@dfm-fi/agent 0.2.1075 → 0.2.1079

package/README.md

@@ -34,7 +34,7 @@ the agent.
   publish CI does).
 - A **dedicated throwaway Solana test wallet** (NOT the protocol wallet), funded
   with a few dollars of **USDC** (mainnet mint `EPjFW…`) + a little **SOL** for
-  fees, and **allowlisted** for the closed alpha (send its pubkey to an admin).
+  fees. No allowlisting is required — sign-in is open.
 - For writes: **no client RPC is required** — the backend broadcasts your signed
   tx (`POST /tx/submit`). Set `HELIUS_RPC_URL` only if you want to submit through
   your *own* RPC instead (optional override; power users + the test harness).
@@ -55,9 +55,9 @@ the agent.
 - **Never** use the protocol wallet (`9GjE…`) here. Use a **dedicated throwaway
   test wallet** funded with a few dollars of USDC. The harness hard-refuses to
   load the known protocol pubkey as a tripwire.
-- The test wallet must be on the **closed-alpha access allowlist** — otherwise
-  SIWS sign-in is rejected **server-side** (403), so it can't reach any protected
-  endpoint. An admin adds it via the `/ops` Access panel (`POST /access/allowlist`).
+- No access allowlist exists. SIWS sign-in is open to any wallet; the only
+  wallet gate left is `OPS_ADMIN_WALLETS`, which guards `/ops` and the agent
+  config, not ordinary use.
 - All **real-money WRITE tools** (deposit / redeem) are **gated behind
   `DFM_AGENT_WRITE_ENABLED=true` and default OFF**. With write off, those tools
   refuse and never touch the chain or load the keypair.
@@ -70,7 +70,7 @@ SIWS (Sign In With Solana), signed locally, exchanged for a Bearer session:
    exact message** (domain-bound to `n2.dfm.finance`, nonce embedded).
 2. Sign **that exact message** locally with the test keypair (Ed25519 → base58).
 3. `POST /auth/siws { wallet, signature, message, client: 'native' }` →
-   `{ accessToken, … }`. The server also enforces the access gate here.
+   `{ accessToken, … }`. The server verifies the wallet, nonce and domain here.
 4. Authed calls send `Authorization: Bearer <accessToken>`; a 401 triggers one
    transparent re-auth + retry.
 
@@ -251,7 +251,7 @@ Generate a dedicated throwaway wallet and fund it with a little USDC + SOL:
 
 ```bash
 solana-keygen new --no-bip39-passphrase -o ~/dfm-test-wallet.json
-solana-keygen pubkey ~/dfm-test-wallet.json   # send this pubkey to an admin to allowlist
+solana-keygen pubkey ~/dfm-test-wallet.json
 ```
 
 Then either point the agent at the file (preferred):
@@ -273,7 +273,7 @@ Only after the parent has reviewed the write path (`create-flow.ts`,
 
 ```bash
 export DFM_API_URL=https://n2-api.dfm.finance
-export DFM_AGENT_KEYPAIR_PATH=$HOME/dfm-test-wallet.json                 # allowlisted + funded
+export DFM_AGENT_KEYPAIR_PATH=$HOME/dfm-test-wallet.json                 # dedicated + funded
 export DFM_AGENT_WRITE_ENABLED=true                                     # the kill-switch
 # export HELIUS_RPC_URL=https://mainnet.helius-rpc.com/?api-key=YOUR_KEY # OPTIONAL — submit via your own RPC
 
@@ -360,7 +360,7 @@ Notes:
 | Variable | Required | Default | Description |
 |----------|----------|---------|-------------|
 | `DFM_API_URL` | No | `https://n2-api.dfm.finance` | API base (the `/api/v2` prefix is auto-appended). |
-| `DFM_AGENT_KEYPAIR_PATH` | For auth | — | Path to a Solana secret-key JSON file (preferred). The wallet must be **allowlisted** + **funded** (USDC + a little SOL). |
+| `DFM_AGENT_KEYPAIR_PATH` | For auth | — | Path to a Solana secret-key JSON file (preferred). Use a dedicated wallet funded with USDC + a little SOL. |
 | `DFM_AGENT_KEYPAIR_JSON` | For auth | — | The secret-key JSON array inline (alternative; e.g. injected from a secret manager). |
 | `DFM_AGENT_WRITE_ENABLED` | No | `false` | Master kill-switch for **all** write tools (launch/deposit/redeem/cancel/update-envelope). |
 | `HELIUS_RPC_URL` / `DFM_RPC_URL` | No (optional) | — | OPTIONAL override — submit through your OWN RPC instead of the backend broadcast (`POST /tx/submit`). Writes need NO client RPC by default; mainnet never uses the rate-limited public RPC. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dfm-fi/agent",
-  "version": "0.2.1075",
+  "version": "0.2.1079",
   "description": "DFM v2 MCP server — drive the full DTF launch → deposit → redeem (+ manage) lifecycle from an AI agent against the live API.",
   "type": "module",
   "bin": {

package/skills.md

@@ -23,9 +23,8 @@ broadcasts your signed tx.
 ## Available Tools
 
 ### whoami (read)
-Report the test-wallet public key, API base + cluster, whether writes are
-enabled, and the closed-alpha access-gate decision. **Call this first** to
-confirm the agent is wired up and the wallet is allowlisted.
+Report the wallet public key, API base + cluster, and whether writes are
+enabled. **Call this first** to confirm the agent is wired up.
 
 ### list_dtfs (read)
 List DTF vaults (`GET /vaults`): `address`, `vaultName`/`vaultSymbol`, type,
@@ -155,8 +154,8 @@ purely to size the converging legs.
   management/performance fees do not exist. Swap slippage is borne by the
   transacting user on top.
 - **Amounts are RAW**: USDC + shares both use 6 decimals. $12 = `"12000000"`.
-- **Auth gate**: a non-allowlisted wallet is rejected at SIWS sign-in (403). Get
-  the test-wallet pubkey from `whoami` and have an admin add it.
+- **Auth**: SIWS is open to any wallet; the server verifies the signed nonce and
+  domain before issuing a session.
 
 ## Security
 - The programs are **oracle-free**: deposit/mint is proportional in-kind against