Fix bot dashboard and augurScan UI review findings by KillariDev · Pull Request #1114 · AugurProject/zoltar

KillariDev · 2026-10-02T17:35:50Z

What

A source review of the three bot operator dashboards (bots/chaos, bots/liquidator, bots/open-oracle-arbitrager), their shared console kit (bots/shared/src/dashboard) and the augurScan explorer found one high-severity theming bug, five high-severity augurScan bugs and a longer list of medium/low ones. This PR fixes them.

Why and what changed

Shared bot console (`bots/shared`)

Dark console broke on a light-mode OS. The imported token sheet sets color-scheme: light dark, and the console pinned only some colours, so --accent-ink, --info and --border-strong resolved to light values (primary button text at ~1.4:1). color-scheme: dark is now pinned.
Confirmation dialog returns focus to its opener, its disabled type-to-confirm button looks disabled, and its body has stacked spacing.
createFocusedFormSubmitter renders failures in the error style with role="alert".
A global [hidden] rule so the attribute always hides in the dashboards.
The shared server rejects every non-same-origin non-GET/HEAD request before routing (the per-route checks in the bots were removed), and unhandled exceptions return a sanitized 500 with the security headers.
New requestJson reads the response body inside the timeout; a beforeunload guard protects dirty tracked forms; scroll offsets only subtract the header when it is sticky; universe approval keeps keyboard focus; no duplicate history entries; formatAmount never renders -0.

Chaos

State polls wait (bounded) for the page's own mutations, so a slow "Check and save RPCs" no longer shows a healthy bot as down. Operation status polls are not counted as mutations.
Drafts are rebased instead of being flagged "changed elsewhere" when the operator's own action bumped the revision without touching the form's fields.
Drain & Retire lists the actual blockers and V3 positions; live "Execute operation" asks for confirmation and shows ETH values; the resume preflight refreshes first and blocks when stale.
In-page links navigate in place; unchanged alerts and panels are not rebuilt or re-announced; recovery and retirement requests keep their in-flight locks and reconcile unknown outcomes.

Liquidator

Changing the Chain select now asks for confirmation (typed phrase when live) instead of switching and pausing on change; a timed-out or rejected switch unlocks the dashboard instead of freezing it.
Saving one form, or a background configuration reload, no longer wipes unsaved edits in the other forms.
The resume preflight reads the saved strategy and names the enabled automatic actions.
Reconcile cards update in place (typed hash and status survive polls); request latches are no longer undone by polls; the configuration-failure notice and Retry show on every page.
Capacity values are labelled ETH (the source is underwritingLimitAttoEth); vault health uses the configured top-up threshold.

Open-oracle-arbitrager

The approved-universes form no longer reports "Unsaved changes" after merely searching the explorer.
The server forwards allow-listed operator-safe validation messages instead of a generic fallback on five endpoints.
Chain switch, submission mode, approved universes and RPC endpoint saves go through a review dialog; reloading configuration asks before discarding dirty forms.
The resume readiness check live-updates, shows a queued signer, and stays open with a stale row and Resume locked when a poll fails (it used to close).
The price chart only rebuilds when its data changes; the read-only operator file view refreshes after saves; the operator guide matches the UI.

augurScan

hidden was overridden by author display rules (stale "Show more" buttons and error boxes). There is now one global [hidden] rule.
Links in the "Sent transactions" dialog navigated the page behind it while the dialog stayed open.
Address A's data could show under address B's title, including after a failed load. The same guard covers questions and universes.
System state search disabled its own input while typing.
Live refreshes rebuilt whole views every block; unchanged refreshes are skipped and focus/open disclosures are restored.
Chart legend swatches and plotted lines share one colour list, and Plot's CSP-blocked inline <style> is replaced by rules in the stylesheet.
A closed event stream reconnects with backoff; search results float over the page and can be dismissed; query params no longer leak between Activity and the Operations timeline; operations filter forms submit in place and errors show their cause; timestamps are UTC throughout; an unknown chainId shows a notice.
Metric values wrap instead of truncating; activity rows show the full transaction cell; print styles exist.
Security headers on every response, application/octet-stream fallback content type, stricter CSP, minified bundle, dead CSS removed.

Dependency audit

bun audit started failing for every project on GHSA-vfj7-8cjw-p6xm (braces <= 3.0.3, stack exhaustion on deeply nested brace patterns), which has no patched release. braces arrives only through @tevm/compiler > solc-typed-ast > findup-sync > micromatch, and its only caller is solc-typed-ast's import resolver, which passes the constant pattern node_modules/; no pattern from this repository, a user or a remote party reaches it. All audits now share one command in tooling/repo/projects.ts that ignores exactly this advisory, with the rationale beside it and a test pinning the accepted list. Remove the entry when a patched release exists.

Not covered: the infrastructure-checks job in .github/workflows/ci.yml still runs a bare cd solidity && bun audit (it only runs for infrastructure-only changes). Changing it to bun ./tooling/repo/run-project-tasks.mts audit --project-path solidity needs a push with workflow scope.

Not in this PR

The arbitrager's forwarded-message allow-lists repeat the validators' message strings rather than sharing constants; if a message is reworded the dashboard falls back to the generic text (nothing leaks). Left for a follow-up.

Cross-bot CSS/request-helper dedupe, splitting augurScan's stylesheet, content-hashed assets, a route registry for augurScan, and unifying loading/empty/error styling.

Validation

bun run tsc
bun run test in bots/shared (354), bots/chaos (975), bots/liquidator (328), bots/open-oracle-arbitrager (527)
augurScan bun run test:ci (unit 312, api 66, replay 135) and tests/browser against the demo build in headless Chromium (64)
bun run format:check, bun run check (includes test:preflight), bun run knip, git diff --check
bun ./tooling/repo/run-project-tasks.mts audit --group core-audit and the bot/augurScan audits: no vulnerabilities, 1 ignored
Browser QA: 33 headless-Chromium captures across the four UIs at 1440x900 and 390x844, no console errors and no horizontal overflow.