Release/v1.8.6#2081
Merged
Merged
Conversation
… sources only Agent Staking and the staking-contract selection list could contradict each other (Zendesk #1164): Agent Staking showed the actually-staked Pearl Beta Mech Marketplace (40 OLAS / 5%) while the list badged the agent-config default (5000 OLAS / 138.5%) as "Selected". Root causes and fixes: - useStakingContracts.currentStakingProgramId fell back to the 3-tier selectedStakingProgramId, whose last tier is the agent-config default — a contract the user never joined. Now derives active (subgraph) → service-stored staking_program_id → null, never the default. - Deprecated programs were filtered out of the list before the "current" check, so a user staked in a legacy contract could never see their contract badged. The current program is now kept in the list even when deprecated. - StakingContractDetails (Agent Staking) took its title from the 3-tier id but its stats from active||default, so name and numbers could describe different contracts. Both now key off the same currentStakingProgramId. - useRewardsHistory cached a Zod parse failure as a successful null for ONE_DAY_IN_MS, silently wiping the active program for a day after one malformed subgraph response. The queryFn now throws so React Query retries and surfaces the error. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two HIGH advisories were failing the "yarn audit (both trees)" CI gate, both pre-existing on staging: - adm-zip <0.6.0 (GHSA-xcpc-8h2w-3j85, crafted-ZIP memory allocation DoS) — root direct dependency. Pearl only uses the creation-side API (addLocalFile/writeZip in electron/features/logs.js), unchanged. - js-yaml >=4.0.0 <4.3.0 (GHSA-52cp-r559-cp3m) — pinned via resolutions in both the root and frontend trees; bumped to 4.3.0 in both. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…es out startAgentWithRetries returned ABORTED whenever waitForBalancesReady() was false, but that helper returns false for a transient balance-wait timeout as well as for a genuine disable. The scanner treats ABORTED as "disabled -> stop", so one agent whose balances timed out (e.g. Optimus on Optimism) paused the entire rotation and other eligible agents were never started. Return ABORTED only when auto-run is actually disabled; otherwise return INFRA_FAILED so the scanner falls back to the next eligible agent - matching the existing retry-interrupted handling. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Two HIGH advisories were failing the "yarn audit (both trees)" CI gate, both pre-existing on staging: - adm-zip <0.6.0 (GHSA-xcpc-8h2w-3j85, crafted-ZIP memory allocation DoS) — root direct dependency. Pearl only uses the creation-side API (addLocalFile/writeZip in electron/features/logs.js), unchanged. - js-yaml >=4.0.0 <4.3.0 (GHSA-52cp-r559-cp3m) — pinned via resolutions in both the root and frontend trees; bumped to 4.3.0 in both. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…rce quota Snyk CLI scans without --remote-repo-url can't read GitHub visibility and default to counting against the private test quota, even for public repos. Pass the repo URL so these scans land in the unlimited open-source buckets. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ci(snyk): tag CLI scans with public repo URL so they use the open-source quota
…rrent-contract fix(staking): [OPE-1841] derive current staking contract from trusted sources only
…-fallback fix(autorun): [OPE-1845] don't pause rotation when a balance gate times out
Surface a non-blocking warning when a staking contract's reward pool is empty (availableRewards === 0). Previously the app computed isRewardsAvailable but never used it: users could select/keep a rewards-exhausted contract with no signal, and the middleware would silently deploy the service unstaked (stake omitted, deploy proceeds). - New shared NoStakingRewardsAlert (type="warning"), optional "Switch Staking Contract" action. - Migration/onboarding: per-card warning in SelectActivityRewardsConfiguration when the contract has no rewards; card stays selectable (useCanMigrate unchanged — non-blocking). - Main page: warning added to AgentDisabledAlert, rendered alongside the self-hiding low-balance alerts so neither is masked. Gating reads loaded contract details (availableRewards === 0), not raw isRewardsAvailable, to avoid flashing during load / firing on no_staking. Tests: NoStakingRewardsAlert render + switch button; StakingRewardsWarning load/available/empty gating. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… audit gate) Five HIGH advisories were failing the "yarn audit (both trees)" CI gate. They are newly-published advisories in existing transitive deps (not introduced by this branch) — pre-existing on staging too: - immutable >=5.0.0-beta.1 <5.1.8 (GHSA-v56q-mh7h-f735 List trie DoS, GHSA-xvcm-6775-5m9r Map/Set hash-collision DoS) via sass>immutable. The resolution already pinned immutable to 5.1.5 (still vulnerable) in both trees; bumped to 5.1.9. - fast-uri >=3.0.0 <=3.1.3 (GHSA-v2hh-gcrm-f6hx, GHSA-4c8g-83qw-93j6 host-confusion) via electron-store>conf>ajv>fast-uri. Root resolution bumped 3.1.2 -> 3.1.4. - sharp <0.35.0 (GHSA-f88m-g3jw-g9cj, libvips CVE-2026-33327/33328/ 35590/35591) via next>sharp. Added a sharp 0.35.3 resolution in both trees. New transitive @img/colour is MIT and new @img/sharp-* wasm variants are Apache-2.0 (both allowlisted); @img/sharp-libvips-* covered by the existing prefix exemption. audit:prod now green on both trees. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
sharp 0.35 removed its install/check.js postinstall script (now prebuilt-only via @img/sharp-* binary packages), so `sharp` no longer appears in the install-hook surface. The install-hooks gate fails on the now-stale allowlist entry in both trees. Removed it from root and frontend allowlists. The new @img/* prebuilt packages declare no install scripts, so nothing new needs allowlisting. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…rds-warning feat(staking): warn on empty reward-pool contracts [OPE-1846]
iasonrovis
approved these changes
Jul 22, 2026
OjusWiZard
approved these changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
Types of changes
What types of changes does your code introduce?
Put an
xin the boxes that apply