refactor: earn flow + remove xstate/store by petar-omni · Pull Request #551 · stakekit/widget

petar-omni · 2026-06-26T23:13:26Z

Note

High Risk
Large new DeFi borrow path with wallet signing, transaction submission, and LTV validation touches money-moving flows; earn routing/state refactor could regress staking if mis-wired.

Overview
Adds a feature-flagged borrow experience in the dashboard (form → review → steps → complete, plus borrow position management), backed by a new borrow module: Effect Schema domain models, OpenAPI-generated BorrowApi client, and @effect/atom-react atoms for markets/positions, form state, action execution (sign/submit/confirm), and post-tx cache refresh.

Earn flow cleanup: drops EarnPageStateUsageBoundaryProvider / @xstate/store, removes common/get-token-balances.ts and getInitialToken from stake types, and tightens validator handling via a composite Validator.key (address + optional subnet) used in select-validator and position balance keys.

Tooling/config: OpenAPI generator gains BorrowApi (full httpclient + spec prep), optional CLI spec selection, VITE_BORROW_API_URL / VITE_FORCE_BORROW, and root pnpm.patchedDependencies removed; adds skeleton line/circle loaders for borrow UI loading states.

^{Reviewed by Cursor Bugbot for commit 6cf3187. Configure here.}

changeset-bot · 2026-06-26T23:13:30Z

⚠️ No Changeset found

Latest commit: 1ac27c3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-06-26T23:13:34Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f2d2a83c-e736-49e8-b48f-3041b4042c82

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/earn-effect-atom-poc

_{Comment @coderabbitai help to get the list of available commands.}

aws-amplify-eu-central-1 · 2026-06-26T23:15:52Z

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-551.d2ribjy8evqo6h.amplifyapp.com

aws-amplify-eu-central-1 · 2026-06-26T23:16:01Z

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-551.df4xyoi0xyeak.amplifyapp.com

Key validators by address and subnet so selection keeps distinct validator options. Scope balance and init token options to the selected dashboard category.

cursor

Stale comment

cursor · 2026-07-07T12:26:02Z

+                      {t("dashboard.borrow.success_page.view_transaction")}
+                    </Text>
+                  </Box>
+                ) : null


🔒 Agentic Security Review
Severity: MEDIUM

submission.link is opened via window.open(..., "_blank") without noopener,noreferrer. If this URL is attacker-influenced (e.g., via upstream API data), the opened page can access window.opener and navigate the original tab (reverse-tabnabbing).

Impact: A user can be redirected from the trusted widget host tab to a phishing or malicious page after clicking a transaction link.

^{Reviewed by Cursor Security Reviewer for commit 6cf3187. Configure here.}

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, Cursor Security Agent left an unresolved medium-severity finding, and required checks did not finish on the latest commit (Bugbot cancelled; Security Agent still running). Assigned jdomingos and dnehl for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

dnehl

Played around with the flow - looks good.

no console errors
no "strange" multiple backend calls
duration looks good

Split earn intent and view atoms so route and wallet state changes update the resolved view. Keep dispatch separate from view reads and add wallet resolution handling. Cover dashboard tab selection and patch Effect parent tracking.

Use the native TypeScript 7 compiler across the widget and examples. Keep TypeScript 6 API compatibility for Next.js tooling.

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Replace legacy context, query, and state-machine integrations with Effect services and atom-backed wallet, API, and workflow state. Split Vitest projects and add AST rules to validate the new architecture.

Replace the global identity and phase model with a runtime intake store and route-scoped facade. Align review, workflow, and cleanup lifetimes with one Flow Session generation.

Scope intake cleanup to application runtime replacement and enforce KYC in every Continue path. Deepen intake snapshots and cover wallet, workflow, and stale-session lifetimes.

Reacquire review and steps lifecycle atoms for every router entry. This keeps host and browser navigation normalization reliable without adding a stored flow phase.

Scope Session state to a keyed route boundary. Create fresh Review and Execution capabilities per route mount. Keep only the reviewed action handoff in the parent Session.

Construct action commands through their schemas and reject requests when required subnet IDs are unavailable. Keep completion effects mounted for the workflow scope, refresh generated API clients, and replace brittle architecture checks with documented review constraints.

Split classic and borrow journeys into feature-owned flow sessions. Move shared execution mechanics into a scoped transaction workflow module. Make lifecycle, routing, and completion ownership explicit while preserving isolated attempts.

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Move cacheable remote reads into app-scoped resource modules so features share one typed source of truth. Separate read capabilities from operations and enforce the new dependency boundaries.

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Make Earn state own selection reconciliation, readiness, and targeted failures. Decode consumed mechanic arguments at the API boundary and verify resource behavior.

socket-security · 2026-07-23T13:21:21Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	react@19.2.8
	react-dom@19.2.8

View full report

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

cursor

Stale comment

🔒 Agentic Security Review

1 finding met reporting thresholds after deduplication and triage.

HIGH in .github/workflows/release.yml (added canary publish job): the workflow runs curl https://mise.run | ... sh in a privileged CI context (id-token: write + npm publish path), introducing remote-script execution risk in the release pipeline.

_{Sent by Cursor Security Agent: Security Reviewer}

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Add an internal canary channel for branch-specific QA. Keep the stable Release Please flow unchanged. Derive immutable versions from npm latest and the workflow run number. Publish under the canary dist-tag and document retry and QA usage.

cursor

Stale comment

🔒 Agentic Security Review

One net-new security finding was validated on the current PR head:

MEDIUM: The newly added canary release workflow executes curl https://mise.run | ... sh in .github/workflows/release.yml, introducing remote script execution without integrity verification in a publish-capable CI path.

No duplicate comment was reposted for the existing borrow-link _blank thread because that finding is already present in an open automation thread on this same head.

_{Sent by Cursor Security Agent: Security Reviewer}

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent reported unresolved findings (medium tabnabbing on complete.tsx and medium remote-script execution in release.yml). jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Replace native Date and date-fns usage with Effect DateTime, Duration, and Clock. Apply one time model across API schemas, domain logic, tests, and presentation. Add tolerant timestamp decoding, a shared ticker, Activity expiry guards, and AST lint rules. Prevent loading CTAs from accepting clicks before their action is ready.

Enable the Biome rule and replace existing nested ternaries. Use immutable resolvers, focused Effect Match usage, and clearer JSX branches. Document the value-selection convention for future changes.

Scope collateral balances to their markets and use position-specific risk data. Keep debt, collateral, health, and APY values accurate across borrow positions. Centralize financial formatting and remove misleading capacity and collateral APY labels.

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding. jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Enable ast-grep rules for Effect, Atom, React Query, storage, and serialization boundaries. Remove obsolete memoization and native error rules. Migrate affected wallet and translation code to scoped Effect runtimes and typed failures.

cursor

Stale comment

🔒 Agentic Security Review

1 net-new finding met reporting thresholds after module triage, severity normalization, and duplicate suppression against existing automation threads.

_{Sent by Cursor Security Agent: Security Reviewer}

cursor · 2026-07-24T10:27:02Z

+
+      - name: Install mise
+        run: |
+          curl https://mise.run | MISE_VERSION=v2026.5.6 sh


🔒 Agentic Security Review
Severity: HIGH

The canary publish job executes curl https://mise.run | ... sh directly, which runs mutable remote script content in a publish-capable CI path. This creates a trust-boundary break where compromise of the remote script source or transit path can execute arbitrary commands during release.

Impact: An attacker controlling that install script path could tamper with build/publish steps and ship malicious package artifacts under a trusted namespace.

^{Reviewed by Cursor Security Reviewer for commit ae0dc50. Configure here.}

cursor

Stale comment

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has unresolved findings (medium tabnabbing on complete.tsx and high remote-script execution in release.yml). jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Replace the callback-rich React page models with capability facades that publish read-only views and writable commands, so projections, tracking, navigation, and resource lifetimes live in Effect and Atom instead of hooks. Application navigation moves into the runtime: a scoped ApplicationRouter owns the memory router for a runtime generation, WidgetNavigation executes workflow destinations, and the root route configuration is assembled at the top-level React composition seam rather than imported by runtime construction. Validator selection memory becomes a command-time write instead of a write during a derived read, which previously destabilised the Earn machine view and suppressed validator searches.

cursor

Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has unresolved findings (medium tabnabbing and high remote-script execution in release.yml). jdomingos and dnehl are already assigned for human review.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

petar-omni added 2 commits June 27, 2026 01:10

feat(widget): add effect atom earn flow

8f6710c

refactor(widget): replace xstate stores with effect atoms

15d72af

fix(widget): stabilize earn option resolution

3127f0d

Key validators by address and subnet so selection keeps distinct validator options. Scope balance and init token options to the selected dashboard category.

petar-omni marked this pull request as ready for review July 7, 2026 12:22

Philippoes previously approved these changes Jul 7, 2026

View reviewed changes

cursor Bot reviewed Jul 7, 2026

View reviewed changes

feat: borrow init

5dac944

petar-omni dismissed Philippoes’s stale review via 5dac944 July 7, 2026 12:27

petar-omni force-pushed the feat/earn-effect-atom-poc branch from 6cf3187 to 5dac944 Compare July 7, 2026 12:27

petar-omni requested a review from Philippoes July 7, 2026 12:27

Philippoes previously approved these changes Jul 7, 2026

View reviewed changes

feat: temp

2110846

petar-omni dismissed Philippoes’s stale review via 2110846 July 7, 2026 12:31

cursor Bot requested a review from dnehl July 7, 2026 12:31

cursor Bot reviewed Jul 7, 2026

View reviewed changes

cursor Bot requested a review from jdomingos July 7, 2026 12:31

cursor Bot reviewed Jul 7, 2026

View reviewed changes

dnehl previously approved these changes Jul 7, 2026

View reviewed changes

dnehl self-requested a review July 7, 2026 14:11

petar-omni added 3 commits July 9, 2026 16:56

fix(widget): stabilize earn atom subscriptions

90a2b21

Split earn intent and view atoms so route and wallet state changes update the resolved view. Keep dispatch separate from view reads and add wallet resolution handling. Cover dashboard tab selection and patch Effect parent tracking.

feat: schema decoding, query to atoms migration

b2043f0

build(typescript): migrate to typescript 7

3c5bfdc

Use the native TypeScript 7 compiler across the widget and examples. Keep TypeScript 6 API compatibility for Next.js tooling.

petar-omni dismissed dnehl’s stale review via 16d2bb4 July 14, 2026 23:49

cursor Bot reviewed Jul 14, 2026

View reviewed changes

refactor(widget): migrate runtime state to effect atoms

67eb76f

Replace legacy context, query, and state-machine integrations with Effect services and atom-backed wallet, API, and workflow state. Split Vitest projects and add AST rules to validate the new architecture.

petar-omni force-pushed the feat/earn-effect-atom-poc branch from 16d2bb4 to 67eb76f Compare July 15, 2026 08:42

petar-omni added 6 commits July 20, 2026 14:00

refactor(widget): scope classic flow by session

e68f426

Replace the global identity and phase model with a runtime intake store and route-scoped facade. Align review, workflow, and cleanup lifetimes with one Flow Session generation.

fix(widget): harden classic flow session boundaries

8f8bd72

Scope intake cleanup to application runtime replacement and enforce KYC in every Continue path. Deepen intake snapshots and cover wallet, workflow, and stale-session lifetimes.

fix(widget): key flow lifecycle by route entry

5ad1c12

Reacquire review and steps lifecycle atoms for every router entry. This keeps host and browser navigation normalization reliable without adding a stored flow phase.

refactor(widget): align classic flow lifetimes

1b7fb13

Scope Session state to a keyed route boundary. Create fresh Review and Execution capabilities per route mount. Keep only the reviewed action handoff in the parent Session.

cursor Bot reviewed Jul 21, 2026

View reviewed changes

petar-omni added 2 commits July 21, 2026 16:34

refactor(widget): expose workflows through scoped atoms

77802a3

refactor(widget): centralize authoritative resources

5ab29a2

Move cacheable remote reads into app-scoped resource modules so features share one typed source of truth. Separate read capabilities from operations and enforce the new dependency boundaries.

cursor Bot reviewed Jul 22, 2026

View reviewed changes

petar-omni added 2 commits July 22, 2026 21:20

chore(widget): merge main into effect atom branch

59beec8

feat(widget): resolve earn selection and readiness

4baeb74

Make Earn state own selection reconciliation, readiness, and targeted failures. Decode consumed mechanic arguments at the API boundary and verify resource behavior.

cursor Bot reviewed Jul 23, 2026

View reviewed changes

ci(release): add canary npm publishing

768b66c

Add an internal canary channel for branch-specific QA. Keep the stable Release Please flow unchanged. Derive immutable versions from npm latest and the workflow run number. Publish under the canary dist-tag and document retry and QA usage.

petar-omni force-pushed the feat/earn-effect-atom-poc branch from 04b95f6 to 768b66c Compare July 23, 2026 14:20

cursor Bot reviewed Jul 23, 2026

View reviewed changes

petar-omni added 3 commits July 23, 2026 16:55

refactor(widget): disallow nested ternaries

f4ab711

Enable the Biome rule and replace existing nested ternaries. Use immutable resolvers, focused Effect Match usage, and clearer JSX branches. Document the value-selection convention for future changes.

cursor Bot reviewed Jul 24, 2026

View reviewed changes

feat(lint): enforce widget architecture rules

ae0dc50

Enable ast-grep rules for Effect, Atom, React Query, storage, and serialization boundaries. Remove obsolete memoization and native error rules. Migrate affected wallet and translation code to scoped Effect runtimes and typed failures.

petar-omni force-pushed the feat/earn-effect-atom-poc branch from 63c6f2c to ae0dc50 Compare July 24, 2026 10:22

cursor Bot reviewed Jul 24, 2026

View reviewed changes

cursor Bot reviewed Jul 25, 2026

View reviewed changes

Uh oh!

Conversation

petar-omni commented Jun 26, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Jun 26, 2026

Review skipped

Uh oh!

aws-amplify-eu-central-1 Bot commented Jun 26, 2026

Uh oh!

aws-amplify-eu-central-1 Bot commented Jun 26, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dnehl left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

socket-security Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 24, 2026

Choose a reason for hiding this comment

petar-omni commented Jun 26, 2026 •

edited by cursor Bot

Loading

changeset-bot Bot commented Jun 26, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

dnehl left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

socket-security Bot commented Jul 23, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading