Official token directory and Render clickjacking headers

PlasticDigits commented

2026-08-25 13:10:04 +00:00

(Migrated from gitlab.com)

Summary

Replaces the #token placeholder with a three-part official directory (addresses, DEX trade venues, listings) sourced from src/data/tokenDirectory.ts. CL8Y DEX is first; AscendEX and Coinbase are gone. MegaETH (already official on main) stays, with Kumbaya and SIR as DEX alternatives.
Adds copy-to-clipboard from the typed address constants, hash-scroll for header/footer Token links, and clickjacking headers in render.yaml (X-Frame-Options: DENY, frame-ancestors 'none') without dropping blog prerender routes.
Documents invariants for third-party agents in skills/cl8y-token-directory and skills/cl8y-host-headers, cross-linked from positioning, AGENTS.md, and PROJECT_GUIDE.md.

This is a clean implementation on current main. Please close !9 — that branch deletes the blog, prerender, and MegaETH venues.

Closes #2
Closes #3

Test plan

Cold load / and tap Token in the header (desktop + wrapped mobile). Section #token scrolls into view.
Repeat from the footer Token link and from a cold /#token load.
BSC row shows 0x8F452a1fdd388A45e1080992eFF051b4dd9048d2. Copy → clipboard matches exactly. Explorer opens BscScan.
Terra row shows the full CW20 address. Copy matches. Explorer opens Terra Finder.
MegaETH row shows 0xfBAa45A537cF07dC768c469FfaC4e88208B0098D. Copy matches.
Deny clipboard permission: failure text appears; address stays selectable.
Trade group: CL8Y DEX first, then TidalDex / PancakeSwap / Uniswap / GDEX / Kumbaya / SIR only. No CEX. No “More exchanges”.
Listings are a separate group and do not say “Trade on …”. Coinbase is absent.
Search src/data, PROJECT_GUIDE.md, rendered /, and dist/ for ascendex.com — zero hits.
Blog sidebar no longer says “Buy CL8Y” or links AscendEX.
yarn test, yarn typecheck, yarn lint, yarn build. Optional: yarn preview then yarn test:e2e.
After deploy: curl -sI https://cl8y.com shows X-Frame-Options: DENY and/or frame-ancestors 'none'. Confirm the same on the Render URL.

## Summary - Replaces the `#token` placeholder with a three-part official directory (addresses, DEX trade venues, listings) sourced from `src/data/tokenDirectory.ts`. CL8Y DEX is first; AscendEX and Coinbase are gone. MegaETH (already official on `main`) stays, with Kumbaya and SIR as DEX alternatives. - Adds copy-to-clipboard from the typed address constants, hash-scroll for header/footer Token links, and clickjacking headers in `render.yaml` (`X-Frame-Options: DENY`, `frame-ancestors 'none'`) **without** dropping blog prerender routes. - Documents invariants for third-party agents in `skills/cl8y-token-directory` and `skills/cl8y-host-headers`, cross-linked from positioning, `AGENTS.md`, and `PROJECT_GUIDE.md`. This is a clean implementation on current `main`. Please **close !9** — that branch deletes the blog, prerender, and MegaETH venues. Closes #2 Closes #3 ## Test plan - [ ] Cold load `/` and tap **Token** in the header (desktop + wrapped mobile). Section `#token` scrolls into view. - [ ] Repeat from the footer Token link and from a cold `/#token` load. - [ ] BSC row shows `0x8F452a1fdd388A45e1080992eFF051b4dd9048d2`. Copy → clipboard matches exactly. Explorer opens BscScan. - [ ] Terra row shows the full CW20 address. Copy matches. Explorer opens Terra Finder. - [ ] MegaETH row shows `0xfBAa45A537cF07dC768c469FfaC4e88208B0098D`. Copy matches. - [ ] Deny clipboard permission: failure text appears; address stays selectable. - [ ] Trade group: CL8Y DEX first, then TidalDex / PancakeSwap / Uniswap / GDEX / Kumbaya / SIR only. No CEX. No “More exchanges”. - [ ] Listings are a separate group and do not say “Trade on …”. Coinbase is absent. - [ ] Search `src/data`, `PROJECT_GUIDE.md`, rendered `/`, and `dist/` for `ascendex.com` — zero hits. - [ ] Blog sidebar no longer says “Buy CL8Y” or links AscendEX. - [ ] `yarn test`, `yarn typecheck`, `yarn lint`, `yarn build`. Optional: `yarn preview` then `yarn test:e2e`. - [ ] After deploy: `curl -sI https://cl8y.com` shows `X-Frame-Options: DENY` and/or `frame-ancestors 'none'`. Confirm the same on the Render URL.

PlasticDigits commented

2026-08-25 13:10:11 +00:00

(Migrated from gitlab.com)

mentioned in merge request !9