@exagent/agent 0.3.5 → 0.3.6

package/src/llm-providers.ts

@@ -1,100 +1,8 @@
-/**
- * LLM provider and model registry.
- * Keep in sync with apps/web/src/lib/llm-providers.ts.
- */
-
-export interface LlmModel {
-  id: string;
-  label: string;
-}
-
-export interface LlmProvider {
-  id: string;
-  label: string;
-  models: LlmModel[];
-}
-
-export const LLM_PROVIDERS: LlmProvider[] = [
-  {
-    id: 'openai',
-    label: 'OpenAI',
-    models: [
-      { id: 'gpt-5.2', label: 'GPT-5.2' },
-      { id: 'gpt-5.2-pro', label: 'GPT-5.2 Pro' },
-      { id: 'gpt-5-mini', label: 'GPT-5 Mini' },
-      { id: 'gpt-5-nano', label: 'GPT-5 Nano' },
-      { id: 'gpt-4o', label: 'GPT-4o' },
-      { id: 'gpt-4o-mini', label: 'GPT-4o Mini' },
-    ],
-  },
-  {
-    id: 'anthropic',
-    label: 'Anthropic',
-    models: [
-      { id: 'claude-opus-4-6', label: 'Claude Opus 4.6' },
-      { id: 'claude-sonnet-4-6', label: 'Claude Sonnet 4.6' },
-      { id: 'claude-haiku-4-5', label: 'Claude Haiku 4.5' },
-    ],
-  },
-  {
-    id: 'google',
-    label: 'Google',
-    models: [
-      { id: 'gemini-3-pro', label: 'Gemini 3 Pro' },
-      { id: 'gemini-3-flash', label: 'Gemini 3 Flash' },
-      { id: 'gemini-2.5-pro', label: 'Gemini 2.5 Pro' },
-      { id: 'gemini-2.5-flash', label: 'Gemini 2.5 Flash' },
-      { id: 'gemini-2.5-flash-lite', label: 'Gemini 2.5 Flash Lite' },
-    ],
-  },
-  {
-    id: 'deepseek',
-    label: 'DeepSeek',
-    models: [
-      { id: 'deepseek-chat', label: 'DeepSeek Chat' },
-      { id: 'deepseek-reasoner', label: 'DeepSeek Reasoner' },
-    ],
-  },
-  {
-    id: 'mistral',
-    label: 'Mistral',
-    models: [
-      { id: 'mistral-large-latest', label: 'Mistral Large' },
-      { id: 'mistral-small-latest', label: 'Mistral Small' },
-    ],
-  },
-  {
-    id: 'groq',
-    label: 'Groq',
-    models: [
-      { id: 'llama-3.3-70b-versatile', label: 'Llama 3.3 70B' },
-      { id: 'llama-3.1-8b-instant', label: 'Llama 3.1 8B' },
-      { id: 'mixtral-8x7b-32768', label: 'Mixtral 8x7B' },
-    ],
-  },
-  {
-    id: 'together',
-    label: 'Together',
-    models: [
-      { id: 'meta-llama/Meta-Llama-3.1-70B-Instruct-Turbo', label: 'Llama 3.1 70B' },
-      { id: 'meta-llama/Meta-Llama-3.1-8B-Instruct-Turbo', label: 'Llama 3.1 8B' },
-    ],
-  },
-  {
-    id: 'ollama',
-    label: 'Ollama (local)',
-    models: [
-      { id: 'llama3.1', label: 'Llama 3.1' },
-      { id: 'mistral', label: 'Mistral' },
-      { id: 'custom', label: 'Custom (type model name)' },
-    ],
-  },
-];
-
-export function getProvider(id: string): LlmProvider | undefined {
-  return LLM_PROVIDERS.find((p) => p.id === id);
-}
-
-export function getProviderIds(): string[] {
-  return LLM_PROVIDERS.map((p) => p.id);
-}
+export {
+  LLM_PROVIDERS,
+  getDefaultModel,
+  getProvider,
+  getProviderIds,
+  providerRequiresApiKey,
+} from '@exagent/sdk';
+export type { LlmModel, LlmProvider } from '@exagent/sdk';

package/src/prediction/client.ts

@@ -9,7 +9,9 @@
  */
 
 import { ClobClient, Side } from '@polymarket/clob-client';
-import { Wallet } from 'ethers';
+import { createWalletClient, http, type WalletClient } from 'viem';
+import { privateKeyToAccount } from 'viem/accounts';
+import { polygon } from 'viem/chains';
 import type {
   PredictionConfig,
   PredictionMarket,
@@ -32,7 +34,7 @@ export class PolymarketClient {
   private readonly config: PredictionConfig;
   private clobClient: ClobClient | null = null;
   private apiCreds: ApiKeyCreds | null = null;
-  private readonly signer: Wallet;
+  private readonly signer: WalletClient;
   private readonly walletAddress: string;
 
   private marketCache: Map<string, { market: PredictionMarket; cachedAt: number }> = new Map();
@@ -40,8 +42,13 @@ export class PolymarketClient {
 
   constructor(privateKey: string, config?: Partial<PredictionConfig>) {
     this.config = { ...DEFAULT_PREDICTION_CONFIG, ...config } as PredictionConfig;
-    this.signer = new Wallet(privateKey);
-    this.walletAddress = this.signer.address;
+    const account = privateKeyToAccount(privateKey as `0x${string}`);
+    this.signer = createWalletClient({
+      account,
+      chain: polygon,
+      transport: http(),
+    });
+    this.walletAddress = account.address;
   }
 
   // ── INITIALIZATION ─────────────────────────────────────────

package/src/runtime.ts

@@ -52,7 +52,7 @@ import type { BridgeConfig } from './bridge/types.js';
 
 import { createRequire } from 'module';
 const _require = createRequire(import.meta.url);
-let SDK_VERSION = '0.3.0';
+let SDK_VERSION = '0.3.5';
 try { SDK_VERSION = _require('../package.json').version; } catch {}
 
 /** Number of consecutive cycle failures before switching to idle */
@@ -427,7 +427,7 @@ export class AgentRuntime {
         : 'Strategy description: follow the owner-configured strategy exactly and do not improvise outside it.',
       `Allowed venues: ${venues}.`,
       'Stay inside the owner-configured scope. If the setup is unclear or the trade does not fit, return no trades.',
-      'Return ONLY a JSON array of trade signals.',
+      'Return ONLY a JSON array of trade intents.',
     ].filter((line): line is string => Boolean(line)).join('\n');
   }
 
@@ -446,7 +446,7 @@ export class AgentRuntime {
     }
 
     if (typeof rawStrategy.code === 'string' && rawStrategy.code.trim()) {
-      return { code: rawStrategy.code, venues };
+      throw new Error('Raw JavaScript strategy code is disabled. Use a prompt-backed strategy or template instead.');
     }
 
     if (typeof rawStrategy.systemPrompt === 'string' && rawStrategy.systemPrompt.trim()) {

package/src/setup.ts

@@ -146,11 +146,11 @@ async function setupWallet(config: RuntimeConfigFile): Promise<string> {
 // Step 3: LLM
 // ---------------------------------------------------------------------------
 
-import { LLM_PROVIDERS, getProvider } from './llm-providers.js';
+import { LLM_PROVIDERS, getDefaultModel, getProvider, providerRequiresApiKey } from './llm-providers.js';
 
 async function setupLlm(
   config: RuntimeConfigFile,
-): Promise<{ provider: string; model: string; apiKey: string }> {
+): Promise<{ provider: string; model: string; apiKey?: string }> {
   // LLM config is always entered locally — never pulled from bootstrap.
   // Config file may have provider/model as defaults from the deploy wizard.
 
@@ -161,7 +161,9 @@ async function setupLlm(
     const apiKey = process.env.EXAGENT_LLM_KEY;
     if (!provider) throw new Error('EXAGENT_LLM_PROVIDER required in non-interactive mode');
     if (!model) throw new Error('EXAGENT_LLM_MODEL required in non-interactive mode');
-    if (!apiKey) throw new Error('EXAGENT_LLM_KEY required in non-interactive mode');
+    if (providerRequiresApiKey(provider) && !apiKey) {
+      throw new Error('EXAGENT_LLM_KEY required in non-interactive mode');
+    }
     printDone('LLM configured');
     return { provider, model, apiKey };
   }
@@ -182,7 +184,7 @@ async function setupLlm(
   const providerInfo = getProvider(provider);
   const modelOptions = providerInfo
     ? providerInfo.models.map(m => ({ value: m.id, label: m.label }))
-    : [{ value: defaultModel || 'gpt-4o', label: defaultModel || 'gpt-4o' }];
+    : [{ value: defaultModel || getDefaultModel('openai'), label: defaultModel || getDefaultModel('openai') }];
   const selectedModel = await clack.select({
     message: 'LLM model:',
     options: modelOptions,
@@ -191,12 +193,18 @@ async function setupLlm(
   if (clack.isCancel(selectedModel)) cancelled();
   const model = selectedModel;
 
-  // API Key — always prompt, never from bootstrap
-  const apiKey = await clack.password({
-    message: 'LLM API key:',
-    validate: (val) => validateLlmKeyFormat(provider, val),
-  });
-  if (clack.isCancel(apiKey)) cancelled();
+  let apiKey: string | undefined;
+  if (providerRequiresApiKey(provider)) {
+    // API Key — always prompt, never from bootstrap
+    const enteredApiKey = await clack.password({
+      message: 'LLM API key:',
+      validate: (val) => validateLlmKeyFormat(provider, val),
+    });
+    if (clack.isCancel(enteredApiKey)) cancelled();
+    apiKey = enteredApiKey;
+  } else {
+    printInfo('Ollama uses your local server; no API key needed.');
+  }
 
   printDone('LLM configured');
   return { provider, model, apiKey };

package/src/strategy/loader.ts

@@ -1,27 +1,36 @@
-import { existsSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { existsSync, readFileSync } from 'node:fs';
+import { extname, resolve } from 'node:path';
 import { z } from 'zod';
 import type { StrategyFunction, StrategyContext, TradeSignal } from '@exagent/sdk';
 import { getTemplate } from './templates.js';
 import { scrubSecrets } from '../scrub-secrets.js';
 
+const MAX_PROMPT_SIGNALS = 10;
+const SUPPORTED_FILE_EXPORTS = new Set(['name', 'description', 'category', 'venues', 'systemPrompt', 'template']);
+
 const promptSignalSchema = z.object({
-  symbol: z.string().min(1),
+  symbol: z.string().min(1).max(80),
   side: z.enum(['buy', 'sell', 'long', 'short']),
   confidence: z.number().min(0).max(1).optional(),
-  reasoning: z.string().optional(),
-  venue: z.string().optional(),
-  chain: z.string().optional(),
+  reasoning: z.string().max(1000).optional(),
+  venue: z.string().min(1).max(80).optional(),
+  chain: z.string().min(1).max(80).optional(),
   size: z.number().positive().optional(),
   price: z.number().positive().optional(),
-  fee: z.number().min(0).optional(),
-  venueFillId: z.string().optional(),
-  venueTimestamp: z.string().optional(),
-  leverage: z.number().positive().optional(),
-  orderType: z.string().optional(),
-});
+  leverage: z.number().positive().max(100).optional(),
+  orderType: z.enum(['market', 'limit', 'yes', 'no']).optional(),
+}).strict();
+
+const promptSignalArraySchema = z.array(promptSignalSchema).max(MAX_PROMPT_SIGNALS);
 
-const promptSignalArraySchema = z.array(promptSignalSchema);
+const strategyMetadataSchema = z.object({
+  name: z.string().min(1).max(120).optional(),
+  description: z.string().max(1000).optional(),
+  category: z.string().max(80).optional(),
+  venues: z.array(z.string().min(1).max(80)).max(20).optional(),
+  systemPrompt: z.string().min(1).max(12000).optional(),
+  template: z.string().min(1).max(80).optional(),
+}).strict();
 
 export async function loadStrategy(config: {
   file?: string;
@@ -33,12 +42,12 @@ export async function loadStrategy(config: {
     venues?: string[];
   };
 }): Promise<StrategyFunction> {
-  if (config.file) {
-    return loadFromFile(config.file);
+  if (config.code?.trim()) {
+    throw new Error('Raw JavaScript strategy code is disabled. Use a template or prompt-backed strategy instead.');
   }
 
-  if (config.code) {
-    return loadFromCode(config.code);
+  if (config.file) {
+    return loadFromFile(config.file);
   }
 
   if (config.prompt) {
@@ -50,7 +59,14 @@ export async function loadStrategy(config: {
     if (!template) {
       throw new Error(`Unknown strategy template: ${config.template}. Available: momentum, value, arbitrage, hold`);
     }
-    return loadFromCode(template.code);
+    if (!template.systemPrompt.trim()) {
+      return holdStrategy;
+    }
+    return loadFromPrompt({
+      name: template.name,
+      systemPrompt: template.systemPrompt,
+      venues: template.venues,
+    });
   }
 
   // Default: hold strategy (no trades)
@@ -64,51 +80,40 @@ async function loadFromFile(filePath: string): Promise<StrategyFunction> {
   }
 
   try {
-    const mod = await import(resolved);
-    const fn = mod.default || mod.strategy;
+    const source = readFileSync(resolved, 'utf8');
+    const metadata = extname(resolved) === '.json'
+      ? strategyMetadataSchema.parse(JSON.parse(source))
+      : parseStrategyMetadataModule(source, resolved);
 
-    if (typeof fn !== 'function') {
-      if (typeof mod.code === 'string' && mod.code.trim()) {
-        return loadFromCode(mod.code);
-      }
+    if (metadata.systemPrompt?.trim()) {
+      return loadFromPrompt({
+        name: metadata.name,
+        systemPrompt: metadata.systemPrompt,
+        venues: metadata.venues,
+      });
+    }
 
-      if (typeof mod.systemPrompt === 'string' && mod.systemPrompt.trim()) {
-        const venues = Array.isArray(mod.venues)
-          ? mod.venues.filter((venue: unknown): venue is string => typeof venue === 'string')
-          : undefined;
-        const name = typeof mod.name === 'string' ? mod.name : undefined;
-        return loadFromPrompt({
-          name,
-          systemPrompt: mod.systemPrompt,
-          venues,
-        });
+    if (metadata.template?.trim()) {
+      const template = getTemplate(metadata.template);
+      if (!template) {
+        throw new Error(`Unknown strategy template: ${metadata.template}. Available: momentum, value, arbitrage, hold`);
       }
-
-      if (typeof mod.template === 'string' && mod.template.trim()) {
-        const template = getTemplate(mod.template);
-        if (!template) {
-          throw new Error(`Unknown strategy template: ${mod.template}. Available: momentum, value, arbitrage, hold`);
-        }
-        return loadFromCode(template.code);
+      if (!template.systemPrompt.trim()) {
+        return holdStrategy;
       }
-
-      throw new Error(`Strategy file must export a default function, 'strategy' function, 'code' string, 'systemPrompt' string, or 'template' string`);
+      return loadFromPrompt({
+        name: template.name,
+        systemPrompt: template.systemPrompt,
+        venues: metadata.venues?.length ? metadata.venues : template.venues,
+      });
     }
 
-    return fn as StrategyFunction;
+    throw new Error('Strategy file must define a systemPrompt or template. Executable strategy files are disabled.');
   } catch (err) {
     throw new Error(`Failed to load strategy from ${resolved}: ${(err as Error).message}`);
   }
 }
 
-async function loadFromCode(code: string): Promise<StrategyFunction> {
-  // Templates return a factory function as a string
-  // We wrap it in a module and evaluate
-  const AsyncFunction = Object.getPrototypeOf(async function () {}).constructor;
-  const fn = new AsyncFunction('context', code) as StrategyFunction;
-  return fn;
-}
-
 function loadFromPrompt(config: {
   name?: string;
   systemPrompt: string;
@@ -124,17 +129,18 @@ function loadFromPrompt(config: {
       chain: position.chain,
     }));
 
+    const allowedVenues = config.venues?.filter(Boolean) ?? [];
     const response = await context.llm.chat([
       { role: 'system', content: config.systemPrompt },
       {
         role: 'user',
         content: [
           `Strategy: ${config.name || 'Prompt Strategy'}`,
-          `Allowed venues: ${(config.venues || []).join(', ') || 'any'}`,
+          `Allowed venues: ${allowedVenues.join(', ') || 'none configured'}`,
           `Current prices: ${JSON.stringify(prices)}`,
           `Open positions: ${JSON.stringify(positions)}`,
           `Risk config: ${JSON.stringify(context.config)}`,
-          'Return ONLY a JSON array of trade signals.',
+          'Return ONLY a JSON array of trade intents. Do not include executable code. Do not invent fill IDs.',
         ].join('\n'),
       },
     ]);
@@ -142,16 +148,26 @@ function loadFromPrompt(config: {
     // Defense-in-depth: scrub any secrets the LLM might echo back before parsing
     const scrubbedContent = scrubSecrets(response.content);
 
-    const match = scrubbedContent.match(/\[[\s\S]*\]/);
-    if (!match) {
+    const jsonPayload = extractJsonArray(scrubbedContent);
+    if (!jsonPayload) {
       context.log('Prompt strategy returned a non-JSON response; no signals emitted.');
       return [];
     }
 
     try {
-      const parsed = promptSignalArraySchema.parse(JSON.parse(match[0]));
+      const parsed = promptSignalArraySchema.parse(JSON.parse(jsonPayload));
       const signals: TradeSignal[] = [];
       for (const signal of parsed) {
+        const venue = signal.venue || allowedVenues[0];
+        if (!venue) {
+          context.log(`Prompt strategy skipped ${signal.symbol}: no allowed venue configured.`);
+          continue;
+        }
+        if (allowedVenues.length > 0 && !allowedVenues.includes(venue)) {
+          context.log(`Prompt strategy skipped ${signal.symbol}: venue ${venue} is not allowed.`);
+          continue;
+        }
+
         const price = signal.price ?? prices[signal.symbol.toUpperCase()];
         if (!price || price <= 0) {
           context.log(`Prompt strategy skipped ${signal.symbol}: no usable price in response or market cache.`);
@@ -163,13 +179,13 @@ function loadFromPrompt(config: {
           side: signal.side,
           confidence: signal.confidence ?? 0.5,
           reasoning: signal.reasoning,
-          venue: signal.venue || config.venues?.[0] || 'manual',
+          venue,
           chain: signal.chain,
-          size: signal.size ?? 1,
+          size: signal.size ?? 0,
           price,
-          fee: signal.fee ?? 0,
-          venueFillId: signal.venueFillId ?? '',
-          venueTimestamp: signal.venueTimestamp ?? new Date().toISOString(),
+          fee: 0,
+          venueFillId: '',
+          venueTimestamp: '',
           leverage: signal.leverage,
           orderType: signal.orderType,
         });
@@ -182,6 +198,64 @@ function loadFromPrompt(config: {
   };
 }
 
+function extractJsonArray(content: string): string | null {
+  const trimmed = content.trim();
+  if (trimmed.startsWith('[') && trimmed.endsWith(']')) {
+    return trimmed;
+  }
+
+  const start = trimmed.indexOf('[');
+  const end = trimmed.lastIndexOf(']');
+  if (start === -1 || end === -1 || end <= start) {
+    return null;
+  }
+  return trimmed.slice(start, end + 1);
+}
+
+function parseStrategyMetadataModule(source: string, filePath: string): z.infer<typeof strategyMetadataSchema> {
+  const values: Record<string, unknown> = {};
+  let statement = '';
+
+  for (const rawLine of source.replace(/\r\n/g, '\n').split('\n')) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith('//')) {
+      continue;
+    }
+
+    statement = statement ? `${statement}\n${rawLine}` : rawLine;
+    if (!line.endsWith(';')) {
+      continue;
+    }
+
+    const match = statement.match(/^\s*export\s+const\s+([A-Za-z_$][\w$]*)\s*=\s*([\s\S]*);\s*$/);
+    if (!match) {
+      throw new Error(`Unsupported statement in ${filePath}. Strategy files may only export JSON constants.`);
+    }
+
+    const [, name, rawValue] = match;
+    if (name === 'code') {
+      throw new Error('Raw JavaScript strategy code is disabled. Replace code with systemPrompt.');
+    }
+    if (!SUPPORTED_FILE_EXPORTS.has(name)) {
+      throw new Error(`Unsupported strategy export "${name}".`);
+    }
+
+    try {
+      values[name] = JSON.parse(rawValue.trim());
+    } catch {
+      throw new Error(`Strategy export "${name}" must be a JSON literal.`);
+    }
+
+    statement = '';
+  }
+
+  if (statement.trim()) {
+    throw new Error(`Unterminated export in ${filePath}.`);
+  }
+
+  return strategyMetadataSchema.parse(values);
+}
+
 const holdStrategy: StrategyFunction = async (_context: StrategyContext): Promise<TradeSignal[]> => {
   return []; // No trades — hold position
 };

package/src/strategy/templates.ts

@@ -18,23 +18,6 @@ Rules:
 - Consider volume as confirmation of momentum
 
 Return a JSON array of trade signals.`,
-    code: `
-const prices = context.market.getPrices();
-const positions = context.position.openPositions;
-
-const messages = [
-  { role: 'system', content: 'You are a momentum trading agent. Analyze market data and return trade signals as a JSON array. Each signal: { symbol, side: "buy"|"sell", confidence: 0-1, reasoning }. Return [] if no opportunities.' },
-  { role: 'user', content: 'Current prices: ' + JSON.stringify(prices) + '\\nOpen positions: ' + JSON.stringify(positions.map(p => p.token)) + '\\nAnalyze for momentum opportunities.' }
-];
-
-const response = await context.llm.chat(messages);
-try {
-  const signals = JSON.parse(response.content);
-  return Array.isArray(signals) ? signals : [];
-} catch {
-  return [];
-}
-`,
   },
   {
     id: 'value',
@@ -53,23 +36,6 @@ Rules:
 - Diversify across sectors
 
 Return a JSON array of trade signals.`,
-    code: `
-const prices = context.market.getPrices();
-const positions = context.position.openPositions;
-
-const messages = [
-  { role: 'system', content: 'You are a value investing agent. Identify undervalued tokens. Return trade signals as JSON array: { symbol, side: "buy"|"sell", confidence: 0-1, reasoning }. Return [] if nothing is compelling.' },
-  { role: 'user', content: 'Current prices: ' + JSON.stringify(prices) + '\\nPositions: ' + JSON.stringify(positions.map(p => ({ token: p.token, entry: p.costBasisPerUnit }))) + '\\nLook for value opportunities.' }
-];
-
-const response = await context.llm.chat(messages);
-try {
-  const signals = JSON.parse(response.content);
-  return Array.isArray(signals) ? signals : [];
-} catch {
-  return [];
-}
-`,
   },
   {
     id: 'arbitrage',
@@ -87,22 +53,6 @@ Rules:
 - Monitor cross-chain opportunities (CEX vs DEX spreads)
 
 Return a JSON array of trade signals.`,
-    code: `
-const prices = context.market.getPrices();
-
-const messages = [
-  { role: 'system', content: 'You are an arbitrage agent. Find price discrepancies. Return trade signals as JSON array: { symbol, side: "buy"|"sell", venue, confidence: 0-1, reasoning }. Return [] if no arb opportunities.' },
-  { role: 'user', content: 'Market prices: ' + JSON.stringify(prices) + '\\nScan for cross-venue arbitrage opportunities.' }
-];
-
-const response = await context.llm.chat(messages);
-try {
-  const signals = JSON.parse(response.content);
-  return Array.isArray(signals) ? signals : [];
-} catch {
-  return [];
-}
-`,
   },
   {
     id: 'hold',
@@ -112,7 +62,6 @@ try {
     venues: [],
     riskLevel: 'conservative',
     systemPrompt: '',
-    code: `return [];`,
   },
 ];