Release 002
Release 002 · VEX 0.1.4
Every open community report, resolved.
VEX 0.1.4 is the community release. We triaged every open pull request and issue in the repository, all of them, back to #1: merged what was ready, rebuilt what needed hardening, and closed the board to zero.
This page summarizes the work merged since 0.1.3.
Community release · Board closed to zero
14
Fourteen merges landed: three security hardenings, a cross protocol accounting fix verified on chain, a full mission acceptance flow, and a sharper first run experience.
01 · Security
Three boundaries, hardened.
VEX holds your keys, so error messages and process boundaries are safety features.
A correct password is never called wrong. Vault unlock now classifies failures by phase: only a failed cryptographic authentication can say "wrong password". A corrupt file says corrupt, a vault written by a newer build says update VEX, and a transient system error says try again. None of them advance the lockout throttle or steer you toward wiping keystores.
Helper processes lost their keyring. Docker helpers spawned by the app only need PATH and a socket. They no longer inherit your unlocked API secrets, and the strip survives Windows' case insensitive environment semantics.
Web research fetches only through Tavily. The raw local fetch fallback is gone: the privileged process never fetches arbitrary URLs from your machine anymore, which deletes the entire local SSRF surface instead of guarding it. Provider responses are now accounted exactly once, so duplicate, conflicting, or unrequested entries can't multiply results or poison the cache.
02 · Trade accounting
Wrapped native is native, on every chain.
A buy funded with the WETH contract address is economically the same trade as one funded with ETH. VEX's books now agree, everywhere.
Uniswap and KyberSwap classify by economics, not by tool name. A wrapped native leg (WETH, WBNB, WPOL, WMNT, wS, WBERA and friends) records as the native side of the trade. KyberSwap gained a fail closed wrapped native registry covering all 19 aggregator chains, with every address verified on chain before it shipped.
Portfolio lines can't be spoofed by a symbol. Positions aggregate by token address, never by self declared symbol, so a fake "WETH" can't melt into your real one, and brand icons render only for address verified tokens.
Polymarket responses are validated end to end. All nine previously raw reward and market endpoints now parse through strict, bounded schemas, so a garbled number rejects instead of silently displaying as zero.
03 · Missions
From mission ready to running: one visible path.
A Review & accept contract bar now appears exactly where Start mission will be. The passive header badge is no longer the only way in, and accepting closes the modal right onto the Start button. Merged directly from the community.
Readiness is honest. While the action plan is still loading, failed to load, or empty, every surface (badge, bar, and modal) says Preparing, and a failed read gets an explicit Retry instead of a dead end.
A dropped event can't hide the bar. Live sync now carries a fallback poll, so mission state stays current even if a push goes missing.
04 · First run
The composer shows what VEX can actually do.
The three starter chips are protocol forward: hunt trending memecoins through DexScreener with X sentiment, turn on Hypervexing by asking for it, scout Pendle fixed yield markets. Plan first phrasing, no fake prices, and clicking still only fills the composer. Nothing sends or trades without you.
05 · Hypervexing
Leaving the room is as smooth as entering it.
The exit drain animation actually plays. The trading room theme holds through the drain and hands back your own theme cleanly, with reduced motion respected.
Focus follows you. Into the room on enter, back to the chat composer on exit, with proper screen reader labels along the way.
Earn cards stopped clipping their actions in short windows.
06 · Community
This release exists because you filed it.
Every change above started as, or was shaped by, community work. Several of these changes shipped within days of the community reporting them:
darahub · #43, #44, #46: the vault, SSRF, and secrets findings.
Nishant-Adhikari · #39 merged directly, and the accounting discipline behind the registry work.
mandatedisrael · #37 merged directly, and #38: the mission acceptance flow.
alexastro01 · #36 and #40: the polish that shipped, and the best design issue this repo has received in #21.
ellygeronline-lab · issues #26, #41, #42: diagnoses precise enough to fix from.
Reimplemented or merged as is, every author is credited in the landing pull requests. Join the Discord and ping @lookyegbe to get into the dev channel.
07 · Engineering
Under the hood.
Update toast actions stay inside the card at every width. A corrupt Solana keystore no longer reports as a wrong password. Cache writes are best effort, so a failed local write never discards a result you already have. And VEX wears its new cobalt VX mark on every platform icon.
08 · Before you update
Upgrade notes.
No new database migrations in this release. Update and go. One behavior change worth knowing: web research now requires the free Tavily API key for fetching pages (the tool was already hidden without it), and a Tavily outage reports an honest failure instead of silently degrading. No manual action is required.