Skip to content

Phase 1: Shared config centralization#10

Merged
jratdish1 merged 4 commits into
mainfrom
openhands/phase-1-config-single-source
Jun 4, 2026
Merged

Phase 1: Shared config centralization#10
jratdish1 merged 4 commits into
mainfrom
openhands/phase-1-config-single-source

Conversation

@jratdish1

@jratdish1 jratdish1 commented Jun 4, 2026

Copy link
Copy Markdown
Owner

Summary

This is a foundational shared-config PR, not a production deployment PR.

Creates and begins adoption of shared configuration for HeroBase token, chain, staking, RPC, and external-link data.

What this PR does

  • config.ts (+140 lines): Single source of truth for:

    • CHAINS - Base (8453) and PulseChain (369) chain configs
    • HERO_ADDRESSES - HERO token contract addresses per chain
    • STAKING_ADDRESSES - Staking contract addresses per chain
    • VETS_ADDRESS - VETS token on PulseChain
    • Helper functions: getChainConfig(), getHeroAddress(), getStakingAddress(), getVETSAddress(), getRPCs(), getTokenBySymbol()
  • external-links.ts (+107 lines): External URLs for explorers, bridges, DEXes, documentation

  • 8 files migrated to use shared config:

    • useStaking.ts, HeroStake.tsx, Dashboard.tsx, HeroWallet.tsx
    • HeroSwapWidget.tsx, SquirrelSwapWidget.tsx, Swap.tsx, PortfolioDashboard.tsx
  • scripts/check-token-registry.mjs: Scanner to detect duplicated hardcoded addresses

Results

Metric Before After
Scanner violations 33 25
packageManager pnpm 10.25.0 10.27.0
Build Pass Pass

Known Risks

Risk Status
Scanner violations 25 remain in 12 files
pnpm check 109 pre-existing TS errors (no new Phase 1 errors)
pnpm test 240/260 (20 need VITE_WALLETCONNECT_PROJECT_ID in CI)
pnpm audit 1 critical (vitist) + 3 high (pnpm)
Production deploy NO

Commands

Command Result
pnpm build Pass
pnpm test 240/260
pnpm check 109 errors (pre-existing, no new Phase 1 errors)
pnpm audit 13 vulns (1 critical, 3 high)

Recommendation

Ready to merge as foundation only. Not safe for production deploy.

This PR creates the shared config scaffolding. Remaining work tracked below.


Follow-up Tasks

  1. Phase 2: Wallet balance hook + continued config migration (25 violations)
  2. chore(deps): bump fast-xml-builder from 1.1.4 to 1.2.0 #2: Resolve remaining 25 token registry scanner violations
  3. chore(deps): bump mermaid from 11.12.0 to 11.15.0 #3: Fix/triage 109 TypeScript errors (server + client)
  4. chore(deps): bump uuid from 11.1.0 to 11.1.1 #4: Configure VITE_WALLETCONNECT_PROJECT_ID in GitHub Actions
  5. Audit: 1 critical + 3 high vulnerabilities in dependencies #9: Investigate pnpm/vitest audit findings in dedicated dependency-security PR

Created client/src/lib/config.ts:
- Single source of truth for chain IDs, contract addresses, chain metadata
- SUPPORTED_CHAIN_IDS, SupportedChainId type
- CHAINS record with Base (8453) and PulseChain (369) metadata
- Helper functions: getChainConfig, getHeroAddress, getStakingAddress, getExplorer, etc.
- Backward compat exports: HERO_ADDRESSES, STAKING_ADDRESSES, CHAIN_IDS

Created client/src/lib/external-links.ts:
- Explorer links: getExplorerAddressUrl, getExplorerTxUrl, getExplorerTokenUrl
- DEX/swap links: getSwapUrl, getLiquidityUrl
- Bridge links: getBridgeUrl
- External links: documentation, discord, twitter, telegram, github, website

Verified addresses from existing repo sources.

Build: pnpm build passes (24.36s)
Tests: 240/260 pass (20 require VITE_WALLETCONNECT_PROJECT_ID)
useStaking.ts:
- Removed duplicate STAKING_ADDRESSES record
- Now imports getStakingAddress() from shared config
- Kept HERO_STAKING_ADDRESS export for backward compat

HeroStake.tsx:
- Replaced duplicate CHAIN_CONFIG with getHeroStakeChainConfig()
- Uses shared getChainConfig() for heroCA and explorer
- Only keeps local display config (name, color)

config.ts:
- Fixed staking addresses from useStaking.ts (Base: 0xAD79..., Pulse: 0xD5F1...)

Scanner (check-token-registry.mjs):
- Created to detect duplicated hardcoded addresses
- Reports 33 violations in other files (Phase 2 scope)

Build: passes (23.80s)
pnpm upgrade:
- packageManager: 10.25.0 → 10.27.0 (fixes critical/high CVEs)

Migrated to shared config:
- Dashboard.tsx: Removed HERO_ADDRESS, VETS_ADDRESS; uses getHeroAddress(), getVETSAddress()
- HeroWallet.tsx: BALANCE_CHAINS now uses getHeroAddress() and getRPCs()
- HeroSwapWidget.tsx: buildDEXLinks() uses getHeroAddress() for dynamic URLs
- config.ts: Added getVETSAddress() helper

Scanner violations reduced: 33 → 28
Remaining violations: Dashboard (VETS), HeroWallet (VETS), AppLayout, Swap, etc.

Build: passes (23.57s)
Migrated to shared config:
- Swap.tsx: Uses getHeroAddress(369) for Switch.win and SquirrelSwap URLs
- SquirrelSwapWidget.tsx: buildDEXLinks-like pattern uses getHeroAddress()
- PortfolioDashboard.tsx: CONTRACTS.hero now uses getHeroAddress()
- HeroSwapWidget.tsx: Fixed undefined check with fallback address

Scanner violations reduced: 28 → 25
(remaining in Phase 2 scope: AppLayout, LiveTicker, PortfolioPnL, etc.)

Build: passes (23.49s)
@jratdish1 jratdish1 marked this pull request as ready for review June 4, 2026 08:34
@jratdish1 jratdish1 merged commit ba4ef1f into main Jun 4, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dcb6639d5e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread client/src/pages/Swap.tsx
{/* CTA Button */}
<a
href="https://switch.win/?network=pulsechain&to=0x35a51Dfc82032682E4Bda8AAcA87B9Bc386C3D27"
href="https://switch.win/?network=pulsechain&to={`${heroPulse}`}"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Interpolate HERO address in swap CTA URLs

When users click the Swap page CTAs, this string literal sends the to parameter as the literal text `${heroPulse}` instead of the PulseChain HERO contract address; the SquirrelSwap link below has the same pattern for tokenOut. As a result these aggregators cannot preselect HERO from the Swap page, regressing the main buy flow that previously passed the hardcoded token address.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants