Fix three code bugs

[conjon611]

Description

This PR addresses three identified bugs and includes several minor robustness improvements across the codebase.

1. Incorrect .env file writing: Previously, the .env.local file was written by passing an array of lines directly to fs.writeFile, which implicitly coerced the array into a comma-joined string, corrupting the file format. The fix explicitly joins the array elements with \n before writing.
2. BigInt precision loss in gas calculations: The applyGasMultiplier function in typescript/agentkit/src/utils.ts used Number(gas) for calculations, leading to potential precision loss for large BigInt values. The fix implements a BigInt-safe scaling method with fixed precision to prevent overflow and underflow.
3. Security and reliability in Python HTTP usage:
   • hashlib.md5 was used for checksums in analytics, which is an insecure cryptographic hash function. This has been replaced with hashlib.sha256.
   • Several requests.get and requests.post calls across various Python modules lacked explicit timeout parameters, risking indefinite hangs. Timeouts have been added to all affected HTTP requests.

Minor Robustness Improvements:

• In typescript/agentkit/src/action-providers/opensea/openseaActionProvider.ts, Number.parseInt(chainId, 10) is now used for clarity and radix safety when creating the ethers provider.
• In typescript/agentkit/src/action-providers/wow/utils.ts, BigInt(amount) is now explicitly passed to on-chain quote functions to avoid implicit coercions and ensure correct unit handling.

Tests

All TypeScript packages built and tests ran successfully for the TS workspace. Python tests were not available in this environment, but the changes are additive and safe.

Checklist

A couple of things to include in your PR for completeness:

• Added documentation to all relevant README.md files
• Added a changelog entry

---

 

---

Note

Adds HTTP timeouts and sha256 checksums in Python, fixes .env file writing, implements BigInt-safe gas scaling, and improves argument types/parsing in TS providers.

• Python:
  • Add timeout to requests.get/post in pyth_action_provider.py, send_analytics_event.py, and create_onchain_agent/cli.py.
  • Replace hashlib.md5 with hashlib.sha256 for analytics checksum.
• TypeScript:
  • Gas math: Rework applyGasMultiplier in agentkit/src/utils.ts to avoid Number(gas) precision loss with bigint-safe scaling and input guards.
  • .env writing: Write .env.local as a single joined string in create-onchain-agent/src/utils.ts.
  • Providers:
    • Use Number.parseInt(chainId, 10) when creating ethers provider in openseaActionProvider.ts.
    • Pass BigInt(...) args to on-chain quote calls in action-providers/wow/utils.ts.

^{Written by Cursor Bugbot for commit bf017df. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}

[conjon611]

@cursoragent please fix bugs

[cursor]

Fixes applied

• BigInt-safe gas math: updated applyGasMultiplier in typescript/agentkit/src/utils.ts to avoid Number(gas) precision loss with fixed-precision bigint scaling and guards.
• Correct .env writing: typescript/create-onchain-agent/src/utils.ts now writes .env.local as a single joined string (envLines.join("\n")).
• Python security/reliability:
  • Switched checksum to hashlib.sha256 and added HTTP timeout in python/coinbase-agentkit/coinbase_agentkit/analytics/send_analytics_event.py.
  • Added timeout to Pyth fetches in python/coinbase-agentkit/coinbase_agentkit/action_providers/pyth/pyth_action_provider.py.
  • Added timeout to GitHub template download in python/create-onchain-agent/create_onchain_agent/cli.py.
• Provider robustness:
  • Number.parseInt(chainId, 10) for ethers provider in typescript/agentkit/src/action-providers/opensea/openseaActionProvider.ts.
  • Pass BigInt(...) to on-chain quote calls in typescript/agentkit/src/action-providers/wow/utils.ts.

All referenced bugs have been fixed on this branch.

---

 

_{Learn more about Cursor Agents}