Harden token resolution, clear lint, and gate CI on typecheck, lint and build

.github/workflows/test.yml

@@ -1,28 +1,82 @@
-name: Tests
+name: CI
 
 on:
   push:
-    branches: ["**"]
+    branches: [main]
   pull_request:
-    branches: ["**"]
+
+# A newer push to the same branch makes the older run pointless.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
 
 jobs:
   test:
-    name: Run test suite
+    name: Contract and unit tests
     runs-on: ubuntu-latest
-
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: "22"
-          cache: "npm"
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            frontend/package-lock.json
+            openclaw-service/package-lock.json
 
+      # The root suite imports frontend and service sources, which resolve their
+      # dependencies from their own node_modules.
       - name: Install dependencies
-        run: npm ci
+        run: |
+          npm ci
+          npm ci --prefix frontend
+          npm ci --prefix openclaw-service
 
       - name: Run tests
         run: npm test
+
+  frontend:
+    name: Frontend typecheck, lint and build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: frontend
+    env:
+      NEXT_PUBLIC_NETWORK: mainnet
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - run: npm ci
+      - run: npx tsc --noEmit
+      - run: npm run lint
+      # Webpack, not Turbopack: Turbopack breaks @stacks/connect in production.
+      - run: npm run build
+
+  openclaw-service:
+    name: OpenClaw service typecheck
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: openclaw-service
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: openclaw-service/package-lock.json
+
+      - run: npm ci
+      - run: npx tsc --noEmit

frontend/src/app/dashboard/create/page.tsx

@@ -16,6 +16,7 @@ import {
   EXPLORER_BASE,
   BLOCKS_PER_HOUR,
   toRawAmount,
+  hasExcessPrecision,
   fromRawAmount,
   type DurationUnit,
 } from "@/lib/constants";
@@ -91,6 +92,9 @@ export default function CreateStreamPage() {
     else if (amountRaw === null) {
       errs.amount = "Enter a valid amount (digits and up to one decimal point)";
     }
+    else if (hasExcessPrecision(amount, selectedToken.decimals)) {
+      errs.amount = `${selectedToken.symbol} has ${selectedToken.decimals} decimal places. Remove the extra digits.`;
+    }
     // Pre-flight balance check. The on-chain ft-transfer? inside create-stream
     // returns (err u1) if the wallet is short — catch it here so users don't
     // burn gas on a doomed tx.

frontend/src/app/dashboard/page.tsx

@@ -1,7 +1,6 @@
 "use client";
 
 import { StatCard } from "@/components/ui/stat-card";
-import { Card, CardTitle } from "@/components/ui/card";
 import { Button } from "@/components/ui/button";
 import { EmptyState } from "@/components/ui/empty-state";
 import { StreamCard } from "@/components/stream/stream-card";

frontend/src/app/earn/page.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { StatCard } from "@/components/ui/stat-card";
-import { Card, CardTitle } from "@/components/ui/card";
+import { Card } from "@/components/ui/card";
 import { EmptyState } from "@/components/ui/empty-state";
 import { Skeleton } from "@/components/ui/skeleton";
 import { RealtimeBalance } from "@/components/stream/realtime-balance";

frontend/src/components/openclaw/assistant-widget.tsx

@@ -5,17 +5,55 @@ import { Button } from "@/components/ui/button";
 import { cn } from "@/lib/utils";
 import { OPENCLAW_API_URL, unresolvableTokenLabel } from "@/lib/constants";
 import { formatTokenAmount, getStreamStatusLabel, getStreamStatusColor } from "@/lib/utils";
-import { MessageCircle, X, Search, Loader2, Zap, Hash, User, Building2 } from "lucide-react";
+import { MessageCircle, X, Search, Zap, Hash, User, Building2 } from "lucide-react";
 
 type QueryType = "stream" | "sender" | "recipient" | "dao" | "block";
 
 interface ResultEntry {
   type: QueryType;
   query: string;
-  data: any;
+  /** Raw JSON from the API, narrowed to a response type where it is rendered. */
+  data: unknown;
   error?: string;
 }
 
+// Response shapes from the public read API. Every field is optional because
+// the widget renders whatever came back and must not crash on a missing one.
+
+interface StreamResponse {
+  streamId?: number;
+  id?: number;
+  status?: number | { code?: number; label?: string };
+  sender?: string;
+  recipient?: string;
+  token?: string;
+  depositFormatted?: string | null;
+  depositAmount?: string;
+  "deposit-amount"?: string;
+  claimableFormatted?: string | null;
+  claimable?: string;
+  tokenDecimals?: number | null;
+  tokenLabel?: string | null;
+  progress?: number;
+}
+
+type StreamListResponse = { streamIds?: number[] } | number[];
+
+interface DaoResponse {
+  name?: string;
+  admin?: string;
+  isActive?: boolean;
+  "is-active"?: boolean;
+  totalStreamsCreated?: number;
+  "total-streams-created"?: number;
+  totalDepositedFormatted?: string | null;
+}
+
+interface BlockResponse {
+  blockHeight?: number;
+  block_height?: number;
+}
+
 async function fetchApi(path: string) {
   const res = await fetch(`${OPENCLAW_API_URL}${path}`);
   if (!res.ok) {
@@ -50,13 +88,15 @@ function formatApiAmount(
   return "—";
 }
 
-function StreamResult({ data }: { data: any }) {
+function StreamResult({ data }: { data: StreamResponse }) {
+  const statusCode = typeof data.status === "object" ? data.status.code : data.status;
+  const statusLabel = typeof data.status === "object" ? data.status.label : undefined;
   return (
     <div className="space-y-2 text-xs">
       <div className="flex items-center justify-between">
         <span className="font-medium text-zinc-200">Stream #{data.streamId ?? data.id}</span>
-        <span className={cn("font-medium", getStreamStatusColor(data.status?.code ?? data.status))}>
-          {data.status?.label ?? getStreamStatusLabel(data.status)}
+        <span className={cn("font-medium", getStreamStatusColor(statusCode ?? -1))}>
+          {statusLabel ?? getStreamStatusLabel(statusCode ?? -1)}
         </span>
       </div>
       <div className="grid grid-cols-2 gap-x-3 gap-y-1 text-zinc-400">
@@ -85,8 +125,8 @@ function StreamResult({ data }: { data: any }) {
   );
 }
 
-function StreamListResult({ data, label }: { data: any; label: string }) {
-  const ids = data.streamIds ?? data;
+function StreamListResult({ data, label }: { data: StreamListResponse; label: string }) {
+  const ids = Array.isArray(data) ? data : data.streamIds;
   return (
     <div className="space-y-1 text-xs">
       <p className="text-zinc-400">{label}</p>
@@ -105,7 +145,7 @@ function StreamListResult({ data, label }: { data: any; label: string }) {
   );
 }
 
-function DaoResult({ data }: { data: any }) {
+function DaoResult({ data }: { data: DaoResponse }) {
   return (
     <div className="space-y-2 text-xs">
       <div className="flex items-center justify-between">
@@ -133,7 +173,7 @@ function DaoResult({ data }: { data: any }) {
   );
 }
 
-function BlockResult({ data }: { data: any }) {
+function BlockResult({ data }: { data: BlockResponse }) {
   return (
     <div className="text-xs space-y-1">
       <p className="text-zinc-400">Current block height</p>
@@ -192,7 +232,7 @@ export function AssistantWidget() {
 
     setLoading(true);
     try {
-      let data: any;
+      let data: unknown;
       switch (queryType) {
         case "stream":
           data = await fetchApi(`/api/streams/${safe}`);
@@ -211,10 +251,10 @@ export function AssistantWidget() {
           break;
       }
       setResults((prev) => [...prev, { type: queryType, query: q, data }]);
-    } catch (err: any) {
+    } catch (err: unknown) {
       setResults((prev) => [
         ...prev,
-        { type: queryType, query: q, data: null, error: err.message },
+        { type: queryType, query: q, data: null, error: err instanceof Error ? err.message : String(err) },
       ]);
     } finally {
       setLoading(false);
@@ -308,16 +348,16 @@ export function AssistantWidget() {
                 {result.error ? (
                   <p className="text-xs text-red-400">{result.error}</p>
                 ) : result.type === "stream" ? (
-                  <StreamResult data={result.data} />
+                  <StreamResult data={result.data as StreamResponse} />
                 ) : result.type === "sender" || result.type === "recipient" ? (
                   <StreamListResult
-                    data={result.data}
+                    data={result.data as StreamListResponse}
                     label={`${result.type === "sender" ? "Sent" : "Received"} streams`}
                   />
                 ) : result.type === "dao" ? (
-                  <DaoResult data={result.data} />
+                  <DaoResult data={result.data as DaoResponse} />
                 ) : (
-                  <BlockResult data={result.data} />
+                  <BlockResult data={result.data as BlockResponse} />
                 )}
               </div>
             ))}

frontend/src/components/stream/claim-dialog.tsx

@@ -8,7 +8,7 @@ import { useStacksTx } from "@/hooks/use-stacks-tx";
 import { useTokenMetadata } from "@/hooks/use-token-metadata";
 import { buildClaimTx, type StreamData } from "@/lib/stacks";
 import { formatTokenAmount, formatTxError } from "@/lib/utils";
-import { toRawAmount, fromRawAmount, unresolvableTokenLabel } from "@/lib/constants";
+import { toRawAmount, fromRawAmount, hasExcessPrecision, unresolvableTokenLabel } from "@/lib/constants";
 import { toast } from "sonner";
 import { Download, AlertTriangle } from "lucide-react";
 
@@ -56,6 +56,10 @@ export function ClaimDialog({
       setError("Enter a valid amount (digits and up to one decimal point)");
       return false;
     }
+    if (hasExcessPrecision(amount, token.decimals)) {
+      setError(`${token.symbol} has ${token.decimals} decimal places. Remove the extra digits.`);
+      return false;
+    }
     if (amountRaw > claimable) {
       setError(`Max claimable is ${formatTokenAmount(claimable, token.decimals)} ${token.symbol}`);
       return false;

frontend/src/components/stream/token-selector.tsx

@@ -38,6 +38,8 @@ import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { useCuratedTokens, useTokenSearch } from "@/hooks/use-token-search";
 import { resolveTokenMetadata } from "@/lib/token-metadata-client";
+import { contractIdNetwork } from "@/lib/token-metadata";
+import { NETWORK, NETWORK_LABEL } from "@/lib/constants";
 import {
   MAX_RESULTS,
   classifyAll,
@@ -274,12 +276,7 @@ export function TokenSelector({ value, onChange, disabled }: TokenSelectorProps)
   const verify = async (candidate: DiscoveredToken): Promise<boolean> => {
     setVerifying(true);
     try {
-      const result = await verifySelection(
-        candidate,
-        curatedIds,
-        curatedSymbols,
-        resolveTokenMetadata,
-      );
+      const result = await verifySelection(candidate, resolveTokenMetadata);
 
       if (result.status === "verified" && result.resolved) {
         onChange(toSelection(result.resolved, candidate));
@@ -349,6 +346,14 @@ export function TokenSelector({ value, onChange, disabled }: TokenSelectorProps)
    */
   const selectByContractId = async (contractId: ContractId) => {
     setManualError(null);
+    // Checked before any chain read: the node would answer a wrong-network id
+    // with a bare "not found", which reads as if the token does not exist.
+    if (contractIdNetwork(contractId) !== NETWORK) {
+      setManualError(
+        `That contract is not on ${NETWORK_LABEL}. Check you copied the ${NETWORK_LABEL.toLowerCase()} contract id.`,
+      );
+      return;
+    }
     setVerifying(true);
     try {
       // The chain is the authority here, and it is the only source: the
@@ -405,7 +410,7 @@ export function TokenSelector({ value, onChange, disabled }: TokenSelectorProps)
     const parsed = parseTokenDeepLink(manual);
     if (!isValidContractId(parsed)) {
       setManualError(
-        "That is not a valid contract id. It should look like SP….contract-name.",
+        `That is not a valid contract id. It should look like ${NETWORK === "mainnet" ? "SP" : "ST"}….contract-name.`,
       );
       return;
     }
@@ -589,7 +594,7 @@ export function TokenSelector({ value, onChange, disabled }: TokenSelectorProps)
                 setManual(e.target.value);
                 setManualError(null);
               }}
-              placeholder="SP….contract-name"
+              placeholder={`${NETWORK === "mainnet" ? "SP" : "ST"}….contract-name`}
               disabled={disabled || verifying}
               autoComplete="off"
               spellCheck={false}

frontend/src/components/stream/top-up-dialog.tsx

@@ -10,7 +10,7 @@ import { useTokenMetadata } from "@/hooks/use-token-metadata";
 import { buildTopUpStreamTx, type StreamData } from "@/lib/stacks";
 import { useWalletStore } from "@/stores/wallet-store";
 import { formatTokenAmount, formatTxError } from "@/lib/utils";
-import { toRawAmount, fromRawAmount, unresolvableTokenLabel } from "@/lib/constants";
+import { toRawAmount, fromRawAmount, hasExcessPrecision, unresolvableTokenLabel } from "@/lib/constants";
 import { toast } from "sonner";
 import { ArrowUpCircle, AlertTriangle } from "lucide-react";
 
@@ -61,6 +61,10 @@ export function TopUpDialog({
       setError("Enter a valid amount (digits and up to one decimal point)");
       return false;
     }
+    if (hasExcessPrecision(amount, token.decimals)) {
+      setError(`${token.symbol} has ${token.decimals} decimal places. Remove the extra digits.`);
+      return false;
+    }
     if (amountRaw > balance) {
       setError(
         `Insufficient ${token.symbol} balance. You have ${formatTokenAmount(balance, token.decimals)} ${token.symbol}.`