# ElizaOS Developer Update (2026-03-25 → 2026-03-31)

This update summarizes core engineering work and developer-relevant discussions captured from GitHub activity and the ElizaOS Discord during the week ending 2026-03-31.

---

## 1) Core Framework

### Runtime correctness: trajectory context initialization (AsyncLocalStorage)
A core runtime bug was fixed by ensuring trajectory `AsyncLocalStorage` is initialized **synchronously**, preventing missing/undefined trajectory context when actions execute early in the request lifecycle.

- PR: https://github.com/elizaos/eliza/pull/6687

**Why it matters:** if you rely on per-request/per-session context (tracing, tool telemetry, action attribution), async initialization can lead to context loss under concurrency, especially with streaming and parallel action execution.

---

### Build/CI ergonomics: avoid unnecessary file rewrites
A maintenance improvement reduces needless file rewrites during build steps, lowering churn in generated artifacts and improving incremental build performance.

- PR: https://github.com/elizaos/eliza/pull/6683

---

### Streaming internals: StreamChunkCallback consolidation + dependency cleanup
Work landed to consolidate `StreamChunkCallback` and remove `dual-extra`, simplifying the streaming plumbing and reducing dependency surface.

- PR: https://github.com/elizaos/eliza/pull/6690

**Developer impact:** if you have custom runtime hooks around streaming callbacks, re-check your integration against the updated callback contract/types after pulling this week’s changes.

---

## 2) New Features

### Wallet-related plugin proposal (OWS wallet)
A new feature proposal for an OWS wallet plugin was opened (documentation-level change this week).

- PR: https://github.com/elizaos/eliza/pull/6682

**Status:** proposal; expect follow-up implementation details (capabilities, signing flow, chain support, config schema) in subsequent PRs.

---

### “Agent Commerce” ecosystem momentum: x402 + Orbis API marketplace (Discord)
While not merged as a single core PR this week, developer discussion continued around **autonomous agent spend governance** using x402-style “pay-per-request” flows and policy facilitation (“Dreamline x402 Policy Facilitator” threads).

Key open technical questions raised:
- Spend governance patterns (machine policy checks vs explicit operator authorization)
- Whether operators get **pre-execution visibility** for paid fetches (event before spend vs first signal being wallet balance change)
- Target chain selection for an on-chain registry (affects token standards/oracles/policy enforcement primitives)
- Possible integration paths (MAXIA AIP Protocol vs escrow-like patterns)

Reference summary (discussion aggregation):
- https://elizaos.github.io/api/summaries/overall/day/2026-03-31.json

#### Orbis discovery endpoint (useful for agent-side service discovery)
Orbis surfaced an agent discovery endpoint returning the API catalog:
- https://orbisapi.com/api/agents/discovery

Example:
```bash
curl -s https://orbisapi.com/api/agents/discovery | jq .
```

#### x402-style client pattern (handling HTTP 402)
A common integration shape discussed is: attempt request → if `402 Payment Required`, trigger an automated payment flow → retry request.

```ts
// Pseudocode pattern (exact APIs depend on your x402/payment plugin wiring)
async function paidFetch(url: string, init?: RequestInit) {
  const res = await fetch(url, init);

  if (res.status !== 402) return res;

  const invoice = await res.json(); // e.g., contains amount, recipient, payment params
  await agent.wallet.pay(invoice);  // policy + preauth gating should happen here
  return fetch(url, init);          // retry after payment
}
```

---

## 3) Bug Fixes

### Critical supply-chain mitigation: axios compromise (Discord → plugin updates)
A critical security alert was raised about a supply-chain attack impacting `axios@1.14.1`, which pulls in a previously nonexistent dependency (`plain-crypto-js@4.2.1`) described as installer malware.

Discord alert context:
- https://discord.com/channels/1253563208833433701/1300025221834739744

#### Fix applied across plugins: pin axios to 1.7.8
Pinned `axios` to `1.7.8` in multiple plugin repos to mitigate the compromise (confirmed for `plugin-autocoder` and `plugin-coingecko`).

- Summary source: https://elizaos.github.io/api/summaries/overall/day/2026-03-31.json

**Recommended developer action (all ElizaOS-based projects):** explicitly pin/override axios to a known-good version and ensure lockfiles are updated.

```jsonc
// package.json (npm)
{
  "dependencies": {
    "axios": "1.7.8"
  },
  "overrides": {
    "axios": "1.7.8"
  }
}
```

```jsonc
// package.json (yarn)
{
  "resolutions": {
    "axios": "1.7.8"
  }
}
```

```bash
npm install
npm ls axios
```

**Operational note:** treat this as an incident response item—scan CI logs, rotate relevant credentials if you installed the compromised version, and review your dependency update automation policies.

---

### XML parsing robustness: standalone XML blocks
Improved parsing of standalone XML blocks (net large change including tests), addressing misparses that can break tool invocation, structured output decoding, or prompt-to-action bridging when XML is used as an interchange format.

- PR: https://github.com/elizaos/eliza/pull/6692

---

### Action schema cleanup: remove redundant action parameters
A refactor removed redundant action parameters, reducing ambiguity in action invocation and simplifying downstream tooling.

- PR: https://github.com/elizaos/eliza/pull/6684

---

## 4) API Changes

### Streaming callback surface changes (potential integration updates)
The `StreamChunkCallback` consolidation (and removal of `dual-extra`) can affect:
- custom streaming middlewares
- tool/action adapters that intercept chunk events
- tests that mock streaming callbacks

- PR: https://github.com/elizaos/eliza/pull/6690

**Migration tip:** search your codebase for `StreamChunkCallback` usage and revalidate types/signatures after updating.

---

## 5) Social Media Integrations

### No new social plugin merges recorded this week
No confirmed merges were captured in the provided activity for Twitter / Telegram / Discord / Farcaster plugins this week.

### Developer request: Instagram Story scraping
A request surfaced for an Instagram Story scraper capable of extracting @mentions and URLs (Apify tested, ~$0.30/story deemed too expensive).

- Discord thread: https://discord.com/channels/1253563208833433701/1300025221834739744

**Opportunity:** this is a strong candidate for a community plugin (e.g., `plugin-instagram-insights`) with clear cost/latency trade-offs and a constrained scope (story URL → extracted entities).

---

## 6) Model Provider Updates

### Claude Code Review action: model/version refresh
Configuration updates were merged to update the Claude Code Review action and its model version (tooling automation).

- PR: https://github.com/elizaos/eliza/pull/6681

**Developer impact:** if you rely on automated code review outputs for CI gating, rebaseline expectations (format, strictness, token usage) after pulling the updated model configuration.

---

## 7) Breaking Changes (V1 → V2)

### No explicit V1→V2 breaking-cutover PRs recorded in this week’s provided data
No single “hard break” migration PR was captured in the week’s summaries. However, **two areas may cause practical breakage** when updating:

1) **Streaming callback refactors** (see `StreamChunkCallback` consolidation)  
   - PR: https://github.com/elizaos/eliza/pull/6690

2) **Action parameter cleanup** (if you depended on removed/duplicative parameters)  
   - PR: https://github.com/elizaos/eliza/pull/6684

### Security-driven “breaking” dependency pin
If your plugin or app depended on newer axios behavior, pinning to `1.7.8` may surface compatibility issues—but the security posture takes priority.

---

## Relevant Plugin Registry Activity (GitHub)

Multiple plugin-addition PRs were opened in the registry this week (names/details vary by PR; review each entry for permissions, secrets, and chain interactions before deploying):

- `@zero-nium/plugin-project-substitute`: https://github.com/elizaos-plugins/registry/pull/319  
- New plugin addition: https://github.com/elizaos-plugins/registry/pull/322  
- New plugin addition: https://github.com/elizaos-plugins/registry/pull/323  
- New plugin addition: https://github.com/elizaos-plugins/registry/pull/324  

Also referenced in discussions: a new proposal for wallet reputation scoring + DeFi TVL verification submitted to the registry (see aggregated summary):
- https://elizaos.github.io/api/summaries/overall/day/2026-03-31.json