Skip to content

Conversation

@EehMauro
Copy link
Contributor

@EehMauro EehMauro commented Oct 20, 2025

Summary by CodeRabbit

  • Chores

    • Added Windows platform target and enabled PowerShell installer option.
  • Documentation

    • Expanded README and docs with a new Examples section and a Windows installation tab; clarified provider guidance and formatting.
  • New Features

    • Added user-facing example workflows and companion scripts demonstrating batch transfers, scheduled (cron) transfers, and a complex multi-step "create ship" transaction, including usage, arguments, and concrete examples.

@EehMauro EehMauro requested a review from scarmuega as a code owner October 20, 2025 12:44
@coderabbitai
Copy link

coderabbitai bot commented Oct 20, 2025

Walkthrough

Added PowerShell installer and Windows target to distribution config; introduced three example workflows (batch transfers, scheduled transfers, complex Asteria transaction) with tx3 definitions and shell orchestration scripts; updated README and docs with Examples and Windows installation content.

Changes

Cohort / File(s) Change Summary
Distribution Configuration
\dist-workspace.toml``
Added "powershell" to installers and appended "x86_64-pc-windows-msvc" to targets.
Documentation / README
\README.md`, `docs/index.mdx`, `docs/examples.mdx``
Minor README formatting edits and added a new Examples section (Batch transactions, Scheduled tasks, Complex transaction). Added a Windows installation tab with a PowerShell install command.
Batch transactions example
examples/batch-transactions/
\examples/batch-transactions/transfer.sh`, `examples/batch-transactions/transfer.tx3``
Added transfer.sh (bash) to perform multiple lovelace transfers from one sender to many receivers (arg validation, wallet lookup, per-recipient cshell invoke) and transfer.tx3 transaction definition for the transfer.
Scheduled tasks example
examples/scheduled-tasks/
\examples/scheduled-tasks/transfer.sh`, `examples/scheduled-tasks/transfer.tx3``
Added transfer.sh to schedule transfers via cron (arg/cron validation, wallet lookup, compose cshell invoke, append to crontab) and transfer.tx3 tx definition used by the scheduled job.
Complex transaction example (Asteria)
examples/complex-transaction/
\examples/complex-transaction/asteria.tx3`, `examples/complex-transaction/create-ship.sh``
Added asteria.tx3 defining policies, assets, datums, redeemers, and tx create_ship(...) (inputs, mints, outputs, datums, references, collateral, validity). Added create-ship.sh orchestration script (arg validation, GraphQL queries, JSON payload construction, cshell tx invoke).
Docs metadata
\docs/commands/_meta.yml``
Updated ordering metadata (order changed from 5 to 6).

Sequence Diagram(s)

sequenceDiagram
    autonumber
    participant User
    participant Script as create-ship.sh
    participant GraphQL as GraphQL API
    participant CShell as cshell
    participant Chain as Cardano Node

    User->>Script: run create-ship.sh (player_wallet,pos_x,pos_y)
    Script->>GraphQL: query next token ID
    GraphQL-->>Script: token info
    Script->>GraphQL: query tip/slot
    GraphQL-->>Script: tip_slot
    Script->>Script: build JSON payload (player, names, tip_slot,...)
    Script->>CShell: cshell tx invoke --tx-file asteria.tx3 --args <payload>
    CShell->>Chain: submit transaction (minting, inputs, outputs)
    Chain-->>CShell: tx accepted / error
    CShell-->>Script: result
    Script-->>User: display success / failure
Loading
sequenceDiagram
    autonumber
    participant User
    participant Script as transfer.sh
    participant CShell as cshell
    participant Chain as Cardano Node

    User->>Script: run transfer.sh (sender, receivers, amount)
    Script->>Script: validate args & wallet lookups
    loop per receiver
        Script->>CShell: cshell tx invoke --tx-file transfer.tx3 --args {from,to,amount}
        CShell->>Chain: submit transfer tx
        Chain-->>CShell: tx accepted / error
        CShell-->>Script: result for receiver
    end
    Script-->>User: summary of transfers
Loading
sequenceDiagram
    autonumber
    participant User
    participant Script as scheduled-transfer.sh
    participant Crontab as system crontab
    participant CShell as cshell

    User->>Script: run scheduled-transfer.sh (sender,receiver,amount,cron)
    Script->>Script: validate args & cron format
    Script->>CShell: verify wallets & build invoke command
    Script->>Crontab: append scheduled cshell invoke line
    Crontab-->>User: cron job registered
    Note right of Crontab: At scheduled times,\ncshell runs the transfer command
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Suggested reviewers

  • scarmuega

Poem

🐰 I hop through scripts and minting light,

I batch the coins and set the night.
Cron hums softly, slots align—
Tokens bloom and ships will shine.
Hooray — this rabbit's code is fine! 🥕

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check ✅ Passed The PR title "feat: add examples" directly and accurately reflects the primary change in the changeset, which is the addition of three comprehensive example workflows: batch transactions, scheduled tasks, and complex transaction scenarios. Each example includes corresponding bash scripts, transaction definitions, and documentation. The title is concise, specific enough to convey the main purpose, and a teammate reviewing the PR history would immediately understand that this PR introduces new examples. While the changeset includes secondary modifications (Windows PowerShell support, README formatting, documentation updates), these are supporting changes aligned with the primary objective of adding examples.
Docstring Coverage ✅ Passed No functions found in the changes. Docstring coverage check skipped.
✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 1d28848 and 0ecfa29.

📒 Files selected for processing (1)
  • docs/commands/_meta.yml (1 hunks)
✅ Files skipped from review due to trivial changes (1)
  • docs/commands/_meta.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: integration

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (1)
dist-workspace.toml (1)

33-38: Add GitHub Actions runner configuration for Windows target.

The [dist.github-custom-runners] section defines runners for other targets but does not include an entry for the newly added x86_64-pc-windows-msvc. Consider adding a Windows runner (e.g., x86_64-pc-windows-msvc = "windows-2022").

Apply this addition to define a runner for the Windows target:

 [dist.github-custom-runners]
 global = "ubuntu-22.04"
 x86_64-unknown-linux-gnu = "ubuntu-22.04"
 aarch64-apple-darwin = "macos-14"
 x86_64-apple-darwin = "macos-13"
 aarch64-unknown-linux-gnu = "ubuntu-22.04-arm"
+x86_64-pc-windows-msvc = "windows-2022"
📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 2837f50 and 106bf98.

📒 Files selected for processing (1)
  • dist-workspace.toml (1 hunks)
🔇 Additional comments (2)
dist-workspace.toml (2)

15-15: Confirm Windows archive format aligns with platform expectations.

The addition of x86_64-pc-windows-msvc target combined with line 25's windows-archive = ".tar.gz" may cause usability issues. Typically, Windows distributions use .zip format. Confirm whether .tar.gz is intentional for Windows builds or if this should be .zip.

Given that line 25 specifies .tar.gz for Windows archives, verify that:

  1. This format is supported for the Windows target
  2. End-users can easily extract .tar.gz on Windows without additional tools
  3. This aligns with your distribution strategy

11-11: PowerShell is a supported installer option in cargo-dist. The addition of "powershell" to the installers list in line 11 is correct and requires no changes.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Nitpick comments (5)
examples/batch-transactions/transfer.tx3 (1)

5-21: LGTM; consider enforcing positive quantity at the DSL level.

Add a guard or use a non-negative type for quantity to reject zero/negative transfers even if scripts bypass shell validation.

If tx3 supports it, either:

  • Change quantity: Int to a non-negative numeric type, or
  • Add a predicate like require quantity > 0.
examples/scheduled-tasks/transfer.tx3 (1)

5-21: Duplication with batch-transactions transfer.

This file is identical to examples/batch-transactions/transfer.tx3. Consider a single canonical copy (or symlink) to avoid drift.

README.md (2)

104-105: Tighten Demeter guidance wording.

Minor style: “set the URL to … and put … in the headers.”

Apply this diff:

-> If you have a [Demeter](https://demeter.run) port you would have to set the URL as `https://{host}` and on put `dmtr-api-key:YOUR_API_KEY` on the headers.
+> If you use a [Demeter](https://demeter.run) port, set the URL to `https://{host}` and put `dmtr-api-key:YOUR_API_KEY` in the headers.

106-179: Examples section is clear; a couple of tiny nits.

  • “in order to” → “to” (Line 180).
  • Consider noting that scripts assume testnet addresses and that --unsafe is for examples only.
examples/complex-transaction/asteria.tx3 (1)

45-61: Solid structure; consider a few invariants and dedupes.

  • Validity: tip_slot is passed in; if tip_slot() will be available soon, document/remove param when ready.
  • Locals duplicate policy hash/refs already declared in policy blocks; if tx3 lets you reference them directly, prefer that to avoid drift.
  • Consider asserting initial_fuel > 0 and ship_mint_lovelace_fee > 0 via guards.
  • Nice touch accounting for min_utxo(*); keep this aligned with ledger changes.

Also applies to: 62-65, 78-131

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 106bf98 and ecbff7d.

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock
📒 Files selected for processing (7)
  • README.md (1 hunks)
  • examples/batch-transactions/transfer.sh (1 hunks)
  • examples/batch-transactions/transfer.tx3 (1 hunks)
  • examples/complex-transaction/asteria.tx3 (1 hunks)
  • examples/complex-transaction/create-ship.sh (1 hunks)
  • examples/scheduled-tasks/transfer.sh (1 hunks)
  • examples/scheduled-tasks/transfer.tx3 (1 hunks)
🧰 Additional context used
🪛 LanguageTool
README.md

[style] ~180-~180: Consider a more concise word here.
Context: ...ovider with the Cardano preview testnet in order to submit this transaction

(IN_ORDER_TO_PREMIUM)

🪛 Shellcheck (0.11.0)
examples/complex-transaction/create-ship.sh

[warning] 57-57: Quote this to prevent word splitting.

(SC2046)


[warning] 59-59: Quote this to prevent word splitting.

(SC2046)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
  • GitHub Check: unit
  • GitHub Check: integration
🔇 Additional comments (1)
examples/batch-transactions/transfer.sh (1)

1-61: Review addresses valid hardening concerns but contains incompatible address-parsing pattern.

The review's suggestions for set -euo pipefail, proper variable quoting, safer array splitting, and explicit error handling are sound practices. However, the proposed address-parsing pattern has a critical flaw:

Pattern mismatch: The review proposes awk -F': ' '/^Address \(testnet\)/{print $2; exit}', which expects colon-delimited key-value format (Address (testnet): value). However, the source code uses comfy_table::Table (src/wallet/types.rs:180-193), which renders formatted ASCII tables with borders and padding—not key-value pairs with colons. This pattern would fail to extract the address correctly and likely break the script.

The current pattern (grep "Address (testnet)" | awk '{print $5}') is fragile but designed for the actual table output format. To verify the exact field position and confirm the correct extraction pattern, manually run cshell wallet info --name <wallet_name> and inspect the actual output format.

Recommendation: Apply the safety improvements (set flags, quoting, array split), but verify and adjust the address-parsing logic independently based on actual cshell wallet info output before committing.

@@ -0,0 +1,77 @@
#!/bin/bash

alias cshell="cargo run -- "
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Cron will ignore the alias; which won’t resolve it. Use absolute cshell path.

The alias won’t exist in cron’s non-interactive shell, and which doesn’t see aliases. The scheduled job will likely fail.

Apply this diff:

@@
-alias cshell="cargo run -- "
+# Do not rely on aliases for cron. Ensure cshell is in PATH.
@@
-CSHELL_PATH=$(which cshell)
-TX3_PATH=$(pwd)/transfer.tx3
-UNBUFFER_PATH=$(which unbuffer)
-CMD="$CSHELL_PATH tx invoke --tx3-file $TX3_PATH --signers $SENDER_WALLET --unsafe --tx3-args-json '{\"sender\":\"$SENDER_ADDRESS\",\"receiver\":\"$RECEIVER_ADDRESS\",\"quantity\":$AMOUNT}'"
+CSHELL_PATH=$(command -v cshell || true)
+if [ -z "${CSHELL_PATH}" ]; then
+  echo "Error: cshell binary not found in PATH (cron requires absolute paths)."
+  exit 1
+fi
+TX3_PATH="$(pwd)/transfer.tx3"
+UNBUFFER_PATH=$(command -v unbuffer || true) # optional
+# Build command string with quoted vars; cron runs /bin/sh, so embed quotes.
+CMD="${CSHELL_PATH} tx invoke --tx3-file ${TX3_PATH} --signers \"${SENDER_WALLET}\" --unsafe --tx3-args-json '{\"sender\":\"${SENDER_ADDRESS}\",\"receiver\":\"${RECEIVER_ADDRESS}\",\"quantity\":${AMOUNT}}'"

Also applies to: 72-77

🤖 Prompt for AI Agents
In examples/scheduled-tasks/transfer.sh around line 3 (and also lines 72-77),
the script uses an alias (alias cshell="cargo run -- ") which cron will ignore
and which cannot be resolved by which; replace the alias usage with the absolute
path to the cshell binary (or invoke cargo via its full path) and update any
references that rely on the alias to call that absolute path instead, ensuring
the script uses full executable paths so cron can run it non-interactively.

Comment on lines +32 to +50
# Validate amount is a positive integer
if ! [[ "$AMOUNT" =~ ^[0-9]+$ ]]; then
echo "Error: amount must be a positive integer"
exit 1
fi

# Validate cron string is not empty
if [ -z "$CRON_STRING" ]; then
echo "Error: cron string cannot be empty"
exit 1
fi

# Basic validation of cron string format (5 fields separated by spaces)
CRON_FIELDS=$(echo "$CRON_STRING" | awk '{print NF}')
if [ "$CRON_FIELDS" -ne 5 ]; then
echo "Error: invalid cron string format. Must have 5 fields: 'minute hour day month weekday'"
echo "Example: '0 */2 * * *' (every 2 hours)"
exit 1
fi
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major

Quoting, crontab -l fallback, and address parsing improvements.

  • Quote all vars; validate cron list retrieval; make address extraction robust; allow missing unbuffer.

Apply this diff:

@@
-if ! [[ "$AMOUNT" =~ ^[0-9]+$ ]]; then
+if ! [[ "${AMOUNT}" =~ ^[0-9]+$ ]]; then
@@
-if [ -z "$CRON_STRING" ]; then
+if [ -z "${CRON_STRING}" ]; then
@@
-CRON_FIELDS=$(echo "$CRON_STRING" | awk '{print NF}')
-if [ "$CRON_FIELDS" -ne 5 ]; then
+CRON_FIELDS=$(awk '{print NF}' <<<"${CRON_STRING}")
+if [ "${CRON_FIELDS}" -ne 5 ]; then
@@
-SENDER_INFO=$(cshell wallet info --name $SENDER_WALLET 2>&1)
-if [ $? -ne 0 ]; then
+if ! SENDER_INFO=$(cshell wallet info --name "${SENDER_WALLET}" 2>&1); then
@@
-SENDER_ADDRESS=$(echo "$SENDER_INFO" | grep "Address (testnet)" | awk '{print $5}')
+SENDER_ADDRESS=$(awk -F': ' '/^Address \(testnet\)/{print $2; exit}' <<<"${SENDER_INFO}")
+if [ -z "${SENDER_ADDRESS:-}" ]; then
+  echo "Error: could not parse sender testnet address"
+  exit 1
+fi
@@
-RECEIVER_INFO=$(cshell wallet info --name $RECEIVER_WALLET 2>&1)
-if [ $? -ne 0 ]; then
+if ! RECEIVER_INFO=$(cshell wallet info --name "${RECEIVER_WALLET}" 2>&1); then
@@
-RECEIVER_ADDRESS=$(echo "$RECEIVER_INFO" | grep "Address (testnet)" | awk '{print $5}')
+RECEIVER_ADDRESS=$(awk -F': ' '/^Address \(testnet\)/{print $2; exit}' <<<"${RECEIVER_INFO}")
+if [ -z "${RECEIVER_ADDRESS:-}" ]; then
+  echo "Error: could not parse receiver testnet address"
+  exit 1
+fi
@@
-crontab -l | { cat; echo "$CRON_STRING $UNBUFFER_PATH $CMD"; } | crontab -
+CRON_CURRENT=$(crontab -l 2>/dev/null || true)
+if [ -n "${UNBUFFER_PATH}" ]; then
+  NEW_LINE="${CRON_STRING} ${UNBUFFER_PATH} ${CMD}"
+else
+  NEW_LINE="${CRON_STRING} ${CMD}"
+fi
+{ printf '%s\n' "${CRON_CURRENT}"; printf '%s\n' "${NEW_LINE}"; } | crontab -

Optional: write a tiny wrapper script and schedule that path to avoid complex quoting in cron.

Also applies to: 52-69, 70-77

🤖 Prompt for AI Agents
In examples/scheduled-tasks/transfer.sh around lines 32 to 50 (and also apply
same fixes to lines 52-69 and 70-77), quote all variable expansions (e.g.
"$AMOUNT", "$CRON_STRING"), check the return code and output of crontab -l and
fall back gracefully if crontab is empty or not installed, make address
extraction robust by using a safer parsing method (avoid fragile awk/regex
assumptions and handle quotes/commas), and allow missing unbuffer by
conditionally using it only if present; update validations to use the quoted
vars and robust extraction logic and add clear error messages on failure.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

♻️ Duplicate comments (1)
examples/scheduled-tasks/transfer.sh (1)

1-75: Address previously flagged critical and major issues before merge.

This script has several unfixed issues that were detailed in previous review feedback:

Critical:

  • Lines 70–72: Using which cshell and which unbuffer won't resolve these commands in cron's non-interactive shell, causing the scheduled job to fail silently. Cron requires absolute paths.

Major:

  • Lines 19–73: Unquoted variables ($AMOUNT, $CRON_STRING, $SENDER_WALLET, etc.) are unsafe and can cause word-splitting issues, especially if values contain spaces or special characters.
  • Lines 57, 66: Address extraction using grep "Address (testnet)" | awk '{print $5}' is fragile; if output format changes slightly, parsing fails silently with no error detection.
  • Line 75: crontab -l | { ... } fails if crontab is empty or not set; needs fallback with crontab -l 2>/dev/null || true.
  • Lines 72, 73, 75: Quoting in the cron command string is complex and error-prone; unbuffer is also optional but treated as required.

The previous review provided a comprehensive diff addressing all of these. I recommend reviewing that feedback and applying those changes before merging.

Would you like me to provide an updated consolidated fix covering all these issues, or do you have questions about implementing the changes from the previous review?

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 46336e1 and d258756.

📒 Files selected for processing (2)
  • examples/complex-transaction/create-ship.sh (1 hunks)
  • examples/scheduled-tasks/transfer.sh (1 hunks)
🧰 Additional context used
🪛 Shellcheck (0.11.0)
examples/complex-transaction/create-ship.sh

[warning] 55-55: Quote this to prevent word splitting.

(SC2046)


[warning] 57-57: Quote this to prevent word splitting.

(SC2046)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
  • GitHub Check: integration
  • GitHub Check: unit

Comment on lines +1 to +78
#!/bin/bash

# Validate arguments
if [ $# -ne 3 ]; then
echo "Error: exactly 3 arguments are required"
echo "Usage: $0 <player_wallet> <pos_x> <pos_y>"
echo "Example: $0 alice 25 25"
exit 1
fi

# Get arguments
PLAYER_WALLET=$1
POS_X=$2
POS_Y=$3

# Validate player wallet name is not empty
if [ -z "$PLAYER_WALLET" ]; then
echo "Error: player wallet name cannot be empty"
exit 1
fi

# Validate POS_X is an integer
if ! [[ "$POS_X" =~ ^-?[0-9]+$ ]]; then
echo "Error: pos_x must be an integer"
exit 1
fi

# Validate POS_Y is an integer
if ! [[ "$POS_Y" =~ ^-?[0-9]+$ ]]; then
echo "Error: pos_y must be an integer"
exit 1
fi

# Get player wallet info
PLAYER_INFO=$(cshell wallet info --name $PLAYER_WALLET 2>&1)
if [ $? -ne 0 ]; then
echo "Error: player wallet '$PLAYER_WALLET' does not exist"
exit 1
fi

PLAYER_ADDRESS=$(echo "$PLAYER_INFO" | grep "Address (testnet)" | awk '{print $5}')

NEXT_SHIP_RES=$(curl --location 'https://8000-skillful-employee-kb9ou6.us1.demeter.run/graphql' --header 'Content-Type: application/json' \
--data '{"query":"query { nextShipTokenName(spacetimeAddress: \"addr_test1wzmvtc20xxhseyj3tns4vcj6l3r5nccvamch3nawr7ffllcmwmxeq\", spacetimePolicyId: \"b6c5e14f31af0c92515ce156625afc4749e30ceef178cfae1f929fff\") { shipName pilotName } }"}')

SHIP_NAME=$(echo $NEXT_SHIP_RES | jq -r '.data.nextShipTokenName.shipName')
PILOT_NAME=$(echo $NEXT_SHIP_RES | jq -r '.data.nextShipTokenName.pilotName')

SHIP_NAME=$(printf '%s' "$SHIP_NAME" | xxd -p -u)
PILOT_NAME=$(printf '%s' "$PILOT_NAME" | xxd -p -u)

LAST_SLOT_RES=$(curl --location 'https://8000-skillful-employee-kb9ou6.us1.demeter.run/graphql' --header 'Content-Type: application/json' \
--data '{"query":"query { lastSlot { slot } }"}')

TIP_SLOT=`expr $(echo $LAST_SLOT_RES | jq -r '.data.lastSlot.slot') + 300`

LAST_MOVE_TIMESTAMP=`expr $(date +%s) + 300000`

JSON=$(jq -n \
--arg player "$PLAYER_ADDRESS" \
--arg ship_name "$SHIP_NAME" \
--arg pilot_name "$PILOT_NAME" \
--argjson p_pos_x "$POS_X" \
--argjson p_pos_y "$POS_Y" \
--argjson tip_slot "$TIP_SLOT" \
--argjson last_move_timestamp "$LAST_MOVE_TIMESTAMP" \
'{
"player": $player,
"ship_name": $ship_name,
"pilot_name": $pilot_name,
"p_pos_x": $p_pos_x,
"p_pos_y": $p_pos_y,
"tip_slot": $tip_slot,
"last_move_timestamp": $last_move_timestamp
}'
)

cshell tx invoke --tx3-file ./asteria.tx3 --signers $PLAYER_WALLET --tx3-args-json "$JSON" --unsafe No newline at end of file
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

Critical shell-safety and data-validation issues remain unaddressed from previous review.

The previous detailed review provided comprehensive feedback with a complete diff covering multiple critical issues (unquoted expansions, missing safety flags, unsafe API calls, null-check gaps, deprecated arithmetic, and missing 0x prefix for Bytes). The current code has not incorporated these fixes.

Most critical issues that must be fixed before merge:

  1. Unquoted variable expansions (lines 35, 41, 46, 47, 55, 78): Word-splitting risk; all $VAR should become "${VAR}".
  2. Missing shell safety flags (line 1): Add set -euo pipefail and IFS=$' \t\n' to catch errors early and prevent quoting surprises.
  3. Unsafe API calls (lines 43, 52): curl lacks --fail flag; silent failures will propagate bad data downstream.
  4. No null-value guards (lines 46, 47, 55): If jq returns null or fails, the variables become empty/corrupted; use jq -re and error-trap.
  5. Deprecated arithmetic (lines 55, 57): Replace backtick `expr ...` with $(( ... )) (POSIX, safer, clearer).
  6. Missing 0x prefix on hex (lines 49, 50): tx3 Bytes type requires 0x prefix; currently SHIP_NAME and PILOT_NAME lack it.
  7. Fragile address parsing (line 41): Missing validation; if extraction fails, PLAYER_ADDRESS is empty but script continues.

The previous review provided a complete, ready-to-apply diff addressing all of these. Recommend applying that diff or let me verify/regenerate it.


I'll verify the review comment by examining the actual file and checking whether the claimed issues are present.


---

🏁 Script executed:

```shell
#!/bin/bash
# Check if file exists and examine its content
if [ -f "examples/complex-transaction/create-ship.sh" ]; then
  echo "=== FILE EXISTS ===" 
  cat -n "examples/complex-transaction/create-ship.sh"
else
  echo "File not found at examples/complex-transaction/create-ship.sh"
  find . -name "create-ship.sh" -type f 2>/dev/null | head -5
fi

Length of output: 3030


🏁 Script executed:

#!/bin/bash
# Run shellcheck to identify actual issues
if command -v shellcheck &> /dev/null; then
  echo "=== SHELLCHECK ANALYSIS ==="
  shellcheck examples/complex-transaction/create-ship.sh 2>&1 || true
else
  echo "shellcheck not available, will use grep-based analysis"
fi

Length of output: 2952


🏁 Script executed:

#!/bin/bash
# Check for specific patterns mentioned in review
echo "=== PATTERN ANALYSIS ==="
echo "Checking for backtick arithmetic (expr):"
grep -n '`expr' examples/complex-transaction/create-ship.sh 2>/dev/null || echo "Not found"
echo ""
echo "Checking for unquoted variables on line 35:"
sed -n '35p' examples/complex-transaction/create-ship.sh 2>/dev/null || echo "Line 35 check failed"
echo ""
echo "Checking for curl without --fail:"
grep -n 'curl' examples/complex-transaction/create-ship.sh 2>/dev/null || echo "No curl found"
echo ""
echo "Checking for set -euo pipefail on line 1:"
head -1 examples/complex-transaction/create-ship.sh 2>/dev/null || echo "Line 1 check failed"

Length of output: 676


I need to verify one more technical claim about the tx3 Bytes type format.


---

🌐 Web query:

```web
tx3 Bytes type hex format prefix requirements

💡 Result:

I’m not sure which “tx3” you mean—can you clarify the context? For example:

  • tx3 DSL for UTxO/Cardano transactions (tx3 language). [1]
  • a “tx3” field/identifier in a blockchain/transaction hex (e.g., tx1/tx2/tx3 are just transaction hashes). [2]
  • a hardware/firmware or protocol byte field named TX3 (e.g., SFF specs). [3]

Tell me which one (or paste an example hex/string) and I’ll list exact byte/hex prefix rules required.

Sources: [1] tx3-lang (GitHub). [2] example Bitcoin tx3 usage (blockchain note). [3] SFF‑8636 TX3 references.


Fix unquoted variables, add shell safety flags, secure curl calls, and replace deprecated arithmetic.

Shellcheck confirms 7 real issues in the script that must be fixed:

  • Unquoted variable expansions (lines 35, 46, 47, 78): Quote all $VAR"${VAR}" to prevent word splitting
  • Missing shell safety flags (line 1): Add set -euo pipefail and IFS=$' \t\n' after shebang
  • Unsafe curl calls (lines 43, 52): Add --fail flag to both curl commands to catch HTTP errors
  • Deprecated backtick arithmetic (lines 55, 57): Replace `expr ... ` with $(( ... )) syntax
  • Unquoted jq output (line 55): Quote $(echo "$LAST_SLOT_RES" | jq -r ...) to prevent word splitting
  • Indirect exit check (line 36): Replace if [ $? -ne 0 ] with direct command: if ! cshell wallet info ...
🧰 Tools
🪛 Shellcheck (0.11.0)

[warning] 55-55: Quote this to prevent word splitting.

(SC2046)


[warning] 57-57: Quote this to prevent word splitting.

(SC2046)

🤖 Prompt for AI Agents
In examples/complex-transaction/create-ship.sh around lines 1–78, fix
shell-safety and quoting issues: add set -euo pipefail and IFS=$' \t\n'
immediately after the shebang, change the wallet-info check to use a direct
command test (if ! cshell wallet info ... ) instead of checking $?, capture its
output with proper quoting, quote all variable expansions (e.g.
"$PLAYER_WALLET", "$PLAYER_INFO", "$PLAYER_ADDRESS", "$SHIP_NAME",
"$PILOT_NAME", "$JSON" and positional vars) to prevent word-splitting, add
--fail to both curl invocations to catch HTTP errors, replace the backtick/expr
arithmetic with POSIX arithmetic $(( ... )) and ensure results from jq are
quoted when assigned (e.g. "$(echo "$LAST_SLOT_RES" | jq -r ... )") so no
unquoted expansions remain.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (1)
docs/examples.mdx (1)

79-79: Minor language improvement: use a more concise phrasing.

The phrase "in order to submit" could be shortened to simply "to submit" for better conciseness.

-> Note: you need to use a provider with the Cardano preview testnet in order to submit this transaction
+> Note: you need to use a provider with the Cardano preview testnet to submit this transaction
📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between d258756 and 1d28848.

📒 Files selected for processing (1)
  • docs/examples.mdx (1 hunks)
🧰 Additional context used
🪛 LanguageTool
docs/examples.mdx

[style] ~79-~79: Consider a more concise word here.
Context: ...ovider with the Cardano preview testnet in order to submit this transaction

(IN_ORDER_TO_PREMIUM)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: integration
🔇 Additional comments (2)
docs/examples.mdx (2)

1-79: Documentation structure is clear and well-organized.

The three examples follow a consistent, helpful template with location, usage, arguments, concrete commands, and explanatory notes. The content accurately reflects the purpose of each example and provides readers with enough context to use them effectively. The YAML frontmatter is properly formatted.


36-36: All referenced example files verified to exist.

All example scripts and configuration files referenced in the documentation are present in the repository:

  • examples/batch-transactions/transfer.sh and transfer.tx3
  • examples/scheduled-tasks/transfer.sh and transfer.tx3
  • examples/complex-transaction/create-ship.sh and asteria.tx3

@scarmuega scarmuega merged commit 5df16e6 into txpipe:main Oct 21, 2025
9 of 10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants