Merge remote-tracking branch 'origin/develop' into fix/pr-7714-7715-review-issues

# Conflicts:
#	packages/app/tsconfig.typecheck.json
#	packages/cloud-api/src/_router.generated.ts
#	packages/cloud-routing/package.json
#	packages/elizaos/templates-manifest.json
#	packages/ui/src/state/useOnboardingCallbacks.ts
#	plugins/plugin-local-inference/native/llama.cpp
#	plugins/plugin-openai/utils/config.ts

Author: Shaw

.github/workflows/cloud-deploy-backend.yml

@@ -76,12 +76,12 @@ jobs:
         run: |
           for attempt in 1 2 3; do
             if [ "$attempt" -eq 3 ]; then
-              bun install --no-save --verbose && git diff --exit-code -- bun.lock && exit 0
+              bun install --frozen-lockfile --ignore-scripts --verbose && exit 0
             else
-              bun install --no-save && git diff --exit-code -- bun.lock && exit 0
+              bun install --frozen-lockfile --ignore-scripts && exit 0
             fi
 
-            echo "bun install attempt $attempt failed or changed bun.lock; retrying in 10s..."
+            echo "bun install attempt $attempt failed; retrying in 10s..."
             sleep 10
           done
 
@@ -148,12 +148,12 @@ jobs:
         run: |
           for attempt in 1 2 3; do
             if [ "$attempt" -eq 3 ]; then
-              bun install --no-save --verbose && git diff --exit-code -- bun.lock && exit 0
+              bun install --frozen-lockfile --ignore-scripts --verbose && exit 0
             else
-              bun install --no-save && git diff --exit-code -- bun.lock && exit 0
+              bun install --frozen-lockfile --ignore-scripts && exit 0
             fi
 
-            echo "bun install attempt $attempt failed or changed bun.lock; retrying in 10s..."
+            echo "bun install attempt $attempt failed; retrying in 10s..."
             sleep 10
           done
 
@@ -294,7 +294,7 @@ jobs:
               export PATH="$BUN_INSTALL/bin:$PATH"
             fi
             for attempt in 1 2 3; do
-              if bun install --frozen-lockfile; then
+              if bun install --frozen-lockfile --ignore-scripts; then
                 break
               fi
 

.github/workflows/deploy-eliza-provisioning-worker.yml

@@ -87,7 +87,13 @@ jobs:
             rm -f .git/index.lock
 
             # Discard local drift, preserve env files.
-            git clean -fdx -e .env -e .env.local -e .env.* -e node_modules || true
+            git clean -fdx \
+              -e .env \
+              -e .env.local \
+              -e .env.* \
+              -e cloud/.env.local \
+              -e cloud/.env.* \
+              -e node_modules || true
             git checkout -- . 2>/dev/null || true
 
             # bun.lock became tracked at 4ae092dcda; the host's previous deploy
@@ -120,31 +126,20 @@ jobs:
               export PATH="$BUN_INSTALL/bin:$PATH"
             fi
 
-            # cloud/ is a separate bun project (not a sub-workspace of the
-            # outer monorepo, whose `workspaces` is `packages/*`). Install from
-            # /opt/eliza/cloud so the worker's deps end up in cloud/node_modules.
-            #
-            # No --frozen-lockfile: cloud/bun.lock currently has a duplicate
-            # package path for @elizaos/plugin-workflow (workspace + registry
-            # entries for the same name) that bun rejects under frozen mode.
-            # Cloud-CF deploys hit the same upstream bug; until the lockfile is
-            # cleaned at source, allow bun to recompute the deps tree.
-            cd /opt/eliza/cloud
+            cd /opt/eliza
             for attempt in 1 2 3; do
-              if bun install; then
+              if bun install --frozen-lockfile --ignore-scripts; then
                 break
               fi
               if [ "$attempt" -eq 3 ]; then exit 1; fi
               echo "bun install attempt $attempt failed; retrying in 10s..."
               sleep 10
             done
-            cd /opt/eliza
 
             # The daemons run under Node/tsx rather than Bun. Node resolves
             # linked workspace packages through their built `node` exports, so
             # refresh linked package dist files after installing dependencies.
-            bun run --cwd cloud build:linked-core
-            bun run --cwd cloud build:linked-billing
+            bun run build:core
             mkdir -p plugins/plugin-sql/node_modules/@elizaos
             rm -rf plugins/plugin-sql/node_modules/@elizaos/core
             ln -s ../../../../packages/core plugins/plugin-sql/node_modules/@elizaos/core

.github/workflows/release-electrobun.yml

@@ -179,46 +179,6 @@ jobs:
         with:
           submodules: recursive
 
-      - name: Validate public desktop signing inputs
-        env:
-          BUILD_ENV: ${{ needs.prepare.outputs.env }}
-          PUBLISH_RELEASE: ${{ inputs.publish_release || github.event_name == 'push' }}
-          PLATFORM_OS: ${{ matrix.platform.os }}
-          CSC_LINK: ${{ secrets.CSC_LINK }}
-          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          WINDOWS_SIGN_CERT_BASE64: ${{ secrets.WINDOWS_SIGN_CERT_BASE64 }}
-          WINDOWS_SIGN_CERT_PASSWORD: ${{ secrets.WINDOWS_SIGN_CERT_PASSWORD }}
-          WINDOWS_SIGN_TIMESTAMP_URL: ${{ secrets.WINDOWS_SIGN_TIMESTAMP_URL }}
-        run: |
-          if [[ "$PUBLISH_RELEASE" != "true" && "$BUILD_ENV" != "stable" ]]; then
-            echo "Non-published canary build; signing inputs are advisory."
-            exit 0
-          fi
-
-          missing=()
-          case "$PLATFORM_OS" in
-            macos)
-              [[ -z "$CSC_LINK" ]] && missing+=("CSC_LINK")
-              [[ -z "$CSC_KEY_PASSWORD" ]] && missing+=("CSC_KEY_PASSWORD")
-              [[ -z "$APPLE_ID" ]] && missing+=("APPLE_ID")
-              [[ -z "$APPLE_APP_SPECIFIC_PASSWORD" ]] && missing+=("APPLE_APP_SPECIFIC_PASSWORD")
-              [[ -z "$APPLE_TEAM_ID" ]] && missing+=("APPLE_TEAM_ID")
-              ;;
-            windows)
-              [[ -z "$WINDOWS_SIGN_CERT_BASE64" ]] && missing+=("WINDOWS_SIGN_CERT_BASE64")
-              [[ -z "$WINDOWS_SIGN_CERT_PASSWORD" ]] && missing+=("WINDOWS_SIGN_CERT_PASSWORD")
-              [[ -z "$WINDOWS_SIGN_TIMESTAMP_URL" ]] && missing+=("WINDOWS_SIGN_TIMESTAMP_URL")
-              ;;
-          esac
-
-          if [[ ${#missing[@]} -gt 0 ]]; then
-            echo "::error::Missing public desktop signing inputs for $PLATFORM_OS: ${missing[*]}"
-            exit 1
-          fi
-
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
@@ -415,6 +375,46 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Validate public desktop signing inputs
+        env:
+          BUILD_ENV: ${{ needs.prepare.outputs.env }}
+          PUBLISH_RELEASE: ${{ inputs.publish_release || github.event_name == 'push' }}
+          PLATFORM_OS: ${{ matrix.platform.os }}
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          WINDOWS_SIGN_CERT_BASE64: ${{ secrets.WINDOWS_SIGN_CERT_BASE64 }}
+          WINDOWS_SIGN_CERT_PASSWORD: ${{ secrets.WINDOWS_SIGN_CERT_PASSWORD }}
+          WINDOWS_SIGN_TIMESTAMP_URL: ${{ secrets.WINDOWS_SIGN_TIMESTAMP_URL }}
+        run: |
+          if [[ "$PUBLISH_RELEASE" != "true" && "$BUILD_ENV" != "stable" ]]; then
+            echo "Non-published canary build; signing inputs are advisory."
+            exit 0
+          fi
+
+          missing=()
+          case "$PLATFORM_OS" in
+            macos)
+              [[ -z "$CSC_LINK" ]] && missing+=("CSC_LINK")
+              [[ -z "$CSC_KEY_PASSWORD" ]] && missing+=("CSC_KEY_PASSWORD")
+              [[ -z "$APPLE_ID" ]] && missing+=("APPLE_ID")
+              [[ -z "$APPLE_APP_SPECIFIC_PASSWORD" ]] && missing+=("APPLE_APP_SPECIFIC_PASSWORD")
+              [[ -z "$APPLE_TEAM_ID" ]] && missing+=("APPLE_TEAM_ID")
+              ;;
+            windows)
+              [[ -z "$WINDOWS_SIGN_CERT_BASE64" ]] && missing+=("WINDOWS_SIGN_CERT_BASE64")
+              [[ -z "$WINDOWS_SIGN_CERT_PASSWORD" ]] && missing+=("WINDOWS_SIGN_CERT_PASSWORD")
+              [[ -z "$WINDOWS_SIGN_TIMESTAMP_URL" ]] && missing+=("WINDOWS_SIGN_TIMESTAMP_URL")
+              ;;
+          esac
+
+          if [[ ${#missing[@]} -gt 0 ]]; then
+            echo "::error::Missing public desktop signing inputs for $PLATFORM_OS: ${missing[*]}"
+            exit 1
+          fi
+
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:

biome.json

@@ -16,6 +16,8 @@
       "!**/build",
       "!**/.next",
       "!**/node_modules",
+      "!**/vendor",
+      "!**/vendor/**",
       "!**/public",
       "!packages/inference/llama.cpp",
       "!packages/inference/reports",

bun.lock

@@ -84,7 +84,7 @@
     "format": "turbo run format",
     "format:check": "turbo run format:check",
     "clean": "turbo run clean --concurrency=100% && rm -rf dist .turbo node_modules .turbo-tsconfig.json tsconfig.tsbuildinfo bun.lock* .eliza .elizadb && bun install && bun run build --concurrency=100%",
-    "build:core": "turbo run build --filter=@elizaos/contracts --filter=@elizaos/core --filter=@elizaos/shared --filter=@elizaos/cloud-sdk --filter=@elizaos/cloud-shared --filter=@elizaos/vault --filter=@elizaos/plugin-local-inference --filter=@elizaos/plugin-ollama --filter=@elizaos/plugin-commands --filter=@elizaos/plugin-shell --filter=@elizaos/plugin-coding-tools --filter=@elizaos/plugin-agent-orchestrator --filter=@elizaos/plugin-video --filter=@elizaos/plugin-background-runner --filter=@elizaos/plugin-mlx --filter=@elizaos/plugin-anthropic --filter=@elizaos/plugin-openai --filter=@elizaos/plugin-elizacloud --no-cache",
+    "build:core": "turbo run build --filter=@elizaos/contracts --filter=@elizaos/core --filter=@elizaos/shared --filter=@elizaos/cloud-sdk --filter=@elizaos/cloud-shared --filter=@elizaos/vault --filter=@elizaos/app-core --filter=@elizaos/plugin-local-inference --filter=@elizaos/plugin-ollama --filter=@elizaos/plugin-commands --filter=@elizaos/plugin-shell --filter=@elizaos/plugin-coding-tools --filter=@elizaos/plugin-agent-orchestrator --filter=@elizaos/plugin-app-manager --filter=@elizaos/plugin-wallet --filter=@elizaos/plugin-video --filter=@elizaos/plugin-background-runner --filter=@elizaos/plugin-mlx --filter=@elizaos/plugin-anthropic --filter=@elizaos/plugin-openai --filter=@elizaos/plugin-elizacloud --no-cache",
     "build:server": "turbo run build --filter=@elizaos/agent --no-cache",
     "lint": "turbo run lint && node packages/scripts/run-examples-benchmarks.mjs lint",
     "lint:check": "turbo run lint:check",

package.json

@@ -0,0 +1,125 @@
+import type {
+  IAgentRuntime,
+  Memory,
+  Plugin,
+  Provider,
+  State,
+} from "@elizaos/core";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const rolesMock = vi.hoisted(() => ({
+  checkSenderRole: vi.fn(),
+}));
+
+vi.mock("./roles.ts", () => rolesMock);
+
+import { applyPluginRoleGating } from "./plugin-role-gating.ts";
+
+const runtime = {
+  agentId: "11111111-1111-1111-1111-111111111111",
+} as IAgentRuntime;
+
+function message(metadata: Record<string, unknown> = {}): Memory {
+  return {
+    id: "22222222-2222-2222-2222-222222222222",
+    entityId: "33333333-3333-3333-3333-333333333333",
+    roomId: "44444444-4444-4444-4444-444444444444",
+    content: { text: "hi", source: "discord" },
+    metadata,
+  } as Memory;
+}
+
+function provider(name: string): Provider {
+  return {
+    name,
+    get: vi.fn(async () => ({ text: `${name}: visible` })),
+  } as unknown as Provider;
+}
+
+function pluginWithProviders(providers: Provider[]): Plugin {
+  return {
+    name: "test-plugin",
+    providers,
+  } as Plugin;
+}
+
+describe("applyPluginRoleGating", () => {
+  beforeEach(() => {
+    rolesMock.checkSenderRole.mockReset();
+  });
+
+  it("deduplicates concurrent provider role checks for the same message", async () => {
+    rolesMock.checkSenderRole.mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          setTimeout(() => {
+            resolve({ role: "ADMIN", isOwner: false, isAdmin: true });
+          }, 10);
+        }),
+    );
+    const providers = [provider("SECRETS_STATUS"), provider("MISSING_SECRETS")];
+    applyPluginRoleGating([pluginWithProviders(providers)]);
+
+    const results = await Promise.all(
+      providers.map((item) =>
+        item.get?.(runtime, message({ fromId: "discord-user-1" }), {} as State),
+      ),
+    );
+
+    expect(rolesMock.checkSenderRole).toHaveBeenCalledTimes(1);
+    expect(results.map((item) => item?.text)).toEqual([
+      "SECRETS_STATUS: visible",
+      "MISSING_SECRETS: visible",
+    ]);
+  });
+
+  it("does not reuse a resolved role decision across later turns", async () => {
+    rolesMock.checkSenderRole
+      .mockResolvedValueOnce({ role: "ADMIN", isOwner: false, isAdmin: true })
+      .mockResolvedValueOnce({ role: "GUEST", isOwner: false, isAdmin: false });
+    const gatedProvider = provider("SECRETS_STATUS");
+    applyPluginRoleGating([pluginWithProviders([gatedProvider])]);
+
+    await expect(
+      gatedProvider.get?.(
+        runtime,
+        message({ fromId: "discord-user-1" }),
+        {} as State,
+      ),
+    ).resolves.toMatchObject({ text: "SECRETS_STATUS: visible" });
+    await expect(
+      gatedProvider.get?.(
+        runtime,
+        message({ fromId: "discord-user-1" }),
+        {} as State,
+      ),
+    ).resolves.toMatchObject({ text: "" });
+
+    expect(rolesMock.checkSenderRole).toHaveBeenCalledTimes(2);
+  });
+
+  it("keeps concurrent role checks separate when live connector metadata differs", async () => {
+    rolesMock.checkSenderRole.mockResolvedValue({
+      role: "ADMIN",
+      isOwner: false,
+      isAdmin: true,
+    });
+    const gatedProvider = provider("SECRETS_STATUS");
+    applyPluginRoleGating([pluginWithProviders([gatedProvider])]);
+
+    await Promise.all([
+      gatedProvider.get?.(
+        runtime,
+        message({ fromId: "discord-user-1" }),
+        {} as State,
+      ),
+      gatedProvider.get?.(
+        runtime,
+        message({ fromId: "discord-user-2" }),
+        {} as State,
+      ),
+    ]);
+
+    expect(rolesMock.checkSenderRole).toHaveBeenCalledTimes(2);
+  });
+});