Harden core runtime safety checks

[phroi]

Why

Core runtime entry points need fail-closed chain identity checks, secret-safe config/preflight tooling, and transaction planning that does not treat reserved plain CKB as spendable.

Changes

• Pin vulnerable transitive brace-expansion and ws ranges.
• Add runtime config generation and preflight scripts with ignored-path, symlink, secp256k1 key, chain identity, and secret-redaction safeguards.
• Fail closed when SDK scan tips drift and guard order mint output mutation.
• Reuse conversion projection in the interface and reserve plain CKB before planning CKB conversions.

[gemini-code-assist]

Code Review

This pull request enhances the project's operational tooling by adding configuration generation and preflight verification scripts. Key technical improvements include the implementation of secret redaction for logs, stricter private key validation, and more robust chain tip crossing detection. The SDK now utilizes a specialized conversion transaction context, and a new utility manages spendable CKB calculations. Security is also addressed through dependency overrides for brace-expansion and ws. Review feedback correctly identified a potential indexing bug in the OrderManager.mint implementation and suggested refactoring brittle import paths in the preflight script.

[phroi]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces several security and robustness enhancements, including secret redaction for logs (private keys and RPC credentials), chain identity verification via preflight checks, and security overrides for vulnerable dependencies. It also refactors transaction context projection in the SDK and adds new CLI tools for configuration generation and live environment preflighting. A critical issue was identified in the OrderManager.mint implementation where the return value of addOutput is incorrectly treated as a count rather than an index, which would lead to an out-of-bounds access when adding the first output to a transaction.

[phroi]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a spendableCkb utility to handle reserved capacity, refactors transaction context projection within the SDK, and adds new scripts for configuration generation and live preflight checks. It also implements robust secret redaction for logs and security overrides for vulnerable dependencies. A critical issue was identified in the OrderManager.mint function, where the logic incorrectly calculates the output index, potentially leading to incorrect transaction construction.

[phroi]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces several security and robustness improvements, including chain preflight checks for RPC consistency, hardened private key validation against the SECP256K1 curve order, and secret redaction for logs. It also adds utility scripts for configuration generation and live environment preflighting, alongside refactoring the conversion context projection in the SDK. Feedback was provided regarding the redaction logic in node-utils, recommending that sensitive fields be omitted at the source to avoid potential issues with escaped characters in complex redaction cycles.

[phroi]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a spendableCkb utility for capacity management and refactors state projection to use projectConversionTransactionContext. It adds scripts for secure bot configuration generation and live pre-flight checks, supported by enhanced secret redaction for logs and chain identity verification. Security is further addressed through dependency overrides for brace-expansion and ws, and expanded test coverage for chain reorgs. A review comment identifies inconsistent role validation between the new scripts and suggests a stricter regex to prevent trailing special characters.

[phroi]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces several enhancements and security improvements, including new scripts for configuration generation and live pre-flight checks. It implements secret redaction for logs, refactors CKB availability logic using a new utility, and strengthens chain tip change detection in the SDK. Additionally, security overrides were added for vulnerable dependencies. Feedback was provided regarding the log sanitization logic, specifically that the current circular reference detection may incorrectly flag shared references in non-circular structures.

[phroi]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a suite of utilities for live environment management, including configuration generation and pre-flight checks, while enhancing security through robust secret redaction in logs and dependency overrides. It refactors CKB availability logic using a new spendableCkb utility and introduces projectConversionTransactionContext to streamline transaction context preparation. Additionally, it strengthens chain state validation by checking both block numbers and hashes during scans. Feedback focuses on correcting logic in the OrderManager.mint function, improving error serialization for objects and bigints, and adding safety guards for decodeURIComponent calls within the redaction logic to prevent potential crashes.

[phroi]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces the projectConversionTransactionContext helper and a spendableCkb utility to improve transaction context and capacity management. It also adds comprehensive chain preflight verification and secret redaction logic to the node utilities, supported by new scripts for bot configuration and live system reporting. Security pins for brace-expansion and ws are also applied. Feedback highlights a critical bug in OrderManager.mint where the return value of addOutput is incorrectly used as a count, potentially leading to an out-of-bounds error when accessing the first output.

[phroi]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces several security and reliability enhancements, including robust secret redaction for logs, chain preflight verification, and new scripts for configuration generation and live environment checks. It also refactors transaction context projection and improves error handling during chain state scanning to better handle network reorgs. Review feedback suggests further strengthening the logging pipeline by omitting sensitive fields at the source rather than relying on regex-based redaction, ensuring recursive processing of nested error causes, and expanding the list of sensitive keys to prevent accidental data exposure.

[phroi]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces several improvements to the CKB interaction layer, including a new spendableCkb utility, enhanced chain preflight checks, and robust secret redaction for logs. It also adds CLI tools for configuration generation and live preflight checks, while updating dependencies to address security vulnerabilities. The review feedback highlights a preference for omitting sensitive fields at the source rather than relying on regex-based redaction in the logging pipeline.

[phroi]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces several enhancements across the codebase, including new scripts for configuration generation and live preflight checks, improved secret redaction in logs, and a refactored transaction context projection in the SDK. It also includes security-related dependency overrides for brace-expansion and ws. A critical issue was identified in the OrderManager implementation where the return value of tx.addOutput is incorrectly handled as a count rather than an index, which would lead to incorrect transaction construction or runtime errors.

[phroi]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces several security and robustness improvements, including utility functions for calculating spendable CKB, enhanced secret redaction in logs and errors, and new scripts for configuration generation and live pre-flight checks. It also refactors state projection logic in the SDK and interface to improve consistency. A critical logic error was identified in the OrderManager.mint function regarding the handling of the return value from tx.addOutput(), which could lead to incorrect capacity assignment or runtime errors.

[phroi]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces several security and robustness improvements across the codebase. Key changes include the addition of chain preflight verification and secret redaction utilities in @ickb/node-utils, the introduction of projectConversionTransactionContext in the SDK to streamline transaction context creation, and new scripts for generating and verifying bot configurations. Additionally, it includes security overrides for vulnerable dependencies and refines CKB availability logic to account for reserved capacity. Feedback was provided regarding the safety of integer parsing in the configuration generator to prevent potential precision loss.

[phroi]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces significant updates to the project's infrastructure and utilities, including new scripts for generating configurations and performing live preflight checks. It also enhances security by implementing secret redaction for RPC URLs and private keys in logs and error messages, adds chain identity verification, and improves the robustness of L1 state scanning by detecting chain tip changes. My feedback highlights an opportunity to improve error diagnostics in the configuration parsing logic by preserving the original error cause.

[phroi]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces several improvements, including a new spendableCkb utility, enhanced preflight checks for chain identity and secret redaction, and a new CLI tool for generating runtime configurations. It also fixes a bug in OrderManager.mint where the output index was incorrectly calculated. I have reviewed the changes and confirmed that the fix for the output index in packages/order/src/order.ts is necessary and correct.

[phroi]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces several improvements, including a new preflight check utility for chain identity verification, enhanced secret redaction for logs, and configuration generation scripts. It also updates the OrderManager to correctly handle output indexing when adding order cells. I have reviewed the changes and identified a critical issue in packages/order/src/order.ts where the output indexing logic was incorrect, which would lead to runtime errors. The provided suggestion correctly addresses this by using the index returned by addOutput.

[phroi]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces several enhancements focused on security, environment pre-flight checks, and code refactoring. Key changes include the addition of a spendableCkb utility to manage reserved capacity in the interface, the introduction of projectConversionTransactionContext in the SDK to streamline transaction context creation, and the implementation of robust secret redaction logic within node utilities to prevent leaking private keys or RPC credentials in logs. Additionally, new scripts for generating secure configurations and performing live environment pre-flights have been added, along with security-related dependency overrides for ws and brace-expansion. I have no feedback to provide as there were no review comments to assess.

[phroi]

LGTM

Phroi %143