Commit bdec8f7
* docs(analytics): design spec for property-model foundation (#2883)
First slice of the cross-platform analytics schema-alignment epic:
global property-model cleanup (schema_version, account_id_hash, Identify
traits, drop SDK-duplicated fields, app.opened snapshot). Evolves the
existing emitMetric path in place; hard cutover, no dual-write. Event
renames deferred to follow-on slices B/C.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(analytics): add memoized account_id_hash helper
* feat(analytics): add popup/sidebar/fullpage surface detection
* refactor(analytics): reshape common context into RFC four-bucket model
* feat(analytics): supply appVersion to Amplitude init, keep autocapture off
* feat(analytics): send durable wallet traits via Amplitude Identify
Adds deriveIdentifyTraits (pure wallet_count/has_hardware_wallet/
has_imported_account) and syncIdentifyTraits (dirty-checked Amplitude
Identify call), wired into storeAccountMetricsData.
Also fixes a privacy violation found in review: storeBalanceMetricData
emitted a truncated public key in the freighterAccountFunded event body.
Replaced with account_id_hash of the full public key, matching the
schema's "never emit a raw or truncated public key" constraint.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(analytics): emit app.opened with one-time connectivity snapshot
* test(analytics): guard against raw public keys in event payloads
* test(analytics): fix jest.Mock cast to satisfy typecheck in privacy guard test
* fix(analytics): record Identify fingerprint only after send guard
syncIdentifyTraits cached the dirty-check fingerprint before the
AMPLITUDE_KEY/hasInitialized guard, so a pre-init call would poison the
cache without ever sending an Identify, causing a later identical call
to silently short-circuit and never sync the user's traits. Move the
cache write to after the guard so it's only recorded once an Identify
actually fires.
* docs(analytics): correct §6 Identify call-site list (accountServices duplicate)
Final review found accountServices.ts uses a private duplicate
storeAccountMetricsData that doesn't call syncIdentifyTraits; the
effective sync sites are useGetAppData + the recover hook. Non-functional
gap (traits self-heal via useGetAppData). Note added + dedupe follow-up.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(analytics): drop process-oriented design doc from repo
The canonical analytics schema lives in the cross-platform RFC
(stellar/wallet-eng-monorepo#10); this repo doc was a brainstorming
artifact (slice refs, PR numbers, migration-decision narrative) that
would rot as a second source of truth. Design context lives in the PR
description; cross-platform contracts go to the RFC.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(analytics): address PR review — consent-hydration timing + pre-unlock omission
- app.opened: defer emit until the data-sharing preference resolves to
allowed (it defaults false and hydrates async, so emitting at init was
suppressed and lost). Emit once, when consent becomes allowed.
- syncIdentifyTraits: gate on consent and don't cache the fingerprint
while opted out, so traits re-sync after consent hydrates.
- buildCommonContext: omit account_type/account_funded/is_hardware_account
pre-unlock (no active key), per the spec's omission rule.
- pt locale: real Portuguese for the auto-generated Auto-lock timer keys.
- Tests: 22/22; adds consent-hydration regressions for app.opened + Identify.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(analytics): derive account_funded from balances cache, not sticky flag
account_funded was read from a per-account-type sticky map
(accountFundedByType[metricsData.accountType], sourced from localStorage
freighterFunded/hwFunded/importedFunded). Funding any one account of a
given type latched that type "funded" for every subsequent event, even
events for a different, still-unfunded account of the same type.
Read it instead from the active account's cached balance
(balancesSelector from popup/ducks/cache, keyed by network then public
key), matching the cross-platform contract mobile already implements.
Omit account_funded (tri-state, same as account_id_hash) when there is
no cached entry for the active key, or when the cached isFunded is
null (unknown), rather than defaulting to false.
storeBalanceMetricData and the one-time freighterAccountFunded
milestone event are untouched — they still use metricsData for that
purpose.
* fix(analytics): resolve account_type live from Redux, not the stale metricsData cache
buildCommonContext derived account_type/is_hardware_account from the
localStorage metricsData cache, which is only refreshed by useGetAppData
(on a cache miss), makeAccountActive, and recoverAccount. Account-mutation
thunks (importAccount, importHardwareWallet, addAccount, createAccount)
switch the active account without refreshing it, so events emitted before
the next full app-data reload mislabel the active account's type — e.g. a
freshly-imported secret-key account reports account_type "freighter"
(accountScreenImportAccount + the follow-on account view event both fire
in this window).
Resolve account_type/is_hardware_account live from the Redux account list
keyed on the active public key, and omit them when the active key isn't
resolvable in allAccounts (auth-store update race) rather than guessing —
matching mobile's fail-safe behavior. account_id_hash and account_funded
are unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(analytics): cache Identify fingerprint only after a successful send
syncIdentifyTraits cached lastIdentifiedTraits before dispatching the
Identify. If amplitude.identify() ever throws, the traits were already
marked "sent", so every later call with the same traits short-circuits on
the dirty-check and never retries — the same self-poisoning failure the
pre-init/consent guards were hardened against.
Reorder so the fingerprint is cached only after a successful dispatch,
inside try/catch. On a throw, lastIdentifiedTraits stays unset so the next
sync retries. Mirrors the mobile implementation (freighter-mobile#936).
Adds a regression test asserting a one-off identify() throw does not
suppress the next sync of the same traits.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(analytics): screen.viewed consolidation (#2883) (#2907)
* feat(analytics): add screen.viewed event and emitScreenViewed helper
Introduce the canonical, consolidated screen-view event `screen.viewed`
and the machinery to emit it, ahead of cutting every screen-load event
over to it (Slice B of #2883).
- Add METRIC_NAMES.screenViewed = "screen.viewed".
- Add helpers/metrics#emitScreenViewed, which emits screen.viewed with a
screen_name plus optional flow/step and any preserved extra props
(surface and the rest of the common context come from Slice A's
buildCommonContext). Undefined flow/step are dropped from the payload.
- Add helpers/metrics#toScreenName: the deterministic canonicalization of
a legacy "loaded screen: X" string into a snake_case screen_name, and
the Flow union type.
- Register emitScreenViewed in the global helpers/metrics test mock so
component tests that render screens keep working after the cutover.
- Cover toScreenName and emitScreenViewed in metrics.test.ts.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C1GhBXnrhTgwhopiq46ceq
* feat(analytics): consolidate all screen-load events into screen.viewed
Collapse every "loaded screen: X" event into the single canonical
`screen.viewed` event (Slice B of #2883). Screen identity now lives in
the `screen_name` property (derived deterministically from the legacy
string), grouped by `flow`, with `step` on terminal completion/success
screens; `surface` comes from the Slice-A common context.
- popup/metrics/views.ts: refactor routeToEventName into a
route -> { screen_name, flow, step? } map (single source of truth) and
emit screen.viewed via emitScreenViewed, preserving the extra props on
grant-access / add-token / sign-transaction / sign-auth-entry /
sign-message. The modify-asset-list route keeps its non-screen (action)
event untouched.
- Cut the remaining screen-load emit sites over to emitScreenViewed:
Send + Swap step maps, SwapAmount set-max, DisplayBackupPhrase,
TrustlineError, and discover's trackDiscoverViewed.
- Remove now-dead "loaded screen: X" name constants from metricsNames.ts
(all unreferenced after the cutover); leave non-screen names intact.
- Add popup/metrics/views.test.ts covering the route -> screen mapping,
preserved props, completion-screen steps, and the no-legacy-name
guarantee.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C1GhBXnrhTgwhopiq46ceq
* docs(analytics): remove internal slice-name references from comments
* chore(analytics): drop unrelated files accidentally swept into this branch
Removes files that were included by an errant 'git add -A' during an
earlier commit (local .claude settings, .github parity/runbook infra,
addtoken-sac e2e tests + pr-evidence, a pr-review note) and reverts a
prettier-only reformat of the v3 manifest. Untracked here only — the
files remain on disk for the branches they belong to.
* refactor(analytics): remove unused toScreenName helper
The route->screen map holds literal screen_name values as the single
source of truth, so the toScreenName transform had no production caller
(only its own test + a stale comment). Remove it and its test; reword
the ScreenDef comment.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(analytics): correct stale legacy-string comments in screen maps
The extension already identifies screens by declared screen_name literals
(routeToScreen / per-step maps) with no 'loaded screen: X' plumbing. Fix the
comments that described screen_name as 'derived from the legacy string' — the
names are declared literals, not derived.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* analytics(screen.viewed): reconcile cross-platform drift with mobile (D2–D6, D8)
From the cross-platform drift review of RFC #2883 slice B:
- D2: type `step` as the canonical Step enum {confirm, processing, success};
tag send_payment_confirm / swap_confirm step:"confirm" to match mobile.
- D3: add flow:"assets" to the shared `account` and
`view_public_key_generator` screens (align with mobile).
- D4: canonicalize the reveal-phrase screen to `show_recovery_phrase`
(+ `unlock_recovery_phrase` for the extension-only locked-state gate).
- D5: reclassify the swap percentage/set-max button emit as an action event
(`swap: amount percentage set`) instead of an inflating screen.viewed.
- D6: skip + report to Sentry for an uncatalogued route instead of throwing
inside the navigate handler (removes a popup-crash risk).
- D8: drop the `send_payment` container screen (intentional non-emit); the
send flow's step effect owns the per-step screens, matching mobile.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test(swap): stub emitScreenViewed in Swap.selectionType test
The Swap view emits screen.viewed on mount; the real emitScreenViewed runs
buildCommonContext, which reads the Redux auth slice this test's minimal store
doesn't provide, throwing "Cannot read properties of undefined (reading
'publicKey')". The suite overrides the global metrics mock with requireActual +
emitMetric only, so the real emit ran. Stub emitScreenViewed too — this suite
covers picker-selection wiring, not screen-view analytics.
Pre-existing since the screen.viewed cutover (fails identically at the parent
commit); surfaced when CI ran on this branch.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* analytics(swap): reuse shared set-max event for cross-platform parity
The swap amount screen coined a new "swap: amount percentage set" event
that fired on every percentage tap. Mobile has no such event — it emits
the shared "send payment: set max" on the Max tap only, reused across
send and swap. The extension Send handler already matched that; only Swap
diverged.
Point the swap Max tap at METRIC_NAMES.sendPaymentSetMax (gated on 100%)
and drop the now-dead swapAmountPercentageSet constant, so all four call
sites (ext send/swap, mobile send/swap) emit one consistent event.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(analytics): rename routeToScreen -> SCREEN_BY_ROUTE
Naming consistency with the SEND_SCREEN_BY_STEP / SWAP_SCREEN_BY_STEP
step maps. No behavior change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(analytics): emit send_payment_processing for the in-flight send stage
The extension's in-flight submission is an internal state of the confirm
screen (submitStatus === PENDING → SendingTransaction), not a distinct
step/route, so it never fired a screen.viewed. Mobile emits
send_payment_processing (flow:send, step:processing) for this stage, so a
cross-platform "processing" funnel had no extension data.
Emit send_payment_processing (flow:"send", step:"processing") from a
submitStatus effect in Send/index when a submission enters PENDING, once
per submission (reset when the status clears). Swap is intentionally left
alone — mobile emits no swap-processing event, so adding one would create
new single-platform drift; deferred to the action/step follow-up.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* analytics(screen.viewed): emit send_payment_success on submission success
Mirror the existing processing effect: when the send submission settles
into ActionStatus.SUCCESS, emit send_payment_success (flow:"send",
step:"success"), guarded to fire once per submission and reset on IDLE.
Pairs with mobile (stellar/freighter-mobile#937), which emits the same
send_payment_success from its processing screen's SENT state, so the send
funnel confirm -> processing -> success is symmetric across both platforms
rather than success being single-platform drift. Adds a matching test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(analytics): domain-event consolidation (#2883) (#2909)
* feat(analytics): add screen.viewed event and emitScreenViewed helper
Introduce the canonical, consolidated screen-view event `screen.viewed`
and the machinery to emit it, ahead of cutting every screen-load event
over to it (Slice B of #2883).
- Add METRIC_NAMES.screenViewed = "screen.viewed".
- Add helpers/metrics#emitScreenViewed, which emits screen.viewed with a
screen_name plus optional flow/step and any preserved extra props
(surface and the rest of the common context come from Slice A's
buildCommonContext). Undefined flow/step are dropped from the payload.
- Add helpers/metrics#toScreenName: the deterministic canonicalization of
a legacy "loaded screen: X" string into a snake_case screen_name, and
the Flow union type.
- Register emitScreenViewed in the global helpers/metrics test mock so
component tests that render screens keep working after the cutover.
- Cover toScreenName and emitScreenViewed in metrics.test.ts.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C1GhBXnrhTgwhopiq46ceq
* feat(analytics): consolidate all screen-load events into screen.viewed
Collapse every "loaded screen: X" event into the single canonical
`screen.viewed` event (Slice B of #2883). Screen identity now lives in
the `screen_name` property (derived deterministically from the legacy
string), grouped by `flow`, with `step` on terminal completion/success
screens; `surface` comes from the Slice-A common context.
- popup/metrics/views.ts: refactor routeToEventName into a
route -> { screen_name, flow, step? } map (single source of truth) and
emit screen.viewed via emitScreenViewed, preserving the extra props on
grant-access / add-token / sign-transaction / sign-auth-entry /
sign-message. The modify-asset-list route keeps its non-screen (action)
event untouched.
- Cut the remaining screen-load emit sites over to emitScreenViewed:
Send + Swap step maps, SwapAmount set-max, DisplayBackupPhrase,
TrustlineError, and discover's trackDiscoverViewed.
- Remove now-dead "loaded screen: X" name constants from metricsNames.ts
(all unreferenced after the cutover); leave non-screen names intact.
- Add popup/metrics/views.test.ts covering the route -> screen mapping,
preserved props, completion-screen steps, and the no-legacy-name
guarantee.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C1GhBXnrhTgwhopiq46ceq
* docs(analytics): remove internal slice-name references from comments
* feat(analytics): consolidate domain event catalog to shared grammar (#2883)
Rewrite the domain (action/outcome) event names to the cross-platform
`domain.action_past` grammar: a dotted domain prefix followed by a
snake_case past-tense action. Outcomes get their own terminal events
(completed/failed/rejected/blocked/submitted) and a `result` property is
reserved for cases where the attempt itself is the analytical unit
(Blockaid scans). Several legacy names collapse into single events keyed by
a discriminator property (Blockaid scans, add-token responses, trustline
removal failures, payment type selection). Adds constants for newly
instrumented and split events and drops redundant ones.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTPk4zPZ2GVdmTrmQCCckM
* feat(analytics): map onboarding, account & recovery events (#2883)
Point account creation, recovery-phrase, password, re-auth, recovery and
import events at the new names, carrying `reason_code` on failures. Drop
the redundant recover-account-finished and vague backup-phrase
success/error events (completion screens are already covered by
screen.viewed).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTPk4zPZ2GVdmTrmQCCckM
* feat(analytics): map payment & swap outcomes, add collectible + submission events (#2883)
Direct (non-routed) payment outcomes emit payment.completed/payment.failed;
routed/path-payment outcomes settle as swap.completed/swap.failed, matching
how the send flow already routes a destination-asset send through the swap
path. Swap completion now carries from_asset_code/to_asset_code. Collectible
sends get their own collectible_send.completed/failed terminal events, and a
transaction.submitted event fires when a signed transaction is actually
broadcast to the network (distinct from the signing approval). Failure
events carry a reason_code derived from the operation/transaction result
codes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTPk4zPZ2GVdmTrmQCCckM
* feat(analytics): rework signing & dApp-access events, split rejects from failures (#2883)
Rename grant-access and signing approvals/rejections to the dapp_access.*
and signing.* names, and separate user rejection from runtime failure:
per-type reject handlers now emit signing.message_rejected and
signing.auth_entry_rejected instead of a single generic event. The
generic "user signed transaction" / "user cancelled signing flow" events
are removed as duplicates of the per-type approve/reject handlers. The
memo-required case emits signing.transaction_blocked with
reason_code=memo_required. Add-token prompt responses collapse into
asset_add.responded keyed by decision; the injected-API token events move
to the asset_add_api.* names. Redundant per-handler account_type reads are
dropped now that it rides on the shared common context.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTPk4zPZ2GVdmTrmQCCckM
* feat(analytics): consolidate asset, trustline & blockaid events (#2883)
Trustline add/remove emit asset.added/asset.removed with asset_code;
manage-asset errors emit asset.operation_failed with operation +
reason_code; the three trustline-removal blockers collapse into
trustline_remove.failed keyed by reason_code; the modify-asset-list event
becomes asset_list.modified. The five Blockaid scan events consolidate into
blockaid.scan_completed / blockaid.scan_failed, keyed by scan_target
(domain | transaction | asset) with a coarse result. The remove-token
prompt now emits asset_remove.responded (decision confirm | reject).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTPk4zPZ2GVdmTrmQCCckM
* feat(analytics): rename discovery, history, account-view & on-ramp events (#2883)
Point discovery, history-item, account rename / public-key-copy /
StellarExpert, first-funded and Coinbase on-ramp events at the new names.
Discovery events carry protocol_id; history and account-rename events carry
a source; the first-funded event moves to account.first_funded.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTPk4zPZ2GVdmTrmQCCckM
* test(analytics): update metric-name assertions for the new grammar (#2883)
Point the affected unit tests at the renamed constants and event names.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTPk4zPZ2GVdmTrmQCCckM
* chore(analytics): drop unrelated files accidentally swept into this branch
Removes files that were included by an errant 'git add -A' during an
earlier commit (local .claude settings, .github parity/runbook infra,
addtoken-sac e2e tests + pr-evidence, a pr-review note) and reverts a
prettier-only reformat of the v3 manifest. Untracked here only — the
files remain on disk for the branches they belong to.
* refactor(analytics): remove unused toScreenName helper
The route->screen map holds literal screen_name values as the single
source of truth, so the toScreenName transform had no production caller
(only its own test + a stale comment). Remove it and its test; reword
the ScreenDef comment.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(analytics): correct stale legacy-string comments in screen maps
The extension already identifies screens by declared screen_name literals
(routeToScreen / per-step maps) with no 'loaded screen: X' plumbing. Fix the
comments that described screen_name as 'derived from the legacy string' — the
names are declared literals, not derived.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(analytics): narrow Blockaid scan result by status before reading is_malicious
Slice C's blockaidScanCompleted metric read response.data.is_malicious
without narrowing the SiteScanResponse union, which only carries that field
on the status==='hit' variant (TS2339). Mirror the existing guard used
elsewhere (status === 'hit' && is_malicious).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* analytics: cross-platform property-shape parity + deferred fixes
Reconcile the extension analytics catalog with freighter-mobile against the
shared cross-platform analytics schema, plus the deferred signing / history /
dApp-access items.
- Property shapes: asset_code+asset_issuer (drop legacy code/issuer); payment.
completed asset_code; swap.* {from,to}_asset_code only; reason_code-only
failures (drop raw error); import_method on account.imported/import_failed;
recovery_method on account_recovery.completed; snake_case discover
(protocol_name/is_known_protocol).
- Blockaid result normalized to safe|warn|block|unknown; asset_bulk scan_target.
- Remove transaction.submitted (extension has no dApp sign-and-submit path;
internal broadcasts already covered by payment/swap/collectible_send.completed).
- Wire runtime signing-failure events (signing.message_failed [new] +
signing.auth_entry_failed) off the sign thunks' .rejected.
- Signing origin: thread the dApp url through useSetupSigningFlow into the metric
handlers; attach origin to dapp_access + signing events.
- Wire account.public_key_copied (ViewPublicKey) and history.full_history_opened
(AccountHeader nav).
Contract-breaking wire/payload changes (hard cutover per #2883) — notify
dashboard owners.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* analytics: address cross-platform drift review (blockaid coverage, collectible props, origin)
- Emit blockaid.scan_failed from the transaction/asset/asset_bulk thrown-error
catch blocks (previously only the response.error branch emitted), matching
mobile's full failure coverage; skip AbortError cancellations.
- asset_bulk scan_completed now carries an aggregate worst-case `result` +
`address_count` (was scan_target only).
- collectible_send.completed carries {collection_address, token_id}.
- Normalize signing / dapp_access `origin` to the bare hostname (was the raw
URL) so it matches mobile's dappDomain-based origin.
- Document that transaction.submitted is reserved / never emitted on the
extension (dApp API signs-and-returns; internal broadcasts are covered by the
payment/swap/collectible_send .completed events).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* analytics: wire one-sided events + distinct report event + source discriminator
- payment.simulation_failed now emitted from the simulation catch (was
mobile-only); carries {reason_code, network}.
- onboarding.recovery_phrase_viewed (recovery-phrase screen mount) and
onboarding.completed (mnemonic confirm) now emitted, matching mobile.
- blockaid.warning_reported: new distinct event for reportAssetWarning /
reportTransactionWarning (were mislabeled as blockaid.scan_completed).
- asset_add.responded carries source:"dapp_api" (extension emits it only for the
dApp injected-API prompt) to distinguish from mobile's manual add.
- Docs: onboarding.recovery_phrase_back_clicked not emitted (no Back affordance
on the recovery-phrase screens); account.first_funded is extension-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* analytics: emit asset.operation_failed + trustline_remove.failed on the live fail path
Both events were emitted only by the orphaned TrustlineError component (never
rendered in production), so they were effectively dead on the extension while
mobile emits them. Emit them from the live ChangeTrust submit fail branch
(SubmitTx isFail), which knows add-vs-remove directly — so `operation` is never
mislabeled (fixes the old envelope-inference "remove" default). trustline_remove
.failed maps op_low_reserve->low_reserve and op_invalid_limit->has_balance
(extension does not split buying_liabilities; mobile does — documented).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* analytics: complete trustline-failure parity; remove orphaned TrustlineError
- trustline_remove.failed now splits op_invalid_limit into buying_liabilities vs
has_balance using the asset's buying liabilities from the balance cache — full
parity with mobile (was reporting has_balance only).
- Delete the orphaned TrustlineError component (+ styles) and its two stale,
skipped ManageAssets test cases: it was never rendered in production, and its
asset.operation_failed / trustline_remove.failed emits are now live on the
ChangeTrust submit fail path (SubmitTx).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* analytics: drift-review clear fixes (scrub, domain result, asset dims, source)
- StrKey-scrub `reason_code` on the import / recovery / create-password / reauth
and runtime signing-failure paths (secret-material hardening, matching mobile;
new helpers/stellarStrKey.ts ported from mobile).
- payment.simulation_failed: drop the hand-added `network` (it rides on
buildCommonContext; hand-adding violates the catalog invariant).
- asset_remove.responded (manual manage-assets prompt) carries source:"manage_assets".
- trustline_remove.failed carries asset_code / asset_issuer.
- blockaid.scan_completed{scan_target:"domain"} uses the full safe|warn|block|unknown
mapping (was block/safe only), mirroring mobile's assessSiteSecurity.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* analytics: drift-review decisions (asset_code on responded, token_code on scan)
- asset_remove.responded (manual manage-assets prompt) carries asset_code (N3).
- blockaid.scan_completed{scan_target:"asset"} carries token_code (N5), matching
mobile; derived from the CODE-ISSUER scan address.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* analytics: round-4 drift fixes (blockaid abort guards, asset_code on asset_add.responded)
- blockaid.scan_failed: skip emit on AbortError in the domain and transaction
scan catches (matches scanAsset's guard) so cancelled scans don't report as
failures.
- asset_add.responded: thread asset_code from the add-token view through the
add/reject dispatch (analytics-only arg on the thunks; read off action.meta.arg
in the metrics handler), mirroring mobile's asset_add.responded { asset_code }.
- Includes catalog/annotation cleanup carried in this round (dapp_access.blocked
assertion, reserved-event notes, duplicate describe-block removal).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* analytics: scrub StrKeys on the remaining free-text reason_code paths
Defense-in-depth to match the scrubbing the PR already applies on the
auth/onboarding/import paths — Amplitude is a third-party sink not covered by
Sentry's beforeSend, so a G…/S… StrKey embedded in an error string must be
redacted before it leaves the client.
- payment.simulation_failed (useSimulateTxData): scrub error.message.
- asset_add_api.failed (useSetupAddTokenFlow): scrub the thunk-rejection message
and the caught error message.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* analytics: snake_case swap.trustline_added props (D5)
Align swap.trustline_added to asset_code/asset_issuer (was tokenCode/tokenIssuer),
matching the sibling asset.added and the shared snake_case property convention.
Kept in lockstep with the identical mobile rename so the wire values stay aligned.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* analytics: address PR review — scan_failed scrub, StrKey C/M, swap key parity
Review comments from #2909 (paired with the mobile #938 changes):
- blockaid.scan_failed reason_code now scrubbed at all six emit sites (four
err.message catches + two response.error branches) — the last raw error paths.
- scrubStrKeys now covers contract (C…, 56) and muxed (M…, 69) StrKeys, not just
G…/S…; widened to tolerate null. (Muxed is 69 chars, so it's an alternation.)
- swap.source_selected / destination_selected use snake_case asset_code /
asset_issuer / requires_trustline; swap.quote_expired drops the raw amounts
(privacy parity with completed/failed) and emits from_asset_code / to_asset_code
as bare codes (getAssetFromCanonical) + result_code. Removed the now-dead amount
params from useSwapQuoteExpiry. Kept in lockstep with mobile.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* analytics: scrub the two remaining scan_failed catches (scanAsset / scanAssetBulk)
Follow-up to the scan_failed scrub: the previous pass only caught the two hook
catches (useScanSite/useScanTx) because the replace matched their deeper
indentation; the scanAsset and scanAssetBulk catch blocks (shallower indent)
still passed err.message raw. These asset paths are the likeliest to carry a
C…/G… address in a thrown error, so scrub them too — all six scan_failed emit
sites now route reason_code through scrubStrKeys.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 parent ca05603 commit bdec8f7
52 files changed
Lines changed: 2529 additions & 1171 deletions
File tree
- config/jest
- extension/src
- helpers
- hooks
- popup
- components
- InternalTransaction
- SubmitFail
- SubmitTransaction/hooks
- accountHistory
- HistoryItem
- TransactionDetail
- account/AccountHeader
- manageAssets
- ManageAssetRows
- ChangeTrustInternal/SubmitTx
- ToggleTokenInternal
- TrustlineError
- mnemonicPhrase/DisplayMnemonicPhrase
- send
- SendAmount
- hooks
- SendTo
- swap/SwapAmount
- __tests__
- hooks
- constants
- __tests__
- ducks
- helpers
- __tests__
- metrics
- views
- AddAccount
- AddAccount
- ImportAccount
- AddToken
- DisplayBackupPhrase
- FullscreenSuccessMessage
- GrantAccess
- Send
- SignAuthEntry
- SignMessage
- SignTransaction
- Swap
- ViewPublicKey
- Wallets
- __tests__
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
86 | 86 | | |
87 | 87 | | |
88 | 88 | | |
| 89 | + | |
89 | 90 | | |
90 | 91 | | |
91 | 92 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
45 | 45 | | |
46 | 46 | | |
47 | 47 | | |
48 | | - | |
| 48 | + | |
49 | 49 | | |
50 | 50 | | |
51 | 51 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
| 30 | + | |
| 31 | + | |
| 32 | + | |
| 33 | + | |
| 34 | + | |
| 35 | + | |
| 36 | + | |
| 37 | + | |
| 38 | + | |
| 39 | + | |
| 40 | + | |
| 41 | + | |
| 42 | + | |
| 43 | + | |
| 44 | + | |
| 45 | + | |
| 46 | + | |
| 47 | + | |
| 48 | + | |
| 49 | + | |
| 50 | + | |
| 51 | + | |
| 52 | + | |
| 53 | + | |
| 54 | + | |
| 55 | + | |
| 56 | + | |
| 57 | + | |
| 58 | + | |
| 59 | + | |
| 60 | + | |
| 61 | + | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
| 68 | + | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
| 73 | + | |
| 74 | + | |
| 75 | + | |
| 76 | + | |
| 77 | + | |
| 78 | + | |
| 79 | + | |
| 80 | + | |
| 81 | + | |
| 82 | + | |
| 83 | + | |
| 84 | + | |
| 85 | + | |
| 86 | + | |
| 87 | + | |
| 88 | + | |
| 89 | + | |
| 90 | + | |
| 91 | + | |
| 92 | + | |
| 93 | + | |
| 94 | + | |
| 95 | + | |
| 96 | + | |
| 97 | + | |
| 98 | + | |
| 99 | + | |
| 100 | + | |
| 101 | + | |
| 102 | + | |
| 103 | + | |
| 104 | + | |
| 105 | + | |
| 106 | + | |
| 107 | + | |
| 108 | + | |
| 109 | + | |
| 110 | + | |
| 111 | + | |
| 112 | + | |
| 113 | + | |
| 114 | + | |
| 115 | + | |
| 116 | + | |
| 117 | + | |
| 118 | + | |
| 119 | + | |
| 120 | + | |
| 121 | + | |
| 122 | + | |
| 123 | + | |
| 124 | + | |
| 125 | + | |
| 126 | + | |
| 127 | + | |
| 128 | + | |
| 129 | + | |
| 130 | + | |
| 131 | + | |
| 132 | + | |
| 133 | + | |
| 134 | + | |
| 135 | + | |
| 136 | + | |
| 137 | + | |
| 138 | + | |
| 139 | + | |
| 140 | + | |
| 141 | + | |
| 142 | + | |
| 143 | + | |
| 144 | + | |
| 145 | + | |
| 146 | + | |
| 147 | + | |
| 148 | + | |
| 149 | + | |
| 150 | + | |
| 151 | + | |
| 152 | + | |
| 153 | + | |
| 154 | + | |
| 155 | + | |
| 156 | + | |
| 157 | + | |
| 158 | + | |
| 159 | + | |
| 160 | + | |
| 161 | + | |
| 162 | + | |
| 163 | + | |
| 164 | + | |
| 165 | + | |
| 166 | + | |
| 167 | + | |
| 168 | + | |
| 169 | + | |
| 170 | + | |
| 171 | + | |
| 172 | + | |
| 173 | + | |
| 174 | + | |
| 175 | + | |
| 176 | + | |
| 177 | + | |
| 178 | + | |
| 179 | + | |
| 180 | + | |
| 181 | + | |
| 182 | + | |
| 183 | + | |
| 184 | + | |
| 185 | + | |
| 186 | + | |
| 187 | + | |
| 188 | + | |
| 189 | + | |
| 190 | + | |
| 191 | + | |
| 192 | + | |
| 193 | + | |
| 194 | + | |
| 195 | + | |
| 196 | + | |
| 197 | + | |
| 198 | + | |
| 199 | + | |
| 200 | + | |
| 201 | + | |
| 202 | + | |
| 203 | + | |
| 204 | + | |
| 205 | + | |
| 206 | + | |
| 207 | + | |
0 commit comments