@elizaos/agent 2.0.0-alpha.98 → 2.0.0-beta.2

package/packages/agent/src/runtime/release-plugin-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-plugin-policy.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/release-plugin-policy.ts"],"names":[],"mappings":"AA2BA,MAAM,MAAM,4BAA4B,GAAG,SAAS,GAAG,KAAK,CAAC;AAC7D,MAAM,MAAM,iCAAiC,GAAG,SAAS,GAAG,cAAc,CAAC;AAE3E,MAAM,WAAW,kCAAkC;IACjD,mBAAmB,EAAE,iCAAiC,CAAC;IACvD,cAAc,EAAE,4BAA4B,CAAC;IAC7C,sBAAsB,EAAE,OAAO,CAAC;IAChC,sBAAsB,EAAE,OAAO,CAAC;IAChC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAI9D,CAAC;AAEF,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAKzE;AAED,wBAAgB,yBAAyB,CACvC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,GACtC,MAAM,EAAE,CAKV;AAED,wBAAgB,0BAA0B,CACxC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,GACtC,MAAM,EAAE,CAKV;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,kCAAkC,CA2CrC"}
+{"version":3,"file":"release-plugin-policy.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/release-plugin-policy.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,4BAA4B,GAAG,SAAS,GAAG,KAAK,CAAC;AAC7D,MAAM,MAAM,iCAAiC,GAAG,SAAS,GAAG,cAAc,CAAC;AAE3E,MAAM,WAAW,kCAAkC;IACjD,mBAAmB,EAAE,iCAAiC,CAAC;IACvD,cAAc,EAAE,4BAA4B,CAAC;IAC7C,sBAAsB,EAAE,OAAO,CAAC;IAChC,sBAAsB,EAAE,OAAO,CAAC;IAChC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAK9D,CAAC;AAEF,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAKzE;AAED,wBAAgB,yBAAyB,CACvC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,GACtC,MAAM,EAAE,CAKV;AAED,wBAAgB,0BAA0B,CACxC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,GACtC,MAAM,EAAE,CAKV;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,kCAAkC,CA2CrC"}

package/packages/agent/src/runtime/release-plugin-policy.js

@@ -1,8 +1,7 @@
-import { CORE_PLUGINS } from "./core-plugins";
+import { CORE_PLUGINS, OPTIONAL_CORE_PLUGINS } from "./core-plugins.js";
 const BASELINE_RUNTIME_SUPPORT_PACKAGES = [
     "@elizaos/core",
     "@elizaos/prompts",
-    "@elizaos/tui",
 ];
 const BASELINE_PROVIDER_PLUGINS = [
     "@elizaos/plugin-elizacloud",
@@ -13,16 +12,15 @@ const BASELINE_PROVIDER_PLUGINS = [
 const DESKTOP_RUNTIME_ONLY_PLUGINS = new Set([
     "@elizaos/plugin-browser",
     "@elizaos/plugin-computeruse",
-    "@elizaos/plugin-retake",
 ]);
 const LOCAL_RUNTIME_ONLY_PLUGINS = new Set([
     "@elizaos/plugin-browser",
     "@elizaos/plugin-computeruse",
-    "@elizaos/plugin-retake",
 ]);
 export const BASELINE_BUNDLED_RUNTIME_PACKAGES = [
     ...BASELINE_RUNTIME_SUPPORT_PACKAGES,
     ...CORE_PLUGINS,
+    ...OPTIONAL_CORE_PLUGINS,
     ...BASELINE_PROVIDER_PLUGINS,
 ];
 export function derivePluginIdFromPackageName(packageName) {

package/packages/agent/src/runtime/restart.d.ts

@@ -1,45 +1,9 @@
 /**
- * Restart infrastructure for Eliza.
+ * Restart infrastructure for Eliza — thin re-export of `@elizaos/shared/restart`.
  *
- * Provides a pluggable restart handler so the restart action (and the
- * `/api/agent/restart` endpoint) work in every host environment:
- *
- *   - **CLI** (default): exits with {@link RESTART_EXIT_CODE} (75). The runner
- *     script (`scripts/run-node.mjs`) catches this, rebuilds if source files
- *     changed, and relaunches.
- *   - **Dev-server / API**: the host registers a handler via
- *     {@link setRestartHandler} that stops the current runtime, creates a new
- *     one, and hot-swaps references.
- *   - **Desktop app**: the host registers a handler that calls
- *     `AgentManager.restart()`.
- *
- * @module restart
- */
-/**
- * Special exit code that tells the CLI runner to restart the process.
- * Must stay in sync with `RESTART_EXIT_CODE` in `scripts/run-node.mjs`.
- */
-export declare const RESTART_EXIT_CODE = 75;
-/**
- * A function invoked when a restart is requested.
- *
- * Return a Promise if the restart involves async work (stopping the runtime,
- * creating a new one, etc.). The restart action waits for this to settle
- * before confirming to the user.
- */
-export type RestartHandler = (reason?: string) => void | Promise<void>;
-/**
- * Replace the active restart handler.
- *
- * Call this at startup in non-CLI environments (dev-server, desktop shell) to
- * provide an in-process restart strategy.
- */
-export declare function setRestartHandler(handler: RestartHandler): void;
-/**
- * Trigger a restart.  Delegates to whatever handler is currently registered.
- *
- * Safe to call from the restart action, the API endpoint, or any other code
- * that needs to bounce the agent.
+ * The single source of truth lives in `@elizaos/shared` (browser-safe, no-op
+ * default). This module preserves the historical import path used inside the
+ * agent package so existing imports keep working.
  */
-export declare function requestRestart(reason?: string): void | Promise<void>;
+export { RESTART_EXIT_CODE, type RestartHandler, requestRestart, setRestartHandler, } from "@elizaos/shared";
 //# sourceMappingURL=restart.d.ts.map

package/packages/agent/src/runtime/restart.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"restart.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/restart.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;GAGG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAOvE;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE"}
+{"version":3,"file":"restart.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/restart.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,iBAAiB,EACjB,KAAK,cAAc,EACnB,cAAc,EACd,iBAAiB,GAClB,MAAM,iBAAiB,CAAC"}

package/packages/agent/src/runtime/restart.js

@@ -1,45 +1,8 @@
 /**
- * Restart infrastructure for Eliza.
+ * Restart infrastructure for Eliza — thin re-export of `@elizaos/shared/restart`.
  *
- * Provides a pluggable restart handler so the restart action (and the
- * `/api/agent/restart` endpoint) work in every host environment:
- *
- *   - **CLI** (default): exits with {@link RESTART_EXIT_CODE} (75). The runner
- *     script (`scripts/run-node.mjs`) catches this, rebuilds if source files
- *     changed, and relaunches.
- *   - **Dev-server / API**: the host registers a handler via
- *     {@link setRestartHandler} that stops the current runtime, creates a new
- *     one, and hot-swaps references.
- *   - **Desktop app**: the host registers a handler that calls
- *     `AgentManager.restart()`.
- *
- * @module restart
- */
-import process from "node:process";
-/**
- * Special exit code that tells the CLI runner to restart the process.
- * Must stay in sync with `RESTART_EXIT_CODE` in `scripts/run-node.mjs`.
- */
-export const RESTART_EXIT_CODE = 75;
-// Default handler: exit the process so the CLI runner can relaunch.
-let _handler = () => {
-    process.exit(RESTART_EXIT_CODE);
-};
-/**
- * Replace the active restart handler.
- *
- * Call this at startup in non-CLI environments (dev-server, desktop shell) to
- * provide an in-process restart strategy.
- */
-export function setRestartHandler(handler) {
-    _handler = handler;
-}
-/**
- * Trigger a restart.  Delegates to whatever handler is currently registered.
- *
- * Safe to call from the restart action, the API endpoint, or any other code
- * that needs to bounce the agent.
+ * The single source of truth lives in `@elizaos/shared` (browser-safe, no-op
+ * default). This module preserves the historical import path used inside the
+ * agent package so existing imports keep working.
  */
-export function requestRestart(reason) {
-    return _handler(reason);
-}
+export { RESTART_EXIT_CODE, requestRestart, setRestartHandler, } from "@elizaos/shared";

package/packages/agent/src/runtime/roles/src/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Internal runtime roles capability.
+ *
+ * Provides OWNER / ADMIN / USER / GUEST role hierarchy with:
+ * - Auto-assignment of OWNER to the app user (world owner)
+ * - Connector admin whitelisting (Discord, Telegram, etc.)
+ * - /role command for live role management
+ * - Provider that injects role context for action/provider gating
+ *
+ * Runtime config lives at:
+ *   roles.connectorAdmins = {
+ *     "discord": ["discordUserId1", "discordUserId2"],
+ *     "telegram": ["telegramUserId1"]
+ *   }
+ */
+import { type Plugin, roleAction } from "@elizaos/core";
+export { rolesProvider } from "./provider.ts";
+export type { ConnectorAdminWhitelist, RoleCheckResult, RoleGrantSource, RoleName, RolesConfig, RolesWorldMetadata, } from "./types.ts";
+export { ROLE_RANK } from "./types.ts";
+export { canModifyRole, checkSenderPrivateAccess, checkSenderRole, getConfiguredOwnerEntityIds, getConnectorAdminWhitelist, getEntityRole, hasConfiguredCanonicalOwner, matchEntityToConnectorAdminWhitelist, normalizeRole, resolveCanonicalOwnerId, resolveCanonicalOwnerIdForMessage, resolveEntityRole, resolveWorldForMessage, setConnectorAdminWhitelist, setEntityRole, } from "./utils.ts";
+export { roleAction };
+declare const rolesPlugin: Plugin;
+export default rolesPlugin;
+//# sourceMappingURL=index.d.ts.map

package/packages/agent/src/runtime/roles/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/runtime/roles/src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAGL,KAAK,MAAM,EACX,UAAU,EACX,MAAM,eAAe,CAAC;AAoBvB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,YAAY,EACV,uBAAuB,EACvB,eAAe,EACf,eAAe,EACf,QAAQ,EACR,WAAW,EACX,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EACL,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,2BAA2B,EAC3B,0BAA0B,EAC1B,aAAa,EACb,2BAA2B,EAC3B,oCAAoC,EACpC,aAAa,EACb,uBAAuB,EACvB,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,CAAC;AAkRtB,QAAA,MAAM,WAAW,EAAE,MA4ClB,CAAC;AAEF,eAAe,WAAW,CAAC"}

package/packages/agent/src/runtime/roles/src/index.js

@@ -0,0 +1,255 @@
+/**
+ * Internal runtime roles capability.
+ *
+ * Provides OWNER / ADMIN / USER / GUEST role hierarchy with:
+ * - Auto-assignment of OWNER to the app user (world owner)
+ * - Connector admin whitelisting (Discord, Telegram, etc.)
+ * - /role command for live role management
+ * - Provider that injects role context for action/provider gating
+ *
+ * Runtime config lives at:
+ *   roles.connectorAdmins = {
+ *     "discord": ["discordUserId1", "discordUserId2"],
+ *     "telegram": ["telegramUserId1"]
+ *   }
+ */
+import { logger, roleAction, } from "@elizaos/core";
+import { rolesProvider } from "./provider.js";
+import { hasConfiguredCanonicalOwner, matchEntityToConnectorAdminWhitelist, normalizeRole, resolveCanonicalOwnerId, } from "./utils.js";
+const BOOTSTRAP_RETRY_TIMERS_KEY = Symbol.for("@elizaos/runtime.roles.bootstrapRetries");
+const BOOTSTRAP_RETRY_LIMIT = 3;
+const CONNECTOR_ADMINS_SETTING_KEY = "ELIZA_ROLES_CONNECTOR_ADMINS_JSON";
+export { rolesProvider } from "./provider.js";
+export { ROLE_RANK } from "./types.js";
+export { canModifyRole, checkSenderPrivateAccess, checkSenderRole, getConfiguredOwnerEntityIds, getConnectorAdminWhitelist, getEntityRole, hasConfiguredCanonicalOwner, matchEntityToConnectorAdminWhitelist, normalizeRole, resolveCanonicalOwnerId, resolveCanonicalOwnerIdForMessage, resolveEntityRole, resolveWorldForMessage, setConnectorAdminWhitelist, setEntityRole, } from "./utils.js";
+export { roleAction };
+async function updateWorldMetadata(runtime, worldId, update) {
+    const world = await runtime.getWorld(worldId);
+    if (!world)
+        return;
+    const metadata = (world.metadata ?? {});
+    const changed = await update(metadata);
+    if (!changed)
+        return;
+    world.metadata = metadata;
+    await runtime.updateWorld(world);
+}
+function getBootstrapRetryTimers(runtime) {
+    const runtimeWithBootstrapRetries = runtime;
+    runtimeWithBootstrapRetries[BOOTSTRAP_RETRY_TIMERS_KEY] ??= new Map();
+    return runtimeWithBootstrapRetries[BOOTSTRAP_RETRY_TIMERS_KEY];
+}
+function scheduleBootstrapRetry(runtime, label, task, attempt = 1) {
+    const timers = getBootstrapRetryTimers(runtime);
+    const existingTimer = timers.get(label);
+    if (existingTimer) {
+        clearTimeout(existingTimer);
+    }
+    const delayMs = Math.min(1500 * attempt, 5000);
+    const timer = setTimeout(() => {
+        timers.delete(label);
+        void task().then((ok) => {
+            if (ok) {
+                return;
+            }
+            if (attempt >= BOOTSTRAP_RETRY_LIMIT) {
+                logger.warn(`[roles] ${label} retries exhausted because runtime state is still unavailable`);
+                return;
+            }
+            logger.info(`[roles] ${label} retry ${attempt} skipped because runtime state is still unavailable`);
+            scheduleBootstrapRetry(runtime, label, task, attempt + 1);
+        });
+    }, delayMs);
+    timers.set(label, timer);
+}
+function isExpectedRuntimeStateBootstrapError(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return (/Failed query:\s*select\b.*\bfrom "worlds"/i.test(message) ||
+        /relation .*worlds.*does not exist/i.test(message) ||
+        /no such table:?\s*worlds/i.test(message));
+}
+function logRuntimeStateBootstrapDeferral(label, err) {
+    if (isExpectedRuntimeStateBootstrapError(err)) {
+        logger.info(`[roles] Deferring ${label} bootstrap until runtime worlds are available`);
+        return;
+    }
+    logger.info(`[roles] Deferring ${label} bootstrap until runtime worlds are available: ${String(err)}`);
+}
+/**
+ * Ensure the world owner has OWNER role in metadata.
+ * Called on plugin init — guarantees the app-local user is always OWNER.
+ */
+async function ensureOwnerRole(runtime, opts) {
+    try {
+        const worlds = await runtime.getAllWorlds();
+        for (const world of worlds) {
+            if (!world.id)
+                continue;
+            await updateWorldMetadata(runtime, world.id, (metadata) => {
+                const ownerId = resolveCanonicalOwnerId(runtime, metadata);
+                if (!ownerId)
+                    return false;
+                let changed = false;
+                metadata.ownership ??= {};
+                metadata.roleSources ??= {};
+                if (metadata.ownership.ownerId !== ownerId) {
+                    metadata.ownership.ownerId = ownerId;
+                    changed = true;
+                }
+                if (!metadata.roles)
+                    metadata.roles = {};
+                if (normalizeRole(metadata.roles[ownerId]) !== "OWNER") {
+                    metadata.roles[ownerId] = "OWNER";
+                    changed = true;
+                }
+                if (metadata.roleSources[ownerId] !== "owner") {
+                    metadata.roleSources[ownerId] = "owner";
+                    changed = true;
+                }
+                if (hasConfiguredCanonicalOwner(runtime)) {
+                    for (const [entityId, role] of Object.entries(metadata.roles)) {
+                        if (entityId !== ownerId && normalizeRole(role) === "OWNER") {
+                            delete metadata.roles[entityId];
+                            delete metadata.roleSources?.[entityId];
+                            changed = true;
+                        }
+                    }
+                }
+                if (opts?.pruneConnectorAdmins) {
+                    for (const [entityId, source] of Object.entries(metadata.roleSources)) {
+                        if (source !== "connector_admin")
+                            continue;
+                        delete metadata.roleSources[entityId];
+                        delete metadata.roles[entityId];
+                        changed = true;
+                        logger.info(`[roles] Cleared connector-admin grant ${entityId} because no whitelist is configured`);
+                    }
+                }
+                if (changed) {
+                    logger.info(`[roles] Synced canonical OWNER ${ownerId} in world ${world.id}`);
+                }
+                return changed;
+            });
+        }
+        return true;
+    }
+    catch (err) {
+        logRuntimeStateBootstrapDeferral("owner role", err);
+        return false;
+    }
+}
+/**
+ * Apply connector admin whitelists from config.
+ * Scans worlds for entities matching whitelisted IDs, promotes them to ADMIN,
+ * and removes stale connector_admin grants that no longer match.
+ */
+async function applyConnectorAdminWhitelists(runtime, whitelist) {
+    try {
+        const worlds = await runtime.getAllWorlds();
+        for (const world of worlds) {
+            if (!world.id)
+                continue;
+            const rooms = await runtime.getRooms(world.id);
+            await updateWorldMetadata(runtime, world.id, async (metadata) => {
+                if (!metadata.roles)
+                    metadata.roles = {};
+                metadata.roleSources ??= {};
+                let updated = false;
+                const matchedEntityIds = new Set();
+                for (const room of rooms) {
+                    const entities = await runtime.getEntitiesForRoom(room.id);
+                    for (const entity of entities) {
+                        if (!entity?.id)
+                            continue;
+                        const entityId = entity.id;
+                        if (metadata.roles[entityId])
+                            continue;
+                        const matched = matchEntityToConnectorAdminWhitelist(entity.metadata ??
+                            undefined, whitelist);
+                        if (matched) {
+                            matchedEntityIds.add(entityId);
+                            if (metadata.roleSources[entityId] === "connector_admin" &&
+                                normalizeRole(metadata.roles[entityId]) === "ADMIN") {
+                                continue;
+                            }
+                            if (typeof metadata.roles[entityId] === "string") {
+                                continue;
+                            }
+                            metadata.roles[entityId] = "ADMIN";
+                            metadata.roleSources[entityId] = "connector_admin";
+                            updated = true;
+                            logger.info(`[roles] Auto-promoted whitelisted entity ${entityId} to ADMIN`);
+                        }
+                    }
+                }
+                for (const [entityId, source] of Object.entries(metadata.roleSources)) {
+                    if (source !== "connector_admin")
+                        continue;
+                    if (matchedEntityIds.has(entityId))
+                        continue;
+                    delete metadata.roleSources[entityId];
+                    delete metadata.roles[entityId];
+                    updated = true;
+                    logger.info(`[roles] Revoked stale connector-admin role for entity ${entityId}`);
+                }
+                return updated;
+            });
+        }
+        return true;
+    }
+    catch (err) {
+        logRuntimeStateBootstrapDeferral("connector admin", err);
+        return false;
+    }
+}
+function loadConnectorAdminsConfig(pluginConfig, runtime) {
+    const directConfig = pluginConfig;
+    if (directConfig?.connectorAdmins) {
+        return directConfig;
+    }
+    const raw = typeof runtime.getSetting === "function"
+        ? runtime.getSetting(CONNECTOR_ADMINS_SETTING_KEY)
+        : undefined;
+    if (typeof raw !== "string" || raw.trim().length === 0) {
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        return { connectorAdmins: parsed };
+    }
+    catch (error) {
+        logger.warn(`[roles] Failed to parse ${CONNECTOR_ADMINS_SETTING_KEY}: ${String(error)}`);
+        return {};
+    }
+}
+const rolesPlugin = {
+    name: "roles",
+    description: "Role-based access control — OWNER/ADMIN/USER/GUEST hierarchy with " +
+        "connector whitelisting and /role command.",
+    providers: [rolesProvider],
+    actions: [roleAction],
+    async init(pluginConfig, runtime) {
+        logger.info("[roles] Initializing roles");
+        const config = loadConnectorAdminsConfig(pluginConfig, runtime);
+        const connectorAdmins = config?.connectorAdmins ?? {};
+        const hasConnectorAdmins = Object.values(connectorAdmins).some((ids) => ids.length > 0);
+        // Step 1: Ensure world owners have OWNER role
+        const ownerBootstrapOk = await ensureOwnerRole(runtime, {
+            pruneConnectorAdmins: !hasConnectorAdmins,
+        });
+        if (!ownerBootstrapOk) {
+            scheduleBootstrapRetry(runtime, "Owner role bootstrap", () => ensureOwnerRole(runtime, {
+                pruneConnectorAdmins: !hasConnectorAdmins,
+            }));
+        }
+        // Step 2: Apply connector admin whitelists if configured
+        if (hasConnectorAdmins) {
+            const adminBootstrapOk = await applyConnectorAdminWhitelists(runtime, connectorAdmins);
+            if (!adminBootstrapOk) {
+                scheduleBootstrapRetry(runtime, "Connector admin bootstrap", () => applyConnectorAdminWhitelists(runtime, connectorAdmins));
+            }
+        }
+        logger.info("[roles] Roles initialized");
+    },
+};
+export default rolesPlugin;

package/packages/agent/src/runtime/roles/src/provider.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Roles provider — injects the current speaker's role and the server role
+ * hierarchy into the agent's context so actions/providers can be gated.
+ */
+import { type Provider } from "@elizaos/core";
+export declare const rolesProvider: Provider;
+//# sourceMappingURL=provider.d.ts.map

package/packages/agent/src/runtime/roles/src/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../../../../../src/runtime/roles/src/provider.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAIL,KAAK,QAAQ,EAId,MAAM,eAAe,CAAC;AAYvB,eAAO,MAAM,aAAa,EAAE,QA4I3B,CAAC"}

package/packages/agent/src/runtime/roles/src/provider.js

@@ -0,0 +1,138 @@
+/**
+ * Roles provider — injects the current speaker's role and the server role
+ * hierarchy into the agent's context so actions/providers can be gated.
+ */
+import { logger, } from "@elizaos/core";
+import { hasAdminAccess } from "../../../security/access.js";
+import { getEntityRole, getLiveEntityMetadataFromMessage, hasConfiguredCanonicalOwner, normalizeRole, resolveCanonicalOwnerId, resolveEntityRole, } from "./utils.js";
+export const rolesProvider = {
+    name: "roles",
+    description: "Provides the current speaker's role and the server role hierarchy. " +
+        "Use this to gate actions and decide what a user is allowed to do.",
+    dynamic: true,
+    position: 10,
+    contexts: ["admin", "settings"],
+    contextGate: { anyOf: ["admin", "settings"] },
+    cacheStable: false,
+    cacheScope: "turn",
+    roleGate: { minRole: "ADMIN" },
+    async get(runtime, message, _state) {
+        const room = await runtime.getRoom(message.roomId);
+        if (!room) {
+            return empty();
+        }
+        if (!room.worldId) {
+            return empty();
+        }
+        const world = await runtime.getWorld(room.worldId);
+        if (!world) {
+            return empty();
+        }
+        const metadata = (world.metadata ?? {});
+        const speakerRole = await resolveEntityRole(runtime, world, metadata, message.entityId, {
+            liveEntityMetadata: getLiveEntityMetadataFromMessage(message),
+        });
+        const storedSpeakerRole = getEntityRole(metadata, message.entityId);
+        const roles = { ...(metadata.roles ?? {}) };
+        const canonicalOwnerId = resolveCanonicalOwnerId(runtime, metadata);
+        const canSeeRoleRoster = await hasAdminAccess(runtime, message);
+        if (hasConfiguredCanonicalOwner(runtime) && canonicalOwnerId) {
+            for (const [entityId, role] of Object.entries(roles)) {
+                if (entityId !== canonicalOwnerId && normalizeRole(role) === "OWNER") {
+                    delete roles[entityId];
+                }
+            }
+            roles[canonicalOwnerId] = "OWNER";
+        }
+        if (speakerRole !== storedSpeakerRole) {
+            if (speakerRole === "GUEST") {
+                delete roles[message.entityId];
+            }
+            else {
+                roles[message.entityId] = speakerRole;
+            }
+        }
+        // Build a compact role summary for the agent context.
+        const owners = [];
+        const admins = [];
+        const users = [];
+        for (const [entityId, role] of Object.entries(roles)) {
+            const normalized = normalizeRole(role);
+            if (normalized === "OWNER")
+                owners.push(entityId);
+            else if (normalized === "ADMIN")
+                admins.push(entityId);
+            else if (normalized === "USER")
+                users.push(entityId);
+            // GUEST entities are not listed — they're the default
+        }
+        // Resolve display names where possible (best-effort, no hard failures).
+        const resolveNames = async (ids) => {
+            const results = [];
+            for (const id of ids) {
+                try {
+                    const entity = await runtime.getEntityById(id);
+                    const name = entity?.names?.[0] ??
+                        entity?.metadata?.default?.name ??
+                        id.slice(0, 8);
+                    results.push(name);
+                }
+                catch {
+                    results.push(id.slice(0, 8));
+                }
+            }
+            return results;
+        };
+        const ownerNames = canSeeRoleRoster ? await resolveNames(owners) : [];
+        const adminNames = canSeeRoleRoster ? await resolveNames(admins) : [];
+        const userNames = canSeeRoleRoster ? await resolveNames(users) : [];
+        let text = `## Roles\n`;
+        text += `Current speaker role: **${speakerRole}**\n`;
+        if (canSeeRoleRoster && ownerNames.length > 0) {
+            text += `Owners: ${ownerNames.join(", ")}\n`;
+        }
+        if (canSeeRoleRoster && adminNames.length > 0) {
+            text += `Admins: ${adminNames.join(", ")}\n`;
+        }
+        if (canSeeRoleRoster && userNames.length > 0) {
+            text += `Users: ${userNames.join(", ")}\n`;
+        }
+        const canManage = speakerRole === "OWNER" || speakerRole === "ADMIN";
+        logger.debug(`[roles] Speaker ${message.entityId} role=${speakerRole} canManage=${canManage}`);
+        return {
+            text,
+            values: {
+                speakerRole,
+                canManageRoles: canManage,
+                ownerCount: canSeeRoleRoster ? owners.length : 0,
+                adminCount: canSeeRoleRoster ? admins.length : 0,
+                userCount: canSeeRoleRoster ? users.length : 0,
+            },
+            data: {
+                speakerRole,
+                canManageRoles: canManage,
+                owners: canSeeRoleRoster ? owners : [],
+                admins: canSeeRoleRoster ? admins : [],
+                users: canSeeRoleRoster ? users : [],
+                roles: canSeeRoleRoster ? roles : {},
+            },
+        };
+    },
+};
+function empty() {
+    return {
+        text: "",
+        values: {
+            speakerRole: "GUEST",
+            canManageRoles: false,
+        },
+        data: {
+            speakerRole: "GUEST",
+            canManageRoles: false,
+            owners: [],
+            admins: [],
+            users: [],
+            roles: {},
+        },
+    };
+}

package/packages/agent/src/runtime/roles/src/types.d.ts

@@ -0,0 +1,3 @@
+export type { ConnectorAdminWhitelist, RoleCheckResult, RoleGrantSource, RoleName, RolesConfig, RolesWorldMetadata, } from "@elizaos/core";
+export { ROLE_RANK } from "@elizaos/core";
+//# sourceMappingURL=types.d.ts.map

package/packages/agent/src/runtime/roles/src/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../../src/runtime/roles/src/types.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,uBAAuB,EACvB,eAAe,EACf,eAAe,EACf,QAAQ,EACR,WAAW,EACX,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC"}

package/packages/agent/src/runtime/roles/src/types.js

@@ -0,0 +1 @@
+export { ROLE_RANK } from "@elizaos/core";

package/packages/agent/src/runtime/roles/src/utils.d.ts

@@ -0,0 +1,2 @@
+export { canModifyRole, checkSenderPrivateAccess, checkSenderRole, getConfiguredOwnerEntityIds, getConnectorAdminWhitelist, getEntityRole, getLiveEntityMetadataFromMessage, hasConfiguredCanonicalOwner, matchEntityToConnectorAdminWhitelist, normalizeRole, resolveCanonicalOwnerId, resolveCanonicalOwnerIdForMessage, resolveEntityRole, resolveWorldForMessage, setConnectorAdminWhitelist, setEntityRole, } from "@elizaos/core";
+//# sourceMappingURL=utils.d.ts.map

package/packages/agent/src/runtime/roles/src/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/runtime/roles/src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,2BAA2B,EAC3B,0BAA0B,EAC1B,aAAa,EACb,gCAAgC,EAChC,2BAA2B,EAC3B,oCAAoC,EACpC,aAAa,EACb,uBAAuB,EACvB,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,EACtB,0BAA0B,EAC1B,aAAa,GACd,MAAM,eAAe,CAAC"}

package/packages/agent/src/runtime/roles/src/utils.js

@@ -0,0 +1 @@
+export { canModifyRole, checkSenderPrivateAccess, checkSenderRole, getConfiguredOwnerEntityIds, getConnectorAdminWhitelist, getEntityRole, getLiveEntityMetadataFromMessage, hasConfiguredCanonicalOwner, matchEntityToConnectorAdminWhitelist, normalizeRole, resolveCanonicalOwnerId, resolveCanonicalOwnerIdForMessage, resolveEntityRole, resolveWorldForMessage, setConnectorAdminWhitelist, setEntityRole, } from "@elizaos/core";

package/packages/agent/src/runtime/roles.d.ts

@@ -0,0 +1,3 @@
+export * from "./roles/src/index.ts";
+export { default } from "./roles/src/index.ts";
+//# sourceMappingURL=roles.d.ts.map

package/packages/agent/src/runtime/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/roles.ts"],"names":[],"mappings":"AAIA,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC"}

package/packages/agent/src/runtime/roles.js

@@ -0,0 +1,5 @@
+// Canonical roles plugin barrel used by runtime bootstrap and internal imports.
+// Keep this pointed at the in-repo implementation so the runtime, tests, and
+// helper exports all share the same contract.
+export * from "./roles/src/index.js";
+export { default } from "./roles/src/index.js";