@elizaos/agent 2.0.0-alpha.98 → 2.0.0-beta.2

package/packages/agent/src/services/shell-execution-router.js

@@ -0,0 +1,201 @@
+/**
+ * Single chokepoint for shell execution.
+ *
+ * The runtime has a 3-mode switch via `ELIZA_RUNTIME_MODE`:
+ *  - `cloud`        — agent code runs in the hosted backend; local exec is
+ *                     refused with a clear error.
+ *  - `local-safe`   — every shell exec is routed through `SandboxManager`
+ *                     (Docker / Apple Container) so the host filesystem is
+ *                     not directly touched.
+ *  - `local-yolo`   — direct host exec (the historical default).
+ *
+ * Plugins, services, and CLI helpers that previously called `child_process.spawn`
+ * for one-shot command execution should call `runShell()` instead. This keeps
+ * the mode dispatch in one place and lets the privacy/sandbox guarantees of
+ * `local-safe` actually hold.
+ */
+import { spawn } from "node:child_process";
+import process from "node:process";
+import { resolveRuntimeExecutionMode, } from "@elizaos/shared";
+import { CapabilityBroker } from "./capability-broker.js";
+export function resolveShellExecutionMode(ctx) {
+    if (ctx?.mode)
+        return ctx.mode;
+    return resolveRuntimeExecutionMode(ctx?.runtime ?? null);
+}
+function backendForSandboxManager(manager) {
+    // SandboxManager keeps its engine private; reach in only to label the
+    // backend in ShellResult. If the shape ever changes, the fallback is the
+    // safe "none" value and callers still see a well-formed result.
+    const engine = manager
+        .engine;
+    const engineType = engine?.engineType;
+    if (engineType === "docker")
+        return "docker";
+    if (engineType === "apple-container")
+        return "apple-container";
+    return "none";
+}
+async function resolveSandboxManager(ctx) {
+    if (ctx?.sandboxManager !== undefined)
+        return ctx.sandboxManager;
+    if (ctx?.resolveSandboxManager)
+        return await ctx.resolveSandboxManager();
+    return null;
+}
+// Router-scoped broker so the shell.exec policy is driven by the same mode
+// resolver runShell uses for dispatch. The broker singleton in
+// capability-broker.ts hardcodes `local-safe` as its default mode, which is
+// correct for cloud-side callers but wrong for host-side runShell — those
+// must follow ELIZA_RUNTIME_MODE/RUNTIME_MODE/LOCAL_RUNTIME_MODE. The
+// internal mutable holder lets the broker re-read mode on every call without
+// constructing a new CapabilityBroker per runShell invocation.
+const routerModeHolder = {
+    current: "local-yolo",
+};
+let cachedRouterBroker = null;
+function getRouterBroker(modeSource) {
+    routerModeHolder.current = modeSource();
+    if (cachedRouterBroker)
+        return cachedRouterBroker;
+    cachedRouterBroker = new CapabilityBroker({
+        mode: () => routerModeHolder.current,
+    });
+    return cachedRouterBroker;
+}
+/** Test-only escape hatch — drops the cached router broker. */
+export function __resetShellRouterBrokerForTests() {
+    cachedRouterBroker = null;
+    routerModeHolder.current = "local-yolo";
+}
+async function runOnHost(req) {
+    const start = Date.now();
+    return await new Promise((resolve) => {
+        const timeoutMs = req.timeoutMs ?? 30_000;
+        const useDetachedProcessGroup = process.platform !== "win32";
+        const child = spawn(req.command, req.args.slice(), {
+            cwd: req.cwd,
+            env: req.env ? { ...process.env, ...req.env } : process.env,
+            detached: useDetachedProcessGroup,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        let timedOut = false;
+        const killChildTree = () => {
+            try {
+                if (useDetachedProcessGroup && child.pid !== undefined) {
+                    process.kill(-child.pid, "SIGKILL");
+                    return;
+                }
+            }
+            catch {
+                // Fall back to killing the direct child below.
+            }
+            try {
+                child.kill("SIGKILL");
+            }
+            catch {
+                // child may already have exited
+            }
+        };
+        const timer = setTimeout(() => {
+            timedOut = true;
+            killChildTree();
+        }, timeoutMs);
+        if (typeof timer.unref === "function")
+            timer.unref();
+        child.stdout?.on("data", (chunk) => {
+            stdout += chunk.toString("utf8");
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr += chunk.toString("utf8");
+        });
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            resolve({
+                exitCode: -1,
+                stdout,
+                stderr: stderr.length > 0 ? `${stderr}\n${err.message}` : err.message,
+                durationMs: Date.now() - start,
+                sandbox: "host",
+            });
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            const exitCode = timedOut ? 124 : (code ?? -1);
+            resolve({
+                exitCode,
+                stdout,
+                stderr: timedOut
+                    ? `${stderr}${stderr.endsWith("\n") || stderr.length === 0 ? "" : "\n"}[shell-router] command timed out after ${timeoutMs}ms`
+                    : stderr,
+                durationMs: Date.now() - start,
+                sandbox: "host",
+            });
+        });
+    });
+}
+async function runInSandbox(req, manager) {
+    const result = await manager.run({
+        cmd: req.command,
+        args: req.args,
+        workdir: req.cwd,
+        env: req.env,
+        timeoutMs: req.timeoutMs,
+    });
+    return {
+        exitCode: result.exitCode,
+        stdout: result.stdout,
+        stderr: result.stderr,
+        durationMs: result.durationMs,
+        sandbox: backendForSandboxManager(manager),
+    };
+}
+function assertShellCapability(req, mode, toolName) {
+    const decision = getRouterBroker(() => mode).check({
+        kind: "shell",
+        op: "exec",
+        target: req.command,
+        toolName,
+    });
+    if (decision.allowed !== true) {
+        throw new Error(`[shell] capability denied: ${decision.reason}`);
+    }
+}
+/**
+ * Single entry point for one-shot shell execution. Mode dispatch:
+ *   - `cloud`      → throws.
+ *   - `local-safe` → routed through SandboxManager.run; if no manager is
+ *                    available the call throws so callers cannot silently
+ *                    fall back to the host.
+ *   - `local-yolo` → direct host exec via child_process.spawn.
+ *
+ * On Windows, `local-safe` currently throws because no Windows sandbox
+ * backend is wired up yet; callers must opt in to `local-yolo` explicitly.
+ */
+export async function runShell(req, ctx) {
+    if (!req.command || req.command.length === 0) {
+        throw new Error("[shell-router] runShell requires a non-empty command");
+    }
+    if (!req.toolName || req.toolName.length === 0) {
+        throw new Error("[shell-router] runShell requires toolName for audit");
+    }
+    const mode = resolveShellExecutionMode(ctx);
+    if (mode === "cloud") {
+        throw new Error("Local shell execution disabled in cloud mode.");
+    }
+    if (mode === "local-safe") {
+        assertShellCapability(req, mode, `sandbox.${req.toolName}`);
+        if (process.platform === "win32") {
+            throw new Error("[shell-router] Windows local-safe sandbox not yet implemented");
+        }
+        const manager = await resolveSandboxManager(ctx);
+        if (!manager) {
+            throw new Error("[shell-router] local-safe mode requires SandboxManager but none is available");
+        }
+        return await runInSandbox(req, manager);
+    }
+    assertShellCapability(req, mode, req.toolName);
+    return await runOnHost(req);
+}

package/packages/agent/src/services/skill-marketplace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-marketplace.d.ts","sourceRoot":"","sources":["../../../../../src/services/skill-marketplace.ts"],"names":[],"mappings":"AAyKA,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC1C,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;CAC3D;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;CAC5C;AA0SD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5C,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAiIxC;AAmID,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CAsGpC;AAED,wBAAsB,8BAA8B,CAClD,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAKtC;AAED,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,yBAAyB,CAAC,CAwBpC"}
+{"version":3,"file":"skill-marketplace.d.ts","sourceRoot":"","sources":["../../../../../src/services/skill-marketplace.ts"],"names":[],"mappings":"AA2KA,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC1C,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;CAC3D;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;CAC5C;AAwTD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5C,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAiIxC;AAmID,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CAsGpC;AAED,wBAAsB,8BAA8B,CAClD,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAKtC;AAED,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,yBAAyB,CAAC,CAwBpC"}

package/packages/agent/src/services/skill-marketplace.js

@@ -1,10 +1,9 @@
 import { execFile } from "node:child_process";
 import fs from "node:fs/promises";
-import os from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
-import { logger } from "@elizaos/core";
-import { createIntegrationTelemetrySpan } from "../diagnostics/integration-observability";
+import { logger, resolveStateDir } from "@elizaos/core";
+import { createIntegrationTelemetrySpan } from "../diagnostics/integration-observability.js";
 const execFileAsync = promisify(execFile);
 const DEFAULT_SKILLS_MARKETPLACE_URL = "https://clawhub.ai";
 const LEGACY_SKILLSMP_HOST = "skillsmp.com";
@@ -48,10 +47,11 @@ async function runSkillSecurityScan(skillDir) {
                 continue;
             const fullPath = pathMod.join(dir, entry.name);
             const relPath = pathMod.relative(skillDir, fullPath);
-            if (entry.isDirectory()) {
+            const stats = await fsPromises.lstat(fullPath);
+            if (stats.isDirectory()) {
                 await walk(fullPath);
             }
-            else if (entry.isFile()) {
+            else if (stats.isFile()) {
                 scannedFiles++;
                 const ext = pathMod.extname(entry.name).toLowerCase();
                 if (BINARY_EXTENSIONS.has(ext)) {
@@ -63,14 +63,16 @@ async function runSkillSecurityScan(skillDir) {
                     });
                 }
             }
-            else if (entry.isSymbolicLink()) {
-                const resolved = await fsPromises.realpath(fullPath).catch(() => "");
-                if (resolved && !resolved.startsWith(skillDir + pathMod.sep)) {
+            else if (stats.isSymbolicLink()) {
+                const resolved = await fsPromises.realpath(fullPath).catch(() => null);
+                if (!resolved?.startsWith(skillDir + pathMod.sep)) {
                     manifestFindings.push({
                         ruleId: "symlink-escape",
                         severity: "critical",
                         file: relPath,
-                        message: `Symbolic link points outside skill directory`,
+                        message: resolved
+                            ? "Symbolic link points outside skill directory"
+                            : "Symbolic link could not be resolved safely",
                     });
                 }
             }
@@ -116,15 +118,15 @@ async function runSkillSecurityScan(skillDir) {
     return report;
 }
 function stateDirBase() {
-    const base = process.env.ELIZA_STATE_DIR?.trim();
-    return base || path.join(os.homedir(), ".eliza");
+    return resolveStateDir();
 }
 function safeName(raw) {
     const trimmed = raw.trim();
-    const slug = trimmed
+    const safeTrimmed = trimmed.length > 1024 ? trimmed.slice(0, 1024) : trimmed;
+    const slug = safeTrimmed
         .replace(/[^a-zA-Z0-9._-]/g, "-")
-        .replace(/-+/g, "-")
-        .replace(/^-+|-+$/g, "");
+        .replace(/-{1,1024}/g, "-")
+        .replace(/^-{1,1024}|-{1,1024}$/g, "");
     if (!slug)
         throw new Error("Invalid skill name");
     if (!VALID_NAME.test(slug))
@@ -189,7 +191,7 @@ function parseGithubUrl(rawUrl) {
         url = new URL(rawUrl);
     }
     catch (err) {
-        throw new Error(`Invalid GitHub URL: ${err instanceof Error ? err.message : String(err)}`);
+        throw new Error(`Invalid GitHub URL: ${String(err)}`);
     }
     if (url.hostname !== "github.com") {
         throw new Error("Only github.com URLs are supported for skill install");
@@ -244,7 +246,13 @@ async function readInstallRecords(workspaceDir) {
             return {};
         return parsed;
     }
-    catch {
+    catch (err) {
+        const isMissingFile = err instanceof Error &&
+            "code" in err &&
+            err.code === "ENOENT";
+        if (!isMissingFile) {
+            logger.warn(`[skill-marketplace] Failed to read install records: ${err instanceof Error ? err.message : String(err)}`);
+        }
         return {};
     }
 }
@@ -283,21 +291,24 @@ function inferRepository(skill) {
             return normalizeRepo(value);
         }
         catch (err) {
-            logger.debug(`[skill-marketplace] Failed to normalize repo: ${err instanceof Error ? err.message : err}`);
+            logger.debug(`[skill-marketplace] Failed to normalize repo: ${String(err)}`);
         }
     }
     // Try to extract repository from githubUrl (e.g., https://github.com/owner/repo/tree/...)
     const githubUrl = skill.githubUrl;
-    if (typeof githubUrl === "string" && githubUrl.includes("github.com")) {
+    if (typeof githubUrl === "string") {
         try {
             const url = new URL(githubUrl);
-            const parts = url.pathname.split("/").filter(Boolean);
-            if (parts.length >= 2) {
-                return normalizeRepo(`${parts[0]}/${parts[1]}`);
+            if (url.hostname === "github.com" ||
+                url.hostname.endsWith(".github.com")) {
+                const parts = url.pathname.split("/").filter(Boolean);
+                if (parts.length >= 2) {
+                    return normalizeRepo(`${parts[0]}/${parts[1]}`);
+                }
             }
         }
         catch (err) {
-            logger.debug(`[skill-marketplace] Failed to normalize repo: ${err instanceof Error ? err.message : err}`);
+            logger.debug(`[skill-marketplace] Failed to normalize repo: ${String(err)}`);
         }
     }
     return null;
@@ -371,7 +382,7 @@ function isLegacySkillsmp(baseUrl) {
         return (hostname === LEGACY_SKILLSMP_HOST || hostname.endsWith(".skillsmp.com"));
     }
     catch {
-        return baseUrl.toLowerCase().includes(LEGACY_SKILLSMP_HOST);
+        return false;
     }
 }
 export async function searchSkillsMarketplace(query, opts) {
@@ -410,7 +421,7 @@ export async function searchSkillsMarketplace(query, opts) {
     }
     catch (err) {
         searchSpan.failure({ error: err });
-        const msg = err instanceof Error ? err.message : String(err);
+        const msg = String(err);
         throw new Error(msg.includes("aborted") || msg.includes("timeout")
             ? `Skills marketplace request timed out after ${FETCH_TIMEOUT_MS / 1000}s`
             : `Skills marketplace network error: ${msg}`);
@@ -491,7 +502,7 @@ async function runGitCloneSubset(repository, ref, skillPath, targetDir) {
         const sourceDir = path.join(cloneDir, skillPath);
         assertPathWithinRoot(cloneDir, sourceDir);
         const stat = await fs.stat(sourceDir).catch(() => null);
-        if (!stat || !stat.isDirectory()) {
+        if (!stat?.isDirectory()) {
             throw new Error(`Skill path not found in repository: ${skillPath}`);
         }
         await fs.mkdir(path.dirname(targetDir), { recursive: true });

package/packages/agent/src/services/task-executor.d.ts

@@ -0,0 +1,47 @@
+import type { IAgentRuntime, Memory } from "@elizaos/core";
+/** Specification for a task to be executed */
+export interface TaskSpec {
+    id: string;
+    description: string;
+    type: string;
+    metadata?: Record<string, unknown>;
+    agentType?: string;
+    message?: Memory;
+}
+/** Result from a completed task */
+export interface TaskResult {
+    taskId: string;
+    success: boolean;
+    output?: string;
+    artifacts?: Array<{
+        name: string;
+        path: string;
+        type: string;
+    }>;
+    error?: string;
+    durationMs?: number;
+}
+/** Interface for task executors that handle specific task types */
+export interface TaskExecutor {
+    /** Unique type identifier (e.g., "coding", "research", "content") */
+    readonly type: string;
+    /** Human-readable description of what this executor handles */
+    readonly description: string;
+    /** Check if this executor can handle the given task */
+    canHandle(spec: TaskSpec, runtime: IAgentRuntime): boolean;
+    /** Execute the task and return results */
+    execute(spec: TaskSpec, runtime: IAgentRuntime): Promise<TaskResult>;
+    /** Abort a running task */
+    abort(taskId: string): Promise<void>;
+}
+/** Registry for task executors */
+export declare class TaskExecutorRegistry {
+    private executors;
+    register(executor: TaskExecutor): void;
+    unregister(type: string): void;
+    /** Find the best executor for a task spec */
+    findExecutor(spec: TaskSpec, runtime: IAgentRuntime): TaskExecutor | undefined;
+    getAll(): TaskExecutor[];
+    get(type: string): TaskExecutor | undefined;
+}
+//# sourceMappingURL=task-executor.d.ts.map

package/packages/agent/src/services/task-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-executor.d.ts","sourceRoot":"","sources":["../../../../../src/services/task-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE3D,8CAA8C;AAC9C,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,mCAAmC;AACnC,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,uDAAuD;IACvD,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC;IAE3D,0CAA0C;IAC1C,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAErE,2BAA2B;IAC3B,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED,kCAAkC;AAClC,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,SAAS,CAAwC;IAEzD,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI;IAItC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI9B,6CAA6C;IAC7C,YAAY,CACV,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,aAAa,GACrB,YAAY,GAAG,SAAS;IAa3B,MAAM,IAAI,YAAY,EAAE;IAIxB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;CAG5C"}

package/packages/agent/src/services/task-executor.js

@@ -0,0 +1,31 @@
+/** Registry for task executors */
+export class TaskExecutorRegistry {
+    executors = new Map();
+    register(executor) {
+        this.executors.set(executor.type, executor);
+    }
+    unregister(type) {
+        this.executors.delete(type);
+    }
+    /** Find the best executor for a task spec */
+    findExecutor(spec, runtime) {
+        // If task has explicit type, try that first
+        if (spec.type) {
+            const explicit = this.executors.get(spec.type);
+            if (explicit?.canHandle(spec, runtime))
+                return explicit;
+        }
+        // Otherwise, find first executor that can handle it
+        for (const executor of this.executors.values()) {
+            if (executor.canHandle(spec, runtime))
+                return executor;
+        }
+        return undefined;
+    }
+    getAll() {
+        return Array.from(this.executors.values());
+    }
+    get(type) {
+        return this.executors.get(type);
+    }
+}

package/packages/agent/src/services/update-checker.d.ts

@@ -2,7 +2,7 @@
  * Queries the npm registry for new elizaos versions on the user's
  * configured release channel (stable/beta/nightly).
  */
-import type { ReleaseChannel, UpdateConfig } from "../config/types.eliza";
+import type { ReleaseChannel, UpdateConfig } from "../config/types.eliza.ts";
 /** npm dist-tag corresponding to each release channel. */
 export declare const CHANNEL_DIST_TAGS: Readonly<Record<ReleaseChannel, string>>;
 export interface UpdateCheckResult {

package/packages/agent/src/services/update-checker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update-checker.d.ts","sourceRoot":"","sources":["../../../../../src/services/update-checker.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAQ1E,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAItE,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AA6BD,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,cAAc,CAI5E;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,OAAO,CAAC,EAAE;IAC7C,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA8E7B;AAED,6DAA6D;AAC7D,wBAAsB,uBAAuB,IAAI,OAAO,CACtD,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC,CACtC,CAOA"}
+{"version":3,"file":"update-checker.d.ts","sourceRoot":"","sources":["../../../../../src/services/update-checker.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAQ7E,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAItE,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AA6BD,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,cAAc,CAI5E;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,OAAO,CAAC,EAAE;IAC7C,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA8E7B;AAED,6DAA6D;AAC7D,wBAAsB,uBAAuB,IAAI,OAAO,CACtD,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC,CACtC,CAOA"}

package/packages/agent/src/services/update-checker.js

@@ -2,9 +2,9 @@
  * Queries the npm registry for new elizaos versions on the user's
  * configured release channel (stable/beta/nightly).
  */
-import { loadElizaConfig, saveElizaConfig } from "../config/config";
-import { VERSION } from "../runtime/version";
-import { compareSemver } from "./version-compat";
+import { loadElizaConfig, saveElizaConfig } from "../config/config.js";
+import { VERSION } from "../runtime/version.js";
+import { compareSemver } from "./version-compat.js";
 const CHECK_INTERVAL_SECONDS = 14_400; // 4 hours
 const REGISTRY_TIMEOUT_MS = 8_000;
 const NPM_REGISTRY_PACKUMENT_URL = "https://registry.npmjs.org/elizaos";
@@ -110,7 +110,7 @@ export async function checkForUpdate(options) {
     catch (err) {
         // If config is unwritable the cache interval won't persist and the
         // registry gets queried on every startup — worth surfacing.
-        const msg = err instanceof Error ? err.message : String(err);
+        const msg = String(err);
         process.stderr.write(`[eliza] Warning: could not save update-check metadata: ${msg}\n`);
     }
     return {

package/packages/agent/src/services/version-compat.d.ts

@@ -32,7 +32,7 @@ export interface VersionCompatReport {
     results: PluginCompatResult[];
     /** Plugins that failed the check. */
     failures: PluginCompatResult[];
-    /** Advisory message (e.g. "pin to alpha.3" or "upgrade core"). */
+    /** Advisory message (e.g. "pin to beta.0" or "upgrade core"). */
     advisory: string;
 }
 /**
@@ -45,13 +45,13 @@ export declare const AI_PROVIDER_PLUGINS: readonly string[];
  * Returns null for unparseable versions.
  *
  * Examples:
- *   "2.0.0-alpha.3"          → [2, 0, 0, 3]
- *   "2.0.0-alpha.4"          → [2, 0, 0, 4]
+ *   "2.0.0-beta.0"           → [2, 0, 0, 0]
+ *   "2.0.0-beta.1"           → [2, 0, 0, 1]
  *   "2.0.0-nightly.20260208" → [2, 0, 0, 20260208]
  *   "2.0.0"                  → [2, 0, 0, Infinity]  (release beats any pre-release)
  *
  * Note: comparisons are only meaningful within the same pre-release tag type
- * (alpha vs alpha, nightly vs nightly). Cross-tag comparisons (alpha.7 vs beta.1)
+ * (beta vs beta, nightly vs nightly). Cross-tag comparisons (beta.1 vs rc.1)
  * compare only the numeric suffix, which may not reflect the intended ordering.
  * The update checker always compares within the same channel, so this is safe.
  */

package/packages/agent/src/services/version-compat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version-compat.d.ts","sourceRoot":"","sources":["../../../../../src/services/version-compat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,qDAAqD;AACrD,MAAM,WAAW,kBAAkB;IACjC,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,EAAE,OAAO,CAAC;IACpB,6DAA6D;IAC7D,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,UAAU,EAAE,OAAO,CAAC;IACpB,0BAA0B;IAC1B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,qCAAqC;IACrC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAWhD,CAAC;AAMF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,GACd,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAczC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAUrE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG7E;AAMD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAW3E;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuBxB;AAMD;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CAuB7B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,iBAAiB,EAAE,MAAM,EAAE,EAC3B,aAAa,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GACpD,MAAM,GAAG,IAAI,CA6Cf"}
+{"version":3,"file":"version-compat.d.ts","sourceRoot":"","sources":["../../../../../src/services/version-compat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,qDAAqD;AACrD,MAAM,WAAW,kBAAkB;IACjC,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,EAAE,OAAO,CAAC;IACpB,6DAA6D;IAC7D,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,UAAU,EAAE,OAAO,CAAC;IACpB,0BAA0B;IAC1B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,qCAAqC;IACrC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAWhD,CAAC;AAiBF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,GACd,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAczC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAUrE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG7E;AAMD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAW3E;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuBxB;AAMD;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CAuB7B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,iBAAiB,EAAE,MAAM,EAAE,EAC3B,aAAa,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GACpD,MAAM,GAAG,IAAI,CAsDf"}

package/packages/agent/src/services/version-compat.js

@@ -22,29 +22,39 @@ export const AI_PROVIDER_PLUGINS = [
     "@elizaos/plugin-groq",
     "@elizaos/plugin-xai",
     "@homunculuslabs/plugin-zai",
-    "@elizaos/plugin-pi-ai",
     "@elizaos/plugin-elizacloud",
+    "@elizaos/plugin-codex-cli",
+];
+/**
+ * Self-declared plugin names (the `name` property on the plugin object) that
+ * correspond to AI provider plugins.  Some plugins use a short internal name
+ * (e.g. "elizaOSCloud") that differs from the npm package name.  The
+ * diagnostic must recognise both forms to avoid false-positive warnings.
+ */
+const AI_PROVIDER_PLUGIN_ALIASES = [
+    "elizaOSCloud",
+    "codex-cli",
 ];
 // ---------------------------------------------------------------------------
-// Semver comparison (simplified for alpha tags)
+// Semver comparison for stable and prerelease tags.
 // ---------------------------------------------------------------------------
 /**
  * Parse a semver string (including pre-release tags) into a comparable tuple.
  * Returns null for unparseable versions.
  *
  * Examples:
- *   "2.0.0-alpha.3"          → [2, 0, 0, 3]
- *   "2.0.0-alpha.4"          → [2, 0, 0, 4]
+ *   "2.0.0-beta.0"           → [2, 0, 0, 0]
+ *   "2.0.0-beta.1"           → [2, 0, 0, 1]
  *   "2.0.0-nightly.20260208" → [2, 0, 0, 20260208]
  *   "2.0.0"                  → [2, 0, 0, Infinity]  (release beats any pre-release)
  *
  * Note: comparisons are only meaningful within the same pre-release tag type
- * (alpha vs alpha, nightly vs nightly). Cross-tag comparisons (alpha.7 vs beta.1)
+ * (beta vs beta, nightly vs nightly). Cross-tag comparisons (beta.1 vs rc.1)
  * compare only the numeric suffix, which may not reflect the intended ordering.
  * The update checker always compares within the same channel, so this is safe.
  */
 export function parseSemver(version) {
-    const match = version.match(/^(\d+)\.(\d+)\.(\d+)(?:-(?:alpha|beta|rc|nightly)\.(\d+))?$/);
+    const match = version.match(/^(\d+)\.(\d+)\.(\d+)(?:-(?:beta|rc|nightly)\.(\d+))?$/);
     if (!match)
         return null;
     const major = Number(match[1]);
@@ -164,10 +174,16 @@ export async function validatePluginCompat(pluginName, coreVersion) {
  * @param failedPlugins - Names + error strings of plugins that failed to load.
  */
 export function diagnoseNoAIProvider(loadedPluginNames, failedPlugins) {
-    const loadedProviders = loadedPluginNames.filter((n) => AI_PROVIDER_PLUGINS.includes(n));
+    const isAIProvider = (name) => AI_PROVIDER_PLUGINS.includes(name) ||
+        AI_PROVIDER_PLUGIN_ALIASES.includes(name);
+    const loadedProviders = loadedPluginNames.filter(isAIProvider);
     // At least one AI provider loaded — no issue.
     if (loadedProviders.length > 0)
         return null;
+    if (process.env.ELIZA_LOCAL_LLAMA?.trim() === "1" ||
+        process.env.ELIZA_DEVICE_BRIDGE_ENABLED?.trim() === "1") {
+        return null;
+    }
     // Check if any AI provider plugins were attempted but failed.
     const failedProviders = failedPlugins.filter((f) => AI_PROVIDER_PLUGINS.includes(f.name));
     if (failedProviders.length === 0) {