@elizaos/cli 1.5.11-alpha.6 → 1.5.11-beta.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elizaos/cli",
-  "version": "1.5.11-alpha.6",
+  "version": "1.5.11-beta.0",
   "description": "elizaOS CLI - Manage your AI agents and plugins",
   "publishConfig": {
     "access": "public",
@@ -74,17 +74,17 @@
     "typescript": "5.8.3",
     "vite": "^6.3.5"
   },
-  "gitHead": "17eb2ae71c14317a799bfb90b6e0c57ffc813269",
+  "gitHead": "caadaa3d79cb1a2b5ef4655987019ae1fccf3e90",
   "dependencies": {
     "@anthropic-ai/claude-code": "^1.0.35",
     "@anthropic-ai/sdk": "^0.54.0",
     "@clack/prompts": "^0.11.0",
-    "@elizaos/api-client": "1.5.11-alpha.6",
-    "@elizaos/core": "1.5.11-alpha.6",
-    "@elizaos/plugin-bootstrap": "1.5.11-alpha.6",
+    "@elizaos/api-client": "1.5.11-beta.0",
+    "@elizaos/core": "1.5.11-beta.0",
+    "@elizaos/plugin-bootstrap": "1.5.11-beta.0",
     "@elizaos/plugin-openai": "1.0.11",
-    "@elizaos/plugin-sql": "1.5.11-alpha.6",
-    "@elizaos/server": "1.5.11-alpha.6",
+    "@elizaos/plugin-sql": "1.5.11-beta.0",
+    "@elizaos/server": "1.5.11-beta.0",
     "bun": "^1.2.21",
     "chalk": "^5.4.1",
     "chokidar": "^4.0.3",
@@ -102,6 +102,6 @@
     "tsconfig-paths": "^4.2.0",
     "type-fest": "^4.41.0",
     "yoctocolors": "^2.1.1",
-    "zod": "3.24.2"
+    "zod": "4.1.11"
   }
 }

package/templates/plugin-quick-starter/package.json

@@ -39,11 +39,11 @@
     "package.json"
   ],
   "dependencies": {
-    "@elizaos/core": "1.5.11-alpha.6",
-    "zod": "^3.24.4"
+    "@elizaos/core": "1.5.11-beta.0",
+    "zod": "4.1.11"
   },
   "devDependencies": {
-    "@elizaos/cli": "1.5.11-alpha.6",
+    "@elizaos/cli": "1.5.11-beta.0",
     "dotenv": "16.4.5",
     "prettier": "3.5.3",
     "typescript": "5.8.2"
@@ -62,7 +62,7 @@
   },
   "resolutions": {
     "// Note": "langchain 0.3.30 fixes @langchain/core zod/v3 import issues",
-    "zod": "^3.24.4",
+    "zod": "4.1.11",
     "langchain": "0.3.30",
     "@langchain/core": "0.3.30"
   },

package/templates/plugin-starter/package.json

@@ -39,16 +39,16 @@
     "package.json"
   ],
   "dependencies": {
-    "@elizaos/core": "1.5.11-alpha.6",
+    "@elizaos/core": "1.5.11-beta.0",
     "@tanstack/react-query": "^5.80.7",
     "clsx": "^2.1.1",
     "tailwind-merge": "^3.3.1",
     "tailwindcss": "^4.1.10",
     "vite": "^6.3.5",
-    "zod": "3.24.2"
+    "zod": "4.1.11"
   },
   "devDependencies": {
-    "@elizaos/cli": "1.5.11-alpha.6",
+    "@elizaos/cli": "1.5.11-beta.0",
     "@tailwindcss/vite": "^4.1.10",
     "@vitejs/plugin-react-swc": "^3.10.2",
     "dotenv": "16.4.5",
@@ -77,7 +77,7 @@
   },
   "resolutions": {
     "// Note": "langchain 0.3.30 fixes @langchain/core zod/v3 import issues",
-    "zod": "3.24.2",
+    "zod": "4.1.11",
     "langchain": "0.3.30",
     "@langchain/core": "0.3.30"
   },

package/templates/project-starter/package.json

@@ -27,19 +27,19 @@
     "dist"
   ],
   "dependencies": {
-    "@elizaos/cli": "1.5.11-alpha.6",
-    "@elizaos/client": "1.5.11-alpha.6",
-    "@elizaos/core": "1.5.11-alpha.6",
-    "@elizaos/plugin-bootstrap": "1.5.11-alpha.6",
-    "@elizaos/plugin-sql": "1.5.11-alpha.6",
-    "@elizaos/server": "1.5.11-alpha.6",
+    "@elizaos/cli": "1.5.11-beta.0",
+    "@elizaos/client": "1.5.11-beta.0",
+    "@elizaos/core": "1.5.11-beta.0",
+    "@elizaos/plugin-bootstrap": "1.5.11-beta.0",
+    "@elizaos/plugin-sql": "1.5.11-beta.0",
+    "@elizaos/server": "1.5.11-beta.0",
     "@tanstack/react-query": "^5.29.0",
     "clsx": "^2.1.1",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "tailwind-merge": "^2.6.0",
     "tailwindcss": "^4.1.10",
-    "zod": "3.24.2"
+    "zod": "4.1.11"
   },
   "devDependencies": {
     "@types/react": "^18.3.3",

package/templates/project-tee-starter/package.json

@@ -32,11 +32,11 @@
     "GUIDE.md"
   ],
   "dependencies": {
-    "@elizaos/cli": "1.5.11-alpha.6",
-    "@elizaos/core": "1.5.11-alpha.6",
-    "@elizaos/plugin-bootstrap": "1.5.11-alpha.6",
+    "@elizaos/cli": "1.5.11-beta.0",
+    "@elizaos/core": "1.5.11-beta.0",
+    "@elizaos/plugin-bootstrap": "1.5.11-beta.0",
     "@elizaos/plugin-redpill": "1.2.1",
-    "@elizaos/plugin-sql": "1.5.11-alpha.6",
+    "@elizaos/plugin-sql": "1.5.11-beta.0",
     "@phala/dstack-sdk": "0.1.11",
     "@solana/web3.js": "1.98.2",
     "@tanstack/react-query": "^5.29.0",
@@ -46,7 +46,7 @@
     "tailwind-merge": "^2.6.0",
     "tailwindcss": "^4.1.10",
     "viem": "2.30.1",
-    "zod": "3.24.2"
+    "zod": "4.1.11"
   },
   "devDependencies": {
     "@types/jsdom": "^21.1.7",

package/templates/project-tee-starter/src/__tests__/config.test.ts

@@ -48,7 +48,7 @@ describe('Plugin Configuration', () => {
       // Test with invalid config should fail validation during init
       const invalidConfig = { TEE_MODE: 'INVALID_MODE' };
       await expect(teeStarterPlugin.init(invalidConfig, mockRuntime)).rejects.toThrow(
-        'Invalid plugin configuration'
+        'TEE_MODE must be one of: OFF, LOCAL, DOCKER, PRODUCTION'
       );
     } finally {
       // Restore original environment

package/templates/project-tee-starter/src/__tests__/tee-validation.test.ts

@@ -154,7 +154,9 @@ describe('TEE Environment Validation', () => {
         try {
           await expect(async () => {
             await teeStarterPlugin.init?.({}, mockRuntime);
-          }).toThrow('Wallet secret salt must be at least 8 characters long for security');
+          }).toThrow(
+            'Wallet secret salt must be at least 8 characters long for security (excluding whitespace)'
+          );
         } finally {
           // Restore original argv
           process.argv = originalArgv;
@@ -189,7 +191,60 @@ describe('TEE Environment Validation', () => {
 
       await expect(async () => {
         await teeStarterPlugin.init?.({}, mockRuntime);
-      }).toThrow('Wallet secret salt must not exceed 128 characters');
+      }).toThrow('Wallet secret salt must not exceed 128 characters (excluding whitespace)');
+    });
+
+    test('should reject whitespace-only salt', async () => {
+      // Test various whitespace-only values
+      const whitespaceSalts = ['        ', '\t\t\t\t', '   \t   ', '\n\n\n\n\n\n\n\n'];
+
+      for (const salt of whitespaceSalts) {
+        // Remove argv test detection temporarily to test validation
+        const originalArgv = process.argv;
+        process.argv = ['node', 'script.js']; // Remove test from argv
+
+        process.env.NODE_ENV = 'production';
+        process.env.TEE_MODE = 'OFF';
+        process.env.TEE_VENDOR = 'phala';
+        process.env.WALLET_SECRET_SALT = salt;
+
+        try {
+          await expect(async () => {
+            await teeStarterPlugin.init?.({}, mockRuntime);
+          }).toThrow(
+            'Wallet secret salt must be at least 8 characters long for security (excluding whitespace)'
+          );
+        } finally {
+          // Restore original argv
+          process.argv = originalArgv;
+        }
+      }
+    });
+
+    test('should trim salt and accept if valid after trimming', async () => {
+      // Test values with leading/trailing whitespace that are valid after trimming
+      const paddedSalts = [
+        '  valid_salt_123  ',
+        '\tvalid_salt_123\t',
+        '\n\nvalid_salt_123\n\n',
+        '   valid_salt_123   ',
+      ];
+
+      for (const salt of paddedSalts) {
+        process.env.NODE_ENV = 'production';
+        process.env.TEE_MODE = 'OFF';
+        process.env.TEE_VENDOR = 'phala';
+        process.env.WALLET_SECRET_SALT = salt;
+
+        let error = null;
+        try {
+          await teeStarterPlugin.init?.({}, mockRuntime);
+        } catch (e) {
+          error = e;
+        }
+        // Should not throw error since trimmed value is valid
+        expect(error).toBeNull();
+      }
     });
   });
 
@@ -281,10 +336,11 @@ describe('TEE Environment Validation', () => {
         process.env.TEE_VENDOR = ' phala '; // Whitespace around valid value
         process.env.WALLET_SECRET_SALT = ' test_salt_123 '; // Whitespace around valid value
 
-        // Whitespace should cause validation failure (no auto-trim)
+        // TEE_MODE and TEE_VENDOR whitespace should cause validation failure
+        // But WALLET_SECRET_SALT is now trimmed and should pass if length is valid after trimming
         await expect(async () => {
           await teeStarterPlugin.init?.({}, mockRuntime);
-        }).toThrow();
+        }).toThrow(); // Will throw due to TEE_MODE/TEE_VENDOR whitespace
       } finally {
         // Restore original values
         process.argv = originalArgv;

package/templates/project-tee-starter/src/plugin.ts

@@ -28,10 +28,13 @@ const configSchema = z.object({
       }
       return val;
     })
-    .refine((val) => {
-      if (!val) return true; // Allow undefined in non-test environments
-      return ['OFF', 'LOCAL', 'DOCKER', 'PRODUCTION'].includes(val);
-    }, 'TEE_MODE must be one of: OFF, LOCAL, DOCKER, PRODUCTION'),
+    .refine(
+      (val) => {
+        if (!val) return true; // Allow undefined in non-test environments
+        return ['OFF', 'LOCAL', 'DOCKER', 'PRODUCTION'].includes(val);
+      },
+      { message: 'TEE_MODE must be one of: OFF, LOCAL, DOCKER, PRODUCTION' }
+    ),
 
   TEE_VENDOR: z
     .string()
@@ -43,10 +46,13 @@ const configSchema = z.object({
       }
       return val;
     })
-    .refine((val) => {
-      if (!val) return true; // Allow undefined in non-test environments
-      return val === 'phala';
-    }, 'TEE_VENDOR must be: phala'),
+    .refine(
+      (val) => {
+        if (!val) return true; // Allow undefined in non-test environments
+        return val === 'phala';
+      },
+      { message: 'TEE_VENDOR must be: phala' }
+    ),
 
   WALLET_SECRET_SALT: z
     .string()
@@ -60,26 +66,33 @@ const configSchema = z.object({
       }
       if (!val) {
         logger.warn('Warning: Wallet secret salt is not provided');
+        return val;
       }
-      return val;
+      // Trim whitespace to prevent security bypass
+      return val.trim();
     })
     .refine(
       (val) => {
-        if (!val) return true; // Allow undefined in non-test environments
-        const trimmedVal = val.trim();
-        return trimmedVal.length >= 8 && trimmedVal.length <= 128;
+        if (val === undefined) return true; // Allow undefined in non-test environments
+        // Empty string after trimming is not allowed (reject whitespace-only values)
+        if (!val || val.length === 0) return false;
+        // Check trimmed length for security (val is already trimmed from transform)
+        return val.length >= 8;
       },
-      (val) => {
-        if (!val) return { message: 'Wallet secret salt is required' };
-        const trimmedVal = val.trim();
-        if (trimmedVal.length < 8) {
-          return { message: 'Wallet secret salt must be at least 8 characters long for security' };
-        }
-        if (trimmedVal.length > 128) {
-          return { message: 'Wallet secret salt must not exceed 128 characters' };
-        }
-        return { message: 'Invalid wallet secret salt' };
+      {
+        message:
+          'Wallet secret salt must be at least 8 characters long for security (excluding whitespace)',
       }
+    )
+    .refine(
+      (val) => {
+        if (val === undefined) return true; // Allow undefined in non-test environments
+        // Empty strings not allowed (already checked in previous refine, but be consistent)
+        if (!val || val.length === 0) return false;
+        // Check trimmed length (val is already trimmed from transform)
+        return val.length <= 128;
+      },
+      { message: 'Wallet secret salt must not exceed 128 characters (excluding whitespace)' }
     ),
 });
 
@@ -95,7 +108,8 @@ type TeeServiceConfig = {
  */
 const createTeeServiceConfig = (runtime: IAgentRuntime): TeeServiceConfig => ({
   teeClient: new TappdClient(),
-  secretSalt: process.env.WALLET_SECRET_SALT || 'secret_salt',
+  // Ensure salt is trimmed to match validation behavior
+  secretSalt: (process.env.WALLET_SECRET_SALT || 'secret_salt').trim(),
   runtime,
 });
 
@@ -260,9 +274,36 @@ const teeStarterPlugin: Plugin = {
       }
     } catch (error) {
       if (error instanceof z.ZodError) {
-        throw new Error(
-          `Invalid plugin configuration: ${error.errors.map((e) => e.message).join(', ')}`
+        // Check if this is validation with an invalid TEE_MODE from the test
+        const hasInvalidMode = error.issues.some(
+          (e) => e.path[0] === 'TEE_MODE' && e.message.includes('TEE_MODE must be')
         );
+        if (hasInvalidMode) {
+          // Throw the specific validation error for TEE_MODE
+          const teeError = error.issues.find((e) => e.path[0] === 'TEE_MODE');
+          throw new Error(
+            teeError?.message || 'TEE_MODE must be one of: OFF, LOCAL, DOCKER, PRODUCTION'
+          );
+        }
+
+        // Check if this is validation with an invalid TEE_VENDOR from the test
+        const hasInvalidVendor = error.issues.some(
+          (e) => e.path[0] === 'TEE_VENDOR' && e.message.includes('TEE_VENDOR must be')
+        );
+        if (hasInvalidVendor) {
+          const vendorError = error.issues.find((e) => e.path[0] === 'TEE_VENDOR');
+          throw new Error(vendorError?.message || 'TEE_VENDOR must be: phala');
+        }
+
+        // Check if this is validation with an invalid WALLET_SECRET_SALT from the test
+        const hasSaltError = error.issues.some((e) => e.path[0] === 'WALLET_SECRET_SALT');
+        if (hasSaltError) {
+          const saltError = error.issues.find((e) => e.path[0] === 'WALLET_SECRET_SALT');
+          throw new Error(saltError?.message || 'Invalid wallet secret salt');
+        }
+
+        // Generic invalid configuration error
+        throw new Error('Invalid plugin configuration');
       }
       throw error;
     }