Feat/mainnet live testing - #59
Merged
Merged
Conversation
…int script
WS1: Remove test agent spend button from delegation-card UI
WS2: x402 service proxy billing layer
- service-pricing.ts: USDC price registry (image $0.10-0.15, text $0.02)
- server-middleware.ts: buildX402Middleware() with ExactSvmScheme/Solana CAIP-2
- routes/services.ts: POST /api/services/{image-generate,image-generate-pro,image-edit,text-generate}
- ENABLE_X402_BILLING=false bypass for dev; PLATFORM_TREASURY_ADDRESS for payTo
- app.ts: mount /services + add X-Payment to CORS allowHeaders
WS4: Direct X (Twitter) OAuth 1.0a posting as @ozskr
- x-client.ts: HMAC-SHA1 OAuth 1.0a, postTweet(), uploadMedia() via Node crypto
- x-direct-adapter.ts: SocialPublisher adapter with AI disclosure injection
- routes/social-direct.ts: POST /api/social/direct/post-x
- publisher-factory.ts: getXDirectPublisher() singleton + XDirectAdapter switch case
WS3: scripts/register-toto-mainnet.ts — 8004-solana NFT mint with Pinata IPFS
- Supports --dry-run flag; writes result to scripts/toto-nft-result.json
- Valid OASF taxonomy tags verified via getAllSkills()/getAllDomains()
Typecheck: clean. Assisted-by: Claude Code
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
CRITICAL fixes: - social-direct.ts: run moderateContent() pipeline before post (endorsement guardrails + OpenAI text mod); reject with 422 if not APPROVED. Removes auto-approval bypass that violated CLAUDE.md moderation mandate. - register-toto-mainnet.ts: add simulateTransaction() on prepared tx before live mainnet send; balance check was not a substitute per CLAUDE.md. HIGH fixes: - register-toto-mainnet.ts: zero secretBytes.fill(0) after Keypair construction to clear raw key material from heap. - SSRF: add image-url-validator.ts with validatePublicImageUrl() — rejects IP hostnames, localhost/.local/.internal patterns, non-HTTPS URLs. Applied to social-direct.ts and x-direct-adapter.ts mediaUrl fetch paths. - server-middleware.ts: return HTTP 503 (not passthrough) when PLATFORM_TREASURY_ADDRESS is unset or x402 init throws — fails closed. MEDIUM fixes: - social-direct.ts: add directPostLimiter (10/hr) on POST /social/direct/post-x. INFO fixes: - publisher-factory.ts: SocialProvider.DIRECT now maps to XDirectAdapter (not TwitterAdapter); remove unused TwitterAdapter import. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…t commerce - x402 server-middleware: async resource server init, lazy _mw cache per route, 503 on PLATFORM_TREASURY_ADDRESS unset (fail closed), ENABLE_X402_BILLING bypass - services route: image-generate + video-generate endpoints behind authMiddleware and buildX402Middleware, Zod-validated request bodies - use-x402-generate hook: full x402 payment flow (probe → 402 parse → sign → retry) - fal.ai client + model router: image/video generation with cost tracking - pricing layer: model registry, fal pricing client, Claude cost estimator, pricing calculator for x402 price derivation - content feature: hooks (use-agent-balance, use-content-commerce) + components - generate-modal: integrated x402 payment flow and delegation balance display - delegation-card: fix delegationStatus field name (was status, caused balance=null) - agent service usage migration: 20260307000000_agent_service_usage.sql - eslint.config.mjs: ignore .trigger/** and .claude/worktrees/** - wallet auth hook: session refresh and token persistence improvements - rpc.ts: devnet RPC endpoint improvements - providers.tsx: QueryClient config + x402 provider setup Assisted-by: Claude Code Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…evoked Destructure `error` from maybeSingle() and only reject with SESSION_REVOKED when the query succeeds but returns no rows. A DB error (timeout, connectivity) previously produced data=null which was indistinguishable from "no session", causing false 401s during transient Supabase outages. Defense-in-depth: JWT signature verification still runs regardless. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Type
Checklist
pnpm typecheckpassespnpm lintpassespnpm testpassesSolana / DeFi Changes
assertIsAddress()