1.2.6

fix(track): switch follow-wallet to critical auth (fix HTTP 401 AUTH_INVALID)

CLAUDE.md

@@ -93,8 +93,8 @@ EOF
 
 | Mode | Commands | Requirements |
 |------|----------|--------------|
-| Normal | token / market / portfolio | `GMGN_API_KEY` only, no signature |
-| Critical | swap / order | `GMGN_API_KEY` + `GMGN_PRIVATE_KEY` — CLI handles signing automatically |
+| Normal | token / market / portfolio / track kol / track smartmoney | `GMGN_API_KEY` only, no signature |
+| Critical | swap / order / track follow-wallet | `GMGN_API_KEY` + `GMGN_PRIVATE_KEY` — CLI handles signing automatically |
 
 ## SKILL.md Authoring Rules
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "gmgn-cli",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "gmgn-cli",
-      "version": "1.2.5",
+      "version": "1.2.6",
       "license": "MIT",
       "dependencies": {
         "commander": "^12.1.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "gmgn-cli",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "GMGN OpenAPI CLI — call GMGN market, token, portfolio and swap APIs from the command line",
   "type": "module",
   "bin": {

skills/gmgn-market/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: gmgn-market
 description: Get crypto and meme token price charts (K-line, candlestick, OHLCV), trending meme coin rankings by volume, and newly launched tokens on launchpads (pump.fun, fourmeme, letsbonk, Raydium, etc.) via GMGN API on Solana, BSC, or Base. Use when user asks for price chart, trending tokens, what's pumping, hot coins, new launches, token signals, or wants to discover early-stage opportunities.
-argument-hint: "kline --chain <sol|bsc|base> --address <token_address> --resolution <1m|5m|15m|1h|4h|1d> [--from <unix_ts>] [--to <unix_ts>] | trending --chain <sol|bsc|base> --interval <1m|5m|1h|6h|24h> | trenches --chain <sol|bsc|base> | signal --chain <sol|bsc>""
+argument-hint: "kline --chain <sol|bsc|base> --address <token_address> --resolution <1m|5m|15m|1h|4h|1d> [--from <unix_ts>] [--to <unix_ts>] | trending --chain <sol|bsc|base> --interval <1m|5m|1h|6h|24h> | trenches --chain <sol|bsc|base> | signal --chain <sol|bsc>"
 metadata:
   cliHelp: "gmgn-cli market --help"
 ---
@@ -817,6 +817,8 @@ Chains: `sol` / `bsc` only. **Maximum 50 results per group** — use multiple gr
 
 **Single-group (individual flags):**
 
+Do **not** pass signal types **14, 15, or 16** in `signal_type` / `--signal-type` / `--groups` JSON — OpenAPI returns **400** if any group includes them. Omitting `--signal-type` (empty filter) still queries all types upstream; responses may still include 14–16 in that case.
+
 | Option | Required | Description |
 |--------|----------|-------------|
 | `--chain` | Yes | `sol` / `bsc` |
@@ -836,7 +838,7 @@ Pass `--groups '<json_array>'` to query multiple filter groups in a single reque
 
 ```bash
 gmgn-cli market signal --chain sol \
-  --groups '[{"signal_type":[12,14]},{"signal_type":[6,7],"mc_min":50000}]'
+  --groups '[{"signal_type":[12,13]},{"signal_type":[6,7],"mc_min":50000}]'
 ```
 
 ### Signal Types
@@ -892,7 +894,7 @@ Each item in the response array is one signal event:
 ### Usage Examples
 
 ```bash
-# All signals on SOL (default: all types)
+# All signals on SOL (no --signal-type: upstream returns all types, including 14–16 if present)
 gmgn-cli market signal --chain sol --raw
 
 # Smart money buys only (type 12)
@@ -906,13 +908,13 @@ gmgn-cli market signal --chain sol \
 # Smart money buys on BSC
 gmgn-cli market signal --chain bsc --signal-type 12 --raw
 
-# Multi-group: smart money buys OR large amount buys, in parallel
+# Multi-group: parallel groups (do not use signal_type 14–16 — API returns 400)
 gmgn-cli market signal --chain sol \
-  --groups '[{"signal_type":[12]},{"signal_type":[14,16]}]' --raw
+  --groups '[{"signal_type":[12]},{"signal_type":[6,7]}]' --raw
 
 # Multi-group: combine signal type filter with market cap range per group
 gmgn-cli market signal --chain sol \
-  --groups '[{"signal_type":[12,14],"mc_min":100000},{"signal_type":[6,7],"mc_min":50000,"mc_max":1000000}]' --raw
+  --groups '[{"signal_type":[12,13],"mc_min":100000},{"signal_type":[6,7],"mc_min":50000,"mc_max":1000000}]' --raw
 ```
 
 ---

skills/gmgn-track/SKILL.md

@@ -60,7 +60,8 @@ Use the `gmgn-cli` tool to query on-chain tracking data based on the user's requ
 ## Prerequisites
 
 - `gmgn-cli` installed globally — if missing, run: `npm install -g gmgn-cli`
-- `GMGN_API_KEY` configured in `~/.config/gmgn/.env` — required for all sub-commands; no private key needed
+- `GMGN_API_KEY` configured in `~/.config/gmgn/.env` — required for all sub-commands
+- `GMGN_PRIVATE_KEY` — required for `track follow-wallet` only (critical auth); not needed for `kol` or `smartmoney`
 
 ## Rate Limit Handling
 
@@ -88,11 +89,13 @@ When a request returns `429`:
    ```
    Tell the user: *"This is your Ed25519 public key. Go to **https://gmgn.ai/ai**, paste it into the API key creation form, then send me the API Key value shown on the page."*
 
-2. Wait for the user's API key, then configure:
+2. Wait for the user's API key, then configure (saves both API key and private key — private key is required for `track follow-wallet`):
    ```bash
    mkdir -p ~/.config/gmgn
-   echo 'GMGN_API_KEY=<key_from_user>' > ~/.config/gmgn/.env
+   echo "GMGN_API_KEY=<key_from_user>" > ~/.config/gmgn/.env
+   echo "GMGN_PRIVATE_KEY=$(awk '{printf "%s\\n", $0}' /tmp/gmgn_private.pem)" >> ~/.config/gmgn/.env
    chmod 600 ~/.config/gmgn/.env
+   rm /tmp/gmgn_private.pem
    ```
 
 ## Usage Examples
@@ -308,7 +311,7 @@ To research any token surfaced by smart money activity, follow [`docs/workflow-t
 
 ## Notes
 
-- All sub-commands use normal auth (API Key only, no signature required)
+- `track follow-wallet` uses critical auth (API Key + private key signature); `track kol` and `track smartmoney` use normal auth (API Key only)
 - `track follow-wallet` returns trades from wallets followed on the GMGN platform; the follow list is resolved automatically from the GMGN user account bound to the API Key — `--wallet` is optional
 - Use `--raw` to get single-line JSON for further processing
 - `track kol` / `track smartmoney` `--side` is a **client-side filter** — the CLI fetches all results then filters locally; it is NOT sent to the API

src/client/OpenApiClient.ts

@@ -307,7 +307,7 @@ export class OpenApiClient {
   }
 
   async getFollowWallet(chain: string, extra: Record<string, string | number | string[]> = {}): Promise<unknown> {
-    return this.normalRequest("GET", "/v1/trade/follow_wallet", { chain, ...extra });
+    return this.criticalRequest("GET", "/v1/trade/follow_wallet", { chain, ...extra }, null);
   }
 
   async getKol(chain?: string, limit?: number): Promise<unknown> {
@@ -409,16 +409,16 @@ export class OpenApiClient {
   private async criticalRequest(
     method: string,
     subPath: string,
-    queryExtra: Record<string, string | number>,
+    queryExtra: Record<string, string | number | string[]>,
     body: unknown
   ): Promise<unknown> {
     if (!this.privateKeyPem) {
-      throw new Error("GMGN_PRIVATE_KEY is required for critical-auth commands (swap and all order commands)");
+      throw new Error("GMGN_PRIVATE_KEY is required for critical-auth commands (swap, order, and follow-wallet commands)");
     }
 
     return this.executePreparedRequest(() => {
       const { timestamp, client_id } = buildAuthQuery();
-      const query: Record<string, string | number> = { ...queryExtra, timestamp, client_id };
+      const query: Record<string, string | number | string[]> = { ...queryExtra, timestamp, client_id };
       const bodyStr = body !== null ? JSON.stringify(body) : "";
       const message = buildMessage(subPath, query, bodyStr, timestamp);
       const signature = sign(message, this.privateKeyPem!, detectAlgorithm(this.privateKeyPem!));

src/client/signer.ts

@@ -32,17 +32,24 @@ export function buildAuthQuery(): { timestamp: number; client_id: string } {
 /**
  * Build the signature message (critical auth)
  * Format: {sub_path}:{sorted_query_string}:{request_body}:{timestamp}
- * sorted_query_string: all query params (including timestamp, client_id) sorted alphabetically by key
+ * sorted_query_string: all query params (including timestamp, client_id) sorted alphabetically by key.
+ * Array values are serialized as repeated k=v pairs (same as buildUrl / URLSearchParams), sorted by value.
  */
 export function buildMessage(
   subPath: string,
-  queryParams: Record<string, string | number>,
+  queryParams: Record<string, string | number | string[]>,
   body: string,
   timestamp: number
 ): string {
   const sortedQs = Object.keys(queryParams)
     .sort()
-    .map((k) => `${k}=${queryParams[k]}`)
+    .flatMap((k) => {
+      const v = queryParams[k];
+      if (Array.isArray(v)) {
+        return [...v].sort().map((item) => `${k}=${item}`);
+      }
+      return [`${k}=${v}`];
+    })
     .join("&");
   return `${subPath}:${sortedQs}:${body}:${timestamp}`;
 }

src/config.ts

@@ -15,7 +15,7 @@ export interface Config {
 
 let _config: Config | null = null;
 const PRIVATE_KEY_REQUIRED_MSG =
-  "GMGN_PRIVATE_KEY is required for critical-auth commands (swap and all order commands)";
+  "GMGN_PRIVATE_KEY is required for critical-auth commands (swap, order, and follow-wallet commands)";
 
 export function getConfig(requirePrivateKey = false): Config {
   if (_config) {