chore: harden Somnia session frontend

[CryptoMickle]

Summary

• update viem and wagmi to their current compatible patch releases
• pin patched transitive versions of axios, js-yaml, and ws
• reduce the dependency audit from 35 findings (including 6 high) to 26 moderate, 0 high, and 0 critical without forced major downgrades
• expand the Content Security Policy and browser security headers
• disable the X-Powered-By response header

Verification

• clean install with npm 10.9.4
• lint: 0 errors; 15 pre-existing warnings
• TypeScript check passed
• RISE production webpack build passed
• Somnia standard-play webpack build passed
• Somnia session-key webpack build passed
• production and development /onchain runtime checks returned HTTP 200 with the expected security headers
• npm audit: 26 moderate, 0 high, 0 critical

Guardrails

• stacked on draft PR feat: add feature-flagged Somnia session keys #26 (feat/somnia-session-keys)
• no contract, chain, Vercel environment, domain, or production changes
• MetaMask Support branch and published preview URL remain unchanged at 4ba8ea2
• keep this PR in draft until its isolated preview has completed browser/wallet QA and the gas-sponsorship policy has been reviewed
• the static CSP retains unsafe-inline; nonce-based CSP should be evaluated separately because it changes rendering and deployment behavior

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
delveworn	Ready	Preview	Sep 1, 2026 2:53pm UTC
delveworn-somnia	Ready	Preview	Sep 1, 2026 2:53pm UTC

[CryptoMickle]

Isolated preview QA

Tested the two Vercel previews created for this draft PR.

• Somnia Shannon /onchain loaded with chain ID 50312, the expected dungeon contract, and no browser console warnings or errors.
• RISE /onchain loaded with chain ID 11155931, the expected RISE contract, and no browser console warnings or errors.
• Somnia /practice started a local run and completed a local attack with no console warnings or errors.
• The Somnia wallet entry transitioned to Standard Play and opened the Thirdweb MetaMask connection UI without CSP/runtime errors.
• No wallet account was connected and no signature or transaction was requested during this QA pass.

The branch-specific Somnia session-key variables currently remain scoped to feat/somnia-session-keys, so this new security preview intentionally falls back to Standard Play. Full isolated Instant Play QA will require explicitly enabling the two public preview variables for security/somnia-session-hardening and allowlisting its preview domain in Thirdweb.

Sponsorship-policy review

• Keep the existing Somnia Shannon chain restriction.
• Add a conservative global spend limit before any mainnet rollout.
• Do not enable a dashboard rule that only allows the dungeon contract: smart-account creation, session authorization, and revocation also need account/factory transactions and would be blocked.
• A server verifier is the recommended follow-up for production-grade limits on chain, zero value, targets, selectors, and gas.

No production, support-branch, domain, or existing URL settings were changed.

[CryptoMickle]

Isolated preview QA update

• Branch-scoped Vercel config is active on security/somnia-session-hardening.
• The isolated preview domain is allowlisted in Thirdweb.
• Fresh preview redeploy loaded the Somnia Shannon onchain entry with Instant Play enabled.
• MetaMask Instant Play session creation completed and the UI reached INSTANT PLAY ACTIVE on the expected smart-account player.
• The hardened client verifies the stored onchain permission before activation: Delveworn contract target allowlisted, zero native-token limit, active start/end window, and matching session signer.
• No additional gameplay transaction was sent during this QA checkpoint.

Production and the existing support preview were not changed.

[CryptoMickle]

Strict session-permission verification

Added commit 210619f to tighten the activation and restore checks for Somnia Instant Play. A session is now accepted only when:

• the connected owner remains an administrator of the smart account;
• the temporary signer is explicitly not an administrator;
• the Delveworn dungeon is the single approved target;
• the native-token allowance is zero;
• the permission window is active, matches the stored expiry, and is no longer than eight hours plus the 30-second clock-skew allowance.

Verification completed:

• ESLint: 0 errors (existing warnings only)
• TypeScript: passed
• Somnia Session Keys production build: passed
• GitHub CI: all three deployment configurations passed
• Both Vercel previews: Ready
• Fresh browser reload of the Somnia security preview: correct chain and dungeon contract, no console warnings or errors

No production URL, support URL, contract address, or Vercel environment scope was changed. A fresh wallet-backed Session Keys creation/revocation pass remains the final manual QA step.