feat(electrobun): add first-party Satellites and dynamic views

[Dexploarer]

Why This Is Needed

Electrobun is already the right desktop shell for elizaOS, but the repo had several desktop/system capability paths growing in parallel: plugin-local filesystem access, command execution, local Git helpers, local-model control/status paths, Surface/dev tooling, runtime startup diagnostics, and emerging agent-created views. Leaving those paths duplicated creates permission drift, tracing gaps, inconsistent error handling, platform-specific bugs, and a package graph that becomes harder to review with every feature.

This PR creates the missing separation of responsibilities:

• Plugins keep semantic agent/runtime meaning.
• Satellites own desktop/system implementation.
• eliza.runtime brokers capability calls without taking runtime ownership away from AgentManager.
• Dynamic views become the contextual way agents show state and tools.
• Trace becomes the observability spine.
• Voice remains a streaming pipeline, not a settings panel.
• packages/ui renders shared components and generated UI, but does not execute capabilities.
• Startup/onboarding/database reliability stays in Electrobun core, where boot can be diagnosed before Satellites are available.

The practical reason this is needed now: without this convergence layer, every new plugin/app/desktop feature has to decide for itself how to read files, run commands, inspect Git, show tool state, trace behavior, expose voice/model status, and recover from startup failures. That makes the product harder to secure, harder to debug, and harder to keep portable across desktop, server, mobile, and web. This PR gives those features a shared host/broker/view/trace substrate while preserving the plugin system instead of flattening everything into Satellites.

Summary

This PR is the Electrobun platform convergence stack for first-party Satellites, dynamic views, trace/voice infrastructure, capability routing, Eliza GenUI, launch diagnostics, database boot policy, and the review-boundary build repairs needed after merging current origin/develop.

The core architecture remains:

• packages/app owns the production app UI.
• packages/ui is the shared rendering kit and must not execute desktop/system capabilities.
• packages/app-core/platforms/electrobun is the desktop shell, typed RPC bridge, AgentManager host, dynamic-view host, trace/voice host layer, launch/database diagnostics layer, and first-party Satellite seeder.
• Plugins remain semantic runtime extensions.
• Satellites execute desktop/system implementation capabilities.
• eliza.runtime brokers to Satellites and delegates runtime lifecycle to AgentManager in Electrobun host mode.

Major Changes

First-party Satellites and seeding

Adds bundled first-party Satellites under packages/app-core/platforms/electrobun/satellites/:

• eliza.runtime
• eliza.fs
• eliza.pty
• eliza.git
• eliza.local-model
• eliza.surface as dev/admin only

The seeding path validates manifests, installs/updates idempotently, preserves disabled state, and marks eliza.runtime as required while keeping capability Satellites recommended.

AgentManager-backed runtime broker

eliza.runtime does not own a second runtime process in Electrobun host mode. Runtime lifecycle/status/log calls delegate through the existing AgentManager path. Standalone runtime spawning remains only for Satellite-local smoke/dev mode.

The runtime broker surface routes capability requests to:

• eliza.fs for filesystem implementation
• eliza.pty for terminal/session/command implementation
• eliza.git for local Git implementation
• eliza.local-model for desktop local-model control/status

Typed worker command and event bridge

Adds renderer-safe worker bridge surfaces:

• carrotInvokeWorker
• carrotTailWorkerEvents

Worker events are captured in a bounded per-worker buffer with monotonic sequence cursors. This gives dynamic views and dev/admin views a typed path for command invocation and event tailing without direct Satellite calls.

Dynamic views

Adds host-side dynamic-view infrastructure under src/dynamic-views/:

• manifest and session types
• registry and session manager
• typed renderer RPC methods for register/list/open/push/close/sessions
• trusted worker host requests for dynamic-view lifecycle
• required-Satellite checks before opening views
• canvas/A2UI session open and event push path
• dev demo view agent.run.trace.demo

Dynamic views are contextual agent-created views. They are not a replacement for packages/app and are not new fixed production dashboards.

Trace and voice infrastructure

Adds trace as the observability spine and voice as a streaming/instrumented pipeline layer, including host services, trace integration, live adapter/latency primitives, and validation harness work. This PR does not add live voice/model-download test requirements.

Capability collapse and routing

Adds the convergence/collapse documentation and first routing slices for implementation-only paths. The rule is preserved:

• Plugins keep semantic meaning.
• Satellites own desktop/system implementation.
• Plugins route through a shared capability router/runtime broker rather than importing Electrobun internals or calling Satellites directly.

eliza.computer remains only a documented future candidate for browser/computer-use/screen/camera/canvas overlap.

Eliza GenUI and UI boundary work

Adds Eliza GenUI as an A2UI-compatible, Eliza-owned schema/rendering layer under packages/ui, rendered through the shared UI kit with controlled action routing. It does not replace packages/ui, does not execute arbitrary code, and does not call Satellites directly.

Also repairs packages/ui boundaries so UI no longer depends on @elizaos/app-core, which removes the Turbo circular package dependency involving UI, app-core, local inference, capacitor bridge, and agent packages.

Launch and database diagnostics

Adds launch/startup/onboarding diagnostic groundwork and database boot policy diagnostics as Electrobun/AgentManager boot infrastructure, not Satellites.

Database startup is made explicit around:

• POSTGRES_URL
• legacy DATABASE_URL mapping
• deterministic packaged-desktop PGlite path
• PGLITE_DATA_DIR
• database snapshot/recovery policy docs

Startup/onboarding remains core boot infrastructure. No startup/onboarding/database Satellite is added.

Coding Satellite sandbox runner

Adds a Bun-based coding Satellite image under packages/cloud-services/coding-satellite for Eliza Cloud and home-machine sandbox execution. This is needed because mobile and cloud sessions need a real remote execution target for coding work: the phone/app can stay TypeScript/runtime-portable while file, process, Git, Codex, Claude Code, and opencode execution happens inside an authenticated Bun Satellite runner on Eliza Cloud or the user's home machine.

This keeps the architecture simple:

• Eliza Cloud provisions the container.
• The container runs the same Satellite HTTP contract as a home machine.
• The agent router talks to the Satellite over bearer-authenticated HTTP.
• The Cloud API key is only used for provisioning; each container gets a generated Satellite token for runner calls.
• Vercel, Cloudflare, and Rivet sandbox providers remain documented/commented-out future options, not active routes in this PR.

The new image exposes guarded filesystem and process endpoints, ships with git/ripgrep/Python/SSH plus Codex, Claude Code, and opencode CLIs, and can be selected by setting ELIZA_CLOUD_CODING_SATELLITE_IMAGE. The runner rejects paths outside the workspace and rejects writes through symlinks.

Sandbox live smoke skips Eliza Cloud provisioning in non-strict mode until ELIZA_CLOUD_CODING_SATELLITE_IMAGE or a direct runner URL is configured; strict/manual Cloud runs still fail when the provider is unavailable.

CI follow-up for sandbox/mobile/server gates

After the first coding Satellite push, CI exposed three review-boundary issues that are now addressed in the branch:

• Sandbox live smoke now generates i18n keyword data before importing agent/core modules.
• Android mobile bundling now stubs the desktop/cloud sandbox router out of the mobile payload, keeping init_eliza synchronous.
• runtime/eliza.ts imports local-inference embedding presets through the package's exported @elizaos/plugin-local-inference/runtime subpath instead of a nested non-exported path.

Build and review-boundary repairs

After merging current origin/develop, this PR also includes build-boundary repairs:

• Removes @elizaos/ui -> @elizaos/app-core dependency edge.
• Removes the static @elizaos/plugin-capacitor-bridge -> @elizaos/agent package graph edge.
• Fixes iOS local-agent transport type export drift by making UI own its renderer-safe transport types.
• Updates onboarding/cloud-shell tests for the current upstream UI copy and selectors.
• Adds the benchmark dashboard workspace entry and tracked cn helper so the root build no longer fails on the metrics dashboard package.
• Suppresses the Electrobun app build's Rolldown plugin timing warning.

Static-analysis cleanup

The latest review pass reduces CodeFactor complexity in the high-churn sandbox and startup boundary files without changing behavior:

• entity creation recovery and runtime service startup in packages/agent/src/runtime/eliza.ts
• E2B Satellite HTTP test routing in packages/agent/src/services/e2b-capability-router.test.ts
• coding Satellite HTTP routing in packages/cloud-services/coding-satellite/src/index.ts
• onboarding runtime config assembly in packages/ui/src/onboarding/onboarding-config.ts
• cloud/home instance routing status rendering in packages/ui/src/components/settings/CloudInstancePanel.tsx

This keeps the PR easier to review and avoids letting the sandbox/mobile convergence work add another layer of hard-to-maintain branching logic.

What This PR Does Not Do

• Does not add Swift.
• Does not add a new production static UI panel.
• Does not replace packages/app.
• Does not make eliza.surface production UI.
• Does not collapse connector/provider/app plugins into Satellites.
• Does not add eliza.computer; it remains a future candidate only.
• Does not move startup, onboarding, or database ownership into Satellites.
• Does not make local model downloads or live voice tests part of default validation.

Validation

Local validation performed during this stack includes:

• bun run --cwd packages/ui typecheck
• bun run --cwd packages/ui test
• bun run --cwd packages/app typecheck
• bun run --cwd packages/app-core/platforms/electrobun typecheck
• bun run --cwd packages/app-core/platforms/electrobun test
• bun run --cwd packages/app-core/platforms/electrobun build
• bun run --cwd packages/electrobun-carrots typecheck
• bun run --cwd packages/electrobun-carrots test
• bun run --cwd plugins/plugin-capacitor-bridge typecheck
• bun run --cwd packages/benchmarks/skillsbench/experiments/metrics-dashboard build
• bun run --cwd packages/cloud-services/coding-satellite typecheck
• bun run --cwd packages/cloud-services/coding-satellite test
• bun run --cwd packages/cloud-shared typecheck
• bun test packages/cloud-shared/src/lib/services/coding-containers.test.ts
• bun run --cwd packages/agent typecheck
• bun run --cwd packages/agent build:mobile
• mobile bundle guard: init_eliza remains synchronous
• non-strict eliza-cloud smoke skip when no coding Satellite image/direct runner is configured
• bun run --cwd packages/agent test -- src/services/e2b-capability-router.test.ts --reporter verbose
• home Satellite live smoke: PASSED home: fs, pty, and git routes completed against live provider
• git diff --check

Docker image build was not run locally because this machine does not have the docker CLI installed; the runner package and local HTTP contract were validated directly with Bun and the live home Satellite smoke.

The branch has been merged with current origin/develop and pushed. GitHub reports the PR as mergeable; CI is running on the latest pushed head.

Review Focus

Please review this as a broad platform convergence PR. The most important review surfaces are:

• whether the responsibility split is correct: UI renders, plugins mean, Satellites execute, Electrobun hosts
• first-party Satellite seeding and trust boundaries
• AgentManager-backed eliza.runtime behavior
• typed worker command/event bridge semantics
• dynamic-view registry/session lifecycle
• trace/voice host integration boundaries
• capability-router facade-over-Satellite model
• packages/ui as rendering-only shared kit
• launch/database diagnostics staying in Electrobun core
• package graph cleanup and build gate repairs after current origin/develop

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1d1e9864-f41d-4354-90c7-bc8863a8bbf4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/phase-11-event-bridge-wip

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Dexploarer]

Phase 13 added trace host infrastructure on top of the dynamic view/event bridge:

• TraceStore / TraceService
• trusted trace host requests
• trace RPC methods
• dynamic agent.run.trace view
• runtime stream trace hooks
• capability broker trace hooks
• auto-open policy off by default

Next planned follow-up: eliza.voice mock/text-only pipeline + trace integration. No static UI panel, no Swift.