feat(app-scape): finalize plugin against live 'scape deployment

packages/shared/src/contracts/apps.ts

@@ -252,6 +252,11 @@ export const MILADY_CURATED_APP_DEFINITIONS: readonly MiladyCuratedAppDefinition
       canonicalName: "@elizaos/app-2004scape",
       aliases: [],
     },
+    {
+      slug: "scape",
+      canonicalName: "@elizaos/app-scape",
+      aliases: [],
+    },
     {
       slug: "defense-of-the-agents",
       canonicalName: "@elizaos/app-defense-of-the-agents",

plugins/app-scape/DEPLOYMENT.md

@@ -1,18 +1,48 @@
 # `@elizaos/app-scape` — Deployment Guide
 
-This document covers running the 'scape plugin end-to-end in both dev
-(localhost xRSPS + localhost milady) and production (hosted xRSPS +
-milady runtime somewhere else). For architecture and protocol
-reference, see `README.md` and the upstream xRSPS
-`docs/agent-endpoint.md`.
+This document covers running the 'scape plugin end-to-end. The
+**default configuration** already points at the live production
+deployment of 'scape — no extra setup needed to launch it from the
+milady apps grid. This document covers overriding those defaults
+for local dev or running against your own fork's deployment.
 
-## What you need
+## Default live deployment
 
-1. **xRSPS running somewhere**, with the bot-SDK endpoint enabled:
+When you click **'scape** in the milady apps grid, the viewer
+iframe loads:
+
+    https://scape-client-2sqyc.kinsta.page
+
+That's a React client hosted as a Sevalla static site with its
+WebSocket URL, OSRS cache URL, and map-tile URL all baked in at
+build time. It connects to:
+
+| Component      | URL                                                | Hosted on                        |
+|----------------|----------------------------------------------------|----------------------------------|
+| Game server    | `wss://scape-96cxt.sevalla.app`                   | Sevalla Application (s2 shape)   |
+| OSRS cache     | `https://scape-cache-skrm0.sevalla.storage/caches/` | Sevalla Object Storage (R2 + CDN) |
+| Map tiles      | `https://scape-cache-skrm0.sevalla.storage/map-images/` | Same bucket                   |
+
+**This works out of the box** — open the app, register an
+account on the login screen, play. No env vars required on the
+milady side.
+
+**Caveat — no bot-SDK on production yet.** The autonomous LLM loop
+(the agent that plays for you) requires the xRSPS server's
+bot-SDK endpoint, which the public deployment does NOT currently
+expose. The plugin's `ScapeGameService` will log
+`SCAPE_BOT_SDK_TOKEN not set` and skip the autonomous loop, but
+the viewer iframe still works so you (or anyone else) can log in
+and play manually. To run the autonomous loop, point the plugin
+at a local xRSPS dev stack — see the "Dev loop" section below.
+
+## What you need (dev loop only)
+
+1. **xRSPS running locally**, with the bot-SDK endpoint enabled:
    - `BOT_SDK_TOKEN` set in the environment
    - Port 43595 reachable from wherever the milady runtime runs
-2. **The React client running** (default `http://localhost:3000`),
-   reachable from wherever a human is going to watch the agent play
+2. **The React client running** locally (default
+   `http://localhost:3000`)
 3. **milady runtime** with this plugin installed (it already is if
    you're in this repo — `plugins/app-scape/` is a workspace package)
 
@@ -24,25 +54,41 @@ The plugin reads settings from:
 2. `process.env[KEY]` — via shell or systemd unit
 3. Hardcoded defaults (only for localhost dev)
 
-| Variable                   | Default                         | Purpose                                                                                              |
-|----------------------------|----------------------------------|------------------------------------------------------------------------------------------------------|
-| `SCAPE_CLIENT_URL`         | `http://localhost:3000`          | URL the viewer iframe points at. Change this to your hosted xRSPS client URL in production.        |
-| `SCAPE_BOT_SDK_URL`        | `ws://127.0.0.1:43595`           | WebSocket URL of the xRSPS bot-SDK endpoint. Must be reachable from the milady runtime host.        |
-| `SCAPE_BOT_SDK_TOKEN`      | *(unset → plugin disabled)*      | Must match the xRSPS server's `BOT_SDK_TOKEN`. Without it, ScapeGameService logs a warning and stops. |
-| `SCAPE_AGENT_NAME`         | `scape-agent`                    | In-game display name for the agent. Used as the account username (scrypt-auth).                    |
-| `SCAPE_AGENT_PASSWORD`     | *(unset → plugin disabled)*      | Plaintext password for the agent's account. Auto-registers on first spawn, verified on reconnects. |
-| `SCAPE_AGENT_ID`           | `scape-${SCAPE_AGENT_NAME}`      | Stable identifier for the agent across reconnects. Used as the journal filename.                   |
-| `SCAPE_AGENT_PERSONA`      | *(empty)*                        | Short persona string fed into the LLM's system prompt. Keep it under 200 chars.                    |
-| `SCAPE_LOOP_INTERVAL_MS`   | `15000`                          | How often the autonomous LLM loop fires. Lower = more expensive.                                    |
-| `SCAPE_MODEL_SIZE`         | `TEXT_SMALL`                     | Which elizaOS model tier to use. Try `TEXT_NANO` for cheaper or `TEXT_LARGE` for smarter output.   |
-
-## Dev loop (single host)
-
-Assumes xRSPS and milady are both running on your laptop.
+| Variable                   | Default                                           | Purpose                                                                                              |
+|----------------------------|---------------------------------------------------|------------------------------------------------------------------------------------------------------|
+| `SCAPE_CLIENT_URL`         | `https://scape-client-2sqyc.kinsta.page`         | URL the viewer iframe points at. Defaults to the live 'scape deployment; override to `http://localhost:3000` for local dev. |
+| `SCAPE_BOT_SDK_URL`        | `ws://127.0.0.1:43595`                           | WebSocket URL of the xRSPS bot-SDK endpoint. Local-dev only; no public bot-SDK endpoint yet.         |
+| `SCAPE_BOT_SDK_TOKEN`      | *(unset → autonomous loop disabled)*             | Must match the xRSPS server's `BOT_SDK_TOKEN`. Without it the viewer still works for manual play.   |
+| `SCAPE_AGENT_NAME`         | `scape-agent`                                     | In-game display name for the agent. Used as the account username (scrypt-auth).                    |
+| `SCAPE_AGENT_PASSWORD`     | *(unset → auto-generated + persisted to disk)*   | Plaintext password for the agent's account. Auto-registers on first spawn.                         |
+| `SCAPE_AGENT_ID`           | `scape-${SCAPE_AGENT_NAME}`                       | Stable identifier for the agent across reconnects. Used as the journal filename.                   |
+| `SCAPE_AGENT_PERSONA`      | *(empty)*                                         | Short persona string fed into the LLM's system prompt. Keep it under 200 chars.                    |
+| `SCAPE_LOOP_INTERVAL_MS`   | `15000`                                           | How often the autonomous LLM loop fires. Lower = more expensive.                                    |
+| `SCAPE_MODEL_SIZE`         | `TEXT_SMALL`                                      | Which elizaOS model tier to use. Try `TEXT_MINI` for cheaper, `TEXT_LARGE` for smarter.            |
+
+## Playing against the live deployment (no config)
+
+If you just want to click **'scape** in the milady apps grid and
+land in the game, you don't need to set anything. The plugin
+defaults to the production deployment URL, so the viewer iframe
+will load the hosted client directly. Register an account on
+the login screen (xRSPS scrypts your password and stores it in
+an ephemeral file on the server — note that accounts are wiped
+on every server redeploy until Sevalla-backed Postgres persistence
+lands) and play.
+
+Skip the rest of this section unless you want to run a local
+dev stack.
+
+## Dev loop (single host, autonomous agent)
+
+Assumes xRSPS and milady are both running on your laptop and you
+want to run the autonomous LLM loop against a local xRSPS server
+with a bot-SDK endpoint enabled.
 
 ```bash
 # Terminal 1 — xRSPS
-cd ~/xrsps-typescript
+cd ~/xrsps-typescript   # or ~/scape
 export BOT_SDK_TOKEN=dev-secret
 bun run dev
 ```
@@ -54,6 +100,7 @@ watch all three tabs with `Ctrl-A` + arrow keys.
 ```bash
 # Terminal 2 — milady
 cd ~/milady
+export SCAPE_CLIENT_URL=http://localhost:3000
 export SCAPE_BOT_SDK_TOKEN=dev-secret
 export SCAPE_AGENT_PASSWORD=my-dev-password
 bun run dev  # or however you start milady
@@ -65,10 +112,11 @@ at `~/.milady/scape-journals/scape-scape-agent.toon` (TOON-encoded,
 not JSON).
 
 Click the 'scape tile in the milady apps grid and the viewer iframe
-loads the xRSPS React client at `http://localhost:3000`. Log in with
-any username + an 8+-character password; you're now in the same world
-as the agent and can watch it play. Type `::steer <directive>` in
-public chat to hand it a high-priority goal.
+loads the local xRSPS React client at `http://localhost:3000` (because
+of the `SCAPE_CLIENT_URL` override). Log in with any username + an
+8+-character password; you're now in the same world as the agent and
+can watch it play. Type `::steer <directive>` in public chat to hand
+it a high-priority goal.
 
 ## Production deployment
 

plugins/app-scape/README.md

@@ -8,13 +8,22 @@ server at [xrsps-typescript](https://github.com/xrsps/xrsps-typescript).
 `'scape` turns a running xRSPS instance into an autonomous-agent playground
 for the milady runtime. When you click **'scape** in the apps launcher:
 
-1. The viewer iframe loads the xRSPS React client (default
-   `http://localhost:3000`, override with `SCAPE_CLIENT_URL`) so you can
-   watch what's happening in the game world in real time.
+1. The viewer iframe loads the xRSPS React client — by default the
+   production 'scape deployment at
+   [`https://scape-client-2sqyc.kinsta.page`](https://scape-client-2sqyc.kinsta.page),
+   a React/WebGL build hosted as a Sevalla static site. It's wired at
+   build time to a live game server at `wss://scape-96cxt.sevalla.app`
+   and an OSRS cache + map-tile bucket at
+   `https://scape-cache-skrm0.sevalla.storage`. Override
+   `SCAPE_CLIENT_URL` to point at a local `http://localhost:3000` dev
+   server or your own fork's deployment.
 2. The plugin's `ScapeGameService` connects to xRSPS's **bot-SDK**
    endpoint — a TOON-encoded WebSocket at `ws://127.0.0.1:43595` — and
    spawns a first-class agent-player account using the same scrypt auth
-   + save-file persistence that human logins use.
+   + save-file persistence that human logins use. *(Note: the public
+   Sevalla deployment currently does not expose a bot-SDK endpoint;
+   the autonomous loop only works against a local xRSPS dev stack
+   until the server-side bot-SDK is re-enabled and re-deployed.)*
 3. The milady LLM runtime drives the agent via the action list (walk,
    fight, chat, skill, bank, ...) every N seconds, with optional
    directed prompts from the operator UI.
@@ -45,15 +54,15 @@ the xRSPS server at
 
 ## Env vars
 
-| Variable              | Default                     | Purpose                                          |
-|-----------------------|-----------------------------|--------------------------------------------------|
-| `SCAPE_CLIENT_URL`    | `http://localhost:3000`     | xRSPS client URL the viewer iframe points at.   |
-| `SCAPE_BOT_SDK_URL`   | `ws://127.0.0.1:43595`      | bot-SDK WebSocket endpoint on the xRSPS server. |
-| `SCAPE_BOT_SDK_TOKEN` | *(unset → plugin disabled)* | Shared secret matching xRSPS `BOT_SDK_TOKEN`.   |
-| `SCAPE_AGENT_NAME`    | `scape-agent`               | In-game display name for the agent.              |
-| `SCAPE_AGENT_PASSWORD`| *(unset → plugin disabled)* | Plaintext password for the agent's account.     |
-| `SCAPE_LOOP_INTERVAL_MS` | `15000`                  | Autonomous LLM step interval.                    |
-| `SCAPE_MODEL_SIZE`    | `TEXT_SMALL`                | milady model tier for the loop.                  |
+| Variable              | Default                                         | Purpose                                          |
+|-----------------------|-------------------------------------------------|--------------------------------------------------|
+| `SCAPE_CLIENT_URL`    | `https://scape-client-2sqyc.kinsta.page`        | xRSPS client URL the viewer iframe points at. Set to `http://localhost:3000` for local dev. |
+| `SCAPE_BOT_SDK_URL`   | `ws://127.0.0.1:43595`                          | bot-SDK WebSocket endpoint on the xRSPS server. Local-dev only; public deployment does not expose a bot-SDK yet. |
+| `SCAPE_BOT_SDK_TOKEN` | *(unset → autonomous loop disabled)*            | Shared secret matching xRSPS `BOT_SDK_TOKEN`.   |
+| `SCAPE_AGENT_NAME`    | `scape-agent`                                   | In-game display name for the agent.              |
+| `SCAPE_AGENT_PASSWORD`| *(unset → auto-generated + persisted to disk)*  | Plaintext password for the agent's account.    |
+| `SCAPE_LOOP_INTERVAL_MS` | `15000`                                      | Autonomous LLM step interval.                    |
+| `SCAPE_MODEL_SIZE`    | `TEXT_SMALL`                                    | milady model tier for the loop.                  |
 
 ## Scope by PR
 

plugins/app-scape/elizaos.plugin.json

@@ -4,7 +4,7 @@
     "displayName": "'scape",
     "category": "game",
     "launchType": "connect",
-    "launchUrl": "http://localhost:3000",
+    "launchUrl": "https://scape-client-2sqyc.kinsta.page",
     "capabilities": ["autonomous", "game", "journal", "operator-steering"],
     "runtimePlugin": "@elizaos/app-scape",
     "viewer": {

plugins/app-scape/package.json

@@ -20,7 +20,7 @@
   "dependencies": {
     "@elizaos/core": "workspace:*",
     "@miladyai/shared": "workspace:*",
-    "@toon-format/toon": "^2.1.0"
+    "@toon-format/toon": "2.1.0"
   },
   "agentConfig": {
     "pluginParameters": {
@@ -32,8 +32,8 @@
       },
       "SCAPE_AGENT_PASSWORD": {
         "type": "string",
-        "description": "Password for the agent's xRSPS account. Auto-registers on the first spawn, verified via scrypt on every reconnect. Treat like any other account password.",
-        "required": true,
+        "description": "Password for the agent's xRSPS account. Leave blank to auto-generate a 24-char random password on first launch (persisted to ~/.milady/scape-agent-identity.json and reused on every subsequent run). Only set this if you want to pin a specific existing account — and note that whatever value you set will be written to the identity file in plaintext, so do not reuse a production password.",
+        "required": false,
         "sensitive": true
       },
       "SCAPE_BOT_SDK_URL": {
@@ -45,10 +45,10 @@
       },
       "SCAPE_CLIENT_URL": {
         "type": "string",
-        "description": "URL the /viewer iframe loads — the xRSPS React client. Default is the local craco dev server; override for a deployed build.",
+        "description": "URL the /viewer iframe loads — the xRSPS React client. Defaults to the production 'scape deployment at https://scape-client-2sqyc.kinsta.page (React client with WS URL, OSRS cache URL, and map tiles all baked in at build time, pointing at the deployed game server). Override to http://localhost:3000 for local dev against the craco server.",
         "required": false,
         "sensitive": false,
-        "default": "http://localhost:3000"
+        "default": "https://scape-client-2sqyc.kinsta.page"
       },
       "SCAPE_AGENT_NAME": {
         "type": "string",
@@ -82,7 +82,7 @@
         "required": false,
         "sensitive": false,
         "default": "TEXT_SMALL",
-        "options": ["TEXT_NANO", "TEXT_SMALL", "TEXT_MEDIUM", "TEXT_LARGE", "TEXT_MEGA"]
+        "options": ["TEXT_NANO", "TEXT_MINI", "TEXT_SMALL", "TEXT_LARGE"]
       }
     }
   },
@@ -92,7 +92,7 @@
       "displayName": "'scape",
       "category": "game",
       "launchType": "connect",
-      "launchUrl": "http://localhost:3000",
+      "launchUrl": "https://scape-client-2sqyc.kinsta.page",
       "capabilities": [
         "autonomous",
         "game",

plugins/app-scape/scripts/verify-pr2.ts

@@ -148,9 +148,9 @@ async function main(): Promise<void> {
         /\bframe-ancestors\b/i.test(res.getHeader("Content-Security-Policy") ?? ""),
     );
     assertTrue(
-        "body contains iframe pointing at localhost:3000",
+        "body contains iframe pointing at default deployed 'scape client",
         res.body.includes('id="scape-frame"') &&
-            res.body.includes("http://localhost:3000"),
+            res.body.includes("https://scape-client-2sqyc.kinsta.page"),
     );
     assertTrue(
         "body contains fallback block",

plugins/app-scape/scripts/verify-pr8-settings.ts

@@ -142,8 +142,8 @@ function main(): void {
     );
     const clientParam = scape.parameters.find((p) => p.key === "SCAPE_CLIENT_URL");
     assertTrue(
-        `SCAPE_CLIENT_URL default = "http://localhost:3000" (got "${clientParam?.default}")`,
-        clientParam?.default === "http://localhost:3000",
+        `SCAPE_CLIENT_URL default = "https://scape-client-2sqyc.kinsta.page" (got "${clientParam?.default}")`,
+        clientParam?.default === "https://scape-client-2sqyc.kinsta.page",
     );
     const loopParam = scape.parameters.find((p) => p.key === "SCAPE_LOOP_INTERVAL_MS");
     assertTrue(