@elizaos/app-core 2.0.0-beta.3 → 2.0.3-beta.3

package/scripts/clean-repo.mjs

@@ -16,6 +16,7 @@ import { fileURLToPath } from "node:url";
 import {
   CAPACITOR_PLUGIN_NAMES,
   NATIVE_PLUGINS_ROOT,
+  resolveNativePluginDir as nativePluginDir,
 } from "../../app/scripts/capacitor-plugin-names.mjs";
 import { resolveRepoRootFromImportMeta } from "./lib/repo-root.mjs";
 
@@ -67,19 +68,18 @@ function rmNodeModulesCaches() {
 function rmPluginDists() {
   const pluginsRoot = NATIVE_PLUGINS_ROOT;
   if (!existsSync(pluginsRoot)) return;
-  const relPlugins =
-    path.relative(root, pluginsRoot) || "eliza/packages/native-plugins";
   for (const name of CAPACITOR_PLUGIN_NAMES) {
-    rmPath(`${relPlugins}/${name}/dist`, path.join(pluginsRoot, name, "dist"));
+    const dir = nativePluginDir(name);
+    rmPath(path.relative(root, dir) + "/dist", path.join(dir, "dist"));
   }
   // Any extra plugin dirs (not in canonical list) still get dist removed
   try {
     for (const ent of readdirSync(pluginsRoot, { withFileTypes: true })) {
       if (!ent.isDirectory()) continue;
-      if (CAPACITOR_PLUGIN_NAMES.includes(ent.name)) continue;
+      if (!ent.name.startsWith("plugin-native-")) continue;
       const dist = path.join(pluginsRoot, ent.name, "dist");
       if (existsSync(dist)) {
-        rmPath(`${relPlugins}/${ent.name}/dist`, dist);
+        rmPath(`${path.relative(root, pluginsRoot)}/${ent.name}/dist`, dist);
       }
     }
   } catch {

package/scripts/codesign-mas.mjs

@@ -3,9 +3,11 @@
  * Mac App Store post-package codesign.
  *
  * Walks a built .app bundle bottom-up, signing every Mach-O binary with the
- * child entitlements (mas-child.entitlements: app-sandbox + cs.inherit), then
- * signs the outer .app with the parent entitlements (mas.entitlements). Final
- * step verifies the bundle and (optionally) productbuilds a .pkg installer.
+ * narrowest applicable entitlements. Most nested code gets
+ * mas-child.entitlements (app-sandbox + cs.inherit). The bundled Bun helper,
+ * which imports Apple's JIT write-protection APIs on macOS, gets
+ * mas-bun.entitlements (child entitlements + allow-jit). The outer .app gets
+ * mas.entitlements and does not receive broad code-signing exceptions.
  *
  * Apple TN2206 mandates inside-out signing: deepest binaries first, then
  * frameworks (sealing their resources), then the outer .app. Anything not in
@@ -20,11 +22,11 @@
  *                         [--out=path/to/out.pkg]
  *
  * Env equivalents (CLI args win):
- *   MILADY_MAS_SIGNING_IDENTITY
- *   MILADY_MAS_INSTALLER_IDENTITY
- *   MILADY_APPLE_TEAM_ID
+ *   ELIZA_MAS_SIGNING_IDENTITY
+ *   ELIZA_MAS_INSTALLER_IDENTITY
+ *   ELIZA_APPLE_TEAM_ID
  *
- * Exits non-zero on any signing or verification failure. No try/catch sludge.
+ * Exits non-zero on any signing or verification failure.
  */
 
 import { spawnSync } from "node:child_process";
@@ -39,6 +41,13 @@ import {
 } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import {
+  assertMasEntitlementRuntimeEvidence,
+  assertReviewedEntitlementsFile,
+  assertReviewedEntitlementsText,
+  loadEntitlementReviewManifest,
+  scanAppleAppBundleForNativeRuntimeSignals,
+} from "./lib/apple-entitlement-audit.mjs";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -51,6 +60,7 @@ const CHILD_ENTITLEMENTS = path.join(
   ENTITLEMENTS_DIR,
   "mas-child.entitlements",
 );
+const BUN_ENTITLEMENTS = path.join(ENTITLEMENTS_DIR, "mas-bun.entitlements");
 
 const MACHO_MAGIC = new Set([
   0xfeedface,
@@ -61,6 +71,58 @@ const MACHO_MAGIC = new Set([
   0xbebafeca, // fat
 ]);
 
+const FORBIDDEN_MAS_CODE_SIGNING_EXCEPTIONS = [
+  "com.apple.security.cs.allow-unsigned-executable-memory",
+  "com.apple.security.cs.disable-library-validation",
+  "com.apple.security.cs.allow-dyld-environment-variables",
+];
+
+/**
+ * Mach-O basenames that get the Bun-specific MAS entitlements
+ * (`mas-bun.entitlements`: app-sandbox + cs.inherit + allow-jit).
+ *
+ * Kept as a Set keyed by basename so the smoke harness and the signer agree
+ * on which binaries are "the Bun helper". Today there is exactly one entry
+ * because we ship one Bun runtime; if a fat-bundle ever ships a renamed Bun
+ * helper, add the basename here.
+ */
+export const BUN_HELPER_BINARY_NAMES = new Set(["bun"]);
+
+/**
+ * True when `target` is the Bun runtime helper inside `appPath` — the only
+ * Mach-O that should receive `mas-bun.entitlements`.
+ *
+ * Anchors on the relative location `Contents/MacOS/<basename>` so a stray
+ * `bun`-named binary buried deeper in the bundle does not silently pick up
+ * the JIT entitlement.
+ */
+export function isBunHelperBinary(target, appPath) {
+  const rel = path.relative(appPath, target).split(path.sep).join("/");
+  const basename = path.basename(rel);
+  if (!BUN_HELPER_BINARY_NAMES.has(basename)) return false;
+  return rel === `Contents/MacOS/${basename}`;
+}
+
+function parentAppExecutablePath(appPath) {
+  const infoPlist = path.join(appPath, "Contents", "Info.plist");
+  if (!existsSync(infoPlist)) return null;
+  const content = readFileSync(infoPlist, "utf8");
+  const match = content.match(
+    /<key>CFBundleExecutable<\/key>\s*<string>([^<]+)<\/string>/,
+  );
+  const executable = match?.[1]?.trim();
+  return executable
+    ? path.join(appPath, "Contents", "MacOS", executable)
+    : null;
+}
+
+function isParentAppExecutable(target, appPath) {
+  const executablePath = parentAppExecutablePath(appPath);
+  return executablePath
+    ? path.resolve(target) === path.resolve(executablePath)
+    : false;
+}
+
 function parseArgs(argv) {
   const out = {};
   for (const arg of argv.slice(2)) {
@@ -161,6 +223,21 @@ function runOrPrint(cmd, args, dryRun) {
   return result;
 }
 
+function runCapture(cmd, args) {
+  const display = `${cmd} ${args.map((a) => (a.includes(" ") ? `"${a}"` : a)).join(" ")}`;
+  const result = spawnSync(cmd, args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if (result.status !== 0) {
+    process.stderr.write(result.stderr ?? "");
+    process.stdout.write(result.stdout ?? "");
+    process.exitCode = result.status ?? 1;
+    throw new Error(`Command failed (${result.status}): ${display}`);
+  }
+  return result.stdout;
+}
+
 function plistLint(filePath) {
   if (!existsSync(filePath)) {
     throw new Error(`Entitlements file missing: ${filePath}`);
@@ -174,6 +251,66 @@ function plistLint(filePath) {
   }
 }
 
+function assertSourceEntitlementsReviewed(manifest) {
+  assertReviewedEntitlementsFile({
+    filePath: PARENT_ENTITLEMENTS,
+    targetId: "macos-mas-app",
+    manifest,
+    label: "macOS MAS parent entitlements",
+  });
+  assertReviewedEntitlementsFile({
+    filePath: CHILD_ENTITLEMENTS,
+    targetId: "macos-mas-child",
+    manifest,
+    label: "macOS MAS child entitlements",
+  });
+  assertReviewedEntitlementsFile({
+    filePath: BUN_ENTITLEMENTS,
+    targetId: "macos-mas-bun",
+    manifest,
+    label: "macOS MAS Bun helper entitlements",
+  });
+}
+
+function assertNoForbiddenMasExceptions(filePath) {
+  const content = readFileSync(filePath, "utf8");
+  const forbidden = FORBIDDEN_MAS_CODE_SIGNING_EXCEPTIONS.filter((key) =>
+    content.includes(key),
+  );
+  if (forbidden.length === 0) return;
+  throw new Error(
+    `MAS entitlements file contains forbidden code-signing exception(s): ${filePath}\n` +
+      forbidden.map((key) => `  - ${key}`).join("\n"),
+  );
+}
+
+function assertSignedEntitlements(
+  target,
+  targetId,
+  label,
+  manifest,
+  { allowAbsent = false } = {},
+) {
+  const entitlementsXml = runCapture("codesign", [
+    "-d",
+    "--entitlements",
+    ":-",
+    target,
+  ]);
+  if (!/<dict\b/i.test(entitlementsXml)) {
+    if (allowAbsent) {
+      return null;
+    }
+    throw new Error(`${label}: signed code has no readable entitlements`);
+  }
+  return assertReviewedEntitlementsText({
+    plistXml: entitlementsXml,
+    targetId,
+    manifest,
+    label,
+  });
+}
+
 function sign(target, entitlements, identity, dryRun) {
   runOrPrint(
     "codesign",
@@ -192,6 +329,21 @@ function sign(target, entitlements, identity, dryRun) {
   );
 }
 
+function entitlementsForMacho(target, appPath) {
+  return isBunHelperBinary(target, appPath)
+    ? BUN_ENTITLEMENTS
+    : CHILD_ENTITLEMENTS;
+}
+
+function entitlementTargetIdForMacho(target, appPath) {
+  if (isParentAppExecutable(target, appPath)) {
+    return "macos-mas-app";
+  }
+  return isBunHelperBinary(target, appPath)
+    ? "macos-mas-bun"
+    : "macos-mas-child";
+}
+
 function main() {
   const args = parseArgs(process.argv);
 
@@ -215,10 +367,10 @@ function main() {
   const dryRun = Boolean(args["dry-run"]);
 
   const identity =
-    args.identity ?? process.env.MILADY_MAS_SIGNING_IDENTITY ?? null;
+    args.identity ?? process.env.ELIZA_MAS_SIGNING_IDENTITY ?? null;
   if (!identity) {
     console.error(
-      "error: --identity or MILADY_MAS_SIGNING_IDENTITY required " +
+      "error: --identity or ELIZA_MAS_SIGNING_IDENTITY required " +
         '(e.g. "3rd Party Mac Developer Application: Acme (TEAMID)")',
     );
     process.exit(2);
@@ -226,11 +378,17 @@ function main() {
 
   const installerIdentity =
     args["installer-identity"] ??
-    process.env.MILADY_MAS_INSTALLER_IDENTITY ??
+    process.env.ELIZA_MAS_INSTALLER_IDENTITY ??
     null;
 
   plistLint(PARENT_ENTITLEMENTS);
   plistLint(CHILD_ENTITLEMENTS);
+  plistLint(BUN_ENTITLEMENTS);
+  assertNoForbiddenMasExceptions(PARENT_ENTITLEMENTS);
+  assertNoForbiddenMasExceptions(CHILD_ENTITLEMENTS);
+  assertNoForbiddenMasExceptions(BUN_ENTITLEMENTS);
+  const entitlementManifest = loadEntitlementReviewManifest();
+  assertSourceEntitlementsReviewed(entitlementManifest);
 
   console.log(`MAS codesign for ${appPath}`);
   console.log(`  identity: ${identity}`);
@@ -239,16 +397,16 @@ function main() {
   }
   console.log(`  parent entitlements: ${PARENT_ENTITLEMENTS}`);
   console.log(`  child entitlements:  ${CHILD_ENTITLEMENTS}`);
+  console.log(`  bun entitlements:    ${BUN_ENTITLEMENTS}`);
   if (dryRun) console.log("  mode: DRY RUN — no commands will execute");
 
   const { machos, bundles } = findSigningUnits(appPath);
 
-  // 1. Sign all loose Mach-O binaries with child entitlements (deepest first).
-  console.log(
-    `\nSigning ${machos.length} Mach-O binaries (child entitlements):`,
-  );
+  // 1. Sign all loose Mach-O binaries with the narrowest matching
+  // entitlements (deepest first).
+  console.log(`\nSigning ${machos.length} Mach-O binaries:`);
   for (const target of machos) {
-    sign(target, CHILD_ENTITLEMENTS, identity, dryRun);
+    sign(target, entitlementsForMacho(target, appPath), identity, dryRun);
   }
 
   // 2. Sign nested bundles (frameworks, helper apps, xpc, .bundle) deepest-first.
@@ -271,6 +429,50 @@ function main() {
     dryRun,
   );
 
+  if (!dryRun) {
+    console.log(`\nAuditing signed entitlements:`);
+    const nativeScan = scanAppleAppBundleForNativeRuntimeSignals(appPath);
+    for (const target of machos) {
+      const targetId = entitlementTargetIdForMacho(target, appPath);
+      const entitlements = assertSignedEntitlements(
+        target,
+        targetId,
+        `signed Mach-O ${path.relative(appPath, target)}`,
+        entitlementManifest,
+        { allowAbsent: /\.(dylib|so|node)$/i.test(target) },
+      );
+      if (!entitlements) continue;
+      assertMasEntitlementRuntimeEvidence({
+        entitlements,
+        scan: nativeScan,
+        label: `signed Mach-O ${path.relative(appPath, target)}`,
+      });
+    }
+    for (const target of bundles) {
+      assertSignedEntitlements(
+        target,
+        "macos-mas-child",
+        `signed nested bundle ${path.relative(appPath, target)}`,
+        entitlementManifest,
+      );
+    }
+    assertSignedEntitlements(
+      appPath,
+      "macos-mas-app",
+      `signed parent app ${path.basename(appPath)}`,
+      entitlementManifest,
+    );
+
+    console.log(`\nNative runtime evidence scan:`);
+    console.log(`  Mach-O files: ${nativeScan.machOCount}`);
+    console.log(
+      `  JIT/executable-memory findings: ${nativeScan.jitExecutableMemory.length}`,
+    );
+    console.log(
+      `  native library findings: ${nativeScan.dynamicLibraryLoading.length}`,
+    );
+  }
+
   // 5. Optional productbuild for MAS submission.
   if (installerIdentity) {
     const pkgOut =
@@ -294,4 +496,8 @@ function main() {
   console.log(`\n${dryRun ? "[dry-run] " : ""}Done.`);
 }
 
-main();
+// Run only when invoked as a script; the smoke harness imports
+// `BUN_HELPER_BINARY_NAMES` / `isBunHelperBinary` from this module.
+if (process.argv[1] && path.resolve(process.argv[1]) === __filename) {
+  main();
+}

package/scripts/collect-docker-runtime-deps.mjs

@@ -0,0 +1,229 @@
+#!/usr/bin/env node
+/**
+ * Collect the third-party (non-@elizaos) runtime dependency closure for the
+ * agent Docker image.
+ *
+ * Background: the CI image (deploy/Dockerfile.ci) ships pre-transpiled
+ * artifacts and links a fixed set of workspace packages into
+ * /app/node_modules (see link-docker-local-app-packages.mjs). Some of those
+ * packages are transpiled (tsc, not bundled), so their bare third-party imports
+ * stay external and must resolve from node_modules at runtime; others are
+ * bundled with a small third-partys list. The image used to install a
+ * hand-maintained allowlist of those third-partys, which had to be extended by
+ * hand every time a newly-linked package pulled in a new dependency, causing
+ * repeated boot-crash / rebuild loops.
+ *
+ * This script replaces that hand-maintained list with a DERIVED one: it reads
+ * the declared `dependencies` of every workspace package that is linked into
+ * the image, drops the workspace (@elizaos/*) entries (those are linked
+ * separately, not installed from the registry), and emits the union as
+ * `name@version` install specifiers. `npm install` then resolves the full
+ * transitive closure automatically.
+ *
+ * Versions: each dependency is pinned to the exact version the workspace
+ * lockfile resolves (bun.lock), falling back to the declared range when the
+ * lockfile cannot be read. This keeps the image build reproducible.
+ *
+ * Usage:
+ *   node collect-docker-runtime-deps.mjs            # prints `name@version`, one per line
+ *   node collect-docker-runtime-deps.mjs --json     # prints a JSON array
+ *   node collect-docker-runtime-deps.mjs --names    # prints bare names, one per line
+ *                                                   # (for pre-clean rm -rf)
+ *
+ * The set of linked packages MUST stay in sync with the `localPackages`
+ * array in link-docker-local-app-packages.mjs. It is duplicated here (rather
+ * than imported) because that module performs filesystem linking as a side
+ * effect at import time.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+// scripts/ -> app-core -> packages -> repo root
+const repoRoot = path.resolve(__dirname, "..", "..", "..");
+
+// Workspace packages linked into the image by
+// link-docker-local-app-packages.mjs. The agent entrypoint package itself is
+// relinked separately (relink-workspace-packages-to-dist.mjs @elizaos/agent),
+// so include it here too so its declared deps are part of the closure.
+//
+// NOTE: @elizaos/ui is intentionally excluded. It is linked into the image
+// for module-resolution integrity, but it is a pure browser/React package
+// (radix-ui, three, recharts, react-router, ...). The headless server
+// runtime never imports its components; the dashboard ships as pre-built
+// static assets. Installing its ~50 frontend deps would massively bloat the
+// image (and pull native/canvas deps) for code that is never evaluated on
+// the boot or request path.
+const LINKED_WORKSPACE_PACKAGES = [
+  "packages/agent",
+  "packages/core",
+  "packages/contracts",
+  "packages/cloud-routing",
+  "packages/app-core",
+  "packages/cloud-sdk",
+  "packages/shared",
+  "packages/skills",
+  "packages/vault",
+  // Imported by packages/agent/src/services/remote-plugin-bridge.ts
+  // ("@elizaos/plugin-worker-runtime/error"). The custom-character boot path
+  // goes through remote-plugin-bridge, so without this the container crashes
+  // with ERR_MODULE_NOT_FOUND on plugin-worker-runtime/dist/index.js whenever
+  // an injected character (ELIZA_AGENT_CHARACTER_JSON) is loaded.
+  "packages/plugin-worker-runtime",
+  "plugins/plugin-companion",
+  "plugins/plugin-elizamaker",
+  "plugins/plugin-documents",
+  "plugins/plugin-personal-assistant",
+  "plugins/plugin-steward-app",
+  "plugins/plugin-task-coordinator",
+  "plugins/plugin-training",
+  "plugins/plugin-shopify-ui",
+  "plugins/plugin-vincent",
+  "plugins/plugin-agent-skills",
+  "plugins/plugin-app-manager",
+  "plugins/plugin-browser",
+  "plugins/plugin-capacitor-bridge",
+  "plugins/plugin-coding-tools",
+  "plugins/plugin-computeruse",
+  "plugins/plugin-discord",
+  "plugins/plugin-elizacloud",
+  "plugins/plugin-imessage",
+  "plugins/plugin-local-inference",
+  "plugins/plugin-mcp",
+  "plugins/plugin-pdf",
+  "plugins/plugin-signal",
+  "plugins/plugin-streaming",
+  "plugins/plugin-native-activity-tracker",
+  "plugins/plugin-sql",
+  "plugins/plugin-telegram",
+  "plugins/plugin-video",
+  "plugins/plugin-wallet",
+  "plugins/plugin-whatsapp",
+  "plugins/plugin-workflow",
+  "plugins/plugin-x402",
+];
+
+// Native / desktop / GPU packages that the image deliberately removes or that
+// cannot install in the slim Linux runtime. Excluding them keeps `npm
+// install` from failing on optional native builds the agent never loads on
+// boot. (The image already prunes @node-llama-cpp GPU variants, storybook,
+// and the desktop-only orchestrator.)
+const EXCLUDE = new Set([
+  // Desktop / Electron / Capacitor native shells (not used by the headless
+  // server runtime).
+  "@capacitor/core",
+  "@capacitor/cli",
+  "@capacitor-community/sqlite",
+  "@capacitor/barcode-scanner",
+  "@capacitor/haptics",
+  "@capacitor/keyboard",
+  "@capacitor/preferences",
+  "@capacitor/push-notifications",
+  "electrobun",
+]);
+
+function readJson(p) {
+  return JSON.parse(fs.readFileSync(p, "utf8"));
+}
+
+/**
+ * Build a name -> exact-version map from bun.lock so deps pin reproducibly.
+ * bun.lock is JSONC-ish (trailing commas); we only need the top-level
+ * "packages" map whose entries look like:
+ *   "name": ["name@version", "...", {...}, "sha..."]
+ * We extract the version from the first array element.
+ */
+function loadLockVersions() {
+  const lockPath = path.join(repoRoot, "bun.lock");
+  const versions = new Map();
+  let text;
+  try {
+    text = fs.readFileSync(lockPath, "utf8");
+  } catch {
+    return versions;
+  }
+  // Match:  "key": ["pkg@1.2.3", ...
+  const re = /"([^"]+)":\s*\[\s*"((?:@[^"/]+\/)?[^"@/][^"@]*)@([^"]+)"/g;
+  for (const match of text.matchAll(re)) {
+    const declaredName = match[2];
+    const version = match[3];
+    // Keep the first (top-level) resolution for each package name. Nested
+    // keys like "foo/bar" (a transitive dep of foo) are skipped so we pin to
+    // the hoisted/top-level version the workspace actually builds against.
+    if (!declaredName.includes("/") || declaredName.startsWith("@")) {
+      if (!versions.has(declaredName)) {
+        versions.set(declaredName, version);
+      }
+    }
+  }
+  return versions;
+}
+
+function isExternal(name) {
+  return !name.startsWith("@elizaos/") && !EXCLUDE.has(name);
+}
+
+function main() {
+  const asJson = process.argv.includes("--json");
+  const namesOnly = process.argv.includes("--names");
+  const lockVersions = loadLockVersions();
+  // name -> Set of declared ranges (for diagnostics if unpinned)
+  const collected = new Map();
+
+  for (const rel of LINKED_WORKSPACE_PACKAGES) {
+    const pkgJsonPath = path.join(repoRoot, rel, "package.json");
+    let pkg;
+    try {
+      pkg = readJson(pkgJsonPath);
+    } catch {
+      // A package listed for linking may not exist in every checkout; skip.
+      continue;
+    }
+    const deps = pkg.dependencies ?? {};
+    for (const [name, range] of Object.entries(deps)) {
+      if (!isExternal(name)) continue;
+      if (typeof range === "string" && range.startsWith("workspace:")) continue;
+      if (!collected.has(name)) collected.set(name, new Set());
+      collected.get(name).add(range);
+    }
+  }
+
+  const names = [...collected.keys()].sort();
+  const specifiers = [];
+  const unpinned = [];
+  for (const name of names) {
+    const exact = lockVersions.get(name);
+    if (exact) {
+      specifiers.push(`${name}@${exact}`);
+    } else {
+      // Fall back to a declared range (pick the first). npm will resolve it.
+      const range = [...collected.get(name)][0];
+      specifiers.push(`${name}@${range}`);
+      unpinned.push(`${name} (${range})`);
+    }
+  }
+
+  if (namesOnly) {
+    process.stdout.write(`${names.join("\n")}\n`);
+    return;
+  }
+
+  if (unpinned.length > 0) {
+    process.stderr.write(
+      `[collect-docker-runtime-deps] WARN: no lockfile pin for ${unpinned.length} dep(s); using declared range: ${unpinned.join(", ")}\n`,
+    );
+  }
+  process.stderr.write(
+    `[collect-docker-runtime-deps] ${specifiers.length} third-party runtime deps across ${LINKED_WORKSPACE_PACKAGES.length} linked packages\n`,
+  );
+
+  if (asJson) {
+    process.stdout.write(`${JSON.stringify(specifiers, null, 2)}\n`);
+  } else {
+    process.stdout.write(`${specifiers.join("\n")}\n`);
+  }
+}
+
+main();