Skip to content

Fix auth state race conditions, redesign authorization page, unify policy constants#3

Closed
jarrodwatts wants to merge 31 commits intomainfrom
cleanup/agw-production-hardening
Closed

Fix auth state race conditions, redesign authorization page, unify policy constants#3
jarrodwatts wants to merge 31 commits intomainfrom
cleanup/agw-production-hardening

Conversation

@jarrodwatts
Copy link
Copy Markdown
Contributor

Summary

  • Fix login loop caused by Privy SDK state transitions resetting wizard step during async AGW on-chain check — adds resolving intermediate state, fixes effect deps, gates redirect on wallet readiness
  • Redesign SelectPolicy as clean OAuth-style consent page with safety limit pills, compact permissions, and green CTA
  • Unify policy constants so UI preview, presets, and server-side Privy policy all use the same source of truth (config.ts / default-policy.ts)

Test plan

  • Run pnpm --dir app check-types — passes clean
  • Run pnpm test — 107 tests pass
  • Run pnpm --dir app build — builds successfully
  • Run auth init flow against local companion app and verify:
    • Resolving spinner shown during AGW check (no flash to login)
    • Safety pills display correct values (30 days, 0.01 ETH, chain name)
    • Checkbox enables green "Approve Access" button
    • Clicking "Approve Access" proceeds to Creating step
    • Logout from any state returns to not_logged_in
    • RPC/AGW errors show explicit error with retry button

🤖 Generated with Claude Code

jarrodwatts and others added 30 commits March 10, 2026 11:07
Privy API requires chain_id as hex-prefixed string (0x2b74) not decimal
(11124). Also adds missing chain_type field to RPC body and improves
error parsing to surface actual Privy error messages through the proxy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Use @abstract-foundation/agw-client's createAbstractClient directly
with a custom EIP-1193 provider that routes signing RPCs to Privy's
REST API. This replaces the manual transaction building in
AgwActionAdapter with agw-client's native AA handling (tx preparation,
EIP-712 signing, hook fetching, serialization, broadcasting).

Key changes:
- New src/agw/client.ts: custom transport + AbstractClient factory
- Delete src/agw/actions.ts: fully replaced by AbstractClient
- SessionManager.getAbstractClient(): lazy-cached client creation
- All 7 tool handlers simplified to use AbstractClient methods
- Privy RPC response: handle signature/signed_transaction/result fields
- Privy signTypedData: strip caip2/chain_type, convert primaryType
- Bundle agw-client via noExternal to fix broken ESM exports
- Proxy route: strip caip2/chain_type for signTypedData forwarding

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit removes the `AGW_ZEROEX_API_KEY` from the public runtime configuration, deletes the ZeroEx configuration and quote adapter files, and updates related documentation and tests to reflect these changes. The `MYRIAD` app has also been removed from the app registry.
This commit introduces a new banner image for the AGW CLI and updates the README to include the banner at the top, enhancing the visual presentation of the project documentation.
Replace flat balance arrays with structured nativeBalance/tokenBalances
objects, add tokenAddresses input, surface session and explorer context,
and update all field-path references across docs and skills.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Prefer direct getPool reads over DexScreener when an exact pair is
named. Add factory query examples, clarify that DexScreener misses
are not proof of absence, and align wallet field paths.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Rename the publishable CLI package directory, npm package name, binary
entry point, and all references across source, configs, docs, and tests
so the installed command becomes `agw-cli` and the npm identifier
becomes `@abstract-foundation/agw-cli`.

Also fix copy-button positioning in the companion app code blocks so
the button stays pinned on horizontal scroll and gets a backdrop blur
to avoid text overlap.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Address cursor bot PR feedback:

1. Update publish workflow pnpm filter from @abstract-foundation/agw
   to @abstract-foundation/agw-cli so releases actually publish.

2. Replace hardcoded abstractTestnet in useSessionWizardState with
   chain resolution from the store's chainId, set by SessionFlowClient
   on mount. Mainnet users were hitting the wrong chain for AGW account
   derivation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adopt official gerund naming (`verb-ing-object`) for all shipped skills
to improve discoverability and align with Anthropic's skill authoring
best practices. Update all cross-references in app-catalog, tests,
OpenAI agent YAML files, and README.

Renames:
- agw-auth-session → authenticating-with-agw
- agw-wallet-reads → reading-agw-wallet
- agw-tx-discipline → executing-agw-transactions
- agw-portal-discovery → discovering-abstract-portal
- protocol-aborean → trading-on-aborean

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New skill covering token swaps, price quotes, and basic LP operations
via Uniswap V2 and V3 on Abstract mainnet and testnet. Includes all
deployed contract addresses, function signatures, approval+swap
batching patterns, V2 vs V3 decision guidance, slippage calculations,
and error handling reference.

Key content:
- SKILL.md: swap workflow, V2/V3 decision tree, batching guide
- references/contracts.md: all V2+V3 addresses (mainnet + testnet)
- references/v2-entrypoints.md: router swap/quote/LP signatures
- references/v3-entrypoints.md: SwapRouter02, QuoterV2, NFT manager

Clarifies that agw tx calls requires raw hex calldata (not ABI-level
args), while agw contract write supports ABI-level for readability.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New skill for AI agent identity registration and reputation management
via the ERC-8004 Trustless Agents standard on Abstract. Covers both
IdentityRegistry (agent registration, metadata, wallet management) and
ReputationRegistry (feedback, summaries, revocation).

Includes mainnet and testnet contract addresses (deterministic CREATE2
deploys identical across 20+ EVM chains), complete interface
documentation, and the agentURI registration file schema.

Key fix vs baseline: teaches correct `register(string agentURI)`
signature — baselines hallucinate `registerAgent(address, string)`
which would revert on-chain.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
bridging-to-abstract: Covers native Ethereum bridge (L1↔L2 deposit/
withdrawal with timing and two-step finalization) and six third-party
bridges (Relay, Jumper, Stargate, Symbiosis, thirdweb, deBridge).
Includes Relay API for programmatic bridge quotes, bridge selection
decision tree, and common failure troubleshooting.

building-on-abstract: Developer onboarding skill covering project
scaffolding (create-abstract-app), smart contract deployment via
Foundry/Hardhat, AGW client and React SDK integration, paymaster
development (General and Approval-Based flows), session keys with
Policy Registry, and critical ZKsync VM EVM differences. Includes
all 17 system contract addresses and network configuration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New skill for the on-chain AbstractVoting contract at
0x3b50de27506f0a8c1f4122a1e6f470009a76ce2a. Covers vote cost
queries, remaining vote checks, casting votes (payable with correct
value), checking vote counts per app/epoch, and epoch mechanics.

Includes full verified contract ABI, error handling reference
(InvalidValue, AlreadyVotedFor, UsedAllVotes, etc.), and the
complete voting workflow from cost check through execution.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…trings

The AGW CLI schema validation requires ABI array elements to be JSON
objects (with type, name, inputs, outputs, stateMutability fields),
not human-readable strings like "function balanceOf(address) view
returns (uint256)". The latter fails with "json.abi[0] must be an
object" at the validation layer before reaching viem.

Converted all SKILL.md task-map examples to full JSON ABI format
and added an "ABI Format" section to each affected skill explaining
the requirement. Reference files retain human-readable signatures
for documentation purposes.

Verified on-chain via direct RPC eth_call:
- IdentityRegistry.balanceOf() ✓
- AbstractVoting.voteCost() = 0 (free), currentEpoch() = 317 ✓
- UniswapV2Router.getAmountsOut(0.1 ETH) = 190.22 USDC ✓

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Resolve login loop caused by Privy SDK state transitions resetting the
wizard to not_logged_in during async AGW on-chain verification. Add a
resolving intermediate step, fix effect dependency array to use primitive
signerAddress instead of user object, gate login redirect on embedded
wallet readiness, and surface explicit errors for missing AGW and RPC
failures with proper retry paths.

Redesign the SelectPolicy authorization screen as a clean OAuth-style
consent page: safety limits shown as prominent pills derived from actual
policy defaults, compact permission checklist in plain English, simplified
consent text, and green Approve Access CTA.

Unify policy constants so the UI preview, preset definitions, and
server-side Privy policy all reference the same source of truth in
config.ts and default-policy.ts.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@vercel
Copy link
Copy Markdown

vercel Bot commented Mar 16, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
agw-mcp Ready Ready Preview, Comment Mar 16, 2026 7:13am

Request Review

@cursor
Copy link
Copy Markdown

cursor Bot commented Mar 16, 2026

PR Summary

Medium Risk
Medium risk because it changes the release/publish automation (manifest-driven versioning and filtered pnpm publish) and updates companion app dependencies/env for Privy auth, which can affect release output and auth flows.

Overview
Release automation is reworked for a monorepo-style flow. release-please now uses release-please-config.json + a new .release-please-manifest.json, and the publish workflow only runs pnpm publish for @abstract-foundation/agw-cli via --filter.

Repo hygiene/docs are updated. Adds ignores for *.tgz and generated portal docs, removes CLAUDE.md and the stub CHANGELOG.md, and significantly rewrites README.md/security docs to reposition around AGW CLI + delegated-signer safety model.

Companion app config is adjusted. Adds Privy public env vars to app/.env.example, drops the app-registry refresh script, and adds @privy-io/react-auth to the app’s dependencies.

Written by Cursor Bugbot for commit dde0959. This will update automatically on new commits. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant