StackerPulse v3.2.1

StackerPulse v3.2.1 — stacker stats for quiet accounts, stale bounties

Stacker stats no longer fail on inactive accounts

Looking up an account with no activity in the period failed with
Stacker News: Cannot read properties of undefined (reading 'stacked')
(or 'spent'), and nothing at all was shown.

• The cause is in Stacker News itself (api/resolvers/user.js): the
  stacked and spent resolvers run SUM(...) ... GROUP BY "userId" and
  destructure the first row. With no rows in the period the result is empty
  and the destructuring throws, although the next line means to return 0.
• The fields are nullable, so SN still sends the rest of the profile. The app
  now turns exactly that error, on exactly those two fields, into 0 for the
  period. Any other error is still shown as an error, and stats a stacker
  chose to hide are still shown as hidden (they come back as null with no
  error). Both cases are covered by tests.

Bounty hunter: how old is it?

SN keeps a bounty "open" for as long as nobody pays it, so the list carried
offers from people who left a year ago.

• Every card shows its age: when an SN bounty was posted, or when a GitHub
  issue last had activity. Anything older than six months is marked as
  possibly abandoned.
• New Freshness filter: last 30 / 90 days, half a year (default), a year,
  or everything. Your own tasks are never hidden by age.

Tests: 88 library + 22 CLI (cargo test --release --features cli).

---

Verify your download

Every file below has a SHA-256 checksum in SHA256SUMS.txt and a
build-provenance attestation proving it was built by this workflow
from this repository:

gh attestation verify <file> --repo UBro-dev/stacker-pulse

The installers are not code-signed (that needs a real-name
certificate). Windows SmartScreen and macOS Gatekeeper will warn the
first time; see the README for how to open the app safely.

StackerPulse v3.2.0

StackerPulse v3.2.0 — territory trends, updates you ask for, Russian installers

Territory trends (asked for on Stacker News)

A stacker suggested the app lean into SN's economic data. New panel on the
territory tab, 📈 Territory trends, with a 📈 button on every table row:

• One request fetches SN's own growth series for a territory:
  stackingGrowth, spendingGrowth, itemGrowth and stackerGrowth. SN
  picks the bucket size itself (hour for a day, day for a week or a month,
  month for a year or all time); the app mirrors that rule.
• Shown: what was earned and where it came from (zaps, founder revenue,
  daily rewards, bounty payouts), what was spent, posts and comments, how
  many people earned, and the second half of the period against the first.
• SN quietly returns site-wide numbers for a territory name it doesn't
  know. The query also asks for sub(name:), and the app refuses to show
  anything when that comes back empty, instead of presenting the whole
  site's numbers as one territory's.
• Buckets are matched by time, not by position, so a series with a missing
  bucket can't shift the others; negative and malformed values are dropped.
• The query was validated against SN's schema from 3 November 2026, like the
  others (sub, the four growth queries and all existing queries: VALID).

Updates, only when you ask

Settings → 🔄 Updates → Check for updates, then Download and install.
Built on the official tauri-plugin-updater (2.14), with this app's rules on
top (src-tauri/src/updates.rs):

• No background check, ever. Airgap blocks it. Without Tor the app asks
  first, because GitHub would see your IP, the same rule as the bounty radar.
• Tor when Tor is on. The updater has its own HTTP client (reqwest 0.13)
  with SOCKS turned off. The app enables SOCKS for it and hands it the same
  socks5h:// proxy, with the system and environment proxies disabled.
• Only GitHub. The manifest is this repository's
  releases/latest/download/latest.json (drafts are never offered). Every
  redirect, and the download URL inside the manifest, must be HTTPS on
  github.com, objects.githubusercontent.com or
  release-assets.githubusercontent.com, default port, no credentials.
• Signed with the project's own minisign key, not a real-name
  certificate. The plugin verifies the package before installing, and
  requireSignedVersion binds the signature to the version number.
• Progress is polled from Rust, so the webview needed no new permissions.
• Verified here end to end, short of a real update: a throwaway key
  signed a real .deb; the signature verified with the plugin's own library,
  its trusted comment carries version:…, and flipping one bit of the file
  breaks it. The first real update can only happen between two published
  releases that both have the updater (3.2.0 → the next one).
• A proxy written as socks5h:// with no host used to pass the check; a
  test caught it, and host and port are now required.

Releases

• tauri-action gets the signing key from two repository secrets and
  writes latest.json. A new step checks that it lists signed entries for
  Windows, Linux and both macOS architectures, that its version matches the
  tag, and that every link is pinned to the tag: draft-only untagged-…
  links stop working once the release is published.
• The release refuses to start while tauri.conf.json still has the
  placeholder updater key.
• Local builds without the key (build_*.sh, build_windows.ps1) add
  --config tauri.no-updater.conf.json, so they still produce installers
  instead of failing with "a public key has been found, but no private key".
  Both outcomes were reproduced with a real tauri build. The shell scripts
  expand the optional argument in a way that also works with macOS's
  bash 3.2.

Russian installers

• -setup.exe now speaks English or Russian, picked from the Windows
  language; the .msi comes in en-US and ru-RU.
• Cargo.toml links the Tauri issue behind the required-features
  workaround: tauri-apps/tauri#16460.

Tests: 86 library + 22 CLI (cargo test --release --features cli).

---

Verify your download

Every file below has a SHA-256 checksum in SHA256SUMS.txt and a
build-provenance attestation proving it was built by this workflow
from this repository:

gh attestation verify <file> --repo UBro-dev/stacker-pulse

The installers are not code-signed (that needs a real-name
certificate). Windows SmartScreen and macOS Gatekeeper will warn the
first time; see the README for how to open the app safely.

StackerPulse v3.1.1

StackerPulse v3.1.1 — Support the developer

One page for donation addresses (DONATE.md)

• New DONATE.md: a table of public donation addresses (Monero, USDC on
  Solana, USDT on Tron, Lightning) with network warnings, a check against
  clipboard malware, and what a donation is and is not (a voluntary gift, no
  service, no refund; the software stays MIT whether or not you donate).
• It is the only place the addresses are written. The README links to it,
  GitHub's Sponsor button (.github/FUNDING.yml) points to it, and the app
  embeds it at build time. Changing an address means editing one line.
• In the app: Settings and privacy → Support the developer, one row per
  address with a Copy button and the network warning. The card stays hidden
  while no address is set. Nothing is opened or sent; the address is only
  copied. DONATE.md and support.rs are also in the source viewer.

Every address is checked before it can ship (src-tauri/src/support.rs)

• Monero: decoded from Monero's block base58 and checked against its
  Keccak-256 checksum; main-net standard (4…) and subaddresses (8…) only, no
  testnet, no integrated addresses. Keccak is implemented in the module (about
  60 lines) and tested against the published vectors and the Monero General
  Fund address, so no new dependency and no change to THIRD-PARTY.md.
• Tron: Base58Check checksum, T…, 34 characters, main-net byte 0x41.
• Solana: must decode to exactly 32 bytes (Solana addresses have no
  checksum). A 64-byte value is refused as a private key, with a message
  to delete it and never share it.
• Lightning: name@domain, lower case; a one-time lnbc… invoice is
  refused.
• Anything with spaces is refused as a possible seed phrase, and SeedScan
  itself must find no secret in DONATE.md.
• the_shipped_donate_md_is_valid runs in CI on all three systems and in the
  release workflow before anything is built, so a typo stops the release
  instead of sending someone's money to a wrong address.

Also

• A test that every file offered in the source viewer is actually embedded.
• Release workflow: the first 3.1.1 run built every installer but attached
  none of them. The step that looked up the draft's id came back empty, and
  tauri-action, given no id, builds, skips all uploads and still finishes
  green. The id is now read with gh release view and checked to be a number,
  tauri-action also gets the tag name so it can find the draft by itself, and
  a new step fails the build if no installer actually reached the draft.

Tests: 80 library + 22 CLI (cargo test --release --features cli).

---

Verify your download

Every file below has a SHA-256 checksum in SHA256SUMS.txt and a
build-provenance attestation proving it was built by this workflow
from this repository:

gh attestation verify <file> --repo UBro-dev/stacker-pulse

The installers are not code-signed (that needs a real-name
certificate). Windows SmartScreen and macOS Gatekeeper will warn the
first time; see the README for how to open the app safely.