fix(e2e): cloud agent SDK53 verification — deploy pair + Playwright LT12 (#292) #836

2026-06-08T07:23:36Z

PlasticDigits commented

2026-06-08 07:23:36 +00:00

(Migrated from gitlab.com)

Summary

Cloud Agent full verification for GitLab #292. SDK 53 / terrad v4 stack is already on main; this MR fixes cloud E2E guardrails discovered during verification:

Deploy-pair drift: E2E specs hardcoded a stale EMBER/CORAL bech32; fresh deploy-dex-local on SDK53 volumes produces a different pair_address. Added e2e/helpers/deploy-pair.ts, set E2E_TRADE_PAIR in global-setup.ts from .qa-deploy-stamp.
Smoke locator fixes: pool pair-count strict mode (#292 indexer note duplicate), Trade heading exact: true (#179), mobile wallet LUNC scoped to .sm:hidden chip (#186).
LT12: setup-cloud-localterra now runs npm ci (if needed) + locked playwright install chromium (includes headless shell).

Acceptance checklist (#292)

Criterion	Command / step	Result
1. Fresh clone → reset → start → wait-healthy → deploy-local → dev	`make setup-cloud-localterra` on Cloud VM	PASS — terrad 4.0.1, digest `sha256:29e2d1…2faf`, 25 pairs
2. `make test` (contracts + frontend unit)	`make test-contracts` + `make test-frontend`	PASS — 438 contract + 893 Vitest
3. Strict `make test-e2e`	`sg docker -c 'CI=1 make test-e2e'` after LT11/LT12	PARTIAL — smoke 105/106; tx 33/38
4. `make test-qa-verify-deploy`	`make test-qa-verify-deploy`	PASS
Indexer integration	`make test-indexer-integration`	PASS
Host LCD LT9	`make test-localterra-host-curl`	PASS

Verification commands (third parties)

make setup-cloud-localterra
bash scripts/e2e-start-indexer.sh
sg docker -c 'CI=1 make test-e2e'
make test-qa-verify-deploy

Blockers (issue stays open)

#178 smoke: trade-book Edit copy/limit-ticket UI — tracked separately, not SDK53.
#259 tx: e2e-seed-expired-parked-claim-all.sh fails on current chain.
wrap-pool E7 tx: LUNC-C Provide Liquidity button timeout.

Core SDK53 paths verified: wasm upload/instantiate/execute, indexer v4 tx-search sync, deploy scripts, signing/broadcast in 33/38 on-chain tx specs.

Related: docs/localterra-sdk53.md LT11–LT12.

Note

Low Risk
Test harness, docs, and artifact checksums only—no runtime app or on-chain logic changes.

Overview
Fixes cloud E2E guardrails for SDK 53 LocalTerra verification (#292): trade specs no longer assume a fixed factory pair bech32 after fresh deploy-dex-local.

Deploy-pair resolution: New e2e/helpers/deploy-pair.ts reads E2E_TRADE_PAIR or .qa-deploy-stamp pair_address (with optional-chain legacy fallback). global-setup.ts sets E2E_TRADE_PAIR from the stamp; trade/chart/outage specs use the helper instead of a hardcoded EMBER/CORAL address.

Playwright smoke tweaks: Pool pair count matches (indexer total) copy; Trade heading uses exact: true; mobile wallet LUNC is scoped to the .sm:hidden chip.

Cloud agent LT12: setup-cloud-agent-localterra.sh runs npm ci when needed and locked playwright install chromium (incl. headless shell). Docs LT12 note expanded accordingly.

Artifacts: smartcontracts/artifacts/checksums.txt updates factory/pair/router wasm digests (and trims entries present in the prior file).

^{Reviewed by Cursor Bugbot for commit e91f159716. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Cloud Agent full verification for [GitLab #292](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/292). SDK 53 / terrad v4 stack is already on `main`; this MR fixes **cloud E2E guardrails** discovered during verification: - **Deploy-pair drift**: E2E specs hardcoded a stale EMBER/CORAL bech32; fresh `deploy-dex-local` on SDK53 volumes produces a different `pair_address`. Added `e2e/helpers/deploy-pair.ts`, set `E2E_TRADE_PAIR` in `global-setup.ts` from `.qa-deploy-stamp`. - **Smoke locator fixes**: pool pair-count strict mode (#292 indexer note duplicate), Trade heading `exact: true` (#179), mobile wallet LUNC scoped to `.sm:hidden` chip (#186). - **LT12**: `setup-cloud-localterra` now runs `npm ci` (if needed) + locked `playwright install chromium` (includes headless shell). ## Acceptance checklist (#292) | Criterion | Command / step | Result | |-----------|----------------|--------| | 1. Fresh clone → reset → start → wait-healthy → deploy-local → dev | `make setup-cloud-localterra` on Cloud VM | **PASS** — terrad **4.0.1**, digest `sha256:29e2d1…2faf`, 25 pairs | | 2. `make test` (contracts + frontend unit) | `make test-contracts` + `make test-frontend` | **PASS** — 438 contract + **893** Vitest | | 3. Strict `make test-e2e` | `sg docker -c 'CI=1 make test-e2e'` after LT11/LT12 | **PARTIAL** — smoke **105/106**; tx **33/38** | | 4. `make test-qa-verify-deploy` | `make test-qa-verify-deploy` | **PASS** | | Indexer integration | `make test-indexer-integration` | **PASS** | | Host LCD LT9 | `make test-localterra-host-curl` | **PASS** | ### Verification commands (third parties) ```bash make setup-cloud-localterra bash scripts/e2e-start-indexer.sh sg docker -c 'CI=1 make test-e2e' make test-qa-verify-deploy ``` ## Blockers (issue stays open) - **#178** smoke: trade-book Edit copy/limit-ticket UI — tracked separately, not SDK53. - **#259** tx: `e2e-seed-expired-parked-claim-all.sh` fails on current chain. - **wrap-pool E7** tx: LUNC-C Provide Liquidity button timeout. Core SDK53 paths verified: wasm upload/instantiate/execute, indexer v4 tx-search sync, deploy scripts, signing/broadcast in **33/38** on-chain tx specs. Related: [`docs/localterra-sdk53.md`](docs/localterra-sdk53.md) LT11–LT12.  --- > [!NOTE] > **Low Risk** > Test harness, docs, and artifact checksums only—no runtime app or on-chain logic changes. > > **Overview** > Fixes **cloud E2E guardrails** for SDK 53 LocalTerra verification (#292): trade specs no longer assume a fixed factory pair bech32 after fresh `deploy-dex-local`. > > **Deploy-pair resolution:** New `e2e/helpers/deploy-pair.ts` reads `E2E_TRADE_PAIR` or `.qa-deploy-stamp` `pair_address` (with optional-chain legacy fallback). `global-setup.ts` sets `E2E_TRADE_PAIR` from the stamp; trade/chart/outage specs use the helper instead of a hardcoded EMBER/CORAL address. > > **Playwright smoke tweaks:** Pool pair count matches `(indexer total)` copy; Trade heading uses `exact: true`; mobile wallet LUNC is scoped to the `.sm:hidden` chip. > > **Cloud agent LT12:** `setup-cloud-agent-localterra.sh` runs `npm ci` when needed and locked `playwright install chromium` (incl. headless shell). Docs **LT12** note expanded accordingly. > > **Artifacts:** `smartcontracts/artifacts/checksums.txt` updates factory/pair/router wasm digests (and trims entries present in the prior file). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e91f159716b110e47dbe560ac5d40c2d8a8a78ff. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-08 07:23:44 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-08 07:23:52 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-08 07:24:13 +00:00

(Migrated from gitlab.com)

mentioned in issue #292

PlasticDigits commented

2026-06-08 07:25:44 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: b023bd2b2600e44e51ac98fc1391a04bc58afc4d
Scope: 11 files — E2E deploy-pair helper, Playwright global-setup, smoke locator fixes, setup-cloud-agent-localterra.sh LT12 Playwright install, docs, smartcontracts/artifacts/checksums.txt

Outcome: FINDINGS: 0 medium+ — NONE

Summary

Reviewed added/modified paths for injection, authn/authz, secret leakage, SSRF/XSS, path traversal, and supply-chain regressions. All changes are confined to local E2E / Cloud Agent setup; no production frontend, indexer API, or on-chain contract logic is touched.

Area	Assessment
`e2e/helpers/deploy-pair.ts` + `global-setup.ts`	Reads `E2E_TRADE_PAIR` or `.qa-deploy-stamp` `pair_address` via regex (no shell `source`). Values flow only into Playwright `page.goto('/trade/…')` and local indexer smoke requests during CI/dev E2E — not user-facing runtime. Attacker would need write access to the dev/CI workspace stamp or env; out of production threat model.
Smoke locator tweaks (`navigation`, `pool`, `trade-page-initial-load`)	Test selectors only.
`setup-cloud-agent-localterra.sh` `_ensure_playwright_browsers`	Runs locked `npm ci` + `./node_modules/.bin/playwright install chromium` from existing `package-lock.json`; no new dependencies or user-controlled command injection.
`checksums.txt`	Artifact digest refresh after SDK53 rebuild; file is not referenced by deploy verification (`wasm-checksums.txt` is the CI artifact). No deploy bypass introduced.

No inline threads — nothing to anchor on the diff.

Automated security review (Cursor Cloud Agent)

## Security review **Commit reviewed:** `b023bd2b2600e44e51ac98fc1391a04bc58afc4d` **Scope:** 11 files — E2E deploy-pair helper, Playwright global-setup, smoke locator fixes, `setup-cloud-agent-localterra.sh` LT12 Playwright install, docs, `smartcontracts/artifacts/checksums.txt` **Outcome:** `FINDINGS: 0` medium+ — **NONE** ### Summary Reviewed added/modified paths for injection, authn/authz, secret leakage, SSRF/XSS, path traversal, and supply-chain regressions. All changes are confined to **local E2E / Cloud Agent setup**; no production frontend, indexer API, or on-chain contract logic is touched. | Area | Assessment | |------|------------| | `e2e/helpers/deploy-pair.ts` + `global-setup.ts` | Reads `E2E_TRADE_PAIR` or `.qa-deploy-stamp` `pair_address` via regex (no shell `source`). Values flow only into Playwright `page.goto('/trade/…')` and local indexer smoke requests during CI/dev E2E — not user-facing runtime. Attacker would need write access to the dev/CI workspace stamp or env; out of production threat model. | | Smoke locator tweaks (`navigation`, `pool`, `trade-page-initial-load`) | Test selectors only. | | `setup-cloud-agent-localterra.sh` `_ensure_playwright_browsers` | Runs locked `npm ci` + `./node_modules/.bin/playwright install chromium` from existing `package-lock.json`; no new dependencies or user-controlled command injection. | | `checksums.txt` | Artifact digest refresh after SDK53 rebuild; file is not referenced by deploy verification (`wasm-checksums.txt` is the CI artifact). No deploy bypass introduced. | No inline threads — nothing to anchor on the diff. --- *Automated security review (Cursor Cloud Agent)*

ghost1 commented

2026-06-08 07:25:53 +00:00

(Migrated from gitlab.com)

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit b023bd2b26. Configure here.}

Cursor Bugbot has reviewed your changes and found 1 potential issue.  <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aTo5OTQ4ZjFjYy05ZmM1LTQ0MzAtYTMxYS02ZjI1Zjg5NzNkOTIiLCJlbmNyeXB0aW9uS2V5IjoiMS0zWUd2dkdIbml3WXc2YVVXTTY0OFF5RDNxRmJUN3F5anJhV1FiRWl4WSIsImJyYW5jaCI6ImN1cnNvci9naXRsYWItaXNzdWUtd29ya2Zsb3ctYjBlNCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>   <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. </sup>  <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit b023bd2b2600e44e51ac98fc1391a04bc58afc4d. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-08 07:25:54 +00:00

(Migrated from gitlab.com)

Skip-chain smoke fails import

Medium Severity

Calling e2eTradePairFromDeploy() at module load throws when E2E_TRADE_PAIR and .qa-deploy-stamp are absent. With PLAYWRIGHT_SKIP_CHAIN=1, global-setup.ts is disabled and specs that used a hardcoded pair fallback now fail during collection before per-test test.skip can run.

Additional Locations (2)

^{Reviewed by Cursor Bugbot for commit b023bd2b26. Configure here.}

### Skip-chain smoke fails import **Medium Severity**  Calling `e2eTradePairFromDeploy()` at module load throws when `E2E_TRADE_PAIR` and `.qa-deploy-stamp` are absent. With `PLAYWRIGHT_SKIP_CHAIN=1`, `global-setup.ts` is disabled and specs that used a hardcoded pair fallback now fail during collection before per-test `test.skip` can run.    <details> <summary>Additional Locations (2)</summary> - [`frontend-dapp/e2e/price-chart-smoke.spec.ts#L13-L14`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-//blob/b023bd2b2600e44e51ac98fc1391a04bc58afc4d/frontend-dapp/e2e/price-chart-smoke.spec.ts#L13-L14) - [`frontend-dapp/e2e/trade-book-edit-178.spec.ts#L7-L8`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-//blob/b023bd2b2600e44e51ac98fc1391a04bc58afc4d/frontend-dapp/e2e/trade-book-edit-178.spec.ts#L7-L8) </details> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmVmZGQ4OTA1LWUwNjQtNDJiNC1hYTE2LTJkYjQzYjk1ZGNhZiIsImVuY3J5cHRpb25LZXkiOiJDNUlsa2NYZzdtTFlBSkNiQkN3LXZwd1NhLWxxdEVHLTA1N2lLQ1NreHc4IiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1iMGU0IiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmVmZGQ4OTA1LWUwNjQtNDJiNC1hYTE2LTJkYjQzYjk1ZGNhZiIsImVuY3J5cHRpb25LZXkiOiJDNUlsa2NYZzdtTFlBSkNiQkN3LXZwd1NhLWxxdEVHLTA1N2lLQ1NreHc4IiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1iMGU0IiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIiwicHJOdW1iZXIiOjExOCwiY29tbWl0U2hhIjoiYjAyM2JkMmIyNjAwZTQ0ZTUxYWM5OGZjMTM5MWEwNGJjNThhZmM0ZCIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit b023bd2b2600e44e51ac98fc1391a04bc58afc4d. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-08 07:27:43 +00:00

(Migrated from gitlab.com)

added 1 commit

e91f1597 - fix(e2e): allow skip-chain smoke to import specs without deploy stamp

Compare with previous version

added 1 commit <ul><li>e91f1597 - fix(e2e): allow skip-chain smoke to import specs without deploy stamp</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/118/diffs?diff_id=1839051796&start_sha=b023bd2b2600e44e51ac98fc1391a04bc58afc4d)

ghost1 commented

2026-06-08 07:27:54 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-08 07:28:01 +00:00

(Migrated from gitlab.com)

resolved all threads

PlasticDigits commented

2026-06-08 07:29:52 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: e91f159716b110e47dbe560ac5d40c2d8a8a78ff
Scope: 11 files — e2e/helpers/deploy-pair.ts (incl. optional-chain legacy fallback), Playwright global-setup.ts, smoke locator fixes, setup-cloud-agent-localterra.sh LT12 Playwright install, docs, smartcontracts/artifacts/checksums.txt

Outcome: FINDINGS: 0 medium+ — NONE

Summary

Re-reviewed the full MR diff (including commit e91f159 fixing skip-chain spec import) for injection, authn/authz, secret leakage, SSRF/XSS, path traversal, and supply-chain regressions. All changes remain confined to local E2E / Cloud Agent setup; no production frontend, indexer API, or on-chain contract logic is touched.

Area	Assessment
`e2e/helpers/deploy-pair.ts` + `global-setup.ts`	Reads `E2E_TRADE_PAIR` or `.qa-deploy-stamp` `pair_address` via anchored regex (no shell `source`). Values flow only into Playwright `page.goto('/trade/…')` and local indexer smoke `request.get` during CI/dev E2E — not user-facing runtime. Attacker would need write access to the dev/CI workspace stamp or env; out of production threat model. Optional-chain legacy fallback is a hardcoded bech32 constant (same trust as prior inline default).
Smoke locator tweaks (`navigation`, `pool`, `trade-page-initial-load`)	Test selectors only.
`setup-cloud-agent-localterra.sh` `_ensure_playwright_browsers`	Runs locked `npm ci` + `./node_modules/.bin/playwright install chromium` from existing `package-lock.json`; no new dependencies or user-controlled command injection.
`checksums.txt`	Artifact digest refresh; not referenced by deploy verification (`wasm-checksums.txt` is the CI artifact). No deploy bypass introduced.

No inline threads — nothing to anchor on the diff.

Automated security review (Cursor Cloud Agent)

## Security review **Commit reviewed:** `e91f159716b110e47dbe560ac5d40c2d8a8a78ff` **Scope:** 11 files — `e2e/helpers/deploy-pair.ts` (incl. optional-chain legacy fallback), Playwright `global-setup.ts`, smoke locator fixes, `setup-cloud-agent-localterra.sh` LT12 Playwright install, docs, `smartcontracts/artifacts/checksums.txt` **Outcome:** `FINDINGS: 0` medium+ — **NONE** ### Summary Re-reviewed the full MR diff (including commit `e91f159` fixing skip-chain spec import) for injection, authn/authz, secret leakage, SSRF/XSS, path traversal, and supply-chain regressions. All changes remain confined to **local E2E / Cloud Agent setup**; no production frontend, indexer API, or on-chain contract logic is touched. | Area | Assessment | |------|------------| | `e2e/helpers/deploy-pair.ts` + `global-setup.ts` | Reads `E2E_TRADE_PAIR` or `.qa-deploy-stamp` `pair_address` via anchored regex (no shell `source`). Values flow only into Playwright `page.goto('/trade/…')` and local indexer smoke `request.get` during CI/dev E2E — not user-facing runtime. Attacker would need write access to the dev/CI workspace stamp or env; out of production threat model. Optional-chain legacy fallback is a hardcoded bech32 constant (same trust as prior inline default). | | Smoke locator tweaks (`navigation`, `pool`, `trade-page-initial-load`) | Test selectors only. | | `setup-cloud-agent-localterra.sh` `_ensure_playwright_browsers` | Runs locked `npm ci` + `./node_modules/.bin/playwright install chromium` from existing `package-lock.json`; no new dependencies or user-controlled command injection. | | `checksums.txt` | Artifact digest refresh; not referenced by deploy verification (`wasm-checksums.txt` is the CI artifact). No deploy bypass introduced. | No inline threads — nothing to anchor on the diff. --- *Automated security review (Cursor Cloud Agent)*

PlasticDigits commented

2026-06-08 07:33:56 +00:00

(Migrated from gitlab.com)

mentioned in commit 7bc4fcf9ef

mentioned in commit 7bc4fcf9ef31e964654c39d1a2f1f8550b840d07