@elizaos/ui 2.0.0-alpha.528 → 2.0.0-alpha.529

package/packages/app-core/src/registry/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../../../app-core/src/registry/schema.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAwCxB,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aAXvB,MAAM;iBACF,OAAO;aACX,OAAO,EAAE;oBACF,OAAO;;aAHd,MAAM;iBACF,OAAO;aACX,OAAO,EAAE;oBACF,OAAO;;iBAkCnB,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AA6B5D,QAAA,MAAM,sBAAsB;;;;EAI1B,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAYvB,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACvD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE,eAAO,MAAM,eAAe;;;;iBAI1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAsCxD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAY1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAqDxD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA9MvB,MAAM;qBACF,OAAO;iBACX,OAAO,EAAE;wBACF,OAAO;;iBAHd,MAAM;qBACF,OAAO;iBACX,OAAO,EAAE;wBACF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+MnB,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBApN1B,MAAM;qBACF,OAAO;iBACX,OAAO,EAAE;wBACF,OAAO;;iBAHd,MAAM;qBACF,OAAO;iBACX,OAAO,EAAE;wBACF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2NnB,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAhOpB,MAAM;qBACF,OAAO;iBACX,OAAO,EAAE;wBACF,OAAO;;iBAHd,MAAM;qBACF,OAAO;iBACX,OAAO,EAAE;wBACF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkOnB,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAvOzB,MAAM;qBACF,OAAO;iBACX,OAAO,EAAE;wBACF,OAAO;;iBAHd,MAAM;qBACF,OAAO;iBACX,OAAO,EAAE;wBACF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAHd,MAAM;qBACF,OAAO;iBACX,OAAO,EAAE;wBACF,OAAO;;iBAHd,MAAM;qBACF,OAAO;iBACX,OAAO,EAAE;wBACF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAHd,MAAM;qBACF,OAAO;iBACX,OAAO,EAAE;wBACF,OAAO;;iBAHd,MAAM;qBACF,OAAO;iBACX,OAAO,EAAE;wBACF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAwOnB,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;AAMjD,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;iBAcvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AAMF,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,sBAAsB,CAAC"}

package/packages/app-core/src/registry/schema.js

@@ -0,0 +1,250 @@
+// Registry SoT for apps, plugins, and connectors.
+//
+// Replaces the fragmented surface of:
+//   - plugins.json (97 entries, 5 categories)
+//   - PluginInfo (api/client-types-config.ts)
+//   - ConfigUiHint (types/index.ts)
+//   - RegistryAppInfo (shared/contracts/apps.ts)
+//   - VISIBLE_CONNECTOR_IDS / DEFAULT_ICONS / FEATURE_SUBGROUP / SUBGROUP_DISPLAY_ORDER
+//     (components/pages/plugin-list-utils.ts)
+//   - paramsToSchema() heuristics (PORT/TIMEOUT/MODEL guessing)
+//
+// Static registry only. Runtime overlay (enabled, configured, isActive,
+// validationErrors) lives in RegistryRuntimeOverlay and is merged at API read
+// time — never in the registry files themselves.
+import { z } from "zod";
+// ---------------------------------------------------------------------------
+// Config field schema — replaces PluginParamDef + ConfigUiHint.
+// One field, one place. UI hints are co-located with type info.
+// ---------------------------------------------------------------------------
+const configFieldType = z.enum([
+    "string",
+    "secret",
+    "boolean",
+    "number",
+    "select",
+    "multiselect",
+    "json",
+    "textarea",
+    "url",
+    "file-path",
+]);
+const configFieldOption = z.object({
+    value: z.string(),
+    label: z.string(),
+    description: z.string().optional(),
+    icon: z.string().optional(),
+    disabled: z.boolean().optional(),
+});
+const visibilityCondition = z.object({
+    key: z.string(),
+    equals: z.unknown().optional(),
+    in: z.array(z.unknown()).optional(),
+    notEquals: z.unknown().optional(),
+});
+export const configFieldSchema = z.object({
+    type: configFieldType,
+    required: z.boolean(),
+    sensitive: z.boolean().optional(),
+    default: z.union([z.string(), z.number(), z.boolean(), z.null()]).optional(),
+    label: z.string().optional(),
+    help: z.string().optional(),
+    placeholder: z.string().optional(),
+    group: z.string().optional(),
+    order: z.number().int().optional(),
+    width: z.enum(["full", "half", "third"]).optional(),
+    advanced: z.boolean().optional(),
+    hidden: z.boolean().optional(),
+    readonly: z.boolean().optional(),
+    icon: z.string().optional(),
+    options: z.array(configFieldOption).optional(),
+    pattern: z.string().optional(),
+    patternError: z.string().optional(),
+    min: z.number().optional(),
+    max: z.number().optional(),
+    step: z.number().optional(),
+    unit: z.string().optional(),
+    visible: visibilityCondition.optional(),
+});
+// ---------------------------------------------------------------------------
+// Render hints — replaces VISIBLE_CONNECTOR_IDS / DEFAULT_ICONS /
+// FEATURE_SUBGROUP / SUBGROUP_DISPLAY_ORDER.
+//
+// Surface mapping is implicit:
+//   kind: "connector" → ConnectorsView (primary)
+//   kind: "app"       → AppsView       (primary)
+//   kind: "plugin"    → PluginsView    (primary)
+// Every entry shows in its primary surface unless `visible: false`.
+//
+// Use `pinTo` to ALSO surface an item somewhere it wouldn't appear by default
+// (e.g. promoting an app into the chat quick-launcher). Opt-in only — keeps
+// the common case zero-config.
+// ---------------------------------------------------------------------------
+const renderActionSchema = z.enum([
+    "enable",
+    "configure",
+    "launch",
+    "attach",
+    "detach",
+    "stop",
+    "uninstall",
+    "install",
+    "setup-guide",
+]);
+const secondarySurfaceSchema = z.enum([
+    "chat-apps-section",
+    "companion-shell",
+    "settings-integrations",
+]);
+export const renderSchema = z.object({
+    visible: z.boolean().default(true),
+    pinTo: z.array(secondarySurfaceSchema).default([]),
+    style: z.enum(["card", "setup-panel", "hero-card"]).default("card"),
+    icon: z.string().optional(),
+    heroImage: z.string().optional(),
+    group: z.string(),
+    groupOrder: z.number().int().optional(),
+    actions: z.array(renderActionSchema).default([]),
+});
+// ---------------------------------------------------------------------------
+// External resources (already in plugins.json today).
+// ---------------------------------------------------------------------------
+export const resourcesSchema = z.object({
+    homepage: z.string().url().optional(),
+    repository: z.string().url().optional(),
+    setupGuideUrl: z.string().url().optional(),
+});
+// ---------------------------------------------------------------------------
+// App-only: launch + viewer + session (mirrors RegistryAppInfo).
+// ---------------------------------------------------------------------------
+const appViewerSchema = z.object({
+    url: z.string(),
+    embedParams: z.record(z.string(), z.string()).optional(),
+    postMessageAuth: z.boolean().optional(),
+    sandbox: z.string().optional(),
+});
+const appSessionSchema = z.object({
+    mode: z.enum(["viewer", "spectate-and-steer", "external"]),
+    features: z
+        .array(z.enum(["commands", "telemetry", "pause", "resume", "suggestions"]))
+        .optional(),
+});
+const appSupportsSchema = z.object({
+    v0: z.boolean(),
+    v1: z.boolean(),
+    v2: z.boolean(),
+});
+const appNpmSchema = z.object({
+    package: z.string(),
+    v0Version: z.string().nullable(),
+    v1Version: z.string().nullable(),
+    v2Version: z.string().nullable(),
+});
+const appRoutePluginSchema = z.object({
+    specifier: z.string().min(1),
+    exportName: z.string().min(1).optional(),
+});
+export const appLaunchSchema = z.object({
+    type: z.enum(["internal-tab", "overlay", "server-launch"]),
+    target: z.string().optional(),
+    url: z.string().nullable().optional(),
+    viewer: appViewerSchema.optional(),
+    session: appSessionSchema.optional(),
+    supports: appSupportsSchema.optional(),
+    npm: appNpmSchema.optional(),
+    capabilities: z.array(z.string()).default([]),
+    uiExtension: z.object({ detailPanelId: z.string() }).optional(),
+    curatedSlug: z.string().optional(),
+    routePlugin: appRoutePluginSchema.optional(),
+});
+// ---------------------------------------------------------------------------
+// Common fields shared by every entry.
+// ---------------------------------------------------------------------------
+const commonFields = {
+    id: z
+        .string()
+        .min(1)
+        .regex(/^[a-z0-9][a-z0-9-]*$/, "id must be kebab-case ascii"),
+    name: z.string().min(1),
+    description: z.string().optional(),
+    npmName: z.string().optional(),
+    version: z.string().optional(),
+    releaseStream: z.enum(["latest", "alpha"]).optional(),
+    source: z.enum(["bundled", "store"]).default("bundled"),
+    tags: z.array(z.string()).default([]),
+    config: z.record(z.string(), configFieldSchema).default({}),
+    render: renderSchema,
+    resources: resourcesSchema.default({}),
+    dependsOn: z.array(z.string()).default([]),
+};
+// ---------------------------------------------------------------------------
+// Discriminated union — three kinds, each with their own constraints.
+// ---------------------------------------------------------------------------
+const pluginSubtype = z.enum([
+    "ai-provider",
+    "feature",
+    "database",
+    "voice",
+    "knowledge",
+    "blockchain",
+    "media",
+    "agents",
+    "automation",
+    "storage",
+    "gaming",
+    "devtools",
+    "other",
+]);
+const connectorSubtype = z.enum([
+    "messaging",
+    "social",
+    "streaming",
+    "email",
+    "calendar",
+    "other",
+]);
+export const pluginEntrySchema = z.object({
+    ...commonFields,
+    kind: z.literal("plugin"),
+    subtype: pluginSubtype,
+});
+export const connectorEntrySchema = z.object({
+    ...commonFields,
+    kind: z.literal("connector"),
+    subtype: connectorSubtype,
+    auth: z
+        .object({
+        kind: z.enum(["token", "oauth", "credentials", "none"]),
+        credentialKeys: z.array(z.string()).default([]),
+    })
+        .optional(),
+});
+export const appEntrySchema = z.object({
+    ...commonFields,
+    kind: z.literal("app"),
+    subtype: z.enum(["game", "tool", "shell", "marketplace", "trading", "other"]),
+    launch: appLaunchSchema,
+});
+export const registryEntrySchema = z.discriminatedUnion("kind", [
+    pluginEntrySchema,
+    connectorEntrySchema,
+    appEntrySchema,
+]);
+// ---------------------------------------------------------------------------
+// Runtime overlay — never in registry files. Merged at API read time.
+// ---------------------------------------------------------------------------
+export const registryRuntimeOverlaySchema = z.object({
+    id: z.string(),
+    enabled: z.boolean(),
+    configured: z.boolean(),
+    isActive: z.boolean(),
+    loadError: z.string().optional(),
+    validationErrors: z
+        .array(z.object({ field: z.string(), message: z.string() }))
+        .default([]),
+    validationWarnings: z
+        .array(z.object({ field: z.string(), message: z.string() }))
+        .default([]),
+    installedVersion: z.string().optional(),
+    latestVersion: z.string().nullable().optional(),
+});

package/packages/app-core/src/services/vault-bootstrap.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Boot-time secret hydration: walk known plaintext sources, push sensitive
+ * values to the shared vault, and rewrite the on-disk plaintext to
+ * `vault://<KEY>` sentinels.
+ *
+ * Sources (in order):
+ *   1. milady.json `env[KEY]` and `env.vars[KEY]`
+ *   2. `<stateDir>/config.env`
+ *   3. milady.json `plugins.entries[<id>].config[KEY]`
+ *   4. `process.env[KEY]` for keys flagged sensitive in any registered plugin
+ *      (does not mutate process.env — only mirrors to the vault).
+ *
+ * Idempotent: a hydration marker at `<stateDir>/.vault-hydrated.json`
+ * keeps re-runs cheap once a clean migration has completed. Per-key
+ * failures are isolated; if every write fails the function throws.
+ */
+import type { Vault } from "@elizaos/vault";
+export interface VaultBootstrapResult {
+    migrated: number;
+    alreadyHydrated: number;
+    failed: string[];
+}
+interface VaultBootstrapOptions {
+    configPath?: string;
+    stateDir?: string;
+    /** Test seam — defaults to `sharedVault()`. */
+    vault?: Vault;
+}
+export declare function runVaultBootstrap(opts?: VaultBootstrapOptions): Promise<VaultBootstrapResult>;
+export {};
+//# sourceMappingURL=vault-bootstrap.d.ts.map

package/packages/app-core/src/services/vault-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-bootstrap.d.ts","sourceRoot":"","sources":["../../../../../../app-core/src/services/vault-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAgBH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAe5C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,UAAU,qBAAqB;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AA+MD,wBAAsB,iBAAiB,CACrC,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAgE/B"}

package/packages/app-core/src/services/vault-bootstrap.js

@@ -0,0 +1,245 @@
+/**
+ * Boot-time secret hydration: walk known plaintext sources, push sensitive
+ * values to the shared vault, and rewrite the on-disk plaintext to
+ * `vault://<KEY>` sentinels.
+ *
+ * Sources (in order):
+ *   1. milady.json `env[KEY]` and `env.vars[KEY]`
+ *   2. `<stateDir>/config.env`
+ *   3. milady.json `plugins.entries[<id>].config[KEY]`
+ *   4. `process.env[KEY]` for keys flagged sensitive in any registered plugin
+ *      (does not mutate process.env — only mirrors to the vault).
+ *
+ * Idempotent: a hydration marker at `<stateDir>/.vault-hydrated.json`
+ * keeps re-runs cheap once a clean migration has completed. Per-key
+ * failures are isolated; if every write fails the function throws.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { persistConfigEnv, readConfigEnv } from "@elizaos/agent/api/config-env";
+import { loadElizaConfig, saveElizaConfig, } from "@elizaos/agent/config/config";
+import { resolveStateDir } from "@elizaos/agent/config/paths";
+import { formatVaultRef, isVaultRef, } from "@elizaos/agent/runtime/operations/vault-bridge";
+import { logger } from "@elizaos/core";
+import { loadRegistry } from "../registry";
+import { sharedVault } from "./vault-mirror";
+const MARKER_VERSION = 1;
+const MARKER_FILENAME = ".vault-hydrated.json";
+const ENV_VAR_KEY = /^[A-Z][A-Z0-9_]*$/;
+function inferSensitiveByHeuristic(key) {
+    return /(?:_API_KEY|_SECRET|_TOKEN|_PASSWORD|_PRIVATE_KEY|_SIGNING_|ENCRYPTION_)/i.test(key);
+}
+/** Build the set of plugin-config keys flagged sensitive in the registry. */
+function sensitiveKeysFromRegistry() {
+    const keys = new Set();
+    const registry = loadRegistry();
+    for (const entry of registry.all) {
+        for (const [fieldKey, field] of Object.entries(entry.config)) {
+            if (field.sensitive === true)
+                keys.add(fieldKey);
+        }
+    }
+    return keys;
+}
+async function readMarker(stateDir) {
+    const filePath = path.join(stateDir, MARKER_FILENAME);
+    try {
+        const raw = await fs.readFile(filePath, "utf8");
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.version === "number" &&
+            typeof parsed.completedAt === "string" &&
+            Array.isArray(parsed.migratedKeys) &&
+            Array.isArray(parsed.skippedKeys)) {
+            return parsed;
+        }
+        return null;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+}
+async function writeMarker(stateDir, marker) {
+    await fs.mkdir(stateDir, { recursive: true });
+    const filePath = path.join(stateDir, MARKER_FILENAME);
+    const tmpPath = `${filePath}.tmp`;
+    await fs.writeFile(tmpPath, JSON.stringify(marker, null, 2), {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    await fs.rename(tmpPath, filePath);
+}
+function isPlainRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Walk milady.json env / env.vars / plugins.entries[*].config in place,
+ * pushing sensitive plaintext values to the vault and replacing them with
+ * sentinels. Returns the keys we attempted to migrate plus the failures.
+ */
+async function migrateMiladyJson(config, vault, sensitiveKeys) {
+    const migrated = [];
+    const skipped = [];
+    const failed = [];
+    let mutated = false;
+    async function tryMigrate(container, key) {
+        const value = container[key];
+        if (typeof value !== "string" || value.length === 0)
+            return;
+        if (isVaultRef(value)) {
+            skipped.push(key);
+            return;
+        }
+        const isSensitive = sensitiveKeys.has(key) || inferSensitiveByHeuristic(key);
+        if (!isSensitive)
+            return;
+        try {
+            await vault.set(key, value, { sensitive: true });
+            container[key] = formatVaultRef(key);
+            migrated.push(key);
+            mutated = true;
+        }
+        catch (err) {
+            failed.push(key);
+            logger.error({ err, key }, "[vault-bootstrap] failed to migrate milady.json secret");
+        }
+    }
+    const env = config.env;
+    if (isPlainRecord(env)) {
+        for (const key of Object.keys(env)) {
+            if (!ENV_VAR_KEY.test(key))
+                continue;
+            await tryMigrate(env, key);
+        }
+        const vars = env.vars;
+        if (isPlainRecord(vars)) {
+            for (const key of Object.keys(vars)) {
+                if (!ENV_VAR_KEY.test(key))
+                    continue;
+                await tryMigrate(vars, key);
+            }
+        }
+    }
+    const plugins = config.plugins;
+    if (isPlainRecord(plugins)) {
+        const entries = plugins.entries;
+        if (isPlainRecord(entries)) {
+            for (const entryValue of Object.values(entries)) {
+                if (!isPlainRecord(entryValue))
+                    continue;
+                const entryConfig = entryValue.config;
+                if (!isPlainRecord(entryConfig))
+                    continue;
+                for (const fieldKey of Object.keys(entryConfig)) {
+                    await tryMigrate(entryConfig, fieldKey);
+                }
+            }
+        }
+    }
+    return { migrated, skipped, failed, mutated };
+}
+async function migrateConfigEnvFile(stateDir, vault, sensitiveKeys) {
+    const migrated = [];
+    const skipped = [];
+    const failed = [];
+    const entries = await readConfigEnv(stateDir);
+    for (const [key, value] of Object.entries(entries)) {
+        if (typeof value !== "string" || value.length === 0)
+            continue;
+        if (isVaultRef(value)) {
+            skipped.push(key);
+            continue;
+        }
+        const isSensitive = sensitiveKeys.has(key) || inferSensitiveByHeuristic(key);
+        if (!isSensitive)
+            continue;
+        try {
+            await vault.set(key, value, { sensitive: true });
+            await persistConfigEnv(key, formatVaultRef(key), { stateDir });
+            migrated.push(key);
+        }
+        catch (err) {
+            failed.push(key);
+            logger.error({ err, key }, "[vault-bootstrap] failed to migrate config.env secret");
+        }
+    }
+    return { migrated, skipped, failed };
+}
+async function mirrorProcessEnvSensitive(vault, sensitiveKeys, seenKeys) {
+    const migrated = [];
+    const failed = [];
+    for (const [key, rawValue] of Object.entries(process.env)) {
+        if (!ENV_VAR_KEY.test(key))
+            continue;
+        if (seenKeys.has(key))
+            continue;
+        if (typeof rawValue !== "string" || rawValue.length === 0)
+            continue;
+        if (isVaultRef(rawValue))
+            continue;
+        const isSensitive = sensitiveKeys.has(key) || inferSensitiveByHeuristic(key);
+        if (!isSensitive)
+            continue;
+        if (await vault.has(key))
+            continue;
+        try {
+            await vault.set(key, rawValue, { sensitive: true });
+            migrated.push(key);
+        }
+        catch (err) {
+            failed.push(key);
+            logger.error({ err, key }, "[vault-bootstrap] failed to mirror process.env secret");
+        }
+    }
+    return { migrated, failed };
+}
+export async function runVaultBootstrap(opts = {}) {
+    const stateDir = opts.stateDir ?? resolveStateDir();
+    const vault = opts.vault ?? sharedVault();
+    const marker = await readMarker(stateDir);
+    const alreadyHydrated = marker && marker.version === MARKER_VERSION
+        ? marker.migratedKeys.length + marker.skippedKeys.length
+        : 0;
+    const sensitiveKeys = sensitiveKeysFromRegistry();
+    const config = loadElizaConfig();
+    const json = await migrateMiladyJson(config, vault, sensitiveKeys);
+    if (json.mutated) {
+        saveElizaConfig(config);
+    }
+    const env = await migrateConfigEnvFile(stateDir, vault, sensitiveKeys);
+    // Skip keys we already attempted (success or fail) so process.env
+    // mirroring doesn't double-count keys that just failed against the json
+    // file or the config.env file.
+    const seen = new Set([
+        ...json.migrated,
+        ...json.failed,
+        ...env.migrated,
+        ...env.failed,
+    ]);
+    const proc = await mirrorProcessEnvSensitive(vault, sensitiveKeys, seen);
+    const migratedKeys = [...json.migrated, ...env.migrated, ...proc.migrated];
+    const skippedKeys = [...json.skipped, ...env.skipped];
+    const failedKeys = [...json.failed, ...env.failed, ...proc.failed];
+    const attempted = migratedKeys.length + failedKeys.length;
+    if (attempted > 0 && migratedKeys.length === 0) {
+        throw new Error(`[vault-bootstrap] all ${failedKeys.length} secret writes failed; vault unreachable`);
+    }
+    await writeMarker(stateDir, {
+        version: MARKER_VERSION,
+        completedAt: new Date().toISOString(),
+        migratedKeys,
+        skippedKeys,
+    });
+    if (migratedKeys.length > 0 || failedKeys.length > 0) {
+        logger.info(`[vault-bootstrap] migrated=${migratedKeys.length} skipped=${skippedKeys.length} failed=${failedKeys.length}`);
+    }
+    else {
+        logger.debug(`[vault-bootstrap] no plaintext secrets found (already-hydrated keys=${alreadyHydrated})`);
+    }
+    return {
+        migrated: migratedKeys.length,
+        alreadyHydrated,
+        failed: failedKeys,
+    };
+}

package/packages/app-core/src/services/vault-mirror.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Write-through mirror to @elizaos/vault for plugin sensitive fields.
+ *
+ * Extracted from plugins-compat-routes.ts so unit tests can exercise the
+ * mirror logic without dragging in the entire @elizaos/agent runtime.
+ *
+ * Concurrency: the vault PUT path is hit concurrently when the UI saves
+ * multiple plugin configs in parallel. `VaultImpl.mutate()` has its own
+ * process and filesystem locks; the process-level manager cache keeps the
+ * plugin-save path and `/api/secrets/manager/*` routes sharing one facade.
+ */
+import { type SecretsManager, type Vault } from "@elizaos/vault";
+export declare function sharedSecretsManager(): SecretsManager;
+export declare function sharedVault(): Vault;
+/**
+ * Test-only: drop the cached vault so the next `sharedVault()` call
+ * re-initializes from the (possibly newly configured) environment.
+ * Also lets tests inject a test vault built via `createTestVault`.
+ */
+export declare function _resetSharedVaultForTesting(next?: Vault | null): void;
+/**
+ * Write-through mirror to @elizaos/vault. Iterates the plugin's
+ * declared parameters, finds sensitive ones, and writes whatever
+ * value the user just submitted into the vault as a sensitive entry.
+ *
+ * Returns the list of keys that failed to write. The PUT handler
+ * surfaces them under `vaultMirrorFailures` in the response so the UI
+ * can warn the user that their secret was saved to legacy config but
+ * not mirrored to the vault. Per-key try/catch keeps one failed key
+ * from aborting the rest of the loop.
+ *
+ * Vault key shape: the env-var name itself (e.g.
+ * `OPENROUTER_API_KEY`). Stable, matches what the legacy code uses,
+ * and lets the read-side hydration round-trip cleanly.
+ */
+export declare function mirrorPluginSensitiveToVault(plugin: {
+    parameters: Array<{
+        key: string;
+        sensitive: boolean;
+    }>;
+}, body: unknown): Promise<{
+    failures: string[];
+}>;
+//# sourceMappingURL=vault-mirror.d.ts.map

package/packages/app-core/src/services/vault-mirror.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-mirror.d.ts","sourceRoot":"","sources":["../../../../../../app-core/src/services/vault-mirror.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAiB,KAAK,cAAc,EAAE,KAAK,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAIhF,wBAAgB,oBAAoB,IAAI,cAAc,CAGrD;AAED,wBAAgB,WAAW,IAAI,KAAK,CAEnC;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,GAAE,KAAK,GAAG,IAAW,GAAG,IAAI,CAE3E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,EAAE;IAAE,UAAU,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,EAClE,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAgCjC"}

package/packages/app-core/src/services/vault-mirror.js

@@ -0,0 +1,80 @@
+/**
+ * Write-through mirror to @elizaos/vault for plugin sensitive fields.
+ *
+ * Extracted from plugins-compat-routes.ts so unit tests can exercise the
+ * mirror logic without dragging in the entire @elizaos/agent runtime.
+ *
+ * Concurrency: the vault PUT path is hit concurrently when the UI saves
+ * multiple plugin configs in parallel. `VaultImpl.mutate()` has its own
+ * process and filesystem locks; the process-level manager cache keeps the
+ * plugin-save path and `/api/secrets/manager/*` routes sharing one facade.
+ */
+import { logger } from "@elizaos/core";
+import { asRecord } from "@elizaos/shared";
+import { createManager } from "@elizaos/vault";
+let cachedManager = null;
+export function sharedSecretsManager() {
+    if (!cachedManager)
+        cachedManager = createManager();
+    return cachedManager;
+}
+export function sharedVault() {
+    return sharedSecretsManager().vault;
+}
+/**
+ * Test-only: drop the cached vault so the next `sharedVault()` call
+ * re-initializes from the (possibly newly configured) environment.
+ * Also lets tests inject a test vault built via `createTestVault`.
+ */
+export function _resetSharedVaultForTesting(next = null) {
+    cachedManager = next ? createManager({ vault: next }) : null;
+}
+/**
+ * Write-through mirror to @elizaos/vault. Iterates the plugin's
+ * declared parameters, finds sensitive ones, and writes whatever
+ * value the user just submitted into the vault as a sensitive entry.
+ *
+ * Returns the list of keys that failed to write. The PUT handler
+ * surfaces them under `vaultMirrorFailures` in the response so the UI
+ * can warn the user that their secret was saved to legacy config but
+ * not mirrored to the vault. Per-key try/catch keeps one failed key
+ * from aborting the rest of the loop.
+ *
+ * Vault key shape: the env-var name itself (e.g.
+ * `OPENROUTER_API_KEY`). Stable, matches what the legacy code uses,
+ * and lets the read-side hydration round-trip cleanly.
+ */
+export async function mirrorPluginSensitiveToVault(plugin, body) {
+    const failures = [];
+    const config = asRecord(body)?.config;
+    const configRecord = asRecord(config);
+    if (!configRecord)
+        return { failures };
+    const sensitiveKeys = plugin.parameters
+        .filter((p) => p.sensitive)
+        .map((p) => p.key);
+    if (sensitiveKeys.length === 0)
+        return { failures };
+    const manager = sharedSecretsManager();
+    for (const key of sensitiveKeys) {
+        const value = configRecord[key];
+        if (typeof value !== "string")
+            continue;
+        try {
+            if (value.length === 0) {
+                await manager.remove(key);
+            }
+            else {
+                await manager.set(key, value, {
+                    sensitive: true,
+                    caller: "plugins-compat",
+                });
+            }
+        }
+        catch (err) {
+            failures.push(key);
+            logger.warn(`[plugins-compat] vault mirror for ${key} failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return { failures };
+}