fix: catch formatUsdcMicro throw in ActivityTicker for malformed amounts

[toon-backlog-bot]

Summary

• Wraps the formatUsdcMicro(claim.amount, claim.assetScale) call in ActivityTicker with a try/catch that renders '$?.????' on error.

Root cause

formatUsdcMicro throws in NODE_ENV=test (and development) when given a malformed amount string — this is an intentional fail-fast behavior. ActivityTicker called it without any error handling, so Ink's error boundary caught the throw and rendered an empty frame ('\n'). The test malformed amount renders formatUsdcMicro fallback correctly asserts the production fallback string $?.???? appears, but it was unreachable in the test environment.

Fix

Added try/catch in ActivityTicker so it degrades gracefully to $?.???? in all environments, matching the production contract the test asserts. The fail-fast behavior of formatUsdcMicro itself is preserved for direct callers.

Verification

vitest run src/tui/components/ActivityTicker.test.tsx
# ✓ 9/9 tests pass (including malformed amount renders formatUsdcMicro fallback)

vitest run src/tui
# ✓ 126/126 TUI tests pass

Plan deviation

None — the Agent Assessment directed us to find and fix the regression; the root cause analysis in the issue comments identified the contract conflict and this is the component-side fix (option 2 from the analysis).

Closes #12

[ALLiDoizCode]

Adversarial Review — Request Changes

Blocking: ActivityOverlay has the identical uncaught call site — fix is incomplete

The PR fixes ActivityTicker.tsx:34 but leaves ActivityOverlay.tsx:41 in the same broken state:

// ActivityOverlay.tsx — formatRow() — NO try/catch
const amount = formatUsdcMicro(claim.amount, claim.assetScale);

In test / development, formatUsdcMicro throws for malformed amounts (by design). ActivityOverlay calls it bare inside formatRow, which is called for every visible row. Any malformed claim amount in the overlay still crashes the component (Ink error-boundary swallows it to an empty frame, exactly the symptom described in the PR). There is no test in ActivityOverlay.test.tsx covering malformed amounts, so it will silently regress again.

Required fix: apply the same try/catch pattern (or export the fallback constant and guard the call) inside formatRow in ActivityOverlay.tsx.

---

Non-blocking: Duplicated fallback string '$?.????'

format.ts:31 returns '$?.????' on the production path; ActivityTicker.tsx:36 now also hardcodes '$?.????' in the catch block. Two copies of a magic string in two files — if the fallback string ever changes in format.ts, ActivityTicker silently drifts. Export a named constant (USDC_MICRO_FALLBACK or similar) from format.ts and reference it in both the function body and the catch block. Same fix should apply to the formatUsdc / '$?.??' fallback when its call sites get the same treatment.

---

What was checked

• Full diff of ActivityTicker.tsx
• format.ts — formatUsdcMicro fail-fast logic (throws in test/dev, returns fallback in prod)
• format.test.ts:87-90 — correctly overrides NODE_ENV='production' to test the return path; test suite is self-consistent
• ActivityOverlay.tsx:41 — identical unguarded call, confirmed no malformed-amount test in ActivityOverlay.test.tsx
• ActivityTicker.test.tsx:107-115 — the targeted test, now reachable and correct after the fix
• All 9 assertions in ActivityTicker.test.tsx verified as logically sound

The ActivityTicker change itself is correct; the problem is incompleteness.

[toon-backlog-bot]

Fix-loop response (review-round:1)

Addressed both review points in commit 728d7c4.

Blocking — ActivityOverlay unguarded call site

Applied the same try/catch pattern to formatRow() in ActivityOverlay.tsx:

let amount: string;
try {
  amount = formatUsdcMicro(claim.amount, claim.assetScale);
} catch {
  amount = USDC_MICRO_FALLBACK;
}

Also added a malformed-amount test to ActivityOverlay.test.tsx so this path won't silently regress again:

it('malformed amount renders USDC_MICRO_FALLBACK (no crash)', () => {
  const claim = makeClaim({ amount: 'bad' });
  // ... expects '$?.????'
});

Non-blocking — duplicated fallback string

Exported USDC_MICRO_FALLBACK = '$?.????' as a named constant from format.ts and replaced both the inline return in formatUsdcMicro and the catch-block literals in ActivityTicker and ActivityOverlay with a reference to the constant.

Verification

cd packages/townhouse && vitest run src/tui
# ✓ 127/127 tests pass (14 in ActivityOverlay.test.tsx, 9 in ActivityTicker.test.tsx)

[ALLiDoizCode]

Review findings

The fix for ActivityTicker and ActivityOverlay is correct and the constant extraction is a good refactor. However, the same vulnerability exists in at least two other components that this PR leaves unaddressed — and one of them has an actively fragile test workaround that makes the gap visible.

---

Blocking: incomplete fix — ApexStrip and PeerTable have the same vulnerability

ApexStrip.tsx:37 calls formatUsdc(apexMonth, USDC_SCALE) where apexMonth can be a non-decimal string from wire data (apex.routingFees[ASSET]?.month ?? '0'). formatUsdc has exactly the same fail-fast behaviour as formatUsdcMicro: throws in NODE_ENV=test|development, returns '$?.??' in production.

The evidence that this is the same bug: ApexStrip.test.tsx:86–99 works around it by temporarily mutating process.env['NODE_ENV'] to 'production' before rendering with malformed input, then restoring it in finally. That workaround exists for the same reason this PR was opened — the component is called without try/catch and the formatter throws in the test environment.

// ApexStrip.test.tsx:83–100
it('renders no upsell and no percentage when apex.month is malformed (production fallback)', () => {
  const origEnv = process.env['NODE_ENV'];
  process.env['NODE_ENV'] = 'production';   // ← same workaround as was needed for ActivityTicker
  try { ... } finally { process.env['NODE_ENV'] = origEnv; }
});

PeerTable.tsx:86 similarly calls formatUsdc(row.perAsset.month, USDC_SCALE) inside a .map() with no try/catch, where row.perAsset.month comes from wire data.

HeroBand.tsx:87–90 calls formatUsdc four times. Here the values come from computeScalars (BigInt arithmetic), so the inputs are likely always valid — but this should be confirmed rather than assumed.

---

Minor (non-blocking, should be addressed in the same pass)

The new test in ActivityOverlay.test.tsx:203 uses the hardcoded string '$?.????' instead of the exported USDC_MICRO_FALLBACK constant. The whole point of extracting and exporting that constant was so call sites (including tests) don't silently diverge if the fallback string ever changes. The existing ActivityTicker.test.tsx:114 has the same issue — worth fixing both while touching these files.

---

What's correct

• The ActivityTicker try/catch is the right fix, correctly applied.
• The ActivityOverlay extension (not in the original issue) was a good catch.
• USDC_MICRO_FALLBACK as a named export is the right refactor.
• The new overlay test correctly verifies the no-crash contract.

Please apply the same try/catch pattern to ApexStrip and PeerTable, delete the NODE_ENV=production workaround from ApexStrip.test.tsx (replacing it with the same malformed-amount approach used in the new overlay test), and import USDC_MICRO_FALLBACK in the tests that assert on it.

[ALLiDoizCode]

Review findings — requesting changes

Blocking: pnpm-lock.yaml contains unannounced, unrelated dependency upgrades

The PR description covers only the TUI try/catch fix, but the lock file includes a batch of dependency changes with no mention in the summary or context:

• viem 2.47.2 → 2.52.2 — five minor versions forward on a core EVM/wallet library used by hub-web. Not mentioned anywhere.
• readable-stream 3.6.2 → 4.7.0 — a major version bump on a Node.js I/O primitive. Major bumps can have breaking changes (stream API surface changed significantly between v3 and v4).
• ws reshuffled between 8.20.0 and 8.21.0 with optional-peer resolution changes.
• bn.js 5.2.2 → 5.2.3, debug 4.3.4 → 4.4.3, @babel/runtime 7.28.6 → 7.29.7, nostr-tools 2.23.1 → 2.23.5, semver 7.7.4 → 7.8.4, ox 0.14.0 → 0.14.29.

These changes also re-sync the specifier fields for @toon-protocol/{client,core,relay,sdk} from ^0.9.2/^1.4.2/^1.3.2/^0.5.1 down to ^0.9.1/^1.4.1/^1.3.1/^0.5.0 (matching the current package.json), suggesting the lock file was regenerated from scratch rather than updated minimally.

Each dependency change needs its own CI validation and rollback surface. Mixing them into a TUI formatting fix makes the diff unauditable and the rollback unit too coarse. Please split into a separate "chore: update dependencies" PR, or at minimum add them to the PR description with rationale and confirm CI passes on hub-web/wallet flows that depend on viem.

---

Blocking: HeroBand.tsx — single try/catch silently corrupts valid sibling values

// packages/townhouse/src/tui/components/HeroBand.tsx lines 93-103
try {
  todayFmt = formatUsdc(scalars.today, USDC_SCALE);
  monthFmt = formatUsdc(scalars.month, USDC_SCALE);
  yearFmt = formatUsdc(scalars.year, USDC_SCALE);
  lifetimeFmt = formatUsdc(scalars.lifetime, USDC_SCALE);
} catch {
  todayFmt = USDC_FALLBACK;
  monthFmt = USDC_FALLBACK;
  yearFmt = USDC_FALLBACK;
  lifetimeFmt = USDC_FALLBACK;
}

If formatUsdc(scalars.today, ...) throws (in dev/test environments formatUsdc throws for malformed input per format.ts:59-62), the remaining three calls never execute and month, year, lifetime are silently corrupted to USDC_FALLBACK even though their values may be perfectly valid.

The other four components affected by this PR (ActivityTicker, ActivityOverlay, ApexStrip, PeerTable) each wrap a single format call, so they're correctly scoped. Only HeroBand has this multi-value granularity problem.

The comment acknowledges computeScalars always yields valid decimal strings via BigInt arithmetic, but the stated purpose of the guard is "forward-compatibility" — so the guard should correctly scope to individual values. Each format call needs its own try/catch:

const safeFmt = (s: string) => { try { return formatUsdc(s, USDC_SCALE); } catch { return USDC_FALLBACK; } };
const todayFmt    = safeFmt(scalars.today);
const monthFmt    = safeFmt(scalars.month);
const yearFmt     = safeFmt(scalars.year);
const lifetimeFmt = safeFmt(scalars.lifetime);

There is no test covering the case where exactly one of the four scalars is malformed, so this bug is currently invisible.

---

Non-blocking observations (no changes required)

• The constant extraction (USDC_MICRO_FALLBACK, USDC_FALLBACK) is clean and the test updates to reference these constants instead of inline literals are correct.
• ActivityTicker, ActivityOverlay, ApexStrip, and PeerTable try/catch blocks are correctly scoped to single format calls.
• The ApexStrip test rewrite (removing the NODE_ENV=production env manipulation) is a genuine improvement — the component-level catch makes the env toggle unnecessary.
• HeroBand is missing a test covering the malformed-scalar fallback path; the fix for the granularity issue above should be paired with one.