A shared todo list for a team

[xilosada]

Publish com.calimero-studio.test.team-todo4@0.1.0

---

Note

Medium Risk
Mostly new app and test scaffolding, but it introduces automated node bootstrap/auth flows that hit merod admin/auth APIs and manage local processes, which can be brittle in CI and dev environments.

Overview
Implements a new team-shared todo list app: Vite/React frontend wiring (App.tsx, config.ts, TaskListView.tsx, useTaskList.ts) that creates/edits/completes/deletes tasks and filters by All/Pending/Done, enforcing edit/delete visibility by task ownership.

Adds tooling and tests: generated ABI clients (notably TodoClient) plus Playwright E2E specs and a global setup/teardown that boots 1–3 local merod nodes (embedded auth), installs the built .mpk, authenticates, and runs multi-node sync scenarios. Also updates repo hygiene/config with expanded .gitignore, .nvmrc, and scripts for ABI codegen and bundle install.

^{Reviewed by Cursor Bugbot for commit 750b14f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
workshop-apps	Ready	Preview, Comment	May 19, 2026 8:46am

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

Bugbot Autofix prepared fixes for all 3 issues found in the latest run.

• ✅ Fixed: Wrong package name in .env overrides correct config
  • Removed the incorrect VITE_PACKAGE_NAME=com.calimero.chat from .env so APP_PACKAGE from studio.config.json is now used.
• ✅ Fixed: Variable named Base58 but encoded as base64
  • Renamed variable from publicKeyBase58 to publicKeyBase64 to accurately reflect the base64 encoding being used.
• ✅ Fixed: formatTime incorrectly divides millisecond timestamps by 1M
  • Removed the division by 1,000,000 since message.timestamp_ms is already in milliseconds as the interface indicates.

Or push these changes by commenting:

@cursor push 44e5903ad7

Preview (44e5903ad7)

diff --git a/app/.env b/app/.env
--- a/app/.env
+++ b/app/.env
@@ -1 +1,0 @@
-VITE_PACKAGE_NAME=com.calimero.chat
\ No newline at end of file

diff --git a/app/e2e/global-setup.ts b/app/e2e/global-setup.ts
--- a/app/e2e/global-setup.ts
+++ b/app/e2e/global-setup.ts
@@ -76,14 +76,14 @@
   refreshToken: string;
 }> {
   const keypair = nacl.sign.keyPair();
-  const publicKeyBase58 = Buffer.from(keypair.publicKey).toString('base64');
+  const publicKeyBase64 = Buffer.from(keypair.publicKey).toString('base64');
 
   const resp = await fetch(`${adminUrl}/auth/token`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({
       auth_method: 'user_password',
-      public_key: publicKeyBase58,
+      public_key: publicKeyBase64,
       client_name: 'playwright-e2e',
       timestamp: Date.now(),
       permissions: ['context:create', 'context:list', 'context:execute', 'admin:*'],

diff --git a/app/src/components/MessageBubble.tsx b/app/src/components/MessageBubble.tsx
--- a/app/src/components/MessageBubble.tsx
+++ b/app/src/components/MessageBubble.tsx
@@ -8,9 +8,8 @@
   onDelete: () => Promise<void>;
 }
 
-function formatTime(timestampNs: number): string {
-  // Calimero timestamps are nanoseconds; Date expects milliseconds
-  const d = new Date(timestampNs / 1_000_000);
+function formatTime(timestampMs: number): string {
+  const d = new Date(timestampMs);
   return d.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' });
 }

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 623aed0. Configure here.}

[cursor]

Wrong package name in .env overrides correct config

High Severity

The .env file sets VITE_PACKAGE_NAME=com.calimero.chat but studio.config.json declares the correct package as com.calimero-studio.test.team-todo4. In App.tsx, the env variable takes priority over APP_PACKAGE from config, so MeroProvider will be configured with the wrong chat package name instead of the todo package, causing the app to fail to connect to the correct backend.

Additional Locations (1)

• app/src/App.tsx#L11-L13

 

^{Reviewed by Cursor Bugbot for commit 623aed0. Configure here.}

[cursor]

Variable named Base58 but encoded as base64

Medium Severity

The variable publicKeyBase58 is encoded using .toString('base64') instead of base58. If the auth endpoint expects base58-encoded keys (as the variable name strongly implies), authentication will fail or produce incorrect identity bindings. Base58 and base64 are incompatible encodings.

 

^{Reviewed by Cursor Bugbot for commit 623aed0. Configure here.}

[cursor]

formatTime incorrectly divides millisecond timestamps by 1M

Medium Severity

The formatTime function divides by 1,000,000 assuming nanosecond input, but it receives message.timestamp_ms which the Message interface defines as timestamp_ms (milliseconds). Dividing a millisecond timestamp by 1M produces dates near the Unix epoch (January 1970), showing completely wrong times.

 

^{Reviewed by Cursor Bugbot for commit 623aed0. Configure here.}