fix(frontend): reject production VITE_DEV_MODE=true (FE-01) #1192

Merged

PlasticDigits merged 2 commits from feat/695-reject-prod-vite-dev-mode into main

2026-08-28 11:04:03 +00:00

PlasticDigits commented

2026-08-28 09:39:03 +00:00

(Migrated from gitlab.com)

Closes #695.

Summary

Production vite build --mode production now fails closed when VITE_DEV_MODE=true, so a Coolify / .env.production mistake cannot ship Simulated Wallet chrome on dex.cl8y.com (audit FE-01).
VITE_ALLOW_DEV_MNEMONIC=local-only does not bypass the flag. Development, LocalTerra, Vitest, Playwright, and vite build --mode staging still keep VITE_DEV_MODE=true.
Adds make verify-issue-695, docs/invariants, and the third-party playbook skills/AGENTS_FRONTEND_DEV_MODE_GUARD.md (D695-1–D695-8).

Does not reopen mnemonic (#118 / #378) or WalletConnect project-id guards. Does not change CSP, WalletConnect, clickwrap, or the runtime devWallet.ts gate.

Test plan

viteConfig.build.test.ts: production + VITE_DEV_MODE=true throws /VITE_DEV_MODE/; unset/false loads; development/staging/serve still load
VITE_DEV_MODE=true VITE_WC_PROJECT_ID=x npx vite build --mode production exits non-zero with Coolify / .env.production guidance
make verify-issue-695 green (retested)
Operator: Coolify production env has VITE_DEV_MODE unset (record on #695)
LocalTerra Simulated Wallet still appears when .env.development sets both flags

Closes #695. ## Summary - Production `vite build --mode production` now fails closed when `VITE_DEV_MODE=true`, so a Coolify / `.env.production` mistake cannot ship Simulated Wallet chrome on `dex.cl8y.com` (audit FE-01). - `VITE_ALLOW_DEV_MNEMONIC=local-only` does not bypass the flag. Development, LocalTerra, Vitest, Playwright, and `vite build --mode staging` still keep `VITE_DEV_MODE=true`. - Adds `make verify-issue-695`, docs/invariants, and the third-party playbook `skills/AGENTS_FRONTEND_DEV_MODE_GUARD.md` (D695-1–D695-8). Does not reopen mnemonic (#118 / #378) or WalletConnect project-id guards. Does not change CSP, WalletConnect, clickwrap, or the runtime `devWallet.ts` gate. ## Test plan - [x] `viteConfig.build.test.ts`: production + `VITE_DEV_MODE=true` throws `/VITE_DEV_MODE/`; unset/`false` loads; development/staging/serve still load - [x] `VITE_DEV_MODE=true VITE_WC_PROJECT_ID=x npx vite build --mode production` exits non-zero with Coolify / `.env.production` guidance - [x] `make verify-issue-695` green (retested) - [ ] Operator: Coolify production env has `VITE_DEV_MODE` unset (record on #695) - [ ] LocalTerra Simulated Wallet still appears when `.env.development` sets both flags

PlasticDigits commented

2026-08-28 09:39:11 +00:00

(Migrated from gitlab.com)

mentioned in issue #695

PlasticDigits commented

2026-08-28 11:03:03 +00:00

(Migrated from gitlab.com)

added 42 commits

3d3edc9a...3c4060ab - 41 commits from branch main
db18cee3 - Merge origin/main into feat/695-reject-prod-vite-dev-mode

Compare with previous version

added 42 commits <ul><li>3d3edc9a...3c4060ab - 41 commits from branch <code>main</code></li><li>db18cee3 - Merge origin/main into feat/695-reject-prod-vite-dev-mode</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/474/diffs?diff_id=1990378943&start_sha=3d3edc9acca6ca493ffbdc1739969f44dcdae12d)