feat(ramp): opt-in RAMPS debug dashboard tooling by amitabh94 · Pull Request #28110 · MetaMask/metamask-mobile

amitabh94 · 2026-03-30T18:27:42Z

Description

Adds opt-in developer tooling so Money Movement / RAMPS engineers can stream RampsController state and calls to a local browser dashboard without loading the bridge for every dev build.

RAMPS_DEBUG_DASHBOARD=true in .js.env + Metro restart enables the bridge; RAMPS_DEBUG_DASHBOARD_URL overrides the WebSocket URL (devices/emulators).
Dynamic import() from ramps-controller-init.ts so the bridge (including fetch instrumentation) is omitted from the bundle unless enabled.
app/components/UI/Ramp/debug/README.md — setup, adb reverse, env vars.
ramps-debug-dashboard/ — self-contained Node server (npm ci + node server.mjs); session logs gitignored.
Includes prior commit on this branch: CODEOWNERS paths for Money Movement (@MetaMask/money-movement) and ramps-debug-dashboard/ entry.

Changelog

CHANGELOG entry: null

Related issues

Fixes:

Manual testing steps

Feature: RAMPS debug dashboard

  Scenario: Dashboard receives data when opt-in env is set
    Given a debug build with RAMPS_DEBUG_DASHBOARD=true in .js.env and Metro restarted
    And ramps-debug-dashboard is running (npm ci && node server.mjs)
    When the app launches and RampsController is active
    Then the browser UI at http://localhost:8099 shows state/method traffic
    And Metro logs include a RampsDebug connected message

Screenshots/Recordings

Ramps Debug Dashboard - Watch Video

Pre-merge author checklist

I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
I've completed the PR template to the best of my ability
I've included tests if applicable
I've documented my code using JSDoc format if applicable
I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Dev-only code now conditionally patches fetch and wraps RampsController methods when RAMPS_DEBUG_DASHBOARD=true, which could affect local debugging behavior if enabled. Production behavior should remain unchanged due to __DEV__ gating and optional require.

Overview
Adds an opt-in, __DEV__-only “RAMPS debug dashboard” that streams RampsController state changes, method calls (with timing/cache-hit heuristics), and selected ramps-related fetch traffic to ws://localhost:8099.

Introduces a self-contained host dashboard under scripts/money-movement/debug-dashboard/ (Node HTTP+WebSocket server, JSONL session logging, and yarn ramps:debug-dashboard runner) plus new docs and env var guidance in .js.env.example.

Updates ramps-controller-init to conditionally require and initialize the bridge when RAMPS_DEBUG_DASHBOARD=true, adds Jest coverage for that gating, and excludes the new debug tooling from Sonar coverage and the security code scanner.

^{Written by Cursor Bugbot for commit b8ed425. This will update automatically on new commits. Configure here.}

…OWNERS Made-with: Cursor

github-actions · 2026-03-30T18:27:52Z

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

- Env-gated dynamic import (RAMPS_DEBUG_DASHBOARD) and optional WS URL - Document setup in app/components/UI/Ramp/debug/README.md - Vendor ramps-debug-dashboard server; CODEOWNERS for Money Movement Made-with: Cursor

Made-with: Cursor

scripts/money-movement/debug-dashboard/dashboard.html

…scan - Add isRampsDebugDashboardEnabled / getRampsDebugDashboardWebSocketUrl in environment - Wire RampsDebugBridge and ramps-controller-init to helpers; extend unit tests - Ignore ramps-debug-dashboard/ in MetaMask security-code-scanner paths_ignored Made-with: Cursor

- Type RampsDebugBridge registerWidgetCallback stub (lint:tsc) - Ignore ramps-debug-dashboard/ in PR max-lines count - Exclude app/components/UI/Ramp/debug from Sonar analysis and coverage - Root yarn ramps:debug-dashboard scripts + README quick start Made-with: Cursor

- Move host tooling from repo root to scripts/money-movement/debug-dashboard - Own scripts/money-movement/ in CODEOWNERS; update scanner paths and docs - Fix setup/start/teardown repo-root resolution for nested path Made-with: Cursor

… scripts - CODEOWNERS: only add scripts/money-movement/ for @MetaMask/ramp (match main) - Remove setup/start/teardown (obsolete bridge copy + skip-worktree flow; bridge is in-repo) - Simplify debug-dashboard package.json scripts; align README wording Made-with: Cursor

- Add run.sh: npm ci if needed then server; yarn ramps:debug-dashboard only - Enable RampsDebugBridge in __DEV__ without RAMPS_DEBUG_* env vars - Hardcode ws://localhost:8099 in bridge; document adb reverse for Android - Remove env helpers/tests and .js.env.example RAMPS_DEBUG lines Made-with: Cursor

- Use require under __DEV__ so Jest can mock RampsDebugBridge (dynamic import fails without vm modules) - Exclude ramps-controller-init from test env inlining for __DEV__ toggling - Add __DEV__ test asserting initRampsDebugBridge wiring - Place eslint-disable-next-line on require line for no-require-imports Made-with: Cursor

app/components/UI/Ramp/debug/RampsDebugBridge.ts

app/core/Engine/controllers/ramps-controller/ramps-controller-init.ts

- Require RAMPS_DEBUG_DASHBOARD=true with __DEV__ to load bridge (no reconnect for most devs) - Document .js.env and example; extend tests for env gate and bridge loading Made-with: Cursor

Mitigates DOM XSS findings (CodeQL) when rendering controller state from WebSocket. Made-with: Cursor

… rejections - Serve DOMPurify from vendor/purify.min.js (no nested yarn install) - Ignore vendor bundle in ESLint - Harden dashboard HTML sanitization paths for CodeQL - RampsDebugBridge: only onFulfilled handler on instrumented promises Made-with: Cursor

…init test - Drop vendored purify.min.js and /purify route; load pinned DOMPurify from jsDelivr - Revert root .eslintignore vendor entry - Ignore scripts/money-movement/debug-dashboard in MetaMask security code scanner - Build initial RampsController test state from getDefaultRampsControllerState() Made-with: Cursor

app/components/UI/Ramp/debug/RampsDebugBridge.ts

Made-with: Cursor

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

app/components/UI/Ramp/debug/RampsDebugBridge.ts

Made-with: Cursor

github-actions · 2026-03-31T03:13:05Z

🔍 Smart E2E Test Selection

Selected E2E tags: SmokeRamps
Selected Performance tags: None (no tests recommended)
Risk Level: low
AI Confidence: 90%

click to see 🤖 AI reasoning details

E2E Test Selection:
All changes in this PR are developer tooling additions with no production impact:

ramps-controller-init.ts: The only app code change adds a __DEV__ && isRampsDebugDashboardEnabled() block that is dead code in production builds. The isRampsDebugDashboardEnabled() function checks process.env.RAMPS_DEBUG_DASHBOARD === 'true', which is never set in CI/E2E environments. Metro strips __DEV__ blocks in production builds entirely.
RampsDebugBridge.ts: New file that is only loaded via require() inside the __DEV__ gate. Never loaded in production or E2E test runs.
babel.config.tests.js: Adds ramps-controller-init files to test babel overrides — this is a test infrastructure change needed for Jest to handle the __DEV__ global in unit tests. Does not affect Detox E2E tests.
package.json: Only adds a ramps:debug-dashboard developer script. No new production dependencies.
scripts/money-movement/debug-dashboard/: Entirely new developer tooling (WebSocket server, HTML dashboard). Not part of the app bundle.
CI/config files (.github/workflows/security-code-scanner.yml, sonar-project.properties, .js.env.example): Minor configuration updates to exclude new debug tooling from security scanning and coverage.

Since the ramps-controller-init.ts is a CRITICAL file (app/core/Engine/ path) and it was modified, running SmokeRamps provides a safety net to verify the ramps controller initialization still works correctly in a real E2E scenario. However, the actual risk is very low since the changes are purely additive dev-only code that cannot execute in production/E2E builds.

Performance Test Selection:
No performance impact expected. All changes are developer tooling (debug bridge, WebSocket server, scripts) that are gated behind DEV and an opt-in environment variable. Production builds are completely unaffected. No UI components, rendering logic, state management, or critical user flows were modified.

View GitHub Actions results

github-actions · 2026-03-31T03:30:22Z

✅ E2E Fixture Validation — Schema is up to date
17 value mismatches detected (expected — fixture represents an existing user).
View details

codecov-commenter · 2026-03-31T03:36:36Z

Codecov Report

❌ Patch coverage is 2.95858% with 164 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.54%. Comparing base (e2bb36a) to head (b8ed425).
⚠️ Report is 29 commits behind head on main.

Files with missing lines	Patch %	Lines
app/components/UI/Ramp/debug/RampsDebugBridge.ts	0.00%	164 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #28110      +/-   ##
==========================================
- Coverage   82.63%   82.54%   -0.10%     
==========================================
  Files        4854     4860       +6     
  Lines      125092   125561     +469     
  Branches    27919    28114     +195     
==========================================
+ Hits       103376   103640     +264     
- Misses      14600    14760     +160     
- Partials     7116     7161      +45

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

sonarqubecloud · 2026-03-31T03:38:05Z

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

chore: point Money Movement paths to @MetaMask/money-movement in CODE…

e710609

…OWNERS Made-with: Cursor

amitabh94 self-assigned this Mar 30, 2026

metamaskbot added the team-money-movement issues related to Money Movement features label Mar 30, 2026

feat(ramp): add opt-in RAMPS debug dashboard tooling

d658549

- Env-gated dynamic import (RAMPS_DEBUG_DASHBOARD) and optional WS URL - Document setup in app/components/UI/Ramp/debug/README.md - Vendor ramps-debug-dashboard server; CODEOWNERS for Money Movement Made-with: Cursor

github-actions bot added the size-S label Mar 30, 2026

docs(ramp): note npm ci for ramps-debug-dashboard deps

a81e445

Made-with: Cursor

amitabh94 changed the title ~~chore: update CODEOWNERS to @MetaMask/money-movement~~ feat(ramp): opt-in RAMPS debug dashboard tooling Mar 30, 2026

github-actions bot added size-XL and removed size-S labels Mar 30, 2026

github-advanced-security bot found potential problems Mar 30, 2026

View reviewed changes

amitabh94 added 2 commits March 30, 2026 13:48

github-actions bot added size-L and removed size-XL labels Mar 30, 2026

github-actions bot added size-XL and removed size-L labels Mar 30, 2026

amitabh94 added 3 commits March 30, 2026 15:56

amitabh94 marked this pull request as ready for review March 31, 2026 00:48

Merge branch 'main' into feat/ramps-debug-dashboard-tooling

ff91d07

amitabh94 requested review from a team as code owners March 31, 2026 00:48

github-actions bot added the risk-low Low testing needed · Low bug introduction risk label Mar 31, 2026

cursor bot reviewed Mar 31, 2026

View reviewed changes

app/components/UI/Ramp/debug/RampsDebugBridge.ts Outdated Show resolved Hide resolved

app/core/Engine/controllers/ramps-controller/ramps-controller-init.ts Show resolved Hide resolved

amitabh94 mentioned this pull request Mar 31, 2026

chore: update CODEOWNERS to @MetaMask/money-movement #28131

Merged

7 tasks

amitabh94 added 2 commits March 30, 2026 20:42

feat(ramps): opt-in RAMPS debug dashboard via env

d59c0a2

- Require RAMPS_DEBUG_DASHBOARD=true with __DEV__ to load bridge (no reconnect for most devs) - Document .js.env and example; extend tests for env gate and bridge loading Made-with: Cursor

fix(ramps): escape state keys and error text in debug dashboard HTML

633cda1

Mitigates DOM XSS findings (CodeQL) when rendering controller state from WebSocket. Made-with: Cursor

github-actions bot added risk-low Low testing needed · Low bug introduction risk and removed risk-low Low testing needed · Low bug introduction risk labels Mar 31, 2026

cursor bot reviewed Mar 31, 2026

View reviewed changes

app/components/UI/Ramp/debug/RampsDebugBridge.ts Outdated Show resolved Hide resolved

fix(ramps): avoid spurious unhandled rejections in debug method wrapper

e5d6ebf

Made-with: Cursor

github-actions bot added risk-low Low testing needed · Low bug introduction risk and removed risk-low Low testing needed · Low bug introduction risk labels Mar 31, 2026

cursor bot reviewed Mar 31, 2026

View reviewed changes

app/components/UI/Ramp/debug/RampsDebugBridge.ts Show resolved Hide resolved

fix(ramps): send async method errors to debug dashboard stream

1344099

Made-with: Cursor

github-actions bot added risk-low Low testing needed · Low bug introduction risk and removed risk-low Low testing needed · Low bug introduction risk labels Mar 31, 2026

chore(ramp): drop scripts/money-movement from CODEOWNERS (see #28131)

b8ed425

Made-with: Cursor

github-actions bot added risk-low Low testing needed · Low bug introduction risk and removed risk-low Low testing needed · Low bug introduction risk labels Mar 31, 2026

tommasini approved these changes Mar 31, 2026

View reviewed changes

amitabh94 added this pull request to the merge queue Mar 31, 2026

Merged via the queue into main with commit 09f76fa Mar 31, 2026
98 of 99 checks passed

amitabh94 deleted the feat/ramps-debug-dashboard-tooling branch March 31, 2026 12:39

github-actions bot locked and limited conversation to collaborators Mar 31, 2026

metamaskbot added the release-100.10.0 label Mar 31, 2026

weitingsun added release-7.73.0 Issue or pull request that will be included in release 7.73.0 and removed release-100.10.0 labels Mar 31, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(ramp): opt-in RAMPS debug dashboard tooling#28110

feat(ramp): opt-in RAMPS debug dashboard tooling#28110
amitabh94 merged 20 commits intomainfrom
feat/ramps-debug-dashboard-tooling

amitabh94 commented Mar 30, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 30, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

github-actions bot commented Mar 31, 2026

Uh oh!

github-actions bot commented Mar 31, 2026

Uh oh!

codecov-commenter commented Mar 31, 2026

Uh oh!

sonarqubecloud bot commented Mar 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Conversation

amitabh94 commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changelog

Related issues

Manual testing steps

Screenshots/Recordings

Pre-merge author checklist

Pre-merge reviewer checklist

Uh oh!

github-actions bot commented Mar 30, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Mar 31, 2026

🔍 Smart E2E Test Selection

Uh oh!

github-actions bot commented Mar 31, 2026

Uh oh!

codecov-commenter commented Mar 31, 2026

Codecov Report

Uh oh!

sonarqubecloud bot commented Mar 31, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

amitabh94 commented Mar 30, 2026 •

edited

Loading