fix(signer): percent-encode query params in buildMessage to match server

Server's CanonicalQueryString uses url.QueryEscape on all keys and values,
but buildMessage was using raw string interpolation. Cursor values (base64)
contain +, =, / which diverge under encoding — causing 401 on all paginated
signed requests (e.g. portfolio holdings page 2+).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -4,6 +4,7 @@ on:
   push:
     tags:
       - "v*"
+  workflow_dispatch:
 
 permissions:
   contents: read

CLAUDE.md

@@ -93,8 +93,8 @@ EOF
 
 | Mode | Commands | Requirements |
 |------|----------|--------------|
-| Normal | token / market / portfolio / track kol / track smartmoney | `GMGN_API_KEY` only, no signature |
-| Critical | swap / order / track follow-wallet | `GMGN_API_KEY` + `GMGN_PRIVATE_KEY` — CLI handles signing automatically |
+| Normal | token / market / portfolio (except holdings) / track kol / track smartmoney | `GMGN_API_KEY` only, no signature |
+| Critical | swap / order / portfolio holdings / track follow-wallet | `GMGN_API_KEY` + `GMGN_PRIVATE_KEY` — CLI handles signing automatically |
 
 ## SKILL.md Authoring Rules
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "gmgn-cli",
-  "version": "1.3.3",
+  "version": "1.3.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "gmgn-cli",
-      "version": "1.3.3",
+      "version": "1.3.6",
       "license": "MIT",
       "dependencies": {
         "commander": "^12.1.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "gmgn-cli",
-  "version": "1.3.3",
+  "version": "1.3.6",
   "description": "GMGN OpenAPI CLI — call GMGN market, token, portfolio and swap APIs from the command line",
   "type": "module",
   "bin": {

skills/gmgn-portfolio/SKILL.md

@@ -54,10 +54,17 @@ Use the `gmgn-cli` tool to query wallet portfolio data based on the user's reque
 
 All portfolio routes used by this skill go through GMGN's leaky-bucket limiter with `rate=20` and `capacity=20`. Sustained throughput is roughly `20 ÷ weight` requests/second, and the max burst is roughly `floor(20 ÷ weight)` when the bucket is full.
 
+**Critical auth** (`GMGN_API_KEY` + `GMGN_PRIVATE_KEY` required):
+
+| Command | Route | Weight |
+|---------|-------|--------|
+| `portfolio holdings` | `GET /v1/user/wallet_holdings` | 5 |
+
+**Exist auth** (`GMGN_API_KEY` only):
+
 | Command | Route | Weight |
 |---------|-------|--------|
 | `portfolio info` | `GET /v1/user/info` | 1 |
-| `portfolio holdings` | `GET /v1/user/wallet_holdings` | 2 |
 | `portfolio activity` | `GET /v1/user/wallet_activity` | 3 |
 | `portfolio stats` | `GET /v1/user/wallet_stats` | 3 |
 | `portfolio token-balance` | `GET /v1/user/wallet_token_balance` | 1 |
@@ -226,7 +233,8 @@ The response has a `activities` array and a `next` cursor field for pagination.
 | `token.symbol` | Token ticker |
 | `token_amount` | Token quantity in this transaction |
 | `cost_usd` | USD value of this transaction |
-| `price` | Token price in USD at time of transaction |
+| `price` | Token price denominated in the quote token of the trading pair at time of transaction |
+| `price_usd` | Token price in USD at time of transaction |
 | `timestamp` | Unix timestamp of the transaction |
 | `next` | Pagination cursor — pass to `--cursor` to fetch the next page |
 
@@ -360,7 +368,7 @@ Show the `[Identity: ...]` line only if `common` is present in the response. For
 
 ## Notes
 
-- All portfolio commands use exist auth (API Key only, no signature required)
+- `portfolio holdings` uses **critical auth** (`GMGN_API_KEY` + `GMGN_PRIVATE_KEY` required — CLI signs the request automatically). All other portfolio commands use exist auth (API Key only, no signature required).
 - `portfolio stats` supports multiple `--wallet` flags for batch queries
 - Use `--raw` to get single-line JSON for further processing
 - **Input validation** — Wallet and token addresses are validated against the expected chain format at runtime (sol: base58 32–44 chars; bsc/base/eth: `0x` + 40 hex digits). The CLI exits with an error on invalid input.

skills/gmgn-swap/SKILL.md

@@ -88,6 +88,9 @@ All swap-related routes used by this skill go through GMGN's leaky-bucket limite
 | `multi-swap` | `POST /v1/trade/multi_swap` | 5 |
 | `order quote` | `GET /v1/trade/quote` | 2 |
 | `order get` | `GET /v1/trade/query_order` | 1 |
+| `order strategy create` | `POST /v1/trade/strategy/create` | 5 |
+| `order strategy cancel` | `POST /v1/trade/strategy/cancel` | 2 |
+| `order strategy list` | `GET /v1/trade/strategy/orders` | 1 |
 | `gas-price` | `GET /v1/trade/gas_price` | 1 |
 
 When a request returns `429`:
@@ -544,7 +547,7 @@ gmgn-cli order strategy create \
 | `--quote-token` | Yes | all | Quote token contract address |
 | `--order-type` | Yes | all | Order type: `limit_order` |
 | `--sub-order-type` | Yes | all | Sub-order type: `buy_low` / `buy_high` / `stop_loss` / `take_profit` |
-| `--check-price` | Yes | all | Trigger check price |
+| `--check-price` | Yes | all | Trigger price in USD — the order fires when the token's USD price crosses this value |
 | `--amount-in` | No* | all | Input amount (smallest unit). Mutually exclusive with `--amount-in-percent` |
 | `--amount-in-percent` | No* | all | Input as percentage (e.g. `50` = 50%). Mutually exclusive with `--amount-in` |
 | `--limit-price-mode` | No | all | `exact` / `slippage` (default: `slippage`) |
@@ -600,11 +603,117 @@ gmgn-cli order strategy list --chain sol --group-tag STMix --base-token <token_a
 
 ### `order strategy list` Response Fields
 
-| Field | Type | Description |
-|-------|------|-------------|
+| Field             | Type   | Description |
+| ----------------- | ------ | ---- |
 | `next_page_token` | string | Cursor for next page; empty when no more data |
-| `total` | int | Total count (only returned when `--type open`) |
-| `list` | array | Strategy order list |
+| `total`           | int    | Total count (only returned when `--type open`) |
+| `list`            | array  | Array of strategy order objects; see fields below |
+
+#### `list[]` — Strategy Order Object
+
+| Field                      | Type   | Description |
+| -------------------------- | ------ | ---- |
+| `anti_mev_mode`            | string | Anti-MEV mode string; empty when not set |
+| `auto_slippage`            | bool   | Whether auto slippage is enabled |
+| `base_decimal`             | int    | Base token decimal places |
+| `base_token`               | string | Base token contract address |
+| `chain`                    | string | Chain: `sol` / `bsc` / `base` / `eth` |
+| `close_amount`             | string | Token amount sold on close; empty when order is open |
+| `close_price`              | string | Token price at close; empty when order is open |
+| `close_sell_model`         | string | Sell model used on close; empty when order is open |
+| `close_sign_hash`          | string | Close transaction hash; empty when order is open |
+| `close_time`               | int    | Close timestamp (ms); `0` when order is open |
+| `condition_orders`         | array  | Condition sub-orders; each element is an object — see `condition_orders[]` below |
+| `create_time`              | int    | Creation timestamp (ms) |
+| `custom_rpc`               | string | Custom RPC endpoint; empty string when not set |
+| `dev_sell_ratio`           | string | Dev sell trigger ratio; empty when not set |
+| `drawdown_rate`            | string | Trailing drawdown rate for `profit_stop_trace` / `loss_stop_trace`; empty when not set |
+| `expire_time`              | int    | Expiration timestamp (ms) |
+| `fee`                      | string | Base transaction fee |
+| `gas_price`                | string | Gas price |
+| `is_anti_mev`              | bool   | Whether anti-MEV protection is active |
+| `limit_price_mode`         | string | Limit price mode; empty when not set |
+| `loss_stop`                | string | Stop-loss trigger price; empty when not set |
+| `loss_stop_type`           | string | Stop-loss type; empty when not set |
+| `max_fee_per_gas`          | string | EIP-1559 max fee per gas; EVM only; empty on SOL |
+| `max_priority_fee_per_gas` | string | EIP-1559 max priority fee per gas; EVM only; empty on SOL |
+| `open_amount`              | string | Token amount at open (smallest unit) |
+| `open_price`               | string | Token price at open |
+| `open_sign_hash`           | string | Open transaction hash; empty before confirmed |
+| `order_id`                 | string | Unique order ID (UUID) |
+| `order_statistic`          | object | Cumulative order statistics; see `order_statistic` Object below |
+| `order_type`               | string | Order type: `smart_trade` / `limit_order` |
+| `place_action`             | string | Placement action; empty when not applicable |
+| `prepare_status`           | string | Preparation status; empty when not applicable |
+| `priority_fee`             | string | Priority fee; SOL / BSC only |
+| `profit_stop`              | string | Take-profit trigger price; empty when not set |
+| `profit_stop_type`         | string | Take-profit type; empty when not set |
+| `quote_decimal`            | int    | Quote token decimal places |
+| `quote_investment`         | string | Quote token investment amount (smallest unit) |
+| `quote_token`              | string | Quote token contract address |
+| `reason_by`                | string | Entity that triggered the close; empty when open |
+| `reason_code`              | string | Reason code for the close action; empty when open |
+| `record_high_price`        | string | Highest recorded price since open; used for trailing stops |
+| `sell_param`               | object | Sell transaction parameters; see `sell_param` Object below |
+| `sell_ratio`               | string | Sell ratio; empty when not set |
+| `sell_ratio_type`          | string | Sell ratio base: `buy_amount` / others |
+| `slippage`                 | int    | Slippage tolerance (0 = auto) |
+| `status`                   | string | Order lifecycle status: `open` / `closed` |
+| `strategy_status`          | string | Strategy running status: `running` / `stopped` |
+| `sub_order_type`           | string | Sub-order type: `mix_trade` / others |
+| `tip_fee`                  | string | Tip fee; SOL only |
+| `token_balance`            | string | Remaining token balance; empty when not available |
+| `token_logo`               | string | Token logo URL |
+| `token_name`               | string | Token display name |
+| `token_price`              | string | Current token price; empty when not available |
+| `total_supply`             | string | Token total supply |
+| `version`                  | int    | Order schema version |
+| `wallet_address`           | string | Wallet address that placed the order |
+
+#### `condition_orders[]` — Condition Sub-Order Object
+
+| Field         | Type   | Description |
+| ------------- | ------ | ---- |
+| `cid`         | string | Condition sub-order ID (UUID) |
+| `order_type`  | string | Sub-order type: `profit_stop` / `loss_stop` / `profit_stop_trace` / `loss_stop_trace` |
+| `side`        | string | Trade side: `sell` |
+| `price_scale` | string | Price ratio relative to open price (string); `profit_stop` / `loss_stop` required |
+| `sell_ratio`  | string | Sell ratio (string), e.g. `"100"` |
+| `check_price` | string | Computed trigger price derived from `price_scale` and open price |
+| `status`      | string | Sub-order status: `cancel` / `success` / `failed` |
+
+#### `order_statistic` Object
+
+| Field                  | Type   | Description |
+| ---------------------- | ------ | ---- |
+| `buy_amount`           | string | Bought token amount (smallest unit) |
+| `buy_quote_price`      | string | Quote token price at buy |
+| `buy_usdt_price`       | string | USDT-denominated price at buy |
+| `quote_profit`         | string | Realized profit in quote token |
+| `sell_amount`          | string | Total token amount sold |
+| `sell_num`             | int    | Total number of sell attempts |
+| `success_sell_amount`  | string | Successfully sold token amount |
+| `success_sell_num`     | int    | Number of successful sells |
+| `usdt_profit`          | string | Realized profit in USDT |
+
+#### `sell_param` Object
+
+| Field                      | Type   | Description |
+| -------------------------- | ------ | ---- |
+| `anti_mev_mode`            | string | Anti-MEV mode for the sell transaction |
+| `auto_fee`                 | bool   | Whether auto fee is enabled for the sell |
+| `auto_slippage`            | bool   | Whether auto slippage is enabled for the sell |
+| `auto_tip`                 | bool   | Whether auto tip is enabled |
+| `custom_rpc`               | string | Custom RPC endpoint; empty string when not set |
+| `fee`                      | string | Sell transaction fee |
+| `gas_price`                | string | Gas price for the sell |
+| `is_anti_mev`              | bool   | Whether anti-MEV protection is active for the sell |
+| `max_fee_per_gas`          | string | EIP-1559 max fee per gas for the sell; EVM only |
+| `max_priority_fee_per_gas` | string | EIP-1559 max priority fee per gas for the sell; EVM only |
+| `max_tip_fee`              | string | Maximum tip fee; empty when not set |
+| `priority_fee`             | string | Priority fee for the sell; SOL / BSC only |
+| `slippage`                 | int    | Slippage tolerance for the sell (0 = auto) |
+| `tip_fee`                  | string | Tip fee for the sell; SOL only |
 
 ---
 

skills/gmgn-token/SKILL.md

@@ -288,7 +288,7 @@ The response has five nested objects: `pool`, `dev`, `link`, `stat`, `wallet_tag
 | `price.swaps_{window}` | Total swap count for the window |
 | `price.hot_level` | Heat level integer |
 
-**`fee_distribution` Object** — Launchpad fee-sharing config (optional; present for `pump` / `bankr` tokens)
+**`fee_distribution` Object** — Launchpad fee-sharing config (optional; present for `pump` / `bankr` tokens). Use `token info` to check fee distribution, creator reward claim status (`has_claimed_fee`), and royalty allocation for pump/bankr tokens.
 
 | Field | Description |
 |-------|-------------|
@@ -724,7 +724,7 @@ Show top rows only. Highlight wallets tagged `kol`, `smart_degen`, or flagged `b
 ## Notes
 
 - **Market cap is not returned directly** — calculate it as `price.price × circulating_supply` (`price` is now a nested object; use `price.price` for the current USD price string, and `circulating_supply` is a top-level field already in human-readable token units). Example: `price.price="3.11"` × `circulating_supply=999999151` ≈ $3.11B market cap.
-- **Trading volume (1h, 24h, etc.) is not included in `token info`** — to get volume or OHLCV data, use the `gmgn-market` skill and query K-line data: `gmgn-cli market kline --chain <chain> --address <token_address> --resolution <1m|5m|15m|1h|4h|1d>`. See the `gmgn-market` SKILL.md for full details.
+- **Trading volume and swap counts by window are available in `token info`** via the `price` object: `volume_{window}`, `buy_volume_{window}`, `sell_volume_{window}`, `buys_{window}`, `sells_{window}`, `swaps_{window}` (windows: `1m`, `5m`, `1h`, `6h`, `24h`). For OHLCV candlestick data, use `gmgn-market kline`.
 - All token commands use exist auth (API Key only, no signature required)
 - Use `--raw` to get single-line JSON for further processing
 - `--tag` applies to both `holders` and `traders` and filters to only wallets with that tag — if few results are returned, try the other tag value

src/client/OpenApiClient.ts

@@ -241,18 +241,18 @@ export class OpenApiClient {
     return this.authExistRequest("GET", "/v1/market/token_kline", query);
   }
 
-  // ---- Portfolio endpoints (exist auth) ----
+  // ---- Portfolio endpoints ----
 
   async getWalletHoldings(
     chain: string,
     walletAddress: string,
     extra: Record<string, string | number> = {}
   ): Promise<unknown> {
-    return this.authExistRequest("GET", "/v1/user/wallet_holdings", {
+    return this.authSignedRequest("GET", "/v1/user/wallet_holdings", {
       chain,
       wallet_address: walletAddress,
       ...extra,
-    });
+    }, null);
   }
 
   async getWalletActivity(
@@ -419,7 +419,7 @@ export class OpenApiClient {
     body: unknown
   ): Promise<unknown> {
     if (!this.privateKeyPem) {
-      throw new Error("GMGN_PRIVATE_KEY is required for critical-auth commands (swap, order, and follow-wallet commands)");
+      throw new Error("GMGN_PRIVATE_KEY is required for critical-auth commands (swap, order, follow-wallet, and portfolio holdings commands)");
     }
 
     return this.executePreparedRequest(() => {

src/client/signer.ts

@@ -44,11 +44,12 @@ export function buildMessage(
   const sortedQs = Object.keys(queryParams)
     .sort()
     .flatMap((k) => {
+      const ek = encodeURIComponent(k);
       const v = queryParams[k];
       if (Array.isArray(v)) {
-        return [...v].sort().map((item) => `${k}=${item}`);
+        return [...v].sort().map((item) => `${ek}=${encodeURIComponent(item)}`);
       }
-      return [`${k}=${v}`];
+      return [`${ek}=${encodeURIComponent(String(v))}`];
     })
     .join("&");
   return `${subPath}:${sortedQs}:${body}:${timestamp}`;

src/commands/swap.ts

@@ -41,7 +41,7 @@ export function registerSwapCommands(program: Command): void {
       if (opts.percent != null) validatePercent(opts.percent);
       const params: SwapParams = {
         chain: opts.chain,
-        from_address: opts.from,
+        from_address: opts.chain === "sol" ? opts.from : opts.from.toLowerCase(),
         input_token: opts.inputToken,
         output_token: opts.outputToken,
         input_amount: opts.percent != null ? (opts.amount ?? "0") : opts.amount,
@@ -109,7 +109,7 @@ export function registerSwapCommands(program: Command): void {
       }
       const params: MultiSwapParams = {
         chain: opts.chain,
-        accounts,
+        accounts: opts.chain === "sol" ? accounts : accounts.map((a: string) => a.toLowerCase()),
         input_token: opts.inputToken,
         output_token: opts.outputToken,
       };