@elizaos/plugin-wallet 2.0.0-beta.1 → 2.0.3-beta.5

package/src/chains/evm/providers/wallet.ts

@@ -58,6 +58,41 @@ function headersWithoutAuthorization(headersInit?: HeadersInit): Headers {
   return headers;
 }
 
+/**
+ * Per-turn safety bound for wallet balance RPC calls. `evmWalletProvider.get()`
+ * runs inside `composeState` on every message and is awaited (via `Promise.all`)
+ * before the agent can produce a reply, so an unbounded RPC against a slow or
+ * unreachable endpoint would block the WHOLE turn up to composeState's 30s
+ * provider cap — the dedicated-agent "28s per reply" symptom. Bounding each read
+ * means a wallet-enabled agent never pays more than this per chain; on timeout we
+ * return null (logged) and that chain's balance simply isn't shown that turn.
+ */
+const WALLET_BALANCE_RPC_TIMEOUT_MS = 3000;
+
+/** Transport-level fast-fail bound so a hung socket aborts instead of lingering. */
+const WALLET_RPC_FETCH_TIMEOUT_MS = 4000;
+
+/**
+ * Race `promise` against a timeout. Rejects with a labelled error on timeout so
+ * the caller's existing try/catch can treat it like any other RPC failure. The
+ * timer is always cleared so a fast-resolving promise leaves no dangling handle.
+ */
+async function withTimeout<T>(promise: Promise<T>, ms: number, label: string): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);
+      }),
+    ]);
+  } finally {
+    if (timer) {
+      clearTimeout(timer);
+    }
+  }
+}
+
 function isRetryableManagedRpcStatus(status: number): boolean {
   return (
     status === 401 ||
@@ -109,6 +144,8 @@ export class WalletProvider {
   private _account: PrivateKeyAccount;
   private readonly _runtime: IAgentRuntime;
   private readonly _rpcConfigs: Record<string, ChainRpcConfig>;
+  /** Chains where Cloud RPC returned a non-transient auth error (401/403) and should not be retried this session. */
+  private readonly _cloudRpcDisabled = new Set<string>();
 
   constructor(
     accountOrPrivateKey: PrivateKeyAccount | `0x${string}`,
@@ -218,9 +255,14 @@ export class WalletProvider {
   async getWalletBalanceForChain(chainName: SupportedChain): Promise<string | null> {
     try {
       const client = this.getPublicClient(chainName);
-      const balance = await client.getBalance({
-        address: this._account.address,
-      });
+      // Bound the per-turn RPC so a slow/unreachable endpoint can never block the
+      // reply pipeline (see WALLET_BALANCE_RPC_TIMEOUT_MS). On timeout this rejects
+      // and is handled by the catch below exactly like any other RPC error.
+      const balance = await withTimeout(
+        client.getBalance({ address: this._account.address }),
+        WALLET_BALANCE_RPC_TIMEOUT_MS,
+        `getBalance(${chainName})`
+      );
       return formatUnits(balance, 18);
     } catch (error) {
       logger.error(
@@ -269,7 +311,21 @@ export class WalletProvider {
       const fallbackRpcUrl =
         managedRpc.providerName === "elizacloud" ? chain.rpcUrls.default.http[0] : null;
 
+      // If Cloud RPC already failed with an auth error for this chain, go straight to fallback.
+      if (
+        managedRpc.providerName === "elizacloud" &&
+        fallbackRpcUrl &&
+        this._cloudRpcDisabled.has(chainName)
+      ) {
+        return http(fallbackRpcUrl, {
+          timeout: WALLET_RPC_FETCH_TIMEOUT_MS,
+          retryCount: 0,
+        });
+      }
+
       return http(managedRpc.rpcUrl, {
+        timeout: WALLET_RPC_FETCH_TIMEOUT_MS,
+        retryCount: 0,
         fetchFn:
           managedRpc.providerName === "elizacloud" && fallbackRpcUrl
             ? async (input, init) => {
@@ -281,9 +337,18 @@ export class WalletProvider {
                     return response;
                   }
 
-                  logger.warn(
-                    `[WalletProvider] Eliza Cloud RPC failed for ${chainName}: ${fallbackReason}. Falling back to ${fallbackRpcUrl}.`
-                  );
+                  // For auth errors (401/403), disable Cloud RPC for this chain for the
+                  // rest of the session so we stop retrying and spamming warnings.
+                  if (response.status === 401 || response.status === 403) {
+                    this._cloudRpcDisabled.add(chainName);
+                    logger.warn(
+                      `[WalletProvider] Eliza Cloud RPC returned ${response.status} for ${chainName}. Disabling Cloud RPC for this chain and falling back to ${fallbackRpcUrl} for the rest of this session.`
+                    );
+                  } else {
+                    logger.warn(
+                      `[WalletProvider] Eliza Cloud RPC failed for ${chainName}: ${fallbackReason}. Falling back to ${fallbackRpcUrl}.`
+                    );
+                  }
 
                   return await fetch(fallbackRpcUrl, {
                     ...init,
@@ -311,9 +376,15 @@ export class WalletProvider {
 
     const customRpc = chain.rpcUrls.custom;
     if (customRpc) {
-      return http(customRpc.http[0]);
+      return http(customRpc.http[0], {
+        timeout: WALLET_RPC_FETCH_TIMEOUT_MS,
+        retryCount: 0,
+      });
     }
-    return http(chain.rpcUrls.default.http[0]);
+    return http(chain.rpcUrls.default.http[0], {
+      timeout: WALLET_RPC_FETCH_TIMEOUT_MS,
+      retryCount: 0,
+    });
   }
 
   static genChainFromName(chainName: string, customRpcUrl?: string | null): Chain {
@@ -343,7 +414,7 @@ function genChainsFromRuntime(runtime: IAgentRuntime): {
   chains: Record<string, Chain>;
   rpcConfigs: Record<string, ChainRpcConfig>;
 } {
-  const settings = runtime.character?.settings;
+  const settings = runtime.character.settings;
   let configuredChains: string[] = [];
   if (
     typeof settings === "object" &&

package/src/chains/evm/routes/sign.ts

@@ -10,7 +10,13 @@
  * we only sign here.
  */
 
-import type { IAgentRuntime, Route, RouteRequest, RouteResponse } from "@elizaos/core";
+import type {
+  IAgentRuntime,
+  LegacyRouteHandler,
+  Route,
+  RouteRequest,
+  RouteResponse,
+} from "@elizaos/core";
 import { logger } from "@elizaos/core";
 import {
   type Address,
@@ -24,24 +30,23 @@ import {
 import * as viemChains from "viem/chains";
 import { resolveWalletBackend } from "../../../wallet/select-backend";
 
-type RouteHandler = NonNullable<Route["handler"]>;
+class EvmSignInputError extends Error {}
 
-interface JsonResponse {
-  setHeader?: (name: string, value: string) => void;
+function routeErrorStatus(error: unknown): number {
+  return error instanceof EvmSignInputError ? 400 : 500;
 }
 
 function setCorsHeaders(req: RouteRequest, res: RouteResponse): void {
   const origin = (req.headers?.origin as string | undefined) ?? "*";
-  const r = res as unknown as JsonResponse;
-  r.setHeader?.("Access-Control-Allow-Origin", origin);
-  r.setHeader?.("Vary", "Origin");
-  r.setHeader?.("Access-Control-Allow-Methods", "POST, OPTIONS");
-  r.setHeader?.(
+  res.setHeader?.("Access-Control-Allow-Origin", origin);
+  res.setHeader?.("Vary", "Origin");
+  res.setHeader?.("Access-Control-Allow-Methods", "POST, OPTIONS");
+  res.setHeader?.(
     "Access-Control-Allow-Headers",
     "Authorization, Content-Type, X-Wallet-Sign-Token",
   );
-  r.setHeader?.("Access-Control-Allow-Credentials", "true");
-  r.setHeader?.("Access-Control-Max-Age", "600");
+  res.setHeader?.("Access-Control-Allow-Credentials", "true");
+  res.setHeader?.("Access-Control-Max-Age", "600");
 }
 
 function readSignToken(runtime: IAgentRuntime): string | null {
@@ -68,7 +73,7 @@ function authorize(
   runtime: IAgentRuntime,
 ): boolean {
   setCorsHeaders(req, res);
-  if ((req as unknown as { method?: string }).method === "OPTIONS") {
+  if (req.method === "OPTIONS") {
     res.status(204).json({});
     return false;
   }
@@ -86,9 +91,9 @@ function authorize(
 
 function chainFromId(chainId: number): Chain {
   const all = Object.values(viemChains) as Chain[];
-  const hit = all.find((c) => typeof c?.id === "number" && c.id === chainId);
+  const hit = all.find((c) => typeof c.id === "number" && c.id === chainId);
   if (!hit) {
-    throw new Error(`unsupported EVM chainId: ${chainId}`);
+    throw new EvmSignInputError(`unsupported EVM chainId: ${chainId}`);
   }
   return hit;
 }
@@ -99,14 +104,14 @@ function rpcUrlForChain(runtime: IAgentRuntime, chain: Chain): string {
     process.env[`EVM_RPC_URL_${chain.id}`] ??
     null;
   if (explicit && explicit.length > 0) return explicit;
-  const def = chain.rpcUrls?.default?.http?.[0];
+  const def = chain.rpcUrls.default.http[0];
   if (def) return def;
   throw new Error(`no RPC URL configured for chain ${chain.id} (${chain.name})`);
 }
 
 function readChainId(body: unknown): number {
   if (typeof body !== "object" || body === null) {
-    throw new Error("chainId required");
+    throw new EvmSignInputError("chainId required");
   }
   const c = (body as { chainId?: unknown }).chainId;
   if (typeof c === "number") return c;
@@ -114,10 +119,10 @@ function readChainId(body: unknown): number {
     const n = c.startsWith("0x") ? Number.parseInt(c.slice(2), 16) : Number(c);
     if (Number.isFinite(n)) return n;
   }
-  throw new Error("chainId must be a number or hex string");
+  throw new EvmSignInputError("chainId must be a number or hex string");
 }
 
-const addressHandler: RouteHandler = async (req, res, runtime) => {
+const addressHandler: LegacyRouteHandler = async (req, res, runtime) => {
   if (!authorize(req, res, runtime)) return;
   try {
     const backend = await resolveWalletBackend(runtime);
@@ -133,7 +138,7 @@ const addressHandler: RouteHandler = async (req, res, runtime) => {
   }
 };
 
-const personalSignHandler: RouteHandler = async (req, res, runtime) => {
+const personalSignHandler: LegacyRouteHandler = async (req, res, runtime) => {
   if (!authorize(req, res, runtime)) return;
   try {
     const body = (req.body ?? {}) as { message?: unknown };
@@ -156,7 +161,7 @@ const personalSignHandler: RouteHandler = async (req, res, runtime) => {
   }
 };
 
-const signTypedDataHandler: RouteHandler = async (req, res, runtime) => {
+const signTypedDataHandler: LegacyRouteHandler = async (req, res, runtime) => {
   if (!authorize(req, res, runtime)) return;
   try {
     const body = (req.body ?? {}) as { typedData?: unknown };
@@ -195,12 +200,16 @@ function hexOrIntToBigInt(value: unknown): bigint | undefined {
   if (typeof value === "number") return BigInt(value);
   if (typeof value === "string") {
     if (value.length === 0) return undefined;
-    return value.startsWith("0x") ? BigInt(value) : BigInt(value);
+    try {
+      return value.startsWith("0x") ? BigInt(value) : BigInt(value);
+    } catch {
+      throw new EvmSignInputError(`invalid bigint value: ${value}`);
+    }
   }
-  return undefined;
+  throw new EvmSignInputError("bigint value must be a number, bigint, or string");
 }
 
-const sendTransactionHandler: RouteHandler = async (req, res, runtime) => {
+const sendTransactionHandler: LegacyRouteHandler = async (req, res, runtime) => {
   if (!authorize(req, res, runtime)) return;
   try {
     const body = (req.body ?? {}) as { tx?: EvmTxRequest };
@@ -240,11 +249,11 @@ const sendTransactionHandler: RouteHandler = async (req, res, runtime) => {
     res.status(200).json({ hash, address: account.address, chainId });
   } catch (err) {
     logger.error({ err }, "[wallet/evm/send-transaction] failed");
-    res.status(500).json({ error: (err as Error).message });
+    res.status(routeErrorStatus(err)).json({ error: (err as Error).message });
   }
 };
 
-const signTransactionHandler: RouteHandler = async (req, res, runtime) => {
+const signTransactionHandler: LegacyRouteHandler = async (req, res, runtime) => {
   if (!authorize(req, res, runtime)) return;
   try {
     const body = (req.body ?? {}) as { tx?: EvmTxRequest };
@@ -283,7 +292,7 @@ const signTransactionHandler: RouteHandler = async (req, res, runtime) => {
     });
   } catch (err) {
     logger.error({ err }, "[wallet/evm/sign-transaction] failed");
-    res.status(500).json({ error: (err as Error).message });
+    res.status(routeErrorStatus(err)).json({ error: (err as Error).message });
   }
 };
 

package/src/chains/evm/rpc-providers.ts

@@ -366,7 +366,7 @@ export function validateRPCProviderConfig(runtime: IAgentRuntime): {
 
   // Check for any per-chain custom RPC URLs
   let hasCustomRpc = false;
-  const settings = runtime.character?.settings;
+  const settings = runtime.character.settings;
   let chainsToCheck: string[] = ["mainnet", "base"];
   if (
     typeof settings === "object" &&

package/src/chains/evm/types/index.ts

@@ -176,9 +176,9 @@ export const BebopRouteSchema = z.object({
 });
 
 export interface SwapQuote {
-  readonly aggregator: "lifi" | "bebop";
+  readonly aggregator: "lifi" | "bebop" | "kyberswap";
   readonly minOutputAmount: string;
-  readonly swapData: Route | BebopRoute;
+  readonly swapData: Route | BebopRoute | KyberSwapRouteData;
 }
 
 export interface BridgeParams {
@@ -430,3 +430,23 @@ export function validateHash(hash: string): Hash {
 }
 
 export type { Address, Chain, Hash, Hex, Log } from "viem";
+export interface KyberSwapRouteSummary {
+  amountOut: string;
+  amountOutUsd?: string;
+  gas?: string;
+  gasUsd?: string;
+  gasPrice?: string;
+  // Full summary is forwarded verbatim to the KyberSwap build endpoint.
+  [key: string]: unknown;
+}
+
+export interface KyberSwapRouteData {
+  routeSummary: KyberSwapRouteSummary;
+  routerAddress: string;
+  chainSlug: string;
+  fromToken: string;
+  toToken: string;
+  amountIn: string;
+  slippageBps: number;
+  fromAddress: string;
+}

package/src/chains/registry.ts

@@ -60,7 +60,7 @@ function configuredEvmChains(runtime: IAgentRuntime): Array<{
   readonly key: string;
   readonly chain: Chain;
 }> {
-  const settings = runtime.character?.settings;
+  const settings = runtime.character.settings;
   const configured =
     settings &&
     typeof settings === "object" &&