fix: encryption for character secrets in correct order

[standujar]

No description provided.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/secrets

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[Copilot]

Pull request overview

This pull request fixes a critical security bug where environment variables merged into character secrets were not being encrypted. The fix ensures that secrets are encrypted in the correct order: first merge environment variables, then encrypt all secrets.

Key Changes

• Encryption order corrected: Secrets are now encrypted AFTER environment variables are merged, ensuring all sensitive data (including env vars) is properly encrypted
• Support for root-level secrets: Added encryption handling for character.secrets in addition to character.settings.secrets
• Removed premature encryption: Removed the encryptedCharacter() wrapper call in server/index.ts that was encrypting secrets before env var merging

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
packages/server/src/index.ts	Removed premature encryptedCharacter() call and import, allowing encryption to happen at the correct time in elizaos.ts
packages/server/src/api/agents/crud.ts	Added encryption for both character.secrets and character.settings.secrets in POST and PATCH handlers; moved salt declaration outside conditional blocks for reuse
packages/core/src/elizaos.ts	Added encryption logic after environment variable merging in addAgents() to ensure all secrets including env vars are encrypted
packages/core/src/__tests__/elizaos.test.ts	Added comprehensive test suite covering encryption of settings.secrets, root-level secrets, edge cases, and encryption format validation

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[claude]

Claude finished @standujar's task —— View job

---

PR Review: Encryption for Character Secrets

Todo List:

• Read and analyze all changed files
• Check for security issues (hardcoded keys, SQL injection, XSS)
• Verify test coverage and quality
• Check TypeScript compliance and imports
• Look for architectural issues and breaking changes
• Provide actionable review feedback

---

Code Review Summary

This PR implements encryption for character secrets at multiple levels (root and settings.secrets) with comprehensive test coverage and proper TypeScript handling.

✅ PASSED: Test coverage is excellent with 209 new tests covering all encryption scenarios
✅ PASSED: Uses bun:test correctly (not jest/vitest)
✅ PASSED: TypeScript compliance - proper types and imports
✅ PASSED: Security - no hardcoded secrets, proper encryption implementation
✅ PASSED: Architecture follows existing patterns and ElizaOS conventions

💡 SUGGESTION: TypeScript strictness → Consider: Remove type assertions in server/index.ts:273-290 for better type safety

The implementation is solid and follows project conventions. The encryption logic properly handles both character.secrets and character.settings.secrets locations, with comprehensive tests validating the functionality.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.