{
  "interval": {
    "intervalStart": "2026-03-26T00:00:00.000Z",
    "intervalEnd": "2026-03-27T00:00:00.000Z",
    "intervalType": "day"
  },
  "repository": "elizaos/eliza",
  "overview": "From 2026-03-26 to 2026-03-27, elizaos/eliza had 7 new PRs (3 merged), 1 new issues, and 8 active contributors.",
  "topIssues": [
    {
      "id": "I_kwDOMT5cIs73Maho",
      "title": "Plugin Proposal: AgentID — Cryptographic Identity & Trust Layer for ElizaOS Agents",
      "author": "haroldmalikfrimpong-ops",
      "number": 6688,
      "repository": "elizaos/eliza",
      "body": "## Summary\n\nAgentID provides cryptographic identity, trust levels, and blockchain receipts for AI agents. Proposing an `@elizaos/plugin-agentid` integration.\n\n## Why This Fits ElizaOS\n\n- **Ed25519 native** — AgentID uses Ed25519 keys, same as Solana. Agent's identity key IS a Solana wallet address.\n- **Agent-as-wallet** — register an agent, automatically get a Solana address. Hold funds, send/receive stablecoins.\n- **Trust levels (L0-L4)** — automatic promotion/demotion based on verification history. Spending authority gated per level.\n- **Challenge-response** — real-time proof of key ownership. Stops impersonation.\n- **Behavioural fingerprinting** — detect when an agent acts unusual (frequency spikes, unusual hours, new actions).\n- **Dual receipts** — every action gets both a hash receipt (HMAC-SHA256) and a Solana blockchain receipt.\n- **Multi-chain** — Solana, Ethereum, Polygon wallet binding.\n\n## What the Plugin Would Provide\n\n- Auto-register ElizaOS agents with AgentID on startup\n- Verify other agents before interaction\n- Trust-gated actions (only interact with L2+ agents)\n- Blockchain receipts for every agent action\n- Built-in Solana wallet from the agent's Ed25519 key\n\n## Links\n\n- GitHub: https://github.com/haroldmalikfrimpong-ops/getagentid\n- Website: https://getagentid.dev\n- Python SDK: `pip install getagentid`\n- CrewAI integration: https://github.com/haroldmalikfrimpong-ops/agentid-crewai\n- LangChain integration: https://github.com/haroldmalikfrimpong-ops/agentid-langchain\n\nHappy to build the plugin or collaborate.",
      "createdAt": "2026-03-26T20:46:25Z",
      "closedAt": null,
      "state": "OPEN",
      "commentCount": 2
    }
  ],
  "topPRs": [
    {
      "id": "PR_kwDOMT5cIs7N0CVY",
      "title": "feat(plugin-gas-station): add @elizaos/plugin-gas-station — USDC→gas swaps for AI agents on Polygon",
      "author": "pino12033",
      "number": 6686,
      "body": "## Summary\n\nThis PR adds **`@elizaos/plugin-gas-station`** — a plugin that lets ElizaOS agents autonomously swap USDC for native gas (POL/ETH) on Polygon using a trustless smart contract.\n\n---\n\n## The Problem: Cold-Start Gas\n\nAn AI agent or fresh wallet receives USDC (via bridge, API payment, etc.) but has **zero native gas** and cannot transact. Existing relay solutions are either expensive (Gelato: $70/month) or unreliable (public faucets). There's no simple, trustless primitive for this.\n\n---\n\n## The Solution\n\n[GasStation.sol](https://github.com/pino12033/gas-station-sol) is a trustless Solidity contract that:\n- Accepts USDC (ERC-20) via standard `approve` + `buyGas()`\n- Returns native POL/ETH at a fixed on-chain rate\n- Supports gasless EIP-2612 Permit flow (zero gas required from user)\n- Charges a configurable fee (default 3%) accumulated for the operator\n\nThis plugin wraps that contract as an ElizaOS action.\n\n---\n\n## What's Added\n\n```\npackages/plugin-gas-station/\n├── package.json          # @elizaos/plugin-gas-station\n├── tsconfig.json\n├── README.md             # Full docs\n└── src/\n    ├── index.ts          # Plugin export + /status HTTP route\n    └── actions/\n        └── buyGas.ts     # BUY_GAS action (mock + live modes)\n```\n\n### Plugin API\n\n```ts\nimport { gasStationPlugin } from \"@elizaos/plugin-gas-station\";\n\nconst runtime = new AgentRuntime({\n  plugins: [gasStationPlugin],\n});\n```\n\n### BUY_GAS Action\n\nTriggers on natural language like:\n- \"buy gas for 2 USDC\"\n- \"I need gas, use 5 USDC\"  \n- \"swap USDC for POL\"\n\nParameters:\n| Param | Type | Required | Description |\n|---|---|---|---|\n| `amount_usdc` | number | ✅ | USDC to spend (0.01–50) |\n| `recipient` | address | ❌ | Who gets gas (default: agent wallet) |\n\n### Two Operating Modes\n\n**Mock mode** (default — no contract needed):\n```\n🔧 GasStation (Mock Mode)\nSimulated swap: 2 USDC → 19.4000 POL\nFee: 0.0600 USDC (3%)\n⚠️ MOCK MODE — set GAS_STATION_ADDRESS to enable live swaps.\n```\n\n**Live mode** (when contract is deployed):\n```\n✅ Gas purchased successfully!\n- Spent: 2 USDC → 19.4 POL\n- Tx: 0x1234... (PolygonScan link)\n```\n\n### Configuration\n\n| Variable | Description |\n|---|---|\n| `GAS_STATION_ADDRESS` | Deployed contract (enables live mode) |\n| `GAS_STATION_PRIVATE_KEY` | Agent wallet key |\n| `GAS_STATION_RPC_URL` | RPC endpoint (default: polygon-rpc.com) |\n| `GAS_STATION_MOCK` | Force mock mode |\n\n### HTTP Status Route\n\n`GET /gas-station/status` — returns contract liquidity and mode.\n\n---\n\n## Contract Status\n\nThe GasStation.sol contract is **ready and audited**. Deployment on Polygon mainnet requires $25–50 POL seed funding (human action). Until then, the plugin operates in **mock mode** with full live-ready code.\n\n---\n\n## Why This Matters for ElizaOS\n\n- Agents with USDC can now bootstrap gas autonomously — no human intervention\n- Enables fully autonomous on-chain workflows for ElizaOS agents\n- Zero external dependencies in mock mode — works out of the box\n- Fits the Nosana × ElizaOS bounty scope ($3,000 for AI × blockchain integrations)\n\n---\n\n## Testing\n\n```bash\ncd packages/plugin-gas-station\nbun install\nbun run typecheck\nbun run test\n```\n\nMock mode works without any contract deployment or private key.\n\n---\n\n## Related\n\n- Smart contract: https://github.com/pino12033/gas-station-sol\n- Nosana × ElizaOS bounty: $3,000 for blockchain agent integrations\n\n<!-- greptile_comment -->\n\n<h3>Greptile Summary</h3>\n\nThis PR introduces `@elizaos/plugin-gas-station`, a new plugin that lets ElizaOS agents autonomously swap USDC for native gas tokens (POL/ETH) on Polygon via a trustless `GasStation.sol` contract. The plugin registers a `BUY_GAS` action and exposes a `/gas-station/status` HTTP route, falling back to mock mode when no live contract is configured.\\n\\n**Key findings:**\\n\\n- **Missing upper-bound validation on `amount_usdc`** — the parameter schema declares `maximum: 50` but the handler only checks `<= 0`. An agent could approve and spend an arbitrarily large USDC amount.\\n- **`approve` receipt status is not checked** — if the USDC `approve` transaction reverts, the code proceeds to call `buyGas` anyway, producing a confusing downstream revert.\\n- **TypeScript strict-mode narrowing issue** — `contractAddress` and `privateKey` are typed `string | undefined` after `getSetting()` and are passed to `liveBuyGas` (which requires `string`) without explicit non-null assertion; `tsc --noEmit` will likely fail.\\n- **Stale quote used for displayed POL amount** — `netNative` is fetched from `quote()` before the transaction executes; the on-chain rate could change, making the \\\"Received\\\" figure inaccurate.\\n- **Unused imports and dead code** — `parseEther` is imported but never used; the `ONE_USDC` constant is declared but never referenced.\\n- **ABI duplication** — the `liquidity()` ABI fragment is copy-pasted into `index.ts` instead of imported from `buyGas.ts`.\\n- **No test files shipped** — the PR description mentions tests and `vitest` is configured, but no `*.test.ts` files are included.\n\n<h3>Confidence Score: 2/5</h3>\n\nNot safe to merge — live mode has exploitable fund-loss vectors and a TypeScript build failure.\n\nTwo P1 logic issues directly affect fund safety in live mode: missing upper-bound check on amount_usdc and unverified approve receipt. The TypeScript narrowing issue will fail tsc --noEmit, blocking CI. Stale quote display and absence of tests further reduce confidence.\n\npackages/plugin-gas-station/src/actions/buyGas.ts requires the most attention — all critical issues are concentrated there.\n\n<h3>Important Files Changed</h3>\n\n| Filename | Overview |\n|----------|----------|\n| packages/plugin-gas-station/src/actions/buyGas.ts | Core action implementing USDC→gas swap; contains unused imports/constants, missing bounds enforcement, approve-receipt not checked for success, stale quote used for displayed POL amount, and a TypeScript strict-mode narrowing issue. |\n| packages/plugin-gas-station/src/index.ts | Plugin entry point and HTTP status route; liquidity ABI is duplicated from buyGas.ts; otherwise straightforward plugin wiring. |\n| packages/plugin-gas-station/package.json | Package manifest with workspace dependency on @elizaos/core and viem; version pinned to 1.0.0 which differs from other packages in the monorepo. |\n| packages/plugin-gas-station/tsconfig.json | Standard TypeScript configuration extending the base monorepo tsconfig; no issues found. |\n| packages/plugin-gas-station/README.md | Comprehensive README documenting the plugin's purpose, config, usage, and economics; no code issues. |\n\n</details>\n\n<h3>Sequence Diagram</h3>\n\n```mermaid\nsequenceDiagram\n    participant User\n    participant ElizaOS as ElizaOS Agent\n    participant BuyGasAction as BUY_GAS Action\n    participant USDC as USDC Contract\n    participant GasStation as GasStation.sol\n\n    User->>ElizaOS: \"buy gas for 2 USDC\"\n    ElizaOS->>BuyGasAction: handler(amount_usdc=2, recipient?)\n\n    alt Mock Mode (no contract configured)\n        BuyGasAction-->>ElizaOS: Simulated swap result\n        ElizaOS-->>User: \"Mock: 2 USDC → 19.4 POL\"\n    else Live Mode\n        BuyGasAction->>GasStation: quote(tokenAmount)\n        GasStation-->>BuyGasAction: (grossNative, feeNative, netNative, sufficient)\n        BuyGasAction->>USDC: approve(gasStation, tokenAmount)\n        USDC-->>BuyGasAction: approveTx receipt\n        BuyGasAction->>GasStation: buyGas(tokenAmount, recipient)\n        GasStation-->>BuyGasAction: buyTx receipt\n        BuyGasAction-->>ElizaOS: success + txHash\n        ElizaOS-->>User: \"Spent 2 USDC → 19.4 POL, Tx: 0x...\"\n    end\n```\n\n<sub>Reviews (1): Last reviewed commit: [\"feat(plugin-gas-station): add @elizaos/p...\"](https://github.com/elizaos/eliza/commit/36105dbf34be06c00d1fc5580d4b85823bf1559b) | [Re-trigger Greptile](https://app.greptile.com/api/retrigger?id=26477173)</sub>\n\n> Greptile also left **8 inline comments** on this PR.\n\n<sub>(2/5) Greptile learns from your feedback when you react with thumbs up/down!</sub>\n\n<!-- /greptile_comment -->",
      "repository": "elizaos/eliza",
      "createdAt": "2026-03-26T18:05:15Z",
      "mergedAt": null,
      "additions": 801,
      "deletions": 0
    },
    {
      "id": "PR_kwDOMT5cIs7N2WeK",
      "title": "fix(core): initialize trajectory AsyncLocalStorage synchronously",
      "author": "HaruHunab1320",
      "number": 6687,
      "body": "Trajectory context was initialized lazily via async dynamic import, causing early messages to use the StackContextManager fallback which doesn't propagate through async/await. LLM calls weren't captured — trajectories only had synthetic backfilled data. Fix: synchronous require in Node.js.\n\n<!-- greptile_comment -->\n\n<h3>Greptile Summary</h3>\n\nThis PR fixes a genuine race condition in `trajectory-context.ts` where `AsyncLocalStorage` was wired up via a `.then()` callback on a dynamic `import()`. Because the callback ran asynchronously, the very first call to `getOrCreateContextManager()` always returned the synchronous `StackContextManager` fallback — and that manager does not propagate context through `async`/`await` boundaries, so `logLlmCall` never saw the `trajectoryStepId` during the critical early-message window.\\n\\nThe fix is correct: switching to a synchronous `require(\"node:async_hooks\")` ensures `AsyncLocalStorage` is created inline during the first call to `getOrCreateContextManager()`, with no window where the fallback can \"win.\"\\n\\n**Changes reviewed:**\\n- **Root cause correctly identified and fixed** — synchronous `require()` eliminates the async scheduling gap.\\n- **`contextManagerInitialized` is now a dead variable** — it is assigned but never read; the `!globalContextManager` guard alone is sufficient.\\n- **`this`-cast pattern is unnecessarily complex** — the `run` and `active` methods can close over the `storage` local variable directly instead of casting `this`.\\n- **Bundler implications** — switching from dynamic `import()` to `require()` weakens the original \\\"avoid bundling Node.js code in browser builds\\\" protection; worth confirming build tooling handles `node:async_hooks` externals correctly.\n\n<h3>Confidence Score: 5/5</h3>\n\nSafe to merge — the fix is correct and focused; remaining feedback is non-blocking cleanup.\n\nThe change addresses a real, well-described race condition with a straightforward and correct synchronous fix. No new logic paths are introduced; the try/catch and isNodeEnvironment() guard preserve existing fallback behaviour. All remaining comments are P2 style/cleanup items that do not affect correctness or runtime safety.\n\nNo files require special attention.\n\n<h3>Important Files Changed</h3>\n\n| Filename | Overview |\n|----------|----------|\n| packages/typescript/src/trajectory-context.ts | Replaces async/lazy AsyncLocalStorage initialization with synchronous require(), correctly fixing the race condition that caused early messages to miss trajectory context; leaves a now-dead `contextManagerInitialized` variable and an unnecessary `this`-cast pattern. |\n\n</details>\n\n<h3>Sequence Diagram</h3>\n\n```mermaid\nsequenceDiagram\n    participant Caller\n    participant getOrCreate as getOrCreateContextManager()\n    participant init as initContextManagerSync()\n    participant ALS as AsyncLocalStorage (node:async_hooks)\n    participant Stack as StackContextManager\n\n    Note over Caller,Stack: NEW behaviour (synchronous init)\n    Caller->>getOrCreate: first call\n    getOrCreate->>init: globalContextManager is null\n    init->>ALS: require(\"node:async_hooks\") [synchronous]\n    ALS-->>init: AsyncLocalStorage class\n    init-->>getOrCreate: returns ALS-based manager immediately\n    getOrCreate-->>Caller: returns ALS-based manager\n\n    Note over Caller,Stack: OLD behaviour (async init — race condition)\n    Caller->>getOrCreate: first call\n    getOrCreate-->>Caller: returns StackContextManager (fallback)\n    getOrCreate->>init: createContextManager() .then(...)\n    Note right of init: import() resolves later\n    init->>ALS: dynamic import(\"node:async_hooks\")\n    ALS-->>init: AsyncLocalStorage class\n    init-->>getOrCreate: globalContextManager swapped to ALS manager\n    Note over Caller,Stack: Too late — early LLM calls already used StackContextManager\n    Note over Stack: StackContextManager doesn't propagate context through async/await\n```\n\n<sub>Reviews (1): Last reviewed commit: [\"fix(core): initialize AsyncLocalStorage ...\"](https://github.com/elizaos/eliza/commit/21ac09eb1dd5872117c8b40e1fa3c1cbfd1f6455) | [Re-trigger Greptile](https://app.greptile.com/api/retrigger?id=26494101)</sub>\n\n> Greptile also left **3 inline comments** on this PR.\n\n<!-- /greptile_comment -->",
      "repository": "elizaos/eliza",
      "createdAt": "2026-03-26T20:19:25Z",
      "mergedAt": "2026-03-26T20:33:17Z",
      "additions": 123,
      "deletions": 93
    },
    {
      "id": "PR_kwDOMT5cIs7NlMXt",
      "title": "feat: proposal for OWS wallet plugin",
      "author": "kevarifin14",
      "number": 6682,
      "body": "## Problem\n\nAgent plugins expect private keys via environment variables (\\`EVM_PRIVATE_KEY\\`, \\`SOLANA_PRIVATE_KEY\\`). These sit in \\`.env\\` files, shell history, CI logs, and Docker build layers.\n\n## Proposal\n\nAdd an OWS wallet plugin/skill that loads keys from an [OWS](https://openwallet.sh) encrypted vault instead of env vars. Keys encrypted at rest (AES-256-GCM, scrypt KDF), decrypted only during signing.\n\n```typescript\n// Before\nconst key = process.env.EVM_PRIVATE_KEY;\n\n// After\nimport { exportWallet } from \"@open-wallet-standard/core\";\nconst key = exportWallet(\"my-agent-wallet\");\n```\n\nMulti-chain support: EVM, Solana, Sui, Bitcoin, Cosmos, Tron, TON — all from one vault.\n\n<!-- greptile_comment -->\n\n<h3>Greptile Summary</h3>\n\nThis PR adds a single markdown file (`packages/skills/ows_proposal.md`) proposing an OWS (Open Wallet Standard) wallet skill that would load private keys from an encrypted local vault instead of plain-text environment variables.\\n\\n**The change is not ready to merge in its current form for several reasons:**\\n\\n- **Wrong path & filename**: The skill loader scans `packages/skills/skills/<name>/SKILL.md`. A file placed at the package root with a `_proposal.md` suffix is never discovered and has no runtime effect.\\n- **Missing YAML frontmatter**: The skill format requires a frontmatter block with at minimum `name` and `description`; this file has none, so even if relocated it would be rejected by the loader.\\n- **Stub content**: The body is 9 lines and only references an external URL. No installation steps, no code examples, no workflow, and no guardrails are provided — everything detailed in the PR description is absent from the actual file.\\n- **Proposal vs. implementation**: If this is purely a design proposal, the `packages/skills/` directory is the wrong venue; a GitHub Discussion or `docs/` entry would be more appropriate.\n\n<h3>Confidence Score: 1/5</h3>\n\nNot safe to merge — the file is structurally invalid as a skill and adds no functional value to the codebase in its current form.\n\nThe single changed file is misplaced (package root instead of `skills/<name>/SKILL.md`), missing mandatory YAML frontmatter, and contains only a 9-line stub with no agent-actionable instructions. It cannot be loaded by the skill system as-is, and a pure proposal document does not belong in a runtime package.\n\npackages/skills/ows_proposal.md — needs to be relocated, given proper frontmatter, and filled with a complete workflow before it can function as a skill.\n\n<h3>Important Files Changed</h3>\n\n| Filename | Overview |\n|----------|----------|\n| packages/skills/ows_proposal.md | Adds a 9-line stub proposal for an OWS wallet skill; wrong location, missing YAML frontmatter, and no actionable agent instructions — will not be loaded by the skill system as-is. |\n\n</details>\n\n<h3>Flowchart</h3>\n\n```mermaid\n%%{init: {'theme': 'neutral'}}%%\nflowchart TD\n    A[Agent needs private key] --> B{Key source?}\n    B -- \"Current (env vars)\" --> C[\"process.env.EVM_PRIVATE_KEY\"]\n    B -- \"Proposed (OWS vault)\" --> D[\"exportWallet('my-agent-wallet')\"]\n    D --> E[OWS encrypted vault\\nAES-256-GCM / scrypt KDF]\n    E --> F[Decrypt key in-memory\\nonly during signing]\n    F --> G[Sign transaction]\n    C --> G\n    G --> H[Broadcast to chain\\nEVM / Solana / Sui / etc.]\n\n    style E fill:#f9f,stroke:#333\n    style D fill:#bbf,stroke:#333\n```\n\n<sub>Reviews (1): Last reviewed commit: [\"feat: proposal for OWS wallet plugin\"](https://github.com/elizaos/eliza/commit/325ebbfa42dbbc23cb989cf93eb0f34511ece501) | [Re-trigger Greptile](https://app.greptile.com/api/retrigger?id=26404354)</sub>\n\n> Greptile also left **3 inline comments** on this PR.\n\n<sub>(3/5) Reply to the agent's comments like \"Can you suggest a fix for this @greptileai?\" or ask follow-up questions!</sub>\n\n<!-- /greptile_comment -->",
      "repository": "elizaos/eliza",
      "createdAt": "2026-03-26T05:10:26Z",
      "mergedAt": null,
      "additions": 9,
      "deletions": 0
    },
    {
      "id": "PR_kwDOMT5cIs7NpisE",
      "title": "chore: avoid rewriting unchanged generate-specs.js files",
      "author": "Ocheretovich",
      "number": 6683,
      "body": "Skip rewriting generate-specs.js files when content is unchanged to avoid unnecessary filesystem writes and noisy diffs\n\n<!-- greptile_comment -->\n\n<h3>Greptile Summary</h3>\n\nThis PR adds a content-equality guard in `scripts/update-all-generate-scripts.js` to skip rewriting `generate-specs.js` files when the generated content is identical to what's already on disk, avoiding unnecessary filesystem writes and noisy git diffs.\\n\\n- Reads the existing `scriptPath` file after content generation and compares it to the new content before writing.\\n- Returns `false` (increments the \\\"skipped\\\" counter in `main()`) when content is unchanged — functionally correct.\\n- The `plugin-discord` plugin itself (used as the template source) will always be skipped under the new logic since template substitutions are no-ops for it; this is the desired behaviour.\\n- One minor observation: the new early `return false` path produces no console output, so unchanged files are silently counted as skipped with no distinguishing log line (unlike missing-file skips, which do log a warning). A short `⏭️  Content unchanged, skipping` line would improve transparency but is non-blocking.\n\n<h3>Confidence Score: 5/5</h3>\n\nSafe to merge — the change is a trivial optimisation with correct logic and no functional impact.\n\nThe diff is 5 lines inside a script-only file. The guard correctly reads scriptPath (already verified to exist) and short-circuits the write when content is identical. No production code, tests, or APIs are affected. The only open item is a non-blocking logging suggestion.\n\nNo files require special attention.\n\n<h3>Important Files Changed</h3>\n\n| Filename | Overview |\n|----------|----------|\n| scripts/update-all-generate-scripts.js | Adds a content-equality check before writing generate-specs.js files; logic is correct, only minor logging transparency concern. |\n\n</details>\n\n<h3>Flowchart</h3>\n\n```mermaid\n%%{init: {'theme': 'neutral'}}%%\nflowchart TD\n    A[updateGenerateScript called] --> B{scriptPath exists?}\n    B -- No --> C[Log warning\\nreturn false]\n    B -- Yes --> D{templatePath exists?}\n    D -- No --> E[return false]\n    D -- Yes --> F[Read templatePath\\nApply replacements]\n    F --> G[Read existing scriptPath]\n    G --> H{existing === content?}\n    H -- Yes --> I[return false\\nskipped++]\n    H -- No --> J[writeFileSync scriptPath\\nreturn true\\nupdated++]\n```\n\n<sub>Reviews (1): Last reviewed commit: [\"chore: avoid rewriting unchanged generat...\"](https://github.com/elizaos/eliza/commit/002e4e8cc890197843ccf54ea24eb9dc26df5827) | [Re-trigger Greptile](https://app.greptile.com/api/retrigger?id=26421968)</sub>\n\n> Greptile also left **1 inline comment** on this PR.\n\n<!-- /greptile_comment -->",
      "repository": "elizaos/eliza",
      "createdAt": "2026-03-26T09:42:58Z",
      "mergedAt": null,
      "additions": 6,
      "deletions": 0
    },
    {
      "id": "PR_kwDOMT5cIs7Nzg7g",
      "title": "chore(deps): bump picomatch from 2.3.1 to 2.3.2 in /packages/computeruse/packages/kv in the npm_and_yarn group across 1 directory",
      "author": "dependabot",
      "number": 6685,
      "body": "Bumps the npm_and_yarn group with 1 update in the /packages/computeruse/packages/kv directory: [picomatch](https://github.com/micromatch/picomatch).\n\nUpdates `picomatch` from 2.3.1 to 2.3.2\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a href=\"https://github.com/micromatch/picomatch/releases\">picomatch's releases</a>.</em></p>\n<blockquote>\n<h2>2.3.2</h2>\n<p>This is a security release fixing several security relevant issues.</p>\n<h2>What's Changed</h2>\n<ul>\n<li>fix: exception when glob pattern contains constructor by <a href=\"https://github.com/Jason3S\"><code>@​Jason3S</code></a> in <a href=\"https://redirect.github.com/micromatch/picomatch/pull/144\">micromatch/picomatch#144</a></li>\n<li>Fix for <a href=\"https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj\">CVE-2026-33671</a></li>\n<li>Fix for <a href=\"https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p\">CVE-2026-33672</a></li>\n</ul>\n<p><strong>Full Changelog</strong>: <a href=\"https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2\">https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2</a></p>\n</blockquote>\n</details>\n<details>\n<summary>Changelog</summary>\n<p><em>Sourced from <a href=\"https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md\">picomatch's changelog</a>.</em></p>\n<blockquote>\n<h1>Release history</h1>\n<p><strong>All notable changes to this project will be documented in this file.</strong></p>\n<p>The format is based on <a href=\"http://keepachangelog.com/en/1.0.0/\">Keep a Changelog</a>\nand this project adheres to <a href=\"http://semver.org/spec/v2.0.0.html\">Semantic Versioning</a>.</p>\n<!-- raw HTML omitted -->\n<ul>\n<li>Changelogs are for humans, not machines.</li>\n<li>There should be an entry for every single version.</li>\n<li>The same types of changes should be grouped.</li>\n<li>Versions and sections should be linkable.</li>\n<li>The latest version comes first.</li>\n<li>The release date of each versions is displayed.</li>\n<li>Mention whether you follow Semantic Versioning.</li>\n</ul>\n<!-- raw HTML omitted -->\n<!-- raw HTML omitted -->\n<p>Changelog entries are classified using the following labels <em>(from <a href=\"http://keepachangelog.com/\">keep-a-changelog</a></em>):</p>\n<ul>\n<li><code>Added</code> for new features.</li>\n<li><code>Changed</code> for changes in existing functionality.</li>\n<li><code>Deprecated</code> for soon-to-be removed features.</li>\n<li><code>Removed</code> for now removed features.</li>\n<li><code>Fixed</code> for any bug fixes.</li>\n<li><code>Security</code> in case of vulnerabilities.</li>\n</ul>\n<!-- raw HTML omitted -->\n<h2>4.0.0 (2024-02-07)</h2>\n<h3>Fixes</h3>\n<ul>\n<li>Fix bad text values in parse <a href=\"https://redirect.github.com/micromatch/picomatch/issues/126\">#126</a>, thanks to <a href=\"https://github.com/connor4312\"><code>@​connor4312</code></a></li>\n</ul>\n<h3>Changed</h3>\n<ul>\n<li>Remove process global to work outside of node <a href=\"https://redirect.github.com/micromatch/picomatch/issues/129\">#129</a>, thanks to <a href=\"https://github.com/styfle\"><code>@​styfle</code></a></li>\n<li>Add sideEffects to package.json <a href=\"https://redirect.github.com/micromatch/picomatch/issues/128\">#128</a>, thanks to <a href=\"https://github.com/frandiox\"><code>@​frandiox</code></a></li>\n<li>Removed <code>os</code>, make compatible browser environment. See <a href=\"https://redirect.github.com/micromatch/picomatch/issues/124\">#124</a>, thanks to <a href=\"https://github.com/gwsbhqt\"><code>@​gwsbhqt</code></a></li>\n</ul>\n<h2>3.0.1</h2>\n<h3>Fixes</h3>\n<!-- raw HTML omitted -->\n</blockquote>\n<p>... (truncated)</p>\n</details>\n<details>\n<summary>Commits</summary>\n<ul>\n<li><a href=\"https://github.com/micromatch/picomatch/commit/81cba8d4b767cab3cb29d26eb4f691eed75b73b2\"><code>81cba8d</code></a> Publish 2.3.2</li>\n<li><a href=\"https://github.com/micromatch/picomatch/commit/fc1f6b69006e9435caf8fb40d8aff378bc0b7bce\"><code>fc1f6b6</code></a> Merge commit from fork</li>\n<li><a href=\"https://github.com/micromatch/picomatch/commit/eec17aee5428a7249e9ca5adbb8a0d28fa29619b\"><code>eec17ae</code></a> Merge commit from fork</li>\n<li><a href=\"https://github.com/micromatch/picomatch/commit/78f8ca4362d9e66cadea97b93e292f10096452ed\"><code>78f8ca4</code></a> Merge pull request <a href=\"https://redirect.github.com/micromatch/picomatch/issues/156\">#156</a> from micromatch/backport-144</li>\n<li><a href=\"https://github.com/micromatch/picomatch/commit/3f4f10eaa65bf3a52e8f2999674cd27e11fa3c9b\"><code>3f4f10e</code></a> Merge pull request <a href=\"https://redirect.github.com/micromatch/picomatch/issues/144\">#144</a> from Jason3S/jdent-object-properties</li>\n<li>See full diff in <a href=\"https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2\">compare view</a></li>\n</ul>\n</details>\n<br />\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=picomatch&package-manager=npm_and_yarn&previous-version=2.3.1&new-version=2.3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n<details>\n<summary>Dependabot commands and options</summary>\n<br />\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/elizaOS/eliza/network/alerts).\n\n</details>",
      "repository": "elizaos/eliza",
      "createdAt": "2026-03-26T17:39:14Z",
      "mergedAt": null,
      "additions": 3,
      "deletions": 3
    }
  ],
  "codeChanges": {
    "additions": 125,
    "deletions": 112,
    "files": 5,
    "commitCount": 12
  },
  "completedItems": [
    {
      "title": "fix(core): initialize trajectory AsyncLocalStorage synchronously",
      "prNumber": 6687,
      "type": "bugfix",
      "body": "Trajectory context was initialized lazily via async dynamic import, causing early messages to use the StackContextManager fallback which doesn't propagate through async/await. LLM calls weren't captured — trajectories only had synthetic bac",
      "files": [
        "packages/typescript/src/__tests__/trajectory-context.test.ts",
        "packages/typescript/src/streaming-context.ts",
        "packages/typescript/src/trajectory-context.ts"
      ]
    },
    {
      "title": "fix(core): remove redundant action params example (~500 chars/prompt)",
      "prNumber": 6684,
      "type": "bugfix",
      "body": "The instructions section includes a 15-line SEND_MESSAGE example showing action params format. Redundant with the output section XML example and keys section. Saves ~500 chars per prompt.\n\n<!-- greptile_comment -->\n\n<h3>Greptile Summary</h3",
      "files": [
        "packages/typescript/src/prompts.ts"
      ]
    },
    {
      "title": "Update Claude Code Review action and model version",
      "prNumber": 6681,
      "type": "other",
      "body": "<!-- Use this template by filling in information and copying and pasting relevant items out of the HTML comments. -->\r\n\r\n# Relates to\r\n\r\n<!-- LINK TO ISSUE OR TICKET -->\r\n\r\n<!-- This risks section must be filled out before the final review ",
      "files": [
        ".github/workflows/claude-code-review.yml"
      ]
    }
  ],
  "topContributors": [
    {
      "username": "HaruHunab1320",
      "avatarUrl": "https://avatars.githubusercontent.com/u/51176775?u=e51de0edfe50f67a1a5dca3bf3fa3053811dfb7e&v=4",
      "totalScore": 74.71503190925877,
      "prScore": 74.51503190925877,
      "issueScore": 0,
      "reviewScore": 0,
      "commentScore": 0.2,
      "summary": null
    },
    {
      "username": "odilitime",
      "avatarUrl": "https://avatars.githubusercontent.com/u/16395496?u=c9bac48e632aae594a0d85aaf9e9c9c69b674d8b&v=4",
      "totalScore": 30.80471895621705,
      "prScore": 30.80471895621705,
      "issueScore": 0,
      "reviewScore": 0,
      "commentScore": 0,
      "summary": null
    },
    {
      "username": "pino12033",
      "avatarUrl": "https://avatars.githubusercontent.com/u/265916801?v=4",
      "totalScore": 30.717771519666286,
      "prScore": 30.717771519666286,
      "issueScore": 0,
      "reviewScore": 0,
      "commentScore": 0,
      "summary": null
    },
    {
      "username": "greptile-apps",
      "avatarUrl": "https://avatars.githubusercontent.com/in/867647?v=4",
      "totalScore": 27,
      "prScore": 0,
      "issueScore": 0,
      "reviewScore": 27,
      "commentScore": 0,
      "summary": null
    },
    {
      "username": "kevarifin14",
      "avatarUrl": "https://avatars.githubusercontent.com/u/9817738?u=71b16f60eb8c9138170b55c7c100c4e12ec97d05&v=4",
      "totalScore": 15.151292546497023,
      "prScore": 15.151292546497023,
      "issueScore": 0,
      "reviewScore": 0,
      "commentScore": 0,
      "summary": null
    },
    {
      "username": "Zero-nium",
      "avatarUrl": "https://avatars.githubusercontent.com/u/267874468?u=c8960c25a24ea40512a7207fc69567eb8ec2b630&v=4",
      "totalScore": 14.346573590279972,
      "prScore": 14.346573590279972,
      "issueScore": 0,
      "reviewScore": 0,
      "commentScore": 0,
      "summary": null
    },
    {
      "username": "Ocheretovich",
      "avatarUrl": "https://avatars.githubusercontent.com/u/107276324?u=f59e3590461aab84e456618638b224df4506e508&v=4",
      "totalScore": 13.144955074527656,
      "prScore": 13.144955074527656,
      "issueScore": 0,
      "reviewScore": 0,
      "commentScore": 0,
      "summary": null
    },
    {
      "username": "haroldmalikfrimpong-ops",
      "avatarUrl": "https://avatars.githubusercontent.com/u/261440764?u=462295943ad8ae2cebe73781a6638795de9bda4b&v=4",
      "totalScore": 2.3000000000000003,
      "prScore": 0,
      "issueScore": 2.1,
      "reviewScore": 0,
      "commentScore": 0.2,
      "summary": null
    }
  ],
  "newPRs": 7,
  "mergedPRs": 3,
  "newIssues": 1,
  "closedIssues": 0,
  "activeContributors": 8
}