feat: unify app shell, add fuzzy command palette, harden agent_bidding commit-reveal

[kaluuba-org]

Summary

Closes #348, Closes #350, Closes #352.

Three issues that turned out to share a dependency: #352 introduces a single
source of truth for navigation, and #348's palette reads from it so the two can
never drift apart. #350 is independent — a security review and hardening pass on
the agent_bidding commit-reveal auction.

One thing to flag up front: main does not build. Several files carry two
concatenated copies of themselves from bad merges. The frontend was unbuildable,
so #348 and #352 could not be written or verified without repairing it — that
repair is the first commit and is described in detail below. The backend and one
contract crate are broken the same way and are deliberately untouched; see
Pre-existing breakage.

Changes

fix(frontend): repair merge debris that broke the build

Where a file held two versions, the one kept is the one the rest of the codebase
already depends on:

File	Kept	Why
ToastContext.tsx	the version exporting ToastContext	hooks/useToast.ts imports it
SendXLMForm.tsx	react-hook-form + zod	the file's own imports point at it
TaskSubmissionForm.tsx	the i18n-aware makeTaskSchema factory	the static import cannot take t
Hero.tsx	plain elements	opening tags were already un-wrapped; only closing tags still said motion.*

AgentDetailModal.tsx regained the useAgentReputation call its JSX still read
from; Toast.css lost an orphaned @keyframes body that failed postcss. Fixing
the parse errors surfaced a second layer of type errors that had been masked
behind them.

Two behaviour fixes fell out of this:

• The task submit button was gated on !isValid, so an untouched form could
  never be submitted — a dead button with no explanation. Validation now runs on
  click and says what is wrong.
• AgentReputationRadar.test.tsx stubbed ResponsiveContainer without passing
  dimensions down, so recharts drew nothing. It failed on main too.

feat(frontend): unify the application shell — #352

The sidebar, drawer, and top nav each carried their own navigation list, which
is how they drifted: the drawer's labels were hardcoded English while the
sidebar's were translated, and the sidebar's "Dashboard" pointed at / — the
public landing page — rather than /dashboard. layout/navigation.ts is now the
single source of truth for all of them, plus the breadcrumb and the page title.

• Grouped collapsible sidebar (Overview / Work / Account). Collapsing hides
  labels visually but keeps them in the accessibility tree; previously they were
  removed from the DOM and the buttons lost their accessible names.
• Animated active state — one shared layoutId pill slides between items
  instead of blinking. Disabled under prefers-reduced-motion.
• Active matching is exact-or-descendant: /tasks/new/step-2 highlights
  "New Task", while /tasks/abc-123 (a detail page with no nav entry) correctly
  highlights nothing.
• Slide-over drawer now enters from the left — the side the sidebar occupies
  on desktop — rather than sliding up from an edge nothing else in the app uses.
• Breadcrumbs render structural segments like /tasks as plain text instead
  of links that 404, and wrap rather than pushing the page sideways.
• Per-user sidebar state: keyed by wallet (sidebar_collapsed:<publicKey>).
  Signed-out users keep the old unscoped key, so no existing preference is
  dropped. Storage access is guarded — private-mode browsers throw, and the shell
  falls back to an expanded sidebar rather than failing to render.
• Breakpoint 768px → 1024px per the acceptance criteria.

feat(frontend): fuzzy command palette — #348

Matching was String.includes(), which finds nothing unless you type a
contiguous run, and results came back in source-iteration order.

• Scored subsequence matcher (utils/fuzzy.ts): dsh → "Dashboard",
  cpad → "Copy wallet address". Scoring rewards consecutive characters, word
  starts (including camelCase humps) and early matches; penalises gaps and long
  unmatched prefixes — the difference between a match and the match. It also
  returns matched indices, which the palette uses to highlight the exact
  characters that hit.
• Sources: pages (from the shared nav config), actions, agents (name and
  capabilities), tasks (id, prompt, status), and recent history — searchable as a
  source, so re-running an earlier query needs only a few of its characters.
  Field and category weights rank a title hit above the same hit in a subtitle,
  and actions above recents.
• Actions: run new task, jump to agent, open wallet, copy address, toggle
  theme. Copy-address is hidden with no wallet connected rather than offered dead.
• Keyboard-first: arrows and Tab move selection, Home/End jump to the ends,
  Enter runs, Escape dismisses. Tab is trapped. Focus stays on the input and the
  list is driven via aria-activedescendant over a real listbox/option
  structure, so screen readers announce the highlighted row without focus moving.

Selecting a recent search now refills the query — it previously fired a search
whose results were thrown away. All strings are translated (en + zh).

feat(contracts): harden agent_bidding — #350

Full threat model, per-attack mitigation, and residual risks in
smart-contracts/docs/agent-bidding-security.md;
every claim there names the test that proves it.

	Attack	Mitigation
A-1	reveal_bids was callable the instant bidding closed, so an attacker could reveal their own poor bid and finalise in the same ledger, scoring out everyone who had not yet landed a reveal	Bounded reveal window; finalisation refused while the window is open and any bid is still sealed. Early finalisation stays allowed once nothing is outstanding, which cannot be forced
A-2	Non-reveal was free, making a sealed bid a costless option to walk away after reading the field	Bonds settle asymmetrically — revealers refunded, non-revealers forfeit
A-3	The pre-image bound only the bidder, so identical plaintext committed identically across auctions and deployments, leaking still-sealed bids	Domain separation over (domain, contract_id, task_id); commitment_of published so tooling cannot drift from what reveal_bid verifies
A-6	Unbounded price, terms, and bidder count — the last of which could push reveal_bids past the resource limit and wedge an auction, stranding every bond	max_price, MAX_BID_PRICE, MAX_BIDDERS, MAX_TERMS_LEN, bounded durations, checked arithmetic, paginated get_bidders
A-7	An auction nobody revealed on locked bonds forever	abort_auction rescue path
A-8	reveal_bids and award_contract mutated state with no caller and no require_auth	Both authenticate; award_contract is restricted to creator or winner

The doc is equally explicit about what is not covered — reputation is
self-declared, reveals are public as they land, Sybil resistance is bond cost
alone, and bonds/escrow are modelled as state rather than custodied here. Those
are integration-critical.

Tests grow 27 → 50, covering replay (cross-auction, cross-bidder,
re-reveal), late reveal, double commit, the finalisation front-run, forfeiture,
every cap, and the abort path.

Cargo.lock is refreshed: it still listed three removed crates and missed
agent-registry's upgrade-manager dependency, which fails CI's --locked
builds.

Verification & Testing

• npm test (Frontend) — 35 files, 319 tests pass
• npm run build (Frontend) — clean, tsc --noEmit clean
• cargo test --locked -p agent-bidding — 50 pass
• cargo fmt --all --check && cargo clippy --locked -p agent-bidding --all-targets -- -D warnings — clean
• cargo build --locked -p agent-bidding --target wasm32v1-none --release — clean
• npm test (Backend) — cannot run, see below

Pre-existing breakage not addressed here

Verified present on upstream/main before this branch:

1. Backend does not compile. package.json is invalid JSON (two manifests
   concatenated), tsconfig.json and jest.config.js likewise, and src/api/app.ts
   holds two different createApp factories. Repairing the manifests leaves
   ~45 type errors across ~12 files.
2. upgrade-manager does not compile (25+ errors), which breaks
   agent-registry, which the contracts CI job builds.

I stopped short of both. Each bad merge means judging which half of someone
else's work is canonical, across a subsystem none of these three issues touch —
and a wrong guess there is worse than leaving the breakage visible. The frontend
was different: #348 and #352 live in it, and I could not verify my own work
without it building.

Because CI's contracts job is gated on needs: [backend, frontend], the
backend failure will keep the contract checks from running on this PR. The
agent_bidding commands above were run locally and all pass. Happy to open a
separate PR for the backend repair if maintainers want it.

Contributor Checklist

• PR title follows Conventional Commits
• All CI checks that can pass locally, do
• Documentation updated — new smart-contracts/docs/agent-bidding-security.md, updated contract README and frontend/LAYOUT_IMPLEMENTATION.md
• No secrets or credentials committed

[drips-wave]

@kaluuba-org Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@mananuf is attempting to deploy a commit to the Jaja's projects Team on Vercel.

A member of the Team first needs to authorize it.