Skip to content

Commit

Permalink
feat: clean
Browse files Browse the repository at this point in the history
  • Loading branch information
ponderingdemocritus committed Nov 22, 2024
2 parents 6e05c0f + 7e8a627 commit 464377e
Show file tree
Hide file tree
Showing 10 changed files with 507 additions and 119 deletions.
97 changes: 51 additions & 46 deletions SECURITY.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,74 +17,79 @@ We take the security of Eliza seriously. If you believe you have found a securit

1. **DO NOT** create a public GitHub issue for the vulnerability
2. Send an email to security@eliza.builders with:
- A detailed description of the vulnerability
- Steps to reproduce the issue
- Potential impact of the vulnerability
- Any possible mitigations you've identified
- A detailed description of the vulnerability
- Steps to reproduce the issue
- Potential impact of the vulnerability
- Any possible mitigations you've identified

### What to Expect

- **Initial Response**: Within 48 hours, you will receive an acknowledgment of your report
- **Updates**: We will provide updates every 5 business days about the progress
- **Resolution Timeline**: We aim to resolve critical issues within 15 days
- **Disclosure**: We will coordinate with you on the public disclosure timing
- **Initial Response**: Within 48 hours, you will receive an acknowledgment of your report
- **Updates**: We will provide updates every 5 business days about the progress
- **Resolution Timeline**: We aim to resolve critical issues within 15 days
- **Disclosure**: We will coordinate with you on the public disclosure timing

## Security Best Practices

### For Contributors

1. **API Keys and Secrets**
- Never commit API keys, passwords, or other secrets to the repository
- Use environment variables as described in our secrets management guide
- Rotate any accidentally exposed credentials immediately

- Never commit API keys, passwords, or other secrets to the repository
- Use environment variables as described in our secrets management guide
- Rotate any accidentally exposed credentials immediately

2. **Dependencies**
- Keep all dependencies up to date
- Review security advisories for dependencies regularly
- Use `pnpm audit` to check for known vulnerabilities

- Keep all dependencies up to date
- Review security advisories for dependencies regularly
- Use `pnpm audit` to check for known vulnerabilities

3. **Code Review**
- All code changes must go through pull request review
- Security-sensitive changes require additional review
- Enable branch protection on main branches
- All code changes must go through pull request review
- Security-sensitive changes require additional review
- Enable branch protection on main branches

### For Users

1. **Environment Setup**
- Follow our [secrets management guide](docs/guides/secrets-management.md) for secure configuration
- Use separate API keys for development and production
- Regularly rotate credentials

- Follow our [secrets management guide](docs/guides/secrets-management.md) for secure configuration
- Use separate API keys for development and production
- Regularly rotate credentials

2. **Model Provider Security**
- Use appropriate rate limiting for API calls
- Monitor usage patterns for unusual activity
- Implement proper authentication for exposed endpoints

- Use appropriate rate limiting for API calls
- Monitor usage patterns for unusual activity
- Implement proper authentication for exposed endpoints

3. **Platform Integration**
- Use separate bot tokens for different environments
- Implement proper permission scoping for platform APIs
- Regular audit of platform access and permissions
- Use separate bot tokens for different environments
- Implement proper permission scoping for platform APIs
- Regular audit of platform access and permissions

## Security Features

### Current Implementation

- Environment variable based secrets management
- Type-safe API implementations
- Automated dependency updates via Renovate
- Continuous Integration security checks
- Environment variable based secrets management
- Type-safe API implementations
- Automated dependency updates via Renovate
- Continuous Integration security checks

### Planned Improvements

1. **Q4 2024**
- Automated security scanning in CI pipeline
- Enhanced rate limiting implementation
- Improved audit logging

- Automated security scanning in CI pipeline
- Enhanced rate limiting implementation
- Improved audit logging

2. **Q1 2025**
- Security-focused documentation improvements
- Enhanced platform permission management
- Automated vulnerability scanning
- Security-focused documentation improvements
- Enhanced platform permission management
- Automated vulnerability scanning

## Vulnerability Disclosure Policy

Expand All @@ -100,21 +105,21 @@ We follow a coordinated disclosure process:

We believe in recognizing security researchers who help improve our security. Contributors who report valid security issues will be:

- Credited in our security acknowledgments (unless they wish to remain anonymous)
- Added to our security hall of fame
- Considered for our bug bounty program (coming soon)
- Credited in our security acknowledgments (unless they wish to remain anonymous)
- Added to our security hall of fame
- Considered for our bug bounty program (coming soon)

## License Considerations

As an MIT licensed project, users should understand:

- The software is provided "as is"
- No warranty is provided
- Users are responsible for their own security implementations
- Contributors grant perpetual license to their contributions
- The software is provided "as is"
- No warranty is provided
- Users are responsible for their own security implementations
- Contributors grant perpetual license to their contributions

## Contact

- Security Issues: security@eliza.builders
- General Questions: Join our [Discord](https://discord.gg/ai16z)
- Updates: Follow our [security advisory page](https://github.com/ai16z/eliza/security/advisories)
- Security Issues: security@eliza.builders
- General Questions: Join our [Discord](https://discord.gg/ai16z)
- Updates: Follow our [security advisory page](https://github.com/ai16z/eliza/security/advisories)
11 changes: 2 additions & 9 deletions agent/src/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ import readline from "readline";
import yargs from "yargs";
import path from "path";
import { fileURLToPath } from "url";
import { character } from "./character.ts";
import blobert from "./blobert.ts";
import type { DirectClient } from "@ai16z/client-direct";

const __filename = fileURLToPath(import.meta.url); // get the resolved path to the file
Expand Down Expand Up @@ -258,13 +258,6 @@ export function createAgent(
});
}

function intializeFsCache(baseDir: string, character: Character) {
const cacheDir = path.resolve(baseDir, character.id, "cache");

const cache = new CacheManager(new FsCacheAdapter(cacheDir));
return cache;
}

function intializeDbCache(character: Character, db: IDatabaseCacheAdapter) {
const cache = new CacheManager(new DbCacheAdapter(db, character.id));
return cache;
Expand Down Expand Up @@ -312,7 +305,7 @@ const startAgents = async () => {

let charactersArg = args.characters || args.character;

let characters = [character];
let characters = [blobert];

if (charactersArg) {
characters = await loadCharacters(charactersArg);
Expand Down
3 changes: 2 additions & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,8 @@
"dependencies": {
"ollama-ai-provider": "^0.16.1",
"optional": "^0.1.4",
"sharp": "^0.33.5"
"sharp": "^0.33.5",
"tslog": "^4.9.3"
},
"packageManager": "pnpm@9.12.3+sha512.cce0f9de9c5a7c95bef944169cc5dfe8741abfb145078c0d508b868056848a87c81e626246cb60967cbd7fd29a6c062ef73ff840d96b3c86c40ac92cf4a813ee"
}
6 changes: 4 additions & 2 deletions packages/core/src/embedding.ts
Original file line number Diff line number Diff line change
Expand Up @@ -86,8 +86,10 @@ export async function embed(runtime: IAgentRuntime, input: string) {
// 3. Fallback to OpenAI embedding model
const embeddingModel = settings.USE_OPENAI_EMBEDDING
? "text-embedding-3-small"
: modelProvider.model?.[ModelClass.EMBEDDING] ||
models[ModelProviderName.OPENAI].model[ModelClass.EMBEDDING];
: runtime.character.modelProvider === ModelProviderName.OLLAMA
? settings.OLLAMA_EMBEDDING_MODEL || "mxbai-embed-large"
: modelProvider.model?.[ModelClass.EMBEDDING] ||
models[ModelProviderName.OPENAI].model[ModelClass.EMBEDDING];

if (!embeddingModel) {
throw new Error("No embedding model configured");
Expand Down
11 changes: 9 additions & 2 deletions packages/core/src/generation.ts
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,12 @@ export async function generateText({
return "";
}

elizaLogger.log("Genarating text...");
elizaLogger.log("Generating text...");

elizaLogger.info("Generating text with options:", {
modelProvider: runtime.modelProvider,
model: modelClass,
});

const provider = runtime.modelProvider;
const endpoint =
Expand All @@ -84,6 +89,8 @@ export async function generateText({
model = runtime.getSetting("LLAMACLOUD_MODEL_SMALL");
}

elizaLogger.info("Selected model:", model);

const temperature = models[provider].settings.temperature;
const frequency_penalty = models[provider].settings.frequency_penalty;
const presence_penalty = models[provider].settings.presence_penalty;
Expand Down Expand Up @@ -709,7 +716,7 @@ export async function generateMessageResponse({
let retryLength = 1000; // exponential backoff
while (true) {
try {
elizaLogger.log("Genarating message response..");
elizaLogger.log("Generating message response..");

const response = await generateText({
runtime,
Expand Down
45 changes: 34 additions & 11 deletions packages/core/src/logger.ts
Original file line number Diff line number Diff line change
@@ -1,4 +1,11 @@
class ElizaLogger {
import settings from "./settings.ts";
import { Logger } from "tslog";

interface IElizaLogger extends Logger<IElizaLogger> {
progress(message: string): void;
}

class ElizaLogger implements IElizaLogger {
constructor() {
// Check if we're in Node.js environment
this.isNode =
Expand All @@ -7,7 +14,7 @@ class ElizaLogger {
process.versions.node != null;

// Set verbose based on environment
this.verbose = this.isNode ? process.env.verbose === "true" : false;
this.verbose = this.isNode ? settings.VERBOSE === "true" : false;
}

private isNode: boolean;
Expand Down Expand Up @@ -173,6 +180,7 @@ class ElizaLogger {
}
}

// @ts-expect-error- custom implementation
log(...strings) {
this.#logWithStyle(strings, {
fg: "white",
Expand All @@ -182,6 +190,7 @@ class ElizaLogger {
});
}

// @ts-expect-error- custom implementation
warn(...strings) {
this.#logWithStyle(strings, {
fg: "yellow",
Expand All @@ -191,6 +200,7 @@ class ElizaLogger {
});
}

// @ts-expect-error- custom implementation
error(...strings) {
this.#logWithStyle(strings, {
fg: "red",
Expand All @@ -200,6 +210,7 @@ class ElizaLogger {
});
}

// @ts-expect-error- custom implementation
info(...strings) {
this.#logWithStyle(strings, {
fg: "blue",
Expand All @@ -209,15 +220,7 @@ class ElizaLogger {
});
}

success(...strings) {
this.#logWithStyle(strings, {
fg: "green",
bg: "",
icon: "\u2713",
groupTitle: ` ${this.successesTitle}`,
});
}

// @ts-expect-error- custom implementation
debug(...strings) {
if (!this.verbose) return;
this.#logWithStyle(strings, {
Expand All @@ -228,6 +231,15 @@ class ElizaLogger {
});
}

success(...strings) {
this.#logWithStyle(strings, {
fg: "green",
bg: "",
icon: "\u2713",
groupTitle: ` ${this.successesTitle}`,
});
}

assert(...strings) {
this.#logWithStyle(strings, {
fg: "cyan",
Expand All @@ -236,6 +248,17 @@ class ElizaLogger {
groupTitle: ` ${this.assertsTitle}`,
});
}

progress(message: string) {
if (this.isNode) {
// Clear the current line and move cursor to beginning
process.stdout.clearLine(0);
process.stdout.cursorTo(0);
process.stdout.write(message);
} else {
console.log(message);
}
}
}

export const elizaLogger = new ElizaLogger();
Expand Down
30 changes: 30 additions & 0 deletions packages/core/src/runtime.ts
Original file line number Diff line number Diff line change
Expand Up @@ -176,7 +176,9 @@ export class AgentRuntime implements IAgentRuntime {
return;
}

// Add the service to the services map
this.services.set(serviceType, service);
elizaLogger.success(`Service ${serviceType} registered successfully`);
}

/**
Expand Down Expand Up @@ -217,6 +219,12 @@ export class AgentRuntime implements IAgentRuntime {
cacheManager: ICacheManager;
logging?: boolean;
}) {
elizaLogger.info("Initializing AgentRuntime with options:", {
character: opts.character?.name,
modelProvider: opts.modelProvider,
characterModelProvider: opts.character?.modelProvider,
});

this.#conversationLength =
opts.conversationLength ?? this.#conversationLength;
this.databaseAdapter = opts.databaseAdapter;
Expand Down Expand Up @@ -280,10 +288,32 @@ export class AgentRuntime implements IAgentRuntime {
});

this.serverUrl = opts.serverUrl ?? this.serverUrl;

elizaLogger.info("Setting model provider...");
elizaLogger.info(
"- Character model provider:",
this.character.modelProvider
);
elizaLogger.info("- Opts model provider:", opts.modelProvider);
elizaLogger.info("- Current model provider:", this.modelProvider);

this.modelProvider =
this.character.modelProvider ??
opts.modelProvider ??
this.modelProvider;

elizaLogger.info("Selected model provider:", this.modelProvider);

// Validate model provider
if (!Object.values(ModelProviderName).includes(this.modelProvider)) {
elizaLogger.error("Invalid model provider:", this.modelProvider);
elizaLogger.error(
"Available providers:",
Object.values(ModelProviderName)
);
throw new Error(`Invalid model provider: ${this.modelProvider}`);
}

if (!this.serverUrl) {
elizaLogger.warn("No serverUrl provided, defaulting to localhost");
}
Expand Down
Loading

0 comments on commit 464377e

Please sign in to comment.