@elizaos/ui 2.0.0-alpha.528 → 2.0.0-alpha.529

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elizaos/ui",
-  "version": "2.0.0-alpha.528",
+  "version": "2.0.0-alpha.529",
   "description": "Shared UI primitives, composites, and layout utilities for elizaOS apps.",
   "type": "module",
   "license": "MIT",

package/packages/agent/src/actions/browser-autofill-login.d.ts

@@ -0,0 +1,36 @@
+/**
+ * BROWSER_AUTOFILL_LOGIN — agent-driven browser login autofill.
+ *
+ * Lets the agent say "log into github.com for me" and have the saved
+ * credentials filled into an open Milady browser tab without a per-call
+ * consent prompt.
+ *
+ * Authorization model (mirrors the user-driven autofill flow):
+ *   - The user must have set `creds.<domain>.:autoallow = "1"` on the
+ *     domain. This is the same vault key the React-side consent flow
+ *     uses; toggling it from Settings -> Vault -> Logins is the
+ *     SOLE way to let the agent autofill silently.
+ *   - Without that flag, this action returns
+ *     `{ ok: false, reason: "user has not pre-authorized agent autofill for <domain>" }`.
+ *     The agent should NOT fall back to the user-driven flow on its own
+ *     because the user-driven flow is gated by an interactive React
+ *     modal that an autonomous agent cannot consent to.
+ *
+ * Tab selection:
+ *   - Lists the live browser-workspace tabs and picks the first one
+ *     whose URL hostname matches `domain` (registrable hostname,
+ *     case-insensitive). Returns a clean error when no such tab exists
+ *     so the agent can decide whether to open one first via
+ *     BROWSER_SESSION.
+ *
+ * Fill mechanism:
+ *   - Injects a small JS snippet that mirrors the same form-detection
+ *     and `setNativeInputValue` helpers the in-tab preload uses, so
+ *     React-controlled inputs see the change.
+ *   - When `submit: true`, the snippet also calls `form.submit()` (or
+ *     clicks a likely submit button) after filling. Off by default —
+ *     the safer behaviour is fill-only and let the user click submit.
+ */
+import type { Action } from "@elizaos/core";
+export declare const browserAutofillLoginAction: Action;
+//# sourceMappingURL=browser-autofill-login.d.ts.map

package/packages/agent/src/actions/browser-autofill-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-autofill-login.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/actions/browser-autofill-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EACV,MAAM,EAKP,MAAM,eAAe,CAAC;AA2GvB,eAAO,MAAM,0BAA0B,EAAE,MA8PxC,CAAC"}

package/packages/agent/src/actions/browser-autofill-login.js

@@ -0,0 +1,347 @@
+/**
+ * BROWSER_AUTOFILL_LOGIN — agent-driven browser login autofill.
+ *
+ * Lets the agent say "log into github.com for me" and have the saved
+ * credentials filled into an open Milady browser tab without a per-call
+ * consent prompt.
+ *
+ * Authorization model (mirrors the user-driven autofill flow):
+ *   - The user must have set `creds.<domain>.:autoallow = "1"` on the
+ *     domain. This is the same vault key the React-side consent flow
+ *     uses; toggling it from Settings -> Vault -> Logins is the
+ *     SOLE way to let the agent autofill silently.
+ *   - Without that flag, this action returns
+ *     `{ ok: false, reason: "user has not pre-authorized agent autofill for <domain>" }`.
+ *     The agent should NOT fall back to the user-driven flow on its own
+ *     because the user-driven flow is gated by an interactive React
+ *     modal that an autonomous agent cannot consent to.
+ *
+ * Tab selection:
+ *   - Lists the live browser-workspace tabs and picks the first one
+ *     whose URL hostname matches `domain` (registrable hostname,
+ *     case-insensitive). Returns a clean error when no such tab exists
+ *     so the agent can decide whether to open one first via
+ *     BROWSER_SESSION.
+ *
+ * Fill mechanism:
+ *   - Injects a small JS snippet that mirrors the same form-detection
+ *     and `setNativeInputValue` helpers the in-tab preload uses, so
+ *     React-controlled inputs see the change.
+ *   - When `submit: true`, the snippet also calls `form.submit()` (or
+ *     clicks a likely submit button) after filling. Off by default —
+ *     the safer behaviour is fill-only and let the user click submit.
+ */
+import { logger } from "@elizaos/core";
+import { getAutofillAllowed, getSavedLogin, listSavedLogins, } from "@elizaos/vault";
+import { hasOwnerAccess } from "../security/access.js";
+import { evaluateBrowserWorkspaceTab, isBrowserWorkspaceBridgeConfigured, listBrowserWorkspaceTabs, } from "../services/browser-workspace.js";
+function tabUrlMatchesDomain(tabUrl, domain) {
+    if (!tabUrl)
+        return false;
+    let hostname;
+    try {
+        hostname = new URL(tabUrl).hostname;
+    }
+    catch {
+        return false;
+    }
+    return hostname.toLowerCase() === domain.toLowerCase();
+}
+function buildAutofillScript(args) {
+    // Inline snippet — runs in the OOPIF (the page's content world) via
+    // electrobun tab eval. Uses setNativeInputValue to bypass React's
+    // value-setter override.
+    return `
+(() => {
+  const USERNAME = ${JSON.stringify(args.username)};
+  const PASSWORD = ${JSON.stringify(args.password)};
+  const SUBMIT = ${args.submit ? "true" : "false"};
+
+  function setNativeInputValue(input, value) {
+    const proto = Object.getPrototypeOf(input);
+    const desc = Object.getOwnPropertyDescriptor(proto, "value");
+    if (desc && typeof desc.set === "function") {
+      desc.set.call(input, value);
+    } else {
+      input.value = value;
+    }
+    input.dispatchEvent(new Event("input", { bubbles: true }));
+    input.dispatchEvent(new Event("change", { bubbles: true }));
+  }
+
+  function findPrecedingTextInput(passwordInput) {
+    const root = passwordInput.form || document.body;
+    const candidates = root.querySelectorAll(
+      'input[type="text"], input[type="email"], input:not([type])'
+    );
+    let lastBefore = null;
+    for (const el of candidates) {
+      if (el.compareDocumentPosition(passwordInput) & Node.DOCUMENT_POSITION_FOLLOWING) {
+        lastBefore = el;
+      }
+    }
+    return lastBefore;
+  }
+
+  const password = document.querySelector('input[type="password"]');
+  if (!password) {
+    return { ok: false, reason: "no_password_input" };
+  }
+  const form = password.form;
+  const username =
+    (form && form.querySelector(
+      'input[type="email"], input[name*="user" i], input[name*="email" i], input[name*="login" i]'
+    )) || findPrecedingTextInput(password);
+
+  if (username) setNativeInputValue(username, USERNAME);
+  setNativeInputValue(password, PASSWORD);
+
+  if (SUBMIT) {
+    if (form && typeof form.requestSubmit === "function") {
+      form.requestSubmit();
+    } else if (form && typeof form.submit === "function") {
+      form.submit();
+    } else {
+      const button =
+        (form && form.querySelector('button[type="submit"], input[type="submit"]')) ||
+        document.querySelector('button[type="submit"], input[type="submit"]');
+      if (button) (button).click();
+    }
+  }
+
+  return {
+    ok: true,
+    filled: { username: !!username, password: true },
+    submitted: SUBMIT,
+  };
+})();
+`;
+}
+export const browserAutofillLoginAction = {
+    name: "BROWSER_AUTOFILL_LOGIN",
+    similes: [
+        "AGENT_AUTOFILL",
+        "AUTOFILL_BROWSER_LOGIN",
+        "AUTOFILL_LOGIN",
+        "FILL_BROWSER_CREDENTIALS",
+        "LOG_INTO_SITE",
+        "SIGN_IN_TO_SITE",
+    ],
+    description: "Autofill saved credentials into an open Milady browser tab for the requested domain. Requires the user to have pre-authorized agent autofill for the domain via Settings -> Vault -> Logins (`creds.<domain>.:autoallow = 1`).",
+    validate: async (runtime, message, _state) => {
+        return hasOwnerAccess(runtime, message);
+    },
+    handler: async (runtime, message, _state, options) => {
+        if (!(await hasOwnerAccess(runtime, message))) {
+            return {
+                text: "Permission denied: only the owner may run BROWSER_AUTOFILL_LOGIN.",
+                success: false,
+                values: { success: false, error: "PERMISSION_DENIED" },
+                data: { actionName: "BROWSER_AUTOFILL_LOGIN" },
+            };
+        }
+        const params = options?.parameters;
+        const domain = params?.domain?.trim().toLowerCase() ?? "";
+        const requestedUsername = params?.username?.trim();
+        const submit = params?.submit === true;
+        if (!domain) {
+            return {
+                text: "BROWSER_AUTOFILL_LOGIN requires a `domain` parameter.",
+                success: false,
+                values: {
+                    success: false,
+                    error: "BROWSER_AUTOFILL_LOGIN_BAD_PARAMS",
+                },
+                data: { actionName: "BROWSER_AUTOFILL_LOGIN" },
+            };
+        }
+        if (!isBrowserWorkspaceBridgeConfigured(process.env)) {
+            return {
+                text: "BROWSER_AUTOFILL_LOGIN requires the desktop browser workspace bridge.",
+                success: false,
+                values: {
+                    success: false,
+                    error: "BROWSER_BRIDGE_UNAVAILABLE",
+                },
+                data: { actionName: "BROWSER_AUTOFILL_LOGIN" },
+            };
+        }
+        // Resolve the shared vault via dynamic import — the agent package
+        // doesn't directly depend on @elizaos/app-core to avoid a circular
+        // graph; the runtime bootstraps app-core before any action runs.
+        const { sharedVault } = (await import("@elizaos/app-core/services/vault-mirror"));
+        const vault = sharedVault();
+        // ── Authorization gate: per-domain autoallow flag ─────────────
+        const allowed = await getAutofillAllowed(vault, domain);
+        if (!allowed) {
+            const text = `User has not pre-authorized agent autofill for ${domain}. Toggle "Allow agent to autofill" for this domain under Settings -> Vault -> Logins.`;
+            return {
+                text,
+                success: false,
+                values: {
+                    success: false,
+                    error: "AGENT_AUTOFILL_NOT_AUTHORIZED",
+                    domain,
+                },
+                data: { actionName: "BROWSER_AUTOFILL_LOGIN", domain, reason: text },
+            };
+        }
+        // ── Look up credentials ──────────────────────────────────────
+        let savedLogin = null;
+        if (requestedUsername) {
+            savedLogin = await getSavedLogin(vault, domain, requestedUsername);
+            if (!savedLogin) {
+                return {
+                    text: `No saved login for ${requestedUsername} on ${domain}.`,
+                    success: false,
+                    values: {
+                        success: false,
+                        error: "AGENT_AUTOFILL_NO_LOGIN",
+                        domain,
+                        username: requestedUsername,
+                    },
+                    data: { actionName: "BROWSER_AUTOFILL_LOGIN" },
+                };
+            }
+        }
+        else {
+            // No username supplied — pick the most recently modified entry.
+            const summaries = await listSavedLogins(vault, domain);
+            if (summaries.length === 0) {
+                return {
+                    text: `No saved logins for ${domain}.`,
+                    success: false,
+                    values: {
+                        success: false,
+                        error: "AGENT_AUTOFILL_NO_LOGIN",
+                        domain,
+                    },
+                    data: { actionName: "BROWSER_AUTOFILL_LOGIN" },
+                };
+            }
+            const sorted = [...summaries].sort((a, b) => b.lastModified - a.lastModified);
+            const chosen = sorted[0];
+            if (!chosen) {
+                return {
+                    text: `No saved logins for ${domain}.`,
+                    success: false,
+                    values: {
+                        success: false,
+                        error: "AGENT_AUTOFILL_NO_LOGIN",
+                        domain,
+                    },
+                    data: { actionName: "BROWSER_AUTOFILL_LOGIN" },
+                };
+            }
+            savedLogin = await getSavedLogin(vault, domain, chosen.username);
+            if (!savedLogin) {
+                return {
+                    text: `Saved login ${chosen.username} on ${domain} disappeared between list and reveal.`,
+                    success: false,
+                    values: {
+                        success: false,
+                        error: "AGENT_AUTOFILL_RACE",
+                        domain,
+                    },
+                    data: { actionName: "BROWSER_AUTOFILL_LOGIN" },
+                };
+            }
+        }
+        // ── Locate the open tab ──────────────────────────────────────
+        const tabs = await listBrowserWorkspaceTabs();
+        const matchingTab = tabs.find((t) => tabUrlMatchesDomain(t.url, domain));
+        if (!matchingTab) {
+            return {
+                text: `No open browser tab on ${domain}. Open one with BROWSER_SESSION first.`,
+                success: false,
+                values: {
+                    success: false,
+                    error: "AGENT_AUTOFILL_NO_TAB",
+                    domain,
+                },
+                data: { actionName: "BROWSER_AUTOFILL_LOGIN" },
+            };
+        }
+        // ── Inject and evaluate the autofill script ──────────────────
+        const script = buildAutofillScript({
+            username: savedLogin.username,
+            password: savedLogin.password,
+            submit,
+        });
+        const rawResult = await evaluateBrowserWorkspaceTab({
+            id: matchingTab.id,
+            script,
+        });
+        // The injected snippet returns
+        //   { ok: boolean; reason?: string; filled?: { username, password }; submitted?: boolean }
+        // — narrow to the fields we surface in `values` so the action result
+        // is plain JSON.
+        const filled = rawResult &&
+            typeof rawResult === "object" &&
+            "filled" in rawResult
+            ? Boolean(rawResult.filled)
+            : false;
+        const fillReason = rawResult &&
+            typeof rawResult === "object" &&
+            typeof rawResult.reason === "string"
+            ? rawResult.reason
+            : null;
+        logger.info(`[browser-autofill-login] domain=${domain} tabId=${matchingTab.id} submit=${submit} filled=${filled}`);
+        return {
+            text: submit
+                ? `Filled and submitted login on ${domain} (tab ${matchingTab.id}).`
+                : `Filled login on ${domain} (tab ${matchingTab.id}). User must click submit.`,
+            success: true,
+            values: {
+                success: true,
+                domain,
+                tabId: matchingTab.id,
+                submitted: submit,
+                filled,
+                ...(fillReason ? { fillReason } : {}),
+            },
+            data: {
+                actionName: "BROWSER_AUTOFILL_LOGIN",
+                domain,
+                tabId: matchingTab.id,
+                filled,
+                ...(fillReason ? { fillReason } : {}),
+            },
+        };
+    },
+    parameters: [
+        {
+            name: "domain",
+            description: "Registrable hostname to autofill (e.g. `github.com`, no protocol or path).",
+            required: true,
+            schema: { type: "string" },
+        },
+        {
+            name: "username",
+            description: "Specific saved login to use. When omitted, the most recently modified saved login for the domain is selected.",
+            required: false,
+            schema: { type: "string" },
+        },
+        {
+            name: "submit",
+            description: "When true, submit the form after filling. Defaults to false (fill-only).",
+            required: false,
+            schema: { type: "boolean" },
+        },
+    ],
+    examples: [
+        [
+            {
+                name: "{{user1}}",
+                content: { text: "Log into github.com for me" },
+            },
+            {
+                name: "{{agentName}}",
+                content: {
+                    text: "Filled login on github.com. Click submit when ready.",
+                    actions: ["BROWSER_AUTOFILL_LOGIN"],
+                },
+            },
+        ],
+    ],
+};

package/packages/agent/src/api/experience-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"experience-routes.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/api/experience-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAQ,MAAM,eAAe,CAAC;AAQxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAsC9D,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,GAAG,EAAE,GAAG,CAAC;CACV;AA0YD,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,sBAAsB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAoLlB"}
+{"version":3,"file":"experience-routes.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/api/experience-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAQ,MAAM,eAAe,CAAC;AA0FxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAiB9D,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,GAAG,EAAE,GAAG,CAAC;CACV;AA8ZD,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,sBAAsB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAoLlB"}

package/packages/agent/src/api/experience-routes.js

@@ -1,12 +1,50 @@
-import { ExperienceType, OutcomeType, } from "../../../typescript/src/features/advanced-capabilities/experience/types.js";
+// These enums and types are defined in @elizaos/core's advanced-capabilities
+// experience module but not re-exported from the compiled dist bundle (tsdown
+// tree-shakes them). Inlined here so the packaged desktop build works without
+// a cross-package source import.
+var ExperienceType;
+(function (ExperienceType) {
+    ExperienceType["SUCCESS"] = "success";
+    ExperienceType["FAILURE"] = "failure";
+    ExperienceType["DISCOVERY"] = "discovery";
+    ExperienceType["CORRECTION"] = "correction";
+    ExperienceType["LEARNING"] = "learning";
+    ExperienceType["HYPOTHESIS"] = "hypothesis";
+    ExperienceType["VALIDATION"] = "validation";
+    ExperienceType["WARNING"] = "warning";
+})(ExperienceType || (ExperienceType = {}));
+var OutcomeType;
+(function (OutcomeType) {
+    OutcomeType["POSITIVE"] = "positive";
+    OutcomeType["NEGATIVE"] = "negative";
+    OutcomeType["NEUTRAL"] = "neutral";
+    OutcomeType["MIXED"] = "mixed";
+})(OutcomeType || (OutcomeType = {}));
 const EXPERIENCE_ROUTE_PREFIXES = [
     "/api/experiences",
     "/api/character/experiences",
 ];
 const EXPERIENCE_LIST_DEFAULT_LIMIT = 100;
 const EXPERIENCE_LIST_MAX_LIMIT = 200;
+function isExperienceService(service) {
+    if (!service || typeof service !== "object") {
+        return false;
+    }
+    const candidate = service;
+    const requiredMethods = [
+        "recordExperience",
+        "listExperiences",
+        "getExperience",
+        "updateExperience",
+        "deleteExperience",
+        "getExperienceGraph",
+        "consolidateDuplicateExperiences",
+    ];
+    return requiredMethods.every((method) => typeof candidate[method] === "function");
+}
 function getExperienceService(runtime) {
-    return runtime?.getService("EXPERIENCE");
+    const service = runtime?.getService("EXPERIENCE");
+    return isExperienceService(service) ? service : null;
 }
 function matchExperiencePath(pathname) {
     for (const basePath of EXPERIENCE_ROUTE_PREFIXES) {

package/packages/agent/src/api/static-file-server.d.ts

@@ -1,14 +1,14 @@
 /**
  * Static file serving for the built React dashboard (production mode).
  *
- * Extracted from server.ts — serves apps/app/dist/ with SPA fallback,
+ * Extracted from server.ts — serves packages/app/dist/ with SPA fallback,
  * caching, and API-base injection for reverse-proxy deployments.
  */
 import type http from "node:http";
 export declare function resolveUiDir(): string | null;
 export declare function sendStaticResponse(req: http.IncomingMessage, res: http.ServerResponse, status: number, headers: Record<string, string | number>, body?: Buffer): void;
 /**
- * Serve built dashboard assets from apps/app/dist with SPA fallback.
+ * Serve built dashboard assets from packages/app/dist with SPA fallback.
  * Returns true when the request is handled.
  */
 export declare function injectApiBaseIntoHtml(html: Buffer, externalBase?: string | null, opts?: {

package/packages/agent/src/api/static-file-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"static-file-server.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/api/static-file-server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAkDlC,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CA+B5C;AAMD,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,EACxC,IAAI,CAAC,EAAE,MAAM,GACZ,IAAI,CAON;AAyBD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,EAC5B,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAClC,MAAM,CAuBR;AAMD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CA2GT;AAMD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAS9D"}
+{"version":3,"file":"static-file-server.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/api/static-file-server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAkDlC,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAiC5C;AAMD,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,EACxC,IAAI,CAAC,EAAE,MAAM,GACZ,IAAI,CAON;AAyBD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,EAC5B,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAClC,MAAM,CAuBR;AAMD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CA2GT;AAMD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAS9D"}

package/packages/agent/src/api/static-file-server.js

@@ -1,7 +1,7 @@
 /**
  * Static file serving for the built React dashboard (production mode).
  *
- * Extracted from server.ts — serves apps/app/dist/ with SPA fallback,
+ * Extracted from server.ts — serves packages/app/dist/ with SPA fallback,
  * caching, and API-base injection for reverse-proxy deployments.
  */
 import fs from "node:fs";
@@ -59,7 +59,9 @@ export function resolveUiDir() {
     const thisDir = path.dirname(fileURLToPath(import.meta.url));
     const packageRoot = findOwnPackageRoot(thisDir);
     const candidates = [
+        path.resolve("packages/app/dist"),
         path.resolve("apps/app/dist"),
+        path.resolve(packageRoot, "packages", "app", "dist"),
         path.resolve(packageRoot, "apps", "app", "dist"),
     ];
     for (const candidate of candidates) {
@@ -104,7 +106,7 @@ function getCachedFile(filePath, mtimeMs) {
 // API base injection (reverse-proxy support)
 // ---------------------------------------------------------------------------
 /**
- * Serve built dashboard assets from apps/app/dist with SPA fallback.
+ * Serve built dashboard assets from packages/app/dist with SPA fallback.
  * Returns true when the request is handled.
  */
 export function injectApiBaseIntoHtml(html, externalBase, opts) {

package/packages/agent/src/runtime/agent-wallets.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Per-agent wallet keys, stored in the Eliza vault.
+ *
+ * This module is the bridge between agent identity and the vault. Each
+ * agent gets its own EVM and Solana keypair, stored under
+ * `agent.<agentId>.wallet.<chain>` as a JSON record. Private keys are
+ * sensitive and AES-GCM encrypted at rest by the vault; the vault's
+ * master key lives in the OS keychain.
+ *
+ * The runtime-wide single wallet (process.env.EVM_PRIVATE_KEY etc.) is
+ * the *user* wallet, hydrated from the OS secure store via
+ * `hydrateWalletKeysFromNodePlatformSecureStore`. Per-agent wallets are
+ * stored *inside* the vault (encrypted file), enumerable and easy to
+ * surface in the UI alongside saved logins.
+ *
+ * This module does not generate or store keys on its own; callers
+ * supply a `Vault` instance. Agent-creation lifecycle code wires this
+ * up — see `runtime/eliza.ts`.
+ */
+import { type Vault } from "@elizaos/vault";
+import type { WalletChain } from "../contracts/wallet.js";
+/** Public, non-sensitive description of an agent wallet. */
+export interface AgentWalletDescriptor {
+    readonly agentId: string;
+    readonly chain: WalletChain;
+    readonly address: string;
+    readonly lastModified: number;
+}
+declare function walletKey(agentId: string, chain: WalletChain): string;
+declare function agentPrefix(agentId: string): string;
+declare function parseAgentWalletKey(key: string): {
+    agentId: string;
+    chain: WalletChain;
+} | null;
+/**
+ * Derive the public address from a stored private key. EVM uses the
+ * existing helper; Solana stores the public key alongside the secret in
+ * `generateWalletForChain`, so the stored `address` is authoritative
+ * and we trust it for the read path.
+ */
+declare function deriveAddressFor(chain: WalletChain, privateKey: string): string;
+/**
+ * Read the public descriptor for an agent's wallet. Returns null when
+ * the agent has no wallet for that chain. Does NOT reveal the private
+ * key.
+ */
+export declare function getAgentWalletDescriptor(vault: Vault, agentId: string, chain: WalletChain): Promise<AgentWalletDescriptor | null>;
+/**
+ * Reveal the private key. Audit-logged via the vault. Use only for
+ * signing flows.
+ */
+export declare function revealAgentWalletPrivateKey(vault: Vault, agentId: string, chain: WalletChain, caller?: string): Promise<string>;
+/**
+ * Existence check. Does not reveal the key.
+ */
+export declare function hasAgentWallet(vault: Vault, agentId: string, chain: WalletChain): Promise<boolean>;
+/**
+ * List every wallet descriptor for an agent (typically [evm, solana]).
+ */
+export declare function listAgentWallets(vault: Vault, agentId: string): Promise<readonly AgentWalletDescriptor[]>;
+/**
+ * List every agent that has at least one wallet stored. Returns the
+ * agent IDs (decoded). Use for UI surfaces enumerating agent wallets.
+ */
+export declare function listAgentsWithWallets(vault: Vault): Promise<readonly string[]>;
+/**
+ * Persist a wallet for an agent. Replaces any existing entry for that
+ * (agentId, chain). Stamps `lastModified`.
+ *
+ * Caller is responsible for supplying the matching address — for EVM
+ * this can be derived from the private key, for Solana the keypair
+ * generator returns it directly.
+ */
+export declare function setAgentWallet(vault: Vault, agentId: string, chain: WalletChain, privateKey: string, address: string, caller?: string): Promise<AgentWalletDescriptor>;
+/**
+ * Generate a fresh wallet for an agent and persist it. Returns the
+ * public descriptor. Idempotent: callers should check `hasAgentWallet`
+ * first if they want to avoid replacing an existing wallet.
+ */
+export declare function generateAgentWallet(vault: Vault, agentId: string, chain: WalletChain, caller?: string): Promise<AgentWalletDescriptor>;
+/**
+ * Generate any missing wallets (EVM + Solana) for an agent. Existing
+ * wallets are left alone. Returns descriptors for every chain that now
+ * has a wallet (whether it was generated this call or was already
+ * present).
+ */
+export declare function ensureAgentWallets(vault: Vault, agentId: string, caller?: string): Promise<readonly AgentWalletDescriptor[]>;
+/**
+ * Remove an agent's wallet for one chain. Idempotent.
+ */
+export declare function removeAgentWallet(vault: Vault, agentId: string, chain: WalletChain): Promise<void>;
+/**
+ * Remove every wallet for an agent. Use during agent deletion.
+ */
+export declare function removeAllAgentWallets(vault: Vault, agentId: string): Promise<void>;
+export declare const __test__: {
+    walletKey: typeof walletKey;
+    agentPrefix: typeof agentPrefix;
+    parseAgentWalletKey: typeof parseAgentWalletKey;
+    deriveAddressFor: typeof deriveAddressFor;
+};
+export {};
+//# sourceMappingURL=agent-wallets.d.ts.map

package/packages/agent/src/runtime/agent-wallets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-wallets.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/runtime/agent-wallets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAiC,KAAK,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAE3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAK1D,4DAA4D;AAC5D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAwBD,iBAAS,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAE9D;AAED,iBAAS,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED,iBAAS,mBAAmB,CAC1B,GAAG,EAAE,MAAM,GACV;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GAAG,IAAI,CAQhD;AAsBD;;;;;GAKG;AACH,iBAAS,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CASxE;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAWvC;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAgB3C;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAS5B;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,CAAC,CA+BhC;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,CAAC,CAUhC;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAY3C;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAKf;AAGD,eAAO,MAAM,QAAQ;;;;;CAKpB,CAAC"}