Frontend: verify cosmes fork patches in CI #367

New issue

2026-06-12T05:05:53Z

PlasticDigits commented

2026-06-12 05:05:53 +00:00

(Migrated from gitlab.com)

Parent

Gap analysis follow-up from GitLab #361 — register item M9 (forked @goblinhunt/cosmes + patch-package).

Current codebase

Dependency: @goblinhunt/cosmes ^0.0.71-ghunt.21 in frontend-dapp/package.json.
postinstall: patch-package applies patches under frontend-dapp/patches/.
Regression: frontend-dapp/src/services/terraclassic/__tests__/cosmesPatch127.test.ts reads built node_modules/@goblinhunt/cosmes/dist/... for Keplr fee-guard strings (#127, #208).
If postinstall is skipped (npm ci --ignore-scripts, broken CI cache), wallet signing guards silently disappear.

Why needed

Wallet integration depends on a forked cosmes with local patches for Keplr preferNoSetFee, post-sign fee assertions, and Station amino signing. Supply-chain drift without verification risks underpriced txs or broken extension signing in production builds.

Constraints / guardrails

Do not upgrade cosmes major/fork version without re-running Keplr E2E (#361 H12 is separate).
Pin exact version in lockfile; document upstream merge tracking.
No MR-hosted CI gate required — add verification to existing make test-frontend / lint path.

Relevant files

frontend-dapp/package.json, package-lock.json
frontend-dapp/patches/@goblinhunt+cosmes+*.patch
frontend-dapp/src/services/terraclassic/__tests__/cosmesPatch127.test.ts
scripts/with-node.sh
skills/AGENTS_FRONTEND_TX_BROADCAST_TIMEOUT.md

Recommended direction

Patch hash gate: CI/Makefile step that hashes patches/@goblinhunt+cosmes*.patch and fails if patch file changes without updating a committed patches/.cosmes-patch-sha256 (or extend cosmesPatch127 test).
Verify postinstall: make test-frontend or npm run postinstall in CI docs must run before cosmes tests.
Document: docs/frontend.md section on fork rationale, patch contents, and upgrade checklist.
Track upstream @goblinhunt/cosmes issues for eventual un-fork.

Acceptance criteria

Test fails when patch file is modified but expected hash/fixture not updated.
Test fails when node_modules/@goblinhunt/cosmes lacks patched symbols (simulates --ignore-scripts).
Operator doc lists required postinstall and patch upgrade steps.
make test-frontend includes cosmes patch verification.

Test plan

Path	Command / action
Unit	`make test-frontend` — `cosmesPatch127.test.ts`
Negative	Temporarily rename patch → expect failure
Install	Fresh `npm ci` in `frontend-dapp` → tests pass

Attack / abuse test plan

Patch verification must use content hash, not merely file presence.
Do not fetch cosmes from mutable dist tags without lockfile pin.

Verification criteria

Deliberately removing a patched string from node_modules fails make test-frontend.
README/docs mention fork + patch-package requirement for production builds.

## Parent Gap analysis follow-up from [GitLab #361](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/361) — register item **M9** (forked `@goblinhunt/cosmes` + patch-package). ## Current codebase - Dependency: `@goblinhunt/cosmes` `^0.0.71-ghunt.21` in `frontend-dapp/package.json`. - `postinstall`: `patch-package` applies patches under `frontend-dapp/patches/`. - Regression: `frontend-dapp/src/services/terraclassic/__tests__/cosmesPatch127.test.ts` reads **built** `node_modules/@goblinhunt/cosmes/dist/...` for Keplr fee-guard strings ([#127](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/127), [#208](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/208)). - If `postinstall` is skipped (`npm ci --ignore-scripts`, broken CI cache), wallet signing guards silently disappear. ## Why needed Wallet integration depends on a **forked** cosmes with local patches for Keplr `preferNoSetFee`, post-sign fee assertions, and Station amino signing. Supply-chain drift without verification risks underpriced txs or broken extension signing in production builds. ## Constraints / guardrails - Do not upgrade cosmes major/fork version without re-running Keplr E2E ([#361](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/361) H12 is separate). - Pin exact version in lockfile; document upstream merge tracking. - No MR-hosted CI gate required — add verification to existing `make test-frontend` / lint path. ## Relevant files - `frontend-dapp/package.json`, `package-lock.json` - `frontend-dapp/patches/@goblinhunt+cosmes+*.patch` - `frontend-dapp/src/services/terraclassic/__tests__/cosmesPatch127.test.ts` - `scripts/with-node.sh` - `skills/AGENTS_FRONTEND_TX_BROADCAST_TIMEOUT.md` ## Recommended direction 1. **Patch hash gate**: CI/Makefile step that hashes `patches/@goblinhunt+cosmes*.patch` and fails if patch file changes without updating a committed `patches/.cosmes-patch-sha256` (or extend cosmesPatch127 test). 2. **Verify postinstall**: `make test-frontend` or `npm run postinstall` in CI docs must run before cosmes tests. 3. **Document**: `docs/frontend.md` section on fork rationale, patch contents, and upgrade checklist. 4. Track upstream `@goblinhunt/cosmes` issues for eventual un-fork. ## Acceptance criteria - [ ] Test fails when patch file is modified but expected hash/fixture not updated. - [ ] Test fails when `node_modules/@goblinhunt/cosmes` lacks patched symbols (simulates `--ignore-scripts`). - [ ] Operator doc lists required `postinstall` and patch upgrade steps. - [ ] `make test-frontend` includes cosmes patch verification. ## Test plan | Path | Command / action | |------|------------------| | Unit | `make test-frontend` — `cosmesPatch127.test.ts` | | Negative | Temporarily rename patch → expect failure | | Install | Fresh `npm ci` in `frontend-dapp` → tests pass | ## Attack / abuse test plan - Patch verification must use content hash, not merely file presence. - Do not fetch cosmes from mutable dist tags without lockfile pin. ## Verification criteria - Deliberately removing a patched string from `node_modules` fails `make test-frontend`. - README/docs mention fork + patch-package requirement for production builds.

PlasticDigits commented

2026-06-12 05:06:04 +00:00

(Migrated from gitlab.com)

mentioned in issue #361

PlasticDigits commented

2026-06-12 05:13:48 +00:00

(Migrated from gitlab.com)

mentioned in commit 2850dc8296

mentioned in commit 2850dc8296a45b6be2f4ad3417f5393c8e2666ca

PlasticDigits commented

2026-06-12 05:13:56 +00:00

(Migrated from gitlab.com)

mentioned in merge request !871

ghost1 commented

2026-06-12 05:17:44 +00:00

(Migrated from gitlab.com)

mentioned in commit c0ba255dc0

mentioned in commit c0ba255dc0c35eb21b09c7be1937c3c49aa7071c

Brouie commented

2026-06-12 07:30:31 +00:00

(Migrated from gitlab.com)

Verified !871 live (INT-00-04 territory).

Ran cosmesPatch127.test.ts against the branch's version with my installed node_modules:

Positive: all 3 tests pass — the patch SHA-256 matches the committed patches/.cosmes-patch-sha256, and the patched-symbol assertions (EXTENSION_SIGN_OPTIONS, preferNoSetFee: true, assertExtensionSignedFeeMeetsExpected, the fee-undershoot guard) all find the symbols in node_modules/@goblinhunt/cosmes.
Negative: corrupted the committed hash to a bogus value -> the SHA-256 test correctly FAILS (the other two skip). Proves AC1 (drift caught when the patch file changes without the fixture updating).

AC mapping:

AC1 (fails on patch-without-fixture drift): proven by the negative run.
AC2 (fails when node_modules lacks patched symbols / --ignore-scripts): the symbol-presence assertions cover it; passed against patched install.
AC4 (make test-frontend includes it): it's a vitest test under tests, so the frontend suite runs it.
AC3 (operator postinstall/upgrade docs): docs/frontend.md + docs/testing.md in the diff.

Good from my side.

Verified !871 live (INT-00-04 territory). Ran cosmesPatch127.test.ts against the branch's version with my installed node_modules: - Positive: all 3 tests pass — the patch SHA-256 matches the committed patches/.cosmes-patch-sha256, and the patched-symbol assertions (EXTENSION_SIGN_OPTIONS, preferNoSetFee: true, assertExtensionSignedFeeMeetsExpected, the fee-undershoot guard) all find the symbols in node_modules/@goblinhunt/cosmes. - Negative: corrupted the committed hash to a bogus value -> the SHA-256 test correctly FAILS (the other two skip). Proves AC1 (drift caught when the patch file changes without the fixture updating). AC mapping: - AC1 (fails on patch-without-fixture drift): proven by the negative run. - AC2 (fails when node_modules lacks patched symbols / --ignore-scripts): the symbol-presence assertions cover it; passed against patched install. - AC4 (make test-frontend includes it): it's a vitest test under __tests__, so the frontend suite runs it. - AC3 (operator postinstall/upgrade docs): docs/frontend.md + docs/testing.md in the diff. Good from my side.

PlasticDigits commented

2026-06-12 07:55:00 +00:00

(Migrated from gitlab.com)

mentioned in commit a88cdb2370

mentioned in commit a88cdb23707769629615b9bc0b0a297fc0ab9ef6

PlasticDigits commented

2026-06-12 08:05:58 +00:00

(Migrated from gitlab.com)

Verification — #367 (cosmes fork patches in CI)

Verified on main at 6205054 (includes merged !871). No repo changes required.

Acceptance criteria

Criterion	Result	How verified
Test fails when patch file is modified but hash/fixture not updated	PASS	Appended a byte to `patches/@goblinhunt+cosmes+0.0.71-ghunt.21.patch` → `cosmesPatch127.test.ts` hash test failed (other two passed). Also corrupted `patches/.cosmes-patch-sha256` → hash test failed.
Test fails when `node_modules/@goblinhunt/cosmes` lacks patched symbols (`--ignore-scripts`)	PASS	`sed` removed `assertExtensionSignedFeeMeetsExpected` from `KeplrExtension.js` → Keplr symbol test failed. Fresh `npm ci --ignore-scripts` → 2/3 tests failed (hash OK, Keplr + Station symbol checks failed).
Operator doc lists `postinstall` and patch upgrade steps	PASS	`docs/frontend.md` § Forked cosmes: invariants, `postinstall` requirement, 5-step upgrade checklist. Cross-linked from `docs/testing.md` and `skills/AGENTS_TERRACLASSIC_GAS.md`.
`make test-frontend` includes cosmes patch verification	PASS	`make test-frontend` — 957 tests passed; `cosmesPatch127.test.ts` ×3 (hash + Keplr + Station).

Additional checks (issue test plan)

Step	Result	Command
Fresh install with patches applied	PASS	`rm -rf frontend-dapp/node_modules && bash scripts/with-node.sh --cwd frontend-dapp -- npm ci` → `cosmesPatch127.test.ts` ×3 pass
Full frontend suite	PASS	`make test-frontend`

Artifacts in tree

frontend-dapp/patches/.cosmes-patch-sha256 — committed SHA-256 gate
frontend-dapp/src/services/terraclassic/__tests__/cosmesPatch127.test.ts — lockfile-resolved patch path, hash + symbol assertions

Closing — implementation landed in !871; verification complete.

## Verification — #367 (cosmes fork patches in CI) Verified on `main` at `6205054` (includes merged !871). No repo changes required. ### Acceptance criteria | Criterion | Result | How verified | |-----------|--------|--------------| | Test fails when patch file is modified but hash/fixture not updated | **PASS** | Appended a byte to `patches/@goblinhunt+cosmes+0.0.71-ghunt.21.patch` → `cosmesPatch127.test.ts` hash test failed (other two passed). Also corrupted `patches/.cosmes-patch-sha256` → hash test failed. | | Test fails when `node_modules/@goblinhunt/cosmes` lacks patched symbols (`--ignore-scripts`) | **PASS** | `sed` removed `assertExtensionSignedFeeMeetsExpected` from `KeplrExtension.js` → Keplr symbol test failed. Fresh `npm ci --ignore-scripts` → 2/3 tests failed (hash OK, Keplr + Station symbol checks failed). | | Operator doc lists `postinstall` and patch upgrade steps | **PASS** | `docs/frontend.md` § [Forked cosmes](docs/frontend.md#cosmes-fork-patches): invariants, `postinstall` requirement, 5-step upgrade checklist. Cross-linked from `docs/testing.md` and `skills/AGENTS_TERRACLASSIC_GAS.md`. | | `make test-frontend` includes cosmes patch verification | **PASS** | `make test-frontend` — 957 tests passed; `cosmesPatch127.test.ts` ×3 (hash + Keplr + Station). | ### Additional checks (issue test plan) | Step | Result | Command | |------|--------|---------| | Fresh install with patches applied | **PASS** | `rm -rf frontend-dapp/node_modules && bash scripts/with-node.sh --cwd frontend-dapp -- npm ci` → `cosmesPatch127.test.ts` ×3 pass | | Full frontend suite | **PASS** | `make test-frontend` | ### Artifacts in tree - `frontend-dapp/patches/.cosmes-patch-sha256` — committed SHA-256 gate - `frontend-dapp/src/services/terraclassic/__tests__/cosmesPatch127.test.ts` — lockfile-resolved patch path, hash + symbol assertions Closing — implementation landed in !871; verification complete.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-12 08:05:59 +00:00

PlasticDigits commented

2026-06-12 11:17:44 +00:00

(Migrated from gitlab.com)

mentioned in merge request !884