@elizaos/agent 2.0.0-alpha.98 → 2.0.0-beta.2

package/packages/agent/src/services/permissions/probers/notes.js

@@ -0,0 +1,55 @@
+/**
+ * Notes prober.
+ *
+ * Notes.app is automation-only — there's no NotesKit framework. We probe
+ * via TCC's automation service: kTCCServiceAppleEvents with the Notes
+ * bundle id (`com.apple.Notes`) as the indirect_object_identifier.
+ *
+ * The TCC.db row for Apple Events lives in the `access` table with a
+ * composite key, so the simple bundle-id query in `_bridge.queryTccStatus`
+ * doesn't quite fit. We fall back to AppleScript and treat a successful
+ * round-trip as "granted".
+ *
+ * NOTE: This prober is scoped to Notes.app specifically. The general
+ * `automation` prober probes a different target (System Events). We keep
+ * them separate because the user can grant one without the other.
+ */
+import { buildState, IS_DARWIN, platformUnsupportedState, runOsascript, } from "./_bridge.js";
+const ID = "notes";
+async function probeNotesAccess() {
+    // Read-only probe: count notes folders. AppleScript returns:
+    //   - a number on success (granted)
+    //   - errors with code -1743 (not-allowed by user) when denied
+    //   - errors with code -600 / launch failures when not-determined
+    const result = await runOsascript('try\n  tell application "Notes" to count of folders\non error errMsg number errNum\n  return "ERR:" & errNum\nend try');
+    if (result === null)
+        return "not-determined";
+    if (result.startsWith("ERR:")) {
+        const num = parseInt(result.slice(4), 10);
+        // -1743 = "Not authorized to send Apple events"
+        // -10004 = "Privilege violation"
+        if (num === -1743 || num === -10004)
+            return "denied";
+        return "not-determined";
+    }
+    return "granted";
+}
+export const notesProber = {
+    id: ID,
+    async check() {
+        if (!IS_DARWIN)
+            return platformUnsupportedState(ID);
+        const status = await probeNotesAccess();
+        return buildState(ID, status, { canRequest: status === "not-determined" });
+    },
+    async request({ reason: _reason }) {
+        if (!IS_DARWIN)
+            return platformUnsupportedState(ID);
+        // Same shellout — the act of running it triggers the TCC prompt.
+        const status = await probeNotesAccess();
+        return buildState(ID, status, {
+            canRequest: status === "not-determined",
+            lastRequested: Date.now(),
+        });
+    },
+};

package/packages/agent/src/services/permissions/probers/notifications.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Notifications prober.
+ *
+ * Native APIs (macOS):
+ *   - check:   UNUserNotificationCenter.current().getNotificationSettings { settings.authorizationStatus }
+ *   - request: UNUserNotificationCenter.current().requestAuthorization(options:)
+ *
+ * UNUserNotificationCenter requires the running binary to be a properly
+ * signed app bundle with `NSUserNotificationAlertStyle` in Info.plist. In
+ * unsigned dev, the API silently returns notDetermined forever.
+ *
+ * No FFI binding yet — we shell out to `osascript -e 'display
+ * notification ...'` as a no-op probe for `request`, and report
+ * not-determined for `check` because we have no read-only path.
+ *
+ * INTEGRATION TODO: FFI to UNUserNotificationCenter, gated on whether the
+ * runtime is launched from a signed app bundle.
+ *
+ * On win32/linux, concrete notification state is supplied by the renderer
+ * fallback through Notification.permission.
+ */
+import type { Prober } from "../contracts.js";
+export declare const notificationsProber: Prober;
+//# sourceMappingURL=notifications.d.ts.map

package/packages/agent/src/services/permissions/probers/notifications.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../../../../../../../src/services/permissions/probers/notifications.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAmB,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAK/D,eAAO,MAAM,mBAAmB,EAAE,MAyBjC,CAAC"}

package/packages/agent/src/services/permissions/probers/notifications.js

@@ -0,0 +1,47 @@
+/**
+ * Notifications prober.
+ *
+ * Native APIs (macOS):
+ *   - check:   UNUserNotificationCenter.current().getNotificationSettings { settings.authorizationStatus }
+ *   - request: UNUserNotificationCenter.current().requestAuthorization(options:)
+ *
+ * UNUserNotificationCenter requires the running binary to be a properly
+ * signed app bundle with `NSUserNotificationAlertStyle` in Info.plist. In
+ * unsigned dev, the API silently returns notDetermined forever.
+ *
+ * No FFI binding yet — we shell out to `osascript -e 'display
+ * notification ...'` as a no-op probe for `request`, and report
+ * not-determined for `check` because we have no read-only path.
+ *
+ * INTEGRATION TODO: FFI to UNUserNotificationCenter, gated on whether the
+ * runtime is launched from a signed app bundle.
+ *
+ * On win32/linux, concrete notification state is supplied by the renderer
+ * fallback through Notification.permission.
+ */
+import { buildState, IS_DARWIN, runOsascript } from "./_bridge.js";
+const ID = "notifications";
+export const notificationsProber = {
+    id: ID,
+    async check() {
+        if (!IS_DARWIN) {
+            // Renderer fallback handles Notification.permission.
+            return buildState(ID, "not-determined", { canRequest: true });
+        }
+        // No read-only path without UNUserNotificationCenter. Defer.
+        return buildState(ID, "not-determined", { canRequest: true });
+    },
+    async request({ reason: _reason }) {
+        if (!IS_DARWIN) {
+            return buildState(ID, "not-determined", { canRequest: true });
+        }
+        // Issue a benign notification to surface the consent dialog.
+        // Whether macOS actually prompts depends on the bundle being
+        // signed; in dev this is a silent no-op.
+        await runOsascript('display notification "" with title ""');
+        return buildState(ID, "not-determined", {
+            canRequest: true,
+            lastRequested: Date.now(),
+        });
+    },
+};

package/packages/agent/src/services/permissions/probers/reminders.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Reminders prober.
+ *
+ * Native APIs (macOS):
+ *   - check:   EKEventStore.authorizationStatus(for: .reminder)
+ *   - request: EKEventStore.requestFullAccessToReminders (macOS 14+) or
+ *              .requestAccess(to: .reminder) (older)
+ *
+ * We don't have an FFI binding for EventKit yet, so we use TCC.db reads
+ * for the check path (service: kTCCServiceReminders) and an osascript
+ * shellout to trigger the prompt for the request path. The osascript
+ * targets Reminders.app — since macOS 14 split this into "reminders" and
+ * "calendar" TCC services, we read kTCCServiceReminders explicitly.
+ *
+ * INTEGRATION TODO: ship a small Swift FFI that calls
+ * `EKEventStore.authorizationStatus(for: .reminder)` directly. The osascript
+ * approach can race with TCC.db caching. See `accessibility.ts` for the
+ * pattern.
+ */
+import type { Prober } from "../contracts.js";
+export declare const remindersProber: Prober;
+//# sourceMappingURL=reminders.d.ts.map

package/packages/agent/src/services/permissions/probers/reminders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reminders.d.ts","sourceRoot":"","sources":["../../../../../../../src/services/permissions/probers/reminders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAmB,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAY/D,eAAO,MAAM,eAAe,EAAE,MAuB7B,CAAC"}

package/packages/agent/src/services/permissions/probers/reminders.js

@@ -0,0 +1,44 @@
+/**
+ * Reminders prober.
+ *
+ * Native APIs (macOS):
+ *   - check:   EKEventStore.authorizationStatus(for: .reminder)
+ *   - request: EKEventStore.requestFullAccessToReminders (macOS 14+) or
+ *              .requestAccess(to: .reminder) (older)
+ *
+ * We don't have an FFI binding for EventKit yet, so we use TCC.db reads
+ * for the check path (service: kTCCServiceReminders) and an osascript
+ * shellout to trigger the prompt for the request path. The osascript
+ * targets Reminders.app — since macOS 14 split this into "reminders" and
+ * "calendar" TCC services, we read kTCCServiceReminders explicitly.
+ *
+ * INTEGRATION TODO: ship a small Swift FFI that calls
+ * `EKEventStore.authorizationStatus(for: .reminder)` directly. The osascript
+ * approach can race with TCC.db caching. See `accessibility.ts` for the
+ * pattern.
+ */
+import { buildState, IS_DARWIN, platformUnsupportedState, queryTccStatus, resolveBundleId, runOsascript, } from "./_bridge.js";
+const ID = "reminders";
+export const remindersProber = {
+    id: ID,
+    async check() {
+        if (!IS_DARWIN)
+            return platformUnsupportedState(ID);
+        const tcc = await queryTccStatus("kTCCServiceReminders", resolveBundleId());
+        if (tcc === "granted")
+            return buildState(ID, "granted", { canRequest: false });
+        if (tcc === "denied")
+            return buildState(ID, "denied", { canRequest: false });
+        return buildState(ID, "not-determined", { canRequest: true });
+    },
+    async request({ reason: _reason }) {
+        if (!IS_DARWIN)
+            return platformUnsupportedState(ID);
+        // Trigger the OS prompt by issuing a benign read against Reminders.
+        // `count of lists` is read-only; macOS will surface the consent
+        // dialog the first time the runtime calls this.
+        await runOsascript('tell application "Reminders" to count of lists');
+        const state = await remindersProber.check();
+        return { ...state, lastRequested: Date.now() };
+    },
+};

package/packages/agent/src/services/permissions/probers/screen-recording.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Screen Recording prober.
+ *
+ * Native APIs:
+ *   - check:   CGPreflightScreenCaptureAccess()  (via libMacWindowEffects.dylib)
+ *   - request: CGRequestScreenCaptureAccess()
+ *
+ * Like Accessibility, the OS doesn't grant this from a prompt — once
+ * `CGRequestScreenCaptureAccess()` returns false the user must toggle the
+ * app in System Settings → Privacy & Security → Screen Recording. After
+ * toggling, the app must restart to pick up the new state.
+ */
+import type { Prober } from "../contracts.js";
+export declare const screenRecordingProber: Prober;
+//# sourceMappingURL=screen-recording.d.ts.map

package/packages/agent/src/services/permissions/probers/screen-recording.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"screen-recording.d.ts","sourceRoot":"","sources":["../../../../../../../src/services/permissions/probers/screen-recording.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAmB,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAY/D,eAAO,MAAM,qBAAqB,EAAE,MA4BnC,CAAC"}

package/packages/agent/src/services/permissions/probers/screen-recording.js

@@ -0,0 +1,39 @@
+/**
+ * Screen Recording prober.
+ *
+ * Native APIs:
+ *   - check:   CGPreflightScreenCaptureAccess()  (via libMacWindowEffects.dylib)
+ *   - request: CGRequestScreenCaptureAccess()
+ *
+ * Like Accessibility, the OS doesn't grant this from a prompt — once
+ * `CGRequestScreenCaptureAccess()` returns false the user must toggle the
+ * app in System Settings → Privacy & Security → Screen Recording. After
+ * toggling, the app must restart to pick up the new state.
+ */
+import { buildState, getNativeDylib, IS_DARWIN, platformUnsupportedState, queryTccStatus, resolveBundleId, } from "./_bridge.js";
+const ID = "screen-recording";
+export const screenRecordingProber = {
+    id: ID,
+    async check() {
+        if (!IS_DARWIN)
+            return platformUnsupportedState(ID);
+        const lib = await getNativeDylib();
+        const granted = lib?.checkScreenRecordingPermission() ?? false;
+        if (granted)
+            return buildState(ID, "granted", { canRequest: false });
+        const tcc = await queryTccStatus("kTCCServiceScreenCapture", resolveBundleId());
+        if (tcc === "granted")
+            return buildState(ID, "granted", { canRequest: false });
+        if (tcc === "denied")
+            return buildState(ID, "denied", { canRequest: false });
+        return buildState(ID, "not-determined", { canRequest: true });
+    },
+    async request({ reason: _reason }) {
+        if (!IS_DARWIN)
+            return platformUnsupportedState(ID);
+        const lib = await getNativeDylib();
+        lib?.requestScreenRecordingPermission();
+        const state = await screenRecordingProber.check();
+        return { ...state, lastRequested: Date.now() };
+    },
+};

package/packages/agent/src/services/permissions/probers/screentime.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Screen Time prober.
+ *
+ * Native APIs (macOS 12+):
+ *   - STScreenTimeConfigurationObserver
+ *   - AuthorizationCenter.shared.requestAuthorization(for: .individual)
+ *
+ * Screen Time is gated by the FamilyControls entitlement
+ * (`com.apple.developer.family-controls`) which Apple grants only to
+ * approved apps. The Milady dev build doesn't have it, so we report
+ * `restricted/entitlement_required`.
+ *
+ * The mobile-signals plugin already exposes a more elaborate Screen Time
+ * status object on iOS — see
+ * `eliza/packages/native-plugins/mobile-signals/ios/.../ScreenTimeSupport.swift`.
+ * On macOS we mirror its philosophy: detect the entitlement, refuse to
+ * attempt the framework call without it.
+ */
+import type { Prober } from "../contracts.js";
+export declare const screentimeProber: Prober;
+//# sourceMappingURL=screentime.d.ts.map

package/packages/agent/src/services/permissions/probers/screentime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"screentime.d.ts","sourceRoot":"","sources":["../../../../../../../src/services/permissions/probers/screentime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,KAAK,EAAmB,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAkB/D,eAAO,MAAM,gBAAgB,EAAE,MA8B9B,CAAC"}

package/packages/agent/src/services/permissions/probers/screentime.js

@@ -0,0 +1,67 @@
+/**
+ * Screen Time prober.
+ *
+ * Native APIs (macOS 12+):
+ *   - STScreenTimeConfigurationObserver
+ *   - AuthorizationCenter.shared.requestAuthorization(for: .individual)
+ *
+ * Screen Time is gated by the FamilyControls entitlement
+ * (`com.apple.developer.family-controls`) which Apple grants only to
+ * approved apps. The Milady dev build doesn't have it, so we report
+ * `restricted/entitlement_required`.
+ *
+ * The mobile-signals plugin already exposes a more elaborate Screen Time
+ * status object on iOS — see
+ * `eliza/packages/native-plugins/mobile-signals/ios/.../ScreenTimeSupport.swift`.
+ * On macOS we mirror its philosophy: detect the entitlement, refuse to
+ * attempt the framework call without it.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { buildState, IS_DARWIN, platformUnsupportedState } from "./_bridge.js";
+const ID = "screentime";
+function hasFamilyControlsEntitlement() {
+    try {
+        const macOsDir = path.dirname(path.resolve(process.execPath));
+        const contentsDir = path.resolve(macOsDir, "..");
+        const embedded = path.join(contentsDir, "embedded.provisionprofile");
+        if (!existsSync(embedded))
+            return false;
+        const buf = readFileSync(embedded);
+        return buf.includes(Buffer.from("com.apple.developer.family-controls"));
+    }
+    catch {
+        return false;
+    }
+}
+export const screentimeProber = {
+    id: ID,
+    async check() {
+        if (!IS_DARWIN)
+            return platformUnsupportedState(ID);
+        if (!hasFamilyControlsEntitlement()) {
+            return buildState(ID, "restricted", {
+                canRequest: false,
+                restrictedReason: "entitlement_required",
+            });
+        }
+        // TODO: query STScreenTimeConfigurationObserver via FFI when we
+        // ship the entitlement.
+        return buildState(ID, "not-determined", { canRequest: true });
+    },
+    async request({ reason: _reason }) {
+        if (!IS_DARWIN)
+            return platformUnsupportedState(ID);
+        if (!hasFamilyControlsEntitlement()) {
+            return buildState(ID, "restricted", {
+                canRequest: false,
+                restrictedReason: "entitlement_required",
+                lastRequested: Date.now(),
+            });
+        }
+        return buildState(ID, "not-determined", {
+            canRequest: true,
+            lastRequested: Date.now(),
+        });
+    },
+};

package/packages/agent/src/services/permissions/probers/shell.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Shell access prober.
+ *
+ * Shell execution is app-internal — there's no OS permission for spawning
+ * child processes. We honor an in-app toggle (managed by the existing
+ * `PermissionManager.setShellEnabled` in
+ * `packages/app-core/platforms/electrobun/src/native/permissions.ts`).
+ *
+ * For now, default to `granted` on all platforms. The registry can swap
+ * this with a richer prober that consults the runtime config flag.
+ *
+ * INTEGRATION TODO: when the registry-side wiring lands, expose a hook so
+ * this prober can read the user-toggled `shellEnabled` flag without
+ * importing the Electrobun module (which is a one-way dependency from
+ * agent → app-core that the registry agent should mediate).
+ */
+import type { Prober } from "../contracts.js";
+export declare const shellProber: Prober;
+//# sourceMappingURL=shell.d.ts.map

package/packages/agent/src/services/permissions/probers/shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../../../../../../src/services/permissions/probers/shell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAmB,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAK/D,eAAO,MAAM,WAAW,EAAE,MAczB,CAAC"}

package/packages/agent/src/services/permissions/probers/shell.js

@@ -0,0 +1,31 @@
+/**
+ * Shell access prober.
+ *
+ * Shell execution is app-internal — there's no OS permission for spawning
+ * child processes. We honor an in-app toggle (managed by the existing
+ * `PermissionManager.setShellEnabled` in
+ * `packages/app-core/platforms/electrobun/src/native/permissions.ts`).
+ *
+ * For now, default to `granted` on all platforms. The registry can swap
+ * this with a richer prober that consults the runtime config flag.
+ *
+ * INTEGRATION TODO: when the registry-side wiring lands, expose a hook so
+ * this prober can read the user-toggled `shellEnabled` flag without
+ * importing the Electrobun module (which is a one-way dependency from
+ * agent → app-core that the registry agent should mediate).
+ */
+import { buildState } from "./_bridge.js";
+const ID = "shell";
+export const shellProber = {
+    id: ID,
+    async check() {
+        return buildState(ID, "granted", { canRequest: false });
+    },
+    async request({ reason: _reason }) {
+        // Nothing to request — shell is app-internal.
+        return buildState(ID, "granted", {
+            canRequest: false,
+            lastRequested: Date.now(),
+        });
+    },
+};

package/packages/agent/src/services/permissions/probers/website-blocking.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Website blocking prober.
+ *
+ * App-internal feature — implemented via hosts-file edits / VPN DNS / NE
+ * content blocker depending on platform. There's no OS-level permission
+ * dialog for "may this app block websites" beyond the elevation prompt
+ * the website-blocker plugin issues at block time.
+ *
+ * For the registry's purposes we report `granted` so the plumbing exists,
+ * and let the website-blocker plugin handle the elevation flow at
+ * `startBlock` time. The richer status (requires elevation, hosts file
+ * writable, etc.) lives in `WebsiteBlockerPluginLike.getStatus()`.
+ */
+import type { Prober } from "../contracts.js";
+export declare const websiteBlockingProber: Prober;
+//# sourceMappingURL=website-blocking.d.ts.map

package/packages/agent/src/services/permissions/probers/website-blocking.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"website-blocking.d.ts","sourceRoot":"","sources":["../../../../../../../src/services/permissions/probers/website-blocking.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAmB,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAK/D,eAAO,MAAM,qBAAqB,EAAE,MAanC,CAAC"}

package/packages/agent/src/services/permissions/probers/website-blocking.js

@@ -0,0 +1,27 @@
+/**
+ * Website blocking prober.
+ *
+ * App-internal feature — implemented via hosts-file edits / VPN DNS / NE
+ * content blocker depending on platform. There's no OS-level permission
+ * dialog for "may this app block websites" beyond the elevation prompt
+ * the website-blocker plugin issues at block time.
+ *
+ * For the registry's purposes we report `granted` so the plumbing exists,
+ * and let the website-blocker plugin handle the elevation flow at
+ * `startBlock` time. The richer status (requires elevation, hosts file
+ * writable, etc.) lives in `WebsiteBlockerPluginLike.getStatus()`.
+ */
+import { buildState } from "./_bridge.js";
+const ID = "website-blocking";
+export const websiteBlockingProber = {
+    id: ID,
+    async check() {
+        return buildState(ID, "granted", { canRequest: false });
+    },
+    async request({ reason: _reason }) {
+        return buildState(ID, "granted", {
+            canRequest: false,
+            lastRequested: Date.now(),
+        });
+    },
+};

package/packages/agent/src/services/permissions/register-probers.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Register all native permission probers with the central permissions
+ * registry.
+ *
+ * The runtime should call this exactly once at boot, after the registry
+ * has been instantiated. The sibling agent that owns the registry should
+ * wire this in at the same place where the registry is constructed.
+ *
+ * INTEGRATION TODO (registry-wiring agent): the runtime entrypoint that
+ * constructs the registry should look roughly like:
+ *
+ *     import { PermissionsRegistry } from "./permissions-registry";
+ *     import { registerAllProbers } from "@elizaos/agent/services/permissions/register-probers";
+ *
+ *     const registry = new PermissionsRegistry();
+ *     registerAllProbers(registry);
+ *     runtime.registerService("permissions", registry);
+ *
+ * Likely call sites (in this repo):
+ *   - packages/agent/src/runtime/eliza.ts (top-level runtime bootstrap)
+ *   - packages/app-core/platforms/electrobun/src/index.ts (Electrobun
+ *     desktop bootstrap, where the existing PermissionManager is created)
+ *   - packages/agent/src/runtime/dev-server.ts (dev mode entry)
+ */
+import type { IPermissionsRegistry } from "./contracts.js";
+import { ALL_PROBERS } from "./probers/index.js";
+export declare function registerAllProbers(registry: IPermissionsRegistry): void;
+export { ALL_PROBERS };
+//# sourceMappingURL=register-probers.d.ts.map

package/packages/agent/src/services/permissions/register-probers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-probers.d.ts","sourceRoot":"","sources":["../../../../../../src/services/permissions/register-probers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAIvE;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/packages/agent/src/services/permissions/register-probers.js

@@ -0,0 +1,31 @@
+/**
+ * Register all native permission probers with the central permissions
+ * registry.
+ *
+ * The runtime should call this exactly once at boot, after the registry
+ * has been instantiated. The sibling agent that owns the registry should
+ * wire this in at the same place where the registry is constructed.
+ *
+ * INTEGRATION TODO (registry-wiring agent): the runtime entrypoint that
+ * constructs the registry should look roughly like:
+ *
+ *     import { PermissionsRegistry } from "./permissions-registry";
+ *     import { registerAllProbers } from "@elizaos/agent/services/permissions/register-probers";
+ *
+ *     const registry = new PermissionsRegistry();
+ *     registerAllProbers(registry);
+ *     runtime.registerService("permissions", registry);
+ *
+ * Likely call sites (in this repo):
+ *   - packages/agent/src/runtime/eliza.ts (top-level runtime bootstrap)
+ *   - packages/app-core/platforms/electrobun/src/index.ts (Electrobun
+ *     desktop bootstrap, where the existing PermissionManager is created)
+ *   - packages/agent/src/runtime/dev-server.ts (dev mode entry)
+ */
+import { ALL_PROBERS } from "./probers/index.js";
+export function registerAllProbers(registry) {
+    for (const prober of ALL_PROBERS) {
+        registry.registerProber(prober);
+    }
+}
+export { ALL_PROBERS };

package/packages/agent/src/services/permissions-registry.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Central registry for system-permission state. Holds an in-memory map of
+ * `PermissionState` keyed by `PermissionId`, hydrates from disk on boot,
+ * persists changes (debounced), and exposes a pub/sub channel for the UI.
+ *
+ * Probers are pluggable — each `PermissionId` is wired to a `Prober` that
+ * knows how to `check()` the OS state and `request()` user consent. The
+ * registry is the single source of truth; native bridges register probers,
+ * features call `recordBlock()` to surface why a permission is needed.
+ */
+import { type IAgentRuntime, Service } from "@elizaos/core";
+import type { IPermissionsRegistry, PermissionId, PermissionState, Prober } from "@elizaos/shared";
+export type { IPermissionsRegistry, Prober } from "@elizaos/shared";
+export declare const PERMISSIONS_REGISTRY_SERVICE = "eliza_permissions_registry";
+interface PersistenceAdapter {
+    read(): PermissionState[] | null;
+    write(states: PermissionState[]): void;
+}
+export interface PermissionRegistryOptions {
+    persistence?: PersistenceAdapter;
+    /**
+     * Override the debounce window for persistence writes. Tests pass `0` for
+     * synchronous writes.
+     */
+    persistDebounceMs?: number;
+}
+export declare class PermissionRegistry extends Service implements IPermissionsRegistry {
+    static serviceType: string;
+    static start(runtime: IAgentRuntime): Promise<PermissionRegistry>;
+    capabilityDescription: string;
+    private readonly states;
+    private readonly probers;
+    private readonly subscribers;
+    private persistTimer;
+    private readonly persistence;
+    private readonly persistDebounceMs;
+    constructor(runtime: IAgentRuntime, options?: PermissionRegistryOptions);
+    hydrate(): void;
+    registerProber(prober: Prober): void;
+    get(id: PermissionId): PermissionState;
+    check(id: PermissionId): Promise<PermissionState>;
+    request(id: PermissionId, opts: {
+        reason: string;
+        feature: {
+            app: string;
+            action: string;
+        };
+    }): Promise<PermissionState>;
+    recordBlock(id: PermissionId, feature: {
+        app: string;
+        action: string;
+    }): void;
+    list(): PermissionState[];
+    pending(): PermissionState[];
+    subscribe(cb: (state: PermissionState[]) => void): () => void;
+    stop(): Promise<void>;
+    private commit;
+    private notify;
+    private schedulePersist;
+    private flushPersist;
+}
+//# sourceMappingURL=permissions-registry.d.ts.map

package/packages/agent/src/services/permissions-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-registry.d.ts","sourceRoot":"","sources":["../../../../../src/services/permissions-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAAE,KAAK,aAAa,EAAU,OAAO,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,KAAK,EACV,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,MAAM,EACP,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEpE,eAAO,MAAM,4BAA4B,+BAA+B,CAAC;AA8BzE,UAAU,kBAAkB;IAC1B,IAAI,IAAI,eAAe,EAAE,GAAG,IAAI,CAAC;IACjC,KAAK,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;CACxC;AA4BD,MAAM,WAAW,yBAAyB;IACxC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,kBACX,SAAQ,OACR,YAAW,oBAAoB;IAE/B,MAAM,CAAC,WAAW,SAAgC;WAErC,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAUvE,qBAAqB,SACkD;IAEvE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;IACnE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiD;IAC7E,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAE/B,OAAO,EAAE,aAAa,EAAE,OAAO,GAAE,yBAA8B;IAQ3E,OAAO,IAAI,IAAI;IAQf,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAIpC,GAAG,CAAC,EAAE,EAAE,YAAY,GAAG,eAAe;IAOhC,KAAK,CAAC,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC;IAUjD,OAAO,CACX,EAAE,EAAE,YAAY,EAChB,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GACjE,OAAO,CAAC,eAAe,CAAC;IAmB3B,WAAW,CACT,EAAE,EAAE,YAAY,EAChB,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GACvC,IAAI;IAaP,IAAI,IAAI,eAAe,EAAE;IAIzB,OAAO,IAAI,eAAe,EAAE;IAS5B,SAAS,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,IAAI,GAAG,MAAM,IAAI;IAOvD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ3B,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,MAAM;IAed,OAAO,CAAC,eAAe;IAevB,OAAO,CAAC,YAAY;CAUrB"}