code/cl8y-dex-terraclassic

Fork 0

fix(frontend): humanize post-sign fee guard errors for retail UI (#371) #897

Merged

PlasticDigits merged 2 commits from verify/issue-371-fee-guard-ui-copy into main

2026-06-13 04:30:22 +00:00

PlasticDigits commented

2026-06-13 03:55:05 +00:00

(Migrated from gitlab.com)

Summary

Map EXTENSION_SIGNED_FEE_UNDERSHOOT_PREFIX throws to short retail copy (EXTENSION_SIGNED_FEE_USER_MESSAGE) in tryHumanizeTerraTxMessage instead of passthrough.
Remove terraBroadcast bypass that surfaced raw guard diagnostics before humanization.
Document invariant in docs/frontend.md and agent playbooks.

Verification checklist

Acceptance item	Command / result	Status
Verbatim issue error string humanized (no GitLab #127, `npm ci`, `uluna`, Station steps)	`npx vitest run src/utils/__tests__/humanizeTerraTxError.test.ts -t "GitLab #371"`	PASS
`humanizeUserFacingError` funnel maps guard throw	`npx vitest run src/utils/__tests__/humanizeUserFacingError.test.ts -t "#371"`	PASS
`broadcastTerraExecuteContracts` surfaces retail copy	`npx vitest run src/services/terraclassic/__tests__/terraBroadcast.test.ts -t "#371"`	PASS
Guard still emits diagnostics for logging (unchanged)	`npx vitest run src/utils/__tests__/extensionSignedFeeGuard.test.ts`	PASS
Frontend lint	`make lint-frontend`	PASS
Manual: Keplr low-gas swap on LocalTerra shows retail copy only	LocalTerra not provisioned in verify VM; covered by unit tests on exact verbatim string from #371	SKIP (infra)

Follow-ups

Optional Chrome + Keplr manual repro on LocalTerra after merge to confirm toast/TxResultAlert rendering (same funnel as unit tests).

Note

Low Risk
User-facing error copy and documentation only; guard behavior and diagnostics for logging are unchanged.

Overview
Post-sign extension fee guard failures now show retail copy instead of long diagnostic throws (GitLab refs, uluna, npm ci, Station steps). tryHumanizeTerraTxMessage maps messages containing EXTENSION_SIGNED_FEE_UNDERSHOOT_PREFIX to the shared user string; broadcastTerraExecuteContracts no longer bypasses that funnel with raw guard text.

Adds EXTENSION_SIGNED_FEE_USER_MESSAGE in extensionSignedFeeGuard.ts (same text as the existing undershoot user message) as the documented UI constant for #371. Guard/patch layers keep detailed throws for console.warn / logging only.

Agent playbooks (AGENTS_FRONTEND_USER_ERRORS.md, AGENTS_TERRACLASSIC_GAS.md) record the invariant and update the humanizeTerraTxError.ts row to describe retail mapping rather than Station/npm ci hints in the UI.

^{Reviewed by Cursor Bugbot for commit cc457fb9a4. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary - Map `EXTENSION_SIGNED_FEE_UNDERSHOOT_PREFIX` throws to short retail copy (`EXTENSION_SIGNED_FEE_USER_MESSAGE`) in `tryHumanizeTerraTxMessage` instead of passthrough. - Remove `terraBroadcast` bypass that surfaced raw guard diagnostics before humanization. - Document invariant in `docs/frontend.md` and agent playbooks. ## Verification checklist | Acceptance item | Command / result | Status | |-----------------|------------------|--------| | Verbatim issue error string humanized (no GitLab #127, `npm ci`, `uluna`, Station steps) | `npx vitest run src/utils/__tests__/humanizeTerraTxError.test.ts -t "GitLab #371"` | PASS | | `humanizeUserFacingError` funnel maps guard throw | `npx vitest run src/utils/__tests__/humanizeUserFacingError.test.ts -t "#371"` | PASS | | `broadcastTerraExecuteContracts` surfaces retail copy | `npx vitest run src/services/terraclassic/__tests__/terraBroadcast.test.ts -t "#371"` | PASS | | Guard still emits diagnostics for logging (unchanged) | `npx vitest run src/utils/__tests__/extensionSignedFeeGuard.test.ts` | PASS | | Frontend lint | `make lint-frontend` | PASS | | Manual: Keplr low-gas swap on LocalTerra shows retail copy only | LocalTerra not provisioned in verify VM; covered by unit tests on exact verbatim string from #371 | SKIP (infra) | ## Follow-ups - Optional Chrome + Keplr manual repro on LocalTerra after merge to confirm toast/`TxResultAlert` rendering (same funnel as unit tests).  --- > [!NOTE] > **Low Risk** > User-facing error copy and documentation only; guard behavior and diagnostics for logging are unchanged. > > **Overview** > Post-sign extension fee guard failures now show **retail copy** instead of long diagnostic throws (GitLab refs, `uluna`, `npm ci`, Station steps). **`tryHumanizeTerraTxMessage`** maps messages containing **`EXTENSION_SIGNED_FEE_UNDERSHOOT_PREFIX`** to the shared user string; **`broadcastTerraExecuteContracts`** no longer bypasses that funnel with raw guard text. > > Adds **`EXTENSION_SIGNED_FEE_USER_MESSAGE`** in **`extensionSignedFeeGuard.ts`** (same text as the existing undershoot user message) as the documented UI constant for #371. Guard/patch layers keep detailed throws for **`console.warn`** / logging only. > > Agent playbooks (**`AGENTS_FRONTEND_USER_ERRORS.md`**, **`AGENTS_TERRACLASSIC_GAS.md`**) record the invariant and update the **`humanizeTerraTxError.ts`** row to describe retail mapping rather than Station/`npm ci` hints in the UI. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit cc457fb9a4bf29a56b056470cd550daae6452e58. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-13 03:55:12 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-13 03:55:21 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-13 03:56:58 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 7d3b4aa7c38f5be1b834f5b605df19cfaf32d63b
Scope: MR !897 — humanize post-sign fee guard errors for retail UI (#371). Reviewed added/modified paths: extensionSignedFeeGuard.ts, humanizeTerraTxError.ts, terraBroadcast.ts, related tests, and docs.

Outcome: FINDINGS: 0 medium+

Summary: This change maps verbose EXTENSION_SIGNED_FEE_UNDERSHOOT_PREFIX diagnostics to the static EXTENSION_SIGNED_FEE_USER_MESSAGE and removes the terraBroadcast bypass that previously surfaced raw guard text in the UI. Post-sign fee guard logic and cosmes patch behavior are unchanged.

Analysis (no exploitable paths on this diff):

XSS: Error surfaces (TxResultAlert, ErrorBoundary, toasts) render via React text nodes; no dangerouslySetInnerHTML. Replacing variable diagnostic strings with a fixed constant reduces, not increases, injection surface.
Information disclosure: UI no longer exposes internal diagnostics (uluna amounts, npm ci, GitLab refs). Full throws remain in console.error upstream — intentional, unchanged.
Attacker-controlled input: Prefix match is a substring check on error text; the only realistic source is the local fee guard / cosmes patch throw. A spoofed chain rawLog containing the exact prefix would at most show the same retail copy — no auth bypass, fee bypass, or unsafe sink.
Controls unchanged: EXTENSION_SIGNED_FEE_MIN_PERCENT guard, signing envelope, and broadcast error handling semantics are unaffected; only display mapping changed.

Inline threads: None (no medium+ findings).

Security review: no medium+ findings on this diff.

## Security review **Commit reviewed:** `7d3b4aa7c38f5be1b834f5b605df19cfaf32d63b` **Scope:** MR !897 — humanize post-sign fee guard errors for retail UI (#371). Reviewed added/modified paths: `extensionSignedFeeGuard.ts`, `humanizeTerraTxError.ts`, `terraBroadcast.ts`, related tests, and docs. **Outcome:** `FINDINGS: 0` medium+ **Summary:** This change maps verbose `EXTENSION_SIGNED_FEE_UNDERSHOOT_PREFIX` diagnostics to the static `EXTENSION_SIGNED_FEE_USER_MESSAGE` and removes the `terraBroadcast` bypass that previously surfaced raw guard text in the UI. Post-sign fee guard logic and cosmes patch behavior are unchanged. **Analysis (no exploitable paths on this diff):** - **XSS:** Error surfaces (`TxResultAlert`, `ErrorBoundary`, toasts) render via React text nodes; no `dangerouslySetInnerHTML`. Replacing variable diagnostic strings with a fixed constant reduces, not increases, injection surface. - **Information disclosure:** UI no longer exposes internal diagnostics (`uluna` amounts, `npm ci`, GitLab refs). Full throws remain in `console.error` upstream — intentional, unchanged. - **Attacker-controlled input:** Prefix match is a substring check on error text; the only realistic source is the local fee guard / cosmes patch throw. A spoofed chain `rawLog` containing the exact prefix would at most show the same retail copy — no auth bypass, fee bypass, or unsafe sink. - **Controls unchanged:** `EXTENSION_SIGNED_FEE_MIN_PERCENT` guard, signing envelope, and broadcast error handling semantics are unaffected; only display mapping changed. **Inline threads:** None (no medium+ findings). Security review: no medium+ findings on this diff.

PlasticDigits commented

2026-06-13 04:26:59 +00:00

(Migrated from gitlab.com)

added 111 commits

7d3b4aa7...3ece9321 - 110 commits from branch main
cc457fb9 - Merge branch 'main' into verify/issue-371-fee-guard-ui-copy

Compare with previous version

added 111 commits <ul><li>7d3b4aa7...3ece9321 - 110 commits from branch <code>main</code></li><li>cc457fb9 - Merge branch 'main' into verify/issue-371-fee-guard-ui-copy</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/179/diffs?diff_id=1850166208&start_sha=7d3b4aa7c38f5be1b834f5b605df19cfaf32d63b)

PlasticDigits commented

2026-06-13 04:27:02 +00:00

(Migrated from gitlab.com)

Resolved merge conflicts with main (commit cc457fb).

Conflicts resolved (7 files):

humanizeTerraTxError.ts — aligned on EXTENSION_SIGNED_FEE_UNDERSHOOT_USER_MESSAGE and prefix/exact-message matching from main
terraBroadcast.ts — kept main’s split-sign/recovery imports and isTerraTxTimeoutMessage; fee-guard errors still flow through tryHumanizeTerraTxMessage
Test files (humanizeTerraTxError, humanizeUserFacingError, terraBroadcast) — reconciled #371 assertions with main’s fuller diagnostic strings
docs/frontend.md and skills/AGENTS_TERRACLASSIC_GAS.md — merged #371 humanization docs with main’s cosmes-patch SHA-256 and broadcast-recovery updates

Sanity checks: vitest #371 tests + extensionSignedFeeGuard.test.ts — all passed.

Resolved merge conflicts with `main` (commit cc457fb). **Conflicts resolved (7 files):** - `humanizeTerraTxError.ts` — aligned on `EXTENSION_SIGNED_FEE_UNDERSHOOT_USER_MESSAGE` and prefix/exact-message matching from main - `terraBroadcast.ts` — kept main’s split-sign/recovery imports and `isTerraTxTimeoutMessage`; fee-guard errors still flow through `tryHumanizeTerraTxMessage` - Test files (`humanizeTerraTxError`, `humanizeUserFacingError`, `terraBroadcast`) — reconciled #371 assertions with main’s fuller diagnostic strings - `docs/frontend.md` and `skills/AGENTS_TERRACLASSIC_GAS.md` — merged #371 humanization docs with main’s cosmes-patch SHA-256 and broadcast-recovery updates **Sanity checks:** vitest `#371` tests + `extensionSignedFeeGuard.test.ts` — all passed.

ghost1 commented

2026-06-13 04:27:19 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-13 04:28:58 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: cc457fb9a4bf29a56b056470cd550daae6452e58
Scope: MR !897 — humanize post-sign fee guard errors for retail UI (#371). Net diff vs target (3ece932): extensionSignedFeeGuard.ts (adds EXTENSION_SIGNED_FEE_USER_MESSAGE alias), skills/AGENTS_FRONTEND_USER_ERRORS.md, skills/AGENTS_TERRACLASSIC_GAS.md. Core humanization (tryHumanizeTerraTxMessage, terraBroadcast bypass removal) is already present on the target branch; this MR adds the documented UI constant and playbook rows.

Outcome: FINDINGS: 0 medium+

Summary: No new exploitable paths. The added constant is a static retail string (duplicate of EXTENSION_SIGNED_FEE_UNDERSHOOT_USER_MESSAGE); documentation changes have no runtime effect. Existing error surfaces (TxResultAlert, humanizeUserFacingError) render via React text nodes with no dangerouslySetInnerHTML; mapping verbose diagnostics to fixed copy reduces, not increases, XSS and information-disclosure surface. Post-sign fee guard enforcement (EXTENSION_SIGNED_FEE_MIN_PERCENT, cosmes patch) is unchanged.

Inline threads: None (no medium+ findings).

Security review: no medium+ findings on this diff.

## Security review **Commit reviewed:** `cc457fb9a4bf29a56b056470cd550daae6452e58` **Scope:** MR !897 — humanize post-sign fee guard errors for retail UI (#371). Net diff vs target (`3ece932`): `extensionSignedFeeGuard.ts` (adds `EXTENSION_SIGNED_FEE_USER_MESSAGE` alias), `skills/AGENTS_FRONTEND_USER_ERRORS.md`, `skills/AGENTS_TERRACLASSIC_GAS.md`. Core humanization (`tryHumanizeTerraTxMessage`, `terraBroadcast` bypass removal) is already present on the target branch; this MR adds the documented UI constant and playbook rows. **Outcome:** `FINDINGS: 0` medium+ **Summary:** No new exploitable paths. The added constant is a static retail string (duplicate of `EXTENSION_SIGNED_FEE_UNDERSHOOT_USER_MESSAGE`); documentation changes have no runtime effect. Existing error surfaces (`TxResultAlert`, `humanizeUserFacingError`) render via React text nodes with no `dangerouslySetInnerHTML`; mapping verbose diagnostics to fixed copy reduces, not increases, XSS and information-disclosure surface. Post-sign fee guard enforcement (`EXTENSION_SIGNED_FEE_MIN_PERCENT`, cosmes patch) is unchanged. **Inline threads:** None (no medium+ findings). Security review: no medium+ findings on this diff.