From 483ab12219f05ced62f128dcf44ca332320bf19e Mon Sep 17 00:00:00 2001
From: Wieedze <maxime.moodz@gmail.com>
Date: Tue, 28 Apr 2026 08:42:15 +0200
Subject: [PATCH 1/9] feat(webapp): Safe co-admin shortcut on Deploy + Docs
 link from banners
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two small UX wins around the Safe story:

Deploy form (packages/webapp/src/pages/Deploy.tsx):
- "+ Add my wallet" button (when connected) — appends the EOA to the
  admins textarea
- "+ Add Safe address" toggle — opens an inline input with an Add
  button that validates checksummed-address before appending
- appendAdmin helper handles dedup so the same address can't land
  twice
- Existing "Heads up" hint now links to /docs/safe-admin

Removes friction for the recommended pattern (EOA + Safe co-admins
from genesis) — users no longer have to copy-paste two addresses.

ProxyAdminSafeBanner (packages/webapp/src/components/):
- Both EOA banners (mainnet rose + dev amber) now link to
  /docs/safe-admin via react-router Link
- "Safe admin guide" call-to-action is the actionable next step for
  someone who lands on the warning

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../src/components/ProxyAdminSafeBanner.tsx   | 19 +++++-
 packages/webapp/src/pages/Deploy.tsx          | 67 ++++++++++++++++++-
 2 files changed, 81 insertions(+), 5 deletions(-)

diff --git a/packages/webapp/src/components/ProxyAdminSafeBanner.tsx b/packages/webapp/src/components/ProxyAdminSafeBanner.tsx
index 8f86c95..744b6fd 100644
--- a/packages/webapp/src/components/ProxyAdminSafeBanner.tsx
+++ b/packages/webapp/src/components/ProxyAdminSafeBanner.tsx
@@ -1,3 +1,4 @@
+import { Link } from 'react-router-dom'
 import type { Address } from 'viem'
 import { useChainId } from 'wagmi'
 import { useSafeStatus } from '../hooks/useSafeStatus'
@@ -47,14 +48,28 @@ export function ProxyAdminSafeBanner({ proxyAdmin }: Props) {
   if (onMainnet) {
     return (
       <div className="rounded-lg border border-rose-400/50 bg-rose-400/5 px-4 py-3 text-xs text-rose-300">
-        <strong>EOA proxyAdmin on mainnet — high risk.</strong> This single key can swap the proxy&apos;s implementation, replacing the entire logic of the contract. A key compromise here means total loss of control. Rotate to a Gnosis Safe before any production use.
+        <strong>EOA proxyAdmin on mainnet — high risk.</strong> This single key can swap the proxy&apos;s implementation, replacing the entire logic of the contract. A key compromise here means total loss of control. Rotate to a Gnosis Safe before any production use.{' '}
+        <Link
+          to="/docs/safe-admin"
+          className="underline decoration-rose-400/60 hover:decoration-rose-200 font-medium"
+        >
+          Read the Safe admin guide
+        </Link>
+        .
       </div>
     )
   }
 
   return (
     <div className="rounded-lg border border-amber-400/30 bg-amber-400/5 px-4 py-2.5 text-xs text-amber-300">
-      <strong>EOA proxyAdmin.</strong> Fine for dev / testing. Rotate to a Safe before this proxy goes near mainnet.
+      <strong>EOA proxyAdmin.</strong> Fine for dev / testing. Rotate to a Safe before this proxy goes near mainnet.{' '}
+      <Link
+        to="/docs/safe-admin"
+        className="underline decoration-amber-400/60 hover:decoration-amber-200"
+      >
+        Safe admin guide
+      </Link>
+      .
     </div>
   )
 }
diff --git a/packages/webapp/src/pages/Deploy.tsx b/packages/webapp/src/pages/Deploy.tsx
index 4185bf1..536e7d6 100644
--- a/packages/webapp/src/pages/Deploy.tsx
+++ b/packages/webapp/src/pages/Deploy.tsx
@@ -20,7 +20,7 @@ import { Spinner } from '../components/Spinner'
 const FEE_DENOMINATOR = 10_000n
 
 export default function DeployPage() {
-  const { isConnected } = useAccount()
+  const { address: connectedAddress, isConnected } = useAccount()
   const chainId = useChainId()
   const network = networkFor(chainId)
   const navigate = useNavigate()
@@ -33,6 +33,18 @@ export default function DeployPage() {
   const [fixedFeeEth, setFixedFeeEth] = useState<string>('0.1')
   const [percentageBps, setPercentageBps] = useState<string>('500')
   const [adminsRaw, setAdminsRaw] = useState<string>('')
+  const [safeInput, setSafeInput] = useState<string>('')
+  const [showSafeInput, setShowSafeInput] = useState<boolean>(false)
+
+  function appendAdmin(addr: string): void {
+    setAdminsRaw((prev) => {
+      const trimmed = prev.trim()
+      if (!trimmed) return addr
+      const existing = trimmed.split(/[,\s\n]+/).map((a) => a.toLowerCase())
+      if (existing.includes(addr.toLowerCase())) return prev
+      return `${trimmed}\n${addr}`
+    })
+  }
 
   const { deploy, hash, isPending, error, factory } = useDeployProxy()
   const receipt = useWaitForTransactionReceipt({ hash })
@@ -306,6 +318,47 @@ export default function DeployPage() {
           label="Admins"
           hint="One address per line or comma-separated. At least one required."
         >
+          <div className="flex flex-wrap items-center gap-2 mb-2">
+            {connectedAddress && (
+              <button
+                type="button"
+                onClick={() => appendAdmin(connectedAddress)}
+                className="text-[11px] px-2 py-1 rounded border border-line text-muted hover:text-ink hover:border-ink/40 transition-colors"
+              >
+                + Add my wallet ({connectedAddress.slice(0, 6)}…{connectedAddress.slice(-4)})
+              </button>
+            )}
+            <button
+              type="button"
+              onClick={() => setShowSafeInput((v) => !v)}
+              className="text-[11px] px-2 py-1 rounded border border-line text-muted hover:text-ink hover:border-ink/40 transition-colors"
+            >
+              {showSafeInput ? '− Cancel Safe input' : '+ Add Safe address'}
+            </button>
+          </div>
+          {showSafeInput && (
+            <div className="flex flex-wrap items-center gap-2 mb-2">
+              <input
+                value={safeInput}
+                onChange={(e) => setSafeInput(e.target.value)}
+                placeholder="0x… (Gnosis Safe address)"
+                className="input font-mono text-xs flex-1 min-w-[260px]"
+              />
+              <button
+                type="button"
+                disabled={!isAddress(safeInput.trim())}
+                onClick={() => {
+                  if (!isAddress(safeInput.trim())) return
+                  appendAdmin(safeInput.trim())
+                  setSafeInput('')
+                  setShowSafeInput(false)
+                }}
+                className="btn-secondary text-xs px-3 py-1.5 disabled:opacity-50 disabled:cursor-not-allowed"
+              >
+                Add
+              </button>
+            </div>
+          )}
           <textarea
             value={adminsRaw}
             onChange={(e) => setAdminsRaw(e.target.value)}
@@ -315,8 +368,16 @@ export default function DeployPage() {
           />
           <div className="mt-2 rounded-md border border-brand/30 bg-brand/10 px-3 py-2 text-xs text-ink">
             <span className="font-medium text-brand">Heads up — </span>
-            use a multisig (e.g. a Safe) as admin. A single EOA is a single
-            point of failure for fee withdrawals and version upgrades.
+            use a multisig (e.g. a Safe) as admin for production. A single
+            EOA is a single point of failure for fee withdrawals and version
+            upgrades.{' '}
+            <Link
+              to="/docs/safe-admin"
+              className="underline decoration-brand/60 hover:decoration-brand"
+            >
+              See the Safe multisig admin guide
+            </Link>
+            .
           </div>
           {adminsRaw && !adminsValid && (
             <p className="text-xs text-rose-400 mt-1">

From 28c8f9fa53b6140007f3156b3ba06c30e436f420 Mon Sep 17 00:00:00 2001
From: Wieedze <maxime.moodz@gmail.com>
Date: Tue, 28 Apr 2026 08:57:31 +0200
Subject: [PATCH 2/9] =?UTF-8?q?feat(webapp):=20Safe-aware=20admin=20action?=
 =?UTF-8?q?s=20=E2=80=94=20useSafePropose=20+=20SetFees=20PoC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Foundation for routing webapp admin actions through a Safe multisig
when one is whitelisted, instead of forcing users to a CLI.

src/hooks/useSafePropose.ts:
- Builds an AdminOp into a SafeTx via packages/safe-tx (buildSafeTx)
- Signs EIP-712 via wagmi.signTypedData (no private key on the
  webapp side — uses the connected wallet's signing UI)
- Posts to Den's STS via api-kit (POST .../multisig-transactions/)
- Returns { propose, isProposing, proposed, error, denUrl, reset }
- Caller passes the target Safe address (typically derived from the
  proxy's admins list)

src/hooks/useSafeAdmin.ts:
- Convenience: scans a proxy's admins via useAdmins + useSafeStatuses,
  returns the first detected Safe address (or undefined)
- Multi-Safe edge case: takes the first match, picker can come later

src/components/SetFeesPanel.tsx (PoC integration):
- Keeps the existing direct-write buttons for direct EOA admins
- When useSafeAdmin finds a Safe in the admins list, surfaces a second
  "Propose via Safe" button per fee field (fixed + percentage)
- Click -> uses ops.v2Admin.setDepositFixedFee / setDepositPercentageFee
  to build the AdminOp, then useSafePropose handles the Safe path
- Success state shows the safeTxHash + a link to Den UI for co-signing

Confirm + execute remain in Den UI (per discussion: don't rebuild what
Den does well — Discord/Telegram bots, Tenderly simulations, owner
notifications). The webapp's role is to be the entry point for admin
intents.

Other 5+ admin panels (Withdraw, Admins, UpgradeAuthority, Versions,
ClaimLimits, FundPool, Reclaim) follow the same pattern — refactor
landing in a follow-up commit once this PoC is validated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../webapp/src/components/SetFeesPanel.tsx    |  80 +++++++++++-
 packages/webapp/src/hooks/useSafeAdmin.ts     |  24 ++++
 packages/webapp/src/hooks/useSafePropose.ts   | 117 ++++++++++++++++++
 3 files changed, 218 insertions(+), 3 deletions(-)
 create mode 100644 packages/webapp/src/hooks/useSafeAdmin.ts
 create mode 100644 packages/webapp/src/hooks/useSafePropose.ts

diff --git a/packages/webapp/src/components/SetFeesPanel.tsx b/packages/webapp/src/components/SetFeesPanel.tsx
index 581f8e4..b853bb4 100644
--- a/packages/webapp/src/components/SetFeesPanel.tsx
+++ b/packages/webapp/src/components/SetFeesPanel.tsx
@@ -2,7 +2,10 @@ import { useEffect, useState } from 'react'
 import { formatEther, parseEther, type Address } from 'viem'
 import { useWaitForTransactionReceipt } from 'wagmi'
 
+import { ops } from '@intuition-fee-proxy/safe-tx'
 import { useSetFees } from '../hooks/useProxy'
+import { useSafeAdmin } from '../hooks/useSafeAdmin'
+import { useSafePropose } from '../hooks/useSafePropose'
 
 interface Props {
   proxy: Address
@@ -19,6 +22,9 @@ export function SetFeesPanel({ proxy, currentFixed, currentPct, onDone }: Props)
     useSetFees(proxy)
   const receipt = useWaitForTransactionReceipt({ hash })
 
+  const { safe } = useSafeAdmin(proxy)
+  const safePropose = useSafePropose({ safeAddress: safe })
+
   useEffect(() => {
     if (receipt.isSuccess) onDone()
   }, [hash, receipt.isSuccess])
@@ -47,12 +53,33 @@ export function SetFeesPanel({ proxy, currentFixed, currentPct, onDone }: Props)
     }
   }
 
+  async function onProposeFixed() {
+    if (!fixedValid || !safe) return
+    safePropose.reset()
+    try {
+      await safePropose.propose(ops.v2Admin.setDepositFixedFee(proxy, parseEther(fixedEth)))
+    } catch (e) {
+      console.error(e)
+    }
+  }
+
+  async function onProposePct() {
+    if (!pctValid || !safe) return
+    safePropose.reset()
+    try {
+      await safePropose.propose(ops.v2Admin.setDepositPercentageFee(proxy, BigInt(pctBps)))
+    } catch (e) {
+      console.error(e)
+    }
+  }
+
   return (
     <section className="card space-y-4">
       <div>
         <h2 className="font-semibold">Update fees</h2>
         <p className="text-xs text-subtle">
-          Admin-only. Takes effect immediately.
+          Admin-only. Direct write takes effect immediately. Safe propose
+          opens a multisig transaction for owners to co-sign in Den.
         </p>
       </div>
 
@@ -70,11 +97,21 @@ export function SetFeesPanel({ proxy, currentFixed, currentPct, onDone }: Props)
           <button
             type="button"
             onClick={onUpdateFixed}
-            disabled={!fixedValid || isPending}
+            disabled={!fixedValid || isPending || safePropose.isProposing}
             className="btn-primary w-full mt-1"
           >
             Update fixed
           </button>
+          {safe && (
+            <button
+              type="button"
+              onClick={onProposeFixed}
+              disabled={!fixedValid || isPending || safePropose.isProposing}
+              className="btn-secondary w-full mt-1 text-xs"
+            >
+              {safePropose.isProposing ? 'Proposing…' : 'Propose via Safe'}
+            </button>
+          )}
         </label>
 
         <label className="block space-y-1">
@@ -91,14 +128,51 @@ export function SetFeesPanel({ proxy, currentFixed, currentPct, onDone }: Props)
           <button
             type="button"
             onClick={onUpdatePct}
-            disabled={!pctValid || isPending}
+            disabled={!pctValid || isPending || safePropose.isProposing}
             className="btn-primary w-full mt-1"
           >
             Update percentage
           </button>
+          {safe && (
+            <button
+              type="button"
+              onClick={onProposePct}
+              disabled={!pctValid || isPending || safePropose.isProposing}
+              className="btn-secondary w-full mt-1 text-xs"
+            >
+              {safePropose.isProposing ? 'Proposing…' : 'Propose via Safe'}
+            </button>
+          )}
         </label>
       </div>
 
+      {safePropose.proposed && (
+        <div className="rounded-md border border-emerald-400/30 bg-emerald-400/5 px-3 py-2 text-xs text-emerald-300 space-y-1">
+          <div>
+            <strong>Proposed.</strong> safeTxHash:{' '}
+            <code className="font-mono break-all">{safePropose.proposed.safeTxHash}</code>
+          </div>
+          <div>
+            Owners can co-sign and execute in{' '}
+            <a
+              href={safePropose.proposed.denUrl}
+              target="_blank"
+              rel="noreferrer"
+              className="underline decoration-emerald-400/60 hover:decoration-emerald-200"
+            >
+              Den
+            </a>
+            .
+          </div>
+        </div>
+      )}
+
+      {safePropose.error && (
+        <p className="text-xs text-rose-400 font-mono">
+          Safe propose: {safePropose.error}
+        </p>
+      )}
+
       {error && (
         <p className="text-xs text-rose-400 font-mono">
           {error.message.split('\n')[0]}
diff --git a/packages/webapp/src/hooks/useSafeAdmin.ts b/packages/webapp/src/hooks/useSafeAdmin.ts
new file mode 100644
index 0000000..9809896
--- /dev/null
+++ b/packages/webapp/src/hooks/useSafeAdmin.ts
@@ -0,0 +1,24 @@
+import type { Address } from 'viem'
+import { useAdmins } from './useProxy'
+import { useSafeStatuses } from './useSafeStatus'
+
+/**
+ * Find the first Safe address in a proxy's admins list. Used by panels
+ * to decide whether to surface a "Propose via Safe" path next to (or
+ * instead of) the direct EOA write.
+ *
+ * Returns `safe = undefined` when no admin in the list resolves to a
+ * known Safe singleton. Multiple Safes in the list are rare; we take
+ * the first match — a future iteration can offer a picker if needed.
+ */
+export function useSafeAdmin(proxy: Address | undefined): {
+  safe: Address | undefined
+  isLoading: boolean
+} {
+  const { admins, isLoading } = useAdmins(proxy)
+  const statuses = useSafeStatuses(admins)
+
+  const safe = admins.find((addr) => statuses[addr.toLowerCase()]?.kind === 'safe')
+
+  return { safe, isLoading }
+}
diff --git a/packages/webapp/src/hooks/useSafePropose.ts b/packages/webapp/src/hooks/useSafePropose.ts
new file mode 100644
index 0000000..ea64ca2
--- /dev/null
+++ b/packages/webapp/src/hooks/useSafePropose.ts
@@ -0,0 +1,117 @@
+import { useState } from 'react'
+import type { Address, Hex } from 'viem'
+import {
+  useAccount,
+  useChainId,
+  usePublicClient,
+  useSignTypedData,
+} from 'wagmi'
+
+import {
+  type AdminOp,
+  modes,
+} from '@intuition-fee-proxy/safe-tx'
+
+const DEN_STS_INTUITION = 'https://safe-transaction-intuition.onchainden.com'
+
+const SAFE_TX_TYPES = {
+  SafeTx: [
+    { name: 'to', type: 'address' },
+    { name: 'value', type: 'uint256' },
+    { name: 'data', type: 'bytes' },
+    { name: 'operation', type: 'uint8' },
+    { name: 'safeTxGas', type: 'uint256' },
+    { name: 'baseGas', type: 'uint256' },
+    { name: 'gasPrice', type: 'uint256' },
+    { name: 'gasToken', type: 'address' },
+    { name: 'refundReceiver', type: 'address' },
+    { name: 'nonce', type: 'uint256' },
+  ],
+} as const
+
+export type SafeProposeResult = {
+  safeTxHash: Hex
+  denUrl: string
+}
+
+/**
+ * Build + sign + propose a SafeTx wrapping an AdminOp, routed through
+ * the Den Safe Transaction Service. The connected wallet provides the
+ * EIP-712 signature via wagmi.signTypedData — no private key on the
+ * webapp side.
+ *
+ * Caller is responsible for picking the Safe address (typically the
+ * Safe found in the proxy's admins list).
+ */
+export function useSafePropose({ safeAddress }: { safeAddress: Address | undefined }) {
+  const { address: signerAddress } = useAccount()
+  const chainId = useChainId()
+  const publicClient = usePublicClient()
+  const { signTypedDataAsync } = useSignTypedData()
+
+  const [isProposing, setIsProposing] = useState(false)
+  const [proposed, setProposed] = useState<SafeProposeResult | null>(null)
+  const [error, setError] = useState<string | null>(null)
+
+  const denUrl = safeAddress
+    ? `https://safe.onchainden.com/home?safe=int:${safeAddress}`
+    : ''
+
+  async function propose(op: AdminOp): Promise<void> {
+    if (!safeAddress) {
+      throw new Error('useSafePropose: safeAddress is required')
+    }
+    if (!signerAddress) {
+      throw new Error('useSafePropose: connect a wallet first')
+    }
+    if (!publicClient) {
+      throw new Error('useSafePropose: no publicClient available')
+    }
+
+    setIsProposing(true)
+    setError(null)
+    setProposed(null)
+
+    try {
+      // 1. Build the SafeTx (fetches the Safe nonce on-chain).
+      const payload = await modes.directSign.buildSafeTx(
+        { safe: safeAddress, chainId, op },
+        publicClient,
+      )
+
+      // 2. EIP-712 sign via the connected wallet.
+      const sig = await signTypedDataAsync({
+        domain: { chainId, verifyingContract: safeAddress },
+        types: SAFE_TX_TYPES,
+        primaryType: 'SafeTx',
+        message: payload.message,
+      })
+
+      // 3. POST to Den's STS so the other Safe owners can co-sign in Den UI.
+      const sts = modes.apiKit.createApiKitClient({ txServiceUrl: DEN_STS_INTUITION })
+      await sts.propose(payload, { signer: signerAddress, sig })
+
+      setProposed({ safeTxHash: payload.safeTxHash, denUrl })
+    } catch (e) {
+      const msg = e instanceof Error ? e.message.split('\n')[0] : String(e)
+      setError(msg)
+    } finally {
+      setIsProposing(false)
+    }
+  }
+
+  function reset(): void {
+    setProposed(null)
+    setError(null)
+  }
+
+  return {
+    canPropose: Boolean(safeAddress && signerAddress && publicClient),
+    propose,
+    isProposing,
+    proposed,
+    error,
+    denUrl,
+    reset,
+  }
+}

From d76bae76e7bb4b7b02e41a099cc6d1e008f08413 Mon Sep 17 00:00:00 2001
From: Wieedze <maxime.moodz@gmail.com>
Date: Tue, 28 Apr 2026 08:59:18 +0200
Subject: [PATCH 3/9] feat(webapp): pending Safe transactions panel (read-only
 Den queue)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Surfaces the Safe transaction queue from Den's STS directly inside
the proxy detail page, so an owner doesn't have to context-switch to
discover what's awaiting their signature.

src/hooks/usePendingSafeTxs.ts:
- usePendingSafeTxs(safe): polls Den STS via apiKit.getPendingTxs
- Returns { txs, isLoading, error, refetch }
- Refresh on demand (button) — no aggressive polling, owners typically
  refresh after coming back from Den UI

src/components/PendingSafeTxsPanel.tsx:
- Lists each pending tx: nonce + target + confirmations count
- Per-row "Sign in Den" deep link (transactions/tx?safe=int:...&id=
  multisig_<safe>_<safeTxHash>) — opens directly the right Safe
  detail page in Den
- Top "Open in Den" link to the queue overview
- Empty state and error state both handled cleanly
- Read-only by design — co-sign / execute happen in Den (per the
  delegation strategy decided earlier, we don't rebuild Safe's
  signing UX)

src/components/AdminsTab.tsx:
- Renders PendingSafeTxsPanel when useSafeAdmin detects a Safe in
  the fee admins list — otherwise the panel doesn't appear (no Safe,
  no queue to display)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 packages/webapp/src/components/AdminsTab.tsx  |   4 +
 .../src/components/PendingSafeTxsPanel.tsx    | 110 ++++++++++++++++++
 .../webapp/src/hooks/usePendingSafeTxs.ts     |  52 +++++++++
 3 files changed, 166 insertions(+)
 create mode 100644 packages/webapp/src/components/PendingSafeTxsPanel.tsx
 create mode 100644 packages/webapp/src/hooks/usePendingSafeTxs.ts

diff --git a/packages/webapp/src/components/AdminsTab.tsx b/packages/webapp/src/components/AdminsTab.tsx
index 002187e..d5d4d1c 100644
--- a/packages/webapp/src/components/AdminsTab.tsx
+++ b/packages/webapp/src/components/AdminsTab.tsx
@@ -1,6 +1,8 @@
 import type { Address } from 'viem'
 
+import { useSafeAdmin } from '../hooks/useSafeAdmin'
 import { AdminsPanel } from './AdminsPanel'
+import { PendingSafeTxsPanel } from './PendingSafeTxsPanel'
 import { UpgradeAuthorityPanel } from './UpgradeAuthorityPanel'
 
 interface Props {
@@ -22,6 +24,7 @@ export function AdminsTab({
   isVersionsFetching,
   onWriteDone,
 }: Props) {
+  const { safe: feeAdminSafe } = useSafeAdmin(proxy)
   return (
     <div className="space-y-6">
       <p className="text-xs text-muted leading-relaxed max-w-3xl">
@@ -40,6 +43,7 @@ export function AdminsTab({
         isRefreshing={isVersionsFetching}
       />
       <AdminsPanel proxy={proxy} connectedAccount={account} />
+      {feeAdminSafe && <PendingSafeTxsPanel safe={feeAdminSafe} />}
     </div>
   )
 }
diff --git a/packages/webapp/src/components/PendingSafeTxsPanel.tsx b/packages/webapp/src/components/PendingSafeTxsPanel.tsx
new file mode 100644
index 0000000..09cfcba
--- /dev/null
+++ b/packages/webapp/src/components/PendingSafeTxsPanel.tsx
@@ -0,0 +1,110 @@
+import type { Address } from 'viem'
+import { usePendingSafeTxs } from '../hooks/usePendingSafeTxs'
+import AddressDisplay from './Address'
+import { Spinner } from './Spinner'
+
+interface Props {
+  safe: Address
+}
+
+/**
+ * Read-only listing of Safe transactions currently waiting on owner
+ * co-signatures or execution. Each row links to Den's UI for that Safe
+ * + tx, where owners actually confirm and execute.
+ *
+ * Webapp's role here is "you can see what's queued and where to act
+ * on it" — it deliberately does not duplicate Den's signing surface.
+ */
+export function PendingSafeTxsPanel({ safe }: Props) {
+  const { txs, isLoading, error, refetch } = usePendingSafeTxs(safe)
+
+  const denBaseUrl = `https://safe.onchainden.com/transactions/queue?safe=int:${safe}`
+
+  return (
+    <section className="card border-l-4 border-l-line-strong space-y-3">
+      <div className="flex items-center justify-between gap-3 flex-wrap">
+        <div className="flex items-baseline gap-3">
+          <span className="text-[10px] font-mono uppercase tracking-widest text-muted">
+            Safe queue
+          </span>
+          <h2 className="font-semibold inline-flex items-baseline gap-2">
+            Pending Safe transactions
+            {isLoading && <Spinner ariaLabel="Loading" />}
+          </h2>
+        </div>
+        <div className="flex items-center gap-3">
+          <button
+            type="button"
+            onClick={refetch}
+            disabled={isLoading}
+            className="text-[11px] text-muted hover:text-ink transition-colors"
+          >
+            Refresh
+          </button>
+          <a
+            href={denBaseUrl}
+            target="_blank"
+            rel="noreferrer"
+            className="text-[11px] text-brand underline decoration-brand/60 hover:decoration-brand"
+          >
+            Open in Den ↗
+          </a>
+        </div>
+      </div>
+      <p className="text-xs text-muted leading-relaxed">
+        Read-only view of transactions awaiting signatures or execution
+        on the Safe that admins this proxy. Co-sign and execute happen in
+        Den UI — click any row to jump there.
+      </p>
+
+      {error && (
+        <p className="text-sm font-mono text-rose-400">
+          Failed to load: {error}
+        </p>
+      )}
+
+      {!isLoading && !error && txs.length === 0 && (
+        <p className="text-xs text-subtle border-l-2 border-line pl-3">
+          No pending transactions.
+        </p>
+      )}
+
+      {txs.length > 0 && (
+        <ul className="divide-y divide-line rounded-xl border border-line bg-surface overflow-hidden">
+          {txs.map((tx) => {
+            const denUrl = `https://safe.onchainden.com/transactions/tx?safe=int:${safe}&id=multisig_${safe}_${tx.contractTransactionHash}`
+            return (
+              <li key={tx.contractTransactionHash} className="px-5 py-3 space-y-1">
+                <div className="flex items-center justify-between gap-3 flex-wrap">
+                  <div className="flex items-center gap-3 min-w-0">
+                    <span className="text-[10px] font-mono uppercase text-subtle tracking-wider border border-line rounded px-1.5 py-0.5">
+                      nonce {tx.nonce}
+                    </span>
+                    <span className="text-xs text-muted">to</span>
+                    <AddressDisplay value={tx.to} variant="short" />
+                  </div>
+                  <div className="flex items-center gap-3">
+                    <span className="text-[11px] text-subtle">
+                      {tx.confirmations.length} confirmation{tx.confirmations.length === 1 ? '' : 's'}
+                    </span>
+                    <a
+                      href={denUrl}
+                      target="_blank"
+                      rel="noreferrer"
+                      className="text-[11px] text-brand underline decoration-brand/60 hover:decoration-brand"
+                    >
+                      Sign in Den ↗
+                    </a>
+                  </div>
+                </div>
+                <div className="text-[10px] font-mono text-subtle break-all">
+                  {tx.contractTransactionHash}
+                </div>
+              </li>
+            )
+          })}
+        </ul>
+      )}
+    </section>
+  )
+}
diff --git a/packages/webapp/src/hooks/usePendingSafeTxs.ts b/packages/webapp/src/hooks/usePendingSafeTxs.ts
new file mode 100644
index 0000000..94e5498
--- /dev/null
+++ b/packages/webapp/src/hooks/usePendingSafeTxs.ts
@@ -0,0 +1,52 @@
+import { useEffect, useState } from 'react'
+import type { Address } from 'viem'
+
+import { modes, type StsTxRecord } from '@intuition-fee-proxy/safe-tx'
+
+const DEN_STS_INTUITION = 'https://safe-transaction-intuition.onchainden.com'
+
+/**
+ * Fetch the list of pending (un-executed) Safe transactions for a Safe
+ * from Den's Safe Transaction Service. Polls on `refreshKey` change.
+ */
+export function usePendingSafeTxs(safeAddress: Address | undefined) {
+  const [txs, setTxs] = useState<StsTxRecord[]>([])
+  const [isLoading, setIsLoading] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+  const [refreshKey, setRefreshKey] = useState(0)
+
+  useEffect(() => {
+    if (!safeAddress) {
+      setTxs([])
+      return
+    }
+    let cancelled = false
+    setIsLoading(true)
+    setError(null)
+    const sts = modes.apiKit.createApiKitClient({ txServiceUrl: DEN_STS_INTUITION })
+    sts
+      .getPendingTxs(safeAddress)
+      .then((list) => {
+        if (!cancelled) setTxs(list)
+      })
+      .catch((e) => {
+        if (!cancelled) {
+          const msg = e instanceof Error ? e.message.split('\n')[0] : String(e)
+          setError(msg)
+        }
+      })
+      .finally(() => {
+        if (!cancelled) setIsLoading(false)
+      })
+    return () => {
+      cancelled = true
+    }
+  }, [safeAddress, refreshKey])
+
+  return {
+    txs,
+    isLoading,
+    error,
+    refetch: () => setRefreshKey((k) => k + 1),
+  }
+}

From fa800742691e84620c4686aba8ab25a05f492c5e Mon Sep 17 00:00:00 2001
From: Wieedze <maxime.moodz@gmail.com>
Date: Tue, 28 Apr 2026 09:02:49 +0200
Subject: [PATCH 4/9] fix(webapp): add @intuition-fee-proxy/safe-tx as
 workspace dep

useSafePropose / usePendingSafeTxs / SetFeesPanel import from
@intuition-fee-proxy/safe-tx but the webapp's package.json didn't
declare it. Vite couldn't resolve the import at dev start, blocking
the page with a 500.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 packages/webapp/package.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/webapp/package.json b/packages/webapp/package.json
index 37880d8..bf74aa5 100644
--- a/packages/webapp/package.json
+++ b/packages/webapp/package.json
@@ -11,6 +11,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@intuition-fee-proxy/safe-tx": "workspace:*",
     "@intuition-fee-proxy/sdk": "workspace:*",
     "@rainbow-me/rainbowkit": "^2.1.0",
     "@tanstack/react-query": "^5.51.0",

From ef98145b3b6afeaf1e4d6a76ea2ee4be549f425e Mon Sep 17 00:00:00 2001
From: Wieedze <maxime.moodz@gmail.com>
Date: Tue, 28 Apr 2026 09:10:40 +0200
Subject: [PATCH 5/9] fix(webapp): take Admins block out of <label> wrapper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Admins section used <Field> which renders a <label>. Putting
<button>s inside a <label> leads to ambiguous interactive behavior
on hover/focus — the browser routes interaction events between
label children in ways that depend on the form control they're
associated with.

Replaces <Field> with an equivalent <div>-based block keeping the
exact visual layout (label-style heading, hint, action buttons,
Safe input row, textarea, callout). No <label>, no propagation.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 packages/webapp/src/pages/Deploy.tsx | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/packages/webapp/src/pages/Deploy.tsx b/packages/webapp/src/pages/Deploy.tsx
index 536e7d6..d40be78 100644
--- a/packages/webapp/src/pages/Deploy.tsx
+++ b/packages/webapp/src/pages/Deploy.tsx
@@ -314,11 +314,12 @@ export default function DeployPage() {
           </Field>
         </div>
 
-        <Field
-          label="Admins"
-          hint="One address per line or comma-separated. At least one required."
-        >
-          <div className="flex flex-wrap items-center gap-2 mb-2">
+        <div className="block space-y-1.5">
+          <div className="text-sm font-medium text-ink">Admins</div>
+          <div className="text-xs text-subtle">
+            One address per line or comma-separated. At least one required.
+          </div>
+          <div className="flex flex-wrap items-center gap-2 pt-1">
             {connectedAddress && (
               <button
                 type="button"
@@ -337,7 +338,7 @@ export default function DeployPage() {
             </button>
           </div>
           {showSafeInput && (
-            <div className="flex flex-wrap items-center gap-2 mb-2">
+            <div className="flex flex-wrap items-center gap-2">
               <input
                 value={safeInput}
                 onChange={(e) => setSafeInput(e.target.value)}
@@ -366,7 +367,7 @@ export default function DeployPage() {
             className="input font-mono text-xs"
             placeholder="0x…&#10;0x…"
           />
-          <div className="mt-2 rounded-md border border-brand/30 bg-brand/10 px-3 py-2 text-xs text-ink">
+          <div className="rounded-md border border-brand/30 bg-brand/10 px-3 py-2 text-xs text-ink">
             <span className="font-medium text-brand">Heads up — </span>
             use a multisig (e.g. a Safe) as admin for production. A single
             EOA is a single point of failure for fee withdrawals and version
@@ -380,11 +381,11 @@ export default function DeployPage() {
             .
           </div>
           {adminsRaw && !adminsValid && (
-            <p className="text-xs text-rose-400 mt-1">
+            <p className="text-xs text-rose-400">
               Every line must be a valid address.
             </p>
           )}
-        </Field>
+        </div>
 
         <div className="flex items-center gap-3 pt-1">
           <button

From 3038ec634f6a437f582805f245fa91740b02bbae Mon Sep 17 00:00:00 2001
From: Wieedze <maxime.moodz@gmail.com>
Date: Tue, 28 Apr 2026 09:23:08 +0200
Subject: [PATCH 6/9] feat(dev): intuitionFork hardhat network for Anvil-based
 local testing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds an "intuitionFork" hardhat network entry pointing at
http://127.0.0.1:8545 with chainId 1155 — matches what Anvil
exposes when forking Intuition mainnet, so contracts deployed
through hardhat land on the fork (which inherits all mainnet state,
including the Safe at 0xf10D...).

Wires:
- packages/contracts/hardhat.config.ts: new network entry, uses the
  well-known LOCAL_DEV_KEY (no PRIVATE_KEY required)
- packages/contracts/package.json: deploy:fork script alias
- package.json (root): contracts:deploy:fork workspace alias

Use case: developer wants to test the Safe-aware webapp paths
(propose via Safe, PendingSafeTxsPanel) end-to-end. Workflow:
  anvil --fork-url https://rpc.intuition.systems --chain-id 1155
  bun contracts:deploy:fork
  # take the printed Factory address, set VITE_FACTORY_ADDRESS in
  # packages/webapp/.env.local, restart bun webapp:dev
  # then deploy a proxy from the webapp with the Safe as admin

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 package.json                         | 1 +
 packages/contracts/hardhat.config.ts | 9 +++++++++
 packages/contracts/package.json      | 1 +
 3 files changed, 11 insertions(+)

diff --git a/package.json b/package.json
index b971e0e..8790e2b 100644
--- a/package.json
+++ b/package.json
@@ -12,6 +12,7 @@
     "contracts:clean": "bun --filter @intuition-fee-proxy/contracts clean",
     "contracts:node": "bun --filter @intuition-fee-proxy/contracts node",
     "contracts:deploy:local": "bun --filter @intuition-fee-proxy/contracts deploy:local",
+    "contracts:deploy:fork": "bun --filter @intuition-fee-proxy/contracts deploy:fork",
     "contracts:e2e:local": "bun --filter @intuition-fee-proxy/contracts e2e:local",
     "contracts:e2e:testnet": "bun --filter @intuition-fee-proxy/contracts e2e:testnet",
     "contracts:e2e:sponsored:local": "bun --filter @intuition-fee-proxy/contracts e2e:sponsored:local",
diff --git a/packages/contracts/hardhat.config.ts b/packages/contracts/hardhat.config.ts
index f2d4220..0862c78 100644
--- a/packages/contracts/hardhat.config.ts
+++ b/packages/contracts/hardhat.config.ts
@@ -41,6 +41,15 @@ const config: HardhatUserConfig = {
       url: "http://127.0.0.1:8545",
       chainId: 31337,
     },
+    // Anvil fork of Intuition mainnet — used to test Safe-aware webapp
+    // flows that require the real mainnet state (the Safe at 0xf10D...
+    // exists in the fork, real proxies don't because none are deployed
+    // on Intuition mainnet yet).
+    intuitionFork: {
+      url: "http://127.0.0.1:8545",
+      chainId: 1155,
+      accounts: [LOCAL_DEV_KEY],
+    },
     // Intuition Mainnet
     intuition: {
       url: process.env.INTUITION_RPC_URL || "https://rpc.intuition.systems",
diff --git a/packages/contracts/package.json b/packages/contracts/package.json
index 003d2ac..75dca6c 100644
--- a/packages/contracts/package.json
+++ b/packages/contracts/package.json
@@ -12,6 +12,7 @@
     "clean": "hardhat clean",
     "node": "hardhat node",
     "deploy:local": "hardhat run scripts/deploy.ts --network localhost",
+    "deploy:fork": "hardhat run scripts/deploy.ts --network intuitionFork",
     "deploy:testnet": "hardhat run scripts/deploy.ts --network intuitionTestnet",
     "deploy:mainnet": "hardhat run scripts/deploy.ts --network intuition",
     "e2e:local": "hardhat run scripts/e2e-validate.ts --network localhost",

From 221e0dd777706d0ce90496cdf8748244ee6f5729 Mon Sep 17 00:00:00 2001
From: Wieedze <maxime.moodz@gmail.com>
Date: Tue, 28 Apr 2026 09:27:45 +0200
Subject: [PATCH 7/9] fix(webapp): apply VITE_FACTORY_ADDRESS override on
 mainnet too
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous gate restricted the dev override to testnet. With Anvil
fork now used to test Safe-aware webapp flows on chainId 1155 (the
fork has the real Safe state), the developer needs to point the
webapp at a freshly-deployed local Factory on what wagmi resolves as
"mainnet".

The override only applies when the env var is explicitly set in
packages/webapp/.env.local, which is gitignored and absent in the
prod build — production behavior is unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 packages/webapp/src/lib/addresses.ts | 19 +++++++------------
 1 file changed, 7 insertions(+), 12 deletions(-)

diff --git a/packages/webapp/src/lib/addresses.ts b/packages/webapp/src/lib/addresses.ts
index 25235d0..ae1b006 100644
--- a/packages/webapp/src/lib/addresses.ts
+++ b/packages/webapp/src/lib/addresses.ts
@@ -12,25 +12,20 @@ const DEV_MULTIVAULT = import.meta.env.VITE_MULTIVAULT_ADDRESS as
  * Factory + MultiVault addresses per network. Standard / sponsored impls
  * are read live from the Factory on-chain — no SDK snapshot (single
  * source of truth).
+ *
  * Dev overrides via `VITE_FACTORY_ADDRESS` and `VITE_MULTIVAULT_ADDRESS`
- * take precedence on testnet so you can point the webapp at a
- * local/hardhat deploy without touching the SDK. On a fresh local node,
- * the real testnet MV has no code — using its address would trip the
- * V2 initializer's `code.length > 0` guard and revert.
+ * take precedence on either network when set — set them in
+ * packages/webapp/.env.local to point the webapp at a local hardhat /
+ * Anvil-fork deploy without touching the SDK. The .env.local is
+ * gitignored and never ships in a prod build.
  */
 export function addressesFor(network: Network): {
   factory: Address
   multiVault: Address
 } {
-  if (network === 'testnet') {
-    return {
-      factory: (DEV_FACTORY ?? V2_ADDRESSES[network].factory) as Address,
-      multiVault: (DEV_MULTIVAULT ?? MULTIVAULT_ADDRESSES[network]) as Address,
-    }
-  }
   return {
-    factory: V2_ADDRESSES[network].factory as Address,
-    multiVault: MULTIVAULT_ADDRESSES[network] as Address,
+    factory: (DEV_FACTORY ?? V2_ADDRESSES[network].factory) as Address,
+    multiVault: (DEV_MULTIVAULT ?? MULTIVAULT_ADDRESSES[network]) as Address,
   }
 }
 

From 60753a43026dcd8d0be8c2772bfca81e716a85ca Mon Sep 17 00:00:00 2001
From: Wieedze <maxime.moodz@gmail.com>
Date: Tue, 28 Apr 2026 09:47:42 +0200
Subject: [PATCH 8/9] chore: lockfile + bin executable bit after webapp dep +
 bin: entry
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Side effects of declaring @intuition-fee-proxy/safe-tx as a webapp
workspace dep (commit fa80074) and as a bin in safe-tx/package.json
(commit 2a1d483). Bun installs the workspace symlink and chmods the
bin file to 0755 — committing the artifacts so the working tree is
clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 bun.lock                             | 1 +
 packages/safe-tx/bin/safe-propose.ts | 0
 2 files changed, 1 insertion(+)
 mode change 100644 => 100755 packages/safe-tx/bin/safe-propose.ts

diff --git a/bun.lock b/bun.lock
index c7bfa92..af1ffec 100644
--- a/bun.lock
+++ b/bun.lock
@@ -75,6 +75,7 @@
       "name": "@intuition-fee-proxy/webapp",
       "version": "2.0.0-alpha",
       "dependencies": {
+        "@intuition-fee-proxy/safe-tx": "workspace:*",
         "@intuition-fee-proxy/sdk": "workspace:*",
         "@rainbow-me/rainbowkit": "^2.1.0",
         "@tanstack/react-query": "^5.51.0",
diff --git a/packages/safe-tx/bin/safe-propose.ts b/packages/safe-tx/bin/safe-propose.ts
old mode 100644
new mode 100755

From e207996c39a888470a1ed617dfbf6fd266773d49 Mon Sep 17 00:00:00 2001
From: Wieedze <maxime.moodz@gmail.com>
Date: Tue, 28 Apr 2026 10:03:31 +0200
Subject: [PATCH 9/9] feat(webapp): admins as removable chips instead of
 textarea
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The textarea + dual-button pattern made deletion clumsy (find the
right line, select, delete). Replaces with a chip-list UX:

- Each added admin renders as a rounded pill with truncated address
  + a × button that removes it
- Single input below: paste/type an address, press Enter or click Add
- Inline validation: invalid format -> "Invalid address.", duplicate
  -> "Already added."
- "+ my wallet" quick-action only shown when the connected EOA
  isn't already in the list (auto-hides after first add)

Internal state changes from `adminsRaw: string` to
`admins: Address[]` — `deploy()` already received an Address[], no
shape change at the call site.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 packages/webapp/src/pages/Deploy.tsx | 142 +++++++++++++++------------
 1 file changed, 78 insertions(+), 64 deletions(-)

diff --git a/packages/webapp/src/pages/Deploy.tsx b/packages/webapp/src/pages/Deploy.tsx
index d40be78..673965d 100644
--- a/packages/webapp/src/pages/Deploy.tsx
+++ b/packages/webapp/src/pages/Deploy.tsx
@@ -32,18 +32,28 @@ export default function DeployPage() {
   const [ethMultiVault, setEthMultiVault] = useState<string>(defaultMV)
   const [fixedFeeEth, setFixedFeeEth] = useState<string>('0.1')
   const [percentageBps, setPercentageBps] = useState<string>('500')
-  const [adminsRaw, setAdminsRaw] = useState<string>('')
-  const [safeInput, setSafeInput] = useState<string>('')
-  const [showSafeInput, setShowSafeInput] = useState<boolean>(false)
-
-  function appendAdmin(addr: string): void {
-    setAdminsRaw((prev) => {
-      const trimmed = prev.trim()
-      if (!trimmed) return addr
-      const existing = trimmed.split(/[,\s\n]+/).map((a) => a.toLowerCase())
-      if (existing.includes(addr.toLowerCase())) return prev
-      return `${trimmed}\n${addr}`
-    })
+  const [admins, setAdmins] = useState<Address[]>([])
+  const [adminInput, setAdminInput] = useState<string>('')
+  const [adminInputError, setAdminInputError] = useState<string | null>(null)
+
+  function tryAddAdmin(raw: string): void {
+    const trimmed = raw.trim()
+    if (!trimmed) return
+    if (!isAddress(trimmed)) {
+      setAdminInputError('Invalid address.')
+      return
+    }
+    if (admins.some((a) => a.toLowerCase() === trimmed.toLowerCase())) {
+      setAdminInputError('Already added.')
+      return
+    }
+    setAdmins((prev) => [...prev, trimmed as Address])
+    setAdminInput('')
+    setAdminInputError(null)
+  }
+
+  function removeAdmin(addr: Address): void {
+    setAdmins((prev) => prev.filter((a) => a.toLowerCase() !== addr.toLowerCase()))
   }
 
   const { deploy, hash, isPending, error, factory } = useDeployProxy()
@@ -60,12 +70,7 @@ export default function DeployPage() {
   const atomReceipt = useWaitForTransactionReceipt({ hash: atomHash })
   const [atomTriggered, setAtomTriggered] = useState(false)
 
-  const admins = adminsRaw
-    .split(/[,\s\n]+/)
-    .map((a) => a.trim())
-    .filter(Boolean)
-
-  const adminsValid = admins.length > 0 && admins.every((a) => isAddress(a))
+  const adminsValid = admins.length > 0
   const mvValid = isAddress(ethMultiVault)
   const pctValid = (() => {
     const n = Number(percentageBps)
@@ -314,59 +319,73 @@ export default function DeployPage() {
           </Field>
         </div>
 
-        <div className="block space-y-1.5">
+        <div className="block space-y-2">
           <div className="text-sm font-medium text-ink">Admins</div>
           <div className="text-xs text-subtle">
-            One address per line or comma-separated. At least one required.
+            Add one or more addresses. EOA for dev, Gnosis Safe for production.
           </div>
-          <div className="flex flex-wrap items-center gap-2 pt-1">
-            {connectedAddress && (
-              <button
-                type="button"
-                onClick={() => appendAdmin(connectedAddress)}
-                className="text-[11px] px-2 py-1 rounded border border-line text-muted hover:text-ink hover:border-ink/40 transition-colors"
-              >
-                + Add my wallet ({connectedAddress.slice(0, 6)}…{connectedAddress.slice(-4)})
-              </button>
-            )}
+
+          {admins.length > 0 && (
+            <ul className="flex flex-wrap gap-2">
+              {admins.map((addr) => (
+                <li
+                  key={addr}
+                  className="inline-flex items-center gap-2 rounded-full border border-line bg-surface pl-3 pr-1 py-1"
+                >
+                  <code className="font-mono text-xs text-ink">
+                    {addr.slice(0, 6)}…{addr.slice(-4)}
+                  </code>
+                  <button
+                    type="button"
+                    onClick={() => removeAdmin(addr)}
+                    aria-label={`Remove ${addr}`}
+                    className="inline-flex h-5 w-5 items-center justify-center rounded-full text-muted hover:text-rose-400 hover:bg-rose-400/10 transition-colors"
+                  >
+                    ×
+                  </button>
+                </li>
+              ))}
+            </ul>
+          )}
+
+          <div className="flex flex-wrap items-center gap-2">
+            <input
+              value={adminInput}
+              onChange={(e) => {
+                setAdminInput(e.target.value)
+                if (adminInputError) setAdminInputError(null)
+              }}
+              onKeyDown={(e) => {
+                if (e.key === 'Enter') {
+                  e.preventDefault()
+                  tryAddAdmin(adminInput)
+                }
+              }}
+              placeholder="0x… (paste an EOA or Safe address)"
+              className="input font-mono text-xs flex-1 min-w-[260px]"
+            />
             <button
               type="button"
-              onClick={() => setShowSafeInput((v) => !v)}
-              className="text-[11px] px-2 py-1 rounded border border-line text-muted hover:text-ink hover:border-ink/40 transition-colors"
+              onClick={() => tryAddAdmin(adminInput)}
+              disabled={!adminInput.trim()}
+              className="btn-secondary text-xs px-3 py-1.5 disabled:opacity-50 disabled:cursor-not-allowed"
             >
-              {showSafeInput ? '− Cancel Safe input' : '+ Add Safe address'}
+              Add
             </button>
-          </div>
-          {showSafeInput && (
-            <div className="flex flex-wrap items-center gap-2">
-              <input
-                value={safeInput}
-                onChange={(e) => setSafeInput(e.target.value)}
-                placeholder="0x… (Gnosis Safe address)"
-                className="input font-mono text-xs flex-1 min-w-[260px]"
-              />
+            {connectedAddress && !admins.some((a) => a.toLowerCase() === connectedAddress.toLowerCase()) && (
               <button
                 type="button"
-                disabled={!isAddress(safeInput.trim())}
-                onClick={() => {
-                  if (!isAddress(safeInput.trim())) return
-                  appendAdmin(safeInput.trim())
-                  setSafeInput('')
-                  setShowSafeInput(false)
-                }}
-                className="btn-secondary text-xs px-3 py-1.5 disabled:opacity-50 disabled:cursor-not-allowed"
+                onClick={() => tryAddAdmin(connectedAddress)}
+                className="text-[11px] px-2 py-1.5 rounded border border-line text-muted hover:text-ink hover:border-ink/40 transition-colors"
               >
-                Add
+                + my wallet
               </button>
-            </div>
+            )}
+          </div>
+          {adminInputError && (
+            <p className="text-xs text-rose-400">{adminInputError}</p>
           )}
-          <textarea
-            value={adminsRaw}
-            onChange={(e) => setAdminsRaw(e.target.value)}
-            rows={3}
-            className="input font-mono text-xs"
-            placeholder="0x…&#10;0x…"
-          />
+
           <div className="rounded-md border border-brand/30 bg-brand/10 px-3 py-2 text-xs text-ink">
             <span className="font-medium text-brand">Heads up — </span>
             use a multisig (e.g. a Safe) as admin for production. A single
@@ -380,11 +399,6 @@ export default function DeployPage() {
             </Link>
             .
           </div>
-          {adminsRaw && !adminsValid && (
-            <p className="text-xs text-rose-400">
-              Every line must be a valid address.
-            </p>
-          )}
         </div>
 
         <div className="flex items-center gap-3 pt-1">