Daily Review — 2026-08-26

[up2itnow0822]

Daily review (local bridge run)

Overall status: PARTIAL — all code, docs, secret-scan, CI, and PR-hygiene checks ran; dependency-alerts (S6.3) skipped because this bridge run has no API access for alerts, and .github/review-config.yml is absent so defaults were used.

Worst findings (two P1s on the wallet's core paths, both re-verified today and unchanged since yesterday's review #28): the WALLET_BALANCE handler calls sdk.createWallet({privateKey, walletAddress, chainId}) — the v3-era argument shape — through an as any cast while the dependency is agentwallet-sdk ^5.1.1, whose documented v5 signature (in this repo's own README) is createWallet({accountAddress, chain, walletClient}); the plugin's primary feature likely fails at runtime and the cast hides it from the compiler. Second, the SEND_PAYMENT handler is an unimplemented placeholder that transfers nothing and surfaces developer-note text to the user, despite the manifest and action description advertising payments. Also: the CodeQL scheduled workflow remains auto-disabled by GitHub (disabled_inactivity), so no security scanning is running.

Repo health in one line: CI on main passing (last real run 2026-04-06 — no commits since), 6 open Dependabot PRs, all 6 stale >14 days (incl. a major SDK 5→6 bump and #23 with failing CI), no secrets found, CodeQL silently off.

Delta since yesterday: none — zero commits, zero PR/issue activity in the last 24h; all findings carry over with unchanged ids and no human dismissals on issue #28.

{
  "schema_version": 1,
  "repo": "up2itnow0822/plugin-agentwallet",
  "date": "2026-08-26",
  "status": "PARTIAL",
  "summary": "Single-file ElizaOS wallet plugin, no commits since 2026-04-06 and no repo activity in the last 24h; all findings re-verified and carried over from 2026-08-25 with stable ids. Two P1s on core wallet paths: WALLET_BALANCE builds the wallet with the v3-era createWallet argument shape against SDK v5 behind an 'as any' cast, and SEND_PAYMENT is an unimplemented stub despite being advertised. CodeQL scheduled scan auto-disabled by GitHub (P2, state disabled_inactivity re-verified today). Manifest advertises 3 actions that do not exist in code (P2). README documents the SDK rather than the plugin, and package.json's repository URL 404s (P3s, 404 re-verified today). Secret scan of the working tree clean. 6 open PRs, all Dependabot, all stale >14 days; PR #23 CI failing. Dependency alerts not checkable from this bridge run.",
  "health": {
    "ci_status": "passing",
    "open_pr_count": 6,
    "stale_pr_count": 6,
    "dependency_alerts": 0,
    "secrets_found": false,
    "notes": "dependency_alerts NOT verified (no API access in this bridge run) — 0 is a placeholder, see skipped. CI 'passing' = most recent CI run on main (2026-04-06, success); no pushes to main since. CodeQL workflow state disabled_inactivity per Actions API, verified this run. All 6 open PRs are Dependabot PRs stale >14 days (newest activity 2026-06-22): #23 (actions/checkout 6→7, CI FAILING — verified this run), #20 (agentwallet-sdk 5.1.1→6.2.0 major, since 2026-04-13), #14 (typescript 5.9.3→6.0.2 major, since 2026-04-06), #19/#21/#22 (lint deps, since 2026-04-13). No PRs labeled automated-repair. review-config.yml absent: defaults used (stale_pr_days=14, no ignore_paths, agent_safety not enabled so S6.6 out of scope). Shallow clone (depth 50) sufficed for all checks run; no history-dependent check was attempted. No dismissal comments on prior review issues #25/#26/#28, so no candidates graduated to the do-not-report list."
  },
  "findings": [
    {
      "id": "src-index-ts-createwallet-v3-shape-on-v5-sdk",
      "severity": "P1",
      "title": "WALLET_BALANCE calls createWallet with the v3 API shape against agentwallet-sdk v5, hidden by an 'as any' cast",
      "file": "src/index.ts",
      "line": 33,
      "evidence": "Scenario: a configured user asks for their balance; the handler does `await import(\"agentwallet-sdk\") as any` (the comment on lines 28-30 says the cast exists 'for SDK v3 API compatibility') and calls sdk.createWallet({privateKey, walletAddress, chainId}). The dependency is now ^5.1.1 (bumped v3→v5 in commits c8ec0b6e and cbd9219f without touching this call), and the repo's own README documents v5's createWallet(config) as {accountAddress, chain, walletClient} — a different shape. When the handler runs, createWallet either throws or constructs a misconfigured wallet, so the plugin's primary working feature fails at runtime; the 'any' cast means tsc/CI cannot catch it. Assumption (stated): agentwallet-sdk v5 does not retain a legacy overload accepting the v3 argument shape — inferred from the repo's own v5 API docs; not verified against SDK source (node_modules absent from checkout).",
      "category": "correctness",
      "confidence": "medium",
      "suggested_tier": "RED"
    },
    {
      "id": "src-index-ts-send-payment-stub-handler",
      "severity": "P1",
      "title": "SEND_PAYMENT action is an unimplemented stub — advertised payment capability does nothing",
      "file": "src/index.ts",
      "line": 61,
      "evidence": "Scenario: a user tells the agent 'Send 10 USDC to 0x…'; validate() passes (wallet configured), the action fires, and the handler's only statement is callback({text: 'Payment action: Parse recipient and amount from message, then execute via agentwallet-sdk. Spend limits enforced on-chain.'}) — a developer placeholder surfaced to the end user. No SDK call, no transfer, no error. The action's description ('Send a payment from the agent's wallet (enforces on-chain spend limits)'), its examples ('Sending 10 USDC (within spend limit)...'), and package.json's elizaos.actions all present this as working. No funds are at risk (nothing is sent), but the advertised core capability silently does nothing. No assumptions — verified from code alone.",
      "category": "correctness",
      "confidence": "high",
      "suggested_tier": "RED"
    },
    {
      "id": "github-workflows-codeql-yml-auto-disabled",
      "severity": "P2",
      "title": "CodeQL scheduled workflow auto-disabled by GitHub (disabled_inactivity) — security scanning silently off",
      "file": ".github/workflows/codeql.yml",
      "line": 9,
      "evidence": "Scenario: the Actions API reports this workflow's state as 'disabled_inactivity' (GitHub disables scheduled workflows after 60 days without repo activity; last push to main was 2026-04-06, and the last scheduled CodeQL run was 2026-06-15). The weekly cron on line 9 no longer fires, so new code and newly published CodeQL queries produce no alerts. Per contract S6.1 an auto-disabled scheduled workflow (other than the review/repair workflows themselves) is P2. Verified via `gh api .../actions/workflows` this run; no assumptions. Fix is a repo-settings/API re-enable, not a code change.",
      "category": "ci",
      "confidence": "high",
      "suggested_tier": "YELLOW"
    },
    {
      "id": "package-json-unimplemented-actions-advertised",
      "severity": "P2",
      "title": "Manifest advertises BRIDGE_USDC, SWAP_TOKEN, GET_SPEND_LIMITS — none exist in code",
      "file": "package.json",
      "line": 52,
      "evidence": "Scenario: package.json's elizaos.actions lists 5 actions, but src/index.ts registers only walletBalanceAction and sendPaymentAction (line 75). Any registry, marketplace listing, or runtime that trusts the manifest presents bridging/swap/spend-limit capabilities that resolve to nothing; users select the plugin for capabilities it does not have. Assumption (stated): consumers read elizaos.actions from the manifest rather than introspecting the Plugin object — standard for plugin registries, not verified for every consumer.",
      "category": "docs-drift",
      "confidence": "high",
      "suggested_tier": "YELLOW"
    },
    {
      "id": "readme-md-documents-sdk-not-plugin",
      "severity": "P3",
      "title": "README documents the agentwallet SDK, not this ElizaOS plugin, and mixes two package names",
      "file": "README.md",
      "line": 40,
      "evidence": "Scenario: a user landing on this plugin repo follows the README: it is titled 'Agent Wallet SDK', its Quick Start says `npm install @agentwallet/sdk viem` (line 40) while the actual dependency and later sections use `agentwallet-sdk` — two different npm names used interchangeably — and nowhere does it document the plugin itself (how to add it to ElizaOS, or the AGENT_WALLET_ADDRESS / AGENT_PRIVATE_KEY / CHAIN_ID settings the code reads). The user installs the wrong package or configures nothing. Many code fences are also closed with '```text', which opens a new block instead of closing one, garbling GitHub rendering. Verified from code + README alone; no assumptions.",
      "category": "docs-drift",
      "confidence": "high",
      "suggested_tier": "GREEN"
    },
    {
      "id": "package-json-repository-url-404",
      "severity": "P3",
      "title": "package.json repository URL points to a nonexistent repo (agentwallet-sdk/elizaos-plugin, 404)",
      "file": "package.json",
      "line": 66,
      "evidence": "Scenario: npm and tooling render the repository link https://github.com/agentwallet-sdk/elizaos-plugin; `gh api repos/agentwallet-sdk/elizaos-plugin` returns 404 (re-verified this run), so anyone following the published package's source link — e.g. to audit wallet code before trusting it with keys — hits a dead page instead of up2itnow0822/plugin-agentwallet. No assumptions.",
      "category": "docs-drift",
      "confidence": "high",
      "suggested_tier": "GREEN"
    }
  ],
  "skipped": [
    {
      "check": "dependency_alerts (S6.3)",
      "reason": "No API access for Dependabot/security alerts in this local bridge run (per bridge contract); health.dependency_alerts=0 is an unverified placeholder, not a measured zero."
    },
    {
      "check": "review-config.yml",
      "reason": "File absent from checkout; proceeded with defaults (stale_pr_days=14, no ignore_paths, agent_safety not enabled so S6.6 out of scope)."
    }
  ],
  "metrics": {
    "files_scanned": 12
  }
}