Conversation
Gas-sponsored sends (Turnkey Gas Station, ERC-4337/EIP-7702 smart accounts, relayers) route through a wrapper, so the on-chain transaction's top-level to/calldata no longer describe the action that ran. Decoding only the top-level calldata returns different results for sponsored vs direct sends of the same action. Add a shared trace-decode capability that walks the transaction's internal call tree (debug_traceTransaction callTracer) and decodes the real call against the target contract ABI, so write actions report a consistent "what executed" view regardless of sponsorship. - lib/web3/trace-decode.ts: trace, flatten, decode, and resolveExecutedCall - lib/web3/trace-executed-call.ts: shared helper with RPC failover - write-contract, approve-token, transfer-token: attach normalized executedCall on the sponsored success path, plus executedCall.* output fields for template references - best-effort and graceful: returns undefined when the RPC cannot trace Native transfer-funds is excluded (no function to decode). History-based query-transactions discovery of sponsored calls is out of scope: explorers index internal calls by value transfer only, so a zero-value sponsored call is not discoverable from history.
Protocol action nodes created via the Hub 'Use in Workflow' button only carry actionType and _protocolMeta at creation time — the user fills in required fields (network, asset, amount, etc.) once the editor opens. The create endpoint was rejecting these nodes with 422 INVALID_ACTION_CONFIG because validateWorkflowActionConfigs enforced required fields regardless of whether any user-facing parameters had been set. Add a draft-state guard: if config contains only actionType, reserved keys, and underscore-prefixed metadata keys, skip required-field and type validation for that node. The UNKNOWN_FIELD check still runs. Tests: 5 new unit cases in a 'draft state' describe block and 1 new integration case hitting POST /api/workflows/create with the exact Hub payload shape, asserting no 422 and a DB insert proceeds.
Error filter was returning both user errors and system errors because
workflowDbStatuses("error") expanded to all ERROR_STATUSES. The two
statuses now have distinct single-value filters so each pill shows only
runs of its own kind.
workflow-runs.tsx terminalStatuses was also missing system_error, causing
the poll loop to keep refreshing logs on system_error runs indefinitely
instead of doing one final refresh and stopping.
System error runs have no step logs (the failure happens before any step executes), so the expanded row showed "No step logs available" with no context. The error code and message were available on the execution row but were not included in UnifiedRun or selected by the analytics query. Add error, errorCode, errorType, and errorCategory to UnifiedRun and select them in fetchWorkflowRuns (direct runs null-fill since direct_executions has no error fields). In ExpandedStepRows, call getCustomerRunErrorMessage when the step list is empty and show the customer-facing message in place of the generic fallback text.
Fixes 57 alerts (19 high, 38 medium) across 4 package manifests by adding or updating pnpm.overrides to pin vulnerable transitive deps to their minimum fixed versions. Root (pnpm-lock.yaml): - hono ^4.12.18 -> ^4.12.25 (resolves 9 alerts: CORS, Lambda, path traversal) - undici ^6.24.0 -> ^6.27.0 (header injection, WS DoS) - devalue ^5.6.4 -> ^5.8.1 - dompurify ^3.4.0 -> ^3.4.11 (resolves 16 alerts: XSS/IN_PLACE bypasses) - vite ^7.3.5 added as direct devDep (resolves 9 alerts: FS bypass, NTLMv2) - ws ^8.21.0 override (memory exhaustion DoS, uninitialized memory) - form-data ^4.0.6 override (CRLF injection) - piscina ^4.9.3 override (prototype pollution -> RCE) - brace-expansion ^5.0.6 override (ReDoS) - qs ^6.15.2 override (prototype pollution) - js-yaml ^4.2.0 override (quadratic DoS) - @opentelemetry/core ^2.8.0 override (unbounded memory allocation) - uuid@<11 ^11.1.1 override (buffer bounds check bypass) docs-site/pnpm-lock.yaml: - mermaid >=11.15.0 override (resolves 4 medium CVEs) - @xmldom/xmldom >=0.9.10 override (resolves 5 high CVEs) - dompurify >=3.4.11 override (resolves 5 medium alerts) - brace-expansion >=5.0.6 override (ReDoS) keeperhub-events (workspace lockfile): - ws >=8.21.0 override - vite >=8.0.16 override keeperhub-events/event-tracker: - ws >=8.21.0 override keeperhub-scheduler: - ws >=8.21.0 override - vite >=8.0.16 override - qs >=6.15.2 override Post-fix: pnpm audit root reports 0 high, 0 moderate (4 low remain: @ai-sdk/provider-utils has no fix; esbuild and dompurify low-severity alerts are deferred as dev/low-risk).
Add hasDraftActionNodes() to action-config.ts and call it in the PATCH handler after finalNodes is resolved. Returns 422 UNCONFIGURED_ACTION_NODES when body.enabled is true and any known action node carries only reserved or underscore-prefixed keys (no user-supplied parameters). Covers both the nodes+enabled PATCH path (where validateWorkflowActionConfigs was silently passing draft nodes) and the enable-only PATCH path (where the validation block is skipped entirely when nodes are not in the body).
The previous comment claimed UNKNOWN_FIELD still runs for draft nodes, which is false — the continue exits the entire node iteration, bypassing all three checks. The new comment accurately states that all validation (including UNKNOWN_FIELD) is skipped and explains why: underscore-prefixed metadata keys like _protocolMeta would otherwise be flagged as unknown fields.
…bugs fix(analytics): isolate error and system_error filters
…bot-alerts chore: resolve dependabot high and medium severity vulnerability alerts
- Fix flattenCallTree to propagate parent revert to all descendant frames (geth callTracer only sets error on the reverting frame, not children) - Fix executeWithFailover failover: throw on null result so the provider manager retries the next provider rather than accepting null as success - Remove dead !call.input guard (input is always present on decodable calls) - Extract shared serializeArg util from three duplicate serializeValue impls - Add executedCall tracing to direct-send path in approve-token, transfer-token, and write-contract (was previously only on the sponsored path) - Add unit tests covering revert propagation, executedCall attach/omit, and correct args forwarded to traceExecutedCallWithFailover
…w-from-hub-actions fix: allow creating workflows from Hub protocol actions
The .next/cache incremental-compile cache lives in a BuildKit type=cache mount, which the registry layer cache does not carry. On ephemeral hosted runners each build gets a fresh BuildKit instance, so the mount starts empty and next build runs cold whenever source changes. Give the mount a stable id and persist its contents with actions/cache + buildkit-cache-dance: the cache is injected into the builder before the bake build and extracted again afterwards. Keyed per environment so staging and prod keep separate lineages.
…ored-tx-decode feat(web3): decode actual executed call for sponsored transactions
…-min ci: persist Next.js build cache across runs to warm next build
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.