Establish cyberminimalist glass app shell #422

Merged

PlasticDigits merged 2 commits from cursor/cyberminimalist-shell-290-7826 into main 2026-06-06 13:02:00 +00:00

Conversation 7 Commits 2 Files changed 21 +438 -309

PlasticDigits commented 2026-06-06 12:49:24 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary of changes

Implements GitLab #290 by establishing the cyberminimalist glassmorphism app shell and aligning global frontend chrome with the approved TimeArena command-console direction.

• Added semantic --yo-* glass/console tokens in frontend/src/index.css and remapped shared shell, cards, panels, hero banners, buttons, and modal surfaces to dark tactical glass styling.
• Aligned RainbowKit wallet chrome to a dark cyan-accented theme in AppProviders.
• Kept Time Arena route decisions action-first: visible sub-nav labels are BUY and AUDIT, with mechanics in title / aria-label tooltips instead of default explanatory body copy.
• Removed stale shell/footer/home/placeholder copy that framed current TimeArena as a legacy sale / TimeCurve / arcade milestone.
• Added focused tests and docs/invariants/manual QA guidance for #290.
• Follow-up from real Chromium/Rabby QA: fixed stale Referrals heavy borders and added missing glass styling for the BUY/AUDIT tab class names.

Design review notes

• Primary user goals: get to Time Arena buys quickly, inspect AUDIT/operator reads when needed, connect/switch wallet/network with clear state, and move across first-party/third-party routes without changing mental models.
• Surfaced decisions/actions: global nav emphasizes Time Arena and Referrals; Arena sub-nav exposes BUY and AUDIT only; wallet/network controls use the same dark action palette.
• Time-sensitive actions: the BUY surface preserves the timer/CTA priority and avoids footer/about copy competing with live buy decisions.
• Stale assumptions removed: visible shell copy no longer implies TimeCurve launchpad/PvE/sale-end framing; docs now point future agents at TimeArena v2 mechanics and #290 design invariants.
• Browser QA findings removed: Chromium/Rabby inspection initially found a Referrals quest strip still using a 5px legacy border and the new .arena-subnav__tab elements inheriting no glass border. Both are now fixed and covered in headerLayoutCss.test.ts.

Checklist

Acceptance item	Command or manual step	Status
All routes share the new glass/console visual language	Chromium + Rabby xvfb inspection of /, /arena, /arena/protocol, /referrals, /kumbaya, /sir; checked --yo-* tokens, header/panel 1px glass borders, and dark gradients	PASS
Route labels and shell copy do not imply outdated TimeCurve/PvE mechanics	`rg "arena sale	TimeCurve is the active
Wallet chrome matches the new palette	Chromium + Rabby inspection: Rabby injected window.ethereum; RainbowKit connect modal opened with installed Rabby option and non-white dark overlay; AppProviders.test.ts verifies dark theme	PASS
Frontend typecheck	cd frontend && npm run typecheck	PASS
Frontend lint	cd frontend && npm run lint	PASS (0 errors; existing warnings only)
Frontend tests	cd frontend && npm test	PASS (104 files / 540 tests after browser-found CSS coverage)
Production preview build for Rabby browser QA	VITE_CHAIN_ID=31337 VITE_RPC_URL=http://127.0.0.1:8545 VITE_TIME_ARENA_ADDRESS=0x1111111111111111111111111111111111111111 VITE_PODIUM_VAULTS_ADDRESS=0x2222222222222222222222222222222222222222 VITE_ADMIN_SELL_VAULT_ADDRESS=0x3333333333333333333333333333333333333333 VITE_REFERRAL_REGISTRY_ADDRESS=0x4444444444444444444444444444444444444444 VITE_INDEXER_URL=http://127.0.0.1:3100 npm run build	PASS
Docs/invariants/QA guidance updated	bash scripts/check-doc-anchors.sh; manual review of design/arena/invariants/manual QA docs	PASS

Chromium + Rabby verification notes

Ran an xvfb-backed Chromium session with the installed Rabby extension/profile (/opt/cursor/browser-extensions/rabby, /opt/cursor/chrome-profile-rabby) against Vite preview on http://127.0.0.1:5173.

Checks performed:

• Captured desktop screenshots for /, /arena, /arena/protocol, /referrals, /kumbaya, /sir.
• Captured mobile /arena screenshot at 390×844.
• Captured RainbowKit connect modal screenshot with the installed Rabby option visible.
• Verified Rabby injected window.ethereum in Chromium.
• Verified headers and primary/shared panels use 1px glass borders and dark gradients on all inspected routes.
• Verified /arena shows BUY/AUDIT, has mechanics in title/aria labels, and has no visible ABOUT paragraph.
• Verified no visible route body contained retired TimeCurve, PvE, sale-end, or redeem copy.

Agent-local screenshots were written under /tmp/yieldomega-rabby-issue-290/ during verification.

Visual/design verification checklist for third parties

• Desktop: /, /arena, /arena/protocol, /referrals, /kumbaya, /sir share dark glass shell, thin borders, cyan/gold accent hierarchy, and no blocky cream card chrome.
• Mobile: bottom header dock keeps the same glass palette; labels/focus rings remain visible.
• Arena: visible sub-nav decisions are BUY and AUDIT; hover/focus exposes concise mechanics via tooltips/aria labels; no default ABOUT paragraph.
• Wallet: connect/account/network modal and header controls match the cyan-on-dark palette; Rabby appears in the installed-wallet options.
• Branding: existing character and token imagery remains decorative/consistent but is visually subdued by dark scrims/glass panels.

Accessibility/responsive notes

• Existing --yo-focus-ring focus-visible pattern is preserved and moved to a high-contrast cyan accent.
• BUY/AUDIT mechanics are exposed through aria-label as well as title.
• Mobile header dock keeps fixed positioning and safe-area spacing while adopting the dark glass background.

## Summary of changes Implements GitLab #290 by establishing the cyberminimalist glassmorphism app shell and aligning global frontend chrome with the approved TimeArena command-console direction. - Added semantic `--yo-*` glass/console tokens in `frontend/src/index.css` and remapped shared shell, cards, panels, hero banners, buttons, and modal surfaces to dark tactical glass styling. - Aligned RainbowKit wallet chrome to a dark cyan-accented theme in `AppProviders`. - Kept Time Arena route decisions action-first: visible sub-nav labels are **BUY** and **AUDIT**, with mechanics in `title` / `aria-label` tooltips instead of default explanatory body copy. - Removed stale shell/footer/home/placeholder copy that framed current TimeArena as a legacy sale / TimeCurve / arcade milestone. - Added focused tests and docs/invariants/manual QA guidance for #290. - Follow-up from real Chromium/Rabby QA: fixed stale Referrals heavy borders and added missing glass styling for the BUY/AUDIT tab class names. ## Design review notes - **Primary user goals:** get to Time Arena buys quickly, inspect AUDIT/operator reads when needed, connect/switch wallet/network with clear state, and move across first-party/third-party routes without changing mental models. - **Surfaced decisions/actions:** global nav emphasizes Time Arena and Referrals; Arena sub-nav exposes **BUY** and **AUDIT** only; wallet/network controls use the same dark action palette. - **Time-sensitive actions:** the BUY surface preserves the timer/CTA priority and avoids footer/about copy competing with live buy decisions. - **Stale assumptions removed:** visible shell copy no longer implies TimeCurve launchpad/PvE/sale-end framing; docs now point future agents at TimeArena v2 mechanics and #290 design invariants. - **Browser QA findings removed:** Chromium/Rabby inspection initially found a Referrals quest strip still using a 5px legacy border and the new `.arena-subnav__tab` elements inheriting no glass border. Both are now fixed and covered in `headerLayoutCss.test.ts`. ## Checklist | Acceptance item | Command or manual step | Status | |---|---|---| | All routes share the new glass/console visual language | Chromium + Rabby xvfb inspection of `/`, `/arena`, `/arena/protocol`, `/referrals`, `/kumbaya`, `/sir`; checked `--yo-*` tokens, header/panel 1px glass borders, and dark gradients | PASS | | Route labels and shell copy do not imply outdated TimeCurve/PvE mechanics | `rg "arena sale|TimeCurve is the active|fair-launch arcade|CL8Y sale band|ABOUT TIME ARENA|arcadeWalletTheme|lightTheme" frontend/src --glob '!*.test.*'` | PASS | | Wallet chrome matches the new palette | Chromium + Rabby inspection: Rabby injected `window.ethereum`; RainbowKit connect modal opened with installed Rabby option and non-white dark overlay; `AppProviders.test.ts` verifies dark theme | PASS | | Frontend typecheck | `cd frontend && npm run typecheck` | PASS | | Frontend lint | `cd frontend && npm run lint` | PASS (0 errors; existing warnings only) | | Frontend tests | `cd frontend && npm test` | PASS (104 files / 540 tests after browser-found CSS coverage) | | Production preview build for Rabby browser QA | `VITE_CHAIN_ID=31337 VITE_RPC_URL=http://127.0.0.1:8545 VITE_TIME_ARENA_ADDRESS=0x1111111111111111111111111111111111111111 VITE_PODIUM_VAULTS_ADDRESS=0x2222222222222222222222222222222222222222 VITE_ADMIN_SELL_VAULT_ADDRESS=0x3333333333333333333333333333333333333333 VITE_REFERRAL_REGISTRY_ADDRESS=0x4444444444444444444444444444444444444444 VITE_INDEXER_URL=http://127.0.0.1:3100 npm run build` | PASS | | Docs/invariants/QA guidance updated | `bash scripts/check-doc-anchors.sh`; manual review of design/arena/invariants/manual QA docs | PASS | ## Chromium + Rabby verification notes Ran an xvfb-backed Chromium session with the installed Rabby extension/profile (`/opt/cursor/browser-extensions/rabby`, `/opt/cursor/chrome-profile-rabby`) against Vite preview on `http://127.0.0.1:5173`. Checks performed: - Captured desktop screenshots for `/`, `/arena`, `/arena/protocol`, `/referrals`, `/kumbaya`, `/sir`. - Captured mobile `/arena` screenshot at 390×844. - Captured RainbowKit connect modal screenshot with the installed Rabby option visible. - Verified Rabby injected `window.ethereum` in Chromium. - Verified headers and primary/shared panels use 1px glass borders and dark gradients on all inspected routes. - Verified `/arena` shows **BUY**/**AUDIT**, has mechanics in title/aria labels, and has no visible ABOUT paragraph. - Verified no visible route body contained retired `TimeCurve`, `PvE`, `sale-end`, or `redeem` copy. Agent-local screenshots were written under `/tmp/yieldomega-rabby-issue-290/` during verification. ## Visual/design verification checklist for third parties - Desktop: `/`, `/arena`, `/arena/protocol`, `/referrals`, `/kumbaya`, `/sir` share dark glass shell, thin borders, cyan/gold accent hierarchy, and no blocky cream card chrome. - Mobile: bottom header dock keeps the same glass palette; labels/focus rings remain visible. - Arena: visible sub-nav decisions are **BUY** and **AUDIT**; hover/focus exposes concise mechanics via tooltips/aria labels; no default ABOUT paragraph. - Wallet: connect/account/network modal and header controls match the cyan-on-dark palette; Rabby appears in the installed-wallet options. - Branding: existing character and token imagery remains decorative/consistent but is visually subdued by dark scrims/glass panels. ## Accessibility/responsive notes - Existing `--yo-focus-ring` focus-visible pattern is preserved and moved to a high-contrast cyan accent. - BUY/AUDIT mechanics are exposed through `aria-label` as well as `title`. - Mobile header dock keeps fixed positioning and safe-area spacing while adopting the dark glass background.

ghost1 commented 2026-06-06 12:55:09 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review summary

Commit reviewed: af078cb7e2469aea5a4907854a0916d7fb179d70
Scope: MR !422 — cyberminimalist glass app shell (#290): frontend/src/index.css token/styling overhaul, RainbowKit theme swap (AppProviders.tsx), copy/nav updates, new ArenaThemeConcepts mock panel on /arena, docs/e2e/test adjustments, local Anvil registry metadata tweak.

Outcome: FINDINGS: 0 medium+

What was reviewed

• Full MR diff (main → af078cb7) with focus on authn/authz, injection sinks, secret handling, unsafe deserialization, SSRF/XSS/CSRF, dependency changes, and wallet/RPC configuration.
• Traced attacker-controlled inputs to sinks in changed TS/TSX paths (ArenaSubnav, ArenaThemeConcepts, TimeArenaPage, AppProviders, vite.config.ts, layout/surface copy).
• Confirmed no prior security-review threads on this MR.

Result

No exploitable medium, high, or critical vulnerabilities were introduced on this diff.

Why no findings:

• Changes are overwhelmingly presentational (CSS design tokens, branding copy, RainbowKit darkTheme palette). No new server endpoints, auth paths, or dependency updates (package.json / lockfile unchanged).
• ArenaThemeConcepts uses hardcoded mock constants only; user charmAmount input is clamped and used for local display math — no dangerouslySetInnerHTML, no wallet/RPC calls, buy form uses preventDefault, WarBow buttons are inert type="button".
• ArenaSubnav removed localStorage persistence (reduced client state surface).
• vite.config.ts social-meta injection retains escAttr() escaping; OG string edits are static literals.
• wagmi-config.ts changes are appName strings only; WalletConnect placeholder behavior unchanged.
• CSS diff adds Google Fonts variant and local url() assets; decorative layers use pointer-events: none — no new clickjacking overlay on wallet controls.
• contracts/deployments/local-anvil-registry.json comment/deployBlock update contains no secrets (dev Anvil addresses only).

Non-security note (out of scope for medium+): ArenaThemeConcepts renders static “Live” mock leaderboard/timer UI above the real ArenaSimplePage buy surface. That is a product/display-integrity concern for QA, not an attacker-exploitable vuln on this diff.

Inline threads: none (zero findings).

## Security review summary **Commit reviewed:** `af078cb7e2469aea5a4907854a0916d7fb179d70` **Scope:** MR !422 — cyberminimalist glass app shell (#290): `frontend/src/index.css` token/styling overhaul, RainbowKit theme swap (`AppProviders.tsx`), copy/nav updates, new `ArenaThemeConcepts` mock panel on `/arena`, docs/e2e/test adjustments, local Anvil registry metadata tweak. **Outcome:** `FINDINGS: 0` medium+ ### What was reviewed - Full MR diff (`main` → `af078cb7`) with focus on authn/authz, injection sinks, secret handling, unsafe deserialization, SSRF/XSS/CSRF, dependency changes, and wallet/RPC configuration. - Traced attacker-controlled inputs to sinks in changed TS/TSX paths (`ArenaSubnav`, `ArenaThemeConcepts`, `TimeArenaPage`, `AppProviders`, `vite.config.ts`, layout/surface copy). - Confirmed no prior security-review threads on this MR. ### Result No exploitable medium, high, or critical vulnerabilities were introduced on this diff. **Why no findings:** - Changes are overwhelmingly presentational (CSS design tokens, branding copy, RainbowKit `darkTheme` palette). No new server endpoints, auth paths, or dependency updates (`package.json` / lockfile unchanged). - `ArenaThemeConcepts` uses hardcoded mock constants only; user `charmAmount` input is clamped and used for local display math — no `dangerouslySetInnerHTML`, no wallet/RPC calls, buy form uses `preventDefault`, WarBow buttons are inert `type="button"`. - `ArenaSubnav` **removed** `localStorage` persistence (reduced client state surface). - `vite.config.ts` social-meta injection retains `escAttr()` escaping; OG string edits are static literals. - `wagmi-config.ts` changes are `appName` strings only; WalletConnect placeholder behavior unchanged. - CSS diff adds Google Fonts variant and local `url()` assets; decorative layers use `pointer-events: none` — no new clickjacking overlay on wallet controls. - `contracts/deployments/local-anvil-registry.json` comment/deployBlock update contains no secrets (dev Anvil addresses only). **Non-security note (out of scope for medium+):** `ArenaThemeConcepts` renders static “Live” mock leaderboard/timer UI above the real `ArenaSimplePage` buy surface. That is a product/display-integrity concern for QA, not an attacker-exploitable vuln on this diff. **Inline threads:** none (zero findings).

ghost1 commented 2026-06-06 12:56:28 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 1 commit

• 9a4d01e1 - Refine glass styling from Rabby browser QA

Compare with previous version

added 1 commit <ul><li>9a4d01e1 - Refine glass styling from Rabby browser QA</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/52/diffs?diff_id=1837964587&start_sha=af078cb7e2469aea5a4907854a0916d7fb179d70)

PlasticDigits commented 2026-06-06 12:56:59 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

ghost1 commented 2026-06-06 12:59:55 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review summary

Commit reviewed: 9a4d01e19b762ad6bb3ec0d17ac341c2b771f4a4
Scope: MR !422 — cyberminimalist glass app shell (#290): frontend/src/index.css --yo-* token/styling overhaul, RainbowKit dark theme (AppProviders.tsx), BUY/AUDIT nav simplification (ArenaSubnav.tsx), copy/surface updates, docs/tests. Delta since prior review (af078cb): Referrals quest-strip glass borders + .arena-subnav__tab glass styling fixes (index.css, headerLayoutCss.test.ts).

Outcome: FINDINGS: 0 medium+

What was reviewed

• Full MR diff (main → 9a4d01e) with focus on injection sinks, authn/authz, secret handling, SSRF/XSS/CSRF, unsafe deserialization, dependency/supply-chain changes, and wallet/RPC configuration.
• Traced attacker-controlled inputs to sinks in changed TS/TSX paths (ArenaSubnav, AppProviders, layout/surface copy helpers).
• Re-checked delta since prior security review (af078cb → 9a4d01e).
• Prior review thread on af078cb re-evaluated; no medium+ findings from that pass remain applicable on the updated commit.

Result

Security review: no medium+ findings on this diff.

Why no findings:

• Changes are presentational: CSS design tokens/glass styling, static copy, RainbowKit darkTheme palette constants. No new server endpoints, auth paths, RPC/wagmi config edits, or dependency updates (package.json / lockfile unchanged).
• ArenaSubnav tab title / aria-label strings are hardcoded in TABS; no user-controlled HTML injection (dangerouslySetInnerHTML not introduced). Component removed localStorage persistence for the old ABOUT panel (reduced client state surface).
• Wallet header controls retain distinct variants (.wallet-action--connect, --warning, etc.); decorative layers keep pointer-events: none — no new clickjacking overlay on connect/signing controls.
• CSS uses static url() assets and existing Google Fonts @import (font family variant change only); no attacker-controlled CSS variables.
• Delta commit is CSS/test-only (Referrals borders + subnav tab glass classes) with no runtime logic changes.

Inline threads: none (zero findings).

## Security review summary **Commit reviewed:** `9a4d01e19b762ad6bb3ec0d17ac341c2b771f4a4` **Scope:** MR !422 — cyberminimalist glass app shell (#290): `frontend/src/index.css` `--yo-*` token/styling overhaul, RainbowKit dark theme (`AppProviders.tsx`), BUY/AUDIT nav simplification (`ArenaSubnav.tsx`), copy/surface updates, docs/tests. Delta since prior review (`af078cb`): Referrals quest-strip glass borders + `.arena-subnav__tab` glass styling fixes (`index.css`, `headerLayoutCss.test.ts`). **Outcome:** `FINDINGS: 0` medium+ ### What was reviewed - Full MR diff (`main` → `9a4d01e`) with focus on injection sinks, authn/authz, secret handling, SSRF/XSS/CSRF, unsafe deserialization, dependency/supply-chain changes, and wallet/RPC configuration. - Traced attacker-controlled inputs to sinks in changed TS/TSX paths (`ArenaSubnav`, `AppProviders`, layout/surface copy helpers). - Re-checked delta since prior security review (`af078cb` → `9a4d01e`). - Prior review thread on `af078cb` re-evaluated; no medium+ findings from that pass remain applicable on the updated commit. ### Result **Security review: no medium+ findings on this diff.** **Why no findings:** - Changes are presentational: CSS design tokens/glass styling, static copy, RainbowKit `darkTheme` palette constants. No new server endpoints, auth paths, RPC/wagmi config edits, or dependency updates (`package.json` / lockfile unchanged). - `ArenaSubnav` tab `title` / `aria-label` strings are hardcoded in `TABS`; no user-controlled HTML injection (`dangerouslySetInnerHTML` not introduced). Component **removed** `localStorage` persistence for the old ABOUT panel (reduced client state surface). - Wallet header controls retain distinct variants (`.wallet-action--connect`, `--warning`, etc.); decorative layers keep `pointer-events: none` — no new clickjacking overlay on connect/signing controls. - CSS uses static `url()` assets and existing Google Fonts `@import` (font family variant change only); no attacker-controlled CSS variables. - Delta commit is CSS/test-only (Referrals borders + subnav tab glass classes) with no runtime logic changes. **Inline threads:** none (zero findings).

PlasticDigits commented 2026-06-06 13:01:35 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

resolved all threads

resolved all threads

PlasticDigits commented 2026-06-06 13:02:01 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 523a4eff25

mentioned in commit 523a4eff2594e5a0239f9dd395dce42c1dae4342

PlasticDigits (Migrated from gitlab.com) merged commit 523a4eff25 into main 2026-06-06 13:02:01 +00:00

PlasticDigits commented 2026-06-08 08:45:13 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 07caae0851

mentioned in commit 07caae0851b6f4beeff04d229f9b32ff3d23a5dd

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:open_issues

  

agents

  

agent:security_audit

  

agent:verify

  

area

timecurve

  

arena

  

arena-v2

  

audit

  

block:feature_review

  

block:security

  

bug

  

contracts

  

design

  

devops

  

docs

Documentation

  

documentation

  

enhancement

  

epic

Epic / umbrella issue

  

feature

  

frontend

  

indexer

  

low priority

Low priority, investigate other issues first

  

megaeth

  

operations

  

ops

Deploy and operations

  

performance

  

QA

  

qa checklist

  

referrals

  

removal

Legacy removal

  

security

  

smart-contracts

  

tech-debt

  

testing

  

time-arena

TimeArena v2 revamp

  

timecurve

  

visual-qa

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:open_issues

agents

agent:security_audit

agent:verify

area

timecurve

arena

arena-v2

audit

block:feature_review

block:security

bug

contracts

design

devops

docs

documentation

enhancement

epic

feature

frontend

indexer

low priority

megaeth

operations

ops

performance

QA

qa checklist

referrals

removal

security

smart-contracts

tech-debt

testing

time-arena

timecurve

visual-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!422

No description provided.