docs: scope base-mcp plugin chains; pin smart-account signature pass-through - #10
Conversation
Base MCP can't route send_calls to Robinhood Chain (4663), and the base/skills spec limits a plugin's chains to Base MCP's supported set. Drop robinhood from the frontmatter, mark it out of scope in ## Notes (launch-link/UI fallback), and note the exclusion in the Overview and the Submission chain mapping. Mirrors the copy pushed to base/skills PR #116.
The backend verifies metadata signatures as EOA via verifyTypedData, then falls back to EIP-1271 isValidSignature for smart accounts, whose signatures are variable-length (>200 bytes for Base Accounts) rather than 65-byte ECDSA. The SDK must forward them unmodified: assert a 300-byte signature reaches the API byte-identical, state the contract in postSignedMetadata's doc comment, and note it in the SKILL.md flag validation table.
PR SummaryLow Risk Overview Launch metadata signing is documented for smart accounts: Reviewed by Cursor Bugbot for commit aac7694. Configure here. |
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThe PR documents variable-length metadata signatures, adds forwarding coverage for a 300-byte smart-account signature, removes Robinhood from Base MCP routing documentation, and updates SDK and CLI references from version 1.0.0 to 1.0.1. ChangesSDK release, metadata, and chain routing
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aac76941b6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The plugin doc and SKILL.md ship inside the npm package (package.json `files` includes skills/), and npm versions are immutable — without a bump the corrected chain scoping and signature guidance can never reach consumers of 1.0.0. Patch bump: docs only, no new chain or action. Bumps package.json, the CLI --version, the SKILL.md version line, the plugin doc version frontmatter, and the pinned npx examples in README, SKILL.md, and the plugin doc.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2bef78ba56
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Regenerated with npm install --package-lock-only; the diff is limited to the two root version fields. Left unsynced, a plain npm install would rewrite the tracked lockfile and release tooling reading lockfile metadata would report the previous version.
1 participant
What
Two follow-ups from updating base/skills PR #116 for the BWLK redeployment, plus the version bump they require.
1. Base MCP chain scoping in the plugin doc (
skills/boardwalk/plugins/boardwalk.md)Base MCP's
send_callssupportsarbitrum, avalanche, base, base-sepolia, bsc, ethereum, optimism, polygon— not Robinhood Chain (4663) — and the base/skills spec limits a plugin'schainsto that set. The plugin frontmatter now declareschains: [ethereum, base, arbitrum], with Robinhood marked out of Base MCP scope in## Notes(launch-link/UI fallback), matching the treatment the previous revision gave Fraxtal/Katana/Ink. The CLI itself still supports all four chains — nothing changes outside the plugin doc.2. Smart-account (ERC-1271) signature pass-through, pinned
Base MCP's default wallet is a smart account whose
signreturns variable-length ERC-1271 signatures (>200 bytes), not 65-byte ECDSA. Verified end-to-end: the CLI's--signaturevalidation is length-agnostic,postSignedMetadataforwards the signature unmodified, and the backend (morphex-backendverifyMetadataSignature) verifies EOA viaverifyTypedDatathen falls back to EIP-1271isValidSignatureagainst the issuer contract. Newtest/metadata.test.tsasserts a 300-byte signature reaches the API byte-identical; the contract is stated inpostSignedMetadata's doc comment and the SKILL.md flag table.Two residual items live in the backend, not here: the EIP-1271 path needs an RPC provider configured per chain, and ERC-6492 (undeployed signers) is unhandled — unreachable in this flow, since the metadata signer is the launch issuer, whose account was deployed when
create-launchmined.3. Version bump to 1.0.1
An earlier revision of this PR skipped the bump on the grounds that no runtime behavior changed. That was wrong, per review:
skills/ships inside the npm package (package.jsonfiles), and npm versions are immutable — so without a bump the corrected chain scoping and signature guidance could never reach anyone installing 1.0.0. Patch rather than minor: docs only, no new chain or action. All eight references bumped in lockstep per AGENTS.md (package.json,src/cli.ts.version(), the SKILL.md version line, the plugin docversionfrontmatter, and the pinned npx examples in README/SKILL.md/plugin doc).Follow-up after merge
npm publish1.0.1, then re-pin base/skills PR #116 to@useboardwalk/sdk@1.0.1. That PR intentionally stays at 1.0.0 until then — pinning a documented npx command to an unpublished version would fail to resolve. Apart from those pins the two copies of the plugin doc are identical.Verification
npm run typecheckclean,npm test83/83,npm run buildclean,node dist/cli.js --version→1.0.1. Smoke not run — no runtime code touched.Summary by CodeRabbit
Bug Fixes
Documentation
Chores