Skip to content

Commit 528f586

Browse files
hyper-gonk[bot]hyper-gonk[bot]
committed
Merge remote-tracking branch 'origin/main' into ousdt
# Conflicts: # .github/workflows/ci.yml # package.json # pnpm-lock.yaml # src/components/layout/AppLayout.tsx # src/components/nav/Footer.tsx # src/consts/config.ts # src/consts/links.ts # src/features/tokens/types.ts # src/features/tokens/utils.ts # src/features/transfer/TransferTokenForm.tsx # src/features/transfer/fees.test.ts # src/features/transfer/fees.ts # src/features/transfer/maxAmount.ts # src/features/transfer/useFeeQuotes.ts # src/features/transfer/useTokenTransfer.ts
2 parents 85a39ed + cc07efd commit 528f586

36 files changed

+2378
-52
lines changed

‎.claude/skills/claude-review/SKILL.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
name: claude-review
3+
description: Review code changes using Hyperlane Warp UI coding standards. Use when reviewing PRs, checking your own changes, or doing self-review before committing.
4+
---
5+
6+
# Code Review Skill
7+
8+
Use this skill to review code changes against Hyperlane Warp UI standards.
9+
10+
## When to Use
11+
12+
- Before committing changes (self-review)
13+
- When asked to review a PR or diff
14+
- To check if changes follow project patterns
15+
16+
## Instructions
17+
18+
Read and apply the guidelines from `.github/prompts/code-review.md` to review the code changes.
19+
20+
### For PR Reviews
21+
22+
When reviewing a PR, deliver feedback using `/inline-pr-comments` to post inline comments on specific lines.
23+
24+
**Delivery format:**
25+
26+
1. **Inline comments** - For all issues on lines IN the diff
27+
2. **Summary body** - For:
28+
- Overall assessment
29+
- Architecture concerns
30+
- Issues found OUTSIDE the diff (use "## Observations Outside This PR" section)
31+
32+
GitHub API limitation: Can only post inline comments on changed lines. Issues in unchanged code go in the summary body.
33+
34+
### For Self-Review
35+
36+
When reviewing your own changes before committing:
37+
38+
1. Run `git diff` to see changes
39+
2. Apply the code review guidelines
40+
3. Fix issues directly rather than commenting
41+
42+
Security issues should use `/claude-security-review` instead.

‎.claude/skills/claude-security-review/SKILL.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
name: claude-security-review
3+
description: Security-focused review for frontend/Web3 code. Use for XSS, wallet security, CSP, and dependency checks.
4+
---
5+
6+
# Security Review Skill
7+
8+
Use this skill for security-focused code review of frontend Web3 code.
9+
10+
## When to Use
11+
12+
- Reviewing wallet integration code
13+
- Checking for XSS vulnerabilities
14+
- CSP header changes
15+
- Dependency updates
16+
17+
## Instructions
18+
19+
Read and apply the security guidelines from `.github/prompts/security-scan.md` to review the code changes.
20+
21+
Report findings with severity ratings (Critical/High/Medium/Low/Informational) and suggested fixes.
22+
23+
### For PR Reviews
24+
25+
When reviewing a PR, deliver feedback using `/inline-pr-comments` to post inline comments on specific lines.

‎.claude/skills/inline-pr-comments/SKILL.md‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
---
2+
name: inline-pr-comments
3+
description: Post inline PR review comments on specific lines. Use this skill to deliver code review feedback as inline comments rather than a single summary.
4+
---
5+
6+
# Inline PR Comments Skill
7+
8+
Use this skill to post code review feedback as inline comments on specific lines in a PR.
9+
10+
## When to Use
11+
12+
- After completing a code review (use with /claude-review, /claude-security-review)
13+
- When you have specific line-by-line feedback to deliver
14+
- To make review feedback more actionable
15+
16+
## Instructions
17+
18+
Post a review with inline comments using `gh api`:
19+
20+
```bash
21+
gh api repos/{owner}/{repo}/pulls/{pr_number}/reviews --input - << 'EOF'
22+
{
23+
"event": "COMMENT",
24+
"body": "Optional summary of overall findings",
25+
"comments": [
26+
{
27+
"path": "path/to/file.ts",
28+
"line": 42,
29+
"body": "Issue description and suggested fix"
30+
},
31+
{
32+
"path": "another/file.ts",
33+
"start_line": 10,
34+
"line": 15,
35+
"body": "Multi-line comment spanning lines 10-15"
36+
}
37+
]
38+
}
39+
EOF
40+
```
41+
42+
### Comment Fields
43+
44+
- `path` - File path relative to repo root
45+
- `line` - Line number in the NEW version of the file (right side of diff)
46+
- `start_line` + `line` - For comments spanning multiple lines
47+
- `body` - Markdown-formatted feedback
48+
49+
### Limitations
50+
51+
- Can only comment on lines that appear in the diff (changed/added lines)
52+
- Comments on unchanged lines will fail with "Line could not be resolved"
53+
54+
### Handling Non-Diff Findings
55+
56+
When you discover issues in code NOT changed by the PR:
57+
58+
1. **Include in summary body** - Always report in the `"body"` field
59+
2. **Format clearly** - Use a dedicated section "## Observations Outside This PR"
60+
3. **Be actionable** - Include file:line references so author can follow up
61+
4. **Don't block** - These are informational; don't use `REQUEST_CHANGES` for non-diff issues
62+
63+
Example structure:
64+
65+
```json
66+
{
67+
"event": "COMMENT",
68+
"body": "## Review Summary\n[inline feedback summary]\n\n## Observations Outside This PR\nWhile reviewing, I noticed:\n- `src/utils/foo.ts:142`: Pre-existing null check missing\n- `src/core/bar.ts:78-82`: Similar pattern to line 45 issue - consider deduping",
69+
"comments": [
70+
// Only lines IN the diff
71+
]
72+
}
73+
```
74+
75+
### Feedback Guidelines
76+
77+
| Feedback Type | In Diff? | Where to Put It |
78+
| ----------------------------- | -------- | --------------------------------------------------------- |
79+
| Specific code issue | Yes | Inline comment on that line |
80+
| Pattern repeated across files | Yes | Inline on first occurrence + note "same issue in X, Y, Z" |
81+
| Related issue found | No | Summary body under "Observations Outside This PR" |
82+
| Pre-existing bug discovered | No | Summary body (consider separate issue if critical) |
83+
| Overall architecture concern | N/A | Summary body |
84+
| Approval/changes requested | N/A | Use `event: "APPROVE"` or `event: "REQUEST_CHANGES"` |
85+
86+
Be concise. Group minor style issues together.

‎.github/prompts/code-review.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
Review this pull request. Focus on:
2+
3+
## Code Quality
4+
5+
- Logic errors and potential bugs
6+
- Error handling and edge cases
7+
- Code clarity and maintainability
8+
- Adherence to existing patterns in the codebase
9+
- **Use existing utilities** - Search codebase before adding new helpers
10+
- **Prefer `??` over `||`** - Preserves zero/empty string as valid values
11+
12+
## Architecture
13+
14+
- Consistency with existing architecture patterns
15+
- Breaking changes or backward compatibility issues
16+
- API contract changes
17+
- **Deduplicate** - Move repeated code/types to shared files
18+
- **Extract utilities** - Shared functions belong in utils packages
19+
20+
## Testing
21+
22+
- Test coverage for new/modified code
23+
- Edge cases that should be tested
24+
- **New utility functions need unit tests**
25+
26+
## Performance
27+
28+
- Unnecessary re-renders or computations
29+
- Bundle size impact of new dependencies
30+
31+
## Frontend-Specific
32+
33+
- **Use existing utilities** - Check `src/utils/` before adding (normalizeAddress, etc.)
34+
- **Chain-aware addresses** - Only lowercase EVM hex; Solana/Cosmos are case-sensitive
35+
- **CSP updates required** - New external scripts/styles need `next.config.js` CSP updates
36+
- **Avoid floating promises** - In useEffect, use IIFE or separate async function
37+
- **Use useQuery refetch** - Don't reinvent; use built-in refetch from TanStack Query
38+
- **Flatten rendering logic** - Avoid nested if; use early returns instead
39+
- **Zustand patterns** - Follow existing store patterns in `src/features/store.ts`
40+
- **Constants outside functions** - Move config/constants outside component functions
41+
42+
Provide actionable feedback with specific line references.
43+
Be concise. For minor style issues, group them together.
44+
Security issues are handled by a separate dedicated review.

‎.github/prompts/security-scan.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
## Frontend Security Focus Areas
2+
3+
This is a Web3 frontend application. Pay special attention to:
4+
5+
### XSS & Content Security
6+
- Input sanitization before rendering user data
7+
- Dangerous patterns: dangerouslySetInnerHTML, eval(), innerHTML
8+
- URL validation (javascript: protocol, data: URLs)
9+
- CSP headers and inline script risks
10+
11+
### Web3 Wallet Security
12+
- Blind signature attacks (signing data without user understanding)
13+
- Transaction simulation before signing
14+
- Clear message display before signature requests
15+
- Proper origin/domain verification for wallet connections
16+
- **Chain-aware address validation** - EVM hex can lowercase; Solana base58/Cosmos bech32 are case-sensitive
17+
- **Don't collapse addresses** - Normalizing non-EVM addresses can create security issues
18+
19+
### Dependency & Supply Chain
20+
- Known vulnerabilities in dependencies
21+
- Malicious packages, typosquatting
22+
- Outdated critical security packages
23+
24+
### API & Token Security
25+
- CORS configuration
26+
- Token storage (avoid localStorage for sensitive tokens)
27+
- API key exposure in client-side code
28+
29+
### Private Key Handling
30+
- NEVER expose private keys client-side
31+
- Check for hardcoded keys or mnemonics
32+
- Wallet connection patterns should not request keys
33+
34+
### Content Security Policy
35+
- New external resources (scripts, styles, frames) need CSP header updates
36+
- Check `next.config.js` for script-src, style-src, connect-src, frame-src
37+
- Third-party integrations (Intercom, analytics, wallets) need explicit allowlisting
38+
- Test with CSP enabled in production mode

‎.github/workflows/ci.yml‎

Lines changed: 52 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,26 @@
11
name: ci
22

33
on:
4-
# Triggers the workflow on push or pull request events but only for the main branch
54
push:
65
branches: [main, nautilus, nexus, injective, trump, ousdt]
76
pull_request:
87
branches: [main, nautilus, nexus, injective, trump, ousdt]
98
merge_group:
10-
11-
# Allows you to run this workflow manually from the Actions tab
129
workflow_dispatch:
1310

1411
jobs:
15-
install:
12+
build:
1613
runs-on: ubuntu-latest
1714
steps:
1815
- uses: actions/checkout@v6
1916
- uses: pnpm/action-setup@v4
2017
- uses: actions/setup-node@v6
2118
with:
19+
<<<<<<< HEAD
2220
node-version-file: 'package.json'
21+
=======
22+
node-version-file: '.nvmrc'
23+
>>>>>>> origin/main
2324

2425
- name: Get pnpm store directory
2526
id: pnpm-store
@@ -34,7 +35,11 @@ jobs:
3435
restore-keys: |
3536
${{ runner.os }}-pnpm-store-
3637
38+
<<<<<<< HEAD
3739
- name: pnpm-install
40+
=======
41+
- name: Install dependencies
42+
>>>>>>> origin/main
3843
run: |
3944
pnpm install --frozen-lockfile
4045
CHANGES=$(git status -s)
@@ -44,6 +49,7 @@ jobs:
4449
exit 1
4550
fi
4651
52+
<<<<<<< HEAD
4753
build:
4854
runs-on: ubuntu-latest
4955
needs: [install]
@@ -70,20 +76,53 @@ jobs:
7076
- name: Install dependencies
7177
run: pnpm install --frozen-lockfile
7278

79+
=======
80+
>>>>>>> origin/main
7381
- name: build
7482
run: pnpm run build
7583
env:
7684
NEXT_PUBLIC_WALLET_CONNECT_ID: ${{ secrets.NEXT_PUBLIC_WALLET_CONNECT_ID }}
7785

86+
typecheck:
87+
runs-on: ubuntu-latest
88+
steps:
89+
- uses: actions/checkout@v6
90+
- uses: pnpm/action-setup@v4
91+
- uses: actions/setup-node@v6
92+
with:
93+
node-version-file: '.nvmrc'
94+
95+
- name: Get pnpm store directory
96+
id: pnpm-store
97+
shell: bash
98+
run: echo "path=$(pnpm store path)" >> $GITHUB_OUTPUT
99+
100+
- name: Cache pnpm store
101+
uses: actions/cache@v4
102+
with:
103+
path: ${{ steps.pnpm-store.outputs.path }}
104+
key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
105+
restore-keys: |
106+
${{ runner.os }}-pnpm-store-
107+
108+
- name: Install dependencies
109+
run: pnpm install --frozen-lockfile
110+
111+
- name: typecheck
112+
run: pnpm run typecheck
113+
78114
prettier:
79115
runs-on: ubuntu-latest
80-
needs: [install]
81116
steps:
82117
- uses: actions/checkout@v6
83118
- uses: pnpm/action-setup@v4
84119
- uses: actions/setup-node@v6
85120
with:
121+
<<<<<<< HEAD
86122
node-version-file: 'package.json'
123+
=======
124+
node-version-file: '.nvmrc'
125+
>>>>>>> origin/main
87126

88127
- name: Get pnpm store directory
89128
id: pnpm-store
@@ -112,13 +151,16 @@ jobs:
112151
113152
lint:
114153
runs-on: ubuntu-latest
115-
needs: [install]
116154
steps:
117155
- uses: actions/checkout@v6
118156
- uses: pnpm/action-setup@v4
119157
- uses: actions/setup-node@v6
120158
with:
159+
<<<<<<< HEAD
121160
node-version-file: 'package.json'
161+
=======
162+
node-version-file: '.nvmrc'
163+
>>>>>>> origin/main
122164

123165
- name: Get pnpm store directory
124166
id: pnpm-store
@@ -141,13 +183,16 @@ jobs:
141183

142184
test:
143185
runs-on: ubuntu-latest
144-
needs: [build]
145186
steps:
146187
- uses: actions/checkout@v6
147188
- uses: pnpm/action-setup@v4
148189
- uses: actions/setup-node@v6
149190
with:
191+
<<<<<<< HEAD
150192
node-version-file: 'package.json'
193+
=======
194+
node-version-file: '.nvmrc'
195+
>>>>>>> origin/main
151196

152197
- name: Get pnpm store directory
153198
id: pnpm-store

0 commit comments

Comments
 (0)