code/cl8y-dex-terraclassic

Fork 0

Frontend: verify cosmes fork patches in CI (#367) #871

Merged

PlasticDigits merged 2 commits from issue-367-cosmes-patch-ci-verify into main

2026-06-12 07:54:59 +00:00

PlasticDigits commented

2026-06-12 05:13:55 +00:00

(Migrated from gitlab.com)

Summary

Adds a committed SHA-256 gate for the @goblinhunt/cosmes patch-package file and documents fork/postinstall requirements (#367, parent gap M9 from #361).

frontend-dapp/patches/.cosmes-patch-sha256 — expected hash of patches/@goblinhunt+cosmes+*.patch
cosmesPatch127.test.ts — new hash test plus existing symbol checks on patched node_modules dist files
docs/frontend.md — fork rationale, invariants, patch upgrade checklist
Cross-links in docs/testing.md and skills/AGENTS_*

make test-frontend already runs vitest run, which includes cosmesPatch127.test.ts; no separate CI job added.

Acceptance checklist

Criterion	Command / step	Result
Test fails when patch file is modified but hash not updated	Append byte to patch → `make test-frontend` (hash test fails)	PASS
Test fails when `node_modules/@goblinhunt/cosmes` lacks patched symbols	`sed` removes `assertExtensionSignedFeeMeetsExpected` from `KeplrExtension.js` → `make test-frontend`	PASS
Operator doc lists `postinstall` and patch upgrade steps	`docs/frontend.md` § Forked cosmes	PASS
`make test-frontend` includes cosmes patch verification	`make test-frontend` (926 tests; `cosmesPatch127.test.ts` ×3)	PASS

Verification checklist (third parties)

cd frontend-dapp && npm ci — must run postinstall / patch-package (do not use --ignore-scripts).
make test-frontend — all tests pass; confirm cosmesPatch127.test.ts reports 3 passing tests.
Negative: echo " " >> frontend-dapp/patches/@goblinhunt+cosmes+0.0.71-ghunt.21.patch then re-run step 2 — expect hash mismatch failure; git checkout -- the patch afterward.
Read docs/frontend.md § Forked cosmes for upgrade procedure when changing the patch or dependency version.

Note

Low Risk
Test and documentation only; no runtime wallet or signing behavior changes. Strengthens detection of skipped or drifted cosmes patches.

Overview
Adds a committed SHA-256 fingerprint for the forked @goblinhunt/cosmes patch so CI catches edits to patches/@goblinhunt+cosmes+*.patch that are not paired with an updated hash file (#367).

cosmesPatch127.test.ts now resolves the patch path from package-lock.json, compares the patch file to patches/.cosmes-patch-sha256, and keeps the existing checks that patched fee-guard symbols exist under node_modules/@goblinhunt/cosmes/dist/... after postinstall / patch-package. No new CI job — make test-frontend already runs this suite.

Docs add a Forked cosmes section in docs/frontend.md (rationale, postinstall requirement, upgrade checklist) and cross-links in docs/testing.md and skills/AGENTS_* so operators update the hash when the patch changes.

^{Reviewed by Cursor Bugbot for commit c0ba255dc0. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Adds a committed SHA-256 gate for the `@goblinhunt/cosmes` patch-package file and documents fork/postinstall requirements ([#367](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/367), parent gap M9 from [#361](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/361)). - **`frontend-dapp/patches/.cosmes-patch-sha256`** — expected hash of `patches/@goblinhunt+cosmes+*.patch` - **`cosmesPatch127.test.ts`** — new hash test plus existing symbol checks on patched `node_modules` dist files - **`docs/frontend.md`** — fork rationale, invariants, patch upgrade checklist - Cross-links in **`docs/testing.md`** and **`skills/AGENTS_*`** `make test-frontend` already runs `vitest run`, which includes `cosmesPatch127.test.ts`; no separate CI job added. ## Acceptance checklist | Criterion | Command / step | Result | |-----------|----------------|--------| | Test fails when patch file is modified but hash not updated | Append byte to patch → `make test-frontend` (hash test fails) | **PASS** | | Test fails when `node_modules/@goblinhunt/cosmes` lacks patched symbols | `sed` removes `assertExtensionSignedFeeMeetsExpected` from `KeplrExtension.js` → `make test-frontend` | **PASS** | | Operator doc lists `postinstall` and patch upgrade steps | [`docs/frontend.md` § Forked cosmes](docs/frontend.md#cosmes-fork-patches) | **PASS** | | `make test-frontend` includes cosmes patch verification | `make test-frontend` (926 tests; `cosmesPatch127.test.ts` ×3) | **PASS** | ## Verification checklist (third parties) 1. `cd frontend-dapp && npm ci` — must run `postinstall` / `patch-package` (do not use `--ignore-scripts`). 2. `make test-frontend` — all tests pass; confirm `cosmesPatch127.test.ts` reports 3 passing tests. 3. Negative: `echo " " >> frontend-dapp/patches/@goblinhunt+cosmes+0.0.71-ghunt.21.patch` then re-run step 2 — expect hash mismatch failure; `git checkout --` the patch afterward. 4. Read [`docs/frontend.md` § Forked cosmes](docs/frontend.md#cosmes-fork-patches) for upgrade procedure when changing the patch or dependency version.  --- > [!NOTE] > **Low Risk** > Test and documentation only; no runtime wallet or signing behavior changes. Strengthens detection of skipped or drifted cosmes patches. > > **Overview** > Adds a **committed SHA-256 fingerprint** for the forked `@goblinhunt/cosmes` patch so CI catches edits to `patches/@goblinhunt+cosmes+*.patch` that are not paired with an updated hash file ([#367](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/367)). > > **`cosmesPatch127.test.ts`** now resolves the patch path from **`package-lock.json`**, compares the patch file to **`patches/.cosmes-patch-sha256`**, and keeps the existing checks that patched fee-guard symbols exist under **`node_modules/@goblinhunt/cosmes/dist/...`** after **`postinstall` / patch-package**. No new CI job — **`make test-frontend`** already runs this suite. > > **Docs** add a **Forked cosmes** section in **`docs/frontend.md`** (rationale, **`postinstall`** requirement, upgrade checklist) and cross-links in **`docs/testing.md`** and **`skills/AGENTS_*`** so operators update the hash when the patch changes. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit c0ba255dc0c35eb21b09c7be1937c3c49aa7071c. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-12 05:14:01 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-12 05:14:10 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-12 05:15:22 +00:00

(Migrated from gitlab.com)

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit 2850dc8296. Configure here.}

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.  <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aTpiMjZmNDJkOC05NmE4LTQ3YzEtODFjZS1hZmU3MTBjOTY0YWIiLCJlbmNyeXB0aW9uS2V5IjoiOXBEX0poMVFfcWJ5T01xXzVlYlItMFRSZFJGSlJGZG9IYjdWTTRMTkJLYyIsImJyYW5jaCI6Imlzc3VlLTM2Ny1jb3NtZXMtcGF0Y2gtY2ktdmVyaWZ5IiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>   <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. </sup>  <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 2850dc8296a45b6be2f4ad3417f5393c8e2666ca. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-12 05:15:23 +00:00

(Migrated from gitlab.com)

Stale patch may satisfy hash

Medium Severity

findCosmesPatchFile picks the first @goblinhunt+cosmes*.patch from readdirSync, whose order is not guaranteed. After a version bump, an older patch file often remains while patch-package applies the new one. The SHA-256 test can then hash the untouched stale file and pass even when the active patch changed without updating patches/.cosmes-patch-sha256.

^{Reviewed by Cursor Bugbot for commit 2850dc8296. Configure here.}

### Stale patch may satisfy hash **Medium Severity**  `findCosmesPatchFile` picks the first `@goblinhunt+cosmes*.patch` from `readdirSync`, whose order is not guaranteed. After a version bump, an older patch file often remains while `patch-package` applies the new one. The SHA-256 test can then hash the untouched stale file and pass even when the active patch changed without updating `patches/.cosmes-patch-sha256`.    <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjBiNTRiM2ZhLTg2NDYtNGY4Zi04NTY3LTc0YTgxNDM1ZmY0MiIsImVuY3J5cHRpb25LZXkiOiJaeExDM1daaDNldE05ZW53QndJNkZRQnd6OEVvYzZlX0RfY3M1Nkx1Z2xzIiwiYnJhbmNoIjoiaXNzdWUtMzY3LWNvc21lcy1wYXRjaC1jaS12ZXJpZnkiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJjbDh5LWRleC10ZXJyYWNsYXNzaWMifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjBiNTRiM2ZhLTg2NDYtNGY4Zi04NTY3LTc0YTgxNDM1ZmY0MiIsImVuY3J5cHRpb25LZXkiOiJaeExDM1daaDNldE05ZW53QndJNkZRQnd6OEVvYzZlX0RfY3M1Nkx1Z2xzIiwiYnJhbmNoIjoiaXNzdWUtMzY3LWNvc21lcy1wYXRjaC1jaS12ZXJpZnkiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJjbDh5LWRleC10ZXJyYWNsYXNzaWMiLCJwck51bWJlciI6MTUzLCJjb21taXRTaGEiOiIyODUwZGM4Mjk2YTQ1YjZiZTJmNGFkMzQxN2Y1MzkzYzhlMjY2NmNhIiwicHJvdmlkZXIiOiJnaXRsYWIiLCJob3N0bmFtZSI6ImdpdGxhYi5jb20ifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 2850dc8296a45b6be2f4ad3417f5393c8e2666ca. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

PlasticDigits commented

2026-06-12 05:16:22 +00:00

(Migrated from gitlab.com)

Security review — MR !871

Commit reviewed: 2850dc8296a45b6be2f4ad3417f5393c8e2666ca

Scope: Added patches/.cosmes-patch-sha256, SHA-256 gate in cosmesPatch127.test.ts, and operator/docs cross-links for forked @goblinhunt/cosmes patch verification (#367).

Outcome: FINDINGS: 0 medium+

Summary

This MR is test- and documentation-only relative to production wallet/signing behavior. It strengthens supply-chain integrity by binding the committed patch file to a SHA-256 pin and reusing existing symbol assertions on patched node_modules output after postinstall / patch-package.

Reviewed attack surfaces

Area	Result
Runtime injection / XSS / SSRF	Not in diff; new code is Vitest-only filesystem reads on fixed repo paths
Authn/authz	N/A
Secret leakage	Hash file contains only a public SHA-256 digest
CI install (`npm ci`)	Workflows use plain `npm ci` (no `--ignore-scripts`); docs correctly warn against skipping `postinstall` — pre-existing operational risk, not introduced here
Supply chain	Net improvement: patch tampering without hash update is now caught in the common single-patch case

Prior review thread (Bugbot — stale patch selection): Re-evaluated. findCosmesPatchFile() uses non-deterministic readdirSync().find() and could hash a stale sibling patch during a version bump while patch-package applies the version-matched file. That is a CI gate robustness gap, not a medium+ exploitable vulnerability on this diff: it requires merge access, a multi-patch upgrade mistake reviewers should catch, and an attacker with write access can update .cosmes-patch-sha256 directly. Existing symbol substring checks in the same test file remain the backstop for fee-guard presence. Below the medium+ bar for this security review.

Inline threads: None (no medium+ findings).

## Security review — MR !871 **Commit reviewed:** `2850dc8296a45b6be2f4ad3417f5393c8e2666ca` **Scope:** Added `patches/.cosmes-patch-sha256`, SHA-256 gate in `cosmesPatch127.test.ts`, and operator/docs cross-links for forked `@goblinhunt/cosmes` patch verification ([#367](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/367)). **Outcome:** `FINDINGS: 0` medium+ ### Summary This MR is test- and documentation-only relative to production wallet/signing behavior. It strengthens supply-chain integrity by binding the committed patch file to a SHA-256 pin and reusing existing symbol assertions on patched `node_modules` output after `postinstall` / `patch-package`. **Reviewed attack surfaces** | Area | Result | |------|--------| | Runtime injection / XSS / SSRF | Not in diff; new code is Vitest-only filesystem reads on fixed repo paths | | Authn/authz | N/A | | Secret leakage | Hash file contains only a public SHA-256 digest | | CI install (`npm ci`) | Workflows use plain `npm ci` (no `--ignore-scripts`); docs correctly warn against skipping `postinstall` — pre-existing operational risk, not introduced here | | Supply chain | Net improvement: patch tampering without hash update is now caught in the common single-patch case | **Prior review thread (Bugbot — stale patch selection):** Re-evaluated. `findCosmesPatchFile()` uses non-deterministic `readdirSync().find()` and could hash a stale sibling patch during a version bump while `patch-package` applies the version-matched file. That is a CI gate robustness gap, not a medium+ exploitable vulnerability on this diff: it requires merge access, a multi-patch upgrade mistake reviewers should catch, and an attacker with write access can update `.cosmes-patch-sha256` directly. Existing symbol substring checks in the same test file remain the backstop for fee-guard presence. Below the medium+ bar for this security review. **Inline threads:** None (no medium+ findings).

ghost1 commented

2026-06-12 05:17:45 +00:00

(Migrated from gitlab.com)

changed this line in version 2 of the diff

changed this line in [version 2 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/153/diffs?diff_id=1848248142&start_sha=2850dc8296a45b6be2f4ad3417f5393c8e2666ca#e825b6c27a845316a6b4951bd6d0228ba71c9a24_16_30)

ghost1 commented

2026-06-12 05:17:45 +00:00

(Migrated from gitlab.com)

added 1 commit

c0ba255d - fix(frontend): resolve cosmes patch path from lockfile version

Compare with previous version

added 1 commit <ul><li>c0ba255d - fix(frontend): resolve cosmes patch path from lockfile version</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/153/diffs?diff_id=1848248142&start_sha=2850dc8296a45b6be2f4ad3417f5393c8e2666ca)

ghost1 commented

2026-06-12 05:18:00 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-12 05:18:05 +00:00

(Migrated from gitlab.com)

resolved all threads

Brouie commented

2026-06-12 07:30:32 +00:00

(Migrated from gitlab.com)

mentioned in issue #367