Give operators/agents visibility into when the CLI neutralizes suspicious token
metadata in an API response.
- sanitizeForOutputWithCount returns the cleaned value plus the number of altered
strings; sanitizeForOutput kept as a thin wrapper
- printResult prints "[gmgn-cli] Notice: neutralized N suspicious metadata value(s)"
to stderr when anything was filtered (extra detail under GMGN_DEBUG); sanitized
JSON still goes to stdout so piping is unaffected
- document the notice in the gmgn-token SKILL untrusted-data warning
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Address HackenProof report GMGNWM-143, where attacker-controlled token metadata
could hijack an AI agent driving gmgn-cli into executing an unauthorized trade.
Move guardrails from overridable SKILL.md text into code.
- Add src/sanitize.ts: neutralize prompt-injection framing and hidden/control
characters in API output (via printResult) and validate create-token metadata
- Add src/confirm.ts: code-enforced human confirmation for financial writes
(swap, multi-swap, order strategy create, cooking create) — reads a typed
"yes" from /dev/tty; automation requires GMGN_ALLOW_AUTOMATED_TRADES=1 + --yes
- Harden config.ts: tighten ~/.config/gmgn/.env to 0600 and warn if world-readable
- Update SKILL.md files, Readme.md and Readme.zh.md to document the gate,
the --yes flag, and untrusted-metadata handling
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Update hot-searches default-set docs from 4 chains to 5
(sol/bsc/base/eth/robinhood) and fix two stale "7-chain" leftovers.
- skills/gmgn-market/SKILL.md, docs/cli-usage.md: 5-chain default
- src/commands/market.ts: update default-config comment
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add robinhood as a supported chain across the CLI and skills, and stop
advertising chains that are not publicly supported yet.
robinhood:
- validate.ts: add to VALID_CHAINS and treat as EVM for address checks
- reject guards for commands that do not support it: track kol,
track smartmoney, cooking create (mirrors market signal)
- --chain help updated for supported commands (token/portfolio/swap/
market kline·trending·trenches·hot-searches/track follow-*/order get/
gas-price); OpenApiClient chain comment
- docs: all SKILL.md, Readme.md, Readme.zh.md (split-out row for
unsupported commands), cli-usage.md, plugin/marketplace descriptions
disable monad/megaeth/hyperevm/tron:
- comment monad out of VALID_CHAINS (kept for quick re-enable)
- strip these chains from all --chain help, SKILL.md, cli-usage.md
(hot-searches default now 4 chains: sol/bsc/base/eth)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Add --min-*/--max-* range flags to `market hot-searches` (same metric names as
market trending); flatten filter fields onto each param (no nested filter object)
- Document response as long-form RankItem fields (server maps shortcodes); drop the
filter_id field from the documented response shape
- Sync SKILL.md, cli-usage.md, Readme.md, Readme.zh.md, and OpenApiClient types
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Add gmgn-cli config --check: pure local check for GMGN_API_KEY, exit 0 = found, exit 1 = not found
- Update BEFORE RUNNING ANY COMMAND in all 6 SKILL.md files to use --check instead of file path detection
- Add fallback instruction for outdated gmgn-cli versions (unknown option → prompt user to npm install -g gmgn-cli)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- gmgn-cli config: add multi-language guidance (zh-CN/zh-TW/en) based on system locale
- gmgn-cli config --apply <key>: write GMGN_API_KEY + GMGN_PRIVATE_KEY to ~/.config/gmgn/.env and verify via track follow-wallet
- Delete skills/gmgn-config/SKILL.md — all logic now lives in CLI source
- Simplify BEFORE RUNNING ANY COMMAND in all 6 SKILL.md files to two CLI commands, no duplicated text
- Remove stale First-time setup sections (openssl-based) from all 6 SKILL.md files
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add exact fixed messages for link guidance and verification results in
zh-CN, zh-TW, and English. Instruct Agent to output them verbatim in
the user's conversation language without paraphrasing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add skills/gmgn-config/SKILL.md with complete setup flow: key pair
generation, credential writing, and verification via track follow-wallet.
Verification result is output in the user's conversation language.
- Simplify all 6 SKILL.md BEFORE RUNNING ANY COMMAND to one line that
delegates to gmgn-config skill, removing duplicate logic.
- Remove locale detection from CLI — output only the link; Agent handles
all user-facing guidance in the conversation language.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Use node -e to write GMGN_API_KEY and GMGN_PRIVATE_KEY into .env —
node is guaranteed to be present since gmgn-cli requires Node.js.
Also clarify that the same config step applies when the user explicitly
runs gmgn-cli config and sends back an API Key.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace awk+echo with python3+printf to correctly serialize the PEM
private key as a single-line \n-escaped value when writing to .env.
The awk approach produced multi-line output that broke .env parsing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add a new `gmgn-cli config` command that automates Ed25519 key pair
generation for new users. The command reuses an existing keypair.pem if
present, or generates a new one, then outputs a pre-filled API Key
creation link with the public key embedded. Guidance text is output in
the user's system locale (zh-CN, zh-TW, or English).
All 6 SKILL.md files are updated with a BEFORE RUNNING ANY COMMAND
block that detects missing GMGN_API_KEY, triggers gmgn-cli config, and
instructs the Agent to write both GMGN_API_KEY and GMGN_PRIVATE_KEY
into ~/.config/gmgn/.env once the user provides their API Key.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ETH trenches/trending (SKILL.md, cli-usage.md):
- Add per-chain --launchpad-platform value tables incl. ETH for `market trenches`
- Add ETH trenches usage examples (all / new_creation / completed)
- Rename "Trending — ETH (No Platform Filter)" to "Trending — ETH by Launchpad
Platform" and add --platform ETH examples (platform list is now supported)
min_created/max_created units (market trending):
- Clarify that the raw upstream rank interface accepts minutes only; the
openapi-service does NOT forward this field — it evaluates the age window itself
(cutoff = now - duration, native for m/h/d), so 6h/7d work via this CLI.
- Note a bare number with no unit suffix is rejected. Update --help text and
code comment accordingly.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Register dynamic --min-*/--max-* flags on `market trending`, mirroring the
trenches pattern; forwarded as min_<metric>/max_<metric> query params to
/v1/market/rank
- Add RANK_RANGE_FIELDS covering the 18 numeric metrics plus min/max-created
token-age windows (m/h/d duration strings, passed through as-is)
- Document range filters and web-client filter aliases in SKILL.md, cli-usage.md,
Readme.md and Readme.zh.md
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Add eth to TRENCHES_PLATFORMS and TRENCHES_QUOTE_ADDRESS_TYPES
- Allow --chain eth for market trenches
- Document eth platforms in CLI help, SKILL.md, and cli-usage.md
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Add 30s to --resolution help text in market kline command
- Sync SKILL.md argument-hint and parameters table
- Sync docs/cli-usage.md resolution values
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
quote endpoint downgraded to exist auth (API Key only); from_address
no longer needs to match the key's bound wallet. Update all auth
references in cli-usage.md, SKILL.md, and CLAUDE.md.
Add cubepeg, likwid, goplus_creator, goplus_skills, openfour after
four_xmode_agent; add flap_stocks and flap_aioracle after flap.
Updates both TRENCHES_PLATFORMS defaults and SKILL.md examples.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Correct mkt_bps: it's the tax-recipient share (X handle in gift mode or
split_conf addresses in split mode), not a generic "marketing" fund
- Make twitter_account / split_conf conditional-required based on recipient_type
instead of always required
- Add two end-to-end Flap examples (split mode → BSC address, gift mode → X handle)
- Merge "Full worked examples" into the Usage Examples section
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The interval_seconds param is no longer used. Removed from the CLI
option, params assembly, CreateTokenParams, SKILL.md and cli-usage.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds `track follow-token-groups` command that calls
GET /v1/user/follow_token_groups to retrieve a wallet's token follow
group names (id, name, rank) for a given chain.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Update Readme.md, Readme.zh.md, src/commands/swap.ts and cooking.ts
with integer 0–100 slippage examples (e.g. 30 = 30%) to match the
updated API validation and skill docs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Correct the --anti-mev-mode enum to off / normal / secure
(across cooking.ts, SKILL.md, cli-usage.md, and the TradeParam examples).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The pump_fee_share_list `provider` field rejected "wallet" with
"unknown provider: wallet". Valid values are solana / twitter / github.
- OpenApiClient: update PumpFeeShareInfo provider comment
- SKILL.md / cli-usage.md: provider enum solana / twitter / github,
username is a SOL address when provider = solana
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Rename transfer_in/transfer_out → transferIn/transferOut in portfolio activity --type filter
- Update SKILL.md and portfolio.ts help text to reflect new enum values
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Address review feedback on PR #148: cooking stats uses exist auth
(authExistRequest), matching the CLI client and project terminology.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add full sub-tables for list[], condition_orders[], order_statistic,
and sell_param objects in the `order strategy list` response section.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Align CLI with server-side breaking change: GET /v1/user/wallet_holdings
was upgraded from authExistMW to authCriticalMW on the openapi-service.
- OpenApiClient: switch getWalletHoldings to authSignedRequest
- SKILL.md: split rate-limit table by auth level; update Notes section
- CLAUDE.md: move portfolio holdings from Normal to Critical auth row
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add usage context to fee_distribution section so agents know to use
token info when querying claim status and royalty allocation
- Fix incorrect Note that said trading volume is not in token info;
price.volume_{window}, buys_{window}, sells_{window}, swaps_{window}
are all available in the token info price object
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
David Lau