fix(#12274): fallback-slop sweep — app plugins B (wallet/vision/music/agent-skills/browser/workflow/training)

[lalalune]

Fallback-slop sweep (#12182): app plugins B — wallet / vision / music / agent-skills / browser / workflow / training

Executes the #12182 rubric against the app-plugins-B slice. This is behavior-changing
work, so it is deliberately a small, precise PR: high-confidence slop converted to
fast-fail, plausibly-justified handlers annotated, everything ambiguous left untouched
and counted. Precision over completeness — a reckless large sweep here would fake wallet
success or drop a designed browser/workflow degrade.

Foundation (#12263) is used as-is: ElizaError code/context/cause, and the diff-scoped
bun run audit:error-policy-ratchet.

Re-derived suspect counts (this slice @ base 36be3c8655)

pattern	count
empty catch (non-test, TS)	4 (2 real; 2 inside a PowerShell string — exempt per issue)
promise swallow .catch(()=>…)	33
return-default catch	133
?? <lit>	699
|| <lit>	316
try blocks	968

Site table (verdict per touched site)

site	pattern	verdict	action
plugin-wallet/src/wallet/local-eoa-backend.ts:83-87	catch → return null	SLOP	convert → let typed SolanaPrivateKeyInvalidError propagate
plugin-browser/src/workspace/browser-capture.ts:244	empty catch (teardown)	J6	keep + logger.debug + annotate
plugin-browser/src/workspace/browser-capture.ts:250	empty catch (teardown)	J6	keep + logger.debug + annotate
plugin-browser/src/bridge-policy.ts:41	new URL() catch → null	J3	keep + annotate (typed-invalid, callers fail-closed)
plugin-browser/src/routes/workspace.ts:176	decodeURIComponent catch → null	J3	keep + annotate (typed-invalid tab id → 404)

Per-category tally

• Converted (slop → fast-fail): 1 — local-eoa-backend.ts (money path).
• Annotated (justified J-category): 4 — 2× J6 (browser teardown), 2× J3 (browser URL/tab-id parse).
• Left (ambiguous / designed degrade / legitimate absence): ~large — e.g. the kamino
  APY service (Math.random()-fabricated data — a larp rewrite, out of a fallback sweep's
  scope), workflow-service generation/deploy degrades (getRuntimeContext/fixWorkflowErrors/
  activateWorkflow log-and-continue — nuanced product-degrade judgment, not money paths),
  agent-skills load paths (already logger.warn per failure — not silent), and the wallet
  ?? "0" transaction/LP defaults (ERC20 value=0, optional second LP token — legitimate
  defaults, not catch-swallow). Precision beats completeness; these are candidates for a
  follow-up with the product owner, not high-confidence one-shot conversions.

Exemplar before → after (the money-path conversion)

resolveSolanaKeypair swallowed a carefully-typed error, conflating "invalid configured key"
with "no key configured":

// BEFORE — a malformed SOLANA_PRIVATE_KEY reads as WalletBackendNotConfiguredError("NO_WALLET_CONFIGURED")
if (!raw) return null;
try {
  return keypairFromSolanaSecret(raw);   // throws typed SolanaPrivateKeyInvalidError
} catch {
  return null;                            // swallowed
}

// AFTER — absence stays null; a configured-but-malformed key surfaces the typed error
if (!raw) return null;                    // legitimate absence
return keypairFromSolanaSecret(raw);      // invalid key propagates

Test (real error path, no mocked dependency)

plugin-wallet/src/wallet/local-eoa-backend.test.ts drives the real key-derivation path
(real @solana/web3.js Keypair, real base58):

• valid base58 secret → usable signer (getAddresses().solana matches, canSign('solana'));
• wrong-length configured key → rejects.toBeInstanceOf(SolanaPrivateKeyInvalidError);
• non-base58 configured key → SolanaPrivateKeyInvalidError;
• genuinely no key set → still WalletBackendNotConfiguredError (absence path preserved).

Verification

• bun run --cwd plugins/plugin-wallet test → 126 passed, 1 skipped (incl. the 4 new tests).
• bun run --cwd plugins/plugin-browser test → 147 passed.
• bun run --cwd plugins/plugin-wallet check → clean; bun run --cwd plugins/plugin-browser typecheck → clean.
• bun run audit:error-policy-ratchet → pass; browser-capture emptyCatch 2→0, no new slop in any touched file.

Refs #12274 · parent #12182 · foundation #12263.

🤖 Generated with Claude Code

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9852dc33-0b93-4304-966e-9e73be07c07d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fallback/12274-sweep

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[lalalune]

Reviewed (#12274 slop sweep, app plugins B): browser-capture stop-path errors now log at debug with the error message (non-fatal but observable); the wallet LocalEoaBackend gets tests proving invalid Solana keys / missing config fail loud with typed SolanaPrivateKeyInvalidError/WalletBackendNotConfiguredError instead of fabricating a default (security-correct fail-closed for a wallet key). Net-additive, well-tested. Queuing auto-merge on green.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.