@elizaos/ui 2.0.0-alpha.526 → 2.0.0-alpha.528

package/packages/agent/src/runtime/operations/vault-bridge.js

@@ -0,0 +1,80 @@
+/**
+ * Vault bridge — the only place runtime-ops talks to `@elizaos/vault`.
+ *
+ * Enforces:
+ *   1. The naming convention for provider API key vault entries
+ *      (`providers.<normalizedProvider>.api-key`).
+ *   2. Sensitive flag on every write (so the secret is encrypted at rest).
+ *   3. Caller tagging for the audit log so a reader of
+ *      `<stateDir>/audit/vault.jsonl` can attribute every access to a
+ *      runtime-ops phase.
+ *
+ * The bridge owns NO mutable state. Either pass an explicit
+ * SecretsManager (tests), or call `defaultSecretsManager()` (production)
+ * which constructs a fresh manager backed by the OS-keychain vault.
+ */
+import { createManager } from "@elizaos/vault";
+export class VaultResolveError extends Error {
+    code = "vault-resolve-failed";
+    constructor(apiKeyRef, cause) {
+        super(`[runtime-ops:vault] failed to resolve ${apiKeyRef}: ${cause instanceof Error ? cause.message : String(cause)}`);
+        this.name = "VaultResolveError";
+    }
+}
+/** Stable vault key for a provider API key. */
+export function vaultKeyForProviderApiKey(normalizedProvider) {
+    if (!normalizedProvider || normalizedProvider.includes(".")) {
+        throw new TypeError(`[runtime-ops:vault] invalid provider id: ${JSON.stringify(normalizedProvider)}`);
+    }
+    return `providers.${normalizedProvider}.api-key`;
+}
+/**
+ * Persist a provider API key in the vault under the canonical key name and
+ * return the vault key (the `apiKeyRef`).
+ *
+ * This is the single write path used by `provider-switch-routes.ts`. The
+ * route MUST persist the secret here BEFORE constructing the
+ * `ProviderSwitchIntent` so the intent never carries plaintext.
+ */
+export async function persistProviderApiKey(opts) {
+    const ref = vaultKeyForProviderApiKey(opts.normalizedProvider);
+    await opts.secrets.vault.set(ref, opts.apiKey, {
+        sensitive: true,
+        caller: opts.caller,
+    });
+    return ref;
+}
+/**
+ * Resolve a stored API key for the in-memory `process.env` write path.
+ *
+ * Returns `undefined` only when `apiKeyRef` is absent. If a ref is present,
+ * the operation must fail loudly when the vault cannot resolve it; otherwise a
+ * provider switch can appear successful while running with no key or a stale
+ * key from process.env.
+ *
+ * The caller is recorded on each successful read.
+ */
+export async function resolveProviderApiKey(opts) {
+    if (!opts.apiKeyRef)
+        return undefined;
+    try {
+        return await opts.secrets.vault.reveal(opts.apiKeyRef, opts.caller);
+    }
+    catch (err) {
+        throw new VaultResolveError(opts.apiKeyRef, err);
+    }
+}
+let cached = null;
+/**
+ * Lazy default manager. Production code paths construct a fresh manager
+ * the first time runtime-ops needs the vault; tests inject their own.
+ */
+export function defaultSecretsManager() {
+    if (!cached)
+        cached = createManager();
+    return cached;
+}
+/** Test hook: drop the cached manager. */
+export function _resetDefaultSecretsManagerForTesting() {
+    cached = null;
+}

package/packages/agent/src/runtime/plugin-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-resolver.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/runtime/plugin-resolver.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,qBAAqB,CAAC;AAgBxE,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,cAAc,EAOpB,MAAM,mBAAmB,CAAC;AA0C3B,wBAAgB,mCAAmC,CACjD,UAAU,EAAE,MAAM,GACjB,MAAM,CAMR;AA2VD;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,aAAa,SAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAkC5B;AAgCD,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CAMnD;AA4VD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GACzB,OAAO,CAAC,cAAc,EAAE,CAAC,CA+Z3B"}
+{"version":3,"file":"plugin-resolver.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/runtime/plugin-resolver.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,qBAAqB,CAAC;AAgBxE,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,cAAc,EAOpB,MAAM,mBAAmB,CAAC;AAsC3B,wBAAgB,mCAAmC,CACjD,UAAU,EAAE,MAAM,GACjB,MAAM,CAMR;AA2VD;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,aAAa,SAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAkC5B;AAgCD,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CAMnD;AA4VD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GACzB,OAAO,CAAC,cAAc,EAAE,CAAC,CA+Z3B"}

package/packages/agent/src/runtime/plugin-resolver.js

@@ -24,6 +24,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { logger } from "@elizaos/core";
+import { formatError } from "@elizaos/shared";
 import { saveElizaConfig } from "../config/config.js";
 import { resolveStateDir, resolveUserPath } from "../config/paths.js";
 import { applyPluginAutoEnable, } from "../config/plugin-auto-enable.js";
@@ -43,9 +44,6 @@ const RUNTIME_APP_PLUGIN_SUBPATHS = new Set([
 // ---------------------------------------------------------------------------
 // Helpers (private)
 // ---------------------------------------------------------------------------
-function formatError(err) {
-    return err instanceof Error ? err.message : String(err);
-}
 /** Missing npm package, Bun resolve, or browser stagehand — expected when optional plugins are allow-listed but not installed. */
 function isBenignOptionalPluginFailure(msg) {
     return (msg.includes("Cannot find module") ||

package/packages/agent/src/runtime/plugin-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-types.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/runtime/plugin-types.ts"],"names":[],"mappings":"AAeA,OAAO,EAAU,KAAK,MAAM,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAMpE,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAMD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,CAAC;AAEhE,yEAAyE;AACzE,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AACvD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,oBAAoB,CAAC;AAyCzD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAsC7E;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CA2C9C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE;IACzC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC5B,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAyB5C;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,gBAAgB,SAAkB,GACjC,MAAM,CAaR;AAED,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE3E;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmB7E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAyEjD"}
+{"version":3,"file":"plugin-types.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/runtime/plugin-types.ts"],"names":[],"mappings":"AAeA,OAAO,EAAU,KAAK,MAAM,EAAE,MAAM,eAAe,CAAC;AAIpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAMpE,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAMD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,CAAC;AAEhE,yEAAyE;AACzE,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AACvD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,oBAAoB,CAAC;AAqCzD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAsC7E;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CA2C9C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE;IACzC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC5B,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAyB5C;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,gBAAgB,SAAkB,GACjC,MAAM,CAaR;AAED,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE3E;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmB7E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAyEjD"}

package/packages/agent/src/runtime/plugin-types.js

@@ -4,6 +4,7 @@ import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { logger } from "@elizaos/core";
+import { formatError } from "@elizaos/shared";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -23,9 +24,6 @@ export const EJECTED_PLUGINS_DIRNAME = "plugins/ejected";
 // ---------------------------------------------------------------------------
 // Private helpers
 // ---------------------------------------------------------------------------
-function formatError(err) {
-    return err instanceof Error ? err.message : String(err);
-}
 function looksLikePlugin(value) {
     if (!value || typeof value !== "object")
         return false;

package/packages/agent/src/services/app-package-modules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-package-modules.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/services/app-package-modules.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAG1B,MAAM,sBAAsB,CAAC;AAG9B,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,4BAA4B,GAAG,CACzC,GAAG,EAAE,uBAAuB,KACzB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;AAE1C,MAAM,MAAM,4BAA4B,GAAG,CACzC,GAAG,EAAE,uBAAuB,KACzB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;AAE1C,MAAM,MAAM,wBAAwB,GAAG,CACrC,GAAG,EAAE,uBAAuB,KACzB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAErC,MAAM,MAAM,sBAAsB,GAAG,CACnC,GAAG,EAAE,oBAAoB,KACtB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAErC,MAAM,MAAM,cAAc,GAAG;IAC3B,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,aAAa,CAAC,EAAE,4BAA4B,CAAC;IAC7C,wBAAwB,CAAC,EAAE,4BAA4B,CAAC;IACxD,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,wBAAwB,CAAC,EAAE,CACzB,GAAG,EAAE,oBAAoB,KACtB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACpC,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;IAChD,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AA8HF,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGxB;AAuBD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEvE;AA2QD,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA0DhC;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsBxB"}
+{"version":3,"file":"app-package-modules.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/services/app-package-modules.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAG1B,MAAM,sBAAsB,CAAC;AAI9B,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,4BAA4B,GAAG,CACzC,GAAG,EAAE,uBAAuB,KACzB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;AAE1C,MAAM,MAAM,4BAA4B,GAAG,CACzC,GAAG,EAAE,uBAAuB,KACzB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;AAE1C,MAAM,MAAM,wBAAwB,GAAG,CACrC,GAAG,EAAE,uBAAuB,KACzB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAErC,MAAM,MAAM,sBAAsB,GAAG,CACnC,GAAG,EAAE,oBAAoB,KACtB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAErC,MAAM,MAAM,cAAc,GAAG;IAC3B,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,aAAa,CAAC,EAAE,4BAA4B,CAAC;IAC7C,wBAAwB,CAAC,EAAE,4BAA4B,CAAC;IACxD,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,wBAAwB,CAAC,EAAE,CACzB,GAAG,EAAE,oBAAoB,KACtB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACpC,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;IAChD,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AA8HF,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGxB;AAuBD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEvE;AAmQD,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA0DhC;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsBxB"}

package/packages/agent/src/services/app-package-modules.js

@@ -12,6 +12,7 @@ import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { logger } from "@elizaos/core";
 import { hasAppInterface, packageNameToAppRouteSlug, } from "../contracts/apps.js";
+import { readJsonFile } from "../utils/atomic-json.js";
 import { getPluginInfo } from "./registry-client.js";
 function uniquePaths(paths) {
     const seen = new Set();
@@ -124,14 +125,6 @@ async function importFirstExistingModule(candidatePaths) {
 export function packageNameToAppSlug(packageName) {
     return packageNameToAppRouteSlug(packageName);
 }
-async function readJsonFile(filePath) {
-    try {
-        return JSON.parse(await fs.promises.readFile(filePath, "utf8"));
-    }
-    catch {
-        return null;
-    }
-}
 async function readLocalBridgeExport(packageDir) {
     const packageJson = await readJsonFile(path.join(packageDir, "package.json"));
     const manifest = await readJsonFile(path.join(packageDir, "elizaos.plugin.json"));

package/packages/agent/src/services/app-run-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-run-store.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/services/app-run-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAQV,aAAa,EAId,MAAM,sBAAsB,CAAC;AAwgB9B,wBAAgB,0BAA0B,CACxC,QAAQ,GAAE,MAA0B,GACnC,MAAM,CAER;AAED,wBAAgB,gCAAgC,CAC9C,QAAQ,GAAE,MAA0B,GACnC,MAAM,CAER;AA2BD,wBAAgB,eAAe,CAC7B,QAAQ,GAAE,MAA0B,GACnC,aAAa,EAAE,CA6BjB;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,aAAa,EAAE,EACrB,QAAQ,GAAE,MAA0B,GACnC,aAAa,EAAE,CAWjB"}
+{"version":3,"file":"app-run-store.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/services/app-run-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAQV,aAAa,EAId,MAAM,sBAAsB,CAAC;AAkf9B,wBAAgB,0BAA0B,CACxC,QAAQ,GAAE,MAA0B,GACnC,MAAM,CAER;AAED,wBAAgB,gCAAgC,CAC9C,QAAQ,GAAE,MAA0B,GACnC,MAAM,CAER;AA2BD,wBAAgB,eAAe,CAC7B,QAAQ,GAAE,MAA0B,GACnC,aAAa,EAAE,CA6BjB;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,aAAa,EAAE,EACrB,QAAQ,GAAE,MAA0B,GACnC,aAAa,EAAE,CAWjB"}

package/packages/agent/src/services/app-run-store.js

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import path from "node:path";
 import { resolveStateDir } from "../config/paths.js";
+import { writeJsonAtomicSync } from "../utils/atomic-json.js";
 const APP_RUN_STORE_VERSION = 2;
 const MAX_RECORDED_RUN_EVENTS = 20;
 function nowIso() {
@@ -16,28 +17,6 @@ function _defaultStoreFile() {
         runs: [],
     };
 }
-function ensureParentDir(filePath) {
-    const dir = path.dirname(filePath);
-    if (!fs.existsSync(dir)) {
-        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    }
-}
-function atomicWrite(filePath, payload) {
-    ensureParentDir(filePath);
-    const tmpPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
-    try {
-        fs.writeFileSync(tmpPath, JSON.stringify(payload, null, 2), {
-            encoding: "utf-8",
-            mode: 0o600,
-        });
-        fs.renameSync(tmpPath, filePath);
-    }
-    finally {
-        if (fs.existsSync(tmpPath)) {
-            fs.rmSync(tmpPath, { force: true });
-        }
-    }
-}
 function normalizeAvailability(value) {
     if (value === "available" || value === "unavailable") {
         return value;
@@ -481,7 +460,7 @@ export function readAppRunStore(stateDir = resolveStateDir()) {
 export function writeAppRunStore(runs, stateDir = resolveStateDir()) {
     const filePath = resolveAppRunStoreFilePath(stateDir);
     const normalizedRuns = [...runs].sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
-    atomicWrite(filePath, {
+    writeJsonAtomicSync(filePath, {
         version: APP_RUN_STORE_VERSION,
         updatedAt: nowIso(),
         runs: normalizedRuns,

package/packages/agent/src/services/registry-client-local.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-client-local.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/services/registry-client-local.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAKV,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AA8oBpC,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC,CA8Bf"}
+{"version":3,"file":"registry-client-local.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/services/registry-client-local.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAKV,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AAqoBpC,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC,CA8Bf"}

package/packages/agent/src/services/registry-client-local.js

@@ -4,6 +4,7 @@ import { fileURLToPath } from "node:url";
 import { logger } from "@elizaos/core";
 import { resolveStateDir } from "../config/paths.js";
 import { packageNameToAppDisplayName } from "../contracts/apps.js";
+import { readJsonFile } from "../utils/atomic-json.js";
 import { mergeAppMeta, resolveAppOverride, } from "./registry-client-app-meta.js";
 const LOCAL_PLUGIN_TAG_STOPWORDS = new Set([
     "plugin",
@@ -94,15 +95,6 @@ function normaliseGitHubRepo(repo) {
         return null;
     return cleaned;
 }
-async function readJsonFile(filePath) {
-    try {
-        const raw = await fs.readFile(filePath, "utf-8");
-        return JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-}
 function normalizeLocalTag(tag) {
     const normalized = tag
         .trim()

package/packages/agent/src/utils/atomic-json.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Atomic JSON read/write helpers (node-only).
+ *
+ * Consolidates the write-tmp + rename pattern duplicated across the agent
+ * package for tokens, ledgers, config snapshots, and runtime operations.
+ *
+ * Defaults:
+ *   - mode 0o600 on the written file (secret-grade)
+ *   - dir mode 0o700 when the parent has to be created
+ *   - JSON 2-space indent, no trailing newline
+ *   - tmp filename `${filePath}.tmp-${pid}-${Date.now()}` (multi-process safe)
+ *   - parent directory created with mkdir recursive
+ *
+ * On failure, the temp file is best-effort removed.
+ */
+export interface WriteJsonAtomicOptions {
+    /** File mode for the final file. Default 0o600. */
+    mode?: number;
+    /** Directory mode if the parent has to be created. Default 0o700. */
+    dirMode?: number;
+    /** Append a trailing newline. Default false. */
+    trailingNewline?: boolean;
+    /** `space` arg passed to JSON.stringify. Default 2. */
+    indent?: number | string;
+    /** Skip mkdir of the parent directory. Default false. */
+    skipMkdir?: boolean;
+}
+export declare function writeJsonAtomic(filePath: string, value: unknown, opts?: WriteJsonAtomicOptions): Promise<void>;
+export declare function writeJsonAtomicSync(filePath: string, value: unknown, opts?: WriteJsonAtomicOptions): void;
+/**
+ * Read and JSON.parse a file. Returns `null` if the file does not exist or
+ * cannot be parsed — callers that need the distinction should call
+ * `fs.readFile` directly.
+ */
+export declare function readJsonFile<T>(filePath: string): Promise<T | null>;
+export declare function readJsonFileSync<T>(filePath: string): T | null;
+//# sourceMappingURL=atomic-json.d.ts.map

package/packages/agent/src/utils/atomic-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-json.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/utils/atomic-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,MAAM,WAAW,sBAAsB;IACrC,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,yDAAyD;IACzD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AA+BD,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,IAAI,CAAC,EAAE,sBAAsB,GAC5B,IAAI,CAkBN;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAOzE;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAO9D"}

package/packages/agent/src/utils/atomic-json.js

@@ -0,0 +1,98 @@
+/**
+ * Atomic JSON read/write helpers (node-only).
+ *
+ * Consolidates the write-tmp + rename pattern duplicated across the agent
+ * package for tokens, ledgers, config snapshots, and runtime operations.
+ *
+ * Defaults:
+ *   - mode 0o600 on the written file (secret-grade)
+ *   - dir mode 0o700 when the parent has to be created
+ *   - JSON 2-space indent, no trailing newline
+ *   - tmp filename `${filePath}.tmp-${pid}-${Date.now()}` (multi-process safe)
+ *   - parent directory created with mkdir recursive
+ *
+ * On failure, the temp file is best-effort removed.
+ */
+import fs from "node:fs";
+import fsp from "node:fs/promises";
+import path from "node:path";
+function normalizeOptions(opts) {
+    return {
+        mode: opts?.mode ?? 0o600,
+        dirMode: opts?.dirMode ?? 0o700,
+        trailingNewline: opts?.trailingNewline ?? false,
+        indent: opts?.indent ?? 2,
+        skipMkdir: opts?.skipMkdir ?? false,
+    };
+}
+function tmpPathFor(filePath) {
+    return `${filePath}.tmp-${process.pid}-${Date.now()}`;
+}
+function serialize(value, opts) {
+    const body = JSON.stringify(value, null, opts.indent);
+    return opts.trailingNewline ? `${body}\n` : body;
+}
+export async function writeJsonAtomic(filePath, value, opts) {
+    const o = normalizeOptions(opts);
+    if (!o.skipMkdir) {
+        await fsp.mkdir(path.dirname(filePath), {
+            recursive: true,
+            mode: o.dirMode,
+        });
+    }
+    const tmp = tmpPathFor(filePath);
+    try {
+        await fsp.writeFile(tmp, serialize(value, o), {
+            encoding: "utf-8",
+            mode: o.mode,
+        });
+        await fsp.rename(tmp, filePath);
+    }
+    finally {
+        await fsp.rm(tmp, { force: true }).catch(() => { });
+    }
+}
+export function writeJsonAtomicSync(filePath, value, opts) {
+    const o = normalizeOptions(opts);
+    if (!o.skipMkdir) {
+        fs.mkdirSync(path.dirname(filePath), {
+            recursive: true,
+            mode: o.dirMode,
+        });
+    }
+    const tmp = tmpPathFor(filePath);
+    try {
+        fs.writeFileSync(tmp, serialize(value, o), {
+            encoding: "utf-8",
+            mode: o.mode,
+        });
+        fs.renameSync(tmp, filePath);
+    }
+    finally {
+        if (fs.existsSync(tmp))
+            fs.rmSync(tmp, { force: true });
+    }
+}
+/**
+ * Read and JSON.parse a file. Returns `null` if the file does not exist or
+ * cannot be parsed — callers that need the distinction should call
+ * `fs.readFile` directly.
+ */
+export async function readJsonFile(filePath) {
+    try {
+        const raw = await fsp.readFile(filePath, "utf-8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export function readJsonFileSync(filePath) {
+    try {
+        const raw = fs.readFileSync(filePath, "utf-8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}

package/packages/app-core/src/api/automation-node-contributors.d.ts

@@ -0,0 +1,14 @@
+import type { loadElizaConfig } from "@elizaos/agent";
+import type { AgentRuntime, UUID } from "@elizaos/core";
+import type { AutomationNodeDescriptor } from "./client-types-config";
+export interface AutomationNodeContributorContext {
+    runtime: AgentRuntime;
+    config: ReturnType<typeof loadElizaConfig>;
+    agentName: string;
+    adminEntityId: UUID;
+}
+export type AutomationNodeContributor = (context: AutomationNodeContributorContext) => Promise<AutomationNodeDescriptor[]> | AutomationNodeDescriptor[];
+export declare function registerAutomationNodeContributor(id: string, contributor: AutomationNodeContributor): void;
+export declare function listAutomationNodeContributors(): AutomationNodeContributor[];
+export declare function clearAutomationNodeContributorsForTests(): void;
+//# sourceMappingURL=automation-node-contributors.d.ts.map

package/packages/app-core/src/api/automation-node-contributors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"automation-node-contributors.d.ts","sourceRoot":"","sources":["../../../../../../app-core/src/api/automation-node-contributors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,MAAM,yBAAyB,GAAG,CACtC,OAAO,EAAE,gCAAgC,KACtC,OAAO,CAAC,wBAAwB,EAAE,CAAC,GAAG,wBAAwB,EAAE,CAAC;AAItE,wBAAgB,iCAAiC,CAC/C,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,yBAAyB,GACrC,IAAI,CAMN;AAED,wBAAgB,8BAA8B,IAAI,yBAAyB,EAAE,CAE5E;AAED,wBAAgB,uCAAuC,IAAI,IAAI,CAE9D"}

package/packages/app-core/src/api/automation-node-contributors.js

@@ -0,0 +1,14 @@
+const contributors = new Map();
+export function registerAutomationNodeContributor(id, contributor) {
+    const normalizedId = id.trim();
+    if (!normalizedId) {
+        throw new Error("Automation node contributor id is required");
+    }
+    contributors.set(normalizedId, contributor);
+}
+export function listAutomationNodeContributors() {
+    return [...contributors.values()];
+}
+export function clearAutomationNodeContributorsForTests() {
+    contributors.clear();
+}