Prediction markets prototype: side menu entry, market list and details scenes

[j0ntz]

Technical Design Document

prediction-markets-prototype.md

CHANGELOG

Does this branch warrant an entry to the CHANGELOG?

• Yes
• No

Dependencies

none

Requirements

If you have made any visual changes to the GUI. Make sure you have:

• Tested on iOS device
• Tested on Android device
• Tested on small-screen device (iPod Touch)
• Tested on large-screen device (tablet)

Description

Prototype for the Prediction Markets task (Asana task).

Adds a Prediction Markets side menu entry and two new scenes backed by the Slipstream Connect API (https://github.com/tylerthebuildor/slipstream-example):

• List scene: category tabs (sports, crypto, macro, politics), one card per cross-venue market cluster comparing each venue's best ask, best-priced venue highlighted.
• Details scene: per-venue bid/ask, merged order book top levels, and per-venue market metadata with links out to the venue pages.
• Typed cleaners + fetch client under src/plugins/prediction-markets/, optional API key at ENV.PLUGIN_API_KEYS.slipstream (phaze precedent).
• With no API key configured (the normal state for now), the scenes run on a bundled sample dataset behind a visible banner, so the prototype is fully browsable on any build.

Review hardening (from Cursor Bugbot / Security Reviewer findings, all addressed): shared best-ask helper so both scenes highlight the same venue, an https + venue-host allowlist (userinfo rejected) before any leg URL opens, asBiggystring cleaners on all numeric fields, red asks in the order book, and the list keeps last-good data when a background refetch fails.

Read-only scope: no trading, balances, or positions; the design doc records the rationale and the deferred trade-flow phase.

---

Note

Medium Risk
Introduces a new user-facing flow that fetches untrusted API JSON and opens external URLs; mitigations include cleaners, asBiggystring, and venue URL allowlisting, but the prototype still uses a client-side API key from env like other plugin keys.

Overview
Adds a Prediction Markets side menu entry and logged-in stack routes for a read-only prototype: browse cross-venue market clusters from the Slipstream Connect API.

The list scene uses category tabs (sports, crypto, macro, politics), TanStack Query, and cards that compare each venue’s best ask with the best venue highlighted. The details scene shows per-venue bid/ask, a merged order book, and leg metadata; venue links open in the browser only when isSafeVenueUrl passes an https host allowlist.

New code lives under src/plugins/prediction-markets/ (cleaners, fetchPredictionMarkets, bundled sample data). Optional ENV.PLUGIN_API_KEYS.slipstream enables live GET /connect/markets/{category}; without a key, sample data is shown behind a warning banner. Trading, balances, and positions are intentionally out of scope.

^{Reviewed by Cursor Bugbot for commit 0cb837b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[j0ntz]

📸 Test evidence

side menu entry

market list sports

market list crypto

market details

Captured by the agent's in-app test run (build-and-test).

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[j0ntz]

📸 Test evidence (after fix)

market details after fix

Captured by the agent's in-app test run (build-and-test).

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c8baf0f. Configure here.}