fix: fix bootstrap cache memory leak and fix CI tests

.github/workflows/ci.yaml

@@ -7,14 +7,14 @@ concurrency:
 
 on:
   push:
-    branches: [main]
+    branches: [main, develop]
   pull_request:
-    branches: [main]
+    branches: [main, develop]
 jobs:
   # Test job
   test:
-    # Skip duplicate runs: run on push to main, or on pull_request events only
-    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref_name == 'main')
+    # Skip duplicate runs: run on push to main/develop, or on pull_request events only
+    if: github.event_name == 'pull_request' || (github.event_name == 'push' && contains(fromJson('["main", "develop"]'), github.ref_name))
     runs-on: ubuntu-latest
     timeout-minutes: 20
     env:
@@ -33,6 +33,9 @@ jobs:
       - name: Install dependencies
         run: bun install
 
+      - name: Build packages
+        run: bun run build
+
       - name: Create test env file
         run: |
           echo "TEST_DATABASE_CLIENT=pglite" > packages/core/.env.test
@@ -46,8 +49,8 @@ jobs:
 
   # Lint and format job
   lint-and-format:
-    # Skip duplicate runs: run on push to main, or on pull_request events only
-    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref_name == 'main')
+    # Skip duplicate runs: run on push to main/develop, or on pull_request events only
+    if: github.event_name == 'pull_request' || (github.event_name == 'push' && contains(fromJson('["main", "develop"]'), github.ref_name))
     runs-on: ubuntu-latest
     timeout-minutes: 5
     env:
@@ -72,8 +75,8 @@ jobs:
 
   # Build job
   build:
-    # Skip duplicate runs: run on push to main, or on pull_request events only
-    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref_name == 'main')
+    # Skip duplicate runs: run on push to main/develop, or on pull_request events only
+    if: github.event_name == 'pull_request' || (github.event_name == 'push' && contains(fromJson('["main", "develop"]'), github.ref_name))
     runs-on: ubuntu-latest
     timeout-minutes: 8
     env:

.github/workflows/claude-security-review.yml

@@ -25,11 +25,13 @@ concurrency:
 
 jobs:
   security:
-    # Skip for draft PRs, [skip-security] in title, or bot-triggered
+    # Skip for draft PRs or [skip-security] in title.
+    # NOTE: We intentionally do NOT exclude cursor[bot] or other bot actors.
+    # Development is done via Cursor, so bot-triggered pushes are normal
+    # workflow and still need security review.
     if: |
       github.event.pull_request.draft != true &&
-      !contains(github.event.pull_request.title, '[skip-security]') &&
-      github.actor != 'cursor[bot]'
+      !contains(github.event.pull_request.title, '[skip-security]')
 
     runs-on: ubuntu-latest
     permissions:

.github/workflows/cli-tests.yml

@@ -71,6 +71,13 @@ jobs:
       - name: Build all packages
         run: bun run build
 
+      - name: Install cross-env globally (before linking, to avoid overwriting symlinks)
+        run: bun install -g cross-env
+
+      - name: Install BATS on macOS
+        if: matrix.os == 'macos-latest'
+        run: bun install -g bats
+
       - name: Link packages globally
         run: |
           # Link core package first (everything depends on it)
@@ -101,18 +108,69 @@ jobs:
           which elizaos || echo "elizaos not found in PATH"
           elizaos --version || echo "Failed to run elizaos --version"
 
-      - name: Verify CLI build artifacts
+      - name: Ensure node_modules/.bin/elizaos symlink exists
+        shell: bash
+        run: |
+          # bun install can't create bin symlinks for workspace packages when
+          # dist/ doesn't exist yet.  After building, we need to ensure the
+          # symlink exists so tests use the LOCAL binary rather than the global
+          # one from bun link (which may resolve __dirname differently).
+          if [ ! -f node_modules/.bin/elizaos ]; then
+            echo "Creating node_modules/.bin/elizaos symlink..."
+            mkdir -p node_modules/.bin
+            if [ "$RUNNER_OS" = "Windows" ]; then
+              # On Windows, create a cmd wrapper
+              echo '#!/usr/bin/env bun' > node_modules/.bin/elizaos
+              echo '"$(dirname "$0")/../../packages/cli/dist/index.js" "$@"' >> node_modules/.bin/elizaos
+            else
+              ln -sf ../../packages/cli/dist/index.js node_modules/.bin/elizaos
+            fi
+            chmod +x node_modules/.bin/elizaos 2>/dev/null || true
+            echo "✓ Created symlink"
+          else
+            echo "✓ Symlink already exists"
+          fi
+          ls -la node_modules/.bin/elizaos 2>/dev/null || true
+          readlink -f node_modules/.bin/elizaos 2>/dev/null || true
+
+      - name: Verify CLI build artifacts and templates
         shell: bash
         run: |
-          echo "Checking CLI build artifacts..."
-          echo "CLI dist contents:"
-          ls -la packages/cli/dist/ || echo "ERROR: No dist directory"
+          echo "=== CLI BUILD ARTIFACTS ==="
+          test -f packages/cli/dist/index.js && echo "✓ CLI index.js exists" || echo "ERROR: CLI index.js missing"
           echo ""
-          echo "CLI templates in dist:"
-          ls -la packages/cli/dist/templates/ || echo "ERROR: No templates in dist"
+
+          echo "=== TEMPLATE SOURCE (packages/project-starter/) ==="
+          ls -la packages/project-starter/.gitignore 2>/dev/null && echo "✓ SOURCE .gitignore exists" || echo "✗ SOURCE .gitignore MISSING"
+          ls -la packages/project-starter/.npmignore 2>/dev/null && echo "✓ SOURCE .npmignore exists" || echo "✗ SOURCE .npmignore MISSING"
+          echo ""
+
+          echo "=== BUILD-COPIED TEMPLATE (packages/cli/templates/project-starter/) ==="
+          ls -la packages/cli/templates/project-starter/.gitignore 2>/dev/null && echo "✓ BUILD-COPY .gitignore exists" || echo "✗ BUILD-COPY .gitignore MISSING"
+          ls -la packages/cli/templates/project-starter/.npmignore 2>/dev/null && echo "✓ BUILD-COPY .npmignore exists" || echo "✗ BUILD-COPY .npmignore MISSING"
           echo ""
-          echo "CLI executable:"
-          test -f packages/cli/dist/index.js && echo "✓ CLI index.js exists" || echo "ERROR: CLI index.js missing"
+
+          echo "=== DIST TEMPLATE (packages/cli/dist/templates/project-starter/) ==="
+          ls -la packages/cli/dist/templates/project-starter/.gitignore 2>/dev/null && echo "✓ DIST .gitignore exists" || echo "✗ DIST .gitignore MISSING"
+          ls -la packages/cli/dist/templates/project-starter/.npmignore 2>/dev/null && echo "✓ DIST .npmignore exists" || echo "✗ DIST .npmignore MISSING"
+          echo ""
+
+          echo "=== MONOREPO BIN SYMLINK ==="
+          ls -la node_modules/.bin/elizaos 2>/dev/null && echo "✓ node_modules/.bin/elizaos exists" || echo "⚠ node_modules/.bin/elizaos missing"
+          readlink -f node_modules/.bin/elizaos 2>/dev/null || true
+          echo ""
+
+          echo "=== GLOBAL BIN ==="
+          which elizaos 2>/dev/null && echo "✓ global elizaos: $(which elizaos)" || echo "⚠ no global elizaos"
+          readlink -f "$(which elizaos 2>/dev/null)" 2>/dev/null || true
+          echo ""
+
+          echo "=== BINARY VERIFICATION (grep for copy-template-diag marker) ==="
+          strings packages/cli/dist/index.js 2>/dev/null | grep -c "copy-template-diag" || echo "0 diag markers found in binary"
+          echo ""
+
+          echo "=== BINARY VERIFICATION (grep for COPY-TPL stderr marker) ==="
+          strings packages/cli/dist/index.js 2>/dev/null | grep -c "COPY-TPL" || echo "0 COPY-TPL markers found in binary"
 
       - name: Clean eliza projects cache
         shell: bash
@@ -124,13 +182,6 @@ jobs:
           echo "OPENAI_API_KEY=$OPENAI_API_KEY" > .env
           echo "LOG_LEVEL=info" >> .env
 
-      - name: Install cross-env globally
-        run: bun install -g cross-env
-
-      - name: Install BATS on macOS
-        if: matrix.os == 'macos-latest'
-        run: bun install -g bats
-
       - name: Run CLI TypeScript tests
         run: cross-env bun test tests/commands/
         working-directory: packages/cli

.github/workflows/core-package-tests.yaml

@@ -8,13 +8,15 @@ concurrency:
 on:
   push:
     branches:
-      - '*'
+      - main
+      - develop
     paths:
       - 'packages/**'
       - '.github/workflows/core-package-tests.yaml'
   pull_request:
     branches:
-      - '*'
+      - main
+      - develop
     paths:
       - 'packages/**'
       - '.github/workflows/core-package-tests.yaml'
@@ -29,8 +31,6 @@ env:
 jobs:
   # Validation job
   validate:
-    # Skip duplicate runs: run on push to main/develop, or on pull_request events only
-    if: github.event_name == 'pull_request' || (github.event_name == 'push' && contains(fromJson('["main", "develop"]'), github.ref_name))
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
@@ -86,8 +86,6 @@ jobs:
   # - Plugin/Project starters: no real tests, just templates
   # - SQL plugin: excluded in main package.json
   core-tests:
-    # Skip duplicate runs: run on push to main/develop, or on pull_request events only
-    if: github.event_name == 'pull_request' || (github.event_name == 'push' && contains(fromJson('["main", "develop"]'), github.ref_name))
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
@@ -145,6 +143,15 @@ jobs:
 
           # Track if any tests fail
           TESTS_FAILED=0
+          MAX_RETRIES=2  # Retry up to 2 times on Bun runtime crashes
+
+          # Check if exit code indicates a Bun runtime crash (segfault, SIGILL, etc.)
+          is_bun_crash() {
+            case $1 in
+              132|134|136|139|137) return 0 ;;  # SIGILL, SIGABRT, SIGFPE, SIGSEGV, SIGKILL
+              *) return 1 ;;
+            esac
+          }
 
           # Run tests in each package that has them (excluding CLI and client)
           # These packages are tested together because they:
@@ -159,7 +166,33 @@ jobs:
 
             cd "packages/$package"
 
-            if bun run test --timeout 60000; then
+            attempt=1
+            pkg_passed=false
+            while [ $attempt -le $((MAX_RETRIES + 1)) ]; do
+              set +e
+              bun run test --timeout 60000
+              exit_code=$?
+              set -e
+
+              if [ $exit_code -eq 0 ]; then
+                pkg_passed=true
+                break
+              elif is_bun_crash $exit_code; then
+                if [ $attempt -le $MAX_RETRIES ]; then
+                  echo ""
+                  echo "⚠️  Bun runtime crash (exit $exit_code) in $package — retrying ($((attempt + 1))/$((MAX_RETRIES + 1)))..."
+                  sleep 3
+                  ((attempt++))
+                else
+                  echo "⚠️  Bun crashed $((MAX_RETRIES + 1)) times in $package"
+                  break
+                fi
+              else
+                break  # Normal test failure, no retry
+              fi
+            done
+
+            if $pkg_passed; then
               echo "✅ Tests passed for $package"
             else
               echo "❌ Tests failed for $package"

.github/workflows/plugin-sql-tests.yaml

@@ -13,6 +13,9 @@ on:
 jobs:
   pglite:
     runs-on: ubuntu-latest
+    env:
+      # Use Node.js WASM runtime to avoid browser-style WASM init crashes in CI
+      PGLITE_WASM_MODE: node
     steps:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
@@ -26,6 +29,8 @@ jobs:
         run: bun install && bun run build
       - name: Tests
         working-directory: ./packages/plugin-sql
+        env:
+          PGLITE_WASM_MODE: node
         run: |
           bun run test:unit
           bun run test:integration
@@ -73,6 +78,8 @@ jobs:
   # This tests upgrading from older Eliza versions (1.6.x) to current
   e2e-upgrade:
     runs-on: ubuntu-latest
+    env:
+      PGLITE_WASM_MODE: node
     steps:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
@@ -86,4 +93,6 @@ jobs:
         run: bun install && bun run build
       - name: E2E Upgrade Test
         working-directory: ./packages/plugin-sql
+        env:
+          PGLITE_WASM_MODE: node
         run: bun run test:e2e:upgrade

packages/api-client/src/lib/base-client.ts

@@ -131,13 +131,20 @@ export abstract class BaseApiClient {
       // Handle error responses
       if (!response.ok) {
         // Try to extract error information from response
-        const errorData = jsonData as { error?: { code?: string; message?: string; details?: unknown } } | null;
+        const errorData = jsonData as {
+          error?: { code?: string; message?: string; details?: unknown };
+        } | null;
         const error = errorData?.error || {
           code: 'HTTP_ERROR',
           message: `HTTP ${response.status}: ${response.statusText}`,
         };
         const details = typeof error.details === 'string' ? error.details : undefined;
-        throw new ApiError(error.code || 'HTTP_ERROR', error.message || 'Unknown error', details, response.status);
+        throw new ApiError(
+          error.code || 'HTTP_ERROR',
+          error.message || 'Unknown error',
+          details,
+          response.status
+        );
       }
 
       // Handle successful responses
@@ -149,9 +156,9 @@ export abstract class BaseApiClient {
             'error' in apiResponse
               ? apiResponse.error
               : {
-                code: 'UNKNOWN_ERROR',
-                message: 'An unknown error occurred',
-              };
+                  code: 'UNKNOWN_ERROR',
+                  message: 'An unknown error occurred',
+                };
           throw new ApiError(error.code, error.message, error.details, response.status);
         }
         return apiResponse.data;

packages/api-client/src/services/audio.ts

@@ -94,7 +94,9 @@ export class AudioService extends BaseApiClient {
   /**
    * Convert audio input to appropriate FormData value
    */
-  private processAudioInput(audio: Blob | Buffer | ArrayBuffer | ArrayBufferView | string): Blob | string {
+  private processAudioInput(
+    audio: Blob | Buffer | ArrayBuffer | ArrayBufferView | string
+  ): Blob | string {
     if (audio instanceof Blob) {
       return audio;
     }

packages/cli/.gitignore

@@ -3,6 +3,12 @@ dist
 .turbo
 cache
 models
+
+# Regenerated at build time by src/scripts/copy-templates.ts from the monorepo
+# source packages (packages/project-starter, packages/plugin-starter, etc.).
+# The copy script explicitly verifies .gitignore/.npmignore are present because
+# fs-extra and Bun's fs.cp can silently drop them on some platforms.
+# See the header comments in src/scripts/copy-templates.ts for full context.
 templates/
 
 # Generated version file (created at build time)

packages/cli/src/commands/agent/actions/crud.ts

@@ -65,8 +65,6 @@ export async function getAgent(opts: OptionValues): Promise<void> {
       const { id, createdAt, updatedAt, enabled, ...agentConfig } = agent;
       console.log(JSON.stringify(agentConfig, null, 2));
     }
-
-    return;
   } catch (error) {
     await checkServer(opts);
     handleError(error);
@@ -96,7 +94,6 @@ export async function removeAgent(opts: OptionValues): Promise<void> {
     await agentsService.deleteAgent(agentId);
 
     console.log(`Successfully removed agent ${opts.name}`);
-    return;
   } catch (error) {
     await checkServer(opts);
     handleError(error);
@@ -126,7 +123,6 @@ export async function clearAgentMemories(opts: OptionValues): Promise<void> {
     const result = await memoryService.clearAgentMemories(agentId);
 
     console.log(`Successfully cleared ${result?.deleted || 0} memories for agent ${opts.name}`);
-    return;
   } catch (error) {
     await checkServer(opts);
     handleError(error);

packages/cli/src/commands/agent/utils/display.ts

@@ -27,8 +27,6 @@ export async function listAgents(opts: OptionValues): Promise<void> {
         console.table(agentData);
       }
     }
-
-    return;
   } catch (error) {
     await checkServer(opts);
     handleError(error);