@elizaos/plugin-elizacloud 2.0.0-alpha.7 → 2.0.0-beta.1

package/src/services/cloud-container.ts

@@ -0,0 +1,297 @@
+/**
+ * CloudContainerService — Manages container lifecycle through ElizaCloud API.
+ *
+ * Handles creation, listing, status polling, health monitoring, and deletion
+ * of ECS-backed containers. Deployments are async (CloudFormation takes 8-12
+ * minutes), so `waitForDeployment` polls with exponential backoff.
+ */
+
+import { type IAgentRuntime, logger, Service } from "@elizaos/core";
+import type {
+  CloudContainer,
+  ContainerDeleteResponse,
+  ContainerGetResponse,
+  ContainerHealthResponse,
+  ContainerListResponse,
+  CreateContainerRequest,
+  CreateContainerResponse,
+} from "../types/cloud";
+import { DEFAULT_CLOUD_CONFIG } from "../types/cloud";
+import type { CloudApiClient } from "../utils/cloud-api";
+import type { CloudAuthService } from "./cloud-auth";
+
+/** Active containers tracked locally for quick access. */
+interface TrackedContainer {
+  container: CloudContainer;
+  pollingTimer: ReturnType<typeof setTimeout> | null;
+  healthTimer: ReturnType<typeof setInterval> | null;
+}
+
+export class CloudContainerService extends Service {
+  static serviceType = "CLOUD_CONTAINER";
+  capabilityDescription = "ElizaCloud container provisioning and lifecycle management";
+
+  private authService!: CloudAuthService;
+  private readonly containerDefaults = DEFAULT_CLOUD_CONFIG.container;
+  private tracked: Map<string, TrackedContainer> = new Map();
+
+  static async start(runtime: IAgentRuntime): Promise<Service> {
+    const service = new CloudContainerService(runtime);
+    await service.initialize();
+    return service;
+  }
+
+  async stop(): Promise<void> {
+    for (const [, tracked] of this.tracked) {
+      if (tracked.pollingTimer) clearTimeout(tracked.pollingTimer);
+      if (tracked.healthTimer) clearInterval(tracked.healthTimer);
+    }
+    this.tracked.clear();
+  }
+
+  private async initialize(): Promise<void> {
+    // Get auth service reference
+    const auth = this.runtime.getService("CLOUD_AUTH");
+    if (!auth) {
+      logger.debug(
+        "[CloudContainer] CloudAuthService not available, container operations will fail"
+      );
+      return;
+    }
+    this.authService = auth as CloudAuthService;
+
+    // Load existing containers
+    if (this.authService.isAuthenticated()) {
+      const containers = await this.listContainers();
+      for (const container of containers) {
+        this.tracked.set(container.id, {
+          container,
+          pollingTimer: null,
+          healthTimer: null,
+        });
+
+        // Resume polling for containers that are still deploying
+        if (
+          container.status === "pending" ||
+          container.status === "building" ||
+          container.status === "deploying"
+        ) {
+          this.startPolling(container.id);
+        }
+
+        // Start health monitoring for running containers
+        if (container.status === "running") {
+          this.startHealthMonitoring(container.id);
+        }
+      }
+      logger.info(`[CloudContainer] Loaded ${containers.length} existing container(s)`);
+    }
+  }
+
+  private getClient(): CloudApiClient {
+    return this.authService.getClient();
+  }
+
+  // ─── CRUD ───────────────────────────────────────────────────────────────
+
+  async createContainer(request: CreateContainerRequest): Promise<CreateContainerResponse> {
+    const client = this.getClient();
+    const defaults = this.containerDefaults;
+
+    const payload: Record<string, unknown> = {
+      name: request.name,
+      project_name: request.project_name,
+      description: request.description,
+      port: request.port ?? defaults.defaultPort,
+      desired_count: request.desired_count ?? 1,
+      cpu: request.cpu ?? defaults.defaultCpu,
+      memory: request.memory ?? defaults.defaultMemory,
+      environment_vars: request.environment_vars ?? {},
+      health_check_path: request.health_check_path ?? "/health",
+      ecr_image_uri: request.ecr_image_uri,
+      ecr_repository_uri: request.ecr_repository_uri,
+      image_tag: request.image_tag,
+      architecture: request.architecture ?? defaults.defaultArchitecture,
+    };
+
+    const response = await client.post<CreateContainerResponse>("/containers", payload);
+
+    // Track the new container
+    this.tracked.set(response.data.id, {
+      container: response.data,
+      pollingTimer: null,
+      healthTimer: null,
+    });
+
+    // Start polling for deployment completion
+    this.startPolling(response.data.id);
+
+    logger.info(
+      `[CloudContainer] Created container "${request.name}" (id=${response.data.id}, stack=${response.stackName})`
+    );
+
+    return response;
+  }
+
+  async listContainers(): Promise<CloudContainer[]> {
+    const client = this.getClient();
+    const response = await client.get<ContainerListResponse>("/containers");
+    return response.data;
+  }
+
+  async getContainer(containerId: string): Promise<CloudContainer> {
+    const client = this.getClient();
+    const response = await client.get<ContainerGetResponse>(`/containers/${containerId}`);
+
+    // Update local tracking
+    const existing = this.tracked.get(containerId);
+    if (existing) {
+      existing.container = response.data;
+    }
+
+    return response.data;
+  }
+
+  async deleteContainer(containerId: string): Promise<void> {
+    const client = this.getClient();
+    await client.delete<ContainerDeleteResponse>(`/containers/${containerId}`);
+
+    // Stop tracking
+    const tracked = this.tracked.get(containerId);
+    if (tracked) {
+      if (tracked.pollingTimer) clearTimeout(tracked.pollingTimer);
+      if (tracked.healthTimer) clearInterval(tracked.healthTimer);
+      this.tracked.delete(containerId);
+    }
+
+    logger.info(`[CloudContainer] Deleted container ${containerId}`);
+  }
+
+  // ─── Deployment Polling ────────────────────────────────────────────────
+
+  /**
+   * Poll container status until it reaches a terminal state (running, failed, stopped).
+   * Uses exponential backoff: 5s, 10s, 20s, 30s, 30s, ...
+   */
+  private startPolling(containerId: string): void {
+    const tracked = this.tracked.get(containerId);
+    if (!tracked) return;
+
+    let attempt = 0;
+    const maxAttempts = 120; // ~1 hour with backoff
+    const baseInterval = 5_000;
+    const maxInterval = 30_000;
+
+    const poll = async () => {
+      attempt++;
+      if (attempt > maxAttempts) {
+        logger.error(
+          `[CloudContainer] Polling timed out for container ${containerId} after ${maxAttempts} attempts`
+        );
+        return;
+      }
+
+      const container = await this.getContainer(containerId);
+      const status = container.status;
+
+      logger.debug(`[CloudContainer] Poll #${attempt} for ${containerId}: status=${status}`);
+
+      if (status === "running") {
+        logger.info(
+          `[CloudContainer] Container ${containerId} is now running at ${container.load_balancer_url}`
+        );
+        this.startHealthMonitoring(containerId);
+        return;
+      }
+
+      if (status === "failed" || status === "stopped" || status === "suspended") {
+        logger.warn(`[CloudContainer] Container ${containerId} reached terminal state: ${status}`);
+        if (container.error_message) {
+          logger.error(`[CloudContainer] Error: ${container.error_message}`);
+        }
+        return;
+      }
+
+      // Schedule next poll with exponential backoff
+      const delay = Math.min(baseInterval * 2 ** Math.min(attempt - 1, 3), maxInterval);
+      tracked.pollingTimer = setTimeout(poll, delay);
+    };
+
+    tracked.pollingTimer = setTimeout(poll, baseInterval);
+  }
+
+  /**
+   * Wait for a container to reach "running" status. Returns the updated container.
+   * This is the synchronous API for actions that need to block.
+   */
+  async waitForDeployment(containerId: string, timeoutMs = 900_000): Promise<CloudContainer> {
+    const deadline = Date.now() + timeoutMs;
+    let interval = 5_000;
+    const maxInterval = 30_000;
+
+    while (Date.now() < deadline) {
+      const container = await this.getContainer(containerId);
+
+      if (container.status === "running") return container;
+      if (container.status === "failed") {
+        throw new Error(
+          `Container deployment failed: ${container.error_message ?? "unknown error"}`
+        );
+      }
+      if (container.status === "stopped" || container.status === "suspended") {
+        throw new Error(`Container reached terminal state: ${container.status}`);
+      }
+
+      await new Promise((resolve) => setTimeout(resolve, interval));
+      interval = Math.min(interval * 1.5, maxInterval);
+    }
+
+    throw new Error(`Container deployment timed out after ${Math.round(timeoutMs / 1000)}s`);
+  }
+
+  // ─── Health Monitoring ─────────────────────────────────────────────────
+
+  private startHealthMonitoring(containerId: string): void {
+    const tracked = this.tracked.get(containerId);
+    if (!tracked || tracked.healthTimer) return;
+
+    const interval = 60_000; // Check every 60 seconds
+
+    tracked.healthTimer = setInterval(() => {
+      this.getContainerHealth(containerId)
+        .then((health) => {
+          if (!health.data.healthy) {
+            logger.warn(
+              `[CloudContainer] Container ${containerId} unhealthy: ${health.data.status}`
+            );
+          }
+        })
+        .catch((err: Error) => {
+          logger.error(`[CloudContainer] Health check failed for ${containerId}: ${err.message}`);
+        });
+    }, interval);
+  }
+
+  async getContainerHealth(containerId: string): Promise<ContainerHealthResponse> {
+    const client = this.getClient();
+    return client.get<ContainerHealthResponse>(`/containers/${containerId}/health`);
+  }
+
+  // ─── Accessors ─────────────────────────────────────────────────────────
+
+  getTrackedContainers(): CloudContainer[] {
+    return Array.from(this.tracked.values()).map((t) => t.container);
+  }
+
+  getTrackedContainer(containerId: string): CloudContainer | undefined {
+    return this.tracked.get(containerId)?.container;
+  }
+
+  isContainerRunning(containerId: string): boolean {
+    return this.tracked.get(containerId)?.container.status === "running";
+  }
+
+  getContainerUrl(containerId: string): string | null {
+    return this.tracked.get(containerId)?.container.load_balancer_url ?? null;
+  }
+}

package/src/services/cloud-credential-provider.ts

@@ -0,0 +1,210 @@
+/**
+ * CloudCredentialProvider — bridges plugin-workflow's `CredentialProvider`
+ * service slot to Eliza Cloud's per-connector OAuth surface.
+ *
+ * Resolution path on `resolve(userId, credType)`:
+ *   1. Look up `credType` in `credTypeToConnector` — return `null` for unmapped.
+ *   2. GET `/eliza/<connector>/status` via the authenticated cloud client to
+ *      check whether the user already has an active connection.
+ *   3. When connected → see `RAW_TOKEN_GAP` below; we currently return
+ *      `needs_auth` because the cloud does not expose raw OAuth tokens.
+ *   4. When not connected → POST `/eliza/<connector>/connect/initiate` with
+ *      the mapped `capabilities`; return `needs_auth` with the authUrl the
+ *      cloud issued. The workflow plugin surfaces this to the user.
+ *
+ * RAW_TOKEN_GAP
+ * -------------
+ * Plugin-workflow's `credential_data` shape requires the actual access token
+ * (so the workflow engine can inject it into a node's HTTP calls). The cloud
+ * connector endpoints (Google / GitHub / Discord) intentionally do **not**
+ * vend raw tokens to the local plugin — they hold the token server-side and
+ * proxy connector calls under `/eliza/<connector>/<action>` (e.g.
+ * `/eliza/google/gmail/send`). Bridging that proxy model into the workflow
+ * engine is a separate piece of work (either: extend the workflow engine to
+ * dispatch through cloud proxies, or add a token-vending endpoint cloud-side
+ * for clients with a verified pairing). Until then this provider is honest:
+ * it confirms the connection exists and either reports it cannot inject
+ * (`null` / `needs_auth`) or — once the cloud exposes a vending endpoint —
+ * fetches and returns the credential payload.
+ *
+ * No fallbacks. No fake tokens. The provider fails closed.
+ */
+
+import { type IAgentRuntime, logger, Service } from "@elizaos/core";
+import { credTypeToConnector, supportedCredTypes } from "../lib/credential-type-map";
+import type { CloudAuthLike } from "../lib/cloud-connection";
+
+// Inlined to avoid a hard compile-time dep on @elizaos/plugin-workflow.
+// The runtime duck-types the service via the shared service-type string.
+const WORKFLOW_CREDENTIAL_PROVIDER_TYPE = "workflow_credential_provider";
+
+export type CredentialProviderResult =
+  | { status: "credential_data"; data: Record<string, unknown> }
+  | { status: "needs_auth"; authUrl: string }
+  | null;
+
+export interface CheckCredentialTypesResult {
+  supported: string[];
+  unsupported: string[];
+}
+
+interface CloudConnectorStatus {
+  connected: boolean;
+  reason?: string;
+  authUrl?: string;
+}
+
+interface CloudConnectInitiateResponse {
+  authUrl?: string;
+}
+
+interface CloudClientLike {
+  get?: (path: string) => Promise<unknown>;
+  post?: (path: string, body?: unknown) => Promise<unknown>;
+}
+
+function isCloudAuthLike(value: unknown): value is CloudAuthLike {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  return typeof Reflect.get(value, "getClient") === "function";
+}
+
+function isCloudClientLike(value: unknown): value is CloudClientLike {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const get = Reflect.get(value, "get");
+  const post = Reflect.get(value, "post");
+  return (
+    (get === undefined || typeof get === "function") &&
+    (post === undefined || typeof post === "function")
+  );
+}
+
+export class CloudCredentialProvider extends Service {
+  static override readonly serviceType = WORKFLOW_CREDENTIAL_PROVIDER_TYPE;
+
+  override capabilityDescription =
+    "Resolves workflow node credentials via the user's paired Eliza Cloud account.";
+
+  static async start(runtime: IAgentRuntime): Promise<CloudCredentialProvider> {
+    return new CloudCredentialProvider(runtime);
+  }
+
+  override async stop(): Promise<void> {
+    // No-op: holds no per-instance state.
+  }
+
+  async resolve(_userId: string, credType: string): Promise<CredentialProviderResult> {
+    const mapping = credTypeToConnector.get(credType);
+    if (!mapping) {
+      return null;
+    }
+
+    const client = this.getCloudClient();
+    if (!client) {
+      logger.debug(
+        { src: "plugin:elizacloud:credential-provider", credType },
+        "CLOUD_AUTH unavailable — cannot resolve workflow credentials",
+      );
+      return null;
+    }
+
+    const status = await this.fetchConnectorStatus(client, mapping.connector);
+
+    if (!status.connected) {
+      const authUrl =
+        status.authUrl ??
+        (await this.initiateConnectorAuth(client, mapping.connector, mapping.capabilities));
+      if (!authUrl) {
+        return null;
+      }
+      return { status: "needs_auth", authUrl };
+    }
+
+    // Connected, but the cloud does not expose raw tokens — see RAW_TOKEN_GAP
+    // in the file header. We re-prompt for explicit user-side auth so the
+    // workflow plugin reports "missing connection" instead of silently
+    // injecting a stale or empty credential. When the cloud adds a token
+    // vending endpoint, fetch + return `credential_data` here.
+    const reauthUrl = await this.initiateConnectorAuth(
+      client,
+      mapping.connector,
+      mapping.capabilities,
+    );
+    if (reauthUrl) {
+      return { status: "needs_auth", authUrl: reauthUrl };
+    }
+    return null;
+  }
+
+  checkCredentialTypes(credTypes: string[]): CheckCredentialTypesResult {
+    const supported: string[] = [];
+    const unsupported: string[] = [];
+    for (const t of credTypes) {
+      if (supportedCredTypes.has(t)) {
+        supported.push(t);
+      } else {
+        unsupported.push(t);
+      }
+    }
+    return { supported, unsupported };
+  }
+
+  // ─── internals ───────────────────────────────────────────────────────
+
+  private getCloudClient(): CloudClientLike | null {
+    const cloudAuth = this.runtime.getService("CLOUD_AUTH");
+    if (!isCloudAuthLike(cloudAuth)) {
+      return null;
+    }
+    const client = cloudAuth.getClient?.();
+    if (!isCloudClientLike(client)) {
+      return null;
+    }
+    return client;
+  }
+
+  private async fetchConnectorStatus(
+    client: CloudClientLike,
+    connector: string,
+  ): Promise<CloudConnectorStatus> {
+    if (typeof client.get !== "function") {
+      return { connected: false };
+    }
+    const raw = await client.get(`/eliza/${connector}/status`);
+    return shapeConnectorStatus(raw);
+  }
+
+  private async initiateConnectorAuth(
+    client: CloudClientLike,
+    connector: string,
+    capabilities: readonly string[] | undefined,
+  ): Promise<string | null> {
+    if (typeof client.post !== "function") {
+      return null;
+    }
+    const body: Record<string, unknown> = {};
+    if (capabilities && capabilities.length > 0) {
+      body.capabilities = [...capabilities];
+    }
+    const raw = (await client.post(
+      `/eliza/${connector}/connect/initiate`,
+      body,
+    )) as CloudConnectInitiateResponse | null;
+    const authUrl = raw?.authUrl;
+    return typeof authUrl === "string" && authUrl.length > 0 ? authUrl : null;
+  }
+}
+
+function shapeConnectorStatus(raw: unknown): CloudConnectorStatus {
+  if (!raw || typeof raw !== "object") {
+    return { connected: false };
+  }
+  const obj = raw as Record<string, unknown>;
+  const connected = obj.connected === true;
+  const reason = typeof obj.reason === "string" ? obj.reason : undefined;
+  const authUrl = typeof obj.authUrl === "string" ? obj.authUrl : undefined;
+  return { connected, reason, authUrl };
+}