Skip to content

feat: develop to main - #93

Merged
rongquan1 merged 4 commits into
mainfrom
develop
Jul 31, 2026
Merged

feat: develop to main#93
rongquan1 merged 4 commits into
mainfrom
develop

Conversation

@RishabhS7

@RishabhS7 RishabhS7 commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Gasless Transaction Complete functionality

Summary by CodeRabbit

  • New Features

    • Added gasless “pay on behalf” support for transfers, nominations, rejections, and returns.
    • Added paymaster validation, wallet delegation checks, and saved paymaster status.
    • Enhanced verification with paymaster setup, validation, and success feedback.
    • Added new verification and transfer-flow test scenarios.
  • Bug Fixes

    • Error messages now appear alongside transfer instructions instead of replacing them.
  • Style

    • Updated the application typography and expanded responsive verification-card styling.

@coderabbitai

coderabbitai Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

Changes

Gasless transaction infrastructure

Layer / File(s) Summary
Gasless infrastructure and eligibility checks
src/gasless/*, package.json, .env.example, .github/workflows/*, .npmrc
Adds EIP-7702 delegation checks, paymaster whitelist checks, Pimlico smart-account construction, paymaster storage, gasless dependencies, and deployment configuration.
Gasless hook orchestration and operation adapters
src/gasless/makeGaslessHook.ts, src/gasless/useGasless*.ts, src/gasless/index.ts, src/gasless/gaslessHooks.test.tsx
Adds gasless/direct transaction selection for transfer, rejection, nomination, and return operations. Tests cover fallback, state, errors, reset, and paymaster resolution.

Application UI updates

Layer / File(s) Summary
Gasless operation integration and verification UI
src/components/home/VerifySection/VerifyResult.tsx, src/components/common/contexts/..., src/components/AssetManagementPanel/..., src/components/common/Overlay/..., src/components/common/Icons/*
Connects token operations to gasless hooks, validates and stores paymasters, renders pay-on-behalf states, exports InfoMsgIcon, and renders transfer children with errors.
Urbanist typography migration
src/index.css, src/components/common/Tag/Tag.tsx
Replaces Gilroy typography with Urbanist and adds responsive verification-card styles.

E2E validation

Layer / File(s) Summary
E2E fixtures and workflow validation
e2e/fixtures/local/w3c/*, e2e/playwright.config.ts, e2e/setup-contracts.cjs, e2e/helpers/actions.ts, e2e/tests/*
Adds surrender credential fixtures, broadens verification test exclusion, and removes obsolete comments and naming references.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

Suggested reviewers: manishdex25

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 42.86% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes merging develop into main, but it does not identify the primary Gasless Transaction functionality.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch develop

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 11

🧹 Nitpick comments (8)
src/components/common/Icons/Icons.tsx (1)

235-248: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Use a size prop and default aria-hidden for this decorative icon.

fontSize as the width/height knob is misleading (it's an unrelated SVG attribute), and unlike FileIcon this icon renders without aria-hidden, so screen readers announce an empty graphic next to the paymaster status text.

♻️ Proposed signature
 export const InfoMsgIcon = ({
-  fontSize = 24,
+  size = 24,
   stroke = '`#FF8200`',
   ...props
-}: SVGProps<SVGSVGElement>) => {
+}: SVGProps<SVGSVGElement> & { size?: number }) => {
   return (
     <svg
-      width={fontSize}
-      height={fontSize}
+      width={size}
+      height={size}
       viewBox="0 0 20 20"
       fill="none"
       xmlns="http://www.w3.org/2000/svg"
+      aria-hidden="true"
+      focusable="false"
       {...props}
     >
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/components/common/Icons/Icons.tsx` around lines 235 - 248, Update
InfoMsgIcon to use a size prop, defaulting to 24, for its SVG width and height
instead of fontSize, and default aria-hidden to true while allowing
caller-provided props to override it. Preserve the existing stroke and SVG
rendering behavior.
src/gasless/useGaslessAcceptReturned.ts (1)

10-11: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Every gasless hook casts its trustvc functions to any. The shared root cause is that makeGaslessHook does not accept the operation's gasless/direct function signatures as generic parameters, so each call site suppresses type checking — leaving argument-shape drift in a beta @trustvc/trustvc to surface only at runtime.

  • src/gasless/useGaslessAcceptReturned.ts#L10-L11: drop as any on acceptReturnedGasless/acceptReturned once makeGaslessHook is generic over the function types.
  • src/gasless/useGaslessReturnToIssuer.ts#L9-L10: drop as any on returnToIssuerGasless/returnToIssuer.
  • src/gasless/useGaslessTransferOwners.ts#L11-L12: drop as any on transferOwnersGasless/transferOwners.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/gasless/useGaslessAcceptReturned.ts` around lines 10 - 11, Update
makeGaslessHook to accept the gasless and direct operation function signatures
as generic parameters, preserving type checking for their argument shapes. Then
remove the any casts from acceptReturnedGasless/acceptReturned in
src/gasless/useGaslessAcceptReturned.ts lines 10-11,
returnToIssuerGasless/returnToIssuer in src/gasless/useGaslessReturnToIssuer.ts
lines 9-10, and transferOwnersGasless/transferOwners in
src/gasless/useGaslessTransferOwners.ts lines 11-12.
src/gasless/buildSmartAccountClient.ts (1)

59-77: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Hardcoded paymaster gas limits are duplicated and unvalidated.

The same four values are repeated in both callbacks, and the fixed 300_000n/150_000n will under-estimate for paymasters with heavier validatePaymasterUserOp/postOp logic (UO rejected by the bundler) or over-reserve otherwise. Extract shared constants, and consider sourcing the limits from pimlicoClient.getPaymasterStubData/config rather than literals.

♻️ Extract shared limits
+const PAYMASTER_VERIFICATION_GAS_LIMIT = 300_000n
+const PAYMASTER_POST_OP_GAS_LIMIT = 150_000n
+
+const paymasterGasLimits = {
+  paymasterVerificationGasLimit: PAYMASTER_VERIFICATION_GAS_LIMIT,
+  paymasterPostOpGasLimit: PAYMASTER_POST_OP_GAS_LIMIT,
+}
     paymaster: {
       async getPaymasterStubData() {
         return {
           paymaster: paymasterAddress,
           paymasterData: '0x' as `0x${string}`,
-          paymasterVerificationGasLimit: 300_000n,
-          paymasterPostOpGasLimit: 150_000n,
+          ...paymasterGasLimits,
           isFinal: false,
         }
       },
       async getPaymasterData() {
         return {
           paymaster: paymasterAddress,
           paymasterData: '0x' as `0x${string}`,
-          paymasterVerificationGasLimit: 300_000n,
-          paymasterPostOpGasLimit: 150_000n,
+          ...paymasterGasLimits,
         }
       },
     },
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/gasless/buildSmartAccountClient.ts` around lines 59 - 77, Update the
paymaster callbacks in buildSmartAccountClient to remove duplicated gas-limit
literals by extracting shared constants. Prefer obtaining
paymasterVerificationGasLimit and paymasterPostOpGasLimit from
pimlicoClient.getPaymasterStubData or configuration, with appropriate fallback
only if necessary, and use the resolved limits consistently in
getPaymasterStubData and getPaymasterData.
src/gasless/gaslessHooks.test.tsx (2)

997-1017: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Assertion doesn't match the test name.

The name claims the stored paymaster becomes resolvedPaymasterAddress, but the only assertion is state === 'CONFIRMED' on the fallback path — the inline comment concedes this. Either assert the checkPaymasterWhitelist argument (from the gasless describe) or rename to reflect that it only checks no crash occurs.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/gasless/gaslessHooks.test.tsx` around lines 997 - 1017, Align the test
named “uses the paymaster stored in localStorage as resolvedPaymasterAddress”
with its stated behavior by asserting that checkPaymasterWhitelist receives the
localStorage paymaster value, reusing the existing gasless-path call-argument
assertion pattern. If that verification cannot be performed in this test, rename
it and its comments to describe the fallback no-crash behavior instead.

1019-1049: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Two duplicate tests that don't test what their names claim.

Both cases remove the same localStorage key, run the same send, and assert only CONFIRMED; neither exercises the VITE_PAYMASTER_ADDRESS fallback (this block runs with PIMLICO_API_KEY unset, so the gasless path is never entered). Collapse them into one, and move a real env-fallback assertion into the gasless path describe where the paymaster argument passed to checkPaymasterWhitelist can actually be asserted.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/gasless/gaslessHooks.test.tsx` around lines 1019 - 1049, The two tests
around useGaslessTransferHolder are duplicates and do not exercise the
PAYMASTER_ADDRESS fallback. Collapse them into one missing-localStorage coverage
test, then add a focused fallback test in the gasless-path describe that enables
the gasless flow and asserts the paymaster address passed to
checkPaymasterWhitelist comes from VITE_PAYMASTER_ADDRESS when localStorage is
absent.
src/gasless/checkDelegation.test.ts (1)

8-15: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

vi.restoreAllMocks() won't undo the direct global.fetch assignment.

restoreAllMocks only resets spies created via vi.spyOn; assigning global.fetch = vi.fn() permanently replaces the global for the rest of the worker, which can leak into other suites. Prefer vi.stubGlobal with vi.unstubAllGlobals() teardown.

♻️ Suggested test isolation
 describe('checkEIP7702Delegation', () => {
   beforeEach(() => {
-    vi.restoreAllMocks()
+    vi.unstubAllGlobals()
   })
+
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
 
   it('returns true when code starts with EIP-7702 prefix (lowercase)', async () => {
-    global.fetch = vi.fn().mockResolvedValue({
-      json: () => Promise.resolve({ result: '0xef0100deadbeef' }),
-    })
+    vi.stubGlobal(
+      'fetch',
+      vi.fn().mockResolvedValue({
+        json: () => Promise.resolve({ result: '0xef0100deadbeef' }),
+      })
+    )

Remember to also import afterEach from vitest.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/gasless/checkDelegation.test.ts` around lines 8 - 15, Update the test
setup in checkDelegation.test.ts to mock fetch with vi.stubGlobal instead of
assigning global.fetch directly, and import afterEach from vitest. Add teardown
that calls vi.unstubAllGlobals() alongside the existing mock restoration so the
global fetch replacement is removed after each test.
src/gasless/index.ts (1)

1-13: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Barrel omits paymasterStorage, so consumers deep-import it.

VerifyResult.tsx and ActionSelectionForm.tsx reach into ../../../gasless/paymasterStorage directly (and bypass the barrel for checkDelegation/checkPaymasterWhitelist too). Exporting the storage API here keeps the module boundary in one place.

♻️ Add storage exports
 export { checkEIP7702Delegation } from './checkDelegation'
 export { checkPaymasterWhitelist } from './checkPaymasterWhitelist'
 export { buildSmartAccountClient } from './buildSmartAccountClient'
+export {
+  PAYMASTER_CHANGE_EVENT,
+  getPaymasterAddress,
+  setPaymasterAddress,
+  removePaymasterAddress,
+} from './paymasterStorage'
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/gasless/index.ts` around lines 1 - 13, Update the gasless barrel exports
alongside checkEIP7702Delegation and checkPaymasterWhitelist to re-export the
paymasterStorage API, including all intended public storage symbols. Replace the
direct paymasterStorage imports in VerifyResult and ActionSelectionForm with
imports from this barrel, while preserving the existing functionality.
src/components/home/VerifySection/VerifyResult.tsx (1)

392-407: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Debounce the paymaster check triggered on every change event.

checkGasless fires two RPC round-trips synchronously from onChange whenever the current value parses as an address, so paste-then-edit sequences issue repeated on-chain reads. A short debounce (or an explicit blur/submit trigger) avoids the redundant traffic and the input flicker between checking and error.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/components/home/VerifySection/VerifyResult.tsx` around lines 392 - 407,
Debounce the checkGasless call in the paymaster address onChange handler so
rapid edits or paste-then-edit sequences trigger only one RPC check after the
input settles. Preserve the existing validation and idle/error handling for
empty or invalid values, and ensure pending debounce work is cleaned up
appropriately.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.npmrc:
- Line 1: Remove the blanket legacy-peer-deps setting from .npmrc and add a
targeted overrides entry in package.json for the specific conflicting
dependency, likely viem shared by permissionless and `@trustvc/trustvc`. If
legacy-peer-deps must remain, document the precise conflict and rationale in
.npmrc.

In `@package.json`:
- Line 37: Pin the `@trustvc/trustvc` dependency exactly to 2.15.0-beta.2 instead
of using the caret range. Keep main dependent on this fixed prerelease until
stable 2.15.0 is available, and gate merging if the *Gasless exports or
eip7702Abis APIs remain unstable.

In `@src/components/common/Icons/Icons.tsx`:
- Around line 249-266: Update the icon’s line and circle elements alongside the
arc to use the existing stroke prop instead of hardcoded `#FF8200` values. Ensure
every component of the icon consistently reflects caller-provided stroke
overrides.

In `@src/components/common/Tag/Tag.tsx`:
- Line 54: Update the className in TagBorderedLg to replace the unsupported
font-urbanist-bold utility with the configured font-urbanist family utility and
the standard font-bold weight utility, preserving the remaining classes.

In `@src/components/home/VerifySection/VerifyResult.tsx`:
- Around line 140-197: Remove the ungated debug console logging from
checkGasless, including logs for the RPC URL, title escrow address, whitelist
result, and authorization details. Preserve the existing error logging and
gasless status/error handling, unless the project provides a gated logger that
should replace the debug statements.
- Around line 184-196: Update the error handling around the verification flow in
VerifyResult, especially the BigInt(tokenId), ownerOf, and checkGasless stages,
to tag or preserve the failing stage before errors reach the catch block. Map
malformed token IDs and token-registry ownerOf failures to their own accurate
user-facing messages, keep network failures mapped to the network message, and
reserve “Invalid Paymaster Address” only for paymaster-address validation
failures; avoid relying on err.message substring matching.

In `@src/gasless/buildSmartAccountClient.ts`:
- Line 34: Update the client flow around the pimlicoUrl construction to stop
embedding pimlicoApiKey in browser-executed RPC URLs. Route bundler and
paymaster requests through a backend proxy that injects the key server-side; if
that is not available, enforce origin and rate-limit restrictions for the key
and ensure the client uses the restricted endpoint.

In `@src/gasless/checkDelegation.ts`:
- Around line 13-22: Update the delegation RPC request in checkDelegation around
the fetch call to use an AbortController with a bounded timeout, pass its signal
to fetch, and ensure the timer is cleaned up after completion. Let timeout
aborts flow through the existing catch so the function returns false.

In `@src/gasless/useGaslessRejectReturned.ts`:
- Around line 16-20: Update directGuard to validate that tokenId is present in
addition to tokenRegistryAddress, throwing a clear required-field error before
buildParams uses the non-null assertion. Keep buildParams and the existing
tokenRegistryAddress validation unchanged.

In `@src/hooks/useContactForm.ts`:
- Around line 400-419: The presign response validation around the pendingItems
mapping only rejects missing entries and allows extras to reach attachmentKeys.
Before uploading or constructing request keys, require presigned.length to
exactly equal pendingItems.length; reject and record the mismatch using the
existing error-handling flow, while preserving the per-item mapping for valid
responses.

In `@src/index.css`:
- Around line 2226-2276: Remove the fixed height constraints from
.gasless-error-frame, .gasless-guidance-frame, and .gasless-error-text, and
replace the fixed 355px width on .gasless-error-text with a fluid sizing rule
compatible with the card’s responsive layout. Preserve the flex alignment while
allowing long gasless error messages to wrap and remain fully visible on narrow
viewports.

---

Nitpick comments:
In `@src/components/common/Icons/Icons.tsx`:
- Around line 235-248: Update InfoMsgIcon to use a size prop, defaulting to 24,
for its SVG width and height instead of fontSize, and default aria-hidden to
true while allowing caller-provided props to override it. Preserve the existing
stroke and SVG rendering behavior.

In `@src/components/home/VerifySection/VerifyResult.tsx`:
- Around line 392-407: Debounce the checkGasless call in the paymaster address
onChange handler so rapid edits or paste-then-edit sequences trigger only one
RPC check after the input settles. Preserve the existing validation and
idle/error handling for empty or invalid values, and ensure pending debounce
work is cleaned up appropriately.

In `@src/gasless/buildSmartAccountClient.ts`:
- Around line 59-77: Update the paymaster callbacks in buildSmartAccountClient
to remove duplicated gas-limit literals by extracting shared constants. Prefer
obtaining paymasterVerificationGasLimit and paymasterPostOpGasLimit from
pimlicoClient.getPaymasterStubData or configuration, with appropriate fallback
only if necessary, and use the resolved limits consistently in
getPaymasterStubData and getPaymasterData.

In `@src/gasless/checkDelegation.test.ts`:
- Around line 8-15: Update the test setup in checkDelegation.test.ts to mock
fetch with vi.stubGlobal instead of assigning global.fetch directly, and import
afterEach from vitest. Add teardown that calls vi.unstubAllGlobals() alongside
the existing mock restoration so the global fetch replacement is removed after
each test.

In `@src/gasless/gaslessHooks.test.tsx`:
- Around line 997-1017: Align the test named “uses the paymaster stored in
localStorage as resolvedPaymasterAddress” with its stated behavior by asserting
that checkPaymasterWhitelist receives the localStorage paymaster value, reusing
the existing gasless-path call-argument assertion pattern. If that verification
cannot be performed in this test, rename it and its comments to describe the
fallback no-crash behavior instead.
- Around line 1019-1049: The two tests around useGaslessTransferHolder are
duplicates and do not exercise the PAYMASTER_ADDRESS fallback. Collapse them
into one missing-localStorage coverage test, then add a focused fallback test in
the gasless-path describe that enables the gasless flow and asserts the
paymaster address passed to checkPaymasterWhitelist comes from
VITE_PAYMASTER_ADDRESS when localStorage is absent.

In `@src/gasless/index.ts`:
- Around line 1-13: Update the gasless barrel exports alongside
checkEIP7702Delegation and checkPaymasterWhitelist to re-export the
paymasterStorage API, including all intended public storage symbols. Replace the
direct paymasterStorage imports in VerifyResult and ActionSelectionForm with
imports from this barrel, while preserving the existing functionality.

In `@src/gasless/useGaslessAcceptReturned.ts`:
- Around line 10-11: Update makeGaslessHook to accept the gasless and direct
operation function signatures as generic parameters, preserving type checking
for their argument shapes. Then remove the any casts from
acceptReturnedGasless/acceptReturned in src/gasless/useGaslessAcceptReturned.ts
lines 10-11, returnToIssuerGasless/returnToIssuer in
src/gasless/useGaslessReturnToIssuer.ts lines 9-10, and
transferOwnersGasless/transferOwners in src/gasless/useGaslessTransferOwners.ts
lines 11-12.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 930ec339-e626-492c-ab6c-2a39374c11a4

📥 Commits

Reviewing files that changed from the base of the PR and between 06c185b and 38b29c6.

⛔ Files ignored due to path filters (11)
  • package-lock.json is excluded by !**/package-lock.json
  • public/fonts/GilroyBold/font.woff is excluded by !**/*.woff
  • public/fonts/GilroyBold/font.woff2 is excluded by !**/*.woff2
  • public/fonts/GilroyExtraBold/font.woff is excluded by !**/*.woff
  • public/fonts/GilroyExtraBold/font.woff2 is excluded by !**/*.woff2
  • public/fonts/GilroyLight/font.woff is excluded by !**/*.woff
  • public/fonts/GilroyLight/font.woff2 is excluded by !**/*.woff2
  • public/fonts/GilroyMedium/font.woff is excluded by !**/*.woff
  • public/fonts/GilroyMedium/font.woff2 is excluded by !**/*.woff2
  • public/fonts/Urbanist/Urbanist-Italic-Variable.woff2 is excluded by !**/*.woff2
  • public/fonts/Urbanist/Urbanist-Variable.woff2 is excluded by !**/*.woff2
📒 Files selected for processing (61)
  • .github/workflows/e2e.yml
  • .npmrc
  • e2e/fixtures/local/w3c/tr_accept_surrender.json
  • e2e/fixtures/local/w3c/tr_reject_surrender.json
  • e2e/helpers/actions.ts
  • e2e/playwright.config.ts
  • e2e/setup-contracts.cjs
  • e2e/tests/nominate.spec.ts
  • e2e/tests/reject-return-to-issuer.spec.ts
  • e2e/tests/transfer-and-reject-beneficiary.spec.ts
  • e2e/tests/transfer-and-reject-owners.spec.ts
  • package.json
  • public/fonts/Urbanist/OFL.txt
  • src/components/AssetManagementPanel/AssetManagementForm/FormVariants/ActionSelectionForm/ActionSelectionForm.tsx
  • src/components/about/CapabilityCard/CapabilityCard.tsx
  • src/components/about/EcosystemCard/EcosystemCard.tsx
  • src/components/common/AddressBookOverlay/AddressBookOverlay.tsx
  • src/components/common/Button/Button.tsx
  • src/components/common/FormAlert/FormAlert.tsx
  • src/components/common/Icons/Icons.tsx
  • src/components/common/Icons/index.ts
  • src/components/common/Navbar/Navbar.tsx
  • src/components/common/Overlay/OverlayContent/DocumentTransferMessage.test.tsx
  • src/components/common/Overlay/OverlayContent/DocumentTransferMessage.tsx
  • src/components/common/PartnerCard/index.tsx
  • src/components/common/Recaptcha/Recaptcha.tsx
  • src/components/common/Tag/Tag.tsx
  • src/components/common/TextAreaField/TextAreaField.tsx
  • src/components/common/TextField/TextField.tsx
  • src/components/common/contexts/TokenInformationContext/TokenInformationContext.tsx
  • src/components/home/PartnersSection/index.tsx
  • src/components/home/VerifySection/VerifyError.tsx
  • src/components/home/VerifySection/VerifyResult.tsx
  • src/gasless/buildSmartAccountClient.ts
  • src/gasless/checkDelegation.test.ts
  • src/gasless/checkDelegation.ts
  • src/gasless/checkPaymasterWhitelist.test.ts
  • src/gasless/checkPaymasterWhitelist.ts
  • src/gasless/gaslessHooks.test.tsx
  • src/gasless/index.ts
  • src/gasless/makeGaslessHook.ts
  • src/gasless/paymasterStorage.ts
  • src/gasless/useGaslessAcceptReturned.ts
  • src/gasless/useGaslessNominate.ts
  • src/gasless/useGaslessRejectReturned.ts
  • src/gasless/useGaslessRejectTransferBeneficiary.ts
  • src/gasless/useGaslessRejectTransferHolder.ts
  • src/gasless/useGaslessRejectTransferOwners.ts
  • src/gasless/useGaslessReturnToIssuer.ts
  • src/gasless/useGaslessTransferBeneficiary.ts
  • src/gasless/useGaslessTransferHolder.ts
  • src/gasless/useGaslessTransferOwners.ts
  • src/hooks/useContactForm.ts
  • src/hooks/useContractFunctionHook.tsx
  • src/hooks/useRecaptcha.ts
  • src/index.css
  • src/pages/About/index.tsx
  • src/pages/Contact/index.tsx
  • src/pages/Partners/index.tsx
  • src/pages/Settings/index.tsx
  • tailwind.config.js
💤 Files with no reviewable changes (5)
  • e2e/tests/nominate.spec.ts
  • e2e/tests/transfer-and-reject-beneficiary.spec.ts
  • e2e/tests/transfer-and-reject-owners.spec.ts
  • e2e/setup-contracts.cjs
  • e2e/tests/reject-return-to-issuer.spec.ts

Comment thread .npmrc Outdated
Comment thread package.json Outdated
Comment thread src/components/common/Icons/Icons.tsx Outdated
Comment thread src/components/common/Tag/Tag.tsx Outdated
Comment thread src/components/home/VerifySection/VerifyResult.tsx
if (!chain)
throw new Error(`Unsupported chainId for gasless operations: ${chainId}`)

const pimlicoUrl = `https://api.pimlico.io/v2/${chainId}/rpc?apikey=${pimlicoApiKey}`

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Pimlico API key is exposed in the browser bundle.

pimlicoApiKey originates from a VITE_* env var (per the hook tests) and is embedded in a URL executed client-side, so it is readable by anyone loading the app and can be used to drain your bundler/paymaster quota. Route bundler and paymaster RPC through a backend proxy that injects the key server-side, or at minimum restrict the key by origin/rate limit in the Pimlico dashboard.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/gasless/buildSmartAccountClient.ts` at line 34, Update the client flow
around the pimlicoUrl construction to stop embedding pimlicoApiKey in
browser-executed RPC URLs. Route bundler and paymaster requests through a
backend proxy that injects the key server-side; if that is not available,
enforce origin and rate-limit restrictions for the key and ensure the client
uses the restricted endpoint.

Comment thread src/gasless/checkDelegation.ts
Comment thread src/gasless/useGaslessRejectReturned.ts
Comment thread src/hooks/useContactForm.ts
Comment thread src/index.css
@RishabhS7 RishabhS7 changed the title Develop feat: develop to main Jul 30, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/gasless/useGaslessRejectReturned.ts`:
- Around line 17-23: Update the tokenId validation in directGuard and
extraEligibility to reject only null or undefined, allowing numeric or bigint
zero as a valid identifier. Preserve the existing tokenRegistryAddress
validation, and add a regression test covering a zero/falsy tokenId.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 54490f6c-1c39-4f84-8a6e-67eb5b2a5541

📥 Commits

Reviewing files that changed from the base of the PR and between 38b29c6 and 8eb3e90.

📒 Files selected for processing (8)
  • package.json
  • src/components/common/Icons/Icons.tsx
  • src/components/home/VerifySection/VerifyResult.tsx
  • src/gasless/checkDelegation.ts
  • src/gasless/useGaslessAcceptReturned.ts
  • src/gasless/useGaslessRejectReturned.ts
  • src/hooks/useContactForm.ts
  • src/index.css
💤 Files with no reviewable changes (1)
  • src/components/home/VerifySection/VerifyResult.tsx
🚧 Files skipped from review as they are similar to previous changes (5)
  • src/gasless/checkDelegation.ts
  • src/gasless/useGaslessAcceptReturned.ts
  • src/components/common/Icons/Icons.tsx
  • src/hooks/useContactForm.ts
  • src/index.css

Comment on lines +17 to +23
directGuard: ({ tokenRegistryAddress, tokenId }) => {
if (!tokenRegistryAddress)
throw new Error('tokenRegistryAddress is required')
if (!tokenId) throw new Error('tokenId is required')
},
extraEligibility: ({ tokenRegistryAddress, tokenId }) =>
!!tokenRegistryAddress && !!tokenId,

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Candidate files:"
fd -a 'useGaslessRejectReturned\.ts|RejectReturned|gasless' . | sed 's#^\./##' | head -100

echo
echo "Target file outline:"
ast-grep outline src/gasless/useGaslessRejectReturned.ts --view compact || true

echo
echo "Target file contents:"
cat -n src/gasless/useGaslessRejectReturned.ts

echo
echo "Search related tests/usages:"
rg -n "useGaslessRejectReturned|gaslessRejectReturned|RejectReturned|tokenRegistryAddress|tokenId" src test tests __tests__ 2>/dev/null || true

Repository: TrustVC/trustvc-website

Length of output: 22220


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "TypeScript / lint config availability:"
git ls-files | rg '(^|/)(tsconfig.*\.json|eslint\.config\.js|eslint\.config\.mjs|package\.json)$' | head -50

echo
echo "Relevant package TypeScript / lint configuration:"
for f in package.json tsconfig.json tsconfig.*.json eslint.config.js eslint.config.mjs; do
  [ -f "$f" ] && { echo "--- $f" && cat "$f"; }
done

echo
echo "makeGaslessHook and token type declarations:"
cat -n src/gasless/makeGaslessHook.ts
echo
rg -n "rejectReturned\\(|rejectReturnedGasless\\(|tokenId" node_modules 2>/dev/null | head -80 || { echo "node_modules not present"; }

echo
echo "Behavioral probe for current guard/eligibility inputs:"
node - <<'JS'
const cases = [undefined, null, 0n, 0, '0']
const directGuard = ({ tokenId }) => {
  if (!tokenId) throw new Error('tokenId is required')
}
const extraEligibility = ({ tokenId }) => !!tokenId
for (const tokenId of cases) {
  console.log(JSON.stringify(tokenId === 0n ? 0n : tokenId), 'directGuard throws:', (() => { try { directGuard({ tokenId }) } catch (e) { return true } })(), 'extraEligibility:', !!extraEligibility({ tokenId }))
}
JS

Repository: TrustVC/trustvc-website

Length of output: 26168


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "TypeScript / lint config availability:"
git ls-files | rg '(^|/)(tsconfig.*\.json|eslint\.config\.js|eslint\.config\.mjs|package\.json)$' | head -50

echo
echo "Relevant package TypeScript / lint configuration:"
for f in package.json tsconfig.json tsconfig.*.json eslint.config.js eslint.config.mjs; do
  [ -f "$f" ] && { echo "--- $f" && cat "$f"; }
done

echo
echo "makeGaslessHook and token type declarations:"
cat -n src/gasless/makeGaslessHook.ts
echo
rg -n "rejectReturned\\(|rejectReturnedGasless\\(|tokenId" node_modules 2>/dev/null | head -80 || { echo "no node_modules"; }

echo
echo "Behavioral probe for current guard/eligibility inputs:"
node - <<'JS'
const cases = [undefined, null, 0n, 0, '0']
const directGuard = ({ tokenId }) => {
  if (!tokenId) throw new Error('tokenId is required')
}
const extraEligibility = ({ tokenId }) => !!tokenId
for (const tokenId of cases) {
  console.log(JSON.stringify(tokenId === 0n ? 0n : tokenId), 'directGuardThrows:', (() => { try { directGuard({ tokenId }); return false } catch (e) { return true } })(), 'extraEligibility:', extraEligibility({ tokenId }))
}
JS

Repository: TrustVC/trustvc-website

Length of output: 22767


Accept falsy zero values for tokenId.

!tokenId rejects numeric/bigint 0 while allowing undefined/null. ERC-721 contracts may use identifier 0. Use explicit undefined/null checks in directGuard and extraEligibility, and add a regression test for a valid zero/falsy token identifier.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/gasless/useGaslessRejectReturned.ts` around lines 17 - 23, Update the
tokenId validation in directGuard and extraEligibility to reject only null or
undefined, allowing numeric or bigint zero as a valid identifier. Preserve the
existing tokenRegistryAddress validation, and add a regression test covering a
zero/falsy tokenId.

RishabhS7 and others added 2 commits July 31, 2026 17:07
* chore: e2e tests for txns

* feat: gasless transactions

* fix: add legacy-peer-deps to resolve permissionless/ox/viem conflict

permissionless@0.3.7 declares peerOptional ox@^0.11.3 but viem@2.55.1
ships ox@0.14.30, which is out of range. trustvc@2.15.0-beta.2 requires
both viem@^2.53.1 and permissionless@^0.3.6, so neither can be downgraded.
legacy-peer-deps makes npm skip the conflicting optional peer check.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: regenerate package-lock.json with sentry and react-ga4 entries

Lock file was missing @sentry/react, @sentry/vite-plugin, and react-ga4
that were added during the upstream merge, causing npm ci to fail in CI.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: move whitelist fallback tests into gasless section for CI compatibility

The two whitelist-fallback tests require hasGaslessConfig=true (PIMLICO_API_KEY
set) to reach the whitelist check. In CI without a .env file the module-level
constant is undefined, so the hook skips delegation/whitelist entirely and the
assertions on checkPaymasterWhitelist always failed.

Moving them into the gasless section which uses vi.stubEnv + vi.resetModules +
dynamic imports ensures PIMLICO_API_KEY is set when these tests run.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: add @playwright/test explicitly to ensure playwright-core is installed

synpress-cache imports playwright-core at runtime. Since @playwright/test
was only a transitive peer dep of synpress (not listed directly), it was
not installed under legacy-peer-deps, causing ERR_MODULE_NOT_FOUND in CI
during the e2e:setup-wallet step. Pinning to 1.48.2 matches the version
already resolved in the lock file.

* fix: exclude amoy-verify and pol-verify specs from main e2e run

The pattern /verify-.*\.spec\.ts/ only matched files starting with
"verify-", leaving amoy-verify.spec.ts and pol-verify.spec.ts in the
main MetaMask suite. Those specs hit external RPC endpoints (Amoy/Polygon
mainnet) which are unreliable in CI and have no MetaMask dependency.

Widened to /.*verify.*\.spec\.ts/ so all verify specs (local, amoy, pol)
run only via playwright.verify.config.ts.

* chore: remove push trigger from e2e workflow

E2E runs on every push to main/develop were expensive and unnecessary.
Keeping only pull_request (gates PRs) and workflow_dispatch (manual runs).

* fix: move @testing-library/dom to devDeps; disable e2e retries on dirty chain

- @testing-library/dom belongs in devDependencies (test-only, not shipped)
- retries disabled in playwright.config.ts: every spec mutates Hardhat chain
  state (transfer/reject/return), so a retry after partial failure hits an
  already-modified chain and fails for a different reason — retries here
  give false signal, not recovery

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: apply CodeRabbit review fixes for gasless transaction feature

- Extract shared makeGaslessHook factory to eliminate ~90-line duplication
  across 10 hooks; each hook is now a ~20-line thin wrapper
- Add paymasterStorage.ts helper with custom event for same-tab reactivity
- Make ActionSelectionForm reactive to paymaster localStorage changes
- Add try/catch around eligibility checks to fall back to paid path on RPC failure
- Add tokenRegistryAddress + tokenId to hasGaslessConfig for AcceptReturned/RejectReturned
- Fix blank error messages for unknown/gasless errors with Error.message fallback
- Add aria-invalid, aria-describedby, role="alert" to paymaster address input
- Merge duplicate .check-gasless-content-success-text CSS rules
- Replace hard-coded pixel dimensions with fluid values in pay-on-behalf CSS
- Replace gap shorthand with column-gap to preserve row-gap: 0px

* fix: show both children and errorMessage in DocumentTransferMessage

Previously the component rendered errorMessage OR children — never both.
After the error-fallback fix in makeGaslessHook (e.message for unknown
errors), errorMessage became truthy for contract-level reverts, hiding
address/context children that E2E tests depend on.

Now children always render; errorMessage appends below when present,
giving users both the context (current addresses) and the error detail.

* chore: reset paymaster address on page reload (in-memory store)

Swap localStorage for a module-level Map so the paymaster address
clears on every page load. Also drops the cross-tab 'storage' event
listener in ActionSelectionForm since it is no longer relevant.

TODO: restore localStorage persistence when the feature is ready.

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: apply CodeRabbit review fixes (round 2)

- Icons: use stroke prop for line/circle in warning icon (was hardcoded #FF8200)
- VerifyResult: remove debug console statements leaking RPC URL and wallet identifiers
- checkDelegation: add 10s AbortController timeout to RPC fetch
- AcceptReturned/RejectReturned: add tokenId validation to directGuard
- useContactForm: validate presigned.length === pendingItems.length before upload
- index.css: replace fixed height/width on gasless error classes with min-height/auto

* chore: pin @trustvc/trustvc to exact version 2.15.0-beta.2

Remove caret range to prevent unintended upgrades to future beta versions.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
src/index.css (1)

17-17: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Remove quotes around Urbanist and Avenir font-family names.

Stylelint flags font-family-name-quotes errors at these lines. Urbanist and Avenir are valid CSS identifiers and do not need quotes. Other rules added in this same diff already use the unquoted form (for example, line 696 font-family: Urbanist, sans-serif;). Fix the quoted occurrences for lint consistency.

🔧 Example fix pattern (apply to all flagged lines)
   `@font-face` {
-    font-family: 'Urbanist';
+    font-family: Urbanist;
     src: url('/fonts/Urbanist/Urbanist-Variable.woff2') format('woff2');

Apply the same unquoting to lines 26, 77, 435, 444, 2143, 2264, 2319, 2355, 3775, 4107, 4181, and 4708.

Also applies to: 26-26, 77-77, 435-435, 444-444, 2143-2143, 2264-2264, 2319-2319, 2355-2355, 3775-3775, 4107-4107, 4181-4181, 4708-4708

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/index.css` at line 17, Remove quotes from every flagged Urbanist and
Avenir font-family name in the stylesheet, including the declarations near the
referenced lines. Preserve any fallback fonts and ordering while matching the
existing unquoted font-family style.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/index.css`:
- Around line 2185-2191: Remove the redundant duplicate border-radius
declaration from the .gasless-address-input-field styles, keeping a single
border-radius: 8px; while preserving the background and border declarations.
- Around line 2193-2195: Update the `.gasless-address-input-field:focus-visible`
rule to retain a clearly visible keyboard-focus indicator instead of only
removing the outline, using an appropriate border-color change or box-shadow
consistent with the surrounding input styles.

---

Outside diff comments:
In `@src/index.css`:
- Line 17: Remove quotes from every flagged Urbanist and Avenir font-family name
in the stylesheet, including the declarations near the referenced lines.
Preserve any fallback fonts and ordering while matching the existing unquoted
font-family style.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b8a13ac9-3311-4a8b-9625-a7b967d745a1

📥 Commits

Reviewing files that changed from the base of the PR and between 8eb3e90 and a28ecb4.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (40)
  • .npmrc
  • e2e/fixtures/local/w3c/tr_accept_surrender.json
  • e2e/fixtures/local/w3c/tr_reject_surrender.json
  • e2e/helpers/actions.ts
  • e2e/playwright.config.ts
  • e2e/setup-contracts.cjs
  • e2e/tests/nominate.spec.ts
  • e2e/tests/reject-return-to-issuer.spec.ts
  • e2e/tests/transfer-and-reject-beneficiary.spec.ts
  • e2e/tests/transfer-and-reject-owners.spec.ts
  • package.json
  • src/components/AssetManagementPanel/AssetManagementForm/FormVariants/ActionSelectionForm/ActionSelectionForm.tsx
  • src/components/common/Icons/Icons.tsx
  • src/components/common/Icons/index.ts
  • src/components/common/Overlay/OverlayContent/DocumentTransferMessage.test.tsx
  • src/components/common/Overlay/OverlayContent/DocumentTransferMessage.tsx
  • src/components/common/contexts/TokenInformationContext/TokenInformationContext.tsx
  • src/components/home/VerifySection/VerifyResult.tsx
  • src/gasless/buildSmartAccountClient.ts
  • src/gasless/checkDelegation.test.ts
  • src/gasless/checkDelegation.ts
  • src/gasless/checkPaymasterWhitelist.test.ts
  • src/gasless/checkPaymasterWhitelist.ts
  • src/gasless/gaslessHooks.test.tsx
  • src/gasless/index.ts
  • src/gasless/makeGaslessHook.ts
  • src/gasless/paymasterStorage.ts
  • src/gasless/useGaslessAcceptReturned.ts
  • src/gasless/useGaslessNominate.ts
  • src/gasless/useGaslessRejectReturned.ts
  • src/gasless/useGaslessRejectTransferBeneficiary.ts
  • src/gasless/useGaslessRejectTransferHolder.ts
  • src/gasless/useGaslessRejectTransferOwners.ts
  • src/gasless/useGaslessReturnToIssuer.ts
  • src/gasless/useGaslessTransferBeneficiary.ts
  • src/gasless/useGaslessTransferHolder.ts
  • src/gasless/useGaslessTransferOwners.ts
  • src/hooks/useContactForm.ts
  • src/hooks/useContractFunctionHook.tsx
  • src/index.css
💤 Files with no reviewable changes (5)
  • e2e/tests/nominate.spec.ts
  • e2e/tests/transfer-and-reject-beneficiary.spec.ts
  • e2e/tests/reject-return-to-issuer.spec.ts
  • e2e/setup-contracts.cjs
  • e2e/tests/transfer-and-reject-owners.spec.ts
🚧 Files skipped from review as they are similar to previous changes (31)
  • src/components/common/Overlay/OverlayContent/DocumentTransferMessage.tsx
  • src/gasless/useGaslessAcceptReturned.ts
  • .npmrc
  • src/components/common/Icons/index.ts
  • src/components/common/Overlay/OverlayContent/DocumentTransferMessage.test.tsx
  • src/gasless/useGaslessTransferOwners.ts
  • e2e/playwright.config.ts
  • src/gasless/paymasterStorage.ts
  • src/gasless/useGaslessRejectTransferBeneficiary.ts
  • src/gasless/useGaslessReturnToIssuer.ts
  • src/gasless/useGaslessRejectTransferOwners.ts
  • src/gasless/checkDelegation.ts
  • src/gasless/checkDelegation.test.ts
  • package.json
  • src/gasless/useGaslessNominate.ts
  • src/gasless/useGaslessTransferBeneficiary.ts
  • src/hooks/useContractFunctionHook.tsx
  • src/gasless/checkPaymasterWhitelist.test.ts
  • e2e/helpers/actions.ts
  • src/gasless/checkPaymasterWhitelist.ts
  • src/gasless/useGaslessTransferHolder.ts
  • src/hooks/useContactForm.ts
  • src/gasless/useGaslessRejectTransferHolder.ts
  • src/components/common/contexts/TokenInformationContext/TokenInformationContext.tsx
  • src/gasless/index.ts
  • src/gasless/buildSmartAccountClient.ts
  • src/components/home/VerifySection/VerifyResult.tsx
  • src/components/AssetManagementPanel/AssetManagementForm/FormVariants/ActionSelectionForm/ActionSelectionForm.tsx
  • src/gasless/useGaslessRejectReturned.ts
  • src/gasless/makeGaslessHook.ts
  • src/gasless/gaslessHooks.test.tsx

Comment thread src/index.css
Comment on lines +2185 to +2191
/* TrustVC/Surface/Base/BG/Default */
background: #ffffff;
border-radius: 8px;
/* TrustVC/Stroke/Base/Enabled */
border: 1px solid #a9b2bb;
border-radius: 8px;
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Duplicate border-radius declaration.

.gasless-address-input-field declares border-radius: 8px; twice, at Line 2187 and Line 2190. Stylelint flags this as a duplicate property. Remove the redundant declaration.

🔧 Proposed fix
   /* TrustVC/Surface/Base/BG/Default */
   background: `#ffffff`;
-  border-radius: 8px;
   /* TrustVC/Stroke/Base/Enabled */
   border: 1px solid `#a9b2bb`;
   border-radius: 8px;
 }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
/* TrustVC/Surface/Base/BG/Default */
background: #ffffff;
border-radius: 8px;
/* TrustVC/Stroke/Base/Enabled */
border: 1px solid #a9b2bb;
border-radius: 8px;
}
/* TrustVC/Surface/Base/BG/Default */
background: `#ffffff`;
/* TrustVC/Stroke/Base/Enabled */
border: 1px solid `#a9b2bb`;
border-radius: 8px;
}
🧰 Tools
🪛 Stylelint (17.14.1)

[error] 2187-2187: Duplicate property "border-radius" (declaration-block-no-duplicate-properties)

(declaration-block-no-duplicate-properties)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/index.css` around lines 2185 - 2191, Remove the redundant duplicate
border-radius declaration from the .gasless-address-input-field styles, keeping
a single border-radius: 8px; while preserving the background and border
declarations.

Source: Linters/SAST tools

Comment thread src/index.css
Comment on lines +2193 to +2195
.gasless-address-input-field:focus-visible {
outline: none;
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Add a visible focus indicator to .gasless-address-input-field:focus-visible.

This rule sets outline: none; without a replacement focus style. Keyboard users lose the visible focus indicator on the gasless address input field. Add an alternative focus indicator, such as a border-color change or box-shadow.

🔧 Proposed fix
 .gasless-address-input-field:focus-visible {
-  outline: none;
+  outline: none;
+  border-color: `#5b5bb3`;
+  box-shadow: 0 0 0 2px rgba(91, 91, 179, 0.35);
 }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
.gasless-address-input-field:focus-visible {
outline: none;
}
.gasless-address-input-field:focus-visible {
outline: none;
border-color: `#5b5bb3`;
box-shadow: 0 0 0 2px rgba(91, 91, 179, 0.35);
}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/index.css` around lines 2193 - 2195, Update the
`.gasless-address-input-field:focus-visible` rule to retain a clearly visible
keyboard-focus indicator instead of only removing the outline, using an
appropriate border-color change or box-shadow consistent with the surrounding
input styles.

RishabhS7 and others added 2 commits July 31, 2026 17:57
* fix: code rabbit changes

* chore: replace legacy-peer-deps with targeted ox override for permissionless

permissionless@0.3.7 has optional peer ox@^0.11.3 but viem@2.55.1 ships
ox@0.14.30, which is outside that range. Adding overrides.permissionless.ox
in package.json pins the resolution to 0.14.30 so npm resolves cleanly
without the blanket legacy-peer-deps flag.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: code rabit comments

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
)

Without this key at build time hasGaslessConfig evaluates to false in
makeGaslessHook, causing every transaction to fall back to the direct
(payable) path even after paymaster verification succeeds.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
.github/workflows/deploy-dev.yml (1)

48-79: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Validate VITE_PIMLICO_API_KEY before both deployments generate .env.

Both jobs can write an empty key and complete deployment successfully while gasless transactions fail.

  • .github/workflows/deploy-dev.yml#L48-L79: add : "${VITE_PIMLICO_API_KEY:?VITE_PIMLICO_API_KEY is required}" before .env generation.
  • .github/workflows/deploy-prod.yml#L26-L59: add the same check before .env generation.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-dev.yml around lines 48 - 79, Validate
VITE_PIMLICO_API_KEY before generating .env in both deployment jobs: add the
required-variable shell check before the Create .env for build step in
.github/workflows/deploy-dev.yml lines 48-79 and
.github/workflows/deploy-prod.yml lines 26-59. Ensure either deployment fails
immediately with the specified error when the key is unset or empty, rather than
writing an invalid .env and continuing.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/deploy-dev.yml:
- Around line 48-79: Validate VITE_PIMLICO_API_KEY before generating .env in
both deployment jobs: add the required-variable shell check before the Create
.env for build step in .github/workflows/deploy-dev.yml lines 48-79 and
.github/workflows/deploy-prod.yml lines 26-59. Ensure either deployment fails
immediately with the specified error when the key is unset or empty, rather than
writing an invalid .env and continuing.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: eaef4eae-d266-4e79-acda-ae01f8c616a7

📥 Commits

Reviewing files that changed from the base of the PR and between a28ecb4 and f8ed077.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (8)
  • .env.example
  • .github/workflows/deploy-dev.yml
  • .github/workflows/deploy-prod.yml
  • .npmrc
  • package.json
  • src/components/common/Tag/Tag.tsx
  • src/components/home/VerifySection/VerifyResult.tsx
  • src/index.css
🚧 Files skipped from review as they are similar to previous changes (3)
  • package.json
  • src/components/home/VerifySection/VerifyResult.tsx
  • src/index.css

@rongquan1
rongquan1 merged commit 8f60217 into main Jul 31, 2026
13 of 14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants