@elizaos/plugin-elizacloud 2.0.3-beta.6 → 2.0.3-beta.7

package/dist/node/index.node.js

@@ -2896,6 +2896,7 @@ var cloudStatusProvider = {
       const bridgeSvc = runtime.getService("CLOUD_BRIDGE");
       const containers = containerSvc?.getTrackedContainers() ?? [];
       const connected = bridgeSvc?.getConnectedContainerIds() ?? [];
+      const apiKeyInvalid = auth.isApiKeyInvalid();
       const running = containers.filter((c) => c.status === "running").length;
       const deploying = containers.filter((c) => c.status === "pending" || c.status === "building" || c.status === "deploying").length;
       const summaries = containers.slice(0, MAX_CONTAINER_SUMMARIES).map((c) => ({
@@ -2908,6 +2909,7 @@ var cloudStatusProvider = {
       }));
       const lines = [
         `ElizaCloud: ${containers.length} container(s), ${running} running, ${connected.length} bridged`,
+        ...apiKeyInvalid ? ["  - WARNING: Eliza Cloud API key REVOKED/INVALID — model calls will 401 until re-provisioned"] : [],
         ...summaries.map((c) => `  - ${c.name} [${c.status}]${c.url ? ` @ ${c.url}` : ""}${c.bridged ? " (bridged)" : ""}`)
       ];
       return {
@@ -2915,6 +2917,7 @@ var cloudStatusProvider = {
 `),
         values: {
           cloudAuthenticated: true,
+          cloudApiKeyInvalid: apiKeyInvalid,
           totalContainers: containers.length,
           runningContainers: running,
           deployingContainers: deploying
@@ -4968,7 +4971,6 @@ import {
   resolveApiSecurityConfig,
   resolveDesktopApiPort
 } from "@elizaos/core";
-import { isCloudReachable } from "@elizaos/shared";
 import { createRemoteJWKSet, jwtVerify } from "jose";
 
 // src/types/cloud.ts
@@ -5032,11 +5034,57 @@ function detectPlatform() {
   };
   return map[process.platform] ?? "linux";
 }
+var DEFAULT_REVALIDATION_CONFIG = {
+  retryMs: 60000,
+  steadyMs: 1800000,
+  invalidThreshold: 2
+};
+function decideRevalidation(prev, probe, cfg = DEFAULT_REVALIDATION_CONFIG) {
+  if (probe === "valid") {
+    const log = prev.keyState !== "valid" ? { level: "info", message: "[CloudAuth] API key validated" } : null;
+    return {
+      state: { keyState: "valid", consecutiveInvalid: 0 },
+      delayMs: cfg.steadyMs,
+      log
+    };
+  }
+  if (probe === "invalid") {
+    const consecutiveInvalid = prev.consecutiveInvalid + 1;
+    const confirmed = consecutiveInvalid >= cfg.invalidThreshold;
+    if (confirmed) {
+      const log = prev.keyState !== "invalid" ? {
+        level: "error",
+        message: "[CloudAuth] Eliza Cloud API key is REVOKED/INVALID (cloud reachable, key rejected). Model calls will fail with 401 until the agent is re-provisioned or a valid ELIZAOS_CLOUD_API_KEY is set."
+      } : null;
+      return {
+        state: { keyState: "invalid", consecutiveInvalid },
+        delayMs: cfg.steadyMs,
+        log
+      };
+    }
+    return {
+      state: { keyState: prev.keyState, consecutiveInvalid },
+      delayMs: cfg.retryMs,
+      log: null
+    };
+  }
+  return {
+    state: { ...prev },
+    delayMs: cfg.retryMs,
+    log: null
+  };
+}
+
 class CloudAuthService extends Service {
   static serviceType = "CLOUD_AUTH";
   capabilityDescription = "Eliza Cloud device authentication and SSO session helpers";
   client;
   credentials = null;
+  revalidationTimer = null;
+  revalidationState = {
+    keyState: "unknown",
+    consecutiveInvalid: 0
+  };
   constructor(runtime) {
     super(runtime);
     this.client = new CloudApiClient2(DEFAULT_CLOUD_CONFIG.baseUrl);
@@ -5047,6 +5095,11 @@ class CloudAuthService extends Service {
     return service;
   }
   async stop() {
+    if (this.revalidationTimer) {
+      clearTimeout(this.revalidationTimer);
+      this.revalidationTimer = null;
+    }
+    this.revalidationState = { keyState: "unknown", consecutiveInvalid: 0 };
     this.credentials = null;
   }
   async initialize() {
@@ -5063,11 +5116,7 @@ class CloudAuthService extends Service {
         authenticatedAt: Date.now()
       };
       logger10.info("[CloudAuth] Authenticated with saved API key");
-      this.validateApiKey(key).then((valid) => {
-        if (!valid) {
-          logger10.warn("[CloudAuth] Saved API key could not be validated (cloud may be unreachable or key revoked) — model calls will use the key anyway");
-        }
-      }).catch(() => {});
+      this.scheduleRevalidation(0);
       return;
     }
     const enabled = this.runtime.getSetting("ELIZAOS_CLOUD_ENABLED");
@@ -5083,20 +5132,50 @@ class CloudAuthService extends Service {
       logger10.info("[CloudAuth] Cloud not enabled (set ELIZAOS_CLOUD_ENABLED=true)");
     }
   }
-  async validateApiKey(key) {
-    if (!await isCloudReachable()) {
-      logger10.warn("[CloudAuth] Cloud unreachable at boot — skipping API key validation; key will be used as-is");
-      return false;
-    }
+  async probeApiKey(key) {
     try {
       const validationClient = new CloudApiClient2(this.client.getBaseUrl(), key);
       await validationClient.get("/models", { timeoutMs: 2500 });
-      return true;
+      return "valid";
     } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      logger10.warn(`[CloudAuth] Could not reach cloud API to validate key: ${msg}`);
-      return false;
+      if (err instanceof CloudApiError2 && (err.statusCode === 401 || err.statusCode === 403)) {
+        return "invalid";
+      }
+      return "unreachable";
+    }
+  }
+  scheduleRevalidation(delayMs) {
+    if (this.revalidationTimer) {
+      clearTimeout(this.revalidationTimer);
     }
+    const timer = setTimeout(() => {
+      this.runRevalidation();
+    }, delayMs);
+    timer.unref?.();
+    this.revalidationTimer = timer;
+  }
+  async runRevalidation() {
+    const key = this.credentials?.apiKey;
+    if (!key) {
+      return;
+    }
+    const probe = await this.probeApiKey(key).catch(() => "unreachable");
+    if (this.credentials?.apiKey !== key) {
+      return;
+    }
+    const decision = decideRevalidation(this.revalidationState, probe);
+    this.revalidationState = decision.state;
+    if (decision.log) {
+      if (decision.log.level === "error") {
+        logger10.error(decision.log.message);
+      } else {
+        logger10.info(decision.log.message);
+      }
+    }
+    this.scheduleRevalidation(decision.delayMs);
+  }
+  isApiKeyInvalid() {
+    return this.revalidationState.keyState === "invalid";
   }
   async authenticateWithDevice() {
     const deviceId = await deriveDeviceId();
@@ -9648,4 +9727,4 @@ export {
   BackupScheduler
 };
 
-//# debugId=A3451C99EA049FDB64756E2164756E21
+//# debugId=81B43B4EAB60446064756E2164756E21