@elizaos/plugin-wallet 2.0.0-beta.1 → 2.0.3-beta.5

package/src/audit/audit-log.ts

@@ -1,9 +1,13 @@
+import { createHash } from "node:crypto";
 import type {
   ActionFailureCode,
   ValidateFailureCode,
 } from "../actions/failure-codes.js";
 import type { SignScope } from "../wallet/pending.js";
 
+const AUDIT_HASH_ALGORITHM = "sha256";
+const AUDIT_GENESIS_HASH = "0".repeat(64);
+
 export type AuditKind =
   | "action_validate_start"
   | "action_validate_end"
@@ -25,8 +29,7 @@ export type AuditOutcome =
   | "rejected";
 
 /**
- * Row shape for the append-only audit log (hash-chained at rest).
- * Implementation + SQL migration land with Phase 1 runtime wiring.
+ * Row shape for the append-only audit log.
  */
 export interface AuditLogRow {
   readonly id: bigint;
@@ -43,3 +46,55 @@ export interface AuditLogRow {
   readonly prevHash: string;
   readonly rowHash: string;
 }
+
+export type AuditLogRowInput = Omit<
+  AuditLogRow,
+  "id" | "ts" | "prevHash" | "rowHash"
+> & {
+  readonly id?: bigint;
+  readonly ts?: number;
+  readonly prevHash?: string | null;
+};
+
+export function createAuditLogRow(input: AuditLogRowInput): AuditLogRow {
+  const rowWithoutHash = {
+    id: input.id ?? 0n,
+    ts: input.ts ?? Date.now(),
+    actor: input.actor,
+    kind: input.kind,
+    scope: input.scope,
+    actionName: input.actionName,
+    paramsHash: input.paramsHash,
+    approvalId: input.approvalId,
+    outcome: input.outcome,
+    failureCode: input.failureCode,
+    detail: input.detail,
+    prevHash: input.prevHash ?? AUDIT_GENESIS_HASH,
+  };
+  return {
+    ...rowWithoutHash,
+    rowHash: computeAuditLogRowHash(rowWithoutHash),
+  };
+}
+
+export function verifyAuditLogRow(row: AuditLogRow): boolean {
+  return row.rowHash === computeAuditLogRowHash(row);
+}
+
+function computeAuditLogRowHash(row: Omit<AuditLogRow, "rowHash">): string {
+  const canonical = JSON.stringify({
+    id: row.id.toString(),
+    ts: row.ts,
+    actor: row.actor,
+    kind: row.kind,
+    scope: row.scope,
+    actionName: row.actionName,
+    paramsHash: row.paramsHash,
+    approvalId: row.approvalId,
+    outcome: row.outcome,
+    failureCode: row.failureCode,
+    detail: row.detail,
+    prevHash: row.prevHash,
+  });
+  return createHash(AUDIT_HASH_ALGORITHM).update(canonical).digest("hex");
+}

package/src/browser-shim/build-shim.ts

@@ -74,7 +74,7 @@ function readTemplate(): string {
     }
   }
   throw new Error(
-    "wallet shim template not found in any of: " + candidates.join(", "),
+    `wallet shim template not found in any of: ${candidates.join(", ")}`,
   );
 }
 

package/src/browser-shim/shim.template.js

@@ -1,4 +1,5 @@
 /* eslint-disable */
+// biome-ignore-all lint/correctness/noInnerDeclarations: this injected browser template intentionally uses function-scoped var declarations for compatibility.
 /**
  * Wallet shim — runs inside an arbitrary dApp page (in MAIN world) and exposes
  * the agent's resident keypairs as both a Solana Wallet-Standard wallet and an
@@ -6,7 +7,7 @@
  * HTTP API (`@elizaos/plugin-wallet` sign endpoints) over fetch.
  *
  * The shim is consumed via `buildWalletShim({ apiBase, signToken, walletName,
- * walletIcon, solanaPublicKey, evmAddress })` which substitutes the placeholder
+ * walletIcon, solanaPublicKey, evmAddress })` which substitutes the config
  * `__SHIM_CONFIG__` token and returns a self-contained string suitable for
  * `Page.addInitScript` / `BROWSER eval` / a MAIN-world content script.
  *
@@ -32,7 +33,9 @@
     for (var i = 0; i < bytes.length; i += chunk) {
       bin += String.fromCharCode.apply(
         null,
-        bytes.subarray ? bytes.subarray(i, i + chunk) : bytes.slice(i, i + chunk),
+        bytes.subarray
+          ? bytes.subarray(i, i + chunk)
+          : bytes.slice(i, i + chunk),
       );
     }
     return btoa(bin);
@@ -43,11 +46,11 @@
     for (var i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
     return out;
   }
-  function bytesToHex(bytes) {
+  function _bytesToHex(bytes) {
     var out = "0x";
     for (var i = 0; i < bytes.length; i++) {
       var h = bytes[i].toString(16);
-      out += h.length === 1 ? "0" + h : h;
+      out += h.length === 1 ? `0${h}` : h;
     }
     return out;
   }
@@ -56,7 +59,7 @@
   }
   // base58 (Bitcoin alphabet) — small impl, only needed to log the active key
   var B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
-  function base58Encode(bytes) {
+  function _base58Encode(bytes) {
     var digits = [0];
     for (var i = 0; i < bytes.length; i++) {
       var carry = bytes[i];
@@ -100,13 +103,13 @@
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        Authorization: "Bearer " + CONFIG.signToken,
+        Authorization: `Bearer ${CONFIG.signToken}`,
       },
       body: JSON.stringify(body || {}),
-    }).then(function (r) {
+    }).then((r) => {
       if (!r.ok) {
-        return r.text().then(function (t) {
-          throw new Error("wallet-shim " + path + " " + r.status + ": " + t);
+        return r.text().then((t) => {
+          throw new Error(`wallet-shim ${path} ${r.status}: ${t}`);
         });
       }
       return r.json();
@@ -117,17 +120,15 @@
   function makeEmitter() {
     var listeners = {};
     return {
-      on: function (e, l) {
-        (listeners[e] = listeners[e] || []).push(l);
-        return function () {
-          listeners[e] = (listeners[e] || []).filter(function (x) {
-            return x !== l;
-          });
+      on: (e, l) => {
+        listeners[e] = listeners[e] || [];
+        listeners[e].push(l);
+        return () => {
+          listeners[e] = (listeners[e] || []).filter((x) => x !== l);
         };
       },
-      emit: function (e) {
-        var args = [].slice.call(arguments, 1);
-        (listeners[e] || []).forEach(function (l) {
+      emit: (e, ...args) => {
+        (listeners[e] || []).forEach((l) => {
           try {
             l.apply(null, args);
           } catch (_) {}
@@ -167,46 +168,40 @@
 
     function signTransaction(input) {
       var inputs = Array.isArray(input) ? input : [input];
-      var b64s = inputs.map(function (i) {
-        return bytesToBase64(i.transaction);
-      });
+      var b64s = inputs.map((i) => bytesToBase64(i.transaction));
       return api("/wallet/solana/sign-all-transactions", {
         transactionsBase64: b64s,
-      }).then(function (resp) {
-        return resp.signedBase64s.map(function (b64) {
-          return { signedTransaction: base64ToBytes(b64) };
-        });
-      });
+      }).then((resp) =>
+        resp.signedBase64s.map((b64) => ({
+          signedTransaction: base64ToBytes(b64),
+        })),
+      );
     }
 
     function signAndSendTransaction(input) {
       var inputs = Array.isArray(input) ? input : [input];
       return Promise.all(
-        inputs.map(function (i) {
-          return api("/wallet/solana/sign-and-send-transaction", {
+        inputs.map((i) =>
+          api("/wallet/solana/sign-and-send-transaction", {
             transactionBase64: bytesToBase64(i.transaction),
             sendOptions: i.options || {},
-          }).then(function (resp) {
-            return { signature: base58Decode(resp.signature) };
-          });
-        }),
+          }).then((resp) => ({ signature: base58Decode(resp.signature) })),
+        ),
       );
     }
 
     function signMessage(input) {
       var inputs = Array.isArray(input) ? input : [input];
       return Promise.all(
-        inputs.map(function (i) {
-          return api("/wallet/solana/sign-message", {
+        inputs.map((i) =>
+          api("/wallet/solana/sign-message", {
             messageBase64: bytesToBase64(i.message),
-          }).then(function (resp) {
-            return {
-              signedMessage: i.message,
-              signature: base64ToBytes(resp.signatureBase64),
-              signatureType: "ed25519",
-            };
-          });
-        }),
+          }).then((resp) => ({
+            signedMessage: i.message,
+            signature: base64ToBytes(resp.signatureBase64),
+            signatureType: "ed25519",
+          })),
+        ),
       );
     }
 
@@ -221,9 +216,7 @@
         "standard:disconnect": { version: "1.0.0", disconnect: disconnect },
         "standard:events": {
           version: "1.0.0",
-          on: function (e, l) {
-            return emitter.on(e, l);
-          },
+          on: (e, l) => emitter.on(e, l),
         },
         "solana:signTransaction": {
           version: "1.0.0",
@@ -246,7 +239,7 @@
     function registerCallback(api) {
       try {
         api.register(wallet);
-      } catch (e) {
+      } catch (_e) {
         // already registered or registry refused — non-fatal
       }
     }
@@ -264,8 +257,8 @@
     try {
       window.addEventListener(
         "wallet-standard:app-ready",
-        function (e) {
-          if (e && e.detail) registerCallback(e.detail);
+        (e) => {
+          if (e?.detail) registerCallback(e.detail);
         },
         false,
       );
@@ -284,88 +277,95 @@
     var phantomLike = {
       isPhantom: true,
       isConnected: true,
-      publicKey: { toBase58: function () { return publicKey; }, toBuffer: function () { return publicKeyBytes; }, toBytes: function () { return publicKeyBytes; }, toString: function () { return publicKey; } },
+      publicKey: {
+        toBase58: () => publicKey,
+        toBuffer: () => publicKeyBytes,
+        toBytes: () => publicKeyBytes,
+        toString: () => publicKey,
+      },
       connect: function () {
         return Promise.resolve({ publicKey: this.publicKey });
       },
-      disconnect: function () {
+      disconnect: () => {
         emitter.emit("disconnect");
         return Promise.resolve();
       },
       on: emitter.on,
-      off: function () {},
-      signTransaction: function (tx) {
+      off: () => {},
+      signTransaction: (tx) => {
         // legacy phantom returns a single signed tx (Transaction object); we
         // only have raw bytes so dApps using the new adapter pattern get the
         // proper Wallet-Standard call instead.
         var serialized =
           typeof tx.serialize === "function"
-            ? tx.serialize({ requireAllSignatures: false, verifySignatures: false })
+            ? tx.serialize({
+                requireAllSignatures: false,
+                verifySignatures: false,
+              })
             : tx;
         return api("/wallet/solana/sign-transaction", {
           transactionBase64: bytesToBase64(new Uint8Array(serialized)),
-        }).then(function (resp) {
+        }).then((resp) => {
           var bytes = base64ToBytes(resp.signedBase64);
           // Try to populate signatures back into the original tx object so
           // dApp code that does `tx.signatures` keeps working.
           if (tx && Array.isArray(tx.signatures)) {
-            // No-op; we return raw bytes the dApp can re-deserialize.
+            // Return raw bytes so the dApp can re-deserialize.
           }
           // Most dApps either re-deserialize or call signAndSend; expose bytes
           // via `serialize()` on the returned object.
           return {
-            serialize: function () {
-              return bytes;
-            },
+            serialize: () => bytes,
             __signedBytes: bytes,
           };
         });
       },
-      signAllTransactions: function (txs) {
-        var b64s = txs.map(function (tx) {
+      signAllTransactions: (txs) => {
+        var b64s = txs.map((tx) => {
           var serialized =
             typeof tx.serialize === "function"
-              ? tx.serialize({ requireAllSignatures: false, verifySignatures: false })
+              ? tx.serialize({
+                  requireAllSignatures: false,
+                  verifySignatures: false,
+                })
               : tx;
           return bytesToBase64(new Uint8Array(serialized));
         });
         return api("/wallet/solana/sign-all-transactions", {
           transactionsBase64: b64s,
-        }).then(function (resp) {
-          return resp.signedBase64s.map(function (b64) {
+        }).then((resp) =>
+          resp.signedBase64s.map((b64) => {
             var bytes = base64ToBytes(b64);
             return {
-              serialize: function () {
-                return bytes;
-              },
+              serialize: () => bytes,
               __signedBytes: bytes,
             };
-          });
-        });
+          }),
+        );
       },
-      signMessage: function (message, _encoding) {
-        return api("/wallet/solana/sign-message", {
+      signMessage: (message, _encoding) =>
+        api("/wallet/solana/sign-message", {
           messageBase64: bytesToBase64(
-            message instanceof Uint8Array ? message : utf8ToBytes(String(message)),
+            message instanceof Uint8Array
+              ? message
+              : utf8ToBytes(String(message)),
           ),
-        }).then(function (resp) {
-          return {
-            signature: base64ToBytes(resp.signatureBase64),
-            publicKey: { toBase58: function () { return publicKey; } },
-          };
-        });
-      },
-      signAndSendTransaction: function (tx, options) {
+        }).then((resp) => ({
+          signature: base64ToBytes(resp.signatureBase64),
+          publicKey: { toBase58: () => publicKey },
+        })),
+      signAndSendTransaction: (tx, options) => {
         var serialized =
           typeof tx.serialize === "function"
-            ? tx.serialize({ requireAllSignatures: false, verifySignatures: false })
+            ? tx.serialize({
+                requireAllSignatures: false,
+                verifySignatures: false,
+              })
             : tx;
         return api("/wallet/solana/sign-and-send-transaction", {
           transactionBase64: bytesToBase64(new Uint8Array(serialized)),
           sendOptions: options || {},
-        }).then(function (resp) {
-          return { signature: resp.signature };
-        });
+        }).then((resp) => ({ signature: resp.signature }));
       },
     };
 
@@ -392,7 +392,7 @@
     if (!CONFIG.evmAddress) return;
     var address = CONFIG.evmAddress.toLowerCase();
     var emitter = makeEmitter();
-    var chainId = "0x" + CONFIG.evmChainId.toString(16);
+    var chainId = `0x${CONFIG.evmChainId.toString(16)}`;
 
     function rpc(method, params) {
       // Forward read-only RPC methods to a public RPC for this chain. The agent
@@ -408,10 +408,8 @@
           params: params || [],
         }),
       })
-        .then(function (r) {
-          return r.json();
-        })
-        .then(function (j) {
+        .then((r) => r.json())
+        .then((j) => {
           if (j.error) throw new Error(j.error.message || "rpc error");
           return j.result;
         });
@@ -421,9 +419,9 @@
       isMetaMask: true, // many dApps gate connect-button discovery on this
       isElizaWallet: true,
       _state: { isConnected: true, accounts: [address], chainId: chainId },
-      request: function (args) {
-        var method = args && args.method;
-        var params = (args && args.params) || [];
+      request: (args) => {
+        var method = args?.method;
+        var params = args?.params || [];
         switch (method) {
           case "eth_requestAccounts":
           case "eth_accounts":
@@ -431,11 +429,13 @@
           case "eth_chainId":
           case "net_version":
             return Promise.resolve(
-              method === "net_version" ? String(parseInt(chainId, 16)) : chainId,
+              method === "net_version"
+                ? String(parseInt(chainId, 16))
+                : chainId,
             );
           case "wallet_switchEthereumChain":
             try {
-              var nextHex = params[0] && params[0].chainId;
+              var nextHex = params[0]?.chainId;
               if (typeof nextHex === "string") {
                 chainId = nextHex;
                 emitter.emit("chainChanged", chainId);
@@ -459,17 +459,13 @@
               maybeAddr = swap;
             }
             return api("/wallet/evm/personal-sign", { message: msg }).then(
-              function (r) {
-                return r.signature;
-              },
+              (r) => r.signature,
             );
           }
           case "eth_sign": {
-            return api("/wallet/evm/personal-sign", { message: params[1] }).then(
-              function (r) {
-                return r.signature;
-              },
-            );
+            return api("/wallet/evm/personal-sign", {
+              message: params[1],
+            }).then((r) => r.signature);
           }
           case "eth_signTypedData_v4":
           case "eth_signTypedData": {
@@ -480,9 +476,7 @@
               } catch (_) {}
             }
             return api("/wallet/evm/sign-typed-data", { typedData: data }).then(
-              function (r) {
-                return r.signature;
-              },
+              (r) => r.signature,
             );
           }
           case "eth_sendTransaction": {
@@ -490,31 +484,25 @@
             return api("/wallet/evm/send-transaction", {
               chainId: parseInt(chainId, 16),
               tx: tx,
-            }).then(function (r) {
-              return r.hash;
-            });
+            }).then((r) => r.hash);
           }
           case "eth_signTransaction": {
             var tx2 = params[0] || {};
             return api("/wallet/evm/sign-transaction", {
               chainId: parseInt(chainId, 16),
               tx: tx2,
-            }).then(function (r) {
-              return r.signedTransaction;
-            });
+            }).then((r) => r.signedTransaction);
           }
           default:
             // forward read-only methods to public RPC
             return rpc(method, params);
         }
       },
-      on: function (e, l) {
+      on: (e, l) => {
         emitter.on(e, l);
       },
-      removeListener: function () {},
-      enable: function () {
-        return Promise.resolve([address]);
-      },
+      removeListener: () => {},
+      enable: () => Promise.resolve([address]),
     };
 
     try {
@@ -533,7 +521,9 @@
     var info = {
       uuid:
         "00000000-0000-4000-8000-" +
-        ("000000000000" + Math.floor(Math.random() * 1e12).toString(16)).slice(-12),
+        `000000000000${Math.floor(Math.random() * 1e12).toString(16)}`.slice(
+          -12,
+        ),
       name: CONFIG.walletName,
       icon: CONFIG.walletIcon,
       rdns: "ai.elizaos.wallet",
@@ -552,7 +542,7 @@
     announce();
 
     // Notify dApps that a connected wallet exists.
-    setTimeout(function () {
+    setTimeout(() => {
       emitter.emit("connect", { chainId: chainId });
       emitter.emit("accountsChanged", [address]);
     }, 0);

package/src/chains/{wallet-router.test.ts → __tests__/wallet-router.test.ts}

@@ -1,12 +1,12 @@
 import type { HandlerOptions, IAgentRuntime, Memory } from "@elizaos/core";
 import { describe, expect, it, vi } from "vitest";
-import { WalletBackendService } from "../services/wallet-backend-service";
+import { WalletBackendService } from "../../services/wallet-backend-service";
 import type {
   WalletChainHandler,
   WalletRouterExecution,
   WalletRouterParams,
-} from "../types/wallet-router";
-import { walletRouterAction } from "./wallet-action";
+} from "../../types/wallet-router";
+import { walletRouterAction } from "../wallet-action";
 
 function createRuntime(): IAgentRuntime {
   const logger = {
@@ -16,12 +16,22 @@ function createRuntime(): IAgentRuntime {
     log: vi.fn(),
     warn: vi.fn(),
   };
+  const cache = new Map<string, unknown>();
   const runtime = {
     agentId: "test-agent",
     character: { name: "Test Agent", settings: {} },
     getService: vi.fn(() => null),
     getServicesByType: vi.fn(() => []),
     getSetting: vi.fn(() => null),
+    getCache: vi.fn(async <T>(key: string) => cache.get(key) as T | undefined),
+    setCache: vi.fn(async (key: string, value: unknown) => {
+      cache.set(key, value);
+      return true;
+    }),
+    deleteCache: vi.fn(async (key: string) => {
+      cache.delete(key);
+      return true;
+    }),
     logger,
   };
 
@@ -99,17 +109,36 @@ function handler(
   };
 }
 
-function message(): Memory {
+function message(text = "wallet action"): Memory {
   return {
     id: "00000000-0000-0000-0000-000000000001",
     entityId: "00000000-0000-0000-0000-000000000002",
     agentId: "00000000-0000-0000-0000-000000000003",
     roomId: "00000000-0000-0000-0000-000000000004",
-    content: { text: "wallet action" },
+    content: { text },
     createdAt: Date.now(),
   } as Memory;
 }
 
+async function runConfirmed(
+  runtime: IAgentRuntime,
+  parameters: Record<string, unknown>,
+) {
+  const first = await walletRouterAction.handler(
+    runtime,
+    message("please transfer"),
+    undefined,
+    { parameters } as HandlerOptions,
+  );
+  expect(first?.data?.requiresConfirmation).toBe(true);
+  return walletRouterAction.handler(
+    runtime,
+    message("yes, confirm"),
+    undefined,
+    { parameters } as HandlerOptions,
+  );
+}
+
 async function run(
   runtime: IAgentRuntime,
   parameters: Record<string, unknown>,
@@ -125,7 +154,7 @@ describe("wallet router action", () => {
     const base = handler("base", "Base", "8453", "evm");
     service.registerChainHandler(base);
 
-    const result = await run(runtime, {
+    const result = await runConfirmed(runtime, {
       subaction: "transfer",
       chain: "base",
       fromToken: "ETH",
@@ -152,7 +181,7 @@ describe("wallet router action", () => {
     const base = handler("base", "Base", "8453", "evm");
     service.registerChainHandler(base);
 
-    const result = await run(runtime, {
+    const result = await runConfirmed(runtime, {
       subaction: "swap",
       chain: "8453",
       fromToken: "0x0000000000000000000000000000000000000000",
@@ -179,7 +208,7 @@ describe("wallet router action", () => {
     const solana = handler("solana", "Solana", "solana-mainnet", "solana");
     service.registerChainHandler(solana);
 
-    const transfer = await run(runtime, {
+    const transfer = await runConfirmed(runtime, {
       subaction: "transfer",
       chain: "sol",
       fromToken: "SOL",
@@ -187,7 +216,7 @@ describe("wallet router action", () => {
       recipient: "9xQeWvG816bUx9EPfWJXn4xHLh1BaK7Z7QXDXuGpS9SW",
       mode: "execute",
     });
-    const swap = await run(runtime, {
+    const swap = await runConfirmed(runtime, {
       subaction: "swap",
       chain: "solana",
       fromToken: "SOL",
@@ -255,7 +284,7 @@ describe("wallet router action", () => {
     const base = handler("base", "Base", "8453", "evm");
     service.registerChainHandler(base);
 
-    const result = await run(runtime, {
+    const result = await runConfirmed(runtime, {
       subaction: "swap",
       fromToken: "ETH",
       toToken: "USDC",
@@ -271,6 +300,24 @@ describe("wallet router action", () => {
     expect(result?.data?.chain).toBe("base");
   });
 
+  it("does not execute when LLM sets confirmed:true without a user yes reply", async () => {
+    const { runtime, service } = createService();
+    const base = handler("base", "Base", "8453", "evm");
+    service.registerChainHandler(base);
+
+    const result = await run(runtime, {
+      subaction: "transfer",
+      chain: "base",
+      amount: "0.5",
+      recipient: "0x742d35Cc6634C0532925a3b844Bc454e4438f44e",
+      mode: "execute",
+      confirmed: true,
+    });
+
+    expect(result?.data?.requiresConfirmation).toBe(true);
+    expect(base.execute).not.toHaveBeenCalled();
+  });
+
   it("prepares dry-run metadata without executing", async () => {
     const { runtime, service } = createService();
     const base = handler("base", "Base", "8453", "evm");