@elizaos/plugin-registry 2.0.3-beta.2

package/dist/api/plugin-routes.js

@@ -0,0 +1,1391 @@
+import {
+  applyAdvancedCapabilitiesConfig,
+  applyPluginRuntimeMutation,
+  CORE_PLUGINS,
+  getPluginWidgets,
+  isAdvancedCapabilityPluginId,
+  loadElizaConfig,
+  OPTIONAL_CORE_PLUGINS,
+  resolveAdvancedCapabilitiesEnabled,
+  resolveDefaultAgentWorkspaceDir,
+  saveElizaConfig,
+  validatePluginConfig
+} from "@elizaos/agent";
+import { logger } from "@elizaos/core";
+import {
+  asRecord,
+  isElizaSettingsDebugEnabled,
+  PostPluginCoreToggleRequestSchema,
+  PostPluginInstallRequestSchema,
+  PostPluginUninstallRequestSchema,
+  PostPluginUpdateRequestSchema,
+  PutPluginRequestSchema,
+  PutSecretsRequestSchema,
+  sanitizeForSettingsDebug,
+  settingsDebugCloudSummary
+} from "@elizaos/shared";
+function optionalPluginListId(npmName) {
+  if (npmName.startsWith("@elizaos/app-")) {
+    return npmName.slice("@elizaos/".length);
+  }
+  return npmName.replace("@elizaos/plugin-", "");
+}
+const ADVANCED_CAPABILITY_SERVICE_BY_PLUGIN_ID = {
+  experience: "EXPERIENCE",
+  personality: "CHARACTER_MANAGEMENT"
+};
+function getPluginHealthProbe(plugin) {
+  if (!plugin || typeof plugin !== "object") {
+    return null;
+  }
+  const record = plugin;
+  for (const key of ["health", "healthCheck", "testConnection", "test"]) {
+    const candidate = record[key];
+    if (typeof candidate === "function") {
+      return candidate;
+    }
+  }
+  return null;
+}
+function normalizeRegistryLookupKey(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed.toLowerCase() : null;
+}
+function registryLookupCandidates(plugin) {
+  const candidates = /* @__PURE__ */ new Set();
+  const add = (value) => {
+    const normalized = normalizeRegistryLookupKey(value);
+    if (normalized) candidates.add(normalized);
+  };
+  add(plugin.npmName);
+  add(plugin.name);
+  add(plugin.id);
+  add(`@elizaos/plugin-${plugin.id}`);
+  add(`@elizaos/app-${plugin.id}`);
+  return Array.from(candidates);
+}
+function applyRegistryMetadata(plugin, registryMetadataByName) {
+  const registryInfo = registryLookupCandidates(plugin).map((candidate) => registryMetadataByName.get(candidate)).find((candidate) => Boolean(candidate));
+  if (!registryInfo) {
+    if (plugin.npmName?.startsWith("@elizaos/")) {
+      plugin.origin ??= "builtin";
+      plugin.registrySource ??= "builtin";
+      plugin.support ??= "first-party";
+      plugin.builtIn ??= true;
+      plugin.firstParty ??= true;
+      plugin.thirdParty ??= false;
+    }
+    return;
+  }
+  plugin.directory = registryInfo.directory ?? plugin.directory ?? null;
+  plugin.registryKind = registryInfo.registryKind ?? registryInfo.kind ?? plugin.registryKind;
+  plugin.origin = registryInfo.origin ?? plugin.origin;
+  plugin.registrySource = registryInfo.source ?? plugin.registrySource;
+  plugin.support = registryInfo.support ?? plugin.support;
+  plugin.builtIn = registryInfo.builtIn ?? plugin.builtIn;
+  plugin.firstParty = registryInfo.firstParty ?? plugin.firstParty;
+  plugin.thirdParty = registryInfo.thirdParty ?? plugin.thirdParty;
+  plugin.status = registryInfo.status ?? plugin.status;
+  plugin.homepage = plugin.homepage ?? registryInfo.homepage ?? void 0;
+  plugin.repository = plugin.repository ?? `https://github.com/${registryInfo.gitRepo}`;
+  plugin.latestVersion = plugin.latestVersion ?? registryInfo.npm.v2Version ?? registryInfo.npm.v1Version ?? registryInfo.npm.v0Version ?? null;
+}
+const pluginsListInFlight = /* @__PURE__ */ new WeakMap();
+function readCompatEnabledFromConfig(config, pluginId) {
+  const container = asRecord(config.connectors)?.[pluginId] ?? asRecord(config.streaming)?.[pluginId];
+  const value = asRecord(container)?.enabled;
+  return typeof value === "boolean" ? value : null;
+}
+function buildCoreToggleDiagnostics(config, npmName) {
+  const pluginId = optionalPluginListId(npmName);
+  const isOptional = OPTIONAL_CORE_PLUGINS.includes(
+    npmName
+  );
+  if (!isOptional) {
+    return null;
+  }
+  const allowList = new Set(config.plugins?.allow ?? []);
+  const enabledAllowList = allowList.has(npmName) || allowList.has(pluginId);
+  const entryEnabledRaw = config.plugins?.entries?.[pluginId]?.enabled;
+  const enabledEntries = typeof entryEnabledRaw === "boolean" ? entryEnabledRaw : null;
+  const enabledCompat = readCompatEnabledFromConfig(config, pluginId);
+  const driftFlags = [];
+  if (enabledEntries !== null && enabledEntries !== enabledAllowList) {
+    driftFlags.push("entries_vs_allowlist");
+  }
+  if (enabledEntries !== null && enabledCompat !== null && enabledEntries !== enabledCompat) {
+    driftFlags.push("entries_vs_compat");
+  }
+  return {
+    pluginId,
+    npmName,
+    enabled_allowlist: enabledAllowList,
+    enabled_entries: enabledEntries,
+    enabled_compat: enabledCompat,
+    drift_flags: driftFlags
+  };
+}
+async function handlePluginRoutes(ctx) {
+  const {
+    req,
+    res,
+    method,
+    pathname,
+    state,
+    json,
+    error,
+    readJsonBody,
+    scheduleRuntimeRestart,
+    restartRuntime,
+    BLOCKED_ENV_KEYS,
+    discoverInstalledPlugins,
+    maskValue,
+    aggregateSecrets,
+    readProviderCache,
+    paramKeyToCategory,
+    buildPluginEvmDiagnosticEntry,
+    EVM_PLUGIN_PACKAGE,
+    applyWhatsAppQrOverride,
+    applySignalQrOverride,
+    resolvePluginConfigMutationRejections,
+    requirePluginManager,
+    requireCoreManager
+  } = ctx;
+  const buildPluginsListSnapshot = async () => {
+    let freshConfig;
+    try {
+      freshConfig = loadElizaConfig();
+    } catch {
+      freshConfig = state.config;
+    }
+    const bundledIds = new Set(state.plugins.map((p) => p.id));
+    const installedEntries = discoverInstalledPlugins(freshConfig, bundledIds);
+    const allPlugins = [...state.plugins, ...installedEntries];
+    let installedMetadataByName = /* @__PURE__ */ new Map();
+    let registryMetadataByName = /* @__PURE__ */ new Map();
+    try {
+      const pluginManager = requirePluginManager(state.runtime);
+      const installed = await pluginManager.listInstalledPlugins();
+      installedMetadataByName = new Map(
+        installed.map((plugin) => [
+          plugin.name,
+          {
+            version: plugin.version,
+            releaseStream: plugin.releaseStream,
+            requestedVersion: plugin.requestedVersion,
+            latestVersion: plugin.latestVersion,
+            betaVersion: plugin.betaVersion
+          }
+        ])
+      );
+      const registry = await pluginManager.refreshRegistry();
+      registryMetadataByName = /* @__PURE__ */ new Map();
+      for (const [key, info] of registry) {
+        for (const candidate of [key, info.name, info.npm.package]) {
+          const normalized = normalizeRegistryLookupKey(candidate);
+          if (normalized) registryMetadataByName.set(normalized, info);
+        }
+      }
+    } catch {
+    }
+    const evmDiagnostic = buildPluginEvmDiagnosticEntry({
+      config: state.config,
+      runtime: state.runtime
+    });
+    const existingEvmPlugin = allPlugins.find(
+      (plugin) => plugin.id === "evm" || plugin.id === "wallet" || plugin.npmName === EVM_PLUGIN_PACKAGE
+    );
+    if (existingEvmPlugin) {
+      existingEvmPlugin.autoEnabled = evmDiagnostic.autoEnabled;
+      existingEvmPlugin.managementMode = "core-optional";
+      existingEvmPlugin.capabilityStatus = evmDiagnostic.capabilityStatus;
+      existingEvmPlugin.capabilityReason = evmDiagnostic.capabilityReason;
+      existingEvmPlugin.prerequisites = evmDiagnostic.prerequisites;
+      existingEvmPlugin.setupGuideUrl = existingEvmPlugin.setupGuideUrl ?? evmDiagnostic.setupGuideUrl;
+      existingEvmPlugin.tags = Array.from(
+        /* @__PURE__ */ new Set([...existingEvmPlugin.tags, ...evmDiagnostic.tags])
+      );
+    } else {
+      allPlugins.push(evmDiagnostic);
+    }
+    const configEntries = freshConfig.plugins?.entries;
+    const advancedCapabilitiesEnabled = resolveAdvancedCapabilitiesEnabled(freshConfig);
+    const loadedNames = state.runtime ? state.runtime.plugins.map((p) => p.name) : [];
+    for (const plugin of allPlugins) {
+      applyRegistryMetadata(plugin, registryMetadataByName);
+      const installedMetadata = (plugin.npmName ? installedMetadataByName.get(plugin.npmName) : null) ?? installedMetadataByName.get(plugin.name);
+      if (installedMetadata) {
+        plugin.version = installedMetadata.version ?? plugin.version;
+        plugin.releaseStream = installedMetadata.releaseStream ?? plugin.releaseStream;
+        plugin.requestedVersion = installedMetadata.requestedVersion ?? plugin.requestedVersion;
+        plugin.latestVersion = installedMetadata.latestVersion ?? plugin.latestVersion ?? null;
+        plugin.betaVersion = installedMetadata.betaVersion ?? plugin.betaVersion ?? null;
+      }
+      if (isAdvancedCapabilityPluginId(plugin.id)) {
+        const serviceType = ADVANCED_CAPABILITY_SERVICE_BY_PLUGIN_ID[plugin.id];
+        plugin.enabled = advancedCapabilitiesEnabled;
+        plugin.isActive = advancedCapabilitiesEnabled ? serviceType ? Boolean(state.runtime?.getService(serviceType)) : Boolean(state.runtime) : false;
+        plugin.autoEnabled = advancedCapabilitiesEnabled;
+        plugin.loadError = void 0;
+        continue;
+      }
+      const suffix = `plugin-${plugin.id}`;
+      const packageName = `@elizaos/plugin-${plugin.id}`;
+      const npmPkgName = plugin.npmName;
+      const isLoaded = loadedNames.length > 0 && loadedNames.some((name) => {
+        return name === plugin.id || name === suffix || name === packageName || npmPkgName != null && name === npmPkgName || name.endsWith(`/${suffix}`);
+      });
+      plugin.isActive = isLoaded;
+      const configEntry = configEntries?.[plugin.id];
+      if (configEntry && typeof configEntry.enabled === "boolean") {
+        plugin.enabled = configEntry.enabled;
+      } else {
+        plugin.enabled = isLoaded;
+      }
+      plugin.loadError = void 0;
+      if (plugin.enabled && !isLoaded && state.runtime) {
+        const installs = freshConfig.plugins?.installs;
+        const packageName2 = `@elizaos/plugin-${plugin.id}`;
+        const hasInstallRecord = installs?.[packageName2] || installs?.[plugin.id];
+        if (hasInstallRecord) {
+          plugin.loadError = "Plugin installed but failed to load \u2014 the package may be missing compiled files.";
+        }
+      }
+      if (plugin.id === "evm" || plugin.id === "wallet" || plugin.npmName === EVM_PLUGIN_PACKAGE) {
+        plugin.enabled = evmDiagnostic.enabled;
+        plugin.isActive = evmDiagnostic.isActive;
+        plugin.autoEnabled = evmDiagnostic.autoEnabled;
+        plugin.managementMode = "core-optional";
+        plugin.capabilityStatus = evmDiagnostic.capabilityStatus;
+        plugin.capabilityReason = evmDiagnostic.capabilityReason;
+        plugin.prerequisites = evmDiagnostic.prerequisites;
+      }
+    }
+    for (const plugin of allPlugins) {
+      for (const param of plugin.parameters) {
+        const envValue = process.env[param.key];
+        param.isSet = Boolean(envValue?.trim());
+        param.currentValue = param.isSet ? param.sensitive ? maskValue(envValue ?? "") : envValue ?? "" : null;
+      }
+      const paramInfos = plugin.parameters.map((p) => ({
+        key: p.key,
+        required: p.required,
+        sensitive: p.sensitive,
+        type: p.type,
+        description: p.description,
+        default: p.default
+      }));
+      const validation = validatePluginConfig(
+        plugin.id,
+        plugin.category,
+        plugin.envKey,
+        plugin.configKeys,
+        void 0,
+        paramInfos
+      );
+      plugin.validationErrors = validation.errors;
+      plugin.validationWarnings = validation.warnings;
+    }
+    applyWhatsAppQrOverride(allPlugins, resolveDefaultAgentWorkspaceDir());
+    applySignalQrOverride(allPlugins, resolveDefaultAgentWorkspaceDir());
+    for (const plugin of allPlugins) {
+      const providerModels = readProviderCache(plugin.id)?.models ?? [];
+      for (const param of plugin.parameters) {
+        if (!param.key.toUpperCase().includes("MODEL")) continue;
+        const expectedCat = paramKeyToCategory(param.key);
+        const filtered = providerModels.filter(
+          (m) => m.category === expectedCat
+        );
+        if (!plugin.configUiHints) plugin.configUiHints = {};
+        plugin.configUiHints[param.key] = {
+          ...plugin.configUiHints[param.key],
+          type: "select",
+          options: filtered.map((m) => ({
+            value: m.id,
+            label: m.name !== m.id ? `${m.name} (${m.id})` : m.id
+          }))
+        };
+      }
+    }
+    const runtimePlugins = state.runtime?.plugins ?? [];
+    const normalizeId = (value) => {
+      let v = value.trim();
+      if (v.startsWith("@")) {
+        const slash = v.indexOf("/");
+        if (slash > 0) v = v.slice(slash + 1);
+      }
+      if (v.startsWith("plugin-")) v = v.slice("plugin-".length);
+      if (v.startsWith("app-")) v = v.slice("app-".length);
+      return v;
+    };
+    for (const plugin of allPlugins) {
+      const widgets = getPluginWidgets(plugin.id, runtimePlugins);
+      if (widgets.length > 0) {
+        plugin.widgets = widgets;
+      }
+      const normalizedPluginId = normalizeId(plugin.id);
+      const matchedRuntime = runtimePlugins.find(
+        (p) => normalizeId(p.name) === normalizedPluginId
+      );
+      if (matchedRuntime?.app) {
+        const a = matchedRuntime.app;
+        plugin.app = {
+          displayName: a.displayName,
+          category: a.category,
+          icon: a.icon,
+          developerOnly: a.developerOnly,
+          visibleInAppStore: a.visibleInAppStore,
+          navTabs: a.navTabs?.map((t) => ({
+            id: t.id,
+            label: t.label,
+            icon: t.icon,
+            path: t.path,
+            order: t.order,
+            developerOnly: t.developerOnly,
+            group: t.group,
+            componentExport: t.componentExport
+          }))
+        };
+      }
+    }
+    return allPlugins;
+  };
+  const resolvePluginsSnapshot = async (config) => {
+    const { resolvePlugins } = await import("@elizaos/agent");
+    return resolvePlugins(config, { quiet: true });
+  };
+  const resolvePluginsSnapshotSafe = async (config, reason) => {
+    try {
+      return await resolvePluginsSnapshot(config);
+    } catch (err) {
+      logger.warn(
+        `[plugin-routes] Failed to resolve plugin snapshot for ${reason}: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return void 0;
+    }
+  };
+  const npmNamePattern = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+  const validateRegistryPluginPackageName = (pluginName) => {
+    const trimmedName = pluginName.trim();
+    if (!trimmedName) {
+      return "Request body must include 'name' (plugin package name)";
+    }
+    if (!npmNamePattern.test(trimmedName)) {
+      return "Invalid plugin name format";
+    }
+    return null;
+  };
+  if (method === "GET" && pathname === "/api/plugins") {
+    let inFlight = pluginsListInFlight.get(state);
+    if (!inFlight) {
+      inFlight = buildPluginsListSnapshot();
+      pluginsListInFlight.set(state, inFlight);
+    }
+    const allPlugins = await inFlight.finally(() => {
+      pluginsListInFlight.delete(state);
+    });
+    json(res, { plugins: allPlugins });
+    return true;
+  }
+  if (method === "PUT" && pathname.startsWith("/api/plugins/")) {
+    const pluginId = pathname.slice("/api/plugins/".length);
+    const rawPlugin = await readJsonBody(req, res);
+    if (rawPlugin === null) return true;
+    const parsedPlugin = PutPluginRequestSchema.safeParse(rawPlugin);
+    if (!parsedPlugin.success) {
+      error(
+        res,
+        parsedPlugin.error.issues[0]?.message ?? "Invalid request body",
+        400
+      );
+      return true;
+    }
+    const body = parsedPlugin.data;
+    if (isElizaSettingsDebugEnabled()) {
+      logger.debug(
+        `[eliza][settings][api] PUT /api/plugins/${pluginId} body=${JSON.stringify(
+          sanitizeForSettingsDebug({
+            enabled: body.enabled,
+            configKeys: body.config ? Object.keys(body.config).sort() : [],
+            config: body.config ?? {}
+          })
+        )}`
+      );
+    }
+    let plugin = state.plugins.find((p) => p.id === pluginId);
+    if (!plugin) {
+      let freshCfg;
+      try {
+        freshCfg = loadElizaConfig();
+      } catch {
+        freshCfg = state.config;
+      }
+      const bundledIds = new Set(state.plugins.map((p) => p.id));
+      const installed = discoverInstalledPlugins(freshCfg, bundledIds);
+      const found = installed.find((p) => p.id === pluginId);
+      if (found) {
+        state.plugins.push(found);
+        plugin = found;
+      }
+    }
+    if (!plugin) {
+      error(res, `Plugin "${pluginId}" not found`, 404);
+      return true;
+    }
+    const previousConfig = structuredClone(state.config);
+    const previousResolvedPlugins = state.runtime ? await resolvePluginsSnapshotSafe(previousConfig, "plugin update") : void 0;
+    if (body.enabled !== void 0) {
+      plugin.enabled = body.enabled;
+    }
+    if (body.config) {
+      const configRejections = resolvePluginConfigMutationRejections(
+        plugin.parameters,
+        body.config
+      );
+      if (configRejections.length > 0) {
+        json(
+          res,
+          { ok: false, plugin, validationErrors: configRejections },
+          422
+        );
+        return true;
+      }
+      const configObj = body.config;
+      const submittedParamInfos = plugin.parameters.filter((p) => p.key in configObj).map((p) => ({
+        key: p.key,
+        required: p.required,
+        sensitive: p.sensitive,
+        type: p.type,
+        description: p.description,
+        default: p.default
+      }));
+      const configValidation = validatePluginConfig(
+        pluginId,
+        plugin.category,
+        plugin.envKey,
+        plugin.configKeys,
+        body.config,
+        submittedParamInfos
+      );
+      if (!configValidation.valid) {
+        json(
+          res,
+          { ok: false, plugin, validationErrors: configValidation.errors },
+          422
+        );
+        return true;
+      }
+      const allowedParamKeys = new Set(plugin.parameters.map((p) => p.key));
+      const allowedParamsByKey = new Map(
+        plugin.parameters.map((p) => [p.key, p])
+      );
+      if (!state.config.env) {
+        state.config.env = {};
+      }
+      if (!state.config.plugins) {
+        state.config.plugins = {};
+      }
+      if (!state.config.plugins.entries) {
+        state.config.plugins.entries = {};
+      }
+      const entries = state.config.plugins.entries;
+      const pluginEntry = entries[pluginId] ?? {};
+      const nextPluginConfig = asRecord(pluginEntry.config) ? { ...pluginEntry.config } : {};
+      let touchedPluginConfig = false;
+      for (const [key, value] of Object.entries(body.config)) {
+        if (allowedParamKeys.has(key) && !BLOCKED_ENV_KEYS.has(key.toUpperCase()) && typeof value === "string") {
+          touchedPluginConfig = true;
+          if (value.trim()) {
+            process.env[key] = value;
+            state.config.env[key] = value;
+            nextPluginConfig[key] = value;
+          } else if (!allowedParamsByKey.get(key)?.required) {
+            delete process.env[key];
+            delete state.config.env[key];
+            delete nextPluginConfig[key];
+          }
+        }
+      }
+      if (touchedPluginConfig) {
+        pluginEntry.config = nextPluginConfig;
+        entries[pluginId] = pluginEntry;
+      }
+      plugin.configured = true;
+      if (body.enabled === void 0) {
+        try {
+          saveElizaConfig(state.config);
+        } catch (err) {
+          logger.warn(
+            `[eliza-api] Failed to save config: ${err instanceof Error ? err.message : err}`
+          );
+        }
+      }
+    }
+    const refreshParamInfos = plugin.parameters.map((p) => ({
+      key: p.key,
+      required: p.required,
+      sensitive: p.sensitive,
+      type: p.type,
+      description: p.description,
+      default: p.default
+    }));
+    const updated = validatePluginConfig(
+      pluginId,
+      plugin.category,
+      plugin.envKey,
+      plugin.configKeys,
+      void 0,
+      refreshParamInfos
+    );
+    plugin.validationErrors = updated.errors;
+    plugin.validationWarnings = updated.warnings;
+    if (body.enabled !== void 0) {
+      if (isAdvancedCapabilityPluginId(pluginId)) {
+        applyAdvancedCapabilitiesConfig(state.config, body.enabled);
+        for (const candidate of state.plugins) {
+          if (isAdvancedCapabilityPluginId(candidate.id)) {
+            candidate.enabled = body.enabled;
+          }
+        }
+        logger.info(
+          `[eliza-api] ${body.enabled ? "Enabled" : "Disabled"} advanced capabilities via plugin alias: ${pluginId}`
+        );
+      } else {
+        const packageName = `@elizaos/plugin-${pluginId}`;
+        if (!state.config.plugins) {
+          state.config.plugins = {};
+        }
+        if (!state.config.plugins.entries) {
+          state.config.plugins.entries = {};
+        }
+        const entries = state.config.plugins.entries;
+        entries[pluginId] = { enabled: body.enabled };
+        state.config.plugins.allow = state.config.plugins.allow ?? [];
+        const allow = state.config.plugins.allow;
+        if (body.enabled) {
+          if (!allow.includes(pluginId) && !allow.includes(packageName)) {
+            allow.push(pluginId);
+          }
+        } else {
+          state.config.plugins.allow = allow.filter(
+            (p) => p !== pluginId && p !== packageName
+          );
+        }
+        logger.info(
+          `[eliza-api] ${body.enabled ? "Enabled" : "Disabled"} plugin: ${packageName}`
+        );
+      }
+      const CAPABILITY_FEATURE_IDS = /* @__PURE__ */ new Set([
+        "vision",
+        "browser",
+        "computeruse",
+        "coding-agent"
+      ]);
+      if (CAPABILITY_FEATURE_IDS.has(pluginId)) {
+        if (!state.config.features) {
+          state.config.features = {};
+        }
+        state.config.features[pluginId] = body.enabled;
+      }
+      try {
+        saveElizaConfig(state.config);
+      } catch (err) {
+        logger.warn(
+          `[eliza-api] Failed to save config: ${err instanceof Error ? err.message : err}`
+        );
+      }
+    }
+    const runtimeApply = await applyPluginRuntimeMutation({
+      runtime: state.runtime,
+      previousConfig,
+      nextConfig: state.config,
+      previousResolvedPlugins,
+      changedPluginId: pluginId,
+      changedPluginPackage: plugin.npmName,
+      config: body.config,
+      expectRuntimeGraphChange: body.enabled !== void 0,
+      reason: body.enabled !== void 0 ? `Plugin toggle: ${pluginId}` : `Plugin config updated: ${pluginId}`,
+      restartRuntime
+    });
+    if (runtimeApply.requiresRestart) {
+      scheduleRuntimeRestart(runtimeApply.reason);
+    }
+    if (isElizaSettingsDebugEnabled()) {
+      const cloud = state.config.cloud;
+      logger.debug(
+        `[eliza][settings][api] PUT /api/plugins/${pluginId} \u2192 done configured=${plugin.configured} enabled=${plugin.enabled} cloud=${JSON.stringify(settingsDebugCloudSummary(cloud))}`
+      );
+    }
+    json(res, {
+      ok: true,
+      plugin,
+      applied: runtimeApply.mode,
+      requiresRestart: runtimeApply.requiresRestart,
+      restartedRuntime: runtimeApply.restartedRuntime,
+      loadedPackages: runtimeApply.loadedPackages,
+      unloadedPackages: runtimeApply.unloadedPackages,
+      reloadedPackages: runtimeApply.reloadedPackages
+    });
+    return true;
+  }
+  if (method === "GET" && pathname === "/api/secrets") {
+    const bundledIds = new Set(state.plugins.map((p) => p.id));
+    const installedEntries = discoverInstalledPlugins(state.config, bundledIds);
+    const allPlugins = [...state.plugins, ...installedEntries];
+    if (state.runtime) {
+      const loadedNames = state.runtime.plugins.map((p) => p.name);
+      for (const plugin of allPlugins) {
+        const suffix = `plugin-${plugin.id}`;
+        const packageName = `@elizaos/plugin-${plugin.id}`;
+        plugin.enabled = loadedNames.some(
+          (name) => name === plugin.id || name === suffix || name === packageName || name.endsWith(`/${suffix}`)
+        );
+      }
+    }
+    const secrets = aggregateSecrets(allPlugins);
+    json(res, { secrets });
+    return true;
+  }
+  if (method === "PUT" && pathname === "/api/secrets") {
+    const rawSecrets = await readJsonBody(req, res);
+    if (rawSecrets === null) return true;
+    const parsedSecrets = PutSecretsRequestSchema.safeParse(rawSecrets);
+    if (!parsedSecrets.success) {
+      error(
+        res,
+        parsedSecrets.error.issues[0]?.message ?? "Invalid request body",
+        400
+      );
+      return true;
+    }
+    const body = parsedSecrets.data;
+    const bundledIds = new Set(state.plugins.map((p) => p.id));
+    const installedEntries = discoverInstalledPlugins(state.config, bundledIds);
+    const allPlugins = [...state.plugins, ...installedEntries];
+    const allowedKeys = /* @__PURE__ */ new Set();
+    for (const plugin of allPlugins) {
+      for (const param of plugin.parameters) {
+        if (param.sensitive) allowedKeys.add(param.key);
+      }
+    }
+    const updatedKeys = [];
+    for (const [key, value] of Object.entries(body.secrets)) {
+      if (typeof value !== "string" || !value.trim()) continue;
+      if (!allowedKeys.has(key)) continue;
+      if (BLOCKED_ENV_KEYS.has(key.toUpperCase())) continue;
+      process.env[key] = value;
+      updatedKeys.push(key);
+    }
+    for (const plugin of allPlugins) {
+      const pluginKeys = new Set(plugin.parameters.map((p) => p.key));
+      if (updatedKeys.some((k) => pluginKeys.has(k))) {
+        plugin.configured = true;
+      }
+    }
+    json(res, { ok: true, updated: updatedKeys });
+    return true;
+  }
+  const pluginTestMatch = method === "POST" && pathname.match(/^\/api\/plugins\/([^/]+)\/test$/);
+  if (pluginTestMatch) {
+    const pluginId = decodeURIComponent(pluginTestMatch[1]);
+    const startMs = Date.now();
+    try {
+      const allPlugins = state.runtime?.plugins ?? [];
+      const normalizePluginId = (value) => {
+        const scopedPackage = value.match(/^@[^/]+\/plugin-(.+)$/);
+        if (scopedPackage) {
+          return scopedPackage[1] ?? value;
+        }
+        return value.replace(/^@[^/]+\//, "").replace(/^plugin-/, "");
+      };
+      const normalizedPluginId = normalizePluginId(pluginId);
+      const plugin = allPlugins.find((p) => {
+        const runtimeName = p.name ?? "";
+        const runtimeId = normalizePluginId(runtimeName);
+        return p.id === pluginId || p.name === pluginId || runtimeId === pluginId || runtimeId === normalizedPluginId;
+      });
+      if (!plugin) {
+        json(
+          res,
+          {
+            success: false,
+            pluginId,
+            error: "Plugin not found or not loaded",
+            durationMs: Date.now() - startMs
+          },
+          404
+        );
+        return true;
+      }
+      const testFn = getPluginHealthProbe(plugin);
+      if (typeof testFn === "function") {
+        const result = await testFn();
+        json(res, {
+          success: result.ok !== false,
+          pluginId,
+          message: result.message ?? (result.ok !== false ? "Connection successful" : "Connection failed"),
+          durationMs: Date.now() - startMs
+        });
+        return true;
+      }
+      json(res, {
+        success: true,
+        pluginId,
+        message: "Plugin is loaded and active (no custom test available)",
+        durationMs: Date.now() - startMs
+      });
+    } catch (err) {
+      json(
+        res,
+        {
+          success: false,
+          pluginId,
+          error: err instanceof Error ? err.message : String(err),
+          durationMs: Date.now() - startMs
+        },
+        500
+      );
+    }
+    return true;
+  }
+  if (method === "POST" && pathname === "/api/plugins/install") {
+    const rawInstall = await readJsonBody(req, res);
+    if (rawInstall === null) return true;
+    const parsedInstall = PostPluginInstallRequestSchema.safeParse(rawInstall);
+    if (!parsedInstall.success) {
+      error(
+        res,
+        parsedInstall.error.issues[0]?.message ?? "Invalid request body",
+        400
+      );
+      return true;
+    }
+    const body = parsedInstall.data;
+    const pluginName = body.name;
+    const installValidationError = validateRegistryPluginPackageName(pluginName);
+    if (installValidationError) {
+      error(res, installValidationError, 400);
+      return true;
+    }
+    try {
+      const previousConfig = structuredClone(state.config);
+      const previousResolvedPlugins = state.runtime ? await resolvePluginsSnapshotSafe(previousConfig, "plugin install") : void 0;
+      const pluginManager = requirePluginManager(state.runtime);
+      const result = await pluginManager.installPlugin(
+        pluginName,
+        (progress) => {
+          logger.info(`[install] ${progress.phase}: ${progress.message}`);
+          state.broadcastWs?.({
+            type: "install-progress",
+            pluginName: progress.pluginName,
+            phase: progress.phase,
+            message: progress.message
+          });
+        },
+        {
+          releaseStream: body.stream,
+          version: body.version
+        }
+      );
+      if (!result.success) {
+        json(res, { ok: false, error: result.error }, 422);
+        return true;
+      }
+      const installedId = result.pluginName.replace(/^@[^/]+\/plugin-/, "").replace(/^@[^/]+\//, "").replace(/^plugin-/, "");
+      if (!state.config.plugins) {
+        state.config.plugins = {};
+      }
+      if (!state.config.plugins.entries) {
+        state.config.plugins.entries = {};
+      }
+      const pluginEntries = state.config.plugins.entries;
+      pluginEntries[installedId] = { enabled: true };
+      if (result.installPath) {
+        if (!state.config.plugins.installs || typeof state.config.plugins.installs !== "object") {
+          state.config.plugins.installs = {};
+        }
+        const installs = state.config.plugins.installs;
+        installs[result.pluginName] = {
+          source: "npm",
+          requestedVersion: result.requestedVersion,
+          releaseStream: result.releaseStream,
+          installPath: result.installPath,
+          version: result.version,
+          installedAt: (/* @__PURE__ */ new Date()).toISOString()
+        };
+      }
+      try {
+        saveElizaConfig(state.config);
+      } catch (err) {
+        logger.warn(
+          `[eliza-api] Failed to save config after install: ${err instanceof Error ? err.message : err}`
+        );
+      }
+      const runtimeApply = await applyPluginRuntimeMutation({
+        runtime: state.runtime,
+        previousConfig,
+        nextConfig: state.config,
+        previousResolvedPlugins,
+        changedPluginId: installedId,
+        changedPluginPackage: result.pluginName,
+        expectRuntimeGraphChange: true,
+        reason: `Plugin ${result.pluginName} installed`,
+        restartRuntime
+      });
+      if (runtimeApply.requiresRestart && body.autoRestart !== false) {
+        scheduleRuntimeRestart(runtimeApply.reason);
+      }
+      json(res, {
+        ok: true,
+        pluginName: result.pluginName,
+        plugin: {
+          name: result.pluginName,
+          version: result.version,
+          installPath: result.installPath
+        },
+        applied: runtimeApply.mode,
+        requiresRestart: runtimeApply.requiresRestart,
+        restartedRuntime: runtimeApply.restartedRuntime,
+        loadedPackages: runtimeApply.loadedPackages,
+        unloadedPackages: runtimeApply.unloadedPackages,
+        reloadedPackages: runtimeApply.reloadedPackages,
+        releaseStream: result.releaseStream,
+        requestedVersion: result.requestedVersion,
+        latestVersion: result.latestVersion,
+        betaVersion: result.betaVersion,
+        message: runtimeApply.requiresRestart ? `${result.pluginName} installed. Restart required to activate.` : `${result.pluginName} installed.`
+      });
+    } catch (err) {
+      error(
+        res,
+        `Install failed: ${err instanceof Error ? err.message : String(err)}`,
+        500
+      );
+    }
+    return true;
+  }
+  if (method === "POST" && pathname === "/api/plugins/update") {
+    const rawUpdate = await readJsonBody(req, res);
+    if (rawUpdate === null) return true;
+    const parsedUpdate = PostPluginUpdateRequestSchema.safeParse(rawUpdate);
+    if (!parsedUpdate.success) {
+      error(
+        res,
+        parsedUpdate.error.issues[0]?.message ?? "Invalid request body",
+        400
+      );
+      return true;
+    }
+    const body = parsedUpdate.data;
+    const pluginName = body.name;
+    const updateValidationError = validateRegistryPluginPackageName(pluginName);
+    if (updateValidationError) {
+      error(res, updateValidationError, 400);
+      return true;
+    }
+    try {
+      const previousConfig = structuredClone(state.config);
+      const previousResolvedPlugins = state.runtime ? await resolvePluginsSnapshotSafe(previousConfig, "plugin update") : void 0;
+      const pluginManager = requirePluginManager(state.runtime);
+      const updatePlugin = typeof pluginManager.updatePlugin === "function" ? pluginManager.updatePlugin.bind(pluginManager) : pluginManager.installPlugin.bind(pluginManager);
+      const result = await updatePlugin(
+        pluginName,
+        (progress) => {
+          logger.info(`[update] ${progress.phase}: ${progress.message}`);
+          state.broadcastWs?.({
+            type: "install-progress",
+            pluginName: progress.pluginName,
+            phase: progress.phase,
+            message: progress.message
+          });
+        },
+        {
+          releaseStream: body.stream,
+          version: body.version
+        }
+      );
+      if (!result.success) {
+        json(res, { ok: false, error: result.error }, 422);
+        return true;
+      }
+      if (!state.config.plugins) {
+        state.config.plugins = {};
+      }
+      if (!state.config.plugins.entries) {
+        state.config.plugins.entries = {};
+      }
+      const updatedId = result.pluginName.replace(/^@[^/]+\/plugin-/, "").replace(/^@[^/]+\//, "").replace(/^plugin-/, "");
+      state.config.plugins.entries[updatedId] = { enabled: true };
+      state.config.plugins.installs = state.config.plugins.installs ?? {};
+      state.config.plugins.installs[result.pluginName] = {
+        source: "npm",
+        requestedVersion: result.requestedVersion,
+        releaseStream: result.releaseStream,
+        installPath: result.installPath,
+        version: result.version,
+        installedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      try {
+        saveElizaConfig(state.config);
+      } catch (err) {
+        logger.warn(
+          `[eliza-api] Failed to save config after update: ${err instanceof Error ? err.message : err}`
+        );
+      }
+      const runtimeApply = await applyPluginRuntimeMutation({
+        runtime: state.runtime,
+        previousConfig,
+        nextConfig: state.config,
+        previousResolvedPlugins,
+        changedPluginId: updatedId,
+        changedPluginPackage: result.pluginName,
+        forceReloadPackages: [result.pluginName],
+        expectRuntimeGraphChange: true,
+        reason: `Plugin ${result.pluginName} updated`,
+        restartRuntime
+      });
+      if (runtimeApply.requiresRestart && body.autoRestart !== false) {
+        scheduleRuntimeRestart(runtimeApply.reason);
+      }
+      json(res, {
+        ok: true,
+        pluginName: result.pluginName,
+        plugin: {
+          name: result.pluginName,
+          version: result.version,
+          installPath: result.installPath
+        },
+        applied: runtimeApply.mode,
+        requiresRestart: runtimeApply.requiresRestart,
+        restartedRuntime: runtimeApply.restartedRuntime,
+        loadedPackages: runtimeApply.loadedPackages,
+        unloadedPackages: runtimeApply.unloadedPackages,
+        reloadedPackages: runtimeApply.reloadedPackages,
+        releaseStream: result.releaseStream,
+        requestedVersion: result.requestedVersion,
+        latestVersion: result.latestVersion,
+        betaVersion: result.betaVersion,
+        message: runtimeApply.requiresRestart ? `${result.pluginName} updated. Restart required to activate.` : `${result.pluginName} updated.`
+      });
+    } catch (err) {
+      error(
+        res,
+        `Update failed: ${err instanceof Error ? err.message : String(err)}`,
+        500
+      );
+    }
+    return true;
+  }
+  if (method === "POST" && pathname === "/api/plugins/uninstall") {
+    const rawUninstall = await readJsonBody(req, res);
+    if (rawUninstall === null) return true;
+    const parsedUninstall = PostPluginUninstallRequestSchema.safeParse(rawUninstall);
+    if (!parsedUninstall.success) {
+      error(
+        res,
+        parsedUninstall.error.issues[0]?.message ?? "Invalid request body",
+        400
+      );
+      return true;
+    }
+    const body = parsedUninstall.data;
+    const pluginName = body.name;
+    const uninstallValidationError = validateRegistryPluginPackageName(pluginName);
+    if (uninstallValidationError) {
+      error(res, uninstallValidationError, 400);
+      return true;
+    }
+    try {
+      const previousConfig = structuredClone(state.config);
+      const previousResolvedPlugins = state.runtime ? await resolvePluginsSnapshotSafe(previousConfig, "plugin uninstall") : void 0;
+      const pluginManager = requirePluginManager(state.runtime);
+      const result = await pluginManager.uninstallPlugin(pluginName);
+      if (!result.success) {
+        json(res, { ok: false, error: result.error }, 422);
+        return true;
+      }
+      const removedId = result.pluginName.replace(/^@[^/]+\/plugin-/, "").replace(/^@[^/]+\//, "").replace(/^plugin-/, "");
+      const installs = state.config.plugins?.installs;
+      if (installs && typeof installs === "object") {
+        delete installs[result.pluginName];
+      }
+      const entries = state.config.plugins?.entries;
+      if (entries && typeof entries === "object") {
+        delete entries[removedId];
+      }
+      try {
+        saveElizaConfig(state.config);
+      } catch (err) {
+        logger.warn(
+          `[eliza-api] Failed to save config after uninstall: ${err instanceof Error ? err.message : err}`
+        );
+      }
+      const runtimeApply = await applyPluginRuntimeMutation({
+        runtime: state.runtime,
+        previousConfig,
+        nextConfig: state.config,
+        previousResolvedPlugins,
+        changedPluginId: removedId,
+        changedPluginPackage: result.pluginName,
+        expectRuntimeGraphChange: true,
+        reason: `Plugin ${pluginName} uninstalled`,
+        restartRuntime
+      });
+      if (runtimeApply.requiresRestart && body.autoRestart !== false) {
+        scheduleRuntimeRestart(runtimeApply.reason);
+      }
+      json(res, {
+        ok: true,
+        pluginName: result.pluginName,
+        applied: runtimeApply.mode,
+        requiresRestart: runtimeApply.requiresRestart,
+        restartedRuntime: runtimeApply.restartedRuntime,
+        loadedPackages: runtimeApply.loadedPackages,
+        unloadedPackages: runtimeApply.unloadedPackages,
+        reloadedPackages: runtimeApply.reloadedPackages,
+        message: runtimeApply.requiresRestart ? `${pluginName} uninstalled. Restart required.` : `${pluginName} uninstalled.`
+      });
+    } catch (err) {
+      error(
+        res,
+        `Uninstall failed: ${err instanceof Error ? err.message : String(err)}`,
+        500
+      );
+    }
+    return true;
+  }
+  if (method === "POST" && pathname.match(/^\/api\/plugins\/[^/]+\/eject$/)) {
+    const pluginName = decodeURIComponent(
+      pathname.slice("/api/plugins/".length, pathname.length - "/eject".length)
+    );
+    try {
+      const previousConfig = structuredClone(state.config);
+      const previousResolvedPlugins = state.runtime ? await resolvePluginsSnapshotSafe(previousConfig, "plugin eject") : void 0;
+      const pluginManager = requirePluginManager(state.runtime);
+      if (typeof pluginManager.ejectPlugin !== "function") {
+        throw new Error("Plugin manager does not support ejecting plugins");
+      }
+      const result = await pluginManager.ejectPlugin(pluginName);
+      if (!result.success) {
+        json(res, { ok: false, error: result.error }, 422);
+        return true;
+      }
+      const runtimeApply = await applyPluginRuntimeMutation({
+        runtime: state.runtime,
+        previousConfig,
+        nextConfig: state.config,
+        previousResolvedPlugins,
+        changedPluginId: pluginName,
+        changedPluginPackage: result.pluginName,
+        forceReloadPackages: [result.pluginName],
+        expectRuntimeGraphChange: true,
+        reason: `Plugin ${pluginName} ejected`,
+        restartRuntime
+      });
+      if (runtimeApply.requiresRestart) {
+        scheduleRuntimeRestart(runtimeApply.reason);
+      }
+      json(res, {
+        ok: true,
+        pluginName: result.pluginName,
+        applied: runtimeApply.mode,
+        requiresRestart: runtimeApply.requiresRestart,
+        restartedRuntime: runtimeApply.restartedRuntime,
+        loadedPackages: runtimeApply.loadedPackages,
+        unloadedPackages: runtimeApply.unloadedPackages,
+        reloadedPackages: runtimeApply.reloadedPackages,
+        message: `${pluginName} ejected to local source.`
+      });
+    } catch (err) {
+      error(
+        res,
+        `Eject failed: ${err instanceof Error ? err.message : String(err)}`,
+        500
+      );
+    }
+    return true;
+  }
+  if (method === "POST" && pathname.match(/^\/api\/plugins\/[^/]+\/sync$/)) {
+    const pluginName = decodeURIComponent(
+      pathname.slice("/api/plugins/".length, pathname.length - "/sync".length)
+    );
+    try {
+      const previousConfig = structuredClone(state.config);
+      const previousResolvedPlugins = state.runtime ? await resolvePluginsSnapshotSafe(previousConfig, "plugin sync") : void 0;
+      const pluginManager = requirePluginManager(state.runtime);
+      if (typeof pluginManager.syncPlugin !== "function") {
+        throw new Error("Plugin manager does not support syncing plugins");
+      }
+      const result = await pluginManager.syncPlugin(pluginName);
+      if (!result.success) {
+        json(res, { ok: false, error: result.error }, 422);
+        return true;
+      }
+      const runtimeApply = await applyPluginRuntimeMutation({
+        runtime: state.runtime,
+        previousConfig,
+        nextConfig: state.config,
+        previousResolvedPlugins,
+        changedPluginId: pluginName,
+        changedPluginPackage: result.pluginName,
+        forceReloadPackages: result.requiresRestart ? [result.pluginName] : [],
+        expectRuntimeGraphChange: true,
+        reason: `Plugin ${pluginName} synced`,
+        restartRuntime
+      });
+      if (runtimeApply.requiresRestart) {
+        scheduleRuntimeRestart(runtimeApply.reason);
+      }
+      json(res, {
+        ok: true,
+        pluginName: result.pluginName,
+        applied: runtimeApply.mode,
+        requiresRestart: runtimeApply.requiresRestart,
+        restartedRuntime: runtimeApply.restartedRuntime,
+        loadedPackages: runtimeApply.loadedPackages,
+        unloadedPackages: runtimeApply.unloadedPackages,
+        reloadedPackages: runtimeApply.reloadedPackages,
+        message: `${pluginName} synced with upstream.`
+      });
+    } catch (err) {
+      error(
+        res,
+        `Sync failed: ${err instanceof Error ? err.message : String(err)}`,
+        500
+      );
+    }
+    return true;
+  }
+  if (method === "POST" && pathname.match(/^\/api\/plugins\/[^/]+\/reinject$/)) {
+    const pluginName = decodeURIComponent(
+      pathname.slice(
+        "/api/plugins/".length,
+        pathname.length - "/reinject".length
+      )
+    );
+    try {
+      const previousConfig = structuredClone(state.config);
+      const previousResolvedPlugins = state.runtime ? await resolvePluginsSnapshotSafe(previousConfig, "plugin reinject") : void 0;
+      const pluginManager = requirePluginManager(state.runtime);
+      if (typeof pluginManager.reinjectPlugin !== "function") {
+        throw new Error("Plugin manager does not support reinjecting plugins");
+      }
+      const result = await pluginManager.reinjectPlugin(pluginName);
+      if (!result.success) {
+        json(res, { ok: false, error: result.error }, 422);
+        return true;
+      }
+      const runtimeApply = await applyPluginRuntimeMutation({
+        runtime: state.runtime,
+        previousConfig,
+        nextConfig: state.config,
+        previousResolvedPlugins,
+        changedPluginId: pluginName,
+        changedPluginPackage: result.pluginName,
+        forceReloadPackages: [result.pluginName],
+        expectRuntimeGraphChange: true,
+        reason: `Plugin ${pluginName} reinjected`,
+        restartRuntime
+      });
+      if (runtimeApply.requiresRestart) {
+        scheduleRuntimeRestart(runtimeApply.reason);
+      }
+      json(res, {
+        ok: true,
+        pluginName: result.pluginName,
+        applied: runtimeApply.mode,
+        requiresRestart: runtimeApply.requiresRestart,
+        restartedRuntime: runtimeApply.restartedRuntime,
+        loadedPackages: runtimeApply.loadedPackages,
+        unloadedPackages: runtimeApply.unloadedPackages,
+        reloadedPackages: runtimeApply.reloadedPackages,
+        message: `${pluginName} restored to registry version.`
+      });
+    } catch (err) {
+      error(
+        res,
+        `Reinject failed: ${err instanceof Error ? err.message : String(err)}`,
+        500
+      );
+    }
+    return true;
+  }
+  if (method === "GET" && pathname === "/api/plugins/installed") {
+    try {
+      const pluginManager = requirePluginManager(state.runtime);
+      const installed = await pluginManager.listInstalledPlugins();
+      json(res, { count: installed.length, plugins: installed });
+    } catch (err) {
+      error(
+        res,
+        `Failed to list installed plugins: ${err instanceof Error ? err.message : String(err)}`,
+        500
+      );
+    }
+    return true;
+  }
+  if (method === "GET" && pathname === "/api/plugins/ejected") {
+    try {
+      const pluginManager = requirePluginManager(state.runtime);
+      if (typeof pluginManager.listEjectedPlugins !== "function") {
+        throw new Error(
+          "Plugin manager does not support listing ejected plugins"
+        );
+      }
+      const plugins = await pluginManager.listEjectedPlugins();
+      json(res, { count: plugins.length, plugins });
+    } catch (err) {
+      error(
+        res,
+        `Failed to list ejected plugins: ${err instanceof Error ? err.message : String(err)}`,
+        500
+      );
+    }
+    return true;
+  }
+  if (method === "GET" && pathname === "/api/core/status") {
+    try {
+      const coreManager = requireCoreManager(state.runtime);
+      const coreStatus = await coreManager.getCoreStatus();
+      json(res, coreStatus);
+    } catch (err) {
+      error(
+        res,
+        `Failed to get core status: ${err instanceof Error ? err.message : String(err)}`,
+        500
+      );
+    }
+    return true;
+  }
+  if (method === "GET" && pathname === "/api/plugins/core") {
+    const loadedNames = state.runtime ? new Set(state.runtime.plugins.map((p) => p.name)) : /* @__PURE__ */ new Set();
+    const isLoaded = (npmName) => {
+      if (loadedNames.has(npmName)) return true;
+      const withoutScope = npmName.replace("@elizaos/", "");
+      if (loadedNames.has(withoutScope)) return true;
+      const shortId = withoutScope.replace("plugin-", "");
+      if (loadedNames.has(shortId)) return true;
+      for (const n of loadedNames) {
+        if (n.includes(shortId) || shortId.includes(n)) return true;
+      }
+      return false;
+    };
+    const allowList = new Set(state.config.plugins?.allow ?? []);
+    const makeEntry = (npm, isCore) => {
+      const id = optionalPluginListId(npm);
+      return {
+        npmName: npm,
+        id,
+        name: id.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" "),
+        isCore,
+        loaded: isLoaded(npm),
+        enabled: isCore || allowList.has(npm) || allowList.has(id)
+      };
+    };
+    const coreList = CORE_PLUGINS.map((npm) => makeEntry(npm, true));
+    const optionalList = OPTIONAL_CORE_PLUGINS.map(
+      (npm) => makeEntry(npm, false)
+    );
+    json(res, { core: coreList, optional: optionalList });
+    return true;
+  }
+  if (method === "POST" && pathname === "/api/plugins/core/toggle") {
+    const rawToggle = await readJsonBody(req, res);
+    if (rawToggle === null) return true;
+    const parsedToggle = PostPluginCoreToggleRequestSchema.safeParse(rawToggle);
+    if (!parsedToggle.success) {
+      error(
+        res,
+        parsedToggle.error.issues[0]?.message ?? "Invalid request body",
+        400
+      );
+      return true;
+    }
+    const body = parsedToggle.data;
+    const isCorePlugin = CORE_PLUGINS.includes(
+      body.npmName
+    );
+    if (isCorePlugin) {
+      error(res, "Core plugins cannot be disabled");
+      return true;
+    }
+    const isOptional = OPTIONAL_CORE_PLUGINS.includes(
+      body.npmName
+    );
+    if (!isOptional) {
+      error(res, "Unknown optional plugin");
+      return true;
+    }
+    const previousConfig = structuredClone(state.config);
+    const previousResolvedPlugins = state.runtime ? await resolvePluginsSnapshotSafe(previousConfig, "core plugin toggle") : void 0;
+    state.config.plugins = state.config.plugins ?? {};
+    state.config.plugins.allow = state.config.plugins.allow ?? [];
+    const allow = state.config.plugins.allow;
+    const shortId = optionalPluginListId(body.npmName);
+    if (body.enabled) {
+      if (!allow.includes(body.npmName) && !allow.includes(shortId)) {
+        allow.push(body.npmName);
+      }
+    } else {
+      state.config.plugins.allow = allow.filter(
+        (p) => p !== body.npmName && p !== shortId
+      );
+    }
+    const pluginsRoot = state.config.plugins;
+    const prevEntries = pluginsRoot.entries ?? {};
+    pluginsRoot.entries = {
+      ...prevEntries,
+      [shortId]: {
+        ...prevEntries[shortId],
+        enabled: body.enabled
+      }
+    };
+    try {
+      saveElizaConfig(state.config);
+    } catch (err) {
+      logger.warn(
+        `[api] Config save failed: ${err instanceof Error ? err.message : err}`
+      );
+    }
+    const runtimeApply = await applyPluginRuntimeMutation({
+      runtime: state.runtime,
+      previousConfig,
+      nextConfig: state.config,
+      previousResolvedPlugins,
+      changedPluginId: shortId,
+      changedPluginPackage: body.npmName,
+      expectRuntimeGraphChange: true,
+      reason: `Plugin ${shortId} ${body.enabled ? "enabled" : "disabled"}`,
+      restartRuntime
+    });
+    if (runtimeApply.requiresRestart) {
+      scheduleRuntimeRestart(runtimeApply.reason);
+    }
+    json(res, {
+      ok: true,
+      applied: runtimeApply.mode,
+      requiresRestart: runtimeApply.requiresRestart,
+      restartedRuntime: runtimeApply.restartedRuntime,
+      loadedPackages: runtimeApply.loadedPackages,
+      unloadedPackages: runtimeApply.unloadedPackages,
+      reloadedPackages: runtimeApply.reloadedPackages,
+      diagnostics: (() => {
+        const diagnostic = buildCoreToggleDiagnostics(
+          state.config,
+          body.npmName
+        );
+        return diagnostic && diagnostic.drift_flags.length > 0 ? {
+          withDrift: true,
+          plugin: diagnostic
+        } : void 0;
+      })(),
+      message: runtimeApply.requiresRestart ? `${shortId} ${body.enabled ? "enabled" : "disabled"}. Restart required.` : `${shortId} ${body.enabled ? "enabled" : "disabled"}.`
+    });
+    return true;
+  }
+  return false;
+}
+export {
+  handlePluginRoutes
+};
+//# sourceMappingURL=plugin-routes.js.map