{
  "projectId": "elizaos",
  "title": "elizaOS｜插件加载与动作描述",
  "summary": "从正式 npm 包内附带的 source map 恢复插件加载和动作提示模块：核心负责组装 Agent 能力，具体金融执行取决于所安装插件。",
  "scope": "npm @elizaos/core@1.7.2 随包 source map 的 src/plugin.ts 与 src/actions.ts；保留 sourcesContent 原始内容，REA 成功解析 2 个文件。原始大包分析资源受限，未宣称完整恢复运行时。",
  "status": "partial",
  "analyzedAt": "2026-10-13T10:54:43.219893+00:00",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "缺失插件存在受环境限制的自动安装分支",
      "detail": "plugin.ts 在动态 import 失败后可能调用 Bun 安装并重试；CI、测试模式及 ELIZA_NO_AUTO_INSTALL / ELIZA_NO_PLUGIN_AUTO_INSTALL 可禁止该分支，且每进程记录已尝试的插件。我们仅解析代码，没有触发该逻辑。",
      "evidenceType": "observed",
      "evidenceIds": [
        "ev_020930c9e6fe67b5dfe9b0456135bad3800867f49eb313735b644fcc97af0b35"
      ],
      "sourceUrls": [
        "https://registry.npmjs.org/@elizaos/core/-/core-1.7.2.tgz"
      ]
    },
    {
      "title": "动作示例用于构造模型提示",
      "detail": "actions.ts 格式化动作名称、说明和示例对话，并对示例做随机选择；plugin.ts 另检查 actions、services、providers、evaluators 的结构。可以推断核心提供插件与提示组装机制，但具体资金权限和交易规则必须继续检查金融插件。",
      "evidenceType": "code_inference",
      "evidenceIds": [
        "ev_020930c9e6fe67b5dfe9b0456135bad3800867f49eb313735b644fcc97af0b35"
      ],
      "sourceUrls": [
        "https://registry.npmjs.org/@elizaos/core/-/core-1.7.2.tgz"
      ]
    }
  ],
  "limitations": [
    "只覆盖随发行包发布的两个 source-map 原文模块，没有审计完整 runtime、数据库或任何金融插件。",
    "source map 与执行 JS 的逐语句语义对应未做动态验证；记录原始包与 source map 指纹以便复核。",
    "静态代码不证明运行行为、完整风控、成交或收益；未审计服务端。",
    "没有登录、读取账户、连接钱包、签名、交易或执行目标代码。"
  ],
  "artifacts": [
    {
      "label": "@elizaos/core@1.7.2",
      "url": "https://registry.npmjs.org/@elizaos/core/-/core-1.7.2.tgz",
      "sha256": "560ed101bdfa9061c8fe89d2e525aee253f9109933f59dfb8698760dabd29e3b"
    },
    {
      "label": "src--actions.ts",
      "url": "https://registry.npmjs.org/@elizaos/core/-/core-1.7.2.tgz",
      "sha256": "59797d9229aa977362baa142fb945a50941e9c04289851d6eafe5208982545d0"
    },
    {
      "label": "src--plugin.ts",
      "url": "https://registry.npmjs.org/@elizaos/core/-/core-1.7.2.tgz",
      "sha256": "035aee9cc7928384e4e31b8c2fce908df7a133dc3ca23f7fc87952478c404c0a"
    },
    {
      "label": "dist/node/index.node.js.map",
      "url": "https://registry.npmjs.org/@elizaos/core/-/core-1.7.2.tgz",
      "sha256": "9ad1b811458c1497a3f337183bb3f733c7368b383969d2d04a15dda7e7129034"
    }
  ],
  "evidenceIds": [
    "ev_020930c9e6fe67b5dfe9b0456135bad3800867f49eb313735b644fcc97af0b35"
  ],
  "reportUrl": "/research/rea/elizaos.json",
  "coverage": {
    "parsedFiles": 2,
    "parseFailures": 0,
    "semanticCoverage": "unknown",
    "rootArtifactSha256": "909064ff00f989422c3dcc592a9dcd705ebeba4de1682fba5578f97b8f8238bb",
    "inputFileCount": 2,
    "inputBytes": 21262,
    "npmIntegrityVerified": true,
    "sourceMap": {
      "path": "dist/node/index.node.js.map",
      "sha256": "9ad1b811458c1497a3f337183bb3f733c7368b383969d2d04a15dda7e7129034",
      "bytes": 4328074,
      "sourceEntries": [
        "../../src/actions.ts",
        "../../src/plugin.ts"
      ]
    },
    "analysisResult": "completed"
  }
}