Daily Review — 2026-08-25

[up2itnow0822]

Daily review (local bridge run)

Overall status: PARTIAL — all code and docs checks ran; dependency-alerts (S6.3) skipped because the bridge run has no API access for alerts, and .github/review-config.yml is absent so defaults were used.

Worst findings (two P1s, both on the wallet's core paths): the WALLET_BALANCE handler calls sdk.createWallet({privateKey, walletAddress, chainId}) — the v3-era API shape — through an as any cast, while the dependency has since been bumped to agentwallet-sdk v5, whose documented signature (in this repo's own README) is createWallet({accountAddress, chain, walletClient}); the plugin's main feature likely fails at runtime and the cast hides it from the compiler. Second, the SEND_PAYMENT handler is a placeholder stub that transfers nothing and replies with developer-note text, despite the plugin advertising payment capability in its manifest and action description. Also notable: the CodeQL scheduled workflow has been auto-disabled by GitHub (disabled_inactivity), so the repo currently has no security scanning.

Repo health in one line: CI on main passing (last real run 2026-04-06), 6 open PRs — all 6 stale (oldest since 2026-04-06, incl. a major SDK 5→6 bump and one with failing CI), no secrets found, CodeQL silently off.

{
  "schema_version": 1,
  "repo": "up2itnow0822/plugin-agentwallet",
  "date": "2026-08-25",
  "status": "PARTIAL",
  "summary": "Single-file ElizaOS wallet plugin, no commits since 2026-04-06. Two P1s on core wallet paths: WALLET_BALANCE builds the wallet with the v3-era createWallet argument shape against SDK v5 behind an 'as any' cast, and SEND_PAYMENT is an unimplemented stub despite being advertised. CodeQL scheduled scan auto-disabled by GitHub (P2). Manifest advertises 3 actions that do not exist in code (P2). README documents the SDK rather than the plugin and package.json's repository URL 404s (P3s). Secret scan clean. 6 open PRs, all stale >14 days. Dependency alerts not checkable from this bridge run.",
  "health": {
    "ci_status": "passing",
    "open_pr_count": 6,
    "stale_pr_count": 6,
    "dependency_alerts": 0,
    "secrets_found": false,
    "notes": "dependency_alerts NOT verified (no API access in bridge run) — 0 is a placeholder, see skipped. CI 'passing' = last CI run on main (2026-04-06, success); no pushes to main since. CodeQL workflow state is disabled_inactivity per Actions API. All 6 open PRs are Dependabot PRs stale >14 days: #23 (actions/checkout 6→7, CI FAILING, updated 2026-06-22), #20 (agentwallet-sdk 5.1.1→6.2.0 major, since 2026-04-13), #14 (typescript 5.9.3→6.0.2 major, since 2026-04-06), #19/#21/#22 (lint deps, since 2026-04-13). No PRs labeled automated-repair. review-config.yml absent: defaults used (stale_pr_days=14; agent_safety not enabled, so S6.6 out of scope)."
  },
  "findings": [
    {
      "id": "src-index-ts-createwallet-v3-shape-on-v5-sdk",
      "severity": "P1",
      "title": "WALLET_BALANCE calls createWallet with the v3 API shape against agentwallet-sdk v5, hidden by an 'as any' cast",
      "file": "src/index.ts",
      "line": 33,
      "evidence": "Scenario: a configured user asks for their balance; the handler does `await import(\"agentwallet-sdk\") as any` (comment on line 28-30 says the cast exists 'for SDK v3 API compatibility') and calls sdk.createWallet({privateKey, walletAddress, chainId}). The dependency is now ^5.1.1 (bumped v3→v5 in commits c8ec0b6e and cbd9219f without touching this call), and the repo's own README documents v5's createWallet(config) as {accountAddress, chain, walletClient} — a different shape. When the handler runs, createWallet either throws or constructs a misconfigured wallet, so the plugin's primary working feature fails at runtime; the 'any' cast means tsc/CI cannot catch it. Assumption (stated): agentwallet-sdk v5 does not retain a legacy overload accepting the v3 argument shape — inferred from the repo's own v5 API docs, not verified against SDK source.",
      "category": "correctness",
      "confidence": "medium",
      "suggested_tier": "RED"
    },
    {
      "id": "src-index-ts-send-payment-stub-handler",
      "severity": "P1",
      "title": "SEND_PAYMENT action is an unimplemented stub — advertised payment capability does nothing",
      "file": "src/index.ts",
      "line": 61,
      "evidence": "Scenario: a user tells the agent 'Send 10 USDC to 0x…'; validate() passes (wallet configured), the action fires, and the handler's only statement is callback({text: 'Payment action: Parse recipient and amount from message, then execute via agentwallet-sdk. Spend limits enforced on-chain.'}) — a developer placeholder surfaced to the end user. No SDK call, no transfer, no error. The action's description ('Send a payment from the agent's wallet (enforces on-chain spend limits)'), its examples ('Sending 10 USDC (within spend limit)...'), and package.json's elizaos.actions all present this as working. No funds are at risk (nothing is sent), but the advertised core capability silently does nothing. No assumptions — verified from code alone.",
      "category": "correctness",
      "confidence": "high",
      "suggested_tier": "RED"
    },
    {
      "id": "github-workflows-codeql-yml-auto-disabled",
      "severity": "P2",
      "title": "CodeQL scheduled workflow auto-disabled by GitHub (disabled_inactivity) — security scanning silently off",
      "file": ".github/workflows/codeql.yml",
      "line": 9,
      "evidence": "Scenario: the Actions API reports this workflow's state as 'disabled_inactivity' (GitHub disables scheduled workflows after 60 days without repo activity; last push to main was 2026-04-06). The weekly cron on line 9 no longer runs, and push/PR triggers on a disabled workflow do not fire either, so new code and newly published CodeQL queries produce no alerts. Per contract S6.1 an auto-disabled scheduled workflow (other than the review/repair workflows themselves) is P2. Verified via `gh api .../actions/workflows` this run; no assumptions. Fix is a repo-settings/API re-enable, not a code change.",
      "category": "ci",
      "confidence": "high",
      "suggested_tier": "YELLOW"
    },
    {
      "id": "package-json-unimplemented-actions-advertised",
      "severity": "P2",
      "title": "Manifest advertises BRIDGE_USDC, SWAP_TOKEN, GET_SPEND_LIMITS — none exist in code",
      "file": "package.json",
      "line": 52,
      "evidence": "Scenario: package.json's elizaos.actions lists 5 actions, but src/index.ts registers only walletBalanceAction and sendPaymentAction (line 75). Any registry, marketplace listing, or runtime that trusts the manifest presents bridging/swap/spend-limit capabilities that resolve to nothing; users select the plugin for capabilities it does not have. Assumption (stated): consumers read elizaos.actions from the manifest rather than introspecting the Plugin object — standard for plugin registries, not verified for every consumer.",
      "category": "docs-drift",
      "confidence": "high",
      "suggested_tier": "YELLOW"
    },
    {
      "id": "readme-md-documents-sdk-not-plugin",
      "severity": "P3",
      "title": "README documents the agentwallet SDK, not this ElizaOS plugin, and mixes two package names",
      "file": "README.md",
      "line": 40,
      "evidence": "Scenario: a user landing on this plugin repo follows the README: it is titled 'Agent Wallet SDK', its Quick Start says `npm install @agentwallet/sdk viem` (line 40) while the actual dependency and later sections use `agentwallet-sdk` — two different npm names used interchangeably — and nowhere does it document the plugin itself (how to add it to ElizaOS, the AGENT_WALLET_ADDRESS / AGENT_PRIVATE_KEY / CHAIN_ID settings the code reads). The user installs the wrong package or configures nothing. Verified from code + README alone; no assumptions.",
      "category": "docs-drift",
      "confidence": "high",
      "suggested_tier": "GREEN"
    },
    {
      "id": "package-json-repository-url-404",
      "severity": "P3",
      "title": "package.json repository URL points to a nonexistent repo (agentwallet-sdk/elizaos-plugin, 404)",
      "file": "package.json",
      "line": 66,
      "evidence": "Scenario: npm and tooling render the repository link https://github.com/agentwallet-sdk/elizaos-plugin; `gh api repos/agentwallet-sdk/elizaos-plugin` returns 404 (verified this run), so anyone following the published package's source link — e.g. to audit wallet code before trusting it with keys — hits a dead page instead of up2itnow0822/plugin-agentwallet. No assumptions.",
      "category": "docs-drift",
      "confidence": "high",
      "suggested_tier": "GREEN"
    }
  ],
  "skipped": [
    {
      "check": "dependency_alerts (S6.3)",
      "reason": "No API access for Dependabot/security alerts in this local bridge run (per bridge contract); health.dependency_alerts=0 is an unverified placeholder, not a measured zero."
    },
    {
      "check": "review-config.yml",
      "reason": "File absent from checkout; proceeded with defaults (stale_pr_days=14, no ignore_paths, agent_safety not enabled so S6.6 out of scope)."
    }
  ],
  "metrics": {
    "files_scanned": 12
  }
}