[Docs] - Update the README.md - #104
Conversation
📝 WalkthroughWalkthroughThe package version changes to 0.11.1. The changelog records the patch release. The README updates runtime requirements, wallet setup guidance, fixture usage, CI configuration, and ChangesRelease and documentation updates
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
README.md (1)
397-399: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winTest the documented minimum Node.js version in CI.
The requirements declare Node.js
>=22.18, but the matrix runs only Node 24. Add Node 22.18 to the matrix, or change the documented minimum to match the tested support range.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` around lines 397 - 399, Update the node-version matrix in the CI configuration to include Node.js 22.18 alongside Node 24, so CI tests the documented minimum supported version.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Around line 469-471: Update the README option description for password to
explicitly state that the wallet password is stored in plaintext in password.txt
within the wallet cache, and instruct users to protect the cache directory.
- Around line 469-471: Update the README `config` documentation to describe
`extensionSource` as a union of either `{ localPath }` or `{ downloadUrl, sha256
}`. State that `sha256` is required when `downloadUrl` is provided, while
`localPath` uses the supported wallet’s built-in checksum.
- Line 80: Update the README setup-file examples to use supported
wallet-prefixed filenames required by getSetupFunction, such as
metamask.setup.ts and metamask-two.setup.ts, including the additional examples
referenced by the comment. Replace the placeholder term “domain” with “suffix”
or “extension” in the setup-file naming guidance.
- Around line 416-417: Update the CI dependency installation step’s pnpm command
from --no-frozen-lockfile to --frozen-lockfile, ensuring builds fail when
pnpm-lock.yaml is inconsistent with package.json.
---
Nitpick comments:
In `@README.md`:
- Around line 397-399: Update the node-version matrix in the CI configuration to
include Node.js 22.18 alongside Node 24, so CI tests the documented minimum
supported version.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6c7eea03-db59-4b34-a132-0b06ac3ae241
📒 Files selected for processing (3)
CHANGELOG.mdREADME.mdpackage.json
| ### 1. Create wallet setup files | ||
|
|
||
| Create a setup directory (default: `tests/wallet-setup`) and add `*.setup.ts` files with a wallet name in the filename, for example: | ||
| Create a setup directory (default: `tests/wallet-setup`) and add files with a `*.setup.ts` domain in the filename, for example: |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Use a supported wallet name in every setup-file example.
getSetupFunction requires setup filenames to include a valid supported wallet name. base.setup.ts, base-two.setup.ts, main.setup.ts, and main-two.setup.ts do not satisfy that contract. Users who copy these examples cannot resolve a wallet setup. Rename them to wallet-prefixed names, such as metamask.setup.ts and metamask-two.setup.ts. Replace domain with suffix or extension.
Also applies to: 148-150
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` at line 80, Update the README setup-file examples to use supported
wallet-prefixed filenames required by getSetupFunction, such as
metamask.setup.ts and metamask-two.setup.ts, including the additional examples
referenced by the comment. Replace the placeholder term “domain” with “suffix”
or “extension” in the setup-file naming guidance.
| - name: Install dependencies | ||
| run: pnpm install | ||
| run: pnpm install --no-frozen-lockfile |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- repository files relevant to pnpm/CI ---'
git ls-files | grep -E '(^|/)(README\.md|package\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml|.*\.ya?ml)$' | head -200
printf '%s\n' '--- README context ---'
sed -n '390,430p' README.md
printf '%s\n' '--- pnpm references ---'
rg -n -C 3 --glob '!pnpm-lock.yaml' 'pnpm install|frozen-lockfile|no-frozen-lockfile|setup-pnpm|pnpm/action|pnpm@' .
printf '%s\n' '--- package manager declarations ---'
for f in package.json pnpm-workspace.yaml .npmrc; do
if [ -f "$f" ]; then
echo "### $f"
cat "$f"
fi
doneRepository: amaify/chainwright
Length of output: 5823
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- lockfile metadata and importer ---'
sed -n '1,90p' pnpm-lock.yaml
printf '%s\n' '--- pnpm availability and install help (read-only) ---'
if command -v pnpm >/dev/null 2>&1; then
pnpm --version
pnpm install --help | grep -E -A2 -B2 -- '--frozen-lockfile|--no-frozen-lockfile' || true
else
echo 'pnpm is not available in the sandbox'
fi
printf '%s\n' '--- package.json and lockfile dependency-spec comparison ---'
python3 - <<'PY'
import json
from pathlib import Path
package = json.loads(Path("package.json").read_text())
lock = Path("pnpm-lock.yaml").read_text().splitlines()
# This verifier checks the root importer block without importing or executing
# repository code. It compares package.json dependency declarations with the
# corresponding lockfile specifier lines.
root_start = next((i for i, line in enumerate(lock)
if line.startswith(" ") and line.strip() == "specifiers:"), None)
if root_start is None:
print("No root importer specifiers block found")
raise SystemExit(0)
root_end = root_start + 1
while root_end < len(lock) and (lock[root_end].startswith(" ") or not lock[root_end].strip()):
root_end += 1
specifiers = {}
for line in lock[root_start + 1:root_end]:
stripped = line.strip()
if ":" in stripped:
name, value = stripped.split(":", 1)
specifiers[name.strip("'\"")] = value.strip().strip("'\"")
declared = {}
for section in ("dependencies", "devDependencies", "peerDependencies", "optionalDependencies"):
declared.update(package.get(section, {}))
missing = sorted(set(declared) - set(specifiers))
different = sorted((name, declared[name], specifiers[name])
for name in declared
if name in specifiers and declared[name] != specifiers[name])
print("declared dependencies:", len(declared))
print("lockfile specifiers:", len(specifiers))
print("missing:", missing)
print("different:", different)
PYRepository: amaify/chainwright
Length of output: 3951
🌐 Web query:
pnpm install --frozen-lockfile --no-frozen-lockfile CI default lockfile out of date official documentation
💡 Result:
In pnpm, the --frozen-lockfile flag controls whether the installation should fail if the lockfile is out of sync with the manifest (package.json) [1][2]. Default Behavior and CI Environments By default, --frozen-lockfile is set to false in local development environments [1][2]. However, in Continuous Integration (CI) environments, this setting is automatically enabled (true) if a lockfile is present [1][3][2]. pnpm detects a CI environment by checking for standard environment variables such as CI, CONTINUOUS_INTEGRATION, or specific build system variables (e.g., BUILD_NUMBER) [1][2]. When --frozen-lockfile is true (or implicitly enabled in CI): - The installation will fail with an error (ERR_PNPM_OUTDATED_LOCKFILE) if the pnpm-lock.yaml file is missing or out of sync with package.json [1][2][4]. - The lockfile will not be modified or updated [1][5]. - This ensures reproducible builds, as the environment will not silently adjust dependency resolutions [5][6]. Overriding Behavior If you need to bypass this behavior in a CI environment, you can explicitly set the flag to false by appending --no-frozen-lockfile to your installation command [7][8]: pnpm install --no-frozen-lockfile This allows the installation to proceed even if the lockfile is technically out of date, as pnpm will not perform the strict consistency check that triggers the error [6][8]. Important Note on Updating It is important to understand that --frozen-lockfile=false does not mean pnpm will update your lockfile [6]. It simply means pnpm will not fail the installation if a mismatch is detected [6]. To update the lockfile, you should use commands such as pnpm update, which resolves dependencies and regenerates the lockfile based on your package.json [6]. For a dedicated CI command, you can also use pnpm ci, which is an alias for pnpm clean-install and is explicitly designed to perform a clean install with --frozen-lockfile enabled [5].
Citations:
- 1: https://pnpm.io/cli/install
- 2: https://pnpm.io/10.x/cli/install
- 3: https://pnpm.io/continuous-integration
- 4: Frozen lockfile error despite up to date lockfile pnpm/pnpm#6312
- 5: https://stackoverflow.com/questions/70154568/pnpm-equivalent-command-for-npm-ci
- 6: pnpm install --frozen-lockfile=false will not update the outdated packages pnpm/pnpm#7740
- 7: Frozen lockfile setting in CI can't be overridden via env var or updateConfig hook pnpm/pnpm#9861
- 8: Unexpected interaction between --lockfile-only with --frozen-lockfile modifies the lockfile. pnpm/pnpm#6962
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- lockfile metadata and importer ---'
sed -n '1,90p' pnpm-lock.yaml
printf '%s\n' '--- pnpm availability and install help (read-only) ---'
if command -v pnpm >/dev/null 2>&1; then
pnpm --version
pnpm install --help | grep -E -A2 -B2 -- '--frozen-lockfile|--no-frozen-lockfile' || true
else
echo 'pnpm is not available in the sandbox'
fi
printf '%s\n' '--- package.json and lockfile dependency-spec comparison ---'
python3 - <<'PY'
import json
from pathlib import Path
package = json.loads(Path("package.json").read_text())
lock = Path("pnpm-lock.yaml").read_text().splitlines()
root_start = next((i for i, line in enumerate(lock)
if line.startswith(" ") and line.strip() == "specifiers:"), None)
if root_start is None:
print("No root importer specifiers block found")
raise SystemExit(0)
root_end = root_start + 1
while root_end < len(lock) and (lock[root_end].startswith(" ") or not lock[root_end].strip()):
root_end += 1
specifiers = {}
for line in lock[root_start + 1:root_end]:
stripped = line.strip()
if ":" in stripped:
name, value = stripped.split(":", 1)
specifiers[name.strip("'\"")] = value.strip().strip("'\"")
declared = {}
for section in ("dependencies", "devDependencies", "peerDependencies", "optionalDependencies"):
declared.update(package.get(section, {}))
missing = sorted(set(declared) - set(specifiers))
different = sorted((name, declared[name], specifiers[name])
for name in declared
if name in specifiers and declared[name] != specifiers[name])
print("declared dependencies:", len(declared))
print("lockfile specifiers:", len(specifiers))
print("missing:", missing)
print("different:", different)
PYRepository: amaify/chainwright
Length of output: 3951
Keep CI dependency installation frozen.
Use pnpm install --frozen-lockfile so CI fails when pnpm-lock.yaml is out of sync with package.json.
Proposed fix
- run: pnpm install --no-frozen-lockfile
+ run: pnpm install --frozen-lockfile📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Install dependencies | |
| run: pnpm install | |
| run: pnpm install --no-frozen-lockfile | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` around lines 416 - 417, Update the CI dependency installation
step’s pnpm command from --no-frozen-lockfile to --frozen-lockfile, ensuring
builds fail when pnpm-lock.yaml is inconsistent with package.json.
| - `password: string` - wallet unlock password saved as a `.txt` file in the wallet cache | ||
| - `setupFn: ({ context, walletPage }) => Promise<void>` - runs onboarding/setup flow | ||
| - `config?: { profileName?: string; slowMo?: number, extensionSource?: {downloadUrl: "...", localPath: "...", sha256: "..."} }` - useful for setting up multiple wallet profiles, running the setup in slow motion `slowMo` and using a custom extension source. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
State that the wallet password is stored in plaintext.
src/core/trigger-cache-creation.ts writes walletPassword directly to password.txt. Document that the cache contains plaintext credentials and instruct users to protect the cache directory.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` around lines 469 - 471, Update the README option description for
password to explicitly state that the wallet password is stored in plaintext in
password.txt within the wallet cache, and instruct users to protect the cache
directory.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- configuration symbols and extensionSource references ---'
rg -n -S -C 4 'extensionSource|ExtensionSource|config\??:' --glob '!node_modules' --glob '!dist' --glob '!build' .
printf '%s\n' '--- candidate TypeScript file map ---'
fd -t f -e ts -e tsx -e js -e d.ts . | head -200
printf '%s\n' '--- README context ---'
sed -n '430,490p' README.mdRepository: amaify/chainwright
Length of output: 19734
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- exported type definition ---'
cat -n src/types.ts | sed -n '24,50p'
printf '%s\n' '--- extension-source runtime handling ---'
cat -n src/utils/prepare-wallet-extension.ts | sed -n '21,75p'
printf '%s\n' '--- integrity helper and call sites ---'
cat -n src/utils/verify-file-integrity.ts
rg -n -S -C 3 'verifyFileIntegrity|expectedSha256|sha256' src examples README.mdRepository: amaify/chainwright
Length of output: 19581
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
types = Path("src/types.ts").read_text()
runtime = Path("src/utils/prepare-wallet-extension.ts").read_text()
readme = Path("README.md").read_text()
assert re.search(
r"export type ExtensionSource\s*=\s*\|\s*\{\s*localPath:\s*string;\s*\}\s*\|\s*\{\s*downloadUrl:\s*string;\s*sha256:\s*string;\s*\};",
types,
re.S,
), "ExtensionSource is not the expected union"
assert '"downloadUrl" in extensionSource' in runtime
assert '"localPath" in extensionSource' in runtime
assert "expectedSha256 = isExtensionSource ? extensionSource.sha256 : supportedWallet.sha256" in runtime
documented = re.search(r"extensionSource\?:\s*\{([^}]*)\}", readme)
assert documented, "README extensionSource shape not found"
fields = set(re.findall(r"\b(downloadUrl|localPath|sha256)\b", documented.group(1)))
expected_download = {"downloadUrl", "sha256"}
expected_local = {"localPath"}
print("Exported union branches: localPath; downloadUrl + sha256")
print("README fields in one object:", sorted(fields))
print("README matches union:", fields in (expected_download, expected_local))
print("Runtime localPath branch: uses localPath and falls back to the supported wallet SHA-256")
print("Runtime downloadUrl branch: uses downloadUrl and extensionSource.sha256")
PYRepository: amaify/chainwright
Length of output: 469
Document extensionSource as a union.
The type accepts either { localPath } or { downloadUrl, sha256 }. State that sha256 is required with downloadUrl; localPath uses the supported wallet's built-in checksum.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` around lines 469 - 471, Update the README `config` documentation
to describe `extensionSource` as a union of either `{ localPath }` or `{
downloadUrl, sha256 }`. State that `sha256` is required when `downloadUrl` is
provided, while `localPath` uses the supported wallet’s built-in checksum.
1 participant
Summary by CodeRabbit
Documentation
defineWalletSetupconfiguration guidance.Release