Skip to content

[pull] main from MetaMask:main#732

Merged
pull[bot] merged 12 commits into
Reality2byte:mainfrom
MetaMask:main
May 5, 2026
Merged

[pull] main from MetaMask:main#732
pull[bot] merged 12 commits into
Reality2byte:mainfrom
MetaMask:main

Conversation

@pull
Copy link
Copy Markdown

@pull pull Bot commented May 5, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

chrisleewilcox and others added 12 commits May 5, 2026 18:02
…785) (#29682)

## **Description**

Tier 4 of the E2E allowlist reduction (epic
[MMQA-1364](https://consensyssoftware.atlassian.net/browse/MMQA-1364)).
Removes four entries from `tests/api-mocking/mock-e2e-allowlist.ts` by
adding default RPC mocks where the URL is actually pinged at runtime,
and deleting one stale entry whose host is never wired into a
`NetworkController`.

**Entries removed:**

| Entry | Disposition |
| --- | --- |
| `api.avax.network/ext/bc/C/rpc` | Default mock added (pinged on
controller load via `withPopularNetworks()`). |
| `mainnet.era.zksync.io` | Default mock added (same source). |
| `rpc.atlantischain.network` | `CUSTOM_RPC_PROVIDER_MOCKS` extended to
also cover this host. Used by
`permission-system-dapp-chain-switch-grant.spec.ts` (ElysiumTestnet). |
| `testnet-rpc.monad.xyz` | Deleted from allowlist — stale: only used in
`tests/resources/mock-configs.ts` to read `ticker`/`nickname`; the
actual `rpcUrl` is overridden to `http://localhost:8545`, so the live
URL is never set on a controller. |

Detox's `blacklistURLs.json` entries for avax + zksync are also removed
— those URLs are now intercepted by the mock server and no longer leak
to Detox's network-sync.

**Out of scope:** the `npm:` URI regex hack in `MockServerE2E.ts` (Tier
4 — Part 2, blocked by
[MMQA-1366](https://consensyssoftware.atlassian.net/browse/MMQA-1366)).
The Polymarket allowlist follow-up will be a separate ticket.

After this lands, `ALLOWLISTED_HOSTS` is down to **9** entries (4 local
+ 4 Tenderly + Polymarket carve-out + `metamask.github.io`) and
`ALLOWLISTED_URLS` is down to **1** entry
(`metamask.github.io/test-dapp/metamask-fox.svg`).

## **Changelog**

CHANGELOG entry: null

## **Related issues**

[MMQA-1785](https://consensyssoftware.atlassian.net/browse/MMQA-1785)
(Tier 4 — Part 1)
Parent epic:
[MMQA-1364](https://consensyssoftware.atlassian.net/browse/MMQA-1364)

Fixes:

## **Manual testing steps**

```gherkin
Feature: E2E mock coverage for popular network RPCs and ElysiumTestnet

  Scenario: smoke specs that load popular networks no longer leak live requests
    Given an E2E run that builds a fixture with withPopularNetworks()

    When the wallet boots and the NetworkController initializes
    Then requests to api.avax.network and mainnet.era.zksync.io are answered by the mock server
    And no entry for those hosts/URLs is required in mock-e2e-allowlist.ts

  Scenario: dapp chain-switch flow on ElysiumTestnet
    Given the spec permission-system-dapp-chain-switch-grant.spec.ts is run

    When the test taps Elysium Testnet to grant chain permission
    Then RPC calls routed via /proxy?url=https://rpc.atlantischain.network/... are intercepted by CUSTOM_RPC_PROVIDER_MOCKS
    And the spec passes without a live request leak
```

## **Screenshots/Recordings**

### **Before**

`tests/api-mocking/mock-e2e-allowlist.ts` — Tier 4 entries still
permitted to leak as live requests:

```ts
export const ALLOWLISTED_HOSTS = [
  // ... local + Tenderly ...
  'testnet-rpc.monad.xyz',
  // ... Polymarket + metamask.github.io ...
];

export const ALLOWLISTED_URLS = [
  'https://api.avax.network/ext/bc/C/rpc',
  'https://mainnet.era.zksync.io/',
  'https://rpc.atlantischain.network/',
  'https://metamask.github.io/test-dapp/metamask-fox.svg',
];
```

`tests/resources/blacklistURLs.json` — Detox dropping the same hosts at
the network layer:

```json
".*mainnet.era.zksync.io/.*",
".*api.avax.network/ext/bc/C/rpc.*"
```

### **After**

`tests/api-mocking/mock-e2e-allowlist.ts` — four entries removed (1 host
+ 3 URLs):

```ts
export const ALLOWLISTED_HOSTS = [
  '0.0.0.0',
  '127.0.0.1',
  'localhost',
  '10.0.2.2',
  'api.tenderly.co',
  'rpc.tenderly.co',
  'virtual.mainnet.rpc.tenderly.co',
  'virtual.linea.rpc.tenderly.co',
  'gamma-api.polymarket.com',
  '*.polymarket.com',
  'metamask.github.io',
];

export const ALLOWLISTED_URLS = [
  'https://metamask.github.io/test-dapp/metamask-fox.svg',
];
```

`tests/resources/blacklistURLs.json` — corresponding zkSync / avax
patterns removed.

**CI verification (commit `cf2ba92fcc`):**

```
iOS E2E Smoke Tests
  ✓ network-abstraction-ios-smoke (1)  16m3s   PASS
  ✓ network-abstraction-ios-smoke (2)  16m32s  PASS
```

`network-abstraction-ios-smoke` is the suite that runs
`permission-system-dapp-chain-switch-grant.spec.ts` (Elysium /
atlantischain) and the multichain `wallet-*` specs that build fixtures
with `withPopularNetworks()` (Avalanche / zkSync). Both shards passed on
the latest commit, validating the new mocks across both code paths.

> Note: Android smoke jobs flaked with an unrelated infrastructure error
(`Error: kill EPERM` from `nick-fields/retry` during `apt-get install`
on the runner — tests never executed). Same root cause across multiple
suites and reruns; not a code issue.

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

#### Performance checks (if applicable)

- [ ] I've tested on Android
  - Ideally on a mid-range device; emulator is acceptable
- [ ] I've tested with a power user scenario
- Use these [power-user
SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93)
to import wallets with many accounts and tokens
- [ ] I've instrumented key operations with Sentry traces for production
performance metrics
- See [`trace()`](/app/util/trace.ts) for usage and
[`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274)
for an example

For performance guidelines and tooling, see the [Performance
Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers).

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


[MMQA-1364]:
https://consensyssoftware.atlassian.net/browse/MMQA-1364?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
[MMQA-1366]:
https://consensyssoftware.atlassian.net/browse/MMQA-1366?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
<!--
Please submit this PR as a draft initially.

Do not mark it as "Ready for review" until this PR meets the canonical
Definition of Ready For Review in `docs/readme/ready-for-review.md`.

In short: the template must be materially complete (not just section
titles
present), all status checks must be currently passing, and the only
expected
follow-up commits must be reviewer-driven.
-->

## **Description**

Adds the expanded view of the Whats Happening section and adds it to the
Explore page.


https://github.com/user-attachments/assets/3f3da5ca-6f5d-4568-8ab9-2220e8ba706b



<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: null

## **Related issues**

Fixes:

## **Manual testing steps**

```gherkin
Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

<!--
Every checklist item must be consciously assessed before marking this PR
as
"Ready for review". A checked box means you deliberately considered that
responsibility, not that you literally performed every action listed.

Unchecked boxes are ambiguous: they are not an implicit "N/A" and they
are not
a silent "skip". See `docs/readme/ready-for-review.md` for the full
checklist
semantics.
-->

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I've included tests if applicable
- [ ] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

#### Performance checks (if applicable)

- [ ] I've tested on Android
  - Ideally on a mid-range device; emulator is acceptable
- [ ] I've tested with a power user scenario
- Use these [power-user
SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93)
to import wallets with many accounts and tokens
- [ ] I've instrumented key operations with Sentry traces for production
performance metrics
- See [`trace()`](/app/util/trace.ts) for usage and
[`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274)
for an example

For performance guidelines and tooling, see the [Performance
Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers).

## **Pre-merge reviewer checklist**

<!--
Reviewer checklist items follow the same semantics as the author
checklist: an
unchecked box is ambiguous, a checked box means the reviewer consciously
assessed that responsibility. See `docs/readme/ready-for-review.md`.
-->

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Adds a new navigation route and substantial new UI flow (carousel
detail view, bottom sheet link-out, and Buy/Trade actions) which could
impact navigation behavior and external URL handling if not covered by
integration testing.
> 
> **Overview**
> Adds a new `Routes.WHATS_HAPPENING_DETAIL` screen and wires the
Homepage “What’s happening” carousel to navigate to it using only an
`initialIndex` param (the detail view fetches its own data).
> 
> Introduces `WhatsHappeningDetailView` with a horizontally snapping
expanded-card carousel, loading skeletons, error/retry state, and a page
indicator. Expanded cards now support impact badges (new i18n strings),
token/perps action rows (Buy via Ramp, Trade via Perps), and a sources
bottom sheet that lists articles using a shared `ArticleRow` component
with safe URL link-out.
> 
> Refactors Market Insights trend sources bottom sheet to reuse the new
`ArticleRow`, and adds unit tests covering the new screen/components,
navigation params, impact badge rendering, and related-asset icon
resolution (`getRelatedAssetImageSource`).
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
c3dd999. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Antonio Regadas <antonio.regadas@consensys.net>
Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>
## **Description**

Token details (for example **View on block explorer** from the More
menu) pass the asset chain id, but `useBlockExplorer` only used built-in
/ `PopularList` explorers, then fell back to Etherscan using the
**globally selected** network. Chains such as Gnosis (`0x64`) can have a
block explorer in `NetworkController` while the user stays on Ethereum;
those URLs were ignored.

After the built-in / `PopularList` lookup, the hook now calls
`findBlockExplorerUrlForChain(currentChainId, networkConfigurations)` so
URLs match the **token's** chain.

- [GitHub
#26211](#26211)
- [TMCU-709](https://consensyssoftware.atlassian.net/browse/TMCU-709)

## **Changelog**

CHANGELOG entry: Fixed token details opening Etherscan instead of the
correct block explorer for tokens on custom or non–PopularList networks
when another EVM network was selected.

## **Related issues**

Fixes: #26211

Refs: https://consensyssoftware.atlassian.net/browse/TMCU-709

## **Manual testing steps**

```gherkin
Feature: Token details block explorer

  Scenario: Custom network token opens correct explorer
    Given the wallet has a custom or non–PopularList EVM network with a block explorer (e.g. Gnosis)
    And the globally selected network is Ethereum Mainnet
    And the user opens token details for a token on the custom network

    When the user opens the More menu and taps View on block explorer

    Then the in-app browser opens the block explorer for the token's chain, not Etherscan
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**



https://github.com/user-attachments/assets/41043d9d-1688-4385-990f-9512733136fe



## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

#### Performance checks (if applicable)

- [ ] I've tested on Android
  - Ideally on a mid-range device; emulator is acceptable
- [ ] I've tested with a power user scenario
- Use these [power-user
SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93)
to import wallets with many accounts and tokens
- [ ] I've instrumented key operations with Sentry traces for production
performance metrics
- See [`trace()`](/app/util/trace.ts) for usage and
[`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274)
for an example

For performance guidelines and tooling, see the [Performance
Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers).

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


[TMCU-709]:
https://consensyssoftware.atlassian.net/browse/TMCU-709?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: change is limited to block-explorer URL/name resolution
order and adds targeted tests; main impact is which external explorer
URL is opened for certain chains.
> 
> **Overview**
> Fixes token-chain explorer resolution by having `useBlockExplorer`
consult `findBlockExplorerUrlForChain(currentChainId,
networkConfigurations)` when built-in/`PopularList` mappings don’t cover
the chain, before falling back to RPC or Etherscan.
> 
> Adds tests that simulate Ethereum selected with Gnosis configured to
verify `getBlockExplorerBaseUrl`, `getBlockExplorerUrl`, and
`getBlockExplorerName` use the configured Gnosis explorer for a token on
`0x64`.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
8ea2d35. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
…thereum (#29676)

## **Description**

1. **Reason:** On Activity, the Perps tab is gated by
`selectIsEvmNetworkSelected`. After choosing Solana and then **All
popular networks**, `isEvmSelected` stayed false, so Perps did not
return
([TMCU-672](https://consensyssoftware.atlassian.net/browse/TMCU-672)).
An earlier approach called `selectPopularNetwork('eip155:1')` after
`enableAllPopularNetworks()`, which fixed Perps but incorrectly forced
the global EVM chain to Ethereum mainnet, so the network picker showed
Ethereum instead of aggregate popular networks.

2. **Solution:** Keep `selectAllPopularNetworks` limited to
`NetworkEnablementController.enableAllPopularNetworks()` (no implicit
chain switch). Drive Activity Perps visibility with
**`useNetworksByCustomNamespace`** (`eip155`, popular): show Perps when
the Perps feature flag is on **and** either the user is on EVM
(`isEvmSelected`) **or** all popular EVM networks are enabled—without
changing the active multichain selection.

## **Changelog**

CHANGELOG entry: Fixed the Activity Perps tab not reappearing after
switching the transaction network filter back to popular networks from
Solana, without forcing Ethereum as the selected chain.

## **Related issues**

Fixes #29053
Refs: https://consensyssoftware.atlassian.net/browse/TMCU-672

## **Manual testing steps**

```gherkin
Feature: Activity Perps tab and popular network filter (TMCU-602)

  Scenario: Perps returns after Solana then all popular networks without picking Ethereum
    Given the Perps feature flag is enabled
    And the user is on Activity with the transaction network filter showing popular networks
    When the user opens the network picker and selects Solana
    Then the Perps tab is hidden
    When the user opens the network picker and selects all popular networks
    Then the Perps tab is visible again
    And the picker does not show Ethereum as the sole selected chain while aggregate popular mode is intended

  Scenario: Perps still shows when directly on an EVM chain
    Given the Perps feature flag is enabled
    When the user selects an EVM network (e.g. Ethereum) from the picker
    Then the Perps tab is visible
```

## **Screenshots/Recordings**

### **Before**

See #28035 

### **After**



https://github.com/user-attachments/assets/f5192178-b7ae-4501-9daa-992afe0680cd



## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [ ] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

#### Performance checks (if applicable)

Not applicable for this change (network filter / tab visibility only).
Left unchecked until you validate on device if required by your release
process.

- [ ] I've tested on Android
  - Ideally on a mid-range device; emulator is acceptable
- [ ] I've tested with a power user scenario
- Use these [power-user
SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93)
to import wallets with many accounts and tokens
- [ ] I've instrumented key operations with Sentry traces for production
performance metrics
- See [`trace()`](/app/util/trace.ts) for usage and
[`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274)
for an example

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


[TMCU-602]:
https://consensyssoftware.atlassian.net/browse/TMCU-602?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

[TMCU-672]:
https://consensyssoftware.atlassian.net/browse/TMCU-672?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk UI gating change that only affects whether the Perps tab is
shown; main risk is incorrect tab visibility for certain multichain
network-filter states.
> 
> **Overview**
> Restores Perps visibility on the Activity screen when the user
switches to *All popular networks* after selecting a non‑EVM network,
without forcing an EVM chain selection.
> 
> `ActivityView` now enables the Perps tab when the feature flag is on
and either an EVM network is selected **or** all popular `eip155`
networks are enabled (via `useNetworksByCustomNamespace`). Tests update
mocks accordingly and add coverage for the non‑EVM + all popular EVM
networks case.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
f0566bd. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Pedro Pablo Aste Kompen <wachunei@users.noreply.github.com>
)

## **Description**

TradingService.flipPosition() deliberately omits currentPrice from the
order params it passes to provider.placeOrder() — passing a stale entry
price would corrupt IOC slippage calculation. However, placeOrder() was
running #validateOrderBeforePlacement before fetching the live price, so
the minimum-USD check had no price to work with and threw
ORDER_PRICE_REQUIRED on every flip.

Root cause: step ordering in HyperLiquidProvider.placeOrder().
Validation ran at step 1; the live price fetch (#getAssetInfo) ran at
step 3.

Fix: reorder placeOrder() so #getAssetInfo runs first, compute
effectivePrice (live price, or caller-supplied price if present), then
pass it into #validateOrderBeforePlacement. #ensureReadyForTrading stays
after validation, so invalid orders never trigger builder-fee /
DEX-abstraction signature prompts unnecessarily.

As a follow-on, effectivePrice is hoisted above the try block so the
$10-minimum retry path can also use the fetched price when the caller
omits currentPrice — without this, a flip order that hit the $10 edge
case would fail silently instead of retrying.

No changes to TradingService.flipPosition — the intentional omission of
entryPrice is correct and preserved.

Affected tests:

Three HyperLiquidProvider tests updated to reflect the new ordering (the
"missing price data" error now surfaces from #getAssetInfo rather than
validation; the price-less PUMP retry test now succeeds with two
exchange calls)
Two new tests added for the explicit flip-order path

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: fix regression to flip position perps

## **Related issues**

Fixes: MetaMask/metamask-extension#42375

## **Manual testing steps**

```gherkin
Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]
```

## **Screenshots/Recordings**


https://github.com/user-attachments/assets/1a789aff-37e1-4e7f-825b-a4af00f14211

## **Pre-merge author checklist**

<!--
Every checklist item must be consciously assessed before marking this PR
as
"Ready for review". A checked box means you deliberately considered that
responsibility, not that you literally performed every action listed.

Unchecked boxes are ambiguous: they are not an implicit "N/A" and they
are not
a silent "skip". See `docs/readme/ready-for-review.md` for the full
checklist
semantics.
-->

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

#### Performance checks (if applicable)

- [ ] I've tested on Android
  - Ideally on a mid-range device; emulator is acceptable
- [ ] I've tested with a power user scenario
- Use these [power-user
SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93)
to import wallets with many accounts and tokens
- [ ] I've instrumented key operations with Sentry traces for production
performance metrics
- See [`trace()`](/app/util/trace.ts) for usage and
[`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274)
for an example

For performance guidelines and tooling, see the [Performance
Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers).

## **Pre-merge reviewer checklist**

<!--
Reviewer checklist items follow the same semantics as the author
checklist: an
unchecked box is ambiguous, a checked box means the reviewer consciously
assessed that responsibility. See `docs/readme/ready-for-review.md`.
-->

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes the execution order in `HyperLiquidProvider.placeOrder`,
affecting validation/signing flow and retry behavior for minimum-order
errors. Risk is moderate because it touches core order placement logic,
but the change is localized and covered by updated/new tests.
> 
> **Overview**
> Fixes a regression where price-less market orders (notably
`flipPosition`) failed with `ORDER_PRICE_REQUIRED` by fetching the live
price via `#getAssetInfo` before provider-level validation and
validating against the computed `effectivePrice`.
> 
> Also hoists `effectivePrice` so the "$10 minimum order value" retry
path can derive an adjusted `usdAmount` from the fetched price when
`currentPrice` is omitted. Updates existing tests and adds new coverage
to assert success for flip-style params, the $10-minimum retry behavior,
and the revised error surfaced when price data is missing.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
106369c. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
…t tokens across chains for evm-scope specifically cp-7.76.0 (#29675)

<!--
Please submit this PR as a draft initially.

Do not mark it as "Ready for review" until this PR meets the canonical
Definition of Ready For Review in `docs/readme/ready-for-review.md`.

In short: the template must be materially complete (not just section
titles
present), all status checks must be currently passing, and the only
expected
follow-up commits must be reviewer-driven.
-->

## **Description**
This PR fixes an app crash that occurs when the user clicks the
"unstake" button (ETH pooled-staking) when non-evm network is selected.

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: fixed app crash occurring when user clicked
pooled-staking unstake button when non-evm network is selected.

## **Related issues**

Fixes: [MUSD-771: App Crash when user clicks pooled-staking "unstake"
button](https://consensyssoftware.atlassian.net/browse/MUSD-771)

## **Manual testing steps**

```gherkin
Feature: Fix app crash when clicking "unstake" button (pooled-staking)

  Scenario: App crash fixed
    Given user has Staked ETH to unstake

    When user clicks "Tokens" section header on home screen
    And user selects non-EVM network (e.g. Tron) in network selector
    And user returns to home screen
    And user clicks Ethereum asset row
    And user clicks "unstake" button on Ethereum asset details screen
    
    Then user is redirected to unstake screen with keypad
    And the app does not crash
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->


https://github.com/user-attachments/assets/a5ec5ab5-f4e2-47a3-b780-f6b289364ab7

### **After**

<!-- [screenshots/recordings] -->


https://github.com/user-attachments/assets/3661139d-ab90-4437-9127-ac94830eda88

## **Pre-merge author checklist**

<!--
Every checklist item must be consciously assessed before marking this PR
as
"Ready for review". A checked box means you deliberately considered that
responsibility, not that you literally performed every action listed.

Unchecked boxes are ambiguous: they are not an implicit "N/A" and they
are not
a silent "skip". See `docs/readme/ready-for-review.md` for the full
checklist
semantics.
-->

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

#### Performance checks (if applicable)

- [ ] I've tested on Android
  - Ideally on a mid-range device; emulator is acceptable
- [ ] I've tested with a power user scenario
- Use these [power-user
SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93)
to import wallets with many accounts and tokens
- [ ] I've instrumented key operations with Sentry traces for production
performance metrics
- See [`trace()`](/app/util/trace.ts) for usage and
[`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274)
for an example

For performance guidelines and tooling, see the [Performance
Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers).

## **Pre-merge reviewer checklist**

<!--
Reviewer checklist items follow the same semantics as the author
checklist: an
unchecked box is ambiguous, a checked box means the reviewer consciously
assessed that responsibility. See `docs/readme/ready-for-review.md`.
-->

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Medium risk because it changes how the unified multichain token
selector chooses the EVM address, which can affect token lists and Earn
flows across networks; however the change is localized and covered by
updated unit tests/mocks.
> 
> **Overview**
> Fixes a crash/empty-balance issue when a non-EVM network is active by
making `selectAccountTokensAcrossChainsUnified` always derive EVM tokens
from the *EVM-scoped* account in the selected account group, rather than
whatever account is currently selected.
> 
> Adds `selectAccountTokensAcrossChainsForEvmScope` (using
`selectSelectedInternalAccountByScope(EVM_SCOPE)` +
`selectAccountTokensAcrossChainsForAddress`) and updates
multichain/Earn-related tests to mock
`selectSelectedInternalAccountByScope` and the new EVM-token selector
signature.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
d5602d9. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
## **Description**

The advanced chart time axis was always displaying in UTC regardless of
the user's locale.

**Root cause:** The
[`timezone`](https://www.tradingview.com/charting-library-docs/latest/api/interfaces/Charting_Library.ChartingLibraryWidgetOptions#timezone)
property was missing from the `TradingView.widget` constructor. When
omitted, falls back to the symbol's [`resolveSymbol`
timezone](https://www.tradingview.com/charting-library-docs/latest/connecting_data/Symbology#time-zone)
— hardcoded to `Etc/UTC` for our crypto data.

**Fix:** Detect the user's timezone via
`Intl.DateTimeFormat().resolvedOptions().timeZone` and pass it to the
widget constructor. The value is validated against [TradingView's
supported timezone
list](https://www.tradingview.com/charting-library-docs/latest/ui_elements/timezones/#supported-time-zones)
with a fallback to `Etc/UTC`.

Note: the `timezone: 'Etc/UTC'` in `resolveSymbol` is unchanged, it
declares data alignment, which is separate from the display timezone.

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: Fixed advanced chart displaying timestamps in UTC
instead of the user's local timezone

## **Related issues**

Fixes: https://consensyssoftware.atlassian.net/browse/ASSETS-3141

## **Manual testing steps**

```gherkin
Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

<!--
Every checklist item must be consciously assessed before marking this PR
as
"Ready for review". A checked box means you deliberately considered that
responsibility, not that you literally performed every action listed.

Unchecked boxes are ambiguous: they are not an implicit "N/A" and they
are not
a silent "skip". See `docs/readme/ready-for-review.md` for the full
checklist
semantics.
-->

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I've included tests if applicable
- [ ] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

#### Performance checks (if applicable)

- [ ] I've tested on Android
  - Ideally on a mid-range device; emulator is acceptable
- [ ] I've tested with a power user scenario
- Use these [power-user
SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93)
to import wallets with many accounts and tokens
- [ ] I've instrumented key operations with Sentry traces for production
performance metrics
- See [`trace()`](/app/util/trace.ts) for usage and
[`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274)
for an example

For performance guidelines and tooling, see the [Performance
Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers).

## **Pre-merge reviewer checklist**

<!--
Reviewer checklist items follow the same semantics as the author
checklist: an
unchecked box is ambiguous, a checked box means the reviewer consciously
assessed that responsibility. See `docs/readme/ready-for-review.md`.
-->

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.



<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: only affects AdvancedChart display settings by passing a
validated `timezone` into the TradingView widget, with a safe fallback
to `Etc/UTC` if detection/mapping fails.
> 
> **Overview**
> Fixes AdvancedChart timestamps always rendering in UTC by **detecting
the user’s device timezone**
(`Intl.DateTimeFormat().resolvedOptions().timeZone`) and passing it to
`TradingView.widget` via the `timezone` option.
> 
> Adds a whitelist of TradingView-supported IANA timezone IDs plus a
small canonical-to-TradingView alias map, and **falls back to
`Etc/UTC`** when the device timezone is unsupported or detection throws
(applied in both `chartLogic.js` and the injected
`chartLogicString.ts`).
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
5496398. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!--
Please submit this PR as a draft initially.

Do not mark it as "Ready for review" until this PR meets the canonical
Definition of Ready For Review in `docs/readme/ready-for-review.md`.

In short: the template must be materially complete (not just section
titles
present), all status checks must be currently passing, and the only
expected
follow-up commits must be reviewer-driven.
-->

## **Description**
https://consensyssoftware.atlassian.net/browse/RWDS-1160
Add toast to enable notifications
<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry: Add rewards toast to enable notifications

## **Related issues**

Fixes:

## **Manual testing steps**

```gherkin
Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**
<img width="1179" height="2556" alt="Simulator Screenshot - E2E Test -
2026-05-01 at 11 06 23"
src="https://github.com/user-attachments/assets/8874e05d-48c3-4fce-b4cc-69a4dea9a08f"
/>

<img width="1179" height="2556" alt="Simulator Screenshot - E2E Test -
2026-04-29 at 19 33 52"
src="https://github.com/user-attachments/assets/e4921243-394b-4435-be32-5b83af2c3035"
/>
<img width="1179" height="2556" alt="Simulator Screenshot - E2E Test -
2026-04-29 at 19 41 06"
src="https://github.com/user-attachments/assets/3f25d391-9e73-4cf8-bf16-452008a0dbc4"
/>
<img width="1179" height="2556" alt="Simulator Screenshot - E2E Test -
2026-05-05 at 14 23 53"
src="https://github.com/user-attachments/assets/89ffe7f4-2187-4bae-aa61-2bb6f4d38df1"
/>


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

<!--
Every checklist item must be consciously assessed before marking this PR
as
"Ready for review". A checked box means you deliberately considered that
responsibility, not that you literally performed every action listed.

Unchecked boxes are ambiguous: they are not an implicit "N/A" and they
are not
a silent "skip". See `docs/readme/ready-for-review.md` for the full
checklist
semantics.
-->

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

#### Performance checks (if applicable)

- [x] I've tested on Android
  - Ideally on a mid-range device; emulator is acceptable
- [x] I've tested with a power user scenario
- Use these [power-user
SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93)
to import wallets with many accounts and tokens
- [x] I've instrumented key operations with Sentry traces for production
performance metrics
- See [`trace()`](/app/util/trace.ts) for usage and
[`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274)
for an example

For performance guidelines and tooling, see the [Performance
Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers).

## **Pre-merge reviewer checklist**

<!--
Reviewer checklist items follow the same semantics as the author
checklist: an
unchecked box is ambiguous, a checked box means the reviewer consciously
assessed that responsibility. See `docs/readme/ready-for-review.md`.
-->

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.




<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Medium risk because it adds new notification-enablement flow that
interacts with OS permissions/AppState and changes Rewards navigation
behavior to show/close a session-scoped nudge toast based on nested
routes.
> 
> **Overview**
> Adds a new `useRewardsNotificationsNudge` hook that can show a
persistent “enable notifications” toast, drive the enable flow
(including OS settings redirect on denied permission), and optionally
defer actions until notifications become enabled.
> 
> Integrates the nudge into `RewardsNavigator` so it is shown once per
session when viewing campaign routes and notifications are off, then
explicitly closed when navigating away; also shows a success toast when
notifications become enabled.
> 
> Refactors campaign reminder logic into `useCampaignReminderActions`,
making “Notify me”/reminder subscription conditional on the
notifications feature flag and current notification state, and
updates/rebalances toast styling (`flex-start` alignment) plus
adds/updates tests and new `en.json` strings for the
nudge/loading/success messages.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
1b24e0f. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Rik Van Gulck <vangulckrik@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

> 
> Prevents new file-based Jest snapshots by enabling
jest/no-restricted-matchers for *.test/*.spec files and explicitly
disallowing toMatchSnapshot() (while still permitting
toMatchInlineSnapshot()).
> 
> Adds a targeted override that turns this restriction off for tests
under **/snaps/** and **/Snaps/**, and includes eslint-plugin-jest as a
new devDependency (lockfile updated accordingly).


## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:

## **Related issues**

Fixes:

## **Manual testing steps**

```gherkin
Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I've included tests if applicable
- [ ] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.




<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Adds a new ESLint enforcement that will fail builds for any
remaining/new `toMatchSnapshot()` usage in `*.test`/`*.spec` files,
which could cause unexpected CI failures until all tests comply. Code
changes are otherwise limited to test assertions and dev tooling.
> 
> **Overview**
> **Prevents new file-based Jest snapshots** by enabling
`eslint-plugin-jest` and enforcing `jest/no-restricted-matchers` to
disallow `toMatchSnapshot()` across `*.test`/`*.spec` files, while
explicitly exempting tests under `**/snaps/**` and `**/Snaps/**`.
> 
> Refactors a handful of existing tests (e.g., `BadgeWrapper`, `Main`,
`AssetElement`, `SettingsNotification`, `StyledButton`, `TabCountIcon`,
`Root`) to replace snapshot assertions with targeted
`@testing-library/react-native` queries, and removes the corresponding
snapshot files (including deleting the `TokenImage` snapshot test
entirely).
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
728a801. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!--
Please submit this PR as a draft initially.

Do not mark it as "Ready for review" until this PR meets the canonical
Definition of Ready For Review in `docs/readme/ready-for-review.md`.

In short: the template must be materially complete (not just section
titles
present), all status checks must be currently passing, and the only
expected
follow-up commits must be reviewer-driven.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

Since we're using GH actions fo builds, we can disable the auto
triggered builds on Bitrise.

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:

## **Related issues**

Fixes:

## **Manual testing steps**

```gherkin
Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

<!--
Every checklist item must be consciously assessed before marking this PR
as
"Ready for review". A checked box means you deliberately considered that
responsibility, not that you literally performed every action listed.

Unchecked boxes are ambiguous: they are not an implicit "N/A" and they
are not
a silent "skip". See `docs/readme/ready-for-review.md` for the full
checklist
semantics.
-->

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I've included tests if applicable
- [ ] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

#### Performance checks (if applicable)

- [ ] I've tested on Android
  - Ideally on a mid-range device; emulator is acceptable
- [ ] I've tested with a power user scenario
- Use these [power-user
SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93)
to import wallets with many accounts and tokens
- [ ] I've instrumented key operations with Sentry traces for production
performance metrics
- See [`trace()`](/app/util/trace.ts) for usage and
[`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274)
for an example

For performance guidelines and tooling, see the [Performance
Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers).

## **Pre-merge reviewer checklist**

<!--
Reviewer checklist items follow the same semantics as the author
checklist: an
unchecked box is ambiguous, a checked box means the reviewer consciously
assessed that responsibility. See `docs/readme/ready-for-review.md`.
-->

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Moderate risk because it changes CI trigger behavior: Bitrise will no
longer auto-run Expo dev builds on `main` or create QA builds on
`qa-*`/`v*.*.*` tags, which could impact expected build artifacts and
release workflows.
> 
> **Overview**
> Disables Bitrise auto-triggered Expo/QA builds by commenting out
`trigger_map` entries for `main` (`expo_dev_pipeline`) and tag-based QA
build generation (`qa-*` and `v*.*.*` -> `create_qa_builds_pipeline`).
> 
> Pipelines remain defined, but they will no longer run automatically
from those git events.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
09ca051. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!--
Please submit this PR as a draft initially.

Do not mark it as "Ready for review" until this PR meets the canonical
Definition of Ready For Review in `docs/readme/ready-for-review.md`.

In short: the template must be materially complete (not just section
titles
present), all status checks must be currently passing, and the only
expected
follow-up commits must be reviewer-driven.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

This safeguard is a follow up to catch malformed envs and secrets during
build time to prevent issues similar to incident
[1578](https://consensys.slack.com/archives/C0AUU2AT0C9/p1777390058735369).
If any issues are detected during build time, the `Build Mobile App`
workflow will fail with a message listing the offending value

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:

## **Related issues**

Fixes: https://consensyssoftware.atlassian.net/browse/MCWP-564

## **Manual testing steps**

```gherkin
Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

<!--
Every checklist item must be consciously assessed before marking this PR
as
"Ready for review". A checked box means you deliberately considered that
responsibility, not that you literally performed every action listed.

Unchecked boxes are ambiguous: they are not an implicit "N/A" and they
are not
a silent "skip". See `docs/readme/ready-for-review.md` for the full
checklist
semantics.
-->

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I've included tests if applicable
- [ ] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

#### Performance checks (if applicable)

- [ ] I've tested on Android
  - Ideally on a mid-range device; emulator is acceptable
- [ ] I've tested with a power user scenario
- Use these [power-user
SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93)
to import wallets with many accounts and tokens
- [ ] I've instrumented key operations with Sentry traces for production
performance metrics
- See [`trace()`](/app/util/trace.ts) for usage and
[`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274)
for an example

For performance guidelines and tooling, see the [Performance
Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers).

## **Pre-merge reviewer checklist**

<!--
Reviewer checklist items follow the same semantics as the author
checklist: an
unchecked box is ambiguous, a checked box means the reviewer consciously
assessed that responsibility. See `docs/readme/ready-for-review.md`.
-->

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Tightens CI validation by failing builds on previously-accepted
env/secret values (e.g., trailing newlines/whitespace), which may block
releases if any existing configuration relies on those formats. Risk is
limited to build/CI scripts but impacts all build pipelines consuming
`builds.yml` and GitHub secrets.
> 
> **Overview**
> Adds a shared `checkValue` validator for CI-injected configuration
values, flagging missing/empty values plus common paste artifacts
(leading/trailing whitespace, `\r`/CRLF, NUL/control chars, and
zero-width Unicode) while ensuring error messages never include secret
contents.
> 
> Build-time checks are expanded to run this hygiene validation across
`builds.yml` `env` entries (with a small allowlist for
intentionally-empty keys) and across required secrets in
`validate-secrets-from-config.js`, which now emits GitHub Actions
`::error` annotations and reports all offenders in one pass.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
165a500. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
@pull pull Bot locked and limited conversation to collaborators May 5, 2026
@pull pull Bot added the ⤵️ pull label May 5, 2026
@pull pull Bot merged commit dedb5dd into Reality2byte:main May 5, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

9 participants