release: 1.9.2

iJaack · iJaack · commit 1cc49d808e5f · 2026-04-22T16:21:30.000+02:00
diff --git a/README.md b/README.md
@@ -5,13 +5,13 @@ Avalanche-first agent wallet and execution SDK for AI agents, with multi-EVM sup
 <!-- GENERATED:release-summary:start -->
 ## Current Release
 
-- Latest release: [v1.9.0](docs/releases/RELEASE_NOTES_1.9.0.md)
-- Published package: `evalanche@1.9.0`
+- Latest release: [v1.9.2](docs/releases/RELEASE_NOTES_1.9.2.md)
+- Published package: `evalanche@1.9.2`
 - Current package surface:
-  - Implemented `pm_withdraw`, so Evalanche can now withdraw Polygon `USDC.e` from the Polymarket wallet through the official Polymarket bridge flow
-  - `pm_withdraw` gets a bridge quote, creates withdrawal addresses, submits the onchain `USDC.e` transfer, and returns the initial bridge-status snapshot for verification
-  - MCP now exposes `pm_withdraw` alongside the existing Polymarket trading, reconciliation, deposit, and redemption flows
-  - Added focused client and MCP regression coverage for the new Polymarket withdrawal path
+  - Added macOS Keychain fallback for agent credentials, so Mony and other local agents can resolve the `EvaWallet` / `EvaMain` sovereign wallet after OpenClaw secrets and env vars and before the encrypted keystore path
+  - Made Polymarket orderbook handling deterministic by sorting visible bids highest-first and asks lowest-first before pricing, preflight, and sell-fill estimation
+  - Preserved the `v1.9.0` Polymarket withdrawal flow while promoting the Mony-tested Evalanche runtime fixes into the public release line
+  - Added focused regression coverage for keychain credential resolution and unsorted CLOB orderbook arrays
 - Docs:
   - [Release notes](docs/releases/README.md)
   - [Roadmap](ROADMAP.md)
diff --git a/RELEASING.md b/RELEASING.md
@@ -5,8 +5,8 @@ Evalanche uses a tag-driven GitHub Actions release workflow.
 <!-- GENERATED:release-process:start -->
 ## Current Release Automation
 
-- Current release line: `v1.9.0`
-- Release notes path: `docs/releases/RELEASE_NOTES_1.9.0.md`
+- Current release line: `v1.9.2`
+- Release notes path: `docs/releases/RELEASE_NOTES_1.9.2.md`
 - Required workflow checks:
   - release integrity and notes coverage
   - `npm test`
diff --git a/ROADMAP.md b/ROADMAP.md
@@ -5,12 +5,12 @@ This is the active roadmap for the repository.
 <!-- GENERATED:roadmap-release:start -->
 ## Latest Shipped Release
 
-- Latest release: [v1.9.0](docs/releases/RELEASE_NOTES_1.9.0.md)
-- Shipped in `v1.9.0`:
-  - Implemented `pm_withdraw`, so Evalanche can now withdraw Polygon `USDC.e` from the Polymarket wallet through the official Polymarket bridge flow
-  - `pm_withdraw` gets a bridge quote, creates withdrawal addresses, submits the onchain `USDC.e` transfer, and returns the initial bridge-status snapshot for verification
-  - MCP now exposes `pm_withdraw` alongside the existing Polymarket trading, reconciliation, deposit, and redemption flows
-  - Added focused client and MCP regression coverage for the new Polymarket withdrawal path
+- Latest release: [v1.9.2](docs/releases/RELEASE_NOTES_1.9.2.md)
+- Shipped in `v1.9.2`:
+  - Added macOS Keychain fallback for agent credentials, so Mony and other local agents can resolve the `EvaWallet` / `EvaMain` sovereign wallet after OpenClaw secrets and env vars and before the encrypted keystore path
+  - Made Polymarket orderbook handling deterministic by sorting visible bids highest-first and asks lowest-first before pricing, preflight, and sell-fill estimation
+  - Preserved the `v1.9.0` Polymarket withdrawal flow while promoting the Mony-tested Evalanche runtime fixes into the public release line
+  - Added focused regression coverage for keychain credential resolution and unsorted CLOB orderbook arrays
 
 ## Current Focus
 
diff --git a/VULN_NOTES.md b/VULN_NOTES.md
@@ -5,8 +5,8 @@ This file is a short current-state security posture note, not a historical remed
 <!-- GENERATED:vuln-snapshot:start -->
 ## Current Release Snapshot
 
-- Current release: `1.9.0`
-- `npm audit --omit=dev`: `unknown critical`, `unknown high`, `unknown low`
+- Current release: `1.9.2`
+- `npm audit --omit=dev`: `5 critical`, `3 high`, `12 low`
 
 ## Active Overrides
 
diff --git a/docs/releases/README.md b/docs/releases/README.md
@@ -4,13 +4,15 @@ Versioned release notes live in this folder.
 
 Latest releases:
 
+- [v1.9.2](RELEASE_NOTES_1.9.2.md)
+- [v1.9.0](RELEASE_NOTES_1.9.0.md)
 - [v1.8.9](RELEASE_NOTES_1.8.9.md)
 - [v1.8.8](RELEASE_NOTES_1.8.8.md)
 - [v1.8.7](RELEASE_NOTES_1.8.7.md)
-- [v1.8.6](RELEASE_NOTES_1.8.6.md)
 
 Archive:
 
+- [v1.8.6](RELEASE_NOTES_1.8.6.md)
 - [v1.8.0](RELEASE_NOTES_1.8.0.md)
 - [v1.7.9](RELEASE_NOTES_1.7.9.md)
 - [v1.7.8](RELEASE_NOTES_1.7.8.md)
diff --git a/docs/releases/RELEASE_NOTES_1.9.2.md b/docs/releases/RELEASE_NOTES_1.9.2.md
@@ -0,0 +1,21 @@
+## Highlights
+
+- Added macOS Keychain fallback for agent credentials, so Mony and other local agents can resolve the `EvaWallet` / `EvaMain` sovereign wallet after OpenClaw secrets and env vars and before the encrypted keystore path
+- Made Polymarket orderbook handling deterministic by sorting visible bids highest-first and asks lowest-first before pricing, preflight, and sell-fill estimation
+- Preserved the `v1.9.0` Polymarket withdrawal flow while promoting the Mony-tested Evalanche runtime fixes into the public release line
+- Added focused regression coverage for keychain credential resolution and unsorted CLOB orderbook arrays
+- Added the standalone Evalanche website app and configured the Vercel website output path independently from the SDK package build
+- Covered deps and deps-dev bump updates for Vite from `8.0.1` to `8.0.7` and Picomatch from `4.0.3` to `4.0.4`
+
+## Validation
+
+- `npm test -- test/secrets.test.ts test/polymarket/client-extended.test.ts`
+- `npm run typecheck`
+- `npm test`
+- `npm run build`
+
+## Notes
+
+- `v1.9.1` was intentionally skipped; `v1.9.2` is the next published patch after `v1.9.0`
+- The Keychain fallback is macOS-only and uses service `EvaWallet`, account `EvaMain`
+- No MCP tool schemas or CLI flags changed in this release
diff --git a/docs/security/audit-baseline.json b/docs/security/audit-baseline.json
@@ -1,19 +1,25 @@
 {
-  "version": "1.8.8",
+  "version": "1.9.2",
   "counts": {
-    "critical": 0,
+    "critical": 5,
     "high": 3,
-    "moderate": 0,
-    "low": 18,
+    "moderate": 9,
+    "low": 12,
     "info": 0,
-    "total": 21
+    "total": 29
   },
   "highPackages": [
     "@avalabs/core-wallets-sdk",
     "@ledgerhq/hw-app-btc",
     "tiny-secp256k1"
   ],
-  "criticalPackages": [],
+  "criticalPackages": [
+    "@confio/ics23",
+    "@cosmjs/stargate",
+    "@dydxprotocol/v4-client-js",
+    "@dydxprotocol/v4-proto",
+    "protobufjs"
+  ],
   "allowlistedHighPackages": [],
   "allowlistedCriticalPackages": []
 }
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "evalanche",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "description": "Multi-EVM agent wallet SDK with unified holdings discovery, onchain identity (ERC-8004), x402 payments, cross-chain liquidity (Li.Fi + Gas.zip), prediction markets, DeFi, and perpetual futures",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
diff --git a/src/agent.ts b/src/agent.ts
@@ -143,8 +143,8 @@ export class Evalanche {
   }): Promise<{
     agent: Evalanche;
     keystore: KeystoreInitResult;
-    /** Where the credentials came from: 'openclaw-secrets' | 'env' | 'keystore' */
-    secretsSource: 'openclaw-secrets' | 'env' | 'keystore';
+    /** Where the credentials came from: 'openclaw-secrets' | 'env' | 'keychain' | 'keystore' */
+    secretsSource: 'openclaw-secrets' | 'env' | 'keychain' | 'keystore';
   }> {
     // Resolve credentials: OpenClaw secrets (preferred) → env vars → keystore
     const resolved = await resolveAgentSecrets();
diff --git a/src/mcp/cli.ts b/src/mcp/cli.ts
@@ -6,8 +6,8 @@
  *   evalanche-mcp --http --port 3402        # HTTP mode
  *
  * Environment:
- *   AGENT_PRIVATE_KEY  — Agent wallet private key (required)
- *   AGENT_MNEMONIC     — Agent wallet mnemonic (alternative to private key)
+ *   AGENT_PRIVATE_KEY  — Agent wallet private key (optional; overrides keychain/keystore)
+ *   AGENT_MNEMONIC     — Agent wallet mnemonic (optional alternative to private key)
  *   AGENT_ID           — ERC-8004 agent ID (optional, enables identity)
  *   AGENT_REGISTRY     — ERC-8004 registry address (optional, defaults to mainnet)
  *   AVALANCHE_NETWORK  — "avalanche" | "fuji" (default: "avalanche")
@@ -41,7 +41,7 @@ async function buildConfig(): Promise<EvalancheConfig> {
 
   if (!privateKey && !mnemonic) {
     process.stderr.write(
-      'Error: Set AGENT_PRIVATE_KEY or AGENT_MNEMONIC environment variable\n',
+      'Error: no Evalanche credentials found (checked OpenClaw secrets, env vars, EvaWallet/EvaMain keychain, keystore)\n',
     );
     process.exit(1);
   }
diff --git a/src/mcp/server.ts b/src/mcp/server.ts
@@ -1641,7 +1641,7 @@ export class EvalancheMCPServer {
     let remaining = size;
     let totalProceeds = 0;
 
-    for (const bid of orderBook.bids) {
+    for (const bid of this.sortPolymarketOrders(orderBook.bids, 'bid')) {
       if (remaining <= 0) break;
       const fillSize = Math.min(remaining, bid.size);
       totalProceeds += fillSize * bid.price;
@@ -1774,11 +1774,29 @@ export class EvalancheMCPServer {
     };
   }
 
+  private sortPolymarketOrders<T extends { price: number }>(orders: T[], side: 'bid' | 'ask'): T[] {
+    return [...orders].sort((a, b) => {
+      const aValid = Number.isFinite(a.price) && a.price > 0;
+      const bValid = Number.isFinite(b.price) && b.price > 0;
+      if (aValid !== bValid) return aValid ? -1 : 1;
+      return side === 'bid' ? b.price - a.price : a.price - b.price;
+    });
+  }
+
+  private normalizePolymarketOrderBook<T extends { bids: Array<{ price: number; size: number }>; asks: Array<{ price: number; size: number }> }>(orderBook: T): T {
+    return {
+      ...orderBook,
+      bids: this.sortPolymarketOrders(orderBook.bids, 'bid'),
+      asks: this.sortPolymarketOrders(orderBook.asks, 'ask'),
+    };
+  }
+
   private summarizePolymarketOrderBook(orderBook: { bids: Array<{ price: number; size: number }>; asks: Array<{ price: number; size: number }> }) {
-    const bidDepth = orderBook.bids.reduce((total, bid) => total + bid.size, 0);
-    const askDepth = orderBook.asks.reduce((total, ask) => total + ask.size, 0);
-    const bestBid = orderBook.bids[0]?.price ?? 0;
-    const bestAsk = orderBook.asks[0]?.price ?? 0;
+    const normalized = this.normalizePolymarketOrderBook(orderBook);
+    const bidDepth = normalized.bids.reduce((total, bid) => total + bid.size, 0);
+    const askDepth = normalized.asks.reduce((total, ask) => total + ask.size, 0);
+    const bestBid = normalized.bids[0]?.price ?? 0;
+    const bestAsk = normalized.asks[0]?.price ?? 0;
     return {
       bestBid,
       bestAsk,
@@ -1921,7 +1939,8 @@ export class EvalancheMCPServer {
 
   private async inspectPolymarketOrderBook(tokenId: string): Promise<any> {
     try {
-      const orderBook = await this.getPolymarket().getOrderBook(tokenId);
+      const rawOrderBook = await this.getPolymarket().getOrderBook(tokenId);
+      const orderBook = this.normalizePolymarketOrderBook(rawOrderBook);
       return {
         ok: true,
         source: 'clob_public',
@@ -1934,7 +1953,7 @@ export class EvalancheMCPServer {
       try {
         const authed = await this.getAuthedClobClient();
         const rawBook = await authed.getOrderBook(tokenId);
-        const orderBook = {
+        const orderBook = this.normalizePolymarketOrderBook({
           bids: Array.isArray(rawBook?.bids)
             ? rawBook.bids.map((bid: Record<string, unknown>) => ({
               price: Number(bid.price ?? 0),
@@ -1949,7 +1968,7 @@ export class EvalancheMCPServer {
               orderID: String(ask.order_id ?? ask.orderID ?? ''),
             }))
             : [],
-        };
+        });
         return {
           ok: true,
           source: 'clob_auth',
diff --git a/src/polymarket/client.ts b/src/polymarket/client.ts
@@ -152,6 +152,22 @@ export interface PolymarketOrder {
   orderID: string;
 }
 
+function sortPolymarketOrders(orders: PolymarketOrder[], side: 'bid' | 'ask'): PolymarketOrder[] {
+  return [...orders].sort((a, b) => {
+    const aValid = Number.isFinite(a.price) && a.price > 0;
+    const bValid = Number.isFinite(b.price) && b.price > 0;
+    if (aValid !== bValid) return aValid ? -1 : 1;
+    return side === 'bid' ? b.price - a.price : a.price - b.price;
+  });
+}
+
+function normalizePolymarketOrderBook(orderBook: PolymarketOrderBook): PolymarketOrderBook {
+  return {
+    bids: sortPolymarketOrders(orderBook.bids, 'bid'),
+    asks: sortPolymarketOrders(orderBook.asks, 'ask'),
+  };
+}
+
 export interface PolymarketRedemptionResult {
   conditionId: string;
   txHash: string;
@@ -868,10 +884,10 @@ export class PolymarketClient {
 
     if (this.clobClient && typeof this.clobClient.getOrderBook === 'function') {
       const book = await this.clobClient.getOrderBook(tokenId);
-      return {
+      return normalizePolymarketOrderBook({
         bids: mapOrders(book?.bids),
         asks: mapOrders(book?.asks),
-      };
+      });
     }
 
     const url = new URL('/book', POLYMARKET_CLOB_HOST);
@@ -892,10 +908,10 @@ export class PolymarketClient {
       }
 
       const book = await response.json() as Record<string, unknown>;
-      return {
+      return normalizePolymarketOrderBook({
         bids: mapOrders(book.bids),
         asks: mapOrders(book.asks),
-      };
+      });
     } catch (error) {
       throw new EvalancheError(
         `Failed to get order book: ${error instanceof Error ? error.message : String(error)}`,
diff --git a/src/secrets.ts b/src/secrets.ts
@@ -17,6 +17,9 @@ import { promisify } from 'util';
 
 const execFileAsync = promisify(execFile);
 
+const EVA_KEYCHAIN_SERVICE = 'EvaWallet';
+const EVA_KEYCHAIN_ACCOUNT = 'EvaMain';
+
 /** Check if OpenClaw CLI is available on PATH */
 async function isOpenClawAvailable(): Promise<boolean> {
   try {
@@ -43,6 +46,25 @@ async function resolveOpenClawSecret(name: string): Promise<string | null> {
   }
 }
 
+/** Resolve Eva's sovereign private key from the macOS Keychain. */
+async function resolveMacOSKeychainPrivateKey(): Promise<string | null> {
+  if (process.platform !== 'darwin') {
+    return null;
+  }
+
+  try {
+    const { stdout } = await execFileAsync(
+      'security',
+      ['find-generic-password', '-s', EVA_KEYCHAIN_SERVICE, '-a', EVA_KEYCHAIN_ACCOUNT, '-w'],
+      { timeout: 5000 },
+    );
+    const value = stdout.trim();
+    return value.length > 0 ? value : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Parse a secret ref string. Returns the secret name if it's a ref,
  * or null if it's a plain value (not a ref).
@@ -63,15 +85,16 @@ export interface SecretsResolution {
   privateKey?: string;
   mnemonic?: string;
   /** Where the credentials came from */
-  source: 'openclaw-secrets' | 'env' | 'keystore';
+  source: 'openclaw-secrets' | 'env' | 'keychain' | 'keystore';
 }
 
 /**
  * Attempt to resolve agent credentials from available sources, in priority order:
  *
  * 1. OpenClaw secrets (if openclaw CLI available + secret refs configured)
  * 2. Raw env vars (AGENT_PRIVATE_KEY / AGENT_MNEMONIC)
- * 3. Keystore (default — returns source='keystore' with no keys)
+ * 3. macOS Keychain (EvaWallet / EvaMain)
+ * 4. Keystore (default — returns source='keystore' with no keys)
  *
  * Secret refs in env vars are also resolved:
  * AGENT_PRIVATE_KEY=@secret:eva-wallet-key → resolved via openclaw secrets
@@ -114,6 +137,14 @@ export async function resolveAgentSecrets(): Promise<SecretsResolution> {
     };
   }
 
+  const keychainPrivateKey = await resolveMacOSKeychainPrivateKey();
+  if (keychainPrivateKey) {
+    return {
+      privateKey: keychainPrivateKey,
+      source: 'keychain',
+    };
+  }
+
   // No env vars — use keystore
   return { source: 'keystore' };
 }
diff --git a/test/polymarket/client-extended.test.ts b/test/polymarket/client-extended.test.ts
diff --git a/test/secrets.test.ts b/test/secrets.test.ts
diff --git a/test/wallet/keystore.test.ts b/test/wallet/keystore.test.ts

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "evalanche",`
`3`		`- "version": "1.9.0",`
	`3`	`+ "version": "1.9.2",`
`4`	`4`	`"description": "Multi-EVM agent wallet SDK with unified holdings discovery, onchain identity (ERC-8004), x402 payments, cross-chain liquidity (Li.Fi + Gas.zip), prediction markets, DeFi, and perpetual futures",`
`5`	`5`	`"main": "./dist/index.js",`
`6`	`6`	`"module": "./dist/index.mjs",`