@elizaos/agent 0.25.9 → 2.0.0-alpha.151

package/packages/agent/src/runtime/plugin-role-gating.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Plugin role gating — restricts plugin actions and providers to specific roles.
+ *
+ * After plugins are registered, this module wraps the `validate` function
+ * of every action belonging to gated plugins so only users with the
+ * required role (e.g. ADMIN/OWNER) can invoke them. Providers that expose
+ * sensitive context are similarly gated so their `get()` returns empty
+ * content for callers below the required role.
+ *
+ * Two maps control the gating:
+ *
+ * 1. `ROLE_GATED_PLUGINS` — sets a **floor** for every action in a plugin.
+ * 2. `ACTION_ROLE_OVERRIDES` — raises individual actions **above** that floor.
+ *
+ * The effective gate for an action is `max(plugin floor, action override)`.
+ *
+ * @module plugin-role-gating
+ */
+import type { Plugin } from "@elizaos/core";
+type RoleGate = "user" | "admin" | "owner";
+declare const ROLE_GATED_PLUGINS: Readonly<Record<string, RoleGate>>;
+declare const ACTION_ROLE_OVERRIDES: Readonly<Record<string, RoleGate>>;
+declare const PROVIDER_ROLE_OVERRIDES: Readonly<Record<string, RoleGate>>;
+/**
+ * Apply role gating to all registered plugins. Call after runtime.initialize().
+ *
+ * For each plugin:
+ * 1. Actions get gated to `max(plugin floor, action override)`.
+ * 2. Providers in PROVIDER_ROLE_OVERRIDES get gated.
+ */
+export declare function applyPluginRoleGating(plugins: Plugin[]): void;
+/** Exported for testing. */
+export { ACTION_ROLE_OVERRIDES, PROVIDER_ROLE_OVERRIDES, ROLE_GATED_PLUGINS };
+//# sourceMappingURL=plugin-role-gating.d.ts.map

package/packages/agent/src/runtime/plugin-role-gating.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-role-gating.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/plugin-role-gating.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAIV,MAAM,EAIP,MAAM,eAAe,CAAC;AAGvB,KAAK,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAY3C,QAAA,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAwC1D,CAAC;AAOF,QAAA,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAyD7D,CAAC;AAOF,QAAA,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAyB/D,CAAC;AA4FF;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CA+C7D;AAED,4BAA4B;AAC5B,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,CAAC"}

package/packages/agent/src/runtime/plugin-role-gating.js

@@ -0,0 +1,232 @@
+import { logger } from "@elizaos/core";
+const ROLE_GATE_RANK = {
+    user: 1,
+    admin: 2,
+    owner: 3,
+};
+// ---------------------------------------------------------------------------
+// Plugin-level defaults — every action in the plugin gets at least this role.
+// ---------------------------------------------------------------------------
+const ROLE_GATED_PLUGINS = {
+    // Blockchain — financial actions
+    "@elizaos/plugin-evm": "admin",
+    "@elizaos/plugin-solana": "admin",
+    // Orchestration — spawns agents, PTY sessions, workspaces
+    "agent-orchestrator": "admin",
+    // Secrets — sets env vars, manages encrypted secrets
+    "@elizaos/plugin-secrets-manager": "owner",
+    // Plugin installs / registry — matches plugin `name` from plugin-plugin-manager
+    "plugin-manager": "owner",
+    // Trust — policy / trust signals (matches plugin `name` from plugin-trust)
+    trust: "admin",
+    // Shell — arbitrary command execution
+    shell: "owner",
+    // Cron — scheduled job management
+    cron: "admin",
+    // Cloud — provisioning, billing, agent lifecycle
+    elizaOSCloud: "admin",
+    // Clipboard — floor is "user" for reads; writes elevated below
+    clipboard: "user",
+    // Experience — records agent learnings
+    experience: "admin",
+    // Form — form state management
+    form: "admin",
+    // Discord — the plugin floor is "user"; destructive actions elevated below
+    discord: "user",
+    // Music player — playback is user, management is elevated below
+    "music-player": "user",
+};
+// ---------------------------------------------------------------------------
+// Per-action overrides — raise individual actions above the plugin floor.
+// Keys are exact action `name` strings from the plugin source.
+// ---------------------------------------------------------------------------
+const ACTION_ROLE_OVERRIDES = {
+    // --- agent-orchestrator: escalate dangerous actions to owner ---
+    SPAWN_AGENT: "owner",
+    SEND_TO_AGENT: "owner",
+    STOP_AGENT: "owner",
+    TASK_CONTROL: "owner",
+    PROVISION_WORKSPACE: "owner",
+    MANAGE_ISSUES: "owner",
+    CREATE_TASK: "owner",
+    // --- orchestrator coding-agent actions ---
+    SPAWN_CODING_AGENT: "owner",
+    SEND_TO_CODING_AGENT: "owner",
+    STOP_CODING_AGENT: "owner",
+    START_CODING_TASK: "owner",
+    // PROVISION_WORKSPACE / MANAGE_ISSUES already covered above
+    // --- plugin-cron: create/delete/update are owner, list/run are admin ---
+    CREATE_CRON: "owner",
+    DELETE_CRON: "owner",
+    UPDATE_CRON: "owner",
+    // --- plugin-elizacloud: provisioning/billing are owner ---
+    PROVISION_CLOUD_AGENT: "owner",
+    FREEZE_CLOUD_AGENT: "owner",
+    RESUME_CLOUD_AGENT: "owner",
+    // --- plugin-discord: destructive/moderative actions ---
+    DELETE_MESSAGE: "admin",
+    EDIT_MESSAGE: "admin",
+    PIN_MESSAGE: "admin",
+    UNPIN_MESSAGE: "admin",
+    SETUP_CREDENTIALS: "owner",
+    CREATE_POLL: "admin",
+    SEND_MESSAGE: "admin",
+    SEND_DM: "admin",
+    JOIN_CHANNEL: "admin",
+    LEAVE_CHANNEL: "admin",
+    LIST_CHANNELS: "admin",
+    READ_CHANNEL: "admin",
+    SEARCH_MESSAGES: "admin",
+    GET_USER_INFO: "admin",
+    SERVER_INFO: "admin",
+    DOWNLOAD_MEDIA: "admin",
+    TRANSCRIBE_MEDIA: "admin",
+    CHAT_WITH_ATTACHMENTS: "admin",
+    SUMMARIZE_CONVERSATION: "admin",
+    // --- plugin-music-player: management actions ---
+    MANAGE_ROUTING: "admin",
+    MANAGE_ZONES: "admin",
+    // --- clipboard: global writes are admin, reads are user (floor) ---
+    CLIPBOARD_WRITE: "admin",
+    CLIPBOARD_APPEND: "admin",
+    CLIPBOARD_DELETE: "admin",
+    READ_FILE: "admin",
+};
+// ---------------------------------------------------------------------------
+// Provider-level gating — providers that expose sensitive context.
+// Keys are exact provider `name` strings.
+// ---------------------------------------------------------------------------
+const PROVIDER_ROLE_OVERRIDES = {
+    // Shell
+    shellHistoryProvider: "admin",
+    terminalUsage: "admin",
+    // Orchestrator
+    ACTIVE_WORKSPACE_CONTEXT: "admin",
+    CODING_AGENT_EXAMPLES: "admin",
+    // Secrets
+    SECRETS_STATUS: "admin",
+    SECRETS_INFO: "admin",
+    MISSING_SECRETS: "admin",
+    // Cron
+    cronContext: "admin",
+    // Cloud
+    elizacloud_status: "admin",
+    elizacloud_credits: "admin",
+    elizacloud_health: "admin",
+    elizacloud_models: "admin",
+    // Clipboard
+    clipboard: "admin",
+};
+// ---------------------------------------------------------------------------
+// Gating implementation
+// ---------------------------------------------------------------------------
+function resolveGateLevel(pluginGate, overrideGate) {
+    if (!pluginGate && !overrideGate)
+        return null;
+    if (!pluginGate)
+        return overrideGate ?? null;
+    if (!overrideGate)
+        return pluginGate;
+    return ROLE_GATE_RANK[overrideGate] > ROLE_GATE_RANK[pluginGate]
+        ? overrideGate
+        : pluginGate;
+}
+function roleCheckPasses(check, gate) {
+    switch (gate) {
+        case "owner":
+            return check.isOwner === true;
+        case "admin":
+            return check.isAdmin === true;
+        case "user":
+            // USER, ADMIN, and OWNER all pass the "user" gate.
+            // Only GUEST (rank 0) is blocked.
+            return check.role !== "GUEST" && check.role !== "NONE";
+        default:
+            return false;
+    }
+}
+/**
+ * Wrap an action's validate function so it rejects callers below the gate.
+ */
+function gateAction(action, gate) {
+    const originalValidate = action.validate;
+    action.validate = async (runtime, message, state) => {
+        const { checkSenderRole } = await import("./roles.js");
+        const check = await checkSenderRole(runtime, message);
+        if (!check) {
+            // No world context (e.g. direct API call) — allow through
+            return originalValidate
+                ? originalValidate(runtime, message, state)
+                : true;
+        }
+        if (!roleCheckPasses(check, gate)) {
+            logger.debug(`[role-gating] ${action.name} blocked for entity ${message.entityId} ` +
+                `(role: ${check.role}, requires: ${gate})`);
+            return false;
+        }
+        return originalValidate ? originalValidate(runtime, message, state) : true;
+    };
+}
+/**
+ * Wrap a provider's get function so it returns empty content for callers
+ * below the gate. Providers don't block — they just withhold context.
+ */
+function gateProvider(provider, gate) {
+    const originalGet = provider.get;
+    provider.get = async (runtime, message, state) => {
+        const { checkSenderRole } = await import("./roles.js");
+        const check = await checkSenderRole(runtime, message);
+        if (check && !roleCheckPasses(check, gate)) {
+            return { text: "" };
+        }
+        return originalGet.call(provider, runtime, message, state);
+    };
+}
+/**
+ * Apply role gating to all registered plugins. Call after runtime.initialize().
+ *
+ * For each plugin:
+ * 1. Actions get gated to `max(plugin floor, action override)`.
+ * 2. Providers in PROVIDER_ROLE_OVERRIDES get gated.
+ */
+export function applyPluginRoleGating(plugins) {
+    let totalActions = 0;
+    let totalProviders = 0;
+    for (const plugin of plugins) {
+        const pluginName = plugin.name ?? "";
+        const pluginGate = ROLE_GATED_PLUGINS[pluginName];
+        // Gate actions
+        if (plugin.actions?.length) {
+            for (const action of plugin.actions) {
+                const actionOverride = ACTION_ROLE_OVERRIDES[action.name];
+                const effectiveGate = resolveGateLevel(pluginGate, actionOverride);
+                if (effectiveGate) {
+                    gateAction(action, effectiveGate);
+                    totalActions++;
+                }
+            }
+        }
+        // Gate providers
+        if (plugin.providers?.length) {
+            for (const provider of plugin.providers) {
+                const providerName = provider.name ?? "";
+                const providerGate = PROVIDER_ROLE_OVERRIDES[providerName];
+                if (providerGate) {
+                    gateProvider(provider, providerGate);
+                    totalProviders++;
+                }
+            }
+        }
+        if (pluginGate) {
+            const actionCount = plugin.actions?.length ?? 0;
+            const providerCount = plugin.providers?.length ?? 0;
+            logger.info(`[role-gating] ${pluginName}: ${actionCount} action(s) floor=${pluginGate}, ` +
+                `${providerCount} provider(s) checked`);
+        }
+    }
+    if (totalActions > 0 || totalProviders > 0) {
+        logger.info(`[role-gating] Total: ${totalActions} action(s), ${totalProviders} provider(s) gated`);
+    }
+}
+/** Exported for testing. */
+export { ACTION_ROLE_OVERRIDES, PROVIDER_ROLE_OVERRIDES, ROLE_GATED_PLUGINS };

package/packages/agent/src/runtime/plugin-types.d.ts

@@ -0,0 +1,71 @@
+import { type Plugin } from "@elizaos/core";
+import type { ElizaConfig } from "../config/config.js";
+import type { PluginInstallRecord } from "../config/types.eliza.js";
+/** A successfully resolved plugin ready for AgentRuntime registration. */
+export interface ResolvedPlugin {
+    /** npm package name (e.g. "@elizaos/plugin-anthropic"). */
+    name: string;
+    /** The Plugin instance extracted from the module. */
+    plugin: Plugin;
+}
+/** Shape we expect from a dynamically-imported plugin package. */
+export interface PluginModuleShape {
+    default?: Plugin;
+    plugin?: Plugin;
+    [key: string]: Plugin | undefined;
+}
+/**
+ * Static plugin registry.
+ *
+ * Populated by eliza.ts at module-load time with all statically-imported
+ * plugin modules. Defined here (as a mutable record) so that
+ * plugin-resolver.ts can read it without importing eliza.ts, breaking the
+ * circular dependency.
+ */
+export declare const STATIC_ELIZA_PLUGINS: Record<string, unknown>;
+/** Subdirectory under the Eliza state dir for drop-in custom plugins. */
+export declare const CUSTOM_PLUGINS_DIRNAME = "plugins/custom";
+/** Subdirectory under the Eliza state dir for ejected plugins. */
+export declare const EJECTED_PLUGINS_DIRNAME = "plugins/ejected";
+export declare function findRuntimePluginExport(mod: PluginModuleShape): Plugin | null;
+/**
+ * Scan a directory for drop-in plugin packages. Each immediate subdirectory
+ * is treated as a plugin; name comes from package.json or the directory name.
+ */
+export declare function scanDropInPlugins(dir: string): Promise<Record<string, PluginInstallRecord>>;
+/**
+ * Merge drop-in plugins into the load set. Filters out denied, core-colliding,
+ * and already-installed names. Mutates `pluginsToLoad` and `installRecords`.
+ */
+export declare function mergeDropInPlugins(params: {
+    dropInRecords: Record<string, PluginInstallRecord>;
+    installRecords: Record<string, PluginInstallRecord>;
+    corePluginNames: ReadonlySet<string>;
+    denyList: ReadonlySet<string>;
+    pluginsToLoad: Set<string>;
+}): {
+    accepted: string[];
+    skipped: string[];
+};
+export declare function resolveElizaPluginImportSpecifier(pluginName: string, runtimeModuleUrl?: string): string;
+export declare function shouldIgnoreMissingPluginExport(pluginName: string): boolean;
+export declare function findPluginBrowserStagehandDir(startDir: string): string | null;
+/**
+ * `@elizaos/plugin-browser` expects `dist/server/` with the stagehand binary
+ * tree inside the npm package, but the published tarball does not ship it.
+ * When missing, symlink to a repo checkout at `plugins/plugin-browser/stagehand-server`
+ * (discovered via {@link findPluginBrowserStagehandDir}) so the plugin's
+ * process-manager can spawn the server.
+ *
+ * **Why:** Without the symlink, browser automation fails at runtime even when
+ * the user built stagehand locally -- the plugin only looks under its package root.
+ *
+ * @returns `true` when `dist/server` already resolves or symlink succeeded.
+ */
+export declare function ensureBrowserServerLink(): boolean;
+/** @internal Exported for testing. */
+export declare function repairBrokenInstallRecord(config: ElizaConfig, pluginName: string): boolean;
+/** Read package.json exports/main to find the importable entry file. */
+/** @internal Exported for testing. */
+export declare function resolvePackageEntry(pkgRoot: string): Promise<string>;
+//# sourceMappingURL=plugin-types.d.ts.map

package/packages/agent/src/runtime/plugin-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-types.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/plugin-types.ts"],"names":[],"mappings":"AAeA,OAAO,EAAU,KAAK,MAAM,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAMpE,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAMD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,CAAC;AAEhE,yEAAyE;AACzE,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AACvD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,oBAAoB,CAAC;AAyCzD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAsC7E;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CA2C9C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE;IACzC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC5B,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAyB5C;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,gBAAgB,SAAkB,GACjC,MAAM,CAaR;AAED,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE3E;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmB7E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAyEjD;AAED,sCAAsC;AACtC,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAST;AAED,wEAAwE;AACxE,sCAAsC;AACtC,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8D1E"}

package/packages/agent/src/runtime/plugin-types.js

@@ -0,0 +1,318 @@
+import { existsSync, symlinkSync } from "node:fs";
+import fs from "node:fs/promises";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { logger } from "@elizaos/core";
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/**
+ * Static plugin registry.
+ *
+ * Populated by eliza.ts at module-load time with all statically-imported
+ * plugin modules. Defined here (as a mutable record) so that
+ * plugin-resolver.ts can read it without importing eliza.ts, breaking the
+ * circular dependency.
+ */
+export const STATIC_ELIZA_PLUGINS = {};
+/** Subdirectory under the Eliza state dir for drop-in custom plugins. */
+export const CUSTOM_PLUGINS_DIRNAME = "plugins/custom";
+/** Subdirectory under the Eliza state dir for ejected plugins. */
+export const EJECTED_PLUGINS_DIRNAME = "plugins/ejected";
+// ---------------------------------------------------------------------------
+// Private helpers
+// ---------------------------------------------------------------------------
+function formatError(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function looksLikePlugin(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const obj = value;
+    if (typeof obj.name !== "string" || typeof obj.description !== "string") {
+        return false;
+    }
+    // Providers also expose { name, description } so we require at least one
+    // plugin-like capability field before accepting named exports as plugins.
+    return (Array.isArray(obj.services) ||
+        Array.isArray(obj.providers) ||
+        Array.isArray(obj.actions) ||
+        Array.isArray(obj.routes) ||
+        Array.isArray(obj.events) ||
+        typeof obj.init === "function");
+}
+function looksLikePluginBasic(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const obj = value;
+    return typeof obj.name === "string" && typeof obj.description === "string";
+}
+// ---------------------------------------------------------------------------
+// Utility functions
+// ---------------------------------------------------------------------------
+export function findRuntimePluginExport(mod) {
+    // 1. Prefer explicit default export
+    if (looksLikePlugin(mod.default))
+        return mod.default;
+    // 2. Check for a named `plugin` export
+    if (looksLikePlugin(mod.plugin))
+        return mod.plugin;
+    // 3. Check if the module itself looks like a Plugin (CJS default pattern).
+    if (looksLikePlugin(mod))
+        return mod;
+    // 4. Scan named exports in a deterministic order.
+    // Prefer keys ending with "Plugin" before generic exports like providers.
+    const namedKeys = Object.keys(mod).filter((key) => key !== "default" && key !== "plugin");
+    const preferredKeys = namedKeys.filter((key) => /plugin$/i.test(key) || /^plugin/i.test(key));
+    const fallbackKeys = namedKeys.filter((key) => !preferredKeys.includes(key));
+    for (const key of [...preferredKeys, ...fallbackKeys]) {
+        const value = mod[key];
+        if (looksLikePlugin(value))
+            return value;
+    }
+    // 5. Final compatibility fallback: accept minimal plugin-like exports only
+    // when the export name itself indicates it's a plugin.
+    for (const key of preferredKeys) {
+        const value = mod[key];
+        if (looksLikePluginBasic(value))
+            return value;
+    }
+    // 6. Legacy CJS compatibility for modules that export only { name, description }.
+    if (looksLikePluginBasic(mod))
+        return mod;
+    const modDefault = mod.default;
+    const modPlugin = mod.plugin;
+    if (looksLikePluginBasic(modDefault))
+        return modDefault;
+    if (looksLikePluginBasic(modPlugin))
+        return modPlugin;
+    return null;
+}
+/**
+ * Scan a directory for drop-in plugin packages. Each immediate subdirectory
+ * is treated as a plugin; name comes from package.json or the directory name.
+ */
+export async function scanDropInPlugins(dir) {
+    const records = {};
+    let entries;
+    try {
+        entries = await fs.readdir(dir, { withFileTypes: true });
+    }
+    catch (err) {
+        if (err.code === "ENOENT") {
+            return records;
+        }
+        throw err;
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const pluginDir = path.join(dir, entry.name);
+        let pluginName = entry.name;
+        let version = "0.0.0";
+        try {
+            const raw = await fs.readFile(path.join(pluginDir, "package.json"), "utf-8");
+            const pkg = JSON.parse(raw);
+            if (typeof pkg.name === "string" && pkg.name.trim())
+                pluginName = pkg.name.trim();
+            if (typeof pkg.version === "string" && pkg.version.trim())
+                version = pkg.version.trim();
+        }
+        catch (err) {
+            if (err.code !== "ENOENT" &&
+                !(err instanceof SyntaxError)) {
+                throw err;
+            }
+        }
+        records[pluginName] = { source: "path", installPath: pluginDir, version };
+    }
+    return records;
+}
+/**
+ * Merge drop-in plugins into the load set. Filters out denied, core-colliding,
+ * and already-installed names. Mutates `pluginsToLoad` and `installRecords`.
+ */
+export function mergeDropInPlugins(params) {
+    const { dropInRecords, installRecords, corePluginNames, denyList, pluginsToLoad, } = params;
+    const accepted = [];
+    const skipped = [];
+    for (const [name, record] of Object.entries(dropInRecords)) {
+        if (denyList.has(name) || installRecords[name])
+            continue;
+        if (corePluginNames.has(name)) {
+            skipped.push(`[eliza] Custom plugin "${name}" collides with core plugin — skipping`);
+            continue;
+        }
+        pluginsToLoad.add(name);
+        installRecords[name] = record;
+        accepted.push(name);
+    }
+    return { accepted, skipped };
+}
+export function resolveElizaPluginImportSpecifier(pluginName, runtimeModuleUrl = import.meta.url) {
+    if (!pluginName.startsWith("@elizaos/plugin-")) {
+        return pluginName;
+    }
+    const shortName = pluginName.replace("@elizaos/plugin-", "");
+    const thisDir = path.dirname(fileURLToPath(runtimeModuleUrl));
+    const distRoot = thisDir.endsWith("runtime")
+        ? path.resolve(thisDir, "..")
+        : thisDir;
+    const indexPath = path.resolve(distRoot, "plugins", shortName, "index.js");
+    return existsSync(indexPath) ? pathToFileURL(indexPath).href : pluginName;
+}
+export function shouldIgnoreMissingPluginExport(pluginName) {
+    return pluginName === "@elizaos/plugin-streaming-base";
+}
+export function findPluginBrowserStagehandDir(startDir) {
+    let dir = path.resolve(startDir);
+    for (let depth = 0; depth < 14; depth++) {
+        const candidate = path.join(dir, "plugins", "plugin-browser", "stagehand-server");
+        const distIndex = path.join(candidate, "dist", "index.js");
+        const srcEntry = path.join(candidate, "src", "index.ts");
+        if (existsSync(distIndex) || existsSync(srcEntry)) {
+            return candidate;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+/**
+ * `@elizaos/plugin-browser` expects `dist/server/` with the stagehand binary
+ * tree inside the npm package, but the published tarball does not ship it.
+ * When missing, symlink to a repo checkout at `plugins/plugin-browser/stagehand-server`
+ * (discovered via {@link findPluginBrowserStagehandDir}) so the plugin's
+ * process-manager can spawn the server.
+ *
+ * **Why:** Without the symlink, browser automation fails at runtime even when
+ * the user built stagehand locally -- the plugin only looks under its package root.
+ *
+ * @returns `true` when `dist/server` already resolves or symlink succeeded.
+ */
+export function ensureBrowserServerLink() {
+    try {
+        // Resolve the plugin-browser package root via its package.json.
+        const req = createRequire(import.meta.url);
+        const pkgJsonPath = req.resolve("@elizaos/plugin-browser/package.json");
+        const pluginRoot = path.dirname(pkgJsonPath);
+        const serverDir = path.join(pluginRoot, "dist", "server");
+        const serverIndex = path.join(serverDir, "dist", "index.js");
+        // Already linked / available -- nothing to do.
+        if (existsSync(serverIndex))
+            return true;
+        const thisDir = path.dirname(fileURLToPath(import.meta.url));
+        const stagehandDir = findPluginBrowserStagehandDir(thisDir);
+        if (!stagehandDir) {
+            logger.debug("[eliza] plugin-browser: no stagehand-server under plugins/plugin-browser — " +
+                "run node scripts/link-browser-server.mjs or add the plugin checkout");
+            return false;
+        }
+        const stagehandIndex = path.join(stagehandDir, "dist", "index.js");
+        // Auto-build if source exists but dist doesn't
+        if (!existsSync(stagehandIndex) &&
+            existsSync(path.join(stagehandDir, "src", "index.ts"))) {
+            logger.info(`[eliza] Stagehand server not built — attempting auto-build...`);
+            try {
+                const cp = createRequire(import.meta.url)("node:child_process");
+                if (!existsSync(path.join(stagehandDir, "node_modules"))) {
+                    cp.execSync("pnpm install --ignore-scripts", {
+                        cwd: stagehandDir,
+                        stdio: "ignore",
+                        timeout: 60_000,
+                    });
+                }
+                // Prefer local tsc binary, fall back to pnpm exec
+                const localTsc = path.join(stagehandDir, "node_modules", ".bin", "tsc");
+                const tscCmd = existsSync(localTsc) ? localTsc : "pnpm exec tsc";
+                cp.execSync(tscCmd, {
+                    cwd: stagehandDir,
+                    stdio: "ignore",
+                    timeout: 60_000,
+                });
+                logger.info(`[eliza] Stagehand server built successfully`);
+            }
+            catch (buildErr) {
+                logger.debug(`[eliza] Auto-build failed: ${formatError(buildErr)}`);
+            }
+        }
+        if (!existsSync(stagehandIndex)) {
+            logger.debug("[eliza] plugin-browser: stagehand-server present but dist/index.js missing — build it");
+            return false;
+        }
+        // Create symlink: dist/server -> stagehand-server
+        symlinkSync(stagehandDir, serverDir, "dir");
+        logger.info(`[eliza] Linked browser server: ${serverDir} -> ${stagehandDir}`);
+        return true;
+    }
+    catch (err) {
+        logger.debug(`[eliza] Could not link browser server: ${formatError(err)}`);
+        return false;
+    }
+}
+/** @internal Exported for testing. */
+export function repairBrokenInstallRecord(config, pluginName) {
+    const record = config.plugins?.installs?.[pluginName];
+    if (!record || typeof record.installPath !== "string")
+        return false;
+    if (!record.installPath.trim())
+        return false;
+    // Keep the plugin listed as installed but force node_modules resolution.
+    record.installPath = "";
+    record.source = "npm";
+    return true;
+}
+/** Read package.json exports/main to find the importable entry file. */
+/** @internal Exported for testing. */
+export async function resolvePackageEntry(pkgRoot) {
+    const fallback = path.join(pkgRoot, "dist", "index");
+    const fallbackCandidates = [
+        fallback,
+        path.join(pkgRoot, "index"),
+        path.join(pkgRoot, "index.mjs"),
+        path.join(pkgRoot, "index.ts"),
+        path.join(pkgRoot, "src", "index"),
+        path.join(pkgRoot, "src", "index.mjs"),
+        path.join(pkgRoot, "src", "index.ts"),
+    ];
+    const chooseExisting = (...paths) => {
+        const seen = new Set();
+        for (const p of paths) {
+            const resolved = path.resolve(p);
+            if (seen.has(resolved))
+                continue;
+            seen.add(resolved);
+            if (existsSync(resolved))
+                return resolved;
+        }
+        // Return first candidate even when missing so callers still get a useful path in errors.
+        return path.resolve(paths[0] ?? fallback);
+    };
+    try {
+        const raw = await fs.readFile(path.join(pkgRoot, "package.json"), "utf-8");
+        const pkg = JSON.parse(raw);
+        if (typeof pkg.exports === "object" && pkg.exports["."] !== undefined) {
+            const dot = pkg.exports["."];
+            const resolved = typeof dot === "string" ? dot : dot.import || dot.default;
+            if (typeof resolved === "string") {
+                return chooseExisting(path.resolve(pkgRoot, resolved), ...fallbackCandidates);
+            }
+        }
+        if (typeof pkg.exports === "string") {
+            return chooseExisting(path.resolve(pkgRoot, pkg.exports), ...fallbackCandidates);
+        }
+        if (pkg.main) {
+            return chooseExisting(path.resolve(pkgRoot, pkg.main), ...fallbackCandidates);
+        }
+        return chooseExisting(...fallbackCandidates);
+    }
+    catch (err) {
+        if (err.code === "ENOENT") {
+            return chooseExisting(...fallbackCandidates);
+        }
+        throw err;
+    }
+}