@elizaos/agent 2.0.0-beta.1 → 2.0.0-beta.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elizaos/agent",
-  "version": "2.0.0-beta.1",
+  "version": "2.0.0-beta.2",
   "description": "Standalone elizaOS-based agent and backend server package.",
   "type": "module",
   "license": "MIT",
@@ -17,67 +17,54 @@
     "runtime",
     "elizaos"
   ],
-  "main": "src/index.ts",
-  "files": [
-    "dist"
-  ],
+  "main": "./packages/agent/src/index.js",
   "engines": {
     "node": ">=24.0.0"
   },
   "bin": {
-    "eliza-autonomous": "./src/bin.ts"
-  },
-  "scripts": {
-    "clean": "rm -rf dist",
-    "start": "bun run src/bin.ts",
-    "dev": "bun --hot src/bin.ts",
-    "prepublishOnly": "bun run build:dist",
-    "build": "bun run build:dist",
-    "build:mobile": "bun run scripts/build-mobile-bundle.mjs",
-    "build:docker-dist": "rm -rf dist && tsc --noCheck -p tsconfig.build.json && node ../../scripts/prepare-package-dist.mjs packages/agent --compiled-prefix=packages/agent/src",
-    "typecheck": "tsc --noEmit -p tsconfig.json",
-    "build:dist": "rm -rf dist && tsc --noCheck -p tsconfig.build.json && node ../../scripts/prepare-package-dist.mjs packages/agent --compiled-prefix=packages/agent/src",
-    "lint": "bunx @biomejs/biome check ./src/actions ./src/api ./src/auth ./src/awareness ./src/bin.ts ./src/cli ./src/config ./src/contracts ./src/diagnostics ./src/hooks ./src/index.ts ./src/providers ./src/runtime ./src/security ./src/services ./src/shared ./src/testing ./src/triggers ./src/utils ./src/version-resolver.ts",
-    "lint:check": "bun run lint",
-    "lint:fix": "bunx @biomejs/biome check --write ./src/actions ./src/api ./src/auth ./src/awareness ./src/bin.ts ./src/cli ./src/config ./src/contracts ./src/diagnostics ./src/hooks ./src/index.ts ./src/providers ./src/runtime ./src/security ./src/services ./src/shared ./src/testing ./src/triggers ./src/utils ./src/version-resolver.ts",
-    "format": "bunx @biomejs/biome format src",
-    "format:fix": "bunx @biomejs/biome format --write src",
-    "pack:dry-run": "cd dist && npm pack --dry-run",
-    "test": "vitest run --config vitest.config.ts"
+    "eliza-autonomous": "./packages/agent/src/bin.js"
   },
   "exports": {
-    ".": "./src/index.ts",
+    ".": {
+      "types": "./packages/agent/src/index.d.ts",
+      "import": "./packages/agent/src/index.js",
+      "default": "./packages/agent/src/index.js"
+    },
     "./package.json": "./package.json",
-    "./config/plugin-auto-enable": "./src/config/plugin-auto-enable.ts",
+    "./config/plugin-auto-enable": {
+      "types": "./packages/agent/src/config/plugin-auto-enable.d.ts",
+      "import": "./packages/agent/src/config/plugin-auto-enable.js",
+      "default": "./packages/agent/src/config/plugin-auto-enable.js"
+    },
     "./services/app-session-gate": {
-      "types": "./src/services/app-session-gate.d.ts",
+      "types": "./packages/agent/src/services/app-session-gate.d.ts",
       "bun": {
-        "types": "./src/services/app-session-gate.ts",
-        "import": "./src/services/app-session-gate.ts",
-        "default": "./src/services/app-session-gate.ts"
+        "types": "./packages/agent/src/services/app-session-gate.d.ts",
+        "import": "./packages/agent/src/services/app-session-gate.js",
+        "default": "./packages/agent/src/services/app-session-gate.js"
       },
-      "import": "./dist/services/app-session-gate.js",
-      "default": "./dist/services/app-session-gate.js"
+      "import": "./packages/agent/src/services/app-session-gate.js",
+      "default": "./packages/agent/src/services/app-session-gate.js"
     },
     "./security/*": {
-      "types": "./src/security/*.d.ts",
+      "types": "./packages/agent/src/security/*.d.ts",
       "bun": {
-        "types": "./src/security/*.ts",
-        "import": "./src/security/*.ts",
-        "default": "./src/security/*.ts"
+        "types": "./packages/agent/src/security/*.d.ts",
+        "import": "./packages/agent/src/security/*.js",
+        "default": "./packages/agent/src/security/*.js"
       },
-      "import": "./dist/security/*.js",
-      "default": "./dist/security/*.js"
+      "import": "./packages/agent/src/security/*.js",
+      "default": "./packages/agent/src/security/*.js"
     },
     "./services/*": {
-      "types": "./src/services/*.d.ts",
+      "types": "./packages/agent/src/services/*.d.ts",
       "bun": {
-        "types": "./src/services/*.ts",
-        "import": "./src/services/*.ts",
-        "default": "./src/services/*.ts"
+        "types": "./packages/agent/src/services/*.d.ts",
+        "import": "./packages/agent/src/services/*.js",
+        "default": "./packages/agent/src/services/*.js"
       },
-      "import": "./dist/services/*.js",
-      "default": "./dist/services/*.js"
+      "import": "./packages/agent/src/services/*.js",
+      "default": "./packages/agent/src/services/*.js"
     }
   },
   "publishConfig": {
@@ -97,7 +84,7 @@
     "@elizaos/plugin-coding-tools": "2.0.0-beta.1",
     "@elizaos/plugin-commands": "2.0.0-beta.1",
     "@elizaos/plugin-computeruse": "2.0.0-beta.1",
-    "@elizaos/plugin-discord": "2.0.0-beta.1",
+    "@elizaos/plugin-discord": "2.0.0-beta.2",
     "@elizaos/plugin-discord-local": "2.0.0-beta.1",
     "@elizaos/plugin-elizacloud": "2.0.0-beta.1",
     "@elizaos/plugin-imessage": "2.0.0-beta.1",
@@ -148,22 +135,5 @@
       "optional": true
     }
   },
-  "devDependencies": {
-    "@ai-sdk/openai": "^3.0.47",
-    "@types/bun": "^1.3.12",
-    "@types/jsdom": "^28.0.0",
-    "@types/node": "^25.2.0",
-    "@types/pg": "^8.15.2",
-    "@types/qrcode": "^1.5.5",
-    "@types/react": "^19.2.14",
-    "@types/react-dom": "^19.2.3",
-    "@types/ws": "^8.18.1",
-    "ai": "^6.0.134",
-    "bun-types": "^1.3.12",
-    "canvas": "^3.0.1",
-    "sharp": "^0.34.5",
-    "typescript": "^6.0.3",
-    "vite": "^8.0.8",
-    "vitest": "^4.0.18"
-  }
+  "types": "./packages/agent/src/index.d.ts"
 }

package/{dist/packages → packages}/agent/src/actions/contact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contact.d.ts","sourceRoot":"","sources":["../../../../../src/actions/contact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EACV,MAAM,EAON,aAAa,EAWd,MAAM,eAAe,CAAC;AAiZvB,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAIzE;AAw2CD,eAAO,MAAM,aAAa,EAAE,MAoa3B,CAAC"}
+{"version":3,"file":"contact.d.ts","sourceRoot":"","sources":["../../../../../src/actions/contact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EACV,MAAM,EAON,aAAa,EAWd,MAAM,eAAe,CAAC;AAmZvB,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAIzE;AAw2CD,eAAO,MAAM,aAAa,EAAE,MA+a3B,CAAC"}

package/{dist/packages → packages}/agent/src/actions/contact.js

@@ -326,7 +326,7 @@ async function handleSearch(runtime, message, state, params) {
             lines.push(`${String(i + 1).padStart(3, " ")} | ${person.displayName}${aliases} — ${platforms} — ${person.factCount} facts — entityId: ${person.primaryEntityId}`);
         }
         const header = `Search results for "${query}" | ${snapshot.people.length} contacts found`;
-        const footer = "\nUse op:read with an entityId to see full details (facts, conversations, relationships).";
+        const footer = "\nUse action=read with an entityId to see full details (facts, conversations, relationships).";
         return {
             text: `${header}\n${"─".repeat(60)}\n${lines.join("\n")}\n${footer}`,
             success: true,
@@ -1006,7 +1006,7 @@ async function handleLink(runtime, message, params) {
         }
     }
     if (!entityA || !entityB) {
-        return fail("CONTACT link needs two entity IDs. Use op:search to find them first.", "INVALID_PARAMETERS", "link");
+        return fail("CONTACT link needs two entity IDs. Use action=search to find them first.", "INVALID_PARAMETERS", "link");
     }
     if (entityA === entityB) {
         return fail("Cannot link an entity to itself.", "INVALID_PARAMETERS", "link");
@@ -1361,7 +1361,7 @@ export const contactAction = {
         "SCHEDULE_FOLLOWUP",
         "FOLLOW_UP_CONTACT",
     ],
-    description: "Manage Rolodex contacts and entity identities. Op-based dispatch — provide an `op` parameter:\n" +
+    description: "Manage Rolodex contacts and entity identities. Action-based dispatch — provide an `action` parameter:\n" +
         "  create   — create a new contact (name required; optional email/phone/notes/categories/tags).\n" +
         "  read     — load full identity, facts, recent conversations, and relationships by entityId or name.\n" +
         "  search   — search contacts by name/handle/platform; line-numbered results.\n" +
@@ -1371,14 +1371,20 @@ export const contactAction = {
         "  merge    — accept or reject a pending merge candidate by id.\n" +
         "  activity — paginated activity timeline for the Rolodex.\n" +
         "  followup — schedule a follow-up with a contact (scheduledAt + name/entityId; optional reason/priority/message).",
-    descriptionCompressed: "manage Rolodex contacts; op-based dispatch (create read search update delete link merge activity followup)",
+    descriptionCompressed: "manage Rolodex contacts; action=create|read|search|update|delete|link|merge|activity|followup",
     parameters: [
         {
-            name: "subaction",
-            description: `Operation: ${CONTACT_OPS.join(", ")}.`,
+            name: "action",
+            description: `Contact operation: ${CONTACT_OPS.join(", ")}.`,
             required: true,
             schema: { type: "string", enum: [...CONTACT_OPS] },
         },
+        {
+            name: "op",
+            description: "Legacy alias for action.",
+            required: false,
+            schema: { type: "string", enum: [...CONTACT_OPS] },
+        },
         {
             name: "entityId",
             description: "Entity id (UUID). Required for read/update/delete/activity; optional for create/link.",
@@ -1595,16 +1601,20 @@ export const contactAction = {
     ],
     validate: async (runtime, message, state, options) => {
         registerEntitySearchCategory(runtime);
-        if (readOp(getParams(options).op) === "followup")
-            return true;
+        {
+            const params = getParams(options);
+            if (readOp(params.action ?? params.subaction ?? params.op) === "followup") {
+                return true;
+            }
+        }
         return (hasContextSignalSyncForKey(message, state, "search_entity") ||
             hasContextSignalSyncForKey(message, state, "link_entity"));
     },
     handler: async (runtime, message, state, options, callback) => {
         const params = getParams(options);
-        const op = readOp(params.op);
+        const op = readOp(params.action ?? params.subaction ?? params.op);
         if (!op) {
-            return fail(`op is required and must be one of ${CONTACT_OPS.join(", ")}.`, "INVALID");
+            return fail(`action is required and must be one of ${CONTACT_OPS.join(", ")}.`, "INVALID");
         }
         switch (op) {
             case "create":

package/{dist/packages → packages}/agent/src/actions/stream-control.d.ts

@@ -1,7 +1,7 @@
 /**
  * STREAM — single polymorphic action consolidating live-stream lifecycle.
  *
- * Ops:
+ * Actions:
  *   go_live     — start the live stream to the active destination
  *   go_offline  — stop the active stream and release capture/RTMP resources
  *

package/{dist/packages → packages}/agent/src/actions/stream-control.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream-control.d.ts","sourceRoot":"","sources":["../../../../../src/actions/stream-control.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EACV,MAAM,EAQP,MAAM,eAAe,CAAC;AA4FvB,eAAO,MAAM,YAAY,EAAE,MA2E1B,CAAC"}
+{"version":3,"file":"stream-control.d.ts","sourceRoot":"","sources":["../../../../../src/actions/stream-control.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EACV,MAAM,EAQP,MAAM,eAAe,CAAC;AA8FvB,eAAO,MAAM,YAAY,EAAE,MAiF1B,CAAC"}

package/{dist/packages → packages}/agent/src/actions/stream-control.js

@@ -1,7 +1,7 @@
 /**
  * STREAM — single polymorphic action consolidating live-stream lifecycle.
  *
- * Ops:
+ * Actions:
  *   go_live     — start the live stream to the active destination
  *   go_offline  — stop the active stream and release capture/RTMP resources
  *
@@ -94,25 +94,31 @@ export const streamAction = {
     name: STREAM_ACTION,
     contexts: ["general", "media", "automation", "settings"],
     roleGate: { minRole: "OWNER" },
-    description: "Control the live stream lifecycle. Use op='go_live' to start broadcasting " +
+    description: "Control the live stream lifecycle. Use action='go_live' to start broadcasting " +
         "to the active destination (Twitch, YouTube, custom RTMP). Use " +
-        "op='go_offline' to stop any active stream and release capture/RTMP " +
+        "action='go_offline' to stop any active stream and release capture/RTMP " +
         "resources.",
-    descriptionCompressed: "control live stream: op=go_live start broadcast active destination; op=go_offline stop release capture RTMP",
+    descriptionCompressed: "control live stream: action=go_live start broadcast active destination; action=go_offline stop release capture RTMP",
     parameters: [
         {
-            name: "subaction",
+            name: "action",
             description: `Operation: ${STREAM_OPS.join(", ")}.`,
             required: true,
             schema: { type: "string", enum: [...STREAM_OPS] },
         },
+        {
+            name: "op",
+            description: "Legacy alias for action.",
+            required: false,
+            schema: { type: "string", enum: [...STREAM_OPS] },
+        },
     ],
     validate: async (_runtime, message, state) => {
         return hasContextSignalSyncForKey(message, state, "stream_control");
     },
     handler: async (_runtime, _message, _state, options, _callback) => {
         const params = (options ?? {});
-        const op = readOp(params.op);
+        const op = readOp(params.action ?? params.subaction ?? params.op);
         if (!op) {
             return {
                 success: false,
@@ -138,7 +144,7 @@ export const streamAction = {
                 content: {
                     text: "Stream is now live.",
                     actions: [STREAM_ACTION],
-                    actionParameters: { op: "go_live" },
+                    actionParameters: { action: "go_live" },
                 },
             },
         ],
@@ -152,7 +158,7 @@ export const streamAction = {
                 content: {
                     text: "Stream stopped. Now offline.",
                     actions: [STREAM_ACTION],
-                    actionParameters: { op: "go_offline" },
+                    actionParameters: { action: "go_offline" },
                 },
             },
         ],

package/{dist/packages → packages}/agent/src/actions/terminal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terminal.d.ts","sourceRoot":"","sources":["../../../../../src/actions/terminal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,MAAM,EAOP,MAAM,eAAe,CAAC;AA8OvB,eAAO,MAAM,cAAc,EAAE,MAmI5B,CAAC"}
+{"version":3,"file":"terminal.d.ts","sourceRoot":"","sources":["../../../../../src/actions/terminal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,MAAM,EAOP,MAAM,eAAe,CAAC;AAoPvB,eAAO,MAAM,cAAc,EAAE,MA+I5B,CAAC"}

package/{dist/packages → packages}/agent/src/actions/terminal.js

@@ -10,7 +10,7 @@
  *
  * @module actions/terminal
  */
-import { ContentType, logger, stringToUuid } from "@elizaos/core";
+import { buildStoreVariantBlockedMessage, ContentType, isLocalCodeExecutionAllowed, logger, stringToUuid, } from "@elizaos/core";
 import { hasOwnerAccess } from "../security/access.js";
 /** API port for posting terminal requests. */
 const API_PORT = process.env.API_PORT || process.env.SERVER_PORT || "2138";
@@ -198,8 +198,19 @@ export const terminalAction = {
         "Do NOT use for building projects, creating websites, or multi-step work — use START_CODING_TASK instead. " +
         "The command output is captured as a document attachment for native planner follow-up. After the run, decide whether to reply, stay silent, continue with another action, or save the attachment via the clipboard plugin.",
     descriptionCompressed: "run single explicit shell command user provide directly use user give specific command like run ls - la execute npm install use build project, create website, multi-step work use START_CODING_TASK instead command output captur document attachment native planner follow-up after run, decide whether reply, stay silent, continue w/ another action, save attachment via clipboard plugin",
-    validate: async () => true,
+    validate: async () => isLocalCodeExecutionAllowed(),
     handler: async (runtime, message, _state, options) => {
+        if (!isLocalCodeExecutionAllowed()) {
+            return {
+                success: false,
+                text: buildStoreVariantBlockedMessage("Terminal commands"),
+                data: {
+                    actionName: TERMINAL_ACTION_NAME,
+                    suppressPostActionContinuation: true,
+                    terminal: { storeBuildBlocked: true },
+                },
+            };
+        }
         if (!(await hasOwnerAccess(runtime, message))) {
             return {
                 success: false,

package/{dist/packages → packages}/agent/src/api/misc-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"misc-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/misc-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,KAAK,YAAY,EAIlB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAgBvD,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,KAAK,sBAAsB,GAAG;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAyEF,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC;IAC1B,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,KAAK,EAAE;QACL,MAAM,EAAE,WAAW,CAAC;QACpB,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;QAClC,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;QAC9C,qBAAqB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QACjE,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,mBAAmB,EAAE,CAAC;QACnC,gBAAgB,EAAE,KAAK,CAAC;YACtB,EAAE,EAAE,MAAM,CAAC;YACX,MAAM,EAAE,MAAM,CAAC;YACf,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,GAAG,CAAC,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,eAAe,EAAE,MAAM,CAAC;YACxB,UAAU,EAAE,MAAM,CAAC;SACpB,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;QAC7B,qBAAqB,EAAE,MAAM,EAAE,CAAC;KACjC,CAAC;IACF,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzE,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5E,YAAY,EAAE,CAAC,CAAC,SAAS,MAAM,EAC7B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,OAAO,CAAC,EAAE,mBAAmB,KAC1B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,2BAA2B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,2BAA2B,EAAE,CAC3B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,sBAAsB,KACzB;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/C,0BAA0B,EAAE,CAC1B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,sBAAsB,KACzB,MAAM,GAAG,IAAI,CAAC;IACnB,wBAAwB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACxD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,yBAAyB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACpD;AAMD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,OAAO,CAAC,CAkoBlB"}
+{"version":3,"file":"misc-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/misc-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,KAAK,YAAY,EAMlB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAgBvD,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,KAAK,sBAAsB,GAAG;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAyEF,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC;IAC1B,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,KAAK,EAAE;QACL,MAAM,EAAE,WAAW,CAAC;QACpB,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;QAClC,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;QAC9C,qBAAqB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QACjE,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,mBAAmB,EAAE,CAAC;QACnC,gBAAgB,EAAE,KAAK,CAAC;YACtB,EAAE,EAAE,MAAM,CAAC;YACX,MAAM,EAAE,MAAM,CAAC;YACf,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,GAAG,CAAC,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,eAAe,EAAE,MAAM,CAAC;YACxB,UAAU,EAAE,MAAM,CAAC;SACpB,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;QAC7B,qBAAqB,EAAE,MAAM,EAAE,CAAC;KACjC,CAAC;IACF,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzE,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5E,YAAY,EAAE,CAAC,CAAC,SAAS,MAAM,EAC7B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,OAAO,CAAC,EAAE,mBAAmB,KAC1B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,2BAA2B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,2BAA2B,EAAE,CAC3B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,sBAAsB,KACzB;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/C,0BAA0B,EAAE,CAC1B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,IAAI,EAAE,sBAAsB,KACzB,MAAM,GAAG,IAAI,CAAC;IACnB,wBAAwB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACxD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,yBAAyB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACpD;AAMD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,OAAO,CAAC,CAuoBlB"}

package/{dist/packages → packages}/agent/src/api/misc-routes.js

@@ -7,7 +7,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import crypto from "node:crypto";
-import { composePrompt, customActionGenerateTemplate, ModelType, } from "@elizaos/core";
+import { buildStoreVariantBlockedMessage, composePrompt, customActionGenerateTemplate, isLocalCodeExecutionAllowed, ModelType, } from "@elizaos/core";
 import { asRecord } from "@elizaos/shared";
 import { loadElizaConfig, saveElizaConfig } from "../config/config.js";
 import { buildTestHandler, registerCustomActionLive, } from "../runtime/custom-actions.js";
@@ -170,6 +170,10 @@ export async function handleMiscRoutes(ctx) {
     }
     // ── POST /api/terminal/run ──────────────────────────────────────────
     if (method === "POST" && pathname === "/api/terminal/run") {
+        if (!isLocalCodeExecutionAllowed()) {
+            error(res, buildStoreVariantBlockedMessage("Terminal commands"), 403);
+            return true;
+        }
         if (state.shellEnabled === false) {
             error(res, "Shell access is disabled", 403);
             return true;

package/{dist/packages → packages}/agent/src/api/permissions-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/permissions-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAsB,MAAM,iBAAiB,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,UAAU,8BAA+B,SAAQ,oBAAoB;IACnE,QAAQ,CAAC,EAAE;QACT,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;KACjD,CAAC;CACH;AAuGD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,8BAA8B,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACnD,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,KAAK,EAAE,oBAAoB,CAAC;IAC5B,UAAU,EAAE,CAAC,MAAM,EAAE,8BAA8B,KAAK,IAAI,CAAC;IAC7D,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAClD;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,sBAAsB,GAC1B,OAAO,CAAC,OAAO,CAAC,CA4NlB"}
+{"version":3,"file":"permissions-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/permissions-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,KAAK,EAGV,eAAe,EAChB,MAAM,iBAAiB,CAAC;AAOzB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,UAAU,8BAA+B,SAAQ,oBAAoB;IACnE,QAAQ,CAAC,EAAE;QACT,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;KACjD,CAAC;CACH;AAoLD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,8BAA8B,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACnD,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,KAAK,EAAE,oBAAoB,CAAC;IAC5B,UAAU,EAAE,CAAC,MAAM,EAAE,8BAA8B,KAAK,IAAI,CAAC;IAC7D,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAClD;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,sBAAsB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAwPlB"}

package/{dist/packages → packages}/agent/src/api/permissions-routes.js

@@ -6,16 +6,9 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
+import { getMacPermissionDeepLink, isPermissionId, PERMISSION_IDS, } from "@elizaos/shared";
+import { PERMISSIONS_REGISTRY_SERVICE } from "../services/permissions-registry.js";
 const WEBSITE_BLOCKING_PERMISSION_ID = "website-blocking";
-const ALL_PERMISSION_IDS = [
-    "accessibility",
-    "screen-recording",
-    "microphone",
-    "camera",
-    "shell",
-    "website-blocking",
-    "location",
-];
 const SELFCONTROL_MODULE = "@elizaos/app-lifeops";
 async function loadSelfControlApi() {
     try {
@@ -36,6 +29,16 @@ function currentPlatform() {
     const p = process.platform;
     return p === "darwin" || p === "win32" || p === "linux" ? p : "linux";
 }
+function getPermissionRegistry(runtime) {
+    const service = runtime?.getService(PERMISSIONS_REGISTRY_SERVICE);
+    return service &&
+        typeof service === "object" &&
+        "get" in service &&
+        "check" in service &&
+        "request" in service
+        ? service
+        : null;
+}
 function unavailableWebsiteBlockingPermission() {
     return {
         id: WEBSITE_BLOCKING_PERMISSION_ID,
@@ -56,12 +59,79 @@ function unavailableSystemPermission(id) {
         reason: "Native permission checks are unavailable in this runtime.",
     };
 }
-function buildPermissionsPayload(state, websiteBlockingPermission) {
+async function openSystemPermissionSettings(id) {
+    const platform = currentPlatform();
+    let argv = null;
+    if (platform === "darwin") {
+        argv = ["open", getMacPermissionDeepLink(id)];
+    }
+    else if (platform === "win32") {
+        const settingsMap = {
+            microphone: "ms-settings:privacy-microphone",
+            camera: "ms-settings:privacy-webcam",
+            location: "ms-settings:privacy-location",
+            notifications: "ms-settings:notifications",
+        };
+        const uri = settingsMap[id];
+        if (uri)
+            argv = ["cmd", "/c", "start", uri];
+    }
+    else {
+        const settingsMap = {
+            microphone: "privacy",
+            camera: "privacy",
+            location: "privacy",
+            notifications: "notifications",
+        };
+        const panel = settingsMap[id];
+        if (panel)
+            argv = ["sh", "-lc", `gnome-control-center ${panel}`];
+    }
+    if (!argv)
+        return false;
+    try {
+        const { spawn } = await import("node:child_process");
+        const proc = spawn(argv[0], argv.slice(1), {
+            detached: true,
+            stdio: "ignore",
+        });
+        proc.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function buildPermissionsPayload(state, websiteBlockingPermission, refresh = false) {
     const permissionStates = state.permissionStates ?? {};
     const shellEnabled = state.shellEnabled ?? true;
+    const registry = getPermissionRegistry(state.runtime);
     const permissions = {};
-    for (const id of ALL_PERMISSION_IDS) {
-        permissions[id] = permissionStates[id] ?? unavailableSystemPermission(id);
+    await Promise.all(PERMISSION_IDS.map(async (id) => {
+        if (id === WEBSITE_BLOCKING_PERMISSION_ID) {
+            permissions[id] = websiteBlockingPermission;
+            return;
+        }
+        const persisted = permissionStates[id];
+        if (!refresh && persisted) {
+            permissions[id] = persisted;
+            return;
+        }
+        if (registry) {
+            try {
+                permissions[id] = refresh
+                    ? await registry.check(id)
+                    : registry.get(id);
+                return;
+            }
+            catch {
+                // Fall through to persisted/unavailable state.
+            }
+        }
+        permissions[id] = persisted ?? unavailableSystemPermission(id);
+    }));
+    if (!permissions.shell) {
+        permissions.shell = unavailableSystemPermission("shell");
     }
     permissions.shell = {
         ...permissions.shell,
@@ -87,7 +157,7 @@ export async function handlePermissionRoutes(ctx) {
         return false;
     if (method === "GET" && pathname === "/api/permissions") {
         const websiteBlockingPermission = await getWebsiteBlockingPermissionState();
-        json(res, buildPermissionsPayload(state, websiteBlockingPermission));
+        json(res, await buildPermissionsPayload(state, websiteBlockingPermission));
         return true;
     }
     if (method === "GET" && pathname === "/api/permissions/shell") {
@@ -113,7 +183,7 @@ export async function handlePermissionRoutes(ctx) {
     }
     if (method === "GET" && pathname.startsWith("/api/permissions/")) {
         const permId = pathname.slice("/api/permissions/".length);
-        if (!permId || permId.includes("/")) {
+        if (!permId || permId.includes("/") || !isPermissionId(permId)) {
             error(res, "Invalid permission ID", 400);
             return true;
         }
@@ -121,29 +191,36 @@ export async function handlePermissionRoutes(ctx) {
             json(res, await getWebsiteBlockingPermissionState());
             return true;
         }
-        const permStates = state.permissionStates ?? {};
-        const permState = permStates[permId];
-        if (!permState) {
-            json(res, {
-                id: permId,
-                status: "not-applicable",
-                lastChecked: Date.now(),
-                canRequest: false,
-                platform: currentPlatform(),
-            });
+        const permState = state.permissionStates?.[permId];
+        if (permState) {
+            json(res, permState);
             return true;
         }
-        json(res, permState);
+        const registry = getPermissionRegistry(state.runtime);
+        if (registry) {
+            try {
+                json(res, registry.get(permId));
+                return true;
+            }
+            catch {
+                // Fall through to persisted/unavailable state.
+            }
+        }
+        json(res, unavailableSystemPermission(permId));
         return true;
     }
     if (method === "POST" && pathname === "/api/permissions/refresh") {
         const websiteBlockingPermission = await getWebsiteBlockingPermissionState();
-        json(res, buildPermissionsPayload(state, websiteBlockingPermission));
+        json(res, await buildPermissionsPayload(state, websiteBlockingPermission, true));
         return true;
     }
     if (method === "POST" &&
         pathname.match(/^\/api\/permissions\/[^/]+\/request$/)) {
         const permId = pathname.split("/")[3];
+        if (!isPermissionId(permId)) {
+            error(res, "Invalid permission ID", 400);
+            return true;
+        }
         if (permId === WEBSITE_BLOCKING_PERMISSION_ID) {
             const selfControl = await loadSelfControlApi();
             json(res, selfControl
@@ -151,15 +228,29 @@ export async function handlePermissionRoutes(ctx) {
                 : unavailableWebsiteBlockingPermission());
             return true;
         }
-        json(res, {
-            message: `Permission request for ${permId}`,
-            action: `ipc:permissions:request:${permId}`,
-        });
+        const registry = getPermissionRegistry(state.runtime);
+        if (registry) {
+            try {
+                json(res, await registry.request(permId, {
+                    reason: "Requested from permissions API.",
+                    feature: { app: "settings", action: `request.${permId}` },
+                }));
+                return true;
+            }
+            catch {
+                // Fall through to bridge hint for runtimes without a prober.
+            }
+        }
+        json(res, unavailableSystemPermission(permId));
         return true;
     }
     if (method === "POST" &&
         pathname.match(/^\/api\/permissions\/[^/]+\/open-settings$/)) {
         const permId = pathname.split("/")[3];
+        if (!isPermissionId(permId)) {
+            error(res, "Invalid permission ID", 400);
+            return true;
+        }
         if (permId === WEBSITE_BLOCKING_PERMISSION_ID) {
             try {
                 const selfControl = await loadSelfControlApi();
@@ -179,9 +270,11 @@ export async function handlePermissionRoutes(ctx) {
             }
             return true;
         }
+        const opened = await openSystemPermissionSettings(permId);
         json(res, {
-            message: `Opening settings for ${permId}`,
-            action: `ipc:permissions:openSettings:${permId}`,
+            opened,
+            id: permId,
+            permission: state.permissionStates?.[permId] ?? unavailableSystemPermission(permId),
         });
         return true;
     }