@elizaos/plugin-wallet 2.0.0-beta.1 → 2.0.3-beta.6

package/src/lib/wallet-export-guard.test.ts

@@ -0,0 +1,233 @@
+import type http from "node:http";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  _resetForTesting,
+  createHardenedExportGuard,
+  getWalletExportAuditLog,
+} from "./wallet-export-guard";
+
+function request(
+  remoteAddress: string | null = "127.0.0.1",
+  userAgent = "wallet-test",
+): http.IncomingMessage {
+  return {
+    headers: { "user-agent": userAgent },
+    socket: { remoteAddress },
+  } as unknown as http.IncomingMessage;
+}
+
+function parseNonce(reason: string): string {
+  const parsed = JSON.parse(reason) as { nonce?: unknown };
+  if (typeof parsed.nonce !== "string") {
+    throw new Error(`missing nonce in ${reason}`);
+  }
+  return parsed.nonce;
+}
+
+describe("wallet export guard", () => {
+  const upstream = vi.fn(() => null);
+
+  beforeEach(() => {
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2026-01-01T00:00:00.000Z"));
+    upstream.mockReset();
+    upstream.mockReturnValue(null);
+    _resetForTesting();
+    vi.spyOn(console, "warn").mockImplementation(() => undefined);
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    vi.useRealTimers();
+    _resetForTesting();
+  });
+
+  it("issues a nonce, enforces the confirmation delay, then allows exactly one export", () => {
+    const guard = createHardenedExportGuard(upstream);
+    const req = request();
+    const nonceResponse = guard(req, {
+      confirm: true,
+      exportToken: "valid",
+      requestNonce: true,
+    });
+
+    expect(nonceResponse?.status).toBe(403);
+    const nonce = parseNonce(nonceResponse?.reason ?? "");
+    expect(nonce).toMatch(/^wxn_[a-f0-9]{32}$/);
+
+    const tooEarly = guard(req, {
+      confirm: true,
+      exportToken: "valid",
+      exportNonce: nonce,
+    });
+    expect(tooEarly).toMatchObject({
+      status: 403,
+      reason: expect.stringContaining("Wait 10 more seconds"),
+    });
+
+    vi.advanceTimersByTime(10_000);
+    expect(
+      guard(req, {
+        confirm: true,
+        exportToken: "valid",
+        exportNonce: nonce,
+      }),
+    ).toBeNull();
+
+    const replay = guard(req, {
+      confirm: true,
+      exportToken: "valid",
+      exportNonce: nonce,
+    });
+    expect(replay).toMatchObject({
+      status: 403,
+      reason: "Invalid or expired export nonce.",
+    });
+    expect(getWalletExportAuditLog().at(-2)?.outcome).toBe("allowed");
+  });
+
+  it("binds nonces to the socket IP and rejects requests without an IP", () => {
+    const guard = createHardenedExportGuard(upstream);
+    const nonceResponse = guard(request("127.0.0.1"), {
+      confirm: true,
+      exportToken: "valid",
+      requestNonce: true,
+    });
+    const nonce = parseNonce(nonceResponse?.reason ?? "");
+    vi.advanceTimersByTime(10_000);
+
+    expect(
+      guard(request("127.0.0.2"), {
+        confirm: true,
+        exportToken: "valid",
+        exportNonce: nonce,
+      }),
+    ).toMatchObject({
+      status: 403,
+      reason: "Export nonce was issued to a different client.",
+    });
+    expect(
+      guard(request(null), {
+        confirm: true,
+        exportToken: "valid",
+        requestNonce: true,
+      }),
+    ).toMatchObject({
+      status: 400,
+      reason: "Unable to determine client IP; request rejected.",
+    });
+  });
+
+  it("caps pending nonces per IP and trims the audit log", () => {
+    const guard = createHardenedExportGuard(upstream);
+    const req = request("10.0.0.1");
+
+    for (let i = 0; i < 3; i += 1) {
+      expect(
+        guard(req, {
+          confirm: true,
+          exportToken: "valid",
+          requestNonce: true,
+        })?.status,
+      ).toBe(403);
+    }
+    expect(
+      guard(req, {
+        confirm: true,
+        exportToken: "valid",
+        requestNonce: true,
+      }),
+    ).toMatchObject({
+      status: 429,
+      reason: expect.stringContaining("Too many pending export requests"),
+    });
+
+    for (let i = 0; i < 120; i += 1) {
+      guard(request(`10.0.1.${i}`), {
+        confirm: true,
+        exportToken: "valid",
+        requestNonce: true,
+      });
+    }
+    expect(getWalletExportAuditLog()).toHaveLength(100);
+  });
+
+  it("rate limits successful exports per IP after nonce validation", () => {
+    const guard = createHardenedExportGuard(upstream);
+    const req = request("127.0.0.9");
+    const firstNonce = parseNonce(
+      guard(req, {
+        confirm: true,
+        exportToken: "valid",
+        requestNonce: true,
+      })?.reason ?? "",
+    );
+    vi.advanceTimersByTime(10_000);
+    expect(
+      guard(req, {
+        confirm: true,
+        exportToken: "valid",
+        exportNonce: firstNonce,
+      }),
+    ).toBeNull();
+
+    const secondNonce = parseNonce(
+      guard(req, {
+        confirm: true,
+        exportToken: "valid",
+        requestNonce: true,
+      })?.reason ?? "",
+    );
+    vi.advanceTimersByTime(10_000);
+    expect(
+      guard(req, {
+        confirm: true,
+        exportToken: "valid",
+        exportNonce: secondNonce,
+      }),
+    ).toMatchObject({
+      status: 429,
+      reason: expect.stringContaining("Rate limit exceeded"),
+    });
+
+    vi.advanceTimersByTime(10 * 60 * 1000);
+    const thirdNonce = parseNonce(
+      guard(req, {
+        confirm: true,
+        exportToken: "valid",
+        requestNonce: true,
+      })?.reason ?? "",
+    );
+    vi.advanceTimersByTime(10_000);
+    expect(
+      guard(req, {
+        confirm: true,
+        exportToken: "valid",
+        exportNonce: thirdNonce,
+      }),
+    ).toBeNull();
+  });
+
+  it("runs upstream validation before issuing nonces or rate-limit checks", () => {
+    upstream.mockReturnValueOnce({
+      status: 403,
+      reason: "bad export token",
+    });
+    const guard = createHardenedExportGuard(upstream);
+
+    expect(
+      guard(request(), {
+        confirm: true,
+        exportToken: "invalid",
+        requestNonce: true,
+      }),
+    ).toEqual({
+      status: 403,
+      reason: "bad export token",
+    });
+    expect(getWalletExportAuditLog().at(-1)).toMatchObject({
+      outcome: "rejected",
+      reason: "bad export token",
+    });
+  });
+});

package/src/lib/wallet-export-guard.ts

@@ -61,7 +61,7 @@ if (typeof sweepTimer === "object" && "unref" in sweepTimer) {
  * IPs to bypass rate limits and nonce IP binding.
  */
 function getClientIp(req: http.IncomingMessage): string | null {
-  return req.socket?.remoteAddress ?? null;
+  return req.socket.remoteAddress ?? null;
 }
 
 function getUserAgent(req: http.IncomingMessage): string {

package/src/lp/actions/liquidity.ts

@@ -1,4 +1,3 @@
-// @ts-nocheck — legacy code from absorbed plugins (lp-manager, lpinfo, dexscreener, defi-news, birdeye); strict types pending cleanup
 import type {
   Action,
   ActionExample,
@@ -27,6 +26,24 @@ import { getChainConfig } from "../types.ts";
 const SOLANA_DEXES = new Set(["raydium", "orca", "meteora"]);
 const EVM_DEXES = new Set(["uniswap", "aerodrome", "pancakeswap"]);
 
+type PoolTokenWithAddress = PoolInfo["tokenA"] & { address?: string };
+type TransactionWithHash = { transactionId?: string; hash?: string };
+
+function tokenLabel(token: PoolInfo["tokenA"]): string | undefined {
+  const withAddress = token as PoolTokenWithAddress;
+  return token.symbol || token.mint || withAddress.address;
+}
+
+function transactionLabel(result: TransactionWithHash): string {
+  return result.transactionId || result.hash || "submitted";
+}
+
+function isLpPosition(
+  position: LpPositionDetails | null,
+): position is LpPositionDetails {
+  return position !== null;
+}
+
 function selectedContextMatches(
   state: State | undefined,
   contexts: readonly string[],
@@ -73,7 +90,7 @@ const formatPositions = (positions: LpPositionDetails[]): string => {
       `\n${index + 1}. ${pos.poolId} on ${pos.dex}\n` +
       `   Value: $${pos.valueUsd?.toFixed(2) || "N/A"}\n` +
       `   Tokens: ${underlying || "N/A"}\n` +
-      `   LP balance: ${pos.lpTokenBalance?.uiAmount?.toFixed(6) || pos.lpTokenBalance?.balance || "N/A"} ${pos.lpTokenBalance?.symbol || ""}\n`;
+      `   LP balance: ${pos.lpTokenBalance.uiAmount?.toFixed(6) || pos.lpTokenBalance.balance || "N/A"} ${pos.lpTokenBalance.symbol || ""}\n`;
   });
   return response;
 };
@@ -85,16 +102,8 @@ const formatPools = (pools: PoolInfo[]): string => {
 
   let response = "LP pools:\n";
   pools.slice(0, 10).forEach((pool, index) => {
-    const tokenA =
-      pool.tokenA?.symbol ||
-      pool.tokenA?.mint ||
-      pool.tokenA?.address ||
-      "tokenA";
-    const tokenB =
-      pool.tokenB?.symbol ||
-      pool.tokenB?.mint ||
-      pool.tokenB?.address ||
-      "tokenB";
+    const tokenA = tokenLabel(pool.tokenA) || "tokenA";
+    const tokenB = tokenLabel(pool.tokenB) || "tokenB";
     response +=
       `\n${index + 1}. ${pool.displayName || pool.id} on ${pool.dex}\n` +
       `   Pair: ${tokenA}/${tokenB}\n` +
@@ -204,7 +213,7 @@ function normalizeParams(
   message: Memory,
   handlerParams?: Record<string, unknown>,
 ): LpActionParams | null {
-  const contentParams = (message?.content || {}) as Record<string, unknown>;
+  const contentParams = (message.content || {}) as Record<string, unknown>;
   const params = {
     ...contentParams,
     ...(handlerParams || {}),
@@ -242,7 +251,12 @@ function resolveChain(params: LpActionParams): {
   let chainId = params.chainId;
 
   const numericChain = chain && /^\d+$/.test(chain) ? Number(chain) : undefined;
-  const evmChain = getChainConfig(numericChain ?? chain);
+  const evmChain =
+    numericChain !== undefined
+      ? getChainConfig(numericChain)
+      : chain
+        ? getChainConfig(chain)
+        : undefined;
   if (evmChain) {
     chain = "evm";
     chainId = evmChain.chainId;
@@ -404,8 +418,9 @@ async function handlePreferences(
     newConfig.minGainThresholdPercent = params.minGainThresholdPercent;
     updates.push(`minGainThresholdPercent=${params.minGainThresholdPercent}`);
   }
-  if (params.maxSlippageBps !== undefined || params.slippageBps !== undefined) {
-    newConfig.maxSlippageBps = params.maxSlippageBps ?? params.slippageBps;
+  const maxSlippageBps = params.maxSlippageBps ?? params.slippageBps;
+  if (maxSlippageBps !== undefined) {
+    newConfig.maxSlippageBps = maxSlippageBps;
     updates.push(`maxSlippageBps=${newConfig.maxSlippageBps}`);
   }
   if (params.preferredDexes) {
@@ -482,7 +497,7 @@ async function handleLpOperation(
                 .catch(() => null),
             ),
           )
-        ).filter(Boolean);
+        ).filter(isLpPosition);
       }
       return {
         success: true,
@@ -528,7 +543,7 @@ async function handleLpOperation(
       return {
         success: result.success,
         text: result.success
-          ? `LP position opened on ${route.dex || "registered protocol"}. Transaction: ${result.transactionId || result.hash || "submitted"}`
+          ? `LP position opened on ${route.dex || "registered protocol"}. Transaction: ${transactionLabel(result)}`
           : `LP open failed: ${result.error || "unknown error"}`,
         data: result,
       };
@@ -552,7 +567,7 @@ async function handleLpOperation(
       return {
         success: result.success,
         text: result.success
-          ? `LP position closed on ${route.dex || "registered protocol"}. Transaction: ${result.transactionId || result.hash || "submitted"}`
+          ? `LP position closed on ${route.dex || "registered protocol"}. Transaction: ${transactionLabel(result)}`
           : `LP close failed: ${result.error || "unknown error"}`,
         data: result,
       };
@@ -577,7 +592,7 @@ async function handleLpOperation(
       return {
         success: result.success,
         text: result.success
-          ? `LP position repositioned on ${route.dex || "registered protocol"}. Transaction: ${result.transactionId || result.hash || "submitted"}`
+          ? `LP position repositioned on ${route.dex || "registered protocol"}. Transaction: ${transactionLabel(result)}`
           : `LP reposition failed: ${result.error || "unknown error"}`,
         data: result,
       };
@@ -656,7 +671,10 @@ export const liquidityAction: Action = {
       description:
         "Liquidity amount for open, close, or reposition operations.",
       required: false,
-      schema: { type: ["string", "number"] },
+      schema: {
+        type: "string",
+        anyOf: [{ type: "string" }, { type: "number" }],
+      },
     },
     {
       name: "range",
@@ -712,7 +730,10 @@ export const liquidityAction: Action = {
     [
       {
         name: "{{name1}}",
-        content: { text: "Open a Raydium LP position with 100 USDC paired against SOL.", source: "chat" },
+        content: {
+          text: "Open a Raydium LP position with 100 USDC paired against SOL.",
+          source: "chat",
+        },
       },
       {
         name: "{{agentName}}",
@@ -727,7 +748,10 @@ export const liquidityAction: Action = {
     [
       {
         name: "{{name1}}",
-        content: { text: "Show my current liquidity positions.", source: "chat" },
+        content: {
+          text: "Show my current liquidity positions.",
+          source: "chat",
+        },
       },
       {
         name: "{{agentName}}",
@@ -742,7 +766,10 @@ export const liquidityAction: Action = {
     [
       {
         name: "{{name1}}",
-        content: { text: "Close my SOL/USDC liquidity position.", source: "chat" },
+        content: {
+          text: "Close my SOL/USDC liquidity position.",
+          source: "chat",
+        },
       },
       {
         name: "{{agentName}}",
@@ -761,7 +788,7 @@ export const liquidityAction: Action = {
     message: Memory,
     state?: State,
   ): Promise<boolean> => {
-    if (!message?.content) return false;
+    if (!message.content) return false;
     if ((message.content as LpActionParams & { action?: string }).action)
       return true;
     if ((message.content as LpActionParams).subaction) return true;
@@ -789,7 +816,7 @@ export const liquidityAction: Action = {
       };
     }
 
-    const userId = message.entityId || message.userId || "unknown-user";
+    const userId = message.entityId || "unknown-user";
 
     try {
       if (params.subaction === "onboard") {

package/src/lp/e2e/real-token-tests.ts

@@ -1,4 +1,3 @@
-// @ts-nocheck — legacy code from absorbed plugins (lp-manager, lpinfo, dexscreener, defi-news, birdeye); strict types pending cleanup
 import { strict as assert } from "node:assert";
 import type { IAgentRuntime, TestSuite } from "@elizaos/core";
 import type { DexInteractionService } from "../services/DexInteractionService.ts";

package/src/lp/e2e/scenarios.ts

@@ -1,9 +1,8 @@
-// @ts-nocheck — legacy code from absorbed plugins (lp-manager, lpinfo, dexscreener, defi-news, birdeye); strict types pending cleanup
 import { strict as assert } from "node:assert";
 import type { IAgentRuntime, TestSuite } from "@elizaos/core";
 import { sendMessageAndWaitForResponse, setupScenario } from "./test-utils.ts";
 
-// Mock services are registered in setupScenario; this stub is called for backward compatibility.
+// Mock services are registered in setupScenario; this hook is called for backward compatibility.
 async function setupMockLpData(_runtime: IAgentRuntime) {}
 
 /**

package/src/lp/e2e/test-utils.ts

@@ -1,4 +1,3 @@
-// @ts-nocheck — legacy code from absorbed plugins (lp-manager, lpinfo, dexscreener, defi-news, birdeye); strict types pending cleanup
 import { strict as assert } from "node:assert";
 import {
   asUUID,
@@ -10,10 +9,24 @@ import {
   type IAgentRuntime,
   type Memory,
   type Room,
+  type Setting,
   type World,
 } from "@elizaos/core";
 import { v4 as uuid } from "uuid";
 
+const E2E_TEST_SERVER_ID = "e2e-test-server";
+
+function testSetting(name: string, value: string | boolean | null): Setting {
+  return {
+    name,
+    description: `E2E ${name}`,
+    usageDescription: `E2E ${name}`,
+    required: false,
+    value,
+    dependsOn: [],
+  };
+}
+
 /**
  * Sets up a standard scenario environment for an E2E test.
  *
@@ -51,16 +64,15 @@ export async function setupScenario(
     id: asUUID(uuid()),
     agentId: runtime.agentId,
     name: "E2E Test World",
-    serverId: "e2e-test-server",
     metadata: {
       ownership: {
         ownerId: user.id,
       },
       settings: {
         lp_manager: {
-          onboarding_enabled: true,
-          auto_rebalance_enabled: true,
-          default_slippage_bps: 50,
+          onboarding_enabled: testSetting("onboarding_enabled", true),
+          auto_rebalance_enabled: testSetting("auto_rebalance_enabled", true),
+          default_slippage_bps: testSetting("default_slippage_bps", "50"),
         },
       },
     },
@@ -74,7 +86,7 @@ export async function setupScenario(
     type: ChannelType.DM,
     source: "e2e-test",
     worldId: world.id,
-    serverId: world.serverId,
+    serverId: E2E_TEST_SERVER_ID,
   };
   await runtime.createRoom(room);
 
@@ -131,8 +143,9 @@ export function sendMessageAndWaitForResponse(
 
     // The callback function that the message handler will invoke with the agent's final response.
     // We use this callback to resolve our promise.
-    const callback = (responseContent: Content) => {
+    const callback = async (responseContent: Content): Promise<Memory[]> => {
       resolve(responseContent);
+      return [];
     };
 
     // Emit the event to trigger the agent's message processing logic.

package/src/lp/lp-manager-entry.ts

@@ -1,4 +1,3 @@
-// @ts-nocheck — legacy code from absorbed plugins (lp-manager, lpinfo, dexscreener, defi-news, birdeye); strict types pending cleanup
 import {
   type IAgentRuntime,
   logger,
@@ -144,7 +143,7 @@ async function loadSolanaDexes(
           const meteoraPlugin = await import(
             "../chains/solana/dex/meteora/index.ts"
           );
-          if (meteoraPlugin.default?.init) {
+          if (meteoraPlugin.default.init) {
             await meteoraPlugin.default.init(config, runtime);
           }
           logger.info(`[LP Manager] Loaded Meteora DEX`);
@@ -214,7 +213,7 @@ async function loadEvmDexes(
 const lpManagerPlugin: Plugin = {
   name: LP_MANAGER_PLUGIN_NAME,
   description:
-    "Unified Liquidity Pool manager for Solana DEXs (Raydium, Orca, Meteora) and EVM DEXs (Uniswap, PancakeSwap, Aerodrome).",
+    "Liquidity Pool manager for Solana DEXs (Raydium, Orca, Meteora) and EVM DEXs (Uniswap, PancakeSwap, Aerodrome).",
   actions: [...promoteSubactionsToActions(liquidityAction)],
   services: [
     LpManagementService,
@@ -290,13 +289,11 @@ export { raydiumPlugin } from "../chains/solana/dex/raydium/index.ts";
 // Export types
 export * from "./types.ts";
 // Export all services and utilities
-// Back-compat alias for older imports.
 export {
   ConcentratedLiquidityService,
   DexInteractionService,
   LpManagementService,
   liquidityAction,
-  liquidityAction as LpManagementAgentAction,
   UserLpProfileService,
   VaultService,
   YieldOptimizationService,

package/src/lp/services/ConcentratedLiquidityService.ts

@@ -1,4 +1,3 @@
-// @ts-nocheck — legacy code from absorbed plugins (lp-manager, lpinfo, dexscreener, defi-news, birdeye); strict types pending cleanup
 import { type IAgentRuntime, Service } from "@elizaos/core";
 import type {
   IConcentratedLiquidityService,
@@ -7,8 +6,8 @@ import type {
 } from "../types";
 
 /**
- * ConcentratedLiquidityService provides foundation support for concentrated liquidity positions.
- * This is a placeholder implementation that will be expanded when DEX plugins add concentrated liquidity support.
+ * ConcentratedLiquidityService exposes the concentrated-liquidity surface while
+ * DEX-specific providers add position creation and rebalancing support.
  */
 export class ConcentratedLiquidityService
   extends Service
@@ -32,21 +31,17 @@ export class ConcentratedLiquidityService
 
   async start(_runtime: IAgentRuntime): Promise<void> {
     // Service initialization
-    this.isInitialized = true;
     console.info(
       "ConcentratedLiquidityService started - awaiting DEX integration",
     );
   }
 
-  async stop(): Promise<void> {
-    this.isInitialized = false;
-  }
+  async stop(): Promise<void> {}
 
   async createConcentratedPosition(
     _userId: string,
     _params: IRangeParams,
   ): Promise<IConcentratedPosition> {
-    // Placeholder implementation
     throw new Error(
       "Concentrated liquidity positions are coming soon! This feature requires DEX integration.",
     );
@@ -55,7 +50,6 @@ export class ConcentratedLiquidityService
   async getConcentratedPositions(
     userId: string,
   ): Promise<IConcentratedPosition[]> {
-    // Placeholder implementation
     console.info(`Getting concentrated positions for user ${userId}`);
     return [];
   }
@@ -65,7 +59,6 @@ export class ConcentratedLiquidityService
     _positionId: string,
     _newRangeParams?: Partial<IRangeParams>,
   ): Promise<IConcentratedPosition> {
-    // Placeholder implementation
     throw new Error("Concentrated position rebalancing is coming soon!");
   }
 

package/src/lp/services/DexInteractionService.ts

@@ -1,4 +1,3 @@
-// @ts-nocheck — legacy code from absorbed plugins (lp-manager, lpinfo, dexscreener, defi-news, birdeye); strict types pending cleanup
 import { type IAgentRuntime, logger, Service } from "@elizaos/core";
 import type {
   AddLiquidityConfig,
@@ -79,7 +78,7 @@ export class DexInteractionService
   }
 
   async stop(): Promise<void> {
-    // No-op; protocol providers are owned by LpManagementService.
+    // Protocol providers are owned by LpManagementService.
   }
 
   rediscoverServices(): void {

package/src/lp/services/LpManagementService.test.ts

@@ -1,4 +1,3 @@
-// @ts-nocheck — tests use plain objects instead of generated proto message instances
 import { describe, expect, it, vi } from "vitest";
 import {
   LpManagementService,