release: to prod

.claude/agents/protocol-domain.md

@@ -614,7 +614,7 @@ EVM chains with Etherscan-compatible explorer configs (safe for seed workflows):
 - "11155111" -- Sepolia Testnet (Etherscan Sepolia)
 
 Non-EVM / Blockscout chains with explorer configs (NOT safe for protocol seed workflows -- different API format):
-- "42420" -- Tempo (Blockscout)
+- "4217" -- Tempo (Blockscout)
 - "42429" -- Tempo Testnet (Blockscout)
 - "101" -- Solana (Solscan)
 - "103" -- Solana Devnet (Solscan)

.claude/commands/test-protocol.md

@@ -36,7 +36,7 @@ Read the protocol definition file:
 protocols/$ARGUMENTS.ts
 ```
 
-If it does not exist, check alternate names (e.g., `aave-v3.ts` for `aave`, `compound-v3.ts` for `compound`, `uniswap-v3.ts` for `uniswap`, `yearn-v3.ts` for `yearn`).
+If it does not exist, check alternate names (e.g., `compound-v3.ts` for `compound`, `uniswap-v3.ts` for `uniswap`, `yearn-v3.ts` for `yearn`). Aave versions use explicit slugs: `aave-v3.ts` has slug `aave-v3`, `aave-v4.ts` has slug `aave-v4`.
 
 Extract:
 - Protocol name, slug, and description
@@ -132,7 +132,7 @@ Save tested workflow configurations to `scripts/seed/workflows/$ARGUMENTS/` for
 
 After write tests, create and execute withdrawal workflows to recover deposited funds:
 - `vault-withdraw` / `vault-redeem` for ERC-4626 vaults
-- Protocol-specific withdraw actions (e.g., `aave/withdraw`, `compound/withdraw`)
+- Protocol-specific withdraw actions (e.g., `aave-v3/withdraw`, `compound/withdraw`)
 - Run withdrawals **sequentially** (same nonce contention concern)
 
 Verify final balances match expectations.

.github/workflows/pr-checks.yml

@@ -94,6 +94,23 @@ jobs:
       - name: Run check
         run: pnpm check
 
+      - name: Forbid legacy Tempo chain ID 42420
+        # Canonical Tempo mainnet chain ID is 4217 (see lib/rpc/types.ts).
+        # 42420 is a retired legacy ID; re-introducing it silently routes to
+        # the wrong RPC entry or mismatches the chains table. See KEEP-261.
+        # Uses git grep on the checked-out tree -- no user input is interpolated.
+        run: |
+          MATCHES=$(git grep -nE '\b42420\b' -- \
+            ':!*.md' \
+            ':!drizzle/meta/' \
+            ':!.github/workflows/pr-checks.yml' \
+            || true)
+          if [ -n "$MATCHES" ]; then
+            echo "::error::Legacy Tempo chain ID 42420 found. Use 4217 instead (KEEP-261)."
+            echo "$MATCHES"
+            exit 1
+          fi
+
   typecheck:
     runs-on: ubuntu-latest
     steps:
@@ -143,15 +160,15 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Configure AWS credentials
-        if: steps.changes.outputs.relevant == 'true'
+        if: steps.changes.outputs.relevant == 'true' && github.actor != 'dependabot[bot]'
         uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-access-key-id: ${{ secrets.TO_AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.TO_AWS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.TO_REGION }}
 
       - name: Login to AWS ECR
-        if: steps.changes.outputs.relevant == 'true'
+        if: steps.changes.outputs.relevant == 'true' && github.actor != 'dependabot[bot]'
         id: login-ecr
         uses: aws-actions/amazon-ecr-login@v2
 

app/api/billing/billing-details/route.ts

@@ -0,0 +1,44 @@
+import { NextResponse } from "next/server";
+import { isBillingEnabled } from "@/lib/billing/feature-flag";
+import { getOrgSubscription } from "@/lib/billing/plans-server";
+import { getBillingProvider } from "@/lib/billing/providers";
+import { requireOrgOwner } from "@/lib/billing/require-org-owner";
+import { ErrorCategory, logSystemError } from "@/lib/logging";
+
+export async function GET(): Promise<NextResponse> {
+  if (!isBillingEnabled()) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+
+  try {
+    const authResult = await requireOrgOwner();
+    if ("error" in authResult) {
+      return authResult.error;
+    }
+    const { orgId: activeOrgId } = authResult;
+
+    const sub = await getOrgSubscription(activeOrgId);
+    if (!sub?.providerCustomerId) {
+      return NextResponse.json({
+        paymentMethod: null,
+        billingEmail: null,
+      });
+    }
+
+    const provider = getBillingProvider();
+    const details = await provider.getBillingDetails(sub.providerCustomerId);
+
+    return NextResponse.json(details);
+  } catch (error) {
+    logSystemError(
+      ErrorCategory.EXTERNAL_SERVICE,
+      "[Billing] Billing details error",
+      error,
+      { endpoint: "/api/billing/billing-details", operation: "get" }
+    );
+    return NextResponse.json(
+      { error: "Failed to load billing details" },
+      { status: 500 }
+    );
+  }
+}

app/api/mcp/workflows/[slug]/call/route.ts

@@ -4,7 +4,7 @@ import { start } from "workflow/api";
 import { checkConcurrencyLimit } from "@/app/api/execute/_lib/concurrency-limit";
 import { enforceExecutionLimit } from "@/lib/billing/execution-guard";
 import { db } from "@/lib/db";
-import { workflowExecutions, workflows } from "@/lib/db/schema";
+import { tags, workflowExecutions, workflows } from "@/lib/db/schema";
 import { ErrorCategory, logSystemError } from "@/lib/logging";
 import { checkIpRateLimit, getClientIp } from "@/lib/mcp/rate-limit";
 import { hashMppCredential } from "@/lib/mpp/server";
@@ -15,6 +15,7 @@ import {
 } from "@/lib/payments/router";
 import { executeWorkflow } from "@/lib/workflow-executor.workflow";
 import type { WorkflowEdge, WorkflowNode } from "@/lib/workflow-store";
+import { buildCallCompletionResponse } from "@/lib/x402/execution-wait";
 import {
   hashPaymentSignature,
   recordPayment,
@@ -146,8 +147,9 @@ function startExecutionInBackground(
 }
 
 /**
- * Free-path helper: prepares the execution and starts it. Used by the
- * non-paid call path where there is no payment to record between the two.
+ * Free-path helper: prepares the execution, starts it, and awaits completion
+ * up to the read-wait timeout. Returns the mapped output inline on success or
+ * falls back to `{executionId, status: "running"}` on timeout.
  */
 async function createAndStartExecution(
   workflow: CallRouteWorkflow,
@@ -158,16 +160,18 @@ async function createAndStartExecution(
     return prepared.error;
   }
   startExecutionInBackground(workflow, body, prepared.executionId);
-  return NextResponse.json(
-    { executionId: prepared.executionId, status: "running" },
-    { headers: corsHeaders }
+  const responseBody = await buildCallCompletionResponse(
+    prepared.executionId,
+    workflow.outputMapping
   );
+  return NextResponse.json(responseBody, { headers: corsHeaders });
 }
 
 async function lookupWorkflow(slug: string): Promise<CallRouteWorkflow | null> {
   const rows = await db
-    .select(CALL_ROUTE_COLUMNS)
+    .select({ ...CALL_ROUTE_COLUMNS, tagName: tags.name })
     .from(workflows)
+    .leftJoin(tags, eq(workflows.tagId, tags.id))
     .where(and(eq(workflows.listedSlug, slug), eq(workflows.isListed, true)))
     .limit(1);
   return rows[0] ?? null;
@@ -333,10 +337,11 @@ async function handlePaidWorkflow(
 
         startExecutionInBackground(workflow, body, executionId);
 
-        return NextResponse.json(
-          { executionId, status: "running" },
-          { headers: corsHeaders }
+        const responseBody = await buildCallCompletionResponse(
+          executionId,
+          workflow.outputMapping
         );
+        return NextResponse.json(responseBody, { headers: corsHeaders });
       };
     }
   );

app/layout.tsx

@@ -4,6 +4,7 @@ import { Analytics } from "@vercel/analytics/react";
 import { SpeedInsights } from "@vercel/speed-insights/next";
 import { Provider } from "jotai";
 import { type ReactNode, Suspense } from "react";
+import { AppBanner } from "@/components/app-banner";
 import { AuthProvider } from "@/components/auth/provider";
 import { KeeperHubExtensionLoader } from "@/components/extension-loader";
 import { GitHubStarsLoader } from "@/components/github-stars-loader";
@@ -76,6 +77,7 @@ const RootLayout = ({ children }: RootLayoutProps) => (
               <Suspense fallback={<GitHubStarsProvider stars={null} />}>
                 <GitHubStarsLoader />
               </Suspense>
+              <AppBanner />
               <LayoutContent>{children}</LayoutContent>
               <Toaster />
               <GlobalModals />

app/workflows/[workflowId]/layout.tsx

@@ -74,5 +74,13 @@ export async function generateMetadata({
 }
 
 export default function WorkflowLayout({ children }: WorkflowLayoutProps) {
-  return children;
+  // Opt out of in-browser auto-translation (Google Translate, Edge, etc.) on
+  // the editor. Translators replace text nodes with <font> wrappers, which
+  // breaks React's reconciler and throws NotFoundError on insertBefore /
+  // removeChild. Marketing / hub pages remain translatable.
+  return (
+    <div className="contents" translate="no">
+      {children}
+    </div>
+  );
 }

app/workflows/[workflowId]/page.tsx

@@ -880,7 +880,7 @@ const WorkflowEditor = ({ params }: WorkflowPageProps) => {
       {/* Right panel overlay (desktop only) - only show if trigger exists */}
       {!isMobile && hasTriggerNode && (
         <div
-          className="pointer-events-auto absolute top-24 right-0 bottom-0 z-20 border-l bg-background transition-transform duration-300 ease-out lg:top-[60px]"
+          className="pointer-events-auto absolute top-[calc(6rem+var(--app-banner-height,0px))] right-0 bottom-0 z-20 border-l bg-background transition-transform duration-300 ease-out lg:top-[calc(60px+var(--app-banner-height,0px))]"
           style={{
             width: `${panelWidth}%`,
             transform:

components/ai-elements/prompt.tsx

@@ -8,6 +8,7 @@ import { toast } from "sonner";
 import { Shimmer } from "@/components/ai-elements/shimmer";
 import { Button } from "@/components/ui/button";
 import { api } from "@/lib/api-client";
+import { dedupeEdges } from "@/lib/workflow/edge-helpers";
 import {
   currentWorkflowIdAtom,
   currentWorkflowNameAtom,
@@ -135,9 +136,10 @@ export function AIPrompt({ workflowId, onWorkflowCreated }: AIPromptProps) {
               );
             }
 
-            // Update the canvas incrementally
+            // Update the canvas incrementally. Dedupe in case the AI emitted
+            // duplicate edges (same source/sourceHandle -> target/targetHandle).
             setNodes(partialData.nodes || []);
-            setEdges(validEdges);
+            setEdges(dedupeEdges(validEdges));
             if (partialData.name) {
               setCurrentWorkflowName(partialData.name);
             }
@@ -153,11 +155,14 @@ export function AIPrompt({ workflowId, onWorkflowCreated }: AIPromptProps) {
         console.log("[AI Prompt] Nodes:", workflowData.nodes?.length || 0);
         console.log("[AI Prompt] Edges:", workflowData.edges?.length || 0);
 
-        // Use edges from workflow data with animated type
-        const finalEdges = (workflowData.edges || []).map((edge) => ({
-          ...edge,
-          type: "animated",
-        }));
+        // Use edges from workflow data with animated type; dedupe before
+        // persisting so AI hallucinations don't leak duplicates into the DB.
+        const finalEdges = dedupeEdges(
+          (workflowData.edges || []).map((edge) => ({
+            ...edge,
+            type: "animated",
+          }))
+        );
 
         // Validate: check for blank/incomplete nodes
         console.log("[AI Prompt] Validating nodes:", workflowData.nodes);

components/analytics/analytics-page.tsx

@@ -106,7 +106,7 @@ export function AnalyticsPage(): ReactNode {
     return (
       <div className="pointer-events-auto fixed inset-0 overflow-y-auto bg-sidebar">
         <div className="transition-[margin-left] duration-200 ease-out md:ml-[var(--nav-sidebar-width,60px)]">
-          <div className="flex flex-col gap-6 p-6 pt-20">
+          <div className="flex flex-col gap-6 p-6 pt-[calc(5rem+var(--app-banner-height,0px))]">
             <AnalyticsHeader onRefetch={refetch} />
             <EmptyState />
           </div>
@@ -118,7 +118,7 @@ export function AnalyticsPage(): ReactNode {
   return (
     <div className="pointer-events-auto fixed inset-0 overflow-y-auto bg-sidebar">
       <div className="transition-[margin-left] duration-200 ease-out md:ml-[var(--nav-sidebar-width,60px)]">
-        <div className="flex flex-col gap-6 p-6 pt-20">
+        <div className="flex flex-col gap-6 p-6 pt-[calc(5rem+var(--app-banner-height,0px))]">
           <AnalyticsHeader onRefetch={refetch} />
 
           <KpiCards />

components/app-banner.tsx

@@ -0,0 +1,81 @@
+"use client";
+
+import { Info, X } from "lucide-react";
+import Link from "next/link";
+import { useEffect, useState } from "react";
+
+const STORAGE_KEY = "kh-billing-announce-v1";
+
+export function AppBanner(): React.ReactElement | null {
+  const [mounted, setMounted] = useState(false);
+  const [dismissed, setDismissed] = useState(true);
+
+  useEffect(() => {
+    setMounted(true);
+    try {
+      const stored = window.localStorage.getItem(STORAGE_KEY);
+      setDismissed(stored === "1");
+    } catch {
+      setDismissed(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    if (!mounted) {
+      return;
+    }
+    if (dismissed) {
+      document.documentElement.style.removeProperty("--app-banner-height");
+    } else {
+      document.documentElement.style.setProperty("--app-banner-height", "36px");
+    }
+    return (): void => {
+      document.documentElement.style.removeProperty("--app-banner-height");
+    };
+  }, [mounted, dismissed]);
+
+  function handleDismiss(): void {
+    try {
+      window.localStorage.setItem(STORAGE_KEY, "1");
+    } catch {
+      // localStorage unavailable; dismissal only lasts this session
+    }
+    setDismissed(true);
+  }
+
+  if (!mounted || dismissed) {
+    return null;
+  }
+
+  return (
+    <div
+      className="pointer-events-auto fixed top-0 right-0 left-0 z-[55] flex h-9 items-center justify-center border-b border-keeperhub-green/30 bg-keeperhub-green/10 px-12 text-sm backdrop-blur-sm"
+      data-testid="app-banner"
+    >
+      <p className="flex items-center gap-2 truncate text-foreground">
+        <Info
+          aria-hidden="true"
+          className="size-4 shrink-0 text-keeperhub-green-dark"
+        />
+        <span className="truncate">
+          New Pro and Business plans unlock higher execution limits and gas
+          credits. Free stays free forever.{" "}
+          <Link
+            className="font-medium text-keeperhub-green-dark underline-offset-4 hover:underline"
+            href="/billing#plans-section"
+          >
+            See plans
+          </Link>
+        </span>
+      </p>
+      <button
+        aria-label="Dismiss announcement"
+        className="absolute right-3 shrink-0 rounded-md p-1 text-muted-foreground transition-colors hover:bg-keeperhub-green/10 hover:text-foreground"
+        onClick={handleDismiss}
+        type="button"
+      >
+        <X className="size-3.5" />
+      </button>
+    </div>
+  );
+}