src/config.ts loaded ~/.config/gmgn/.env with override:true and then the
cwd .env without override, so the global file always won — the opposite
of what Readme, Readme.zh, CLAUDE.md and the gmgn-cooking skill promise.
A user who updated GMGN_PRIVATE_KEY in a project .env kept signing with
the stale global key and got AUTH_SIGNATURE_INVALID.
Load the cwd .env first and the global file second, both without
override, so precedence is shell env > project .env > global .env.
`config --check` reuses the same loader instead of its own copy.
Co-Authored-By: Claude <noreply@anthropic.com>
gmgn-openapi-service no longer clamps priority_fee / tip_fee / gas_price /
max_fee_per_gas / max_priority_fee_per_gas to per-chain min/max (openapi MR
!114, merged 2026-10-19). Fees are forwarded as-is and the trade backend
enforces its global ceilings; the server only rejects non-numeric or
negative values, plus BSC "0" for the EIP-1559 fields.
Remove the stale "≥ X" / "Clamped per chain minimums" wording from swap.ts
option help, gmgn-swap and gmgn-cooking SKILL.md, and docs/cli-usage.md, and
replace the gmgn-swap "EIP-1559 minimum values" note with the current rules.
Co-Authored-By: Claude <noreply@anthropic.com>
Align with the server-side default (gmgn-openapi-service trenchesDefaults["robinhood"].QuoteAddressType)
that went live in July. Without it, default trenches queries on robinhood miss tokens paired
with quote type 26 (RWA pools).
Co-Authored-By: Claude <noreply@anthropic.com>
gmgn-openapi-service already exposes two read-only call-out routes on
openapi.gmgn.ai behind the normal API-key auth, so the CLI can reach them
without the separate papi AK/SK channel:
- gmgn-cli callout record -> POST /v1/callout/get_record: one wallet's
call-outs over the last 30 days plus the 7d/30d summary card
- gmgn-cli callout global -> POST /v1/callout/global: multi-chain feed with
only-kol / only-declaration / only-safe / holding-range filters
Both are weight 3. Chains are validated against the service's 13-chain
callout list, kept separate from the tradable VALID_CHAINS. Limit is checked
against the service's 0-50 bound; holding bounds are sent as decimal
strings. /v1/callout/token is deliberately left out: the service removed it
(prod returns 404) and publishing call-outs is not part of OpenAPI.
Docs: new skills/gmgn-callout/SKILL.md, CLI reference in docs/cli-usage.md
and both Readmes, routing rows in CLAUDE.md.
Co-Authored-By: Claude <noreply@anthropic.com>
The OpenAPI service now returns two new rate-limit codes:
- RATE_LIMIT_BANNED_MAX (429): the ban has reached its 5-minute ceiling
because requests kept arriving during the cooldown. The CLI now says to
stop all requests until reset_at instead of the generic retry hint.
- PLAN_UPGRADE_REQUIRED (403): the route's weight exceeds the plan's bucket
capacity (e.g. Free on swap / quote / follow-wallet), so it can never
succeed. The CLI surfaces the upgrade message; previously 403s were
printed without it.
Skills and docs/cli-usage.md tell agents not to retry either code, and the
stale rate=10/capacity=10 note is replaced by the plan tiers.
Co-Authored-By: Claude <noreply@anthropic.com>
- Escape every non-visible character in the confirmation block by Unicode
property (\p{C}, \p{Z}, \p{M}, Default_Ignorable_Code_Point, U+2800) instead
of a hand-kept list; soft hyphens, Hangul fillers, tag characters etc. can no
longer make a fee-share username look like another.
- Fold only fields a command declares as blobs (cooking --image); key fields
are always shown in full. multi-swap and strategy create/cancel now validate
their addresses like swap does.
- Judge protections on the values being sent (min_output 0, anti_mev_mode off,
expire_in 0 now warn), and reject NaN / Infinity / negative --slippage,
--percent, --expire-in, --dev-wallet-bps before they reach a signed body.
--gas-price is converted gwei→wei exactly (was float-rounded).
- Total tip / priority fees per container, including sell_param / buy_param and
buy_trade_config / sell_trade_config, so section ① no longer understates.
- Anti-MEV warning only where accurate: none for swap (documented default on),
"server default applies" for multi-swap / strategy on sol / bsc / eth, and
an explicit "off" warning for cooking create on sol.
- Bind confirmations to method + route + query + body, and require one for
every signed non-GET request (deny by default) instead of a path allowlist.
- In interactive mode write the block to /dev/tty, so the process launcher
cannot filter what the human reads before typing yes.
- Display: swap --percent shows the bps line first and marks input_amount as
ignored; strategy amount_in_percent and multi-swap per-wallet bps show "% of
balance"; multi-swap shows the wallet count.
- Group risky leaves in linear time; load credentials before confirmation so a
missing key is reported before the user types yes.
- Sync skills/gmgn-swap, skills/gmgn-cooking and docs/cli-usage.md with the
gated order strategy cancel and its --yes flag.
Co-Authored-By: Claude <noreply@anthropic.com>
The confirmation prompt for swap / multi-swap / order strategy create /
cooking create printed a hand-written summary that omitted fields still sent
and signed: tip / priority fees, gas, min_output_amount, condition_orders
(auto TP/SL), check_price, sell_param / buy_param, buy_wallets,
snip_buy_wallets, dev_wallet_bps and the creator fee-share lists. A
prompt-injected agent could hide any of them behind a normal-looking summary.
Layer 1 - confirmTrade now takes the request object itself, flattens it to
every leaf field and prints four sections: key fields; risky fields, each
with a plain-language consequence and never folded; protections that are NOT
set (no min output, no slippage limit, anti-MEV not requested, no expiry);
and every remaining field. Section 4 is "whatever 1-3 did not print", so new
parameters appear automatically. Long strings (e.g. --image base64) fold to
<string, size, sha256>, gas_price is echoed in gwei, and command-side totals
are added (extra fees, total buy spend across dev / bundle / snipe wallets,
creator-fee recipients). Control, C1, bidi and zero-width characters are
escaped so a value cannot rewrite or hide lines.
Layer 2 - confirmTrade records the canonical-JSON sha256 of the confirmed
body; authSignedRequest refuses to sign swap, multi_swap, strategy/create,
strategy/cancel and create_token unless the exact body being signed was
confirmed, consuming the confirmation so it authorizes one signature. This
blocks a new command that forgets confirmTrade and a body mutated after
confirmation.
Layer 3 - order strategy cancel gets the same gate and --yes flag; cooking
create JSON options fail with a clear error instead of a raw SyntaxError;
Readme / Readme.zh now state the confirmation block is the complete request
body about to be signed.
Co-Authored-By: Claude <noreply@anthropic.com>
The CLI docs promised behavior the API does not deliver:
- --limit: was "max 80 (default 80)". In reality it is best-effort only —
the new_creation category is served from a fixed live window (~60), so
larger and smaller --limit values both tend to return ~60. Documented as
best-effort.
- --launchpad-platform: was "default: all platforms for the chain". In
reality, when omitted the server injects a fixed per-chain default
allow-list (not literally all platforms), and passing values REPLACES that
allow-list (fewer platforms => less data). Platforms outside the list
(incl. some newer RWA / tokenized-stock launchpads) are filtered out.
- Added the previously-missing robinhood platform slug list, and noted that
arc/stable apply no launchpad filter (all platforms).
Docs only; no code change.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Document the new `market search` command backed by the openapi-service
`GET /v1/market/search` endpoint (search_v3). Covers parameters, the
coins/wallets response shape, usage examples, and output format, plus
updates to the frontmatter, sub-commands table, supported chains note,
rate-limit table, and Notes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
