# ElizaOS Developer Update (2026-05-06 → 2026-05-12)

This update summarizes core runtime/framework changes, notable features, fixes, and integration work landing (or discussed) during the week.

---

## 1) Core Framework

### `@elizaos/vault`: secrets become a first-class runtime primitive
The biggest architecture shift this cycle is the introduction of a cross-platform secrets vault package and its wiring into the Settings UI + runtime operations:

- New workspace package: **`@elizaos/vault`** (AES-256-GCM at rest, OS keychain master key by default, headless passphrase fallback).
- Runtime “provider switch” operations now prefer **references** to secrets (`apiKeyRef`) instead of persisting plaintext keys.
- Plugin settings save flow now performs a **write-through mirror**: existing `config.env.*` persistence remains, but sensitive values are mirrored into the vault and can be revealed vault-first.

**PR:** `feat(vault): @elizaos/vault — cross-platform secrets vault + Settings UI integration`  
https://github.com/elizaos/eliza/pull/7197

**Headless Linux stability follow-up:** avoid native segfaults when libsecret/DBus isn’t available.  
**PR:** `fix(vault, confidant): skip OS keychain on headless Linux to prevent native segfault on agent boot`  
https://github.com/elizaos/eliza/pull/7230

#### Developer impact
- If you maintain plugins with sensitive params (API keys, bot tokens, private keys), the Settings UI’s credential selection logic is now broader (`*_TOKEN`, `*_SECRET`, `*_PRIVATE_KEY`, etc.) and will more reliably pick the “primary credential” field for vault mirroring.
- For self-hosted/headless deployments, ensure you configure a passphrase fallback if no OS keychain is present.

Example: headless vault master key fallback (environment-based)
```bash
export ELIZA_VAULT_PASSPHRASE="replace-with-long-random-passphrase"
# (Exact env var name may vary by branding; see packages/vault README in-repo.)
bun run dev
```

---

## 2) New Features

### Self-hosted runtime hardening: CORS + Bearer auth + cross-platform build fixes
Self-hosted deployments received a cohesive connectivity and packaging pass:
- CORS and bearer-auth support on the runtime API.
- Cross-platform build fixes spanning desktop/mobile targets.
- Plugin lifecycle improvements as part of the same integration.

**PR:** `feat(self-hosted): CORS + bearer auth + cross-platform build fixes`  
https://github.com/elizaos/eliza/pull/7212

Example: calling a self-hosted agent runtime with bearer auth
```bash
curl -H "Authorization: Bearer $ELIZA_BEARER_TOKEN" \
  https://your-runtime.example.com/api/health
```

---

### n8n automations: end-to-end clarification loop + UI affordances
The n8n workflow generator now supports a full “needs clarification → user resolves → generation continues” roundtrip:

- Host route now returns and accepts clarification payloads rather than dropping them.
- UI now renders clarifications with quick-pick buttons and supports free-form clarification answers.

Core routes + protocol:
- **PR:** `feat(n8n): clarification roundtrip route`  
  https://github.com/elizaos/eliza/pull/7316
- **PR:** `feat(automations): clarification quick-pick UI`  
  https://github.com/elizaos/eliza/pull/7341
- **PR:** `fix(automations): support free-form clarifications in resolve flow`  
  https://github.com/elizaos/eliza/pull/7370
- Generator tolerance improvement:
  - **PR:** `fix(n8n-workflow): tolerate prose-trailed JSON in parseWorkflowResponse`  
    https://github.com/elizaos/eliza/pull/7369
  - **PR:** `feat(n8n-workflow): structured ClarificationRequest + name->id prompt rules`  
    https://github.com/elizaos/eliza/pull/7373

Example: clarification roundtrip (conceptual)
```ts
// 1) Generate workflow
const gen = await fetch("/api/n8n/workflows/generate", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ prompt: "Post new GitHub issues into Discord #triage" }),
}).then(r => r.json());

if (gen.status === "needs_clarification") {
  // 2) Resolve clarification (quick-pick or free-form)
  const resolved = await fetch("/api/n8n/workflows/clarify", {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify({
      requestId: gen.requestId,
      answers: [
        // may be param-mapped OR free-form depending on the clarification
        { paramPath: "discord.channelId", value: "1234567890" },
        { message: "Use repo elizaos/eliza and label P1 only." },
      ],
    }),
  }).then(r => r.json());

  // 3) Continue / finalize workflow creation
  console.log(resolved.workflow);
}
```

---

### Connector Target Catalog (Discord): runtime-aware channel enumeration
A new service surfaces real Discord guilds/channels for downstream UX flows (notably n8n workflow clarification resolving “which channel?”).

**PR:** `feat(app-core): connector-target-catalog service (Discord)`  
https://github.com/elizaos/eliza/pull/7315

---

### Slack integration migrated into the monorepo
`@elizaos/plugin-slack` is now housed in-repo under `plugins/plugin-slack/` with actions/providers and an updated API surface compatible with the current core alpha.

**PR:** `feat(slack): migrate plugin-slack into the monorepo`  
https://github.com/elizaos/eliza/pull/7375

Key details for plugin authors:
- Core API drift fixes included:
  - `State.recentMessagesData` is now a broader union → plugin casts at read sites.
  - `MentionContext` shape expanded (`isReply`, `isThread`) → plugin fills defaults.

---

### Cloud: monetized container apps + app-scoped chat + managed domains
Cloud-side capabilities expanded substantially:
- App-scoped chat endpoint: `POST /api/v1/apps/:appId/chat`
- Managed domains lifecycle: check/buy/status/sync/verify
- Container deployment lifecycle improvements (monitor reconciliation)

**PR:** `feat(cloud): support monetized container app domains`  
https://github.com/elizaos/eliza/pull/7376

Note: automated review flagged several **P1 correctness/security** issues to verify in your deployments (auth error classification, domain “verified” sync semantics, credit reconciliation/refund edge cases). If you build on these endpoints, validate expected HTTP status codes and billing idempotency before production rollout.

---

## 3) Bug Fixes (critical/high-signal)

### Headless Linux crash on boot (native segfault) when keychain backend unavailable
Root cause: `@napi-rs/keyring` libsecret backend can segfault when no Secret Service is reachable (common on headless Linux servers). Fix: skip OS keychain path on headless Linux and use passphrase fallback.

- **PR:** https://github.com/elizaos/eliza/pull/7230

Why it matters: this was a **process-level crash** (not catchable JS), causing agents to die immediately on certain servers.

---

### Vault sentinel pollution in `process.env`
A runtime fix prevents vault “sentinel” values from being applied into `process.env` during repeated config loads, avoiding subtle downstream provider misconfiguration.

- **PR:** `fix(agent): skip vault sentinels in applyConfigEnvToProcessEnv`  
  https://github.com/elizaos/eliza/pull/7368

---

### Automations trigger deletion correctness
Fixed a UI bug where deletion used the wrong trigger identifier, leading to confusing confirmation/behavior mismatches.

- **PR:** `fix(automations): pass triggerName to onDeleteTrigger from detail pane`  
  https://github.com/elizaos/eliza/pull/7340

---

### Cloud auth stability: SIWE availability + correct domain resolution
- SIWE endpoints were returning 503 when cache was disabled; fix bypassed an unavailable cache singleton.
- Follow-up fixed Worker env usage so SIWE domain/host is correct in staging/prod.

- **PR:** `fix(cloud/auth): unblock SIWE by bypassing the disabled cache singleton`  
  https://github.com/elizaos/eliza/pull/7324
- **PR:** `fix(cloud/auth): pass c.env to getAppHost/getAppUrl on Worker (SIWE domain)`  
  https://github.com/elizaos/eliza/pull/7327

---

### Discord community signal: potential security concern (unconfirmed)
A brief Discord question asked whether “something had been compromised” (no supporting details were provided). Treat this as a reminder to:
- rotate connector tokens if you suspect exposure,
- prefer vault-backed secrets rather than plaintext config values,
- use least-privilege bot permissions.

(Discord log reference: `#coders`, 2026-05-10)

---

## 4) API Changes (developer-facing)

### Secrets + plugin settings APIs (vault integration)
Changes landed with the vault integration that affect how secrets are saved and revealed:

- `PUT /api/plugins/:id` now mirrors sensitive values into the vault (in addition to legacy storage).
- `POST /api/plugins/:id/reveal` now attempts **vault-first reveal** then falls back to legacy env/config.

**PR:** https://github.com/elizaos/eliza/pull/7197

Practical guidance:
- If you have custom tooling that reads secrets from `config.env`, keep it working for now, but start migrating to “secret references” where supported.

---

### Provider switching now prefers `apiKeyRef` (reference) over plaintext `apiKey`
Provider switch operations are migrated on hydrate; legacy ops are upgraded in-place.

**PR:** https://github.com/elizaos/eliza/pull/7197

Conceptual example
```ts
// Old (plaintext)
{
  providerId: "openai",
  apiKey: "sk-..."
}

// New (reference)
{
  providerId: "openai",
  apiKeyRef: "vault:OPENAI_API_KEY#default"
}
```

---

### Cloud app-scoped chat endpoint
If you build Cloud apps, note the new endpoint shape:

- `POST /api/v1/apps/:appId/chat`

**PR:** https://github.com/elizaos/eliza/pull/7376

Validate:
- auth error status codes (401/403 vs 500),
- credit reservation/reconciliation behavior for streaming and non-streaming responses.

---

## 5) Social Media Integrations (Twitter/Telegram/Discord/Farcaster/Slack)

### Telegram: historical reliability issues and mitigation
Recent upstream work (from the May 3–9 weekly summary) indicates Telegram polling races and bot-token bridging were addressed. If you maintain Telegram deployments, ensure only **one poller** consumes updates for a given bot token (Telegram `getUpdates` delivers each update to exactly one consumer).

Related issue context:
- Telegram dual-poller silent message loss: https://github.com/elizaos/eliza/issues/7245 (closed)

---

### Discord: better connector context for automations
The new Discord connector target catalog service (guild/channel enumeration) improves workflow generation and clarification UX.

- **PR:** https://github.com/elizaos/eliza/pull/7315

---

### Slack: now first-class in the monorepo
Slack plugin migration consolidates connector development and testing in the main repo.

- **PR:** https://github.com/elizaos/eliza/pull/7375

Recommended follow-up for Slack deployers:
- Add defensive handling around Slack API lookups (e.g., `users.info`) to avoid dropped events on transient Slack API errors (this was highlighted by automated review on the migration PR).

---

### Discord discussion: multi-agent orchestrator sandbox test request
A community developer requested permission to test a **Python-based multi-agent orchestrator** built with `claude-agent-sdk`, featuring:
- A2A-protocol read-only research agent
- Tools: Tavily, DuckDuckGo, fetch, arXiv via MCP
- Sandbox constraints: read-only, no DMs, responds only to @mentions

Moderator `odilitime` indicated they can handle OAuth invite/whitelist setup via DM.  
(Discord log reference: `#coders`, 2026-05-11)

If you are planning similar experiments, align with:
- sandboxed permissions,
- explicit tool allowlists,
- rate limiting to control operational costs (Twitter bot operators reported costs dropping from ~$100/mo to ~$10/mo depending on reply volume and configuration; Discord log reference: `#coders`, 2026-05-10).

---

## 6) Model Provider Updates (OpenAI/Anthropic/DeepSeek/etc.)

### Anthropic SDK bump
The TypeScript workspace updated Anthropic’s SDK dependency.

- **PR:** `fix(deps): update dependency @anthropic-ai/sdk to ^0.92.0`  
  https://github.com/elizaos/eliza/pull/7218

### AI SDK dependency churn (provider utils / OpenAI adapter)
Several Renovate-driven updates landed for `ai`, `@ai-sdk/provider`, `@ai-sdk/provider-utils`, and `@ai-sdk/openai` (multiple PRs: #7214–#7229 range). If you author provider plugins, ensure your adapter implementations are pinned to compatible versions across the workspace to avoid resolver pathologies.

---

## 7) Breaking Changes / V1 → V2 Migration Warnings

### Monorepo consolidation: “cloud and plugins in-repo; remove rust and python”
A large restructuring PR landed that can affect downstream forks and tooling assumptions (paths, workspace layout, CI expectations, and language subprojects).

- **PR:** `chore: add cloud and plugins, remove rust and python`  
  https://github.com/elizaos/eliza/pull/7235

Potential breakpoints for developers:
- Any scripts referencing the old standalone plugin repos or expecting `rust/` or `python/` subtrees may fail.
- Workspace-wide dependency resolution can become sensitive to per-plugin TypeScript version skew (see follow-up fix: `plugin-video` TypeScript downgrade caused Bun resolver hangs and was reverted).

Relevant fix:
- **PR:** `fix(plugin-video): revert typescript downgrade that hangs bun resolver`  
  https://github.com/elizaos/eliza/pull/7346

### Template alignment: fullstack template now includes cloud-sdk workspace
If you generate projects from templates, note the fix ensuring the template includes the required Cloud SDK workspace.

- **PR:** `fix(elizaos): include cloud-sdk workspace in fullstack-app template`  
  https://github.com/elizaos/eliza/pull/7347

---

### Quick links
- Vault + Settings integration: https://github.com/elizaos/eliza/pull/7197  
- Headless Linux vault/keychain crash fix: https://github.com/elizaos/eliza/pull/7230  
- Self-hosted CORS/bearer auth: https://github.com/elizaos/eliza/pull/7212  
- n8n clarification roundtrip: https://github.com/elizaos/eliza/pull/7316  
- Slack plugin migration: https://github.com/elizaos/eliza/pull/7375  
- Cloud monetized domains + app chat: https://github.com/elizaos/eliza/pull/7376  
- Discord multi-agent orchestrator sandbox discussion (OAuth whitelist): https://discord.com/channels/1253563208833433701/1300025221834739744