{ "interval": { "intervalStart": "2026-04-26T00:00:00.000Z", "intervalEnd": "2026-05-03T00:00:00.000Z", "intervalType": "week" }, "repository": "elizaos/eliza", "overview": "From 2026-04-26 to 2026-05-03, elizaos/eliza had 121 new PRs (109 merged), 19 new issues, and 16 active contributors.", "topIssues": [ { "id": "I_kwDOMT5cIs8AAAABAKqtpQ", "title": "telegram read receipts should fetch by message IDs and avoid nested receipt lookup", "author": "dutchiono", "number": 7009, "repository": "elizaos/eliza", "body": "## Summary\nA follow-up is needed after the fix in commit `55f4f27` / PR #7008.\n\nThe critical correctness bug around 1:1 outbound read state is fixed:\n- use `readViaOutbox` (`numericMsgId <= readOutboxMaxId`) for 1:1 outbound read status\n- use `readViaCount` as fallback for groups\n- clarify the `getMessagesReadParticipants` limitation\n\nTwo issues remain.\n\n## Remaining issue 1: requested message IDs are not fetched directly\n`getTelegramReadReceipts` still calls:\n\n```ts\nclient.getMessages(entity, {\n search: \"\",\n limit: Math.max(requested.size * 2, MAX_RECENT_LIMIT),\n})\n```\n\nThis is not an IDs-based fetch and can silently miss older requested message IDs.\n\n### Expected fix\n- extend `TelegramLocalClientLike.getMessages` to support an `ids` parameter\n- fetch the exact requested Telegram message IDs instead of relying on `search: \"\"`\n- make `getTelegramReadReceipts` deterministic for older messages\n\n## Remaining issue 2: O(n*m) receipt lookup\nThe final assembly still does a nested scan via:\n- `args.messageIds.map(...)`\n- `receipts.find(...)`\n\nThis should be replaced with a `Map` so lookup is linear.\n\n## Why this matters\n- issue 1 is still a correctness gap\n- issue 2 is lower-risk, but worth fixing while touching the same path\n\n## Context\n- fixed in PR: #7008\n- fixed commit: `55f4f27`", "createdAt": "2026-04-22T01:21:52Z", "closedAt": "2026-04-29T21:07:32Z", "state": "CLOSED", "commentCount": 1 }, { "id": "I_kwDOMT5cIs8AAAABA4Rdow", "title": "build: dev-ui.mjs references `./claude-code-stealth.mjs` preload that doesn't exist on fresh clone", "author": "Sw4pIO", "number": 7210, "repository": "elizaos/eliza", "body": "## Summary\n\n`packages/app-core/scripts/dev-ui.mjs` declares `./claude-code-stealth.mjs` as a Bun `--preload` entry when the user has an Anthropic subscription, but **no build step generates that file** and **it isn't checked in**. The script's existence check (`existsSync(path.join(cwd, filePath))`) silently filters the missing file out of the preload list, so the stealth fetch interceptor never installs.\n\nThe interceptor is what prepends the Claude Code system prefix and identity headers (`anthropic-beta`, `user-agent: claude-cli/...`, `x-app: cli`) that Anthropic's API requires for OAuth subscription tokens. Without it, every `api.anthropic.com` request from a subscription user gets `401 Invalid authentication credentials` even though the token is valid and registered correctly.\n\nThe TypeScript source is at `packages/agent/src/auth/claude-code-stealth.ts` and exports `installClaudeCodeStealthFetchInterceptor()`, but the dev preload expects a different file at the **repo root**, named `.mjs`, that auto-runs on import.\n\n## Reproduction\n\nOn a fresh clone of any consumer repo (e.g. milady on `develop`):\n\n1. Sign in to an Anthropic subscription via `POST /api/subscription/anthropic/start` + `/exchange` so `~/.eliza/auth/anthropic-subscription.json` is written.\n2. Manually enable `@elizaos/plugin-anthropic` in `~/./.json` (auto-enable refuses for subscription-only).\n3. Set `ANTHROPIC_AUTH_MODE=oauth` and `CLAUDE_CODE_OAUTH_TOKEN=` in the runtime env.\n4. `bun run dev`\n5. Boot log shows:\n ```\n [milady] Stealth imports enabled: \n ```\n (notice — empty list because the file doesn't exist; it was silently filtered)\n6. Send any chat message → backend retries 3× with `AI_APICallError: Invalid authentication credentials` and surfaces the parse error to the user.\n\n## Diagnostic trail\n\n- `packages/app-core/scripts/dev-ui.mjs:785` declares the preload:\n ```js\n if (stealth.claude) nodeStealthImports.push(\"./claude-code-stealth.mjs\");\n ```\n- Then filters by existence:\n ```js\n const resolvedStealthImports = nodeStealthImports.filter((filePath) =>\n existsSync(path.join(cwd, filePath)),\n );\n ```\n- `find . -name claude-code-stealth.mjs -not -path '*/node_modules/*'` returns nothing on a fresh clone.\n- The TS source exists at `packages/agent/src/auth/claude-code-stealth.ts` and exports `installClaudeCodeStealthFetchInterceptor()`. Nothing builds it into the expected location.\n\n## Suggested fix\n\nEither of:\n\n1. **Check in / generate the `.mjs`** at the repo root (or wherever `cwd` resolves to in `dev-ui.mjs`), with a self-installing call at the bottom. I verified locally that creating this file unblocks the Anthropic subscription auth path end-to-end (successful chat turns, zero 401s, model calls confirmed via `[stealth] →anthropic` debug logs with `ELIZA_STEALTH_DEBUG=1`).\n\n2. **Fail loud instead of silent**: in `dev-ui.mjs`, when `stealth.claude === true` but the resolved preload file is missing, log a clear warning so users know what's wrong instead of chasing parse errors.\n\nBoth would help; (1) makes the feature work out of the box, (2) prevents the same multi-hour debug hunt for the next person.\n\n## Why this matters\n\nWithout the stealth interceptor, subscription auth is **completely non-functional** on the runtime side, which:\n- Makes the `/api/subscription/anthropic/*` flow look broken (it works correctly, but the runtime that consumes its credentials can't actually use them).\n- Forces users to either get a paid API key or sign up for Eliza Cloud — even though the codebase clearly intends to support direct subscription OAuth via the stealth path.\n\n## Environment\n- bun 1.3.13\n- eliza submodule HEAD: `4e650ca0ad`\n- Discovered while booting milady on `develop`", "createdAt": "2026-04-29T22:09:53Z", "closedAt": "2026-05-01T20:04:54Z", "state": "CLOSED", "commentCount": 1 }, { "id": "I_kwDOMT5cIs8AAAABA2wj0Q", "title": "@elizaos/agent server has hard imports from app-* packages, contradicts \"standalone backend\" description", "author": "2-A-M", "number": 7204, "repository": "elizaos/eliza", "body": "\n### Summary\n\n`@elizaos/agent` is described in [`packages/agent/package.json`](https://github.com/elizaOS/eliza/blob/main/packages/agent/package.json) as:\n\n> \"Standalone elizaOS-based agent and backend server package.\"\n\nIn practice, [`packages/agent/src/api/server.ts`](https://github.com/elizaOS/eliza/blob/main/packages/agent/src/api/server.ts#L31-L49) imports directly from a number of Milady-app-specific packages, which makes the package non-standalone for any host that isn't Milady:\n\n```ts\n// packages/agent/src/api/server.ts\nimport { DropService, setElizaMakerDropService } from \"@elizaos/app-elizamaker\";\nimport { handleKnowledgeRoutes } from \"@elizaos/app-knowledge/routes\";\nimport {\n normalizeJsonRpcUrl,\n probeJsonRpcEndpoint,\n TxService,\n} from \"@elizaos/app-steward/api/tx-service\";\nimport {\n ensurePrivyWalletsForCustomUser,\n isPrivyWalletProvisioningEnabled,\n} from \"@elizaos/app-steward/services/privy-wallets\";\nimport { wireCoordinatorBridgesWhenReady } from \"@elizaos/app-task-coordinator/api/coordinator-wiring\";\nimport {\n handleTrainingRoutes,\n handleTrajectoryRoute,\n} from \"@elizaos/app-training/routes\";\n```\n\nThe same pattern shows up in [`@elizaos/app-core`](https://github.com/elizaOS/eliza/tree/main/packages/app-core) — its source re-exports from `@elizaos/app-companion` (e.g. [`character-catalog.ts`](https://github.com/elizaOS/eliza/blob/main/packages/app-core/src/character-catalog.ts), [`state/vrm.ts`](https://github.com/elizaOS/eliza/blob/main/packages/app-core/src/state/vrm.ts), [`components/pages/VectorBrowserView.tsx`](https://github.com/elizaOS/eliza/blob/main/packages/app-core/src/components/pages/VectorBrowserView.tsx)) and imports from `@elizaos/app-steward` in several files (`awareness/contributors/wallet.ts`, `api/client.ts`, `api/client-wallet.ts`, `config/boot-config-store.ts`). `app-core/package.json` describes itself as `\"Shared application core for elizaOS white-label agent apps\"` — same gap.\n\n### Why this matters\n\nFor Atelier — and any future fork that wants to embed elizaOS as a backend — there is no clean spawn target in upstream eliza that doesn't pull in Milady-specific app code, services, routes, and dependencies (xyflow, ethers, telegraf, the full Milady plugin tree). We're tolerating it in v0.1 because cleaning it up isn't on our critical path, but the bundle includes ~50MB of dead Milady code and the dependency graph carries Milady-app concepts (steward wallets, elizamaker drops, lifeops automations) that have no meaning in a non-Milady host.\n\nThe pattern of routes-extracted-into-the-app-itself already exists in this repo — see `server.ts:30`:\n\n```ts\n// Discord local routes extracted to @elizaos/plugin-discord (setup-routes.ts)\n```\n\nSo the architectural shape is established. It just hasn't been generalized to the other apps that still have routes living in the agent server.\n\n### Possible PR shapes — which would you accept?\n\n1. **Move app-* routes into the apps themselves.** `app-elizamaker`, `app-knowledge`, `app-steward`, `app-task-coordinator`, `app-training` would each export their own `setup-routes.ts` (mirroring `plugin-discord`). `agent/src/api/server.ts` would no longer import from any `@elizaos/app-*` package; the apps register their routes via a host-controlled list (or via `runtime.registerRoutes(...)` if such an API is preferred).\n2. **Promote the truly-shared parts into a new `@elizaos/runtime` package.** `@elizaos/agent` becomes a thin orchestrator over `@elizaos/runtime`. Hosts that want a Milady-style stack import `@elizaos/agent`; hosts that want only the runtime import `@elizaos/runtime`. Bigger refactor; cleaner long-term.\n3. **Document the actual coupling and rename `@elizaos/agent`.** If the Milady coupling is intentional and the maintainers prefer to keep it, the package description should reflect that — and a separate \"really standalone\" runtime package should exist for forks. We'd rather have honest naming than a misleading \"standalone\" label.\n\n### What we're doing while this is in flight\n\nWe're spawning `@elizaos/app-core/src/entry.ts start` as-is from Atelier's main process. The Milady coupling rides along in our bundle. We've tracked the cleanup as a follow-up gated on this issue's outcome.\n\n### Reproduction (if useful)\n\n```bash\ngit clone https://github.com/elizaOS/eliza\ncd eliza\ngrep -nE 'from [\"\\'@/]*elizaos/app-(elizamaker|knowledge|steward|task-coordinator|training|companion)' \\\n packages/agent/src packages/app-core/src\n```\n\nReturns ~15 matches across `packages/agent/src/api/server.ts` and the `app-core` files cited above.\n\n---\n\nHappy to draft a PR for any of (1)/(2)/(3) once we know which shape would land. Thanks for elizaOS — the orchestration layer is exactly what we needed.\n", "createdAt": "2026-04-29T17:17:50Z", "closedAt": "2026-04-29T21:37:19Z", "state": "CLOSED", "commentCount": 1 }, { "id": "I_kwDOMT5cIs8AAAABA18TjA", "title": "ux: opaque \"No handler found for delegate type: ACTION_PLANNER\" when no LLM provider is configured", "author": "andex23", "number": 7203, "repository": "elizaos/eliza", "body": "## Summary\n\nWhen a runtime boots without any LLM provider plugin (no `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` / `OPENROUTER_API_KEY` / `ELIZAOS_CLOUD_API_KEY` / Ollama / etc.), the boot logs a clear, actionable message:\n\n```\nInfo [eliza] No AI provider plugin was loaded. Set an API key environment variable\n(e.g. ANTHROPIC_API_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY) or log in to\nEliza Cloud (ELIZAOS_CLOUD_API_KEY) to enable at least one model provider.\n```\n\nBut as soon as the user sends a chat message, the message service calls `runtime.useModel(ModelType.ACTION_PLANNER, ...)` (`packages/typescript/src/services/message.ts:3753`), which walks the fallback chain `[ACTION_PLANNER, TEXT_MEDIUM, TEXT_SMALL]`, finds nothing registered, and throws:\n\n```\nError: No handler found for delegate type: ACTION_PLANNER\n at AgentRuntime.useModel (packages/typescript/src/runtime.ts:4250)\n```\n\nIn the dashboard chat this surfaces as:\n\n> I hit an internal parsing error while preparing the reply. Reason: No handler found for delegate type: ACTION_PLANNER. Please try again or ask me to retry the last step.\n\nThat message is misleading — there's no parsing error, retrying won't help, and the real fix (set an API key or sign in to Eliza Cloud) is nowhere in the user-facing string. The runtime already knows this state at boot.\n\n## Repro\n\n1. Fresh checkout, no `*_API_KEY` env vars set, not signed in to Eliza Cloud.\n2. `bun run dev`\n3. Note the `[eliza] No AI provider plugin was loaded.` info log — boot is otherwise clean.\n4. Open the dashboard, send any chat message to the default agent.\n5. The reply contains the cryptic `ACTION_PLANNER` error.\n\n## Suggested fix\n\nIn `AgentRuntime.useModel` (`packages/typescript/src/runtime.ts` around line 4249), when `resolveModelRegistration` returns `undefined` for any text-generation model, detect \"no provider configured at all\" (no handlers registered for any of `TEXT_NANO/TEXT_SMALL/TEXT_MEDIUM/TEXT_LARGE/TEXT_MEGA/RESPONSE_HANDLER/ACTION_PLANNER/TEXT_COMPLETION`) and throw a typed, user-facing error such as:\n\n```ts\nthrow new NoModelProviderConfiguredError(\n \"This agent has no LLM provider configured. \" +\n \"Set ANTHROPIC_API_KEY, OPENAI_API_KEY, or OPENROUTER_API_KEY in your environment, \" +\n \"or sign in to Eliza Cloud (ELIZAOS_CLOUD_API_KEY).\"\n);\n```\n\nThe chat surface (e.g. milady's dashboard) can then catch that specific error type and render the actionable hint instead of the \"internal parsing error\" generic. The current opaque message stays only for the genuine case where one provider is registered but the requested model + its fallbacks all happen to be missing — which is the rarer, real \\\"misconfiguration\\\" case.\n\n## Environment\n- bun 1.3.13\n- eliza submodule HEAD: `4e650ca0ad`\n- Discovered while exercising the dashboard chat in milady on `develop`", "createdAt": "2026-04-29T14:56:06Z", "closedAt": "2026-04-29T21:11:35Z", "state": "CLOSED", "commentCount": 1 }, { "id": "I_kwDOMT5cIs8AAAABA1ztIQ", "title": "bug: commit 8551fccafe deleted re-export shims but left dangling imports across packages/agent", "author": "andex23", "number": 7202, "repository": "elizaos/eliza", "body": "## Summary\n\nCommit [`8551fccafe`](https://github.com/elizaos/eliza/commit/8551fccafe) (\"updates\", Apr 15 2026) deleted ~30 single-line re-export shim files under `packages/agent/src/**`, but did **not** update the consumers that still import from them. The result: on a fresh clone, the API server crashes immediately on startup with `Cannot find module './.js'` errors.\n\n## Reproduction\n\nOn any consumer of this commit (e.g. milady-ai/milady on `develop`, which pins eliza to a descendant of `8551fccafe`):\n\n1. `bun install`\n2. `bun run dev`\n3. API process exits during boot with one of the errors below.\n\n## Verified missing modules → still imported\n\nI bisected by restoring shims one at a time. The following deleted files have **live importers** that were not updated:\n\n| Deleted shim | Re-exported from | Still imported by |\n|---|---|---|\n| `packages/agent/src/api/task-agent-message-routing.ts` | `@elizaos/app-task-coordinator/api/task-agent-message-routing` | `packages/agent/src/api/server.ts`, `packages/agent/src/api/server-helpers-swarm.ts` |\n| `packages/agent/src/api/website-blocker-routes.ts` | `@elizaos/app-lifeops/routes/website-blocker-routes` | `packages/agent/src/api/server.ts` |\n| `packages/agent/src/runtime/roles/src/utils.ts` | `@elizaos/core` | `packages/agent/src/runtime/roles/src/index.ts`, `packages/agent/src/config/includes.ts` |\n| `packages/agent/src/onboarding-presets.ts` | `@elizaos/shared/onboarding-presets` | `packages/shared/src/i18n/keyword-matching.ts` |\n| `packages/agent/src/providers/lifeops.ts` | `@elizaos/app-lifeops/providers/lifeops` | `packages/agent/src/api/workbench-routes.ts` |\n| `packages/agent/src/actions/life-param-extractor.ts` | `@elizaos/app-lifeops/actions/life-param-extractor` | `packages/agent/src/actions/life-param-extractor-real.test.ts` |\n| `packages/agent/src/actions/life-recent-context.ts` | `@elizaos/app-lifeops/actions/life-recent-context` | `packages/agent/src/actions/context-signal.ts` |\n\nThere may be more — I stopped after the dev server got past boot. The full deletion list from `8551fccafe` contains 33 source files; finding which ones still have callers is straightforward with `git grep`.\n\n## Sample error\n\n```\nerror: Cannot find module './task-agent-message-routing.js'\n from '/path/to/eliza/packages/agent/src/api/server.ts'\n```\n\nThe `.js` extension comes from ESM-style relative imports against `.ts` sources, but the underlying `.ts` file is gone.\n\n## Suggested fix\n\nTwo reasonable options:\n\n1. **Restore the shim files** (one-line `export * from \"@elizaos//...\"` each). Lowest-impact, preserves the existing import boundary.\n2. **Update the importers** to point at the underlying app package directly (e.g. change `from \"./website-blocker-routes.js\"` to `from \"@elizaos/app-lifeops/routes/website-blocker-routes\"`). Cleaner long-term but touches more files.\n\nI have local diffs for option 1 (verified the dev server boots cleanly with all 7 shims restored). Filing as an issue per request rather than sending a PR — happy to convert if useful.\n\n## Environment\n- bun 1.3.13\n- eliza submodule HEAD: `4e650ca0ad` (descendant of `8551fccafe`)\n- Discovered while booting milady on `develop`", "createdAt": "2026-04-29T14:37:23Z", "closedAt": "2026-04-29T21:02:47Z", "state": "CLOSED", "commentCount": 1 } ], "topPRs": [ { "id": "PR_kwDOMT5cIs7XooKA", "title": "chore: add cloud and plugins, remove rust and python", "author": "lalalune", "number": 7235, "body": "This PR simplifies and consolidates", "repository": "elizaos/eliza", "createdAt": "2026-05-02T11:46:07Z", "mergedAt": "2026-05-03T00:50:22Z", "additions": 1307096, "deletions": 248884 }, { "id": "PR_kwDOMT5cIs7V0zva", "title": "Shaw/checkpoint 20260426 eliza", "author": "lalalune", "number": 7135, "body": "Add some new things", "repository": "elizaos/eliza", "createdAt": "2026-04-27T04:40:12Z", "mergedAt": null, "additions": 26405, "deletions": 4667 }, { "id": "PR_kwDOMT5cIs7WsOJC", "title": "feat(vault): @elizaos/vault — cross-platform secrets vault + Settings UI integration", "author": "Dexploarer", "number": 7197, "body": "# Relates to\n\nThis is the upstream-targeting twin of milady-ai/eliza#6. The vault feature originated in the Milady fork; this PR lands the upstream-relevant slice on `elizaOS/eliza:develop`.\n\n# Risks\n\n**Low.** The vault is an additive workspace package; the runtime + Settings UI integration is a write-through mirror over the existing `config.env.X` storage path, so disabling it is a one-line change in `plugins-compat-routes.ts` (`mirrorPluginSensitiveToVault` → no-op). Cross-platform secret-service behaviour is exercised by a new dedicated CI workflow (macOS Keychain / Windows Credential Manager / Linux libsecret) so the headline portability claim is verifiable on every PR. The legacy `config.env.X` write path is unchanged — even if every vault call failed, plugin saves would still persist.\n\n# Background\n\n## What does this PR do?\n\nAdds **`@elizaos/vault`** — a cross-platform secrets/config vault — and wires it into the agent runtime + Settings UI so the existing \"save my OpenAI key\" flow stops storing plaintext in `config.env` and starts encrypting at rest with a key from the OS keychain.\n\n### `@elizaos/vault` (new package, `packages/vault/`)\n\n- **Encryption-at-rest** with AES-256-GCM, secret-id-as-AAD (so a leaked ciphertext can't be replayed against a different key).\n- **Master key in the OS keychain by default** — macOS Keychain, Windows Credential Manager, Linux Secret Service via `@napi-rs/keyring`.\n- **Headless fallback**: `passphraseMasterKey()` / `passphraseMasterKeyFromEnv(\"MILADY_VAULT_PASSPHRASE\")` derives the master key with `scrypt` for Linux servers and CI without a Secret Service agent.\n- `defaultMasterKey()` chains keychain → passphrase → throws `MasterKeyUnavailableError` whose message names every remediation path.\n- **One API for sensitive and non-sensitive config** — `vault.set(key, value, { sensitive: true })` vs `vault.set(key, value)`.\n- **Password-manager references are first-class** — values can live in 1Password / Proton Pass / Bitwarden, the vault stores only the resolver reference.\n- **`SecretsManager`** layer routes per-key writes/reads to the user-selected backend (`in-house`, `1password`, `bitwarden`, `protonpass`), with detection + preferences API at `/api/secrets/manager/{backends,preferences}`.\n- **Audit log** at `audit/vault.jsonl` per write.\n- **Testing harness** (`@elizaos/vault/testing#createTestVault`) that produces a vault wired to an in-memory master key for downstream tests.\n\n### Runtime + Settings UI integration\n\n- **Write-through mirror in `/api/plugins/:id` PUT**: when a sensitive plugin field is saved, the value is mirrored into the vault (encrypted at rest) on top of the existing `config.env.X` write. Mirror failures are surfaced to the UI under `vaultMirrorFailures` rather than silently swallowed.\n- **Vault-first reveal**: `POST /api/plugins/:id/reveal` consults `sharedVault().get(key)` before falling back to `process.env` / `config.env`, so a freshly-saved key is the value the user sees.\n- **Per-process cached `sharedVault()`** so concurrent saves share `VaultImpl.mutate()`'s mutex; a per-request `createVault()` would race and silently lose entries.\n- **Broader credential heuristic** — `pickPrimaryCredentialParam()` walks a priority-ordered regex list (`API_KEY` → `API_TOKEN` → `BOT_TOKEN` → `ACCESS_TOKEN` → `SECRET_KEY` → `PRIVATE_KEY` → `CLIENT_SECRET`) instead of only matching `*_API_KEY$`, with an explicit fallback to the first sensitive parameter. Closes the bug where typing a model field before the API-key field caused `Object.values(config).find()` to pick up the model slug; also fixes connectors whose primary credential is a bot token / private key / client secret.\n- **Settings UI** — `SecretsManagerSection` + `ApiKeyConfig` with inline prefix validation and validation warnings, keyboard shortcut `⌘⌥⌃V` (Mac) / `Ctrl+Alt+Shift+V` (Win/Linux), global modal mount, application menu accelerator.\n- **Cloud disconnect orphan-route patch**: `/api/cloud/disconnect` now nulls every routed service (`llmText`, `tts`, `media`, `embeddings`, `rpc`) instead of just `llmText`, so disconnect doesn't leave silently-401'ing voice/image/embedding features routed at the dead `cloud-proxy → elizacloud`. Plus `linkedAccounts.elizacloud.status=\"unlinked\"` to prevent the in-memory state from overwriting the canonical unlinked state on next `saveElizaConfig`.\n\n### Runtime-ops × vault\n\n- `ProviderSwitchIntent.apiKeyRef` replaces plaintext `apiKey` end-to-end. The provider-switch route writes the vault entry, persists only the reference, and resolves through the vault when the runtime reload-hot needs the key.\n- Legacy ops with plaintext `apiKey` are auto-migrated to `apiKeyRef` on hydrate.\n- Repository pruning suite (retention, cap, idempotency, hydrate; 6 tests).\n- A `simplify` pass that dedupes utility code, removes ghost phases, and consolidates state.\n\n## What kind of change is this?\n\n**Features** — non-breaking. `@elizaos/vault` is new. The runtime/Settings wiring is additive on top of the existing config-write path, controlled by feature presence rather than a flag. The provider-switch `apiKeyRef` replaces `apiKey` but a hydrate-time migration upgrades legacy ops in place.\n\n# Documentation changes needed?\n\nMy changes do not require a change to the project documentation. New package documentation lives inline in `packages/vault/README.md` and the public API surface is documented via TSDoc. The Settings UI changes are user-facing but match the existing settings pattern.\n\n# Testing\n\n## Where should a reviewer start?\n\n1. **`packages/vault/`** — start with `src/vault.ts` (the public API), then `src/master-key.ts` (the keychain/passphrase chain), then `src/manager.ts` (the multi-backend router). Tests in `test/{vault,master-key,manager,store,envelope,references,keyring}.test.ts` exercise every public path; `test/master-key.test.ts` covers the headless-fallback chain explicitly.\n2. **`packages/app-core/src/services/vault-mirror.ts`** + `packages/app-core/src/services/vault-mirror.test.ts` — the write-through mirror is small, isolated, and has a focused test that includes failure-collection and a source-text guard for the vault-first reveal ordering.\n3. **`packages/app-core/src/api/plugins-compat-routes.ts`** — the `PUT /api/plugins/:id` handler and `/reveal` route, where the vault wiring sits next to the existing legacy code path.\n4. **`packages/agent/src/runtime/operations/`** — `vault-bridge.ts`, `vault-integration.test.ts`, and `health.test.ts` show the `apiKeyRef` migration. The 22-case integration suite is the strongest evidence that the runtime path keeps working.\n\n## Detailed testing steps\n\nAutomated tests are acceptable.\n\n- **Vault unit suite (cross-platform)**: `bun run --cwd packages/vault test` — 64 tests covering vault, master-key (incl. passphrase fallback), manager, store, envelope, references, keyring round-trips. The new `vault-ci` workflow runs this matrix on `ubuntu-latest`, `macos-latest`, `windows-latest` so the OS-keychain claim is checked on every PR.\n- **App-core wiring suite**: `bun run --cwd packages/app-core test` — 37 wiring tests (vault-mirror unit + source-text guards, secrets-manager-routes integration via real `http.Server`, usePluginsSkillsState heuristic priority list, useSecretsManagerShortcut Mac/Win/Linux chord matching, server.cloud-disconnect orphan-route guard).\n- **Runtime-ops vault integration**: 22 cases in `packages/agent/src/runtime/operations/vault-integration.test.ts` proving the `apiKeyRef` path works end-to-end.\n- **End-to-end save-flow**: `provider-switch-routes.e2e.test.ts` stands up a real `http.Server` and exercises Settings PUT → mirror → reveal → provider switch against an in-memory vault.\n- **Cross-platform CI**: the new `vault-ci` workflow (`.github/workflows/vault-ci.yaml`) runs the vault suite on macOS / Linux / Windows runners; an `app-core-wiring` job runs the wiring tests on `ubuntu-latest` with proto generation as a prerequisite.\n\n### Manual smoke (UI)\n\n1. Open the desktop app → **Settings → Plugins → OpenAI** (or any AI provider).\n2. Enter an API key, save.\n3. The plugin row should turn green and reload the agent. Open `~/.milady/vault.json` — the value is encrypted; the OS keychain holds the master key under `service: \"milady\"`, `account: \"vault.masterKey\"`.\n4. Open the **Secrets Vault** modal via `⌘⌥⌃V` (or **Edit → Secrets Vault** menu). Switch the routing for `OPENAI_API_KEY` to a different backend, save. Subsequent reveals fetch from the new backend.\n\n## Deploy notes\n\n- **`@elizaos/vault` is a new workspace package** — `bun install` at the repo root picks it up; nothing extra to do.\n- **No database changes.**\n- **No breaking changes** to existing config files. Legacy `config.env.X` writes still happen alongside the vault mirror; vault values shadow `process.env` only in the reveal path. The `apiKeyRef` migration on the runtime-ops side is in-place on hydrate (no operator action required).\n\n---\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n", "repository": "elizaos/eliza", "createdAt": "2026-04-29T11:25:51Z", "mergedAt": "2026-05-01T03:12:42Z", "additions": 22472, "deletions": 677 }, { "id": "PR_kwDOMT5cIs7WjdAP", "title": "Shaw/pr 2067 eliza fix", "author": "lalalune", "number": 7175, "body": "\r\n\r\n# Relates to\r\n\r\n\r\n\r\n\r\n\r\n# Risks\r\n\r\n\r\n\r\n# Background\r\n\r\n## What does this PR do?\r\n\r\n## What kind of change is this?\r\n\r\n\r\n\r\n\r\n\r\n\r\n# Documentation changes needed?\r\n\r\n\r\n\r\n\r\n\r\n# Testing\r\n\r\n## Where should a reviewer start?\r\n\r\n## Detailed testing steps\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n", "repository": "elizaos/eliza", "createdAt": "2026-04-29T02:39:06Z", "mergedAt": "2026-04-29T02:39:14Z", "additions": 20547, "deletions": 3209 }, { "id": "PR_kwDOMT5cIs7Whalw", "title": "feat(agent): runtime operations manager + widget host refresh", "author": "Dexploarer", "number": 7166, "body": "## Summary\n\nBundles in-flight feature work on `feat/widget-host-cycle-and-greenup` so it isn't sitting as uncommitted state. Includes:\n\n- New `packages/agent/src/runtime/operations/` module — `RuntimeOperationManager` as the single-flight gate for provider switches / restarts / reloads, plus classifier (idempotency-key dedupe), health predicates, hot-reload + cold-restart strategies. Tests included.\n- Provider switch route now reads `Idempotency-Key`, routes through the manager rather than the legacy `providerSwitchInProgress` boolean.\n- Restart, server, and dev-platform paths refactored against the new manager.\n- Earlier widget-host cycle/chunking + steward static-import fixes (already on the branch).\n- Splash asset + launchpad fixes (already on the branch).\n\nWIP — squash / split as makes sense for review. The runtime-operations module is the largest new surface and the most reviewable as a single unit.\n\n## Test plan\n\n- [ ] `bun run test` — exercises classifier + health unit tests\n- [ ] Manual provider switch under load with idempotency key — verify dedupe\n- [ ] Hot reload path — verify health gate prevents premature traffic resume\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n\n\n

Greptile Summary

\n\nThis PR introduces a `RuntimeOperationManager` module as the single-flight gate for provider switches and runtime restarts, replacing the previous `providerSwitchInProgress` boolean with a filesystem-backed operation repository, idempotency-key dedup, tier-classified reload strategies (hot/warm/cold), and health-gated promotion. Three issues need attention before merging:\n\n- Config is persisted to disk before the manager's rejection check — a `409 rejected-busy` response leaves the on-disk config mutated with the new provider while the running runtime is unchanged.\n- The `warm` tier strategy is never registered in `server.ts`, so same-family provider switches (classified as `warm` by the classifier) always fail internally with `\\\"no-strategy-for-tier\\\"`.\n- The raw API key is serialized into the persisted `ProviderSwitchIntent` JSON on disk.\n
\n\n

Confidence Score: 3/5

\n\nNot safe to merge — config-mutation-before-rejection and the missing warm strategy are current defects on the provider switch hot path.\n\nTwo P1 behavioral bugs (config written before rejection check, warm strategy unregistered causing silent failures) plus one P1 security issue (API key on disk) pull the score below the P1 ceiling of 4. Multiple P1s in core paths warrant a 3.\n\npackages/agent/src/api/provider-switch-routes.ts and packages/agent/src/api/server.ts\n\n

Security Review

\n\n- **Plaintext credential storage** (`packages/agent/src/api/provider-switch-routes.ts`, `packages/agent/src/runtime/operations/repository.ts`): The `ProviderSwitchIntent` includes the raw `apiKey` and is serialized in full to `/runtime-operations/.json`. Although the file is created with mode `0600`, the API key is readable by any process running as the same user and persists for up to 24 hours. API keys should be stripped from the persisted record.\n
\n\n

Important Files Changed

\n\n| Filename | Overview |\n|----------|----------|\n| packages/agent/src/runtime/operations/manager.ts | New DefaultRuntimeOperationManager: single-flight gate with idempotency-key dedup, async execution chain, and health-gated promotion — logic is sound but warm-tier strategy gap causes silent failures for same-family switches |\n| packages/agent/src/runtime/operations/types.ts | Well-typed contracts for operations, phases, repository, health checks, and strategies; clean discriminated union intent model |\n| packages/agent/src/runtime/operations/classifier.ts | Pure tier classifier: returns \"warm\" for same-family switches but no warm strategy is wired in server.ts, making those operations always fail |\n| packages/agent/src/runtime/operations/repository.ts | Filesystem-backed repo with atomic writes and in-memory O(1) cache; abandoned-op reaping on hydrate is solid; file mode 0600 is appropriate but intent JSON (including API keys) still lands on disk in cleartext |\n| packages/agent/src/api/provider-switch-routes.ts | Route correctly routes through the new manager, but saves config to disk before checking the manager outcome (config mutated even on 409) and embeds the raw API key in the persisted intent |\n| packages/agent/src/api/server.ts | Manager wiring looks correct; warm strategy is missing from the strategies map causing all same-family provider switches to fail with \"no-strategy-for-tier\" |\n| packages/agent/src/runtime/operations/cold-strategy.ts | Cold restart delegates correctly to the injected restartRuntime closure, but double-appends \"shutdown-old\" phase producing a duplicate entry in the log |\n| packages/agent/src/runtime/operations/reload-hot.ts | Hot strategy correctly applies env vars and best-effort notifies plugins; defaultApplyProviderEnv double-writes config since the route also writes before submitting the operation |\n| packages/agent/src/runtime/operations/health.ts | HealthChecker with parallel execution, per-check timeouts via Promise.race, and clean required/optional semantics — well implemented |\n| packages/agent/src/runtime/operations/index.ts | Clean barrel export for the operations module |\n\n
\n\n\n\n

Sequence Diagram

\n\n```mermaid\nsequenceDiagram\n participant C as Client\n participant R as ProviderSwitchRoute\n participant M as RuntimeOperationManager\n participant Repo as FilesystemRepository\n participant S as ReloadStrategy (hot/cold)\n participant H as HealthChecker\n\n C->>R: POST /api/provider/switch\n R->>R: saveElizaConfig ⚠️ written before rejection check\n R->>M: start({intent, idempotencyKey})\n M->>Repo: findByIdempotencyKey(key)\n alt key exists\n Repo-->>M: existing op\n M-->>R: deduped\n R-->>C: 200\n end\n M->>Repo: findActive()\n alt op in flight\n Repo-->>M: active op\n M-->>R: rejected-busy ⚠️ config already written\n R-->>C: 409\n end\n M->>Repo: create(op)\n M-->>R: accepted\n R-->>C: 202 + operationId\n Note over M: async execution chain\n M->>S: apply(ctx)\n S-->>M: newRuntime\n M->>H: runForRuntime(newRuntime)\n H-->>M: HealthCheckReport\n alt ok\n M->>Repo: update succeeded\n else failed\n M->>Repo: update failed\n end\n```\n
\n\n\"Fix \"Fix \"Fix\n\nReviews (1): Last reviewed commit: [\"feat(agent): runtime operations manager ...\"](https://github.com/elizaos/eliza/commit/3b41268180da76fa04f245d949cf9132bc08005e) | [Re-trigger Greptile](https://app.greptile.com/api/retrigger?id=30101058)\n\n> Greptile also left **4 inline comments** on this PR.\n\n", "repository": "elizaos/eliza", "createdAt": "2026-04-28T23:14:38Z", "mergedAt": "2026-04-29T02:39:15Z", "additions": 6861, "deletions": 619 } ], "codeChanges": { "additions": 28825, "deletions": 10702, "files": 467, "commitCount": 1349 }, "completedItems": [ { "title": "fix: WidgetHost re-export cycle + steward static node imports + agent re-exports", "prNumber": 7133, "type": "bugfix", "body": "## Summary\n\nThree small follow-ups that landed AFTER #7115 (now merged) and need their own PR. All targeted at remaining build warnings + a cross-package test gap.\n\n### 1. WidgetHost re-export cycle\n\nRollup warning (new since #7115 introduc", "files": [ "apps/app-steward/src/services/steward-sidecar.ts", "apps/app-steward/src/services/steward-sidecar/process-management.ts", "apps/app-steward/src/services/steward-sidecar/wallet-setup.ts", "packages/agent/src/api/index.ts", "packages/app-core/src/components/character/CharacterHubView.tsx", "packages/app-core/src/components/chat/TasksEventsPanel.tsx", "packages/app-core/src/components/pages/AutomationsView.tsx", "packages/app-core/src/components/pages/HeartbeatsView.tsx" ] }, { "title": "chore(deps): update dependency vitest to v4", "prNumber": 7131, "type": "tests", "body": "> ℹ️ **Note**\n> \n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-con", "files": [ "templates/min-app/package.json", "templates/min-plugin/package.json" ] }, { "title": "chore(deps): update dependency vite to v8", "prNumber": 7130, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [vite](https://vite.dev) ([source](http", "files": [ "templates/min-app/package.json" ] }, { "title": "chore(deps): update dependency @vitejs/plugin-react to v6", "prNumber": 7129, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [@vitejs/plugin-react](https://redirect", "files": [ "templates/min-app/package.json" ] }, { "title": "fix(automations): in-flight draft selection survives stale-id check + synthesizes draft item", "prNumber": 7128, "type": "bugfix", "body": "## Summary\n\nTwo coupled bugs around in-flight workflow drafts in `AutomationsView`:\n\n1. **Stale-id validation effect cleared the in-flight `workflow-draft:` selection** before generation finished. The `selectedItemId` validation effect ", "files": [ "packages/app-core/src/components/pages/AutomationsView.tsx" ] }, { "title": "feat(automations): WorkflowGenerationProgress — multi-stage progress card", "prNumber": 7127, "type": "feature", "body": "## Summary\n\nReplaces the single \"Building workflow...\" chip in `WorkflowGraphViewer`'s generating overlay with a **6-stage timer-cycled progress card** that gives users meaningful feedback during the ~10–30s LLM workflow-generation window.\n", "files": [ "packages/app-core/src/components/pages/WorkflowGraphViewer.tsx" ] }, { "title": "test(n8n): pin handleGenerateWorkflow deployWorkflow path", "prNumber": 7126, "type": "tests", "body": "## Summary\n\nAdds unit-test coverage for the `handleGenerateWorkflow` → `service.deployWorkflow` → `service.getWorkflow` flow introduced by [#7118](https://github.com/elizaOS/eliza/pull/7118). This is the regression net for the route's new s", "files": [ "packages/app-core/src/api/client-n8n.ts", "packages/app-core/src/api/n8n-routes.test.ts", "packages/app-core/src/api/n8n-routes.ts" ] }, { "title": "fix(automations): hide right-rail chat dock on Overview empty state", "prNumber": 7125, "type": "bugfix", "body": "## Summary\n\nWhen the Automations Overview is in its empty state (no workflows, no triggers selected), the right-rail page-scoped chat dock was visible alongside the hero-input compose surface — two compose surfaces on screen at once with ov", "files": [ "packages/app-core/src/components/pages/AutomationsView.tsx", "packages/app-core/src/components/workspace/AppWorkspaceChrome.tsx" ] }, { "title": "fix(triggers): CREATE_TRIGGER_TASK page-automations unblock + LIFE handler hardening", "prNumber": 7124, "type": "bugfix", "body": "## Summary\n\nThree coordinated fixes for the page-automations `LIFE`-vs-trigger routing problem:\n\n1. **`packages/agent/src/triggers/action.ts`** — remove `SET_REMINDER` from `createTriggerTaskAction`'s similes (it collides with LIFE's simile", "files": [ "apps/app-lifeops/src/actions/life.test.ts", "apps/app-lifeops/src/actions/life.ts", "packages/agent/src/triggers/action.ts", "packages/typescript/src/__tests__/owned-action-correction.test.ts", "packages/typescript/src/services/message.ts" ] }, { "title": "fix(lifeops): scope-reject LIFE on foreign page-* scopes", "prNumber": 7123, "type": "bugfix", "body": "## Summary\n\nAdjusts the `LIFE` action handler in app-lifeops to scope-reject when invoked on a foreign `page-*` scope (e.g. `page-automations`, `page-chat`). Previously, `LIFE` would accept the action even from these foreign scopes, which g", "files": [ "apps/app-lifeops/src/actions/life.test.ts", "apps/app-lifeops/src/actions/life.ts" ] }, { "title": "fix(telegram): emit MESSAGE_RECEIVED on Telegram messages so event-kind triggers fire", "prNumber": 7122, "type": "bugfix", "body": "## Summary\n\nEmits `MESSAGE_RECEIVED` on the runtime event bus when an inbound Telegram message arrives via the in-process Telegram shim path. Without this emission, event-kind triggers bound to Telegram messages register fine but never fire", "files": [ "packages/app-core/src/runtime/eliza.ts" ] }, { "title": "fix(automations): delete chat conversation when workflow is deleted + skip orphan workflow rooms in aggregator", "prNumber": 7121, "type": "bugfix", "body": "## Summary\n\nTwo related cleanup fixes on the Automations layer:\n\n1. **Delete the per-workflow chat conversation when the workflow is deleted.** Previously, deleting a workflow left its `workflow:` chat room in the database. Those rooms ", "files": [ "packages/app-core/src/api/automations-compat-routes.ts", "packages/app-core/src/components/pages/AutomationsView.tsx" ] }, { "title": "feat(automations): disambiguate workflow vs trigger + hide empty-state chat pane", "prNumber": 7120, "type": "feature", "body": "## Summary\n\nTwo small UX/planner improvements on the Automations page:\n\n1. **Planner-side disambiguation prompt:** the action-planner now distinguishes between user prompts that mean \"create an n8n workflow\" (multi-node automation pipeline)", "files": [ "packages/app-core/src/components/pages/N8nWorkflowsPanel.tsx", "packages/app-core/src/i18n/locales/en.json", "packages/typescript/src/prompts.ts" ] }, { "title": "fix(triggers): unblock CREATE_TRIGGER_TASK dispatch on page-automations", "prNumber": 7119, "type": "bugfix", "body": "## Summary\n\nFixes a routing bug where `CREATE_TRIGGER_TASK` actions issued from the page-automations scope were silently dropped before reaching the trigger-action handler.\n\n### Root cause\n\n`page-scoped-conversations.ts` filtered out `CREAT", "files": [ "packages/agent/src/triggers/action.test.ts", "packages/agent/src/triggers/action.ts", "packages/app-core/src/components/pages/page-scoped-conversations.ts" ] }, { "title": "fix(n8n): hero-chat workflow create resolves credentials end-to-end", "prNumber": 7118, "type": "bugfix", "body": "## Summary\n\nWires the credential-resolution path through the hero-chat workflow-creation entry point. Previously, workflows created via `POST /api/n8n/workflows/generate` proxied straight to n8n after generation and bypassed `service.deploy", "files": [ "packages/app-core/src/api/client-n8n.ts", "packages/app-core/src/api/n8n-routes.ts" ] }, { "title": "fix(chat): bump streaming generation timeout 90s -> 180s", "prNumber": 7117, "type": "bugfix", "body": "## Summary\n\nBumps the streaming chat-route generation timeout from 90s to 180s.\n\n90s is too short for many real-world LLM workloads we hit downstream:\n- Workflow generation against tool-use / structured-output models routinely takes 60-120s", "files": [ "packages/agent/src/api/chat-routes.ts" ] }, { "title": "feat(triggers): wire event-kind triggers to the runtime event bus", "prNumber": 7116, "type": "feature", "body": "## Summary\n\nAdds a `TriggerEventBridge` service that listens on the runtime event bus and dispatches matching event-kind triggers (Discord MESSAGE_RECEIVED, Telegram MESSAGE_RECEIVED, Webhook, etc.) to the trigger-handler pipeline. Without ", "files": [ "packages/app-core/src/runtime/eliza.ts", "packages/app-core/src/services/trigger-event-bridge.test.ts", "packages/app-core/src/services/trigger-event-bridge.ts" ] }, { "title": "feat(app-core): apps as native windows + App Details page (test-green)", "prNumber": 7115, "type": "feature", "body": "## Summary\n\nThis is the org-owned (milady-ai/eliza) version of [Dexploarer/eliza#26 → elizaOS/eliza#7114](https://github.com/elizaOS/eliza/pull/7114) — same changes, pushed from the org fork instead of a personal fork.\n\n- Every app — intern", "files": [ "apps/app-companion/src/components/companion/CompanionAppView.tsx", "apps/app-companion/src/components/companion/CompanionView.tsx", "apps/app/src/main.tsx", "packages/app-core/platforms/electrobun/electrobun.config.ts", "packages/app-core/platforms/electrobun/src/application-menu.ts", "packages/app-core/platforms/electrobun/src/index.ts", "packages/app-core/platforms/electrobun/src/native/desktop.ts", "packages/app-core/platforms/electrobun/src/native/steward.ts", "packages/app-core/platforms/electrobun/src/rpc-handlers.ts", "packages/app-core/platforms/electrobun/src/rpc-schema.ts", "packages/app-core/platforms/electrobun/src/surface-windows.ts", "packages/app-core/src/App.tsx", "packages/app-core/src/api/auth.ts", "packages/app-core/src/components/apps/helpers.ts", "packages/app-core/src/components/apps/internal-tool-apps.ts", "packages/app-core/src/components/apps/launch-history.ts", "packages/app-core/src/components/apps/per-app-config.ts", "packages/app-core/src/components/apps/useRegistryCatalog.ts", "packages/app-core/src/components/character/CharacterOverviewSection.test.tsx", "packages/app-core/src/components/onboarding/BootstrapStep.tsx", "packages/app-core/src/components/pages/AppDetailsView.tsx", "packages/app-core/src/components/pages/AppsView.tsx", "packages/app-core/src/i18n/locales/en.json", "packages/app-core/src/i18n/locales/es.json", "packages/app-core/src/i18n/locales/ko.json", "packages/app-core/src/i18n/locales/pt.json", "packages/app-core/src/i18n/locales/tl.json", "packages/app-core/src/i18n/locales/vi.json", "packages/app-core/src/i18n/locales/zh-CN.json", "packages/app-core/src/navigation/index.ts", "packages/app-core/src/shell/AppWindowRenderer.tsx", "packages/app-core/src/shell/DetachedShellRoot.tsx", "packages/app-core/src/shell/index.ts", "packages/app-core/src/state/startup-phase-hydrate.test.ts", "packages/shared/src/app-hero-art.ts" ] }, { "title": "chore(deps): bump lambda_runtime from 0.13.0 to 1.1.3 in /packages/examples/aws/rust", "prNumber": 7113, "type": "other", "body": "Bumps [lambda_runtime](https://github.com/aws/aws-lambda-rust-runtime) from 0.13.0 to 1.1.3.\n
\nRelease notes\n

Sourced from lambda_runtime's r", "files": [ "packages/examples/aws/rust/Cargo.lock", "packages/examples/aws/rust/Cargo.toml" ] }, { "title": "chore(deps): update ui-tars requirement from >=0.4.2.2 to >=0.5.1 in /packages/benchmarks/OSWorld", "prNumber": 7112, "type": "other", "body": "Updates the requirements on ui-tars to permit the latest version.\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: ", "files": [ "packages/benchmarks/OSWorld/requirements.txt" ] }, { "title": "chore(deps): update transformers requirement from ~=5.6.0 to ~=5.6.2 in /packages/benchmarks/OSWorld", "prNumber": 7111, "type": "other", "body": "Updates the requirements on [transformers](https://github.com/huggingface/transformers) to permit the latest version.\n

\nRelease notes\n

Sourced from \n

Release notes\n

Sourced from axum's releases.

\n
\n

axum-v0.8.", "files": [ "packages/examples/gcp/rust/Cargo.lock", "packages/examples/gcp/rust/Cargo.toml" ] }, { "title": "chore(deps): bump tower-http from 0.5.2 to 0.6.8 in /packages/examples/a2a/rust", "prNumber": 7109, "type": "other", "body": "Bumps [tower-http](https://github.com/tower-rs/tower-http) from 0.5.2 to 0.6.8.\n
\nRelease notes\n

Sourced from tower-http's releases.

\n\r\n\r\n# Relates to\r\n\r\n\r\n\r\n\n\n

Greptile Summary

\n\nThis PR wires up a full on-device Eliza agent on Android: a new `MiladyAgentService` foreground service extracts and exec's a Bun runtime + agent bundle from APK assets", "files": [ "packages/agent/src/bin.ts", "packages/agent/src/cli/index.ts", "packages/agent/src/runtime/aosp-llama-adapter.test.ts", "packages/agent/src/runtime/aosp-llama-adapter.ts", "packages/agent/src/runtime/aosp-local-inference-bootstrap.test.ts", "packages/agent/src/runtime/aosp-local-inference-bootstrap.ts", "packages/app-core/platforms/android/app/build.gradle", "packages/app-core/platforms/android/app/src/main/java/ai/elizaos/app/MainActivity.java", "packages/app-core/platforms/android/app/src/main/java/ai/elizaos/app/MiladyAgentService.java", "packages/app-core/scripts/lib/stage-android-agent.mjs", "packages/app-core/scripts/lib/stage-android-agent.test.ts", "packages/app-core/scripts/run-mobile-build.mjs", "packages/app-core/scripts/run-mobile-build.test.ts", "packages/app-core/src/components/shell/RuntimeGate.tsx", "packages/app-core/src/onboarding/probe-local-agent.ts", "packages/app-core/src/runtime/ensure-local-inference-handler.test.ts", "packages/app-core/src/runtime/ensure-local-inference-handler.ts", "packages/app-core/src/services/local-inference/catalog.ts", "packages/app-core/src/services/local-inference/router-handler.test.ts", "packages/app-core/test/onboarding/probe-local-agent.test.ts" ] }, { "title": "chore(deps): update github artifact actions (major)", "prNumber": 7201, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Type | Update | Change |\n|---|---|---|---|\n| [actions/download-artifact](https://redirect.github.com/actions/download-artifact) | action | major | `v4` → `v8` |\n| [actions/upload-artifact", "files": [ ".github/workflows/android-release.yml", ".github/workflows/apple-store-release.yml", ".github/workflows/benchmark-weekly.yml", ".github/workflows/docker-ci-smoke.yml", ".github/workflows/live-scenarios.yml", ".github/workflows/mobile-build-smoke.yml", ".github/workflows/publish-packages.yml", ".github/workflows/release-electrobun.yml", ".github/workflows/scenario-matrix.yml", ".github/workflows/snap-build-test.yml", ".github/workflows/test-flatpak.yml", ".github/workflows/test-packaging.yml" ] }, { "title": "chore(deps): update eslint monorepo to v10 (major)", "prNumber": 7200, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [@eslint/js](https://eslint.org) ([sour", "files": [ "packages/homepage/package.json" ] }, { "title": "chore(deps): update dependency wrangler to v4", "prNumber": 7199, "type": "other", "body": "> ℹ️ **Note**\n> \n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-con", "files": [ "packages/homepage/package.json" ] }, { "title": "chore(deps): update dependency vite to v8", "prNumber": 7198, "type": "other", "body": "> ℹ️ **Note**\n> \n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-con", "files": [ "packages/homepage/package.json" ] }, { "title": "feat(vault): @elizaos/vault — cross-platform secrets vault + Settings UI integration", "prNumber": 7197, "type": "feature", "body": "# Relates to\n\nThis is the upstream-targeting twin of milady-ai/eliza#6. The vault feature originated in the Milady fork; this PR lands the upstream-relevant slice on `elizaOS/eliza:develop`.\n\n# Risks\n\n**Low.** The vault is an additive works", "files": [ ".github/actions/setup-bun-workspace/action.yml", ".github/workflows/apple-store-release.yml", ".github/workflows/mobile-build-smoke.yml", ".github/workflows/nightly.yml", ".github/workflows/quality-fork.yml", ".github/workflows/test-electrobun-release.yml", ".github/workflows/vault-ci.yaml", ".github/workflows/windows-dev-smoke.yml", "apps/app/.env.example", "apps/app/.gitignore", "apps/app/README.md", "apps/app/app.config.ts", "apps/app/capacitor.config.ts", "apps/app/electrobun/.gitignore", "apps/app/index.html", "apps/app/package.json", "apps/app/playwright.electrobun.packaged.config.ts", "apps/app/playwright.ui-packaged.config.ts", "apps/app/playwright.ui-smoke.config.ts", "apps/app/playwright.web-views.config.ts", "apps/app/public/android-chrome-192x192.png", "apps/app/public/android-chrome-512x512.png", "apps/app/public/apple-touch-icon.png", "apps/app/public/favicon-16x16.png", "apps/app/public/favicon-32x32.png", "apps/app/public/favicon.ico", "apps/app/public/logos/anthropic-icon-white.png", "apps/app/public/logos/anthropic-icon.png", "apps/app/public/logos/claude-icon.png", "apps/app/public/logos/deepseek-icon.png", "apps/app/public/logos/elizaos-icon.png", "apps/app/public/logos/gemini-icon.png", "apps/app/public/logos/grok-icon-white.png", "apps/app/public/logos/grok-icon.png", "apps/app/public/logos/groq-icon-white.png", "apps/app/public/logos/groq-icon.png", "apps/app/public/logos/mistral-icon.png", "apps/app/public/logos/ollama-icon-white.png", "apps/app/public/logos/ollama-icon.png", "apps/app/public/logos/openai-icon-white.png", "apps/app/public/logos/openai-icon.png", "apps/app/public/logos/openrouter-icon-white.png", "apps/app/public/logos/openrouter-icon.png", "apps/app/public/logos/together-ai-icon.png", "apps/app/public/logos/zai-icon-white.png", "apps/app/public/logos/zai-icon.png", "apps/app/public/og-image.png", "apps/app/public/splash-bg.jpg", "apps/app/scripts/build.mjs", "apps/app/scripts/capacitor-plugin-names.mjs" ] }, { "title": "chore(deps): update dependency typescript to v6", "prNumber": 7193, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [typescript](https://www.typescriptlang", "files": [ "packages/homepage/package.json" ] }, { "title": "chore(deps): update dependency ruby to v4", "prNumber": 7192, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Type | Update | Change |\n|---|---|---|---|\n| [ruby](https://www.ruby-lang.org) ([source](https://redirect.github.com/ruby/ruby)) | uses-with | major | `3.4.9` → `4.0.3` |\n\n---\n\n> [!WARNIN", "files": [ ".github/workflows/android-release.yml", ".github/workflows/apple-store-release.yml" ] }, { "title": "chore(deps): update dependency node to v24", "prNumber": 7191, "type": "other", "body": "> ℹ️ **Note**\n> \n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovateb", "files": [ ".github/workflows/benchmark-tests.yml", ".github/workflows/docker-ci-smoke.yml", ".github/workflows/integration-dod-gap-issues.yml", ".github/workflows/mobile-build-smoke.yml", ".github/workflows/publish-plugin-elizacloud.yml", ".github/workflows/release-electrobun.yml", ".github/workflows/test-electrobun-release.yml", ".github/workflows/test-packaging.yml", ".github/workflows/windows-desktop-preload-smoke.yml", ".github/workflows/windows-dev-smoke.yml", "packages/homepage/package.json" ] }, { "title": "chore(deps): update dependency macos to v15", "prNumber": 7190, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Type | Update | Change |\n|---|---|---|---|\n| [macos](https://redirect.github.com/actions/runner-images) | github-runner | major | `14` → `15` |\n\n---\n\n> [!WARNING]\n> Some dependencies coul", "files": [ ".github/workflows/apple-store-release.yml", ".github/workflows/release-electrobun.yml" ] }, { "title": "chore(deps): update dependency @vitejs/plugin-react to v6", "prNumber": 7189, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [@vitejs/plugin-react](https://redirect", "files": [ "packages/homepage/package.json" ] }, { "title": "chore(deps): update android-actions/setup-android action to v4", "prNumber": 7188, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Type | Update | Change |\n|---|---|---|---|\n| [android-actions/setup-android](https://redirect.github.com/android-actions/setup-android) | action | major | `v3` → `v4` |\n\n---\n\n> [!WARNING]", "files": [ ".github/workflows/elizaos-cuttlefish.yml", ".github/workflows/mobile-build-smoke.yml" ] }, { "title": "chore(deps): update actions/setup-python action to v6", "prNumber": 7186, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Type | Update | Change |\n|---|---|---|---|\n| [actions/setup-python](https://redirect.github.com/actions/setup-python) | action | major | `v5` → `v6` |\n\n---\n\n> [!WARNING]\n> Some dependenci", "files": [ ".github/actions/setup-bun-workspace/action.yml", ".github/workflows/publish-packages.yml", ".github/workflows/publish-plugin-elizacloud.yml", ".github/workflows/test-packaging.yml" ] }, { "title": "chore(deps): update actions/setup-java action to v5", "prNumber": 7185, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Type | Update | Change |\n|---|---|---|---|\n| [actions/setup-java](https://redirect.github.com/actions/setup-java) | action | major | `v4` → `v5` |\n\n---\n\n> [!WARNING]\n> Some dependencies c", "files": [ ".github/workflows/elizaos-cuttlefish.yml" ] }, { "title": "chore(deps): update dependency ai to v6.0.169", "prNumber": 7184, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [ai](https://ai-sdk.dev/docs) ([source]", "files": [ "package.json" ] }, { "title": "chore(deps): update dependency @ai-sdk/provider-utils to v4.0.24", "prNumber": 7183, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [@ai-sdk/provider-utils](https://ai-sdk", "files": [ "package.json" ] }, { "title": "chore(deps): update dependency @ai-sdk/provider to v3.0.9", "prNumber": 7182, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [@ai-sdk/provider](https://ai-sdk.dev/d", "files": [ "package.json" ] }, { "title": "chore(deps): update dependency @ai-sdk/openai to v3.0.54", "prNumber": 7181, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [@ai-sdk/openai](https://ai-sdk.dev/doc", "files": [ "package.json" ] }, { "title": "chore(deps): update actions/setup-node action to v6", "prNumber": 7180, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Type | Update | Change |\n|---|---|---|---|\n| [actions/setup-node](https://redirect.github.com/actions/setup-node) | action | major | `v4` → `v6` |\n\n---\n\n> [!WARNING]\n> Some dependencies c", "files": [ ".github/workflows/android-release.yml", ".github/workflows/apple-store-release.yml", ".github/workflows/benchmark-tests.yml", ".github/workflows/benchmark-weekly.yml", ".github/workflows/docker-ci-smoke.yml", ".github/workflows/integration-dod-gap-issues.yml", ".github/workflows/live-scenarios.yml", ".github/workflows/mobile-build-smoke.yml", ".github/workflows/nightly.yml", ".github/workflows/publish-plugin-elizacloud.yml", ".github/workflows/quality-fork.yml", ".github/workflows/quality.yml", ".github/workflows/release-electrobun.yml", ".github/workflows/test-electrobun-release.yml", ".github/workflows/test-packaging.yml", ".github/workflows/test.yml", ".github/workflows/windows-desktop-preload-smoke.yml", ".github/workflows/windows-dev-smoke.yml" ] }, { "title": "chore(deps): update actions/setup-java action to v5", "prNumber": 7179, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Type | Update | Change |\n|---|---|---|---|\n| [actions/setup-java](https://redirect.github.com/actions/setup-java) | action | major | `v4` → `v5` |\n\n---\n\n> [!WARNING]\n> Some dependencies c", "files": [ ".github/workflows/android-release.yml", ".github/workflows/mobile-build-smoke.yml" ] }, { "title": "chore(deps): update actions/labeler action to v6", "prNumber": 7178, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Type | Update | Change |\n|---|---|---|---|\n| [actions/labeler](https://redirect.github.com/actions/labeler) | action | major | `v5` → `v6` |\n\n---\n\n> [!WARNING]\n> Some dependencies could n", "files": [ ".github/workflows/auto-label.yml" ] }, { "title": "chore(deps): update actions/github-script action to v9", "prNumber": 7177, "type": "other", "body": "This PR contains the following updates:\n\n| Package | Type | Update | Change |\n|---|---|---|---|\n| [actions/github-script](https://redirect.github.com/actions/github-script) | action | major | `v7` → `v9` |\n\n---\n\n> [!WARNING]\n> Some dependen", "files": [ ".github/workflows/auto-label.yml" ] }, { "title": "Miladyos local agent on android", "prNumber": 7176, "type": "other", "body": "\r\n\r\n# Relates to\r\n\r\n\r\n\r\n\r\n\r\n# Relates to\r\n\r\n\r\n\r\n\r\n\r\n# Relates to\r\n\r\n\r\n\r\n