Merge synced main and observability rollout by mateosauton · Pull Request #4 · worldcoin/agentkit

mateosauton · 2026-03-10T23:17:21Z

Summary

Merge local main history (including sybil-airdrop-feature and observability work) into a PR-safe branch to satisfy protected-branch rules.
Add correlated logging + OTel-ready instrumentation across critical API flows with standardized error codes and request ID propagation.
Add client telemetry hooks, observability runbook documentation, and QA test plan updates.

Test plan

pnpm lint (root)
npx tsc --noEmit in sybil-airdrop
Browser flow smoke check with Playwright (/ load, robot gate interaction)
API check: GET /api/challenge returns x-request-id header and requestId in body

Made with Cursor

cursor rules and mcp servers

…urations

Project setup

Includes Next.js app with claim/register flows, Solidity contracts (DroppingAirToken + SybilAirdrop), Prisma schema, deploy scripts, Playwright tests, Vercel config, and design tokens. Updates root workspace and gitignore to exclude secrets and build artifacts. Made-with: Cursor

Replace template Next.js app with sybil-airdrop application: - Add claim, register, and status pages with World ID integration - Add API routes (challenge, claim, rp-context, status) - Add Solidity contracts (DroppingAirToken, SybilAirdrop) - Add Prisma schema and Supabase database layer - Add deploy scripts for Base mainnet Adapt to existing CI pipeline: - Use pnpm with proper lockfile - Configure Tailwind v3, PostCSS, and prettier - Update eslint config (remove boundaries plugin) - Add project-specific words to cspell - Add vitest test, pin vite v6 for compatibility - Update tsconfig for ES2020 BigInt support - Fix vercel.json for root-level Next.js build Made-with: Cursor

The prisma/seed.ts imports PrismaClient which requires prisma generate to have been run. Exclude prisma/ from tsc to fix CI typecheck. Made-with: Cursor

Defer Supabase client creation to runtime to avoid build-time errors when environment variables are not available. Made-with: Cursor

The vercel.json was still pointing install/build/output to the old sybil-airdrop/ subdirectory. Now that the app is at the root, use default Next.js build behavior. Made-with: Cursor

Add sybil-airdrop mini app with World ID integration

## Vercel Web Analytics Implementation Successfully installed and configured Vercel Web Analytics for the Next.js App Router project. ### Changes Made **1. Package Installation** - Installed `@vercel/analytics@1.6.1` using pnpm - Updated `package.json` to include the new dependency - Updated `pnpm-lock.yaml` with the resolved package and its dependencies **2. Modified Files** - `app/layout.tsx` - Root layout file for the App Router **3. Code Changes** Added the Analytics component to the root layout: - Imported `Analytics` from `@vercel/analytics/next` - Added `<Analytics />` component inside the `<body>` tag, placed after the main content - Followed Next.js App Router best practices for component placement ### Implementation Details The implementation follows the standard Vercel Analytics setup for Next.js App Router projects: - The Analytics component is imported from `@vercel/analytics/next` - Placed at the root layout level to track analytics across all pages - Positioned after the main content within the body tag for optimal loading ### Verification Steps Completed ✅ **Build Verification**: Successfully built the project with no errors ✅ **Linting**: Passed ESLint checks with no issues ✅ **Testing**: All existing tests (1 test suite) passed ✅ **Type Checking**: TypeScript compilation successful ### Technical Notes - This is an App Router project (uses `app` directory structure) - The Analytics component will automatically track page views and web vitals - No additional configuration is required; the component works out of the box - Analytics data will be available in the Vercel dashboard when deployed ### Files Staged for Commit - `app/layout.tsx` - Added Analytics import and component - `package.json` - Added @vercel/analytics dependency - `pnpm-lock.yaml` - Updated with new package resolution - `.vade-report` - This report file All changes have been tested and verified to work correctly with no breaking changes to existing functionality. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>

…-nextjs-bi6lem Add Vercel Web Analytics to Next.js

Codify mandatory Playwright validation, living QA test-plan maintenance, and pass-before-commit/PR gates so future tasks follow a consistent quality workflow. Made-with: Cursor

Add QA workflow skills and living test plan

Consolidate onboarding, verification, and claiming into one terminal-like homepage, gate claims behind agent verification plus an inverted typing CAPTCHA, and remove obsolete multi-page routes while updating QA coverage. Made-with: Cursor

- Add instrumentation and observability utilities. - Update challenge API to use observability context. - Center the prompt box on the claim page. - Remove header and light mode toggle for a cleaner UI. Made-with: Cursor

Introduce structured request logging with request IDs, standardized error codes, and span wrappers across critical API flows, plus client telemetry hooks and an observability runbook so failures can be traced end-to-end quickly. Made-with: Cursor

Merge histories using allow-unrelated-histories and resolve top-level config conflicts in favor of the sybil-airdrop-feature project structure. Made-with: Cursor

Merge remote main into local main and resolve root conflicts to preserve the Dropping Air app configuration while incorporating upstream additions. Made-with: Cursor

socket-security · 2026-03-10T23:18:37Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: Authorization Bypass in Next.js Middleware CVE: GHSA-f82v-jwr5-mffw Authorization Bypass in Next.js Middleware (CRITICAL) Affected versions: >= 13.0.0 < 13.5.9; >= 14.0.0 < 14.2.25; >= 15.0.0 < 15.2.3; >= 12.0.0 < 12.3.5 Patched version: 15.2.3 From: `?` → `npm/next@15.2.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/next@15.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Next.js is vulnerable to RCE in React flight protocol CVE: GHSA-9qr9-h5gf-34mp Next.js is vulnerable to RCE in React flight protocol (CRITICAL) Affected versions: >= 14.3.0-canary.77 < 15.0.5; >= 15.1.0-canary.0 < 15.1.9; >= 15.2.0-canary.0 < 15.2.6; >= 15.3.0-canary.0 < 15.3.6; >= 15.4.0-canary.0 < 15.4.8; >= 15.5.0-canary.0 < 15.5.7; >= 16.0.0-canary.0 < 16.0.7 Patched version: 15.2.6 From: `?` → `npm/next@15.2.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/next@15.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@cspell/dict-django` under WTFPL License: WTFPL - the applicable license policy does not allow this license (4) (package/LICENSE) From: pnpm-lock.yaml → `npm/cspell@9.7.0` → `npm/@cspell/dict-django@4.1.6` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@cspell/dict-django@4.1.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@cspell/dict-en-common-misspellings` under CC-BY-SA-4.0 License: CC-BY-SA-4.0 - the applicable license policy does not allow this license (4) (npm metadata) License: CC-BY-SA-4.0 - the applicable license policy does not allow this license (4) (package/LICENSE) License: CC-BY-SA-4.0 - the applicable license policy does not allow this license (4) (package/package.json) From: pnpm-lock.yaml → `npm/cspell@9.7.0` → `npm/@cspell/dict-en-common-misspellings@2.1.12` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@cspell/dict-en-common-misspellings@2.1.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `caniuse-lite` under CC-BY-4.0 License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (npm metadata) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/LICENSE) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/package.json) From: package-lock.json → `npm/caniuse-lite@1.0.30001776` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/caniuse-lite@1.0.30001776`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `caniuse-lite` under CC-BY-4.0 License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (npm metadata) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/LICENSE) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/package.json) From: pnpm-lock.yaml → `npm/next@15.4.10` → `npm/autoprefixer@10.4.27` → `npm/caniuse-lite@1.0.30001777` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/caniuse-lite@1.0.30001777`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `dijkstrajs` License: HPND-sell-MIT-disclaimer-xserver - the applicable license policy does not allow this license (4) (package/LICENSE.md) From: pnpm-lock.yaml → `npm/@worldcoin/idkit@4.0.8` → `npm/dijkstrajs@1.0.3` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/dijkstrajs@1.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `entities` is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: pnpm-lock.yaml → `npm/jsdom@26.1.0` → `npm/entities@6.0.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/entities@6.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `next` under CC-BY-SA-4.0 License: CC-BY-SA-4.0 - the applicable license policy does not allow this license (4) (package/dist/compiled/glob/LICENSE) From: `?` → `npm/next@15.2.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/next@15.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `next` under CC-BY-SA-4.0 License: CC-BY-SA-4.0 - the applicable license policy does not allow this license (4) (package/dist/compiled/glob/LICENSE) From: package.json → `npm/next@15.4.10` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/next@15.4.10`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `playwright` under CC-BY-4.0 License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/ThirdPartyNotices.txt) From: package-lock.json → `npm/@playwright/test@1.58.2` → `npm/playwright@1.58.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/playwright@1.58.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `vite` is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: package.json → `npm/vite@6.4.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/vite@6.4.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 348449c156

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-10T23:21:58Z

app/api/claim/route.ts

+              return false
+            }
+
+            await db.from('Challenge').update({ used: true }).eq('nonce', nonce)


Guard nonce consumption with an atomic update

The nonce is marked as used with an unconditional update after a separate read, so two concurrent requests carrying the same signed payload can both observe used=false and both pass validation. In that race, both requests proceed to executeAirdrop, which can submit duplicate claim transactions and burn signer gas on reverts; consume the nonce with a single conditional write (e.g., ...eq('nonce', nonce).eq('used', false)) and verify that exactly one row was updated.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-03-10T23:21:59Z

app/api/claim/route.ts

+    const txHash = await withSpan(
+      'claim.execute_airdrop',
+      {
+        route: ctx.route,
+      },


Persist claim state before broadcasting transaction

The handler sends the on-chain claim transaction before recording the claim in the database, so if the DB insert fails after the transaction is accepted/mined, the API returns an error even though tokens were claimed. Because retries only consult the DB, the user can get stuck in repeated failures while the contract already considers the nullifier claimed; this should be made idempotent by persisting/locking claim intent before broadcasting or reconciling chain state on failure.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-03-10T23:21:59Z

app/api/agent-challenge/route.ts

+const ACTIVE_CHALLENGES = new Map<string, ChallengeRecord>()
+const CHALLENGE_TTL_MS = 5 * 60 * 1000


Store agent challenges in shared persistence

Challenge state is kept only in an in-memory Map, which breaks verification in multi-instance or serverless deployments where GET /api/agent-challenge and POST /api/agent-challenge can land on different processes (or after a cold restart). In that case valid proofs are rejected as CHALLENGE_NOT_FOUND; challenge records need durable/shared storage (DB/Redis) to make this flow reliable in production.

Useful? React with 👍 / 👎.

Exclude non-app workspaces from root typecheck and switch sybil-airdrop to deployable package dependencies so Vercel builds complete successfully. Made-with: Cursor

Track the new local dev startup and Vercel preview deployment validations in the living QA plan so recent release workflow fixes remain covered. Made-with: Cursor

mateosauton and others added 20 commits February 7, 2026 20:01

Initial commit

f093fa2

Implement initial project structure and setup

7522f16

cursor rules and mcp servers

Refine project structure by adding cursor rules and MCP server config…

24ed703

…urations

Merge pull request #1 from mateosauton/changes

0cf6d1a

Project setup

Exclude prisma/ from TypeScript compilation

6cee92c

The prisma/seed.ts imports PrismaClient which requires prisma generate to have been run. Exclude prisma/ from tsc to fix CI typecheck. Made-with: Cursor

Fix Vercel build: lazy-initialize Supabase client

2fb1c78

Defer Supabase client creation to runtime to avoid build-time errors when environment variables are not available. Made-with: Cursor

Fix Vercel build: remove stale sybil-airdrop subdirectory config

afb612d

The vercel.json was still pointing install/build/output to the old sybil-airdrop/ subdirectory. Now that the app is at the root, use default Next.js build behavior. Made-with: Cursor

Merge pull request #2 from mateosauton/sybil-airdrop-feature

2882fe4

Add sybil-airdrop mini app with World ID integration

Merge pull request #3 from mateosauton/vercel/vercel-web-analytics-to…

393bc8d

…-nextjs-bi6lem Add Vercel Web Analytics to Next.js

Add workflow skills for testing, QA planning, and PR delivery.

842b51f

Codify mandatory Playwright validation, living QA test-plan maintenance, and pass-before-commit/PR gates so future tasks follow a consistent quality workflow. Made-with: Cursor

Merge pull request #4 from mateosauton/sybil-airdrop-feature

3fba187

Add QA workflow skills and living test plan

Merge branch 'main' into sybil-airdrop-feature

b93e956

feat: add observability and update UI layout

9251e71

- Add instrumentation and observability utilities. - Update challenge API to use observability context. - Center the prompt box on the claim page. - Remove header and light mode toggle for a cleaner UI. Made-with: Cursor

merge: integrate sybil-airdrop-feature into main

16df318

Merge histories using allow-unrelated-histories and resolve top-level config conflicts in favor of the sybil-airdrop-feature project structure. Made-with: Cursor

merge: sync local main with origin/main

348449c

Merge remote main into local main and resolve root conflicts to preserve the Dropping Air app configuration while incorporating upstream additions. Made-with: Cursor

chatgpt-codex-connector bot reviewed Mar 10, 2026

View reviewed changes

mateosauton added 2 commits March 10, 2026 20:37

fix: unblock Vercel preview deployments

e9e5237

Exclude non-app workspaces from root typecheck and switch sybil-airdrop to deployable package dependencies so Vercel builds complete successfully. Made-with: Cursor

docs: record local startup and preview deployment QA checks

e63afea

Track the new local dev startup and Vercel preview deployment validations in the living QA plan so recent release workflow fixes remain covered. Made-with: Cursor

mateosauton closed this Mar 10, 2026

mateosauton deleted the merge/sync-main-observability-2026-03-10 branch March 10, 2026 23:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Merge synced main and observability rollout#4

Merge synced main and observability rollout#4
mateosauton wants to merge 22 commits intomainfrom
merge/sync-main-observability-2026-03-10

mateosauton commented Mar 10, 2026

Uh oh!

socket-security bot commented Mar 10, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Mar 10, 2026

Uh oh!

chatgpt-codex-connector bot Mar 10, 2026

Uh oh!

chatgpt-codex-connector bot Mar 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		const ACTIVE_CHALLENGES = new Map<string, ChallengeRecord>()
		const CHALLENGE_TTL_MS = 5 * 60 * 1000

Conversation

mateosauton commented Mar 10, 2026

Summary

Test plan

Uh oh!

socket-security bot commented Mar 10, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant