@elizaos/app-hyperscape": {
+        launchType: "connect",
+        launchUrl: "http://localhost:3333",
+        uiExtension: {
+            detailPanelId: "hyperscape-embedded-agents",
+        },
+        viewer: {
+            url: "http://localhost:3333",
+            embedParams: {
+                embedded: "true",
+                mode: "spectator",
+                quality: "medium",
+            },
+            postMessageAuth: true,
+            sandbox: "allow-scripts allow-same-origin allow-popups allow-forms",
+        },
+    },
+    "@elizaos/app-hyperfy": {
+        launchType: "connect",
+        launchUrl: "http://localhost:3003",
+        viewer: {
+            url: "http://localhost:3003",
+            sandbox: LOCAL_APP_DEFAULT_SANDBOX,
+        },
+    },
+    "@elizaos/app-2004scape": {
+        launchType: "connect",
+        launchUrl: "http://localhost:8880",
+        viewer: {
+            url: "http://localhost:8880",
+            embedParams: { bot: "{RS_SDK_BOT_NAME}" },
+            postMessageAuth: true,
+            sandbox: "allow-scripts allow-same-origin allow-popups allow-forms",
+        },
+    },
+    "@elizaos/app-agent-town": {
+        launchType: "url",
+        launchUrl: "http://localhost:5173/ai-town/index.html",
+        viewer: {
+            url: "http://localhost:5173/ai-town/index.html",
+            sandbox: "allow-scripts allow-same-origin allow-popups allow-forms",
+        },
+    },
+    "@elizaos/app-dungeons": {
+        launchType: "local",
+        launchUrl: "http://localhost:3345",
+        viewer: {
+            url: "http://localhost:3345",
+            sandbox: "allow-scripts allow-same-origin allow-popups allow-forms",
+        },
+    },
+};
+export function sanitizeSandbox(rawSandbox) {
+    if (!rawSandbox || !rawSandbox.trim()) {
+        return LOCAL_APP_DEFAULT_SANDBOX;
+    }
+    const tokens = rawSandbox
+        .split(/\s+/)
+        .map((token) => token.trim())
+        .filter((token) => token.length > 0);
+    if (tokens.length === 0) {
+        return LOCAL_APP_DEFAULT_SANDBOX;
+    }
+    for (const token of tokens) {
+        if (!ALLOWED_SANDBOX_TOKENS.has(token)) {
+            logger.warn(`[registry-client] rejecting untrusted sandbox token: ${token}`);
+            return LOCAL_APP_DEFAULT_SANDBOX;
+        }
+    }
+    return Array.from(new Set(tokens)).join(" ");
+}
+function normalizeViewer(viewer) {
+    if (!viewer)
+        return undefined;
+    return {
+        ...viewer,
+        sandbox: sanitizeSandbox(viewer.sandbox),
+    };
+}
+function mergeViewer(base, patch) {
+    if (!base && !patch)
+        return undefined;
+    if (!base)
+        return normalizeViewer(patch);
+    if (!patch)
+        return normalizeViewer(base);
+    return normalizeViewer({
+        ...base,
+        ...patch,
+        embedParams: {
+            ...(base.embedParams ?? {}),
+            ...(patch.embedParams ?? {}),
+        },
+    });
+}
+export function mergeAppMeta(base, patch) {
+    if (!base && !patch)
+        return undefined;
+    if (!base)
+        return patch;
+    if (!patch)
+        return base;
+    return {
+        ...base,
+        ...patch,
+        capabilities: patch.capabilities.length > 0 ? patch.capabilities : base.capabilities,
+        uiExtension: patch.uiExtension ?? base.uiExtension,
+        viewer: mergeViewer(base.viewer, patch.viewer),
+    };
+}
+export function resolveAppOverride(packageName, appMeta) {
+    const override = LOCAL_APP_OVERRIDES[packageName];
+    if (!override)
+        return appMeta;
+    const base = appMeta ?? {
+        displayName: override.displayName ?? packageName.replace(/^@elizaos\/app-/, ""),
+        category: override.category ?? "game",
+        launchType: override.launchType ?? "url",
+        launchUrl: override.launchUrl ?? null,
+        icon: null,
+        capabilities: override.capabilities ?? [],
+        minPlayers: null,
+        maxPlayers: null,
+        uiExtension: override.uiExtension,
+        viewer: override.viewer,
+    };
+    return {
+        ...base,
+        displayName: override.displayName ?? base.displayName,
+        category: override.category ?? base.category,
+        launchType: override.launchType ?? base.launchType,
+        launchUrl: override.launchUrl !== undefined ? override.launchUrl : base.launchUrl,
+        capabilities: override.capabilities !== undefined
+            ? override.capabilities
+            : base.capabilities,
+        uiExtension: override.uiExtension ?? base.uiExtension,
+        viewer: mergeViewer(base.viewer, override.viewer),
+    };
+}

package/dist/packages/autonomous/src/services/registry-client-endpoints.d.ts

@@ -0,0 +1,7 @@
+import type { RegistryEndpoint } from "../config/types.autonomous.js";
+import type { RegistryPluginInfo } from "./registry-client-types.js";
+export declare function normaliseEndpointUrl(url: string): string;
+export declare function isDefaultEndpoint(url: string, defaultUrl: string): boolean;
+export declare function parseRegistryEndpointUrl(rawUrl: string): URL;
+export declare function mergeCustomEndpoints(plugins: Map<string, RegistryPluginInfo>, endpoints: RegistryEndpoint[]): Promise<void>;
+//# sourceMappingURL=registry-client-endpoints.d.ts.map

package/dist/packages/autonomous/src/services/registry-client-endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-client-endpoints.d.ts","sourceRoot":"","sources":["../../../../../src/services/registry-client-endpoints.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAKtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAUrE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CA4B5D;AA8KD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,EACxC,SAAS,EAAE,gBAAgB,EAAE,GAC5B,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/packages/autonomous/src/services/registry-client-endpoints.js

@@ -0,0 +1,183 @@
+import { lookup as dnsLookup } from "node:dns/promises";
+import net from "node:net";
+import { logger } from "@elizaos/core";
+import { isBlockedPrivateOrLinkLocalIp, normalizeHostLike, } from "../security/network-policy.js";
+const BLOCKED_REGISTRY_HOST_LITERALS = new Set([
+    "localhost",
+    "127.0.0.1",
+    "::1",
+    "0.0.0.0",
+    "169.254.169.254",
+]);
+export function normaliseEndpointUrl(url) {
+    return url.replace(/\/+$/, "");
+}
+export function isDefaultEndpoint(url, defaultUrl) {
+    return normaliseEndpointUrl(url) === normaliseEndpointUrl(defaultUrl);
+}
+export function parseRegistryEndpointUrl(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        throw new Error("Endpoint URL must be a valid absolute URL");
+    }
+    if (parsed.protocol !== "https:") {
+        throw new Error("Endpoint URL must use https://");
+    }
+    const hostname = normalizeHostLike(parsed.hostname);
+    if (!hostname)
+        throw new Error("Endpoint URL hostname is required");
+    if (BLOCKED_REGISTRY_HOST_LITERALS.has(hostname) ||
+        hostname.endsWith(".localhost") ||
+        hostname.endsWith(".local")) {
+        throw new Error(`Endpoint host "${hostname}" is blocked`);
+    }
+    if (net.isIP(hostname) && isBlockedPrivateOrLinkLocalIp(hostname)) {
+        throw new Error(`Endpoint host "${hostname}" is blocked`);
+    }
+    return parsed;
+}
+async function resolveRegistryEndpointUrlRejection(rawUrl) {
+    let parsed;
+    try {
+        parsed = parseRegistryEndpointUrl(rawUrl);
+    }
+    catch (error) {
+        return {
+            rejection: error instanceof Error ? error.message : String(error),
+            endpoint: null,
+        };
+    }
+    const hostname = normalizeHostLike(parsed.hostname);
+    if (!hostname) {
+        return {
+            rejection: "Endpoint URL hostname is required",
+            endpoint: null,
+        };
+    }
+    if (net.isIP(hostname)) {
+        return {
+            rejection: null,
+            endpoint: { parsed, hostname, pinnedAddress: hostname },
+        };
+    }
+    let addresses;
+    try {
+        const resolved = await dnsLookup(hostname, { all: true });
+        addresses = Array.isArray(resolved) ? resolved : [resolved];
+    }
+    catch {
+        return {
+            rejection: `Could not resolve endpoint host "${hostname}"`,
+            endpoint: null,
+        };
+    }
+    if (addresses.length === 0) {
+        return {
+            rejection: `Could not resolve endpoint host "${hostname}"`,
+            endpoint: null,
+        };
+    }
+    for (const entry of addresses) {
+        if (isBlockedPrivateOrLinkLocalIp(entry.address)) {
+            return {
+                rejection: `Endpoint host "${hostname}" resolves to blocked address ${entry.address}`,
+                endpoint: null,
+            };
+        }
+    }
+    return {
+        rejection: null,
+        endpoint: {
+            parsed,
+            hostname,
+            pinnedAddress: addresses[0]?.address ?? null,
+        },
+    };
+}
+async function fetchSingleEndpoint(url, label) {
+    const { rejection, endpoint } = await resolveRegistryEndpointUrlRejection(url);
+    if (rejection || !endpoint) {
+        logger.warn(`[registry-client] Endpoint "${label}" (${url}) blocked: ${rejection ?? "validation failed"}`);
+        return null;
+    }
+    try {
+        if (endpoint.pinnedAddress && !net.isIP(endpoint.hostname)) {
+            const refreshed = await dnsLookup(endpoint.hostname, { all: true });
+            const refreshedAddresses = new Set((Array.isArray(refreshed) ? refreshed : [refreshed]).map((entry) => normalizeHostLike(entry.address)));
+            if (!refreshedAddresses.has(normalizeHostLike(endpoint.pinnedAddress))) {
+                logger.warn(`[registry-client] Endpoint "${label}" (${url}) blocked: host resolution changed before fetch`);
+                return null;
+            }
+            for (const address of refreshedAddresses) {
+                if (isBlockedPrivateOrLinkLocalIp(address)) {
+                    logger.warn(`[registry-client] Endpoint "${label}" (${url}) blocked: host resolves to blocked address ${address}`);
+                    return null;
+                }
+            }
+        }
+        const resp = await fetch(url, { redirect: "error" });
+        if (!resp.ok) {
+            logger.warn(`[registry-client] Endpoint "${label}" (${url}): ${resp.status} ${resp.statusText}`);
+            return null;
+        }
+        const data = (await resp.json());
+        if (!data.registry || typeof data.registry !== "object") {
+            logger.warn(`[registry-client] Endpoint "${label}" (${url}): missing registry field`);
+            return null;
+        }
+        const plugins = new Map();
+        for (const [name, raw] of Object.entries(data.registry)) {
+            const e = raw;
+            const git = (e.git ?? {});
+            const npm = (e.npm ?? {});
+            const supports = (e.supports ?? { v0: false, v1: false, v2: false });
+            plugins.set(name, {
+                name,
+                gitRepo: git.repo ?? "unknown/unknown",
+                gitUrl: `https://github.com/${git.repo ?? "unknown/unknown"}.git`,
+                description: e.description ?? "",
+                homepage: e.homepage ?? null,
+                topics: e.topics ?? [],
+                stars: e.stargazers_count ?? 0,
+                language: e.language ?? "TypeScript",
+                npm: {
+                    package: npm.repo ?? name,
+                    v0Version: npm.v0 ?? null,
+                    v1Version: npm.v1 ?? null,
+                    v2Version: npm.v2 ?? null,
+                },
+                git: {
+                    v0Branch: git.v0?.branch ?? null,
+                    v1Branch: git.v1?.branch ?? null,
+                    v2Branch: git.v2?.branch ?? null,
+                },
+                supports,
+            });
+        }
+        return plugins;
+    }
+    catch (err) {
+        logger.warn(`[registry-client] Endpoint "${label}" (${url}) failed: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}
+export async function mergeCustomEndpoints(plugins, endpoints) {
+    const enabledEndpoints = endpoints.filter((ep) => ep.enabled !== false);
+    if (enabledEndpoints.length === 0)
+        return;
+    const results = await Promise.allSettled(enabledEndpoints.map((ep) => fetchSingleEndpoint(ep.url, ep.label)));
+    for (const result of results) {
+        if (result.status === "fulfilled" && result.value) {
+            for (const [name, info] of result.value) {
+                if (plugins.has(name)) {
+                    logger.warn(`[registry-client] Ignoring custom endpoint override for ${name}`);
+                    continue;
+                }
+                plugins.set(name, info);
+            }
+        }
+    }
+}

package/dist/packages/autonomous/src/services/registry-client-local.d.ts

@@ -0,0 +1,4 @@
+import type { RegistryPluginInfo } from "./registry-client-types.js";
+export declare function applyNodeModulePlugins(plugins: Map<string, RegistryPluginInfo>): Promise<void>;
+export declare function applyLocalWorkspaceApps(plugins: Map<string, RegistryPluginInfo>): Promise<void>;
+//# sourceMappingURL=registry-client-local.d.ts.map

package/dist/packages/autonomous/src/services/registry-client-local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-client-local.d.ts","sourceRoot":"","sources":["../../../../../src/services/registry-client-local.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAIV,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AAuapC,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC,CA8Bf"}