@elizaos/agent 2.0.0-alpha.421 → 2.0.0-alpha.425

package/packages/typescript/src/features/plugin-manager/actions/plugin.js

@@ -0,0 +1,439 @@
+/**
+ * @module features/plugin-manager/actions/plugin
+ *
+ * Unified PLUGIN action with sub-modes (`install`, `eject`, `sync`,
+ * `reinject`, `list`, `list_ejected`, `search`, `core_status`, `create`).
+ *
+ * Validate gates on owner role + a keyword heuristic + a lookup against
+ * any pending PLUGIN_CREATE intent task in the same room (so the
+ * multi-turn choice reply still resolves).
+ *
+ * Handler is pure dispatch — sub-handlers live under ./plugin-handlers/.
+ */
+import path from "node:path";
+import { logger } from "../../../logger.js";
+import { hasOwnerAccess as defaultOwnerAccessFn } from "../security.js";
+import { runCoreStatus } from "./plugin-handlers/core-status.js";
+import { hasPendingPluginCreateIntent, isPluginCreateChoiceReply, runCreate, } from "./plugin-handlers/create.js";
+import { runEject } from "./plugin-handlers/eject.js";
+import { runInstall } from "./plugin-handlers/install.js";
+import { runList } from "./plugin-handlers/list.js";
+import { runListEjected } from "./plugin-handlers/list-ejected.js";
+import { runReinject } from "./plugin-handlers/reinject.js";
+import { runSearch } from "./plugin-handlers/search.js";
+import { runSync } from "./plugin-handlers/sync.js";
+const MODES = [
+    "install",
+    "eject",
+    "sync",
+    "reinject",
+    "list",
+    "list_ejected",
+    "search",
+    "core_status",
+    "create",
+];
+const INSTALL_VERBS = /\binstall\b/i;
+const EJECT_VERBS = /\beject\b/i;
+const SYNC_VERBS = /\bsync\b/i;
+const REINJECT_VERBS = /\b(reinject|re-inject|unject)\b/i;
+const SEARCH_VERBS = /\b(search|find|look\s+for|discover)\b/i;
+const LIST_VERBS = /\b(list|show)\b/i;
+const CREATE_VERBS = /\b(create|build|make|new|scaffold|generate)\b/i;
+const PLUGIN_NOUN = /\bplugins?\b/i;
+const EJECTED_NOUN = /\bejected\b/i;
+const CORE_NOUN = /\bcore\b/i;
+const STATUS_NOUN = /\bstatus\b/i;
+const MANAGE_VERBS = /\b(manage|build|create|build|fix|update|edit)\b/i;
+const KEYWORD_HEURISTIC = /\b(install|eject|sync|reinject|search|find|create|build|make|scaffold|new|list|show|manage|fix|update|edit)\b.*\bplugins?\b|\bcore\s+status\b|\bplugin\b.*\b(install|eject|sync|reinject|search|find|create|build|make|scaffold|new|list|show)\b/i;
+function defaultRepoRoot() {
+    const fromEnv = process.env.MILADY_REPO_ROOT?.trim() ||
+        process.env.MILADY_WORKSPACE_DIR?.trim() ||
+        process.env.ELIZA_WORKSPACE_DIR?.trim();
+    if (fromEnv && path.isAbsolute(fromEnv))
+        return fromEnv;
+    return process.cwd();
+}
+function readNestedParameters(options) {
+    const parameters = options?.parameters;
+    if (typeof parameters !== "object" ||
+        parameters === null ||
+        Array.isArray(parameters)) {
+        return undefined;
+    }
+    return parameters;
+}
+function readOptionValue(options, key) {
+    if (!options)
+        return undefined;
+    const direct = options[key];
+    if (direct !== undefined)
+        return direct;
+    return readNestedParameters(options)?.[key];
+}
+function readStringOption(options, key) {
+    const value = readOptionValue(options, key);
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function readSourceOption(options) {
+    const source = readStringOption(options, "source");
+    if (source === "npm" || source === "git")
+        return source;
+    return undefined;
+}
+function inferMode(text, options) {
+    const explicit = readStringOption(options, "mode");
+    if (explicit && MODES.includes(explicit)) {
+        return explicit;
+    }
+    const trimmed = text.trim();
+    if (!trimmed)
+        return null;
+    if (CORE_NOUN.test(trimmed) && STATUS_NOUN.test(trimmed))
+        return "core_status";
+    if (LIST_VERBS.test(trimmed) && EJECTED_NOUN.test(trimmed))
+        return "list_ejected";
+    if (LIST_VERBS.test(trimmed) && PLUGIN_NOUN.test(trimmed))
+        return "list";
+    if (REINJECT_VERBS.test(trimmed))
+        return "reinject";
+    if (EJECT_VERBS.test(trimmed))
+        return "eject";
+    if (SYNC_VERBS.test(trimmed) && PLUGIN_NOUN.test(trimmed))
+        return "sync";
+    if (INSTALL_VERBS.test(trimmed) && PLUGIN_NOUN.test(trimmed))
+        return "install";
+    if (SEARCH_VERBS.test(trimmed) && PLUGIN_NOUN.test(trimmed))
+        return "search";
+    if (CREATE_VERBS.test(trimmed) && PLUGIN_NOUN.test(trimmed))
+        return "create";
+    if (MANAGE_VERBS.test(trimmed) && PLUGIN_NOUN.test(trimmed))
+        return "create";
+    return null;
+}
+function extractNameFromText(text) {
+    const scoped = text.match(/@[\w-]+\/(plugin-[\w.-]+)/);
+    if (scoped)
+        return scoped[0];
+    const bare = text.match(/\b(plugin-[\w.-]+)\b/);
+    if (bare)
+        return bare[1];
+    return undefined;
+}
+function extractQueryFromText(text) {
+    const patterns = [
+        /search\s+for\s+plugins?\s+(?:that\s+)?(?:can\s+)?(.+)/i,
+        /find\s+plugins?\s+(?:for|that|to)\s+(.+)/i,
+        /look\s+for\s+plugins?\s+(?:that\s+)?(.+)/i,
+        /discover\s+plugins?\s+(?:for|that)\s+(.+)/i,
+        /plugins?\s+(?:for|that\s+can|to)\s+(.+)/i,
+    ];
+    for (const pattern of patterns) {
+        const m = text.match(pattern);
+        if (m?.[1]) {
+            const cleaned = m[1].trim().replace(/[?.!]+$/, "");
+            if (cleaned.length > 2)
+                return cleaned;
+        }
+    }
+    return undefined;
+}
+function hasAccessContext(runtime, message) {
+    return (typeof runtime.agentId === "string" &&
+        runtime.agentId.length > 0 &&
+        typeof message.entityId === "string" &&
+        message.entityId.length > 0);
+}
+export function createPluginAction(deps = {}) {
+    const ownerCheck = deps.hasOwnerAccess ?? defaultOwnerAccessFn;
+    const repoRoot = deps.repoRoot ?? defaultRepoRoot();
+    const canManagePlugins = async (runtime, message) => {
+        if (!hasAccessContext(runtime, message))
+            return false;
+        return ownerCheck(runtime, message);
+    };
+    return {
+        name: "PLUGIN",
+        similes: [
+            "PLUGIN_CONTROL",
+            "MANAGE_PLUGINS",
+            // Legacy single-purpose action names — preserved as similes so
+            // callers that still dispatch by these names resolve to PLUGIN
+            // without breaking. Covers both the prior workspace plugin's
+            // names and the prior built-in capability's names.
+            "INSTALL_PLUGIN",
+            "EJECT_PLUGIN",
+            "SYNC_PLUGIN",
+            "REINJECT_PLUGIN",
+            "LIST_EJECTED_PLUGINS",
+            "SEARCH_PLUGIN",
+            "SEARCH_PLUGINS",
+            "CORE_STATUS",
+            "GET_PLUGIN_DETAILS",
+        ],
+        description: "Unified plugin control. mode=install installs from registry; mode=eject clones a registry plugin locally; mode=sync pulls upstream into an ejected plugin; mode=reinject removes the local copy; mode=list shows loaded/installed; mode=list_ejected shows ejected; mode=search queries the registry; mode=core_status reports @elizaos/core ejection state; mode=create runs the multi-turn create-or-edit flow that scaffolds from the min-plugin template and dispatches a coding agent with AppVerificationService validator.",
+        parameters: [
+            {
+                name: "mode",
+                description: "Sub-mode: install | eject | sync | reinject | list | list_ejected | search | core_status | create.",
+                required: true,
+                schema: { type: "string", enum: [...MODES] },
+            },
+            {
+                name: "name",
+                description: "Plugin name (e.g. @elizaos/plugin-twitter or plugin-twitter). Required for install / eject / sync / reinject.",
+                required: false,
+                schema: { type: "string" },
+            },
+            {
+                name: "version",
+                description: "Version spec for install (npm semver). Optional.",
+                required: false,
+                schema: { type: "string" },
+            },
+            {
+                name: "source",
+                description: "Install source: npm (default) or git.",
+                required: false,
+                schema: { type: "string", enum: ["npm", "git"] },
+            },
+            {
+                name: "url",
+                description: "Override git URL when source=git.",
+                required: false,
+                schema: { type: "string" },
+            },
+            {
+                name: "query",
+                description: "Free-form search query (search mode).",
+                required: false,
+                schema: { type: "string" },
+            },
+            {
+                name: "intent",
+                description: "Free-form description of the plugin to build (create mode). Defaults to user message text.",
+                required: false,
+                schema: { type: "string" },
+            },
+            {
+                name: "choice",
+                description: "Override choice reply (`new` | `edit-N` | `cancel`) for create-mode follow-up turns.",
+                required: false,
+                schema: { type: "string", enum: ["new", "edit", "cancel"] },
+            },
+            {
+                name: "editTarget",
+                description: "Skip the picker and edit this installed plugin directly (create mode).",
+                required: false,
+                schema: { type: "string" },
+            },
+        ],
+        validate: async (runtime, message) => {
+            if (!(await canManagePlugins(runtime, message)))
+                return false;
+            const text = message.content?.text ?? "";
+            if (isPluginCreateChoiceReply(text)) {
+                const roomId = typeof message.roomId === "string" ? message.roomId : runtime.agentId;
+                if (await hasPendingPluginCreateIntent(runtime, roomId))
+                    return true;
+            }
+            return KEYWORD_HEURISTIC.test(text);
+        },
+        handler: async (runtime, message, _state, options, callback) => {
+            if (!(await canManagePlugins(runtime, message))) {
+                const text = "Permission denied: only the owner may manage plugins.";
+                await callback?.({ text });
+                return { success: false, text };
+            }
+            const text = message.content?.text ?? "";
+            if (isPluginCreateChoiceReply(text)) {
+                const roomId = typeof message.roomId === "string" ? message.roomId : runtime.agentId;
+                if (await hasPendingPluginCreateIntent(runtime, roomId)) {
+                    return runCreate({
+                        runtime,
+                        message,
+                        options,
+                        callback,
+                        choice: text.trim(),
+                        repoRoot,
+                    });
+                }
+            }
+            const mode = inferMode(text, options);
+            if (!mode) {
+                const reply = 'Tell me which plugin operation to run. Try: "install @elizaos/plugin-twitter", "list ejected plugins", "search for plugins for blockchain", "create a new plugin for X".';
+                await callback?.({ text: reply });
+                return { success: false, text: reply };
+            }
+            logger.info(`[plugin-manager] PLUGIN mode=${mode}`);
+            const name = readStringOption(options, "name") ?? extractNameFromText(text);
+            const source = readSourceOption(options);
+            const query = readStringOption(options, "query") ?? extractQueryFromText(text) ?? text;
+            switch (mode) {
+                case "install":
+                    return runInstall({ runtime, name: name ?? "", source, callback });
+                case "eject":
+                    return runEject({ runtime, name: name ?? "", callback });
+                case "sync":
+                    return runSync({ runtime, name: name ?? "", callback });
+                case "reinject":
+                    return runReinject({ runtime, name: name ?? "", callback });
+                case "list":
+                    return runList({ runtime, callback });
+                case "list_ejected":
+                    return runListEjected({ runtime, callback });
+                case "search":
+                    return runSearch({ runtime, query, callback });
+                case "core_status":
+                    return runCoreStatus({ runtime, callback });
+                case "create":
+                    return runCreate({
+                        runtime,
+                        message,
+                        options,
+                        callback,
+                        intent: readStringOption(options, "intent"),
+                        choice: readStringOption(options, "choice"),
+                        editTarget: readStringOption(options, "editTarget"),
+                        repoRoot,
+                    });
+            }
+        },
+        examples: [
+            [
+                {
+                    name: "{{user1}}",
+                    content: { text: "install @elizaos/plugin-twitter" },
+                },
+                {
+                    name: "{{agentName}}",
+                    content: {
+                        text: "Installed @elizaos/plugin-twitter@2.0.0 at /…/plugins/installed/@elizaos_plugin-twitter\nRestart required to activate.",
+                        action: "PLUGIN",
+                    },
+                },
+            ],
+            [
+                {
+                    name: "{{user1}}",
+                    content: { text: "eject @elizaos/plugin-shopify" },
+                },
+                {
+                    name: "{{agentName}}",
+                    content: {
+                        text: "Ejected @elizaos/plugin-shopify to /…/plugins/ejected/@elizaos_plugin-shopify (commit 1234abcd)\nRestart required to load the local copy.",
+                        action: "PLUGIN",
+                    },
+                },
+            ],
+            [
+                {
+                    name: "{{user1}}",
+                    content: { text: "sync plugin-shopify" },
+                },
+                {
+                    name: "{{agentName}}",
+                    content: {
+                        text: "Synced @elizaos/plugin-shopify: 3 new upstream commit(s) at deadbeef\nRestart required.",
+                        action: "PLUGIN",
+                    },
+                },
+            ],
+            [
+                {
+                    name: "{{user1}}",
+                    content: { text: "reinject plugin-shopify" },
+                },
+                {
+                    name: "{{agentName}}",
+                    content: {
+                        text: "Reinjected plugin-shopify (removed /…/plugins/ejected/plugin-shopify)\nRestart required.",
+                        action: "PLUGIN",
+                    },
+                },
+            ],
+            [
+                {
+                    name: "{{user1}}",
+                    content: { text: "list plugins" },
+                },
+                {
+                    name: "{{agentName}}",
+                    content: {
+                        text: "Loaded plugins (2):\n  - plugin-manager [LOADED]\n  - @elizaos/plugin-sql [LOADED]",
+                        action: "PLUGIN",
+                    },
+                },
+            ],
+            [
+                {
+                    name: "{{user1}}",
+                    content: { text: "list ejected plugins" },
+                },
+                {
+                    name: "{{agentName}}",
+                    content: {
+                        text: "Ejected plugins (1):\n  - @elizaos/plugin-shopify (v2.0.0) at /…/plugins/ejected/@elizaos_plugin-shopify",
+                        action: "PLUGIN",
+                    },
+                },
+            ],
+            [
+                {
+                    name: "{{user1}}",
+                    content: { text: "search for plugins that handle blockchain" },
+                },
+                {
+                    name: "{{agentName}}",
+                    content: {
+                        text: 'Found 3 plugin(s) matching "handle blockchain":\n\n1. @elizaos/plugin-evm (match: 90%)\n   …',
+                        action: "PLUGIN",
+                    },
+                },
+            ],
+            [
+                {
+                    name: "{{user1}}",
+                    content: { text: "core status" },
+                },
+                {
+                    name: "{{agentName}}",
+                    content: {
+                        text: "Core is using NPM package (v2.0.0-alpha.372). Not ejected.",
+                        action: "PLUGIN",
+                    },
+                },
+            ],
+            [
+                {
+                    name: "{{user1}}",
+                    content: { text: "build me a plugin for sending push notifications" },
+                },
+                {
+                    name: "{{agentName}}",
+                    content: {
+                        text: "[CHOICE:plugin-create id=plugin-create-…]\nnew = Create new plugin\nedit-1 = Edit plugin-notifications\ncancel = Cancel\n[/CHOICE]",
+                        action: "PLUGIN",
+                    },
+                },
+            ],
+            [
+                {
+                    name: "{{user1}}",
+                    content: { text: "new" },
+                },
+                {
+                    name: "{{agentName}}",
+                    content: {
+                        text: "Spawned coding agent. I'll verify when it's done. (Push Notifications Plugin at /…/eliza/plugins/plugin-push-notifications/typescript)",
+                        action: "PLUGIN",
+                    },
+                },
+            ],
+        ],
+    };
+}
+export const pluginAction = createPluginAction();

package/packages/typescript/src/features/plugin-manager/index.d.ts

@@ -3,7 +3,9 @@ import * as pluginRegistry from "./services/pluginRegistryService.ts";
 import * as types from "./types.ts";
 export { coreStatusAction } from "./actions/coreStatusAction.ts";
 export { listEjectedPluginsAction } from "./actions/listEjectedPluginsAction.ts";
+export { createPluginAction, pluginAction, type PluginMode, } from "./actions/plugin.ts";
 export { getPluginDetailsAction, searchPluginAction, } from "./actions/searchPluginAction.ts";
+export { hasAdminAccess, hasOwnerAccess, type SecurityDeps, } from "./security.ts";
 export type { ExtendedRuntime } from "./coreExtensions.ts";
 export { applyRuntimeExtensions, extendRuntimeWithComponentUnregistration, } from "./coreExtensions.ts";
 export { pluginConfigurationStatusProvider } from "./providers/pluginConfigurationStatus.ts";

package/packages/typescript/src/features/plugin-manager/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../typescript/src/features/plugin-manager/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAYpD,OAAO,KAAK,cAAc,MAAM,qCAAqC,CAAC;AACtE,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAKpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EACN,sBAAsB,EACtB,kBAAkB,GAClB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EACN,sBAAsB,EACtB,wCAAwC,GACxC,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,0CAA0C,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,EACN,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,EACvB,4BAA4B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACX,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,cAAc,EACd,gBAAgB,IAAI,oBAAoB,GACxC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAEtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,YAAY,EACX,WAAW,EACX,kBAAkB,EAClB,cAAc,GACd,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACN,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACtB,MAAM,qCAAqC,CAAC;AAC7C,YAAY,EACX,qBAAqB,EACrB,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACN,wBAAwB,EACxB,YAAY,GACZ,MAAM,YAAY,CAAC;AAGpB,OAAO,EACN,iBAAiB,EACjB,eAAe,EACf,eAAe,GACf,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAGjC,eAAO,MAAM,mBAAmB,EAAE,MAiBjC,CAAC;AAEF,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../typescript/src/features/plugin-manager/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAOpD,OAAO,KAAK,cAAc,MAAM,qCAAqC,CAAC;AACtE,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAKpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EACN,kBAAkB,EAClB,YAAY,EACZ,KAAK,UAAU,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,sBAAsB,EACtB,kBAAkB,GAClB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EACN,cAAc,EACd,cAAc,EACd,KAAK,YAAY,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EACN,sBAAsB,EACtB,wCAAwC,GACxC,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,0CAA0C,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,EACN,iBAAiB,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,EACvB,4BAA4B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACX,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,cAAc,EACd,gBAAgB,IAAI,oBAAoB,GACxC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAEtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,YAAY,EACX,WAAW,EACX,kBAAkB,EAClB,cAAc,GACd,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACN,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACtB,MAAM,qCAAqC,CAAC;AAC7C,YAAY,EACX,qBAAqB,EACrB,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACN,wBAAwB,EACxB,YAAY,GACZ,MAAM,YAAY,CAAC;AAGpB,OAAO,EACN,iBAAiB,EACjB,eAAe,EACf,eAAe,GACf,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAGjC,eAAO,MAAM,mBAAmB,EAAE,MAYjC,CAAC;AAEF,eAAe,mBAAmB,CAAC"}

package/packages/typescript/src/features/plugin-manager/index.js

@@ -1,6 +1,4 @@
-import { coreStatusAction } from "./actions/coreStatusAction.js";
-import { listEjectedPluginsAction } from "./actions/listEjectedPluginsAction.js";
-import { getPluginDetailsAction, searchPluginAction, } from "./actions/searchPluginAction.js";
+import { pluginAction } from "./actions/plugin.js";
 import { pluginConfigurationStatusProvider } from "./providers/pluginConfigurationStatus.js";
 import { pluginStateProvider } from "./providers/pluginStateProvider.js";
 import { registryPluginsProvider } from "./providers/registryPluginsProvider.js";
@@ -12,7 +10,11 @@ import * as types from "./types.js";
 // Actions
 export { coreStatusAction } from "./actions/coreStatusAction.js";
 export { listEjectedPluginsAction } from "./actions/listEjectedPluginsAction.js";
+export { createPluginAction, pluginAction, } from "./actions/plugin.js";
 export { getPluginDetailsAction, searchPluginAction, } from "./actions/searchPluginAction.js";
+// Security helpers (re-exported from @elizaos/core for consumers like
+// plugin-app-control).
+export { hasAdminAccess, hasOwnerAccess, } from "./security.js";
 // Core extensions
 export { applyRuntimeExtensions, extendRuntimeWithComponentUnregistration, } from "./coreExtensions.js";
 // Providers
@@ -35,13 +37,8 @@ export { pluginRegistry, types };
 // Plugin definition
 export const pluginManagerPlugin = {
     name: "plugin-manager",
-    description: "Read-only plugin discovery and plugin/core status introspection",
-    actions: [
-        coreStatusAction,
-        getPluginDetailsAction,
-        searchPluginAction,
-        listEjectedPluginsAction,
-    ],
+    description: "Plugin discovery, install, eject/sync, registry search, and creation",
+    actions: [pluginAction],
     providers: [
         pluginConfigurationStatusProvider,
         pluginStateProvider,

package/packages/typescript/src/features/plugin-manager/security.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Real owner/admin role gating for the PLUGIN action.
+ *
+ * Lives in core so other plugins (and the built-in pluginManagerCapability)
+ * can import it without taking a dep on `@elizaos/agent` (which would
+ * create a layer cycle — `@elizaos/agent` already depends on this
+ * capability).
+ *
+ * Behavior:
+ *   - missing runtime/message context → allow (auth is handled elsewhere)
+ *   - sender is the agent itself → allow
+ *   - sender is the canonical owner → allow
+ *   - otherwise: check the sender role via `checkSenderRole` and require
+ *     `isOwner` (for owner gate) or `isOwner || isAdmin` (for admin gate)
+ *
+ * Role-checker functions are injectable so tests can substitute fakes
+ * without monkey-patching the module (bun's `mock.module` persists across
+ * test files in the same run, which would contaminate unrelated suites).
+ */
+import type { Memory } from "../../types/memory.ts";
+import type { IAgentRuntime } from "../../types/runtime.ts";
+type SenderRole = {
+    isOwner?: boolean;
+    isAdmin?: boolean;
+} | null | undefined;
+export type SecurityDeps = {
+    checkSenderRole?: (runtime: IAgentRuntime, message: Memory) => Promise<SenderRole>;
+    resolveCanonicalOwnerIdForMessage?: (runtime: IAgentRuntime, message: Memory) => Promise<string | null | undefined>;
+};
+export declare function hasOwnerAccess(runtime: IAgentRuntime | undefined, message: Memory | undefined, deps?: SecurityDeps): Promise<boolean>;
+export declare function hasAdminAccess(runtime: IAgentRuntime | undefined, message: Memory | undefined, deps?: SecurityDeps): Promise<boolean>;
+export {};
+//# sourceMappingURL=security.d.ts.map

package/packages/typescript/src/features/plugin-manager/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../../../../../typescript/src/features/plugin-manager/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE5D,KAAK,UAAU,GAAG;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,CAAC;AAE9E,MAAM,MAAM,YAAY,GAAG;IAC1B,eAAe,CAAC,EAAE,CACjB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,MAAM,KACX,OAAO,CAAC,UAAU,CAAC,CAAC;IACzB,iCAAiC,CAAC,EAAE,CACnC,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,MAAM,KACX,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;CACxC,CAAC;AAuCF,wBAAsB,cAAc,CACnC,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,IAAI,GAAE,YAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAelB;AAED,wBAAsB,cAAc,CACnC,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,IAAI,GAAE,YAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAelB"}

package/packages/typescript/src/features/plugin-manager/security.js

@@ -0,0 +1,80 @@
+/**
+ * Real owner/admin role gating for the PLUGIN action.
+ *
+ * Lives in core so other plugins (and the built-in pluginManagerCapability)
+ * can import it without taking a dep on `@elizaos/agent` (which would
+ * create a layer cycle — `@elizaos/agent` already depends on this
+ * capability).
+ *
+ * Behavior:
+ *   - missing runtime/message context → allow (auth is handled elsewhere)
+ *   - sender is the agent itself → allow
+ *   - sender is the canonical owner → allow
+ *   - otherwise: check the sender role via `checkSenderRole` and require
+ *     `isOwner` (for owner gate) or `isOwner || isAdmin` (for admin gate)
+ *
+ * Role-checker functions are injectable so tests can substitute fakes
+ * without monkey-patching the module (bun's `mock.module` persists across
+ * test files in the same run, which would contaminate unrelated suites).
+ */
+import { checkSenderRole as defaultCheckSenderRole, resolveCanonicalOwnerIdForMessage as defaultResolveCanonicalOwnerIdForMessage, } from "../../roles.js";
+function getAccessContext(runtime, message) {
+    if (!runtime ||
+        typeof runtime.agentId !== "string" ||
+        !message ||
+        typeof message.entityId !== "string" ||
+        message.entityId.length === 0) {
+        return null;
+    }
+    return { runtime, message };
+}
+function isAgentSelf(context) {
+    return context.message.entityId === context.runtime.agentId;
+}
+async function isCanonicalOwner(context, resolveOwnerFn) {
+    try {
+        const ownerId = await resolveOwnerFn(context.runtime, context.message);
+        return typeof ownerId === "string" && ownerId === context.message.entityId;
+    }
+    catch {
+        return false;
+    }
+}
+export async function hasOwnerAccess(runtime, message, deps = {}) {
+    const context = getAccessContext(runtime, message);
+    if (!context)
+        return true;
+    if (isAgentSelf(context))
+        return true;
+    const resolveOwnerFn = deps.resolveCanonicalOwnerIdForMessage ??
+        defaultResolveCanonicalOwnerIdForMessage;
+    if (await isCanonicalOwner(context, resolveOwnerFn))
+        return true;
+    const checkRoleFn = deps.checkSenderRole ?? defaultCheckSenderRole;
+    try {
+        const role = await checkRoleFn(context.runtime, context.message);
+        return role?.isOwner === true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function hasAdminAccess(runtime, message, deps = {}) {
+    const context = getAccessContext(runtime, message);
+    if (!context)
+        return true;
+    if (isAgentSelf(context))
+        return true;
+    const resolveOwnerFn = deps.resolveCanonicalOwnerIdForMessage ??
+        defaultResolveCanonicalOwnerIdForMessage;
+    if (await isCanonicalOwner(context, resolveOwnerFn))
+        return true;
+    const checkRoleFn = deps.checkSenderRole ?? defaultCheckSenderRole;
+    try {
+        const role = await checkRoleFn(context.runtime, context.message);
+        return role?.isOwner === true || role?.isAdmin === true;
+    }
+    catch {
+        return false;
+    }
+}

package/packages/app-core/src/runtime/plugin-manager-guard.d.ts

@@ -1,12 +0,0 @@
-/**
- * Auto-enable `@elizaos/plugin-plugin-manager` via `plugins.allow` so the
- * dashboard "Install Plugin" flow works. The plugin is bundled but optional
- * (see OPTIONAL_CORE_PLUGINS in the agent runtime).
- *
- * Skipped when `ELIZA_DISABLE_PLUGIN_MANAGER_AUTO_ENABLE=1` is set.
- */
-export declare const PLUGIN_MANAGER_UNAVAILABLE_ERROR = "Plugin manager service not found";
-export type PluginManagerGuardResult = "enabled" | "already-enabled" | "disabled-by-user" | "disabled-by-env" | "error";
-export declare function getPluginManagerBlockReason(result: PluginManagerGuardResult): string | null;
-export declare function ensurePluginManagerAllowed(): Promise<PluginManagerGuardResult>;
-//# sourceMappingURL=plugin-manager-guard.d.ts.map

package/packages/app-core/src/runtime/plugin-manager-guard.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin-manager-guard.d.ts","sourceRoot":"","sources":["../../../../../../app-core/src/runtime/plugin-manager-guard.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,eAAO,MAAM,gCAAgC,qCACT,CAAC;AAErC,MAAM,MAAM,wBAAwB,GAChC,SAAS,GACT,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,OAAO,CAAC;AAEZ,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,wBAAwB,GAC/B,MAAM,GAAG,IAAI,CAQf;AAED,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,wBAAwB,CAAC,CA4DpF"}