`, or `WAIT`\r\n - Shell output and thoughts are appended to `~/.virus/journal.txt`\r\n5. Goes back to sleep the moment the human returns\r\n\r\n**Model selection by available RAM:**\r\n\r\n| RAM | Model |\r\n|-----|-------|\r\n| <5 GB | qwen2.5:1.5b |\r\n| 5–10 GB | qwen2.5:7b |\r\n| 10–20 GB | qwen2.5:14b |\r\n| 20–48 GB | qwen2.5:32b |\r\n| 48+ GB | qwen2.5:72b |\r\n\r\n**Usage:**\n\n\n\nGreptile Summary
\n\nThis PR introduces `packages/virus/` — a self-contained Rust binary that implements an autonomous AI agent with full shell access. Despite being labelled \"concept art,\" the code fully implements the behavioral fingerprint of a Remote Access Trojan (RAT): **stealth activation** (runs only when the user is idle via `GetLastInputInfo`), **reboot persistence** (`--install` writes to `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`), **unrestricted shell execution** (`cmd /C` / `sh -c` with an LLM choosing the command), and **activity logging** to disk. No existing code in the monorepo is changed, but this package being distributed as part of ElizaOS — even as an opt-in — poses serious ethical and security risks.\n\nKey concerns:\n\n- **The command deny-list is not a viable security boundary.** All 30+ blocked patterns can be bypassed via trivial obfuscation (alternate flags, shell variables, base64, Python one-liners, command substitution). An LLM instructed to be \"curious and self-directed\" will eventually find these paths.\n- **Registry persistence without uninstall.** `install_autostart()` writes the binary into the Windows Run key with no corresponding removal path exposed to the user.\n- **Synchronous shell execution on the Tokio runtime thread.** `shell::exec` uses `std::thread::sleep` in a polling loop and is called directly from `async fn step`, stalling the runtime for up to 30 seconds per command.\n- **Silent failure in Ollama install flow.** `bootstrap()` does not verify that `winget install` succeeded before calling `start_ollama()`, potentially running indefinitely against an Ollama instance that was never started.\n- **Stdout silently discarded on command failure**, causing the agent's memory to be incomplete and potentially leading to repeated or incorrect actions.\n- **Unbounded journal growth** at `~/.virus/journal.txt` with no rotation or size cap, combined with a full `read_to_string` on every 30-second cycle.\n\nConfidence Score: 0/5
\n\n- This PR must not be merged — it introduces code that implements core malware behaviors (persistence, stealth, unrestricted shell access) under the ElizaOS brand, with a security model that cannot be made safe through the deny-list approach used.\n- Score 0 reflects two compounding problems: (1) fundamental architectural unsafety — an LLM with full shell access governed only by a substring deny-list is not a controlled agent, it is an uncontrolled execution surface; and (2) the package implements registry-based persistence and idle-time stealth, which are defining characteristics of malware. Even as a proof-of-concept these behaviors are inappropriate for inclusion in the official monorepo.\n- All files require attention, but `packages/virus/src/agent.rs` (deny-list bypass) and `packages/virus/src/system.rs` (registry persistence) are the most critical.\n\nImportant Files Changed
\n\n| Filename | Overview |\n|----------|----------|\n| packages/virus/src/agent.rs | Core agent loop: issues LLM-generated shell commands with a trivially bypassable substring deny-list; stdout silently discarded on failure; synchronous shell exec blocks the async runtime. |\n| packages/virus/src/system.rs | Implements Windows registry persistence (HKCU Run key) and idle detection via GetLastInputInfo — core malware-characteristic behaviors: stealth activation and reboot survival. |\n| packages/virus/src/shell.rs | Executes arbitrary shell commands via cmd /C or sh -c with a 30-second timeout; uses blocking thread::sleep inside what is called from an async context, stalling the Tokio runtime. |\n| packages/virus/src/model.rs | Manages Ollama lifecycle (install, start, model pull, generate); no verification that winget install succeeded before invoking ollama serve, risking silent startup failure. |\n| packages/virus/src/memory.rs | Append-only journal at ~/.virus/journal.txt with no size cap or rotation; reads entire file on every agent step via read_to_string, which degrades over time as the file grows unboundedly. |\n| packages/virus/src/main.rs | Entry point wires idle detection to autonomous shell-command loop; exposes --install flag that silently registers the binary in the Windows startup registry. |\n| packages/virus/Cargo.toml | Standard Rust manifest; opt-level z + LTO + strip produces a compact release binary; winapi dependency correctly gated behind cfg(windows). |\n\n\n\nFlowchart
\n\n```mermaid\n%%{init: {'theme': 'neutral'}}%%\nflowchart TD\n A([virus.exe starts]) --> B{--install flag?}\n B -- yes --> C[Write HKCU\\\\Run\\\\virus registry key\\nfor reboot persistence]\n C --> D([exit])\n B -- no --> E[memory::init\\ncreate ~/.virus/journal.txt]\n E --> F[system::pick_model\\ndetect available RAM]\n F --> G[model::bootstrap\\ninstall Ollama if missing\\npull selected model]\n G --> H{system::idle_seconds\\n>= 120s?}\n H -- no --> I[sleep 10s]\n I --> H\n H -- yes --> J[agent::step\\nbuild prompt from journal + system context]\n J --> K[model::generate\\nPOST /api/generate to Ollama]\n K --> L{Parse LLM response}\n L -- SHELL: cmd --> M[is_command_safe?\\nsubstring deny-list check]\n M -- blocked --> N[memory::error\\nlog blocked command]\n N --> O[sleep 30s]\n M -- allowed --> P[shell::exec\\ncmd /C or sh -c\\n30s timeout]\n P --> Q[memory::action + memory::result\\nappend to journal.txt]\n Q --> O\n L -- THINK: thought --> R[memory::thought\\nappend to journal.txt]\n R --> O\n L -- WAIT --> O\n O --> H\n\n style C fill:#ff4444,color:#fff\n style P fill:#ff8800,color:#fff\n style M fill:#ffcc00\n```\n\nLast reviewed commit: d74601b\n\n> Greptile also left **6 inline comments** on this PR.\n\n(4/5) You can add custom instructions or style guidelines for the agent [here](https://app.greptile.com/review/github)!\n\n",
"repository": "elizaos/eliza",
"createdAt": "2026-03-17T16:03:00Z",
"mergedAt": null,
"additions": 651257,
"deletions": 299259
},
{
"id": "PR_kwDOMT5cIs7HH0BX",
"title": "fix(runtime): handle IGNORE action fallback and tolerate upstream IGNORE",
"author": "paulf280-ui",
"number": 6543,
"body": "## Summary\n\n- Fixes IGNORE action handling in the agent runtime — when the LLM selects `IGNORE`, the runtime now falls back gracefully rather than erroring or hanging\n- Adds diagnostics and tolerance for upstream IGNORE action signals in the bootstrap plugin\n- Pins tsup, externalizes tokenizers, and fixes embedding input coercion in `@elizaos/core`\n- Fixes UUID and parsing helpers; makes embedding tests deterministic\n- Adds CLAUDE.md with build commands and architecture overview for contributors\n\n## Test plan\n\n- [ ] Run `bun run test:core` — all vitest tests pass including new deterministic embedding tests\n- [ ] Verify agent does not crash/hang when LLM responds with IGNORE action\n- [ ] Verify `bun run build:core` succeeds cleanly\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n\n\nGreptile Summary
\n\nThis PR adds core TypeScript files (`runtime.ts`, `embedding.ts`, `parsing.ts`, `uuid.ts`) to `@elizaos/core` package that were previously missing from source control. The main changes include:\n\n- **IGNORE action handling**: Implements graceful fallback when LLM returns IGNORE action (lines 1084-1088 in `runtime.ts`) — treats it as a no-op instead of throwing \"Action not found\" errors\n- **Embedding robustness**: Adds input type coercion to handle non-string inputs gracefully, returning empty arrays for empty inputs \n- **Build configuration**: Pins tsup to `^8.5.1` and externalizes native modules (`@anush008/tokenizers`, `onnxruntime-node`, `sharp`) to prevent bundling issues\n- **Test coverage**: Adds deterministic embedding tests with mocked dependencies\n- **Python additions**: Adds `agent.py`, `run_traderbot.py`, and `trader.json` for Python runtime testing; extensively refactors `runtime.py` (5484 lines changed)\n\n**Issues found:**\n- Type mismatch in `embedding.ts:234` where `input` (type `unknown`) is passed to `retrieveCachedEmbedding` which expects `string` — should pass `text` instead\n- Inconsistent logging using `console.error` instead of `elizaLogger` in `parsing.ts`\n- Misleading comment in `tsup.config.ts` about CommonJS when using ESM format\n\nConfidence Score: 3/5
\n\n- This PR has one critical type mismatch bug that must be fixed before merge\n- Score reflects a logic bug in `embedding.ts:234` where wrong variable type is passed to `retrieveCachedEmbedding`. This could cause runtime type errors. The IGNORE action handling and other changes are well-implemented, but the type bug needs resolution.\n- Pay close attention to `packages/core/src/embedding.ts` line 234 — type mismatch that needs fixing\n\nImportant Files Changed
\n\n\n\n\n| Filename | Overview |\n|----------|----------|\n| packages/core/src/runtime.ts | Added IGNORE action fast-path at lines 1084-1088 to gracefully handle IGNORE actions without throwing errors |\n| packages/core/src/embedding.ts | Added input coercion for robustness, but type mismatch at line 234 where `input` is passed instead of `text` to retrieveCachedEmbedding |\n| packages/core/src/parsing.ts | Added comprehensive JSON parsing utilities, but uses `console.error` instead of `elizaLogger` at 8 locations (lines 100, 101, 119, 120, 154, 155, 168, 169) |\n| packages/core/tsup.config.ts | Added build config with tokenizers externalized, but misleading comment at line 8 says \"targeting CommonJS\" when format is \"esm\" |\n| packages/python/elizaos/runtime.py | Extensive refactoring with 5484 lines changed; difficult to review comprehensively without more context |\n\n\n\n\n\nFlowchart
\n\n```mermaid\n%%{init: {'theme': 'neutral'}}%%\nflowchart TD\n Start[LLM Returns Action] --> Normalize[Normalize Action Name]\n Normalize --> CheckIgnore{Is IGNORE or
contains 'ignore'?}\n CheckIgnore -->|Yes| LogIgnore[Log: Skipping IGNORE action]\n CheckIgnore -->|No| FindAction[Look up action in registry]\n LogIgnore --> Continue[Continue to next message]\n FindAction --> ActionExists{Action found?}\n ActionExists -->|Yes| CheckHandler{Has handler?}\n ActionExists -->|No| LogError[Log: Action not found]\n CheckHandler -->|Yes| Execute[Execute action.handler]\n CheckHandler -->|No| LogNoHandler[Log: No handler]\n LogError --> Continue\n LogNoHandler --> Continue\n Execute --> HandleError{Error occurred?}\n HandleError -->|Yes| LogExecError[Log execution error]\n HandleError -->|No| Success[Action completed]\n LogExecError --> Continue\n Success --> Continue\n```\n\nLast reviewed commit: dbc6b01\n\n\n\n(2/5) Greptile learns from your feedback when you react with thumbs up/down!\n\n",
"repository": "elizaos/eliza",
"createdAt": "2026-03-01T12:49:51Z",
"mergedAt": null,
"additions": 650956,
"deletions": 302982
},
{
"id": "PR_kwDOMT5cIs7FoO_k",
"title": "fix(core): prevent duplicate LLM calls when message contains URL or triggers providers",
"author": "nicolasdma",
"number": 6528,
"body": "\n\n# Relates to\n\nRelates to #6486\n\n# Risks\n\nLow — single condition removed from a boolean expression. No new code, no new logic paths.\n\n# Background\n\n## What does this PR do?\n\nRemoves the `providers.length` check from the `isSimple` determination in `packages/typescript/src/services/message.ts`.\n\n## What kind of change is this?\n\nBug fix (non-breaking change that fixes an issue).\n\n# Changes\n\nWhen a user sends a message containing a URL, the LLM's first call (via `runSingleShotCore`) generates and streams the response text. It also returns `providers: [\"ATTACHMENTS\"]` because the prompt template instructs it to when it sees URLs.\n\nThe `isSimple` check at line 1883 previously treated \"has providers\" as \"not simple\":\n\n```typescript\nconst isSimple =\n responseContent?.actions &&\n responseContent.actions.length === 1 &&\n typeof responseContent.actions[0] === \"string\" &&\n responseContent.actions[0].toUpperCase() === \"REPLY\" &&\n (!responseContent.providers || responseContent.providers.length === 0);\n// ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n// This condition causes the bug\n```\n\nThis caused the message to go through the `actions` path, which triggered the REPLY action handler (`reply.ts:60`), making a **second LLM call** with `replyTemplate` and streaming another response — duplicating output and doubling token costs.\n\n**The fix:** Remove the providers check. Providers enrich state (already handled at L863-871) but don't require re-generating the response. `isSimple` should only care about whether the action is REPLY (text already generated and streamed) vs something else (needs execution).\n\n```typescript\nconst isSimple =\n responseContent?.actions &&\n responseContent.actions.length === 1 &&\n typeof responseContent.actions[0] === \"string\" &&\n responseContent.actions[0].toUpperCase() === \"REPLY\";\n```\n\n# Testing\n\n- [x] Message with URL → single response (not duplicated)\n- [x] Message without URL → works as before\n- [x] Multi-action messages (REPLY + other) → still trigger actions path\n- [x] Messages with non-REPLY actions → still trigger actions path\n\n\n\nGreptile Summary
\n\nRemoves the `providers.length` check from the `isSimple` boolean expression, preventing duplicate LLM calls when messages contain URLs or trigger provider enrichment.\n\n**Key Changes:**\n- Removed condition `(!responseContent.providers || responseContent.providers.length === 0)` from `isSimple` check at line 1883\n- Messages with `actions: [\"REPLY\"]` now correctly use the \"simple\" path regardless of provider presence\n- Providers still enrich state (lines 863-871) but no longer force re-generation of already-streamed responses\n\n**Impact:**\n- Eliminates duplicate streaming when URLs are detected (previously triggered ATTACHMENTS provider → action path → second LLM call)\n- Reduces token costs by avoiding unnecessary second LLM invocation\n- Response text from first `runSingleShotCore` call is now correctly used as final output\n\nConfidence Score: 5/5
\n\n- This PR is safe to merge with minimal risk\n- Simple, surgical fix that removes a single condition causing unintended behavior. The logic is sound: providers enrich state (already handled separately at L863-871) but shouldn't force action-based execution when the response is already generated and streamed. No new code paths, no breaking changes.\n- No files require special attention\n\nImportant Files Changed
\n\n\n\n\n| Filename | Overview |\n|----------|----------|\n| packages/typescript/src/services/message.ts | Removed providers check from `isSimple` determination to prevent duplicate LLM calls when URLs trigger provider enrichment |\n\n\n\n\n\nLast reviewed commit: 681b3d8\n\n\n\n(2/5) Greptile learns from your feedback when you react with thumbs up/down!\n\n",
"repository": "elizaos/eliza",
"createdAt": "2026-02-23T11:57:16Z",
"mergedAt": null,
"additions": 648511,
"deletions": 299259
}
],
"codeChanges": {
"additions": 51,
"deletions": 51,
"files": 1,
"commitCount": 28
},
"completedItems": [
{
"title": "chore(deps): bump cryptography from 46.0.5 to 46.0.6 in /packages/python in the uv group across 1 directory",
"prNumber": 6696,
"type": "other",
"body": "Bumps the uv group with 1 update in the /packages/python directory: [cryptography](https://github.com/pyca/cryptography).\n\nUpdates `cryptography` from 46.0.5 to 46.0.6\n\nChangelog
\nSourced from \n\nGreptile Summary
\n\nThis PR wires up task-completion assessment into the reflection evaluator pipeline: the model is now asked whether the current task is done, the result is p",
"files": []
}
],
"topContributors": [
{
"username": "lalalune",
"avatarUrl": "https://avatars.githubusercontent.com/u/18633264?u=e2e906c3712c2506ebfa98df01c2cfdc50050b30&v=4",
"totalScore": 30.438,
"prScore": 30,
"issueScore": 0,
"reviewScore": 0,
"commentScore": 0.43799999999999994,
"summary": "lalalune: Focused on project architecture and dependency management, successfully merging PR #6721 to synchronize the reflection runtime while resolving critical issues regarding V3 goals (#4720) and CLI dependency registration (#4997). Their activity was characterized by extensive community engagement through 114 total comments and significant codebase maintenance, with a primary focus on general project support and feature development."
},
{
"username": "BarisSozen",
"avatarUrl": "https://avatars.githubusercontent.com/u/31259058?u=552303524bfd292b4ff8f3c0eeafa34dcef865e9&v=4",
"totalScore": 14.693147180559945,
"prScore": 14.693147180559945,
"issueScore": 0,
"reviewScore": 0,
"commentScore": 0,
"summary": "BarisSozen: Focused on expanding ecosystem integrations by opening PR #337 in elizaos-plugins/registry to add the @hashlock/plugin-hashlock. This work involved a targeted configuration update to support new plugin functionality."
},
{
"username": "douglasborthwick-crypto",
"avatarUrl": "https://avatars.githubusercontent.com/u/256362537?u=d2bcb713a5c90ba7d8bb079bbd0ea91041348838&v=4",
"totalScore": 0.33999999999999997,
"prScore": 0,
"issueScore": 0,
"reviewScore": 0,
"commentScore": 0.33999999999999997,
"summary": "douglasborthwick-crypto: Contributed to project maintenance by providing 2 pull request comments and executing a minor code modification involving 1 commit and 2 line changes. Their activity today was focused entirely on miscellaneous tasks across various file types."
},
{
"username": "odilitime",
"avatarUrl": "https://avatars.githubusercontent.com/u/16395496?u=c9bac48e632aae594a0d85aaf9e9c9c69b674d8b&v=4",
"totalScore": 0.2,
"prScore": 0,
"issueScore": 0,
"reviewScore": 0,
"commentScore": 0.2,
"summary": null
}
],
"newPRs": 1,
"mergedPRs": 2,
"newIssues": 1,
"closedIssues": 103,
"activeContributors": 17
}