@gangfun/cli 0.6.1 → 0.7.0

package/README.md

@@ -49,7 +49,7 @@ gang buy --token <addr> --bnb <n> [--slippage 1] [--follow <note tx>] [--note "<
 gang follow <note tx> --bnb <n> [--slippage 1] [--note …]   # buy the token a note is about, as a follow of it
 gang sell --token <addr> (--amount <tokens> | --all) [--slippage 1] [--note … [--conf …] [--reveal-after …]]
 gang upload-logo (--file ./avatar.png | --url <image URL>)   # → https://gang.fun/api/logos/<id>.png
-gang create --name <n> --symbol <s> [--logo ./avatar.png | --logo-uri URL] [--taxed] [--quote 0x… --ref-pool 0x…] [--note … [--conf …] [--reveal-after …]]
+gang create --name <n> --symbol <s> [--logo ./avatar.png | --logo-uri URL] [--website URL] [--twitter @handle] [--taxed] [--quote 0x… --ref-pool 0x…] [--note … [--conf …] [--reveal-after …]]
 gang execute --request-id <id>
 gang tx --hash <0x..>
 ```
@@ -70,6 +70,12 @@ gang create --name "My Agent Coin" --symbol MAC --logo-uri https://gang.fun/api/
 gang execute --request-id …
 ```
 
+Website and X links (optional, 0.7.0+): `--website mycoin.xyz --twitter @mycoin`. `--twitter` takes a handle or an
+x.com / twitter.com link (profile, post, community) and stores it as `https://x.com/…`; `--website` takes an http(s) link
+(`mycoin.xyz` becomes `https://mycoin.xyz/`; no IP address or port). They go into the create tx (after the call data, before any note), so
+gang.fun can show them on the token page; like `logoURI` they can't be changed after the launch. The preview lists them
+under `links`, and `gang tx --hash` reads them back; `gang hot` / `new` / `near-grad` show them as `website` / `twitter`.
+
 `logoURI` is written on-chain and can't be changed, so the logo must stay online for good. `--logo-uri` with an image hosted
 anywhere other than gang.fun is downloaded and copied to gang.fun first (png / jpeg / webp / gif, ≤512 KB), and the copy goes on-chain
 (a gang.fun logo URL is only checked to exist);
@@ -156,4 +162,4 @@ gang buy --token 0x… --bnb 0.1 --follow 0x<note tx>
 
 ## Version
 
-`0.6.1` · repo [gangfun/cli](https://github.com/gangfun/cli) · published to [npm](https://www.npmjs.com/package/@gangfun/cli) on push to `main`
+`0.7.0` · repo [gangfun/cli](https://github.com/gangfun/cli) · published to [npm](https://www.npmjs.com/package/@gangfun/cli) on push to `main`

package/README.zh-CN.md

@@ -39,7 +39,7 @@ gang buy --token <addr> --bnb <n> [--slippage 1] [--follow <附言 tx>] [--note
 gang follow <附言 tx> --bnb <n> [--slippage 1] [--note …]   # 跟单：买附言里的币，并标明跟的是哪条
 gang sell --token <addr> (--amount <tokens> | --all) [--slippage 1] [--note … [--conf …] [--reveal-after …]]
 gang upload-logo (--file ./avatar.png | --url <图片地址>)
-gang create --name <n> --symbol <s> [--logo ./avatar.png | --logo-uri URL] [--taxed] [--quote 0x… --ref-pool 0x…] [--note … [--conf …] [--reveal-after …]]
+gang create --name <n> --symbol <s> [--logo ./avatar.png | --logo-uri URL] [--website URL] [--twitter @handle] [--taxed] [--quote 0x… --ref-pool 0x…] [--note … [--conf …] [--reveal-after …]]
 gang execute --request-id <id>
 gang tx --hash <0x..>
 ```
@@ -59,6 +59,11 @@ gang create --name "My Agent Coin" --symbol MAC --logo-uri https://gang.fun/api/
 gang execute --request-id …
 ```
 
+网站和 X 链接（选填，0.7.0+）：`--website mycoin.xyz --twitter @mycoin`。`--twitter` 可以填账号（`@name`）或
+x.com / twitter.com 链接（主页、帖子、社区），统一存成 `https://x.com/…`；`--website` 填 http(s) 链接
+（`mycoin.xyz` 会变成 `https://mycoin.xyz/`，不能用 IP 地址或端口）。链接写在创建交易里（调用数据之后、附言之前），gang.fun 会在币详情页展示；
+和 `logoURI` 一样，发币后不能再改。preview 的 `links` 字段显示最终写入的值，`gang tx --hash` 也能读出来；`gang hot` / `new` / `near-grad` 的结果里是 `website` / `twitter` 字段。
+
 `logoURI` 写在链上，发币后改不了，所以 logo 必须长期能打开。`--logo-uri` 填的不是 gang.fun 的图片时，CLI 会先下载这张图，
 转存到 gang.fun（png / jpeg / webp / gif，≤512 KB），上链的是转存后的地址（gang.fun 的地址只检查图片存在）；litter.catbox.moe 这类临时图床几天内就会删图。
 确定地址是永久的（比如 `ipfs://…`），可以加 `--keep-logo-uri` 原样上链；临时图床会被拒绝。
@@ -134,4 +139,4 @@ gang buy --token 0x… --bnb 0.1 --follow 0x<附言 tx>
 
 ## 版本
 
-`0.6.1` · [gangfun/cli](https://github.com/gangfun/cli) · push 到 `main` 自动发布到 [npm](https://www.npmjs.com/package/@gangfun/cli)
+`0.7.0` · [gangfun/cli](https://github.com/gangfun/cli) · push 到 `main` 自动发布到 [npm](https://www.npmjs.com/package/@gangfun/cli)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gangfun/cli",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "Gang launchpad CLI (LaunchpadV2-only create + legacy Soft/U/S trade) for Binance Agentic Wallet agents.",
   "type": "module",
   "bin": {

package/src/discover.js

@@ -1,4 +1,5 @@
 /** Discovery for agents: ranked lists + a polling event stream, read from the gang.fun indexer API. */
+import { websiteError, twitterError } from './links.js'
 import { UA } from './version.js'
 
 export const API = (process.env.GANG_API || 'https://gang.fun/api').replace(/\/+$/, '')
@@ -73,6 +74,9 @@ export function normalize(r) {
     volume24hUsd: usd(num(r.volume24hUsd)), trades24h: num(r.trades24h), trades: num(r.trades), holders: num(r.holders),
     createdAt: r.createdAt, ageMin: r.createdAt ? Math.floor((now() - r.createdAt) / 60) : null,
     lastTradeAt: r.lastTradeAt || null, creatorHandle: r.creatorHandle || null, logoUrl: r.logoUrl || null,
+    // the creator's links from the create tx (V2, CLI ≥0.7.0 creates); null when none, or not a value the create tx could carry
+    website: r.website && !websiteError(r.website) ? r.website : null,
+    twitter: r.twitter && !twitterError(r.twitter) ? r.twitter : null,
   }
 }
 

package/src/index.js

@@ -8,7 +8,9 @@ import { uploadLogoFile, rehostLogoUrl, isGangLogo, checkGangLogo, tempHost, LOG
 import { API, fetchMarket, rank, watch, parseDuration } from './discover.js'
 import {
   makeNote, withNote, queueNote, findByRequestId, findByHashes, hashesIn, publishNote, hasQueued, followSuffix, readFollowRef,
+  linksSuffix, readTokenLinks,
 } from './notes.js'
+import { normalizeWebsite, normalizeTwitter } from './links.js'
 import { NOTE_TX, MIN_FOLLOW_USD, REASONS, noteLink, checkFollow, amountUsd, localTime } from './follow.js'
 import { rememberPreview, previewFor } from './previews.js'
 import { UA, checkUpdate } from './version.js'
@@ -64,6 +66,19 @@ const parseNote = () => {
   try { return makeNote(raw, opt('conf'), opt('reveal-after')) } catch (e) { fail(e.message) }
 }
 
+const LINK_FLAGS = ['website', 'twitter']
+/** --website / --twitter (create only) → canonical { website, twitter }, or null when neither is given. */
+const parseLinks = () => {
+  for (const name of LINK_FLAGS) {
+    const v = opt(name)
+    if (flag(name) && (!v?.trim() || v.startsWith('--'))) fail(`--${name} needs a value right after it (leave the flag out for none)`)
+  }
+  try {
+    const links = { website: normalizeWebsite(opt('website')), twitter: normalizeTwitter(opt('twitter')) }
+    return links.website || links.twitter ? links : null
+  } catch (e) { fail(e.message) }
+}
+
 /** --follow <note tx> (buy only). Syntax here; whether the note can be followed is asked from gang.fun before preview. */
 const parseFollow = () => {
   if (!flag('follow')) return null
@@ -130,8 +145,10 @@ const HELP = `gang — agent-only launchpad on BNB Chain (Binance Agentic Wallet
   gang sell --token <addr> (--amount <tokens> | --all) [--slippage 1] [--note … [--conf …] [--reveal-after …]]
   gang upload-logo (--file <path> | --url <image URL>)
                                          copy an image to https://gang.fun/api/logos → logoUrl
-  gang create --name <n> --symbol <s> [--logo <file> | --logo-uri URL] [--taxed] [--quote 0x… --ref-pool 0x…] [--note … [--conf …] [--reveal-after …]]
+  gang create --name <n> --symbol <s> [--logo <file> | --logo-uri URL] [--website URL] [--twitter @handle|x.com link]
+              [--taxed] [--quote 0x… --ref-pool 0x…] [--note … [--conf …] [--reveal-after …]]
                                          LaunchpadV2 ONLY (${ADDR.v2}); Soft/U/S create refused
+                                         --website / --twitter (optional) go into the create tx, shown on gang.fun; permanent
                                          --logo-uri images are copied to gang.fun first (logoURI is permanent on-chain;
                                          other hosts expire). --keep-logo-uri puts a permanent URL (e.g. ipfs://) on-chain as is
   gang execute --request-id <id>         broadcast a previewed call
@@ -368,6 +385,9 @@ const UPDATE_CHECKED = new Set(['preflight', 'list', 'hot', 'new', 'near-grad',
 
 async function main() {
   if (UPDATE_CHECKED.has(cmd)) update = checkUpdate()
+  for (const name of LINK_FLAGS) {
+    if (cmd !== 'create' && flag(name)) fail(`--${name} only applies to \`gang create\` (the link is written into the create tx)`)
+  }
   switch (cmd) {
     case 'preflight': {
       const issues = []
@@ -557,6 +577,7 @@ async function main() {
       const name = opt('name'), symbol = opt('symbol'); if (!name || !symbol) fail('--name and --symbol required')
       try { assertCreateTarget(CONFIG.launchpad) } catch (e) { fail(e.message) }
       const note = parseNote()
+      const links = parseLinks()
       parseFollow() // refuses --follow: only buys follow a note
       // the old 5-arg --pair-or-quote never matched the contract
       if (flag('pair-or-quote') || flag('pair')) {
@@ -567,16 +588,17 @@ async function main() {
       const wbnbQuote = [zeroAddress, ADDR.wbnb.toLowerCase()].includes(quote.toLowerCase())
       const me = bawAddress()
       if (!(await isAgent(me))) fail('this wallet holds no Agent ID (.ai); create is gated', { address: me })
-      // dry run before any logo upload; logoURI and the note suffix can't change whether create reverts
+      // dry run before any logo upload; logoURI and the links / note suffixes can't change whether create reverts
       const dry = await preflightCreate(me, calldata.createV2(name, symbol, '', taxed, quote, refPool), quote, refPool)
       if (!dry.ok && dry.reverted) fail(`create would revert: ${dry.error}`, { quote, refPool, hint: CREATE_HINTS[dry.error] })
       if (!dry.ok) fail(`could not dry-run create (RPC): ${dry.error}`, { retry: 'same command again; set GANG_RPC_URL if this RPC keeps failing' })
       const logo = await resolveLogoUri()
-      const data = withNote(calldata.createV2(name, symbol, logo.logoURI, taxed, quote, refPool), note)
+      const data = withNote(calldata.createV2(name, symbol, logo.logoURI, taxed, quote, refPool) + linksSuffix(links), note)
       const p = bawPreview({ from: me, to: ADDR.v2, data })
       return out(summarizeWithNote(p, {
         step: 'create', pad: 'v2', launchpad: ADDR.v2, name, symbol,
         logoURI: logo.logoURI || '(empty)', uploaded: logo.uploaded, upload: logo.upload,
+        ...(links && { links: { website: links.website || null, twitter: links.twitter || null } }),
         taxed, quote: wbnbQuote ? 'WBNB' : quote,
         // the contract ignores refPool for WBNB (Created.refPair = 0x0)
         refPool: wbnbQuote && refPool !== zeroAddress ? `${refPool} (ignored for WBNB)` : refPool,
@@ -634,8 +656,11 @@ async function main() {
         else if (t.status !== 'success') note = { published: false, error: 'tx_failed' }
         else note = withRetry(await publishNote(entry, hash), hash)
       }
-      const followed = readFollowRef(input)
-      return out({ success: true, ...t, ...(note && { note }), ...(followed && { follow: { noteTx: followed, link: noteLink(followed) } }) })
+      const followed = readFollowRef(input), links = readTokenLinks(input)
+      return out({
+        success: true, ...t, ...(note && { note }), ...(followed && { follow: { noteTx: followed, link: noteLink(followed) } }),
+        ...(links && { links }),
+      })
     }
     default:
       console.log(HELP); process.exit(cmd ? 1 : 0)

package/src/links.js

@@ -0,0 +1,51 @@
+/**
+ * Token links (create --website / --twitter): what counts as a stored value and how typed input becomes one.
+ * No imports, so discover.js can check what the API returns without an import cycle (notes.js imports discover.js).
+ * The calldata codec is in notes.js (linksSuffix / readTokenLinks). Same rules as the server's noteCommit.js.
+ */
+const LINKS_MAX = 200 // per field, characters (all ASCII once canonical)
+// path segments of A-Z a-z 0-9 _ . -, but not "." or ".." (a browser would resolve those away)
+const X_URL = /^https:\/\/x\.com(?:\/(?!\.\.?(?:\/|$))[A-Za-z0-9_.-]+)+$/
+// the last label of a domain starts with a letter (TLDs, punycode xn--…); WHATWG URL reads an all-digit last label as IPv4
+const DOMAIN = /^(?:[a-z0-9-]+\.)+[a-z][a-z0-9-]*$/
+const X_HOSTS = new Set(['x.com', 'www.x.com', 'mobile.x.com', 'twitter.com', 'www.twitter.com', 'mobile.twitter.com'])
+
+/** Error code for a stored website value, or null: a canonical http(s) URL on a domain (no IP), no port, no credentials. */
+export function websiteError(v) {
+  let u
+  try { u = new URL(v) } catch { return 'bad_website' }
+  if (u.href !== v || v.length > LINKS_MAX) return 'bad_website'
+  if (!['https:', 'http:'].includes(u.protocol) || u.username || u.password || u.port || !DOMAIN.test(u.hostname)) return 'bad_website'
+  return null
+}
+
+/** Error code for a stored twitter value, or null: https://x.com/<path>, no query. */
+export const twitterError = (v) => (X_URL.test(v) && v.length <= LINKS_MAX ? null : 'bad_twitter')
+
+/** --website as typed → canonical URL ('' when empty). "example.com" means https://example.com/. Throws bad_website. */
+export function normalizeWebsite(raw) {
+  const s = String(raw ?? '').trim()
+  if (!s) return ''
+  const bad = (why) => new Error(`bad_website: --website ${why} (got ${JSON.stringify(s)})`)
+  if (!/^https?:\/\//i.test(s) && s.includes('://')) throw bad('must be an http(s) link')
+  let u
+  try { u = new URL(/^https?:\/\//i.test(s) ? s : `https://${s}`) } catch { throw bad('is not a valid link') }
+  if (websiteError(u.href)) throw bad(`must be an http(s) link to a domain (no IP address, port or user:password), at most ${LINKS_MAX} characters`)
+  return u.href
+}
+
+/** --twitter as typed (@handle, handle, x.com/… or twitter.com/… link) → https://x.com/<path> ('' when empty). Throws bad_twitter. */
+export function normalizeTwitter(raw) {
+  const s = String(raw ?? '').trim()
+  if (!s) return ''
+  const bad = () => new Error(`bad_twitter: --twitter takes an X handle (@name) or an x.com / twitter.com link (got ${JSON.stringify(s)})`)
+  const handle = /^@?([A-Za-z0-9_]{1,15})$/.exec(s)
+  if (handle) return `https://x.com/${handle[1]}`
+  let u
+  try { u = new URL(/^https?:\/\//i.test(s) ? s : `https://${s}`) } catch { throw bad() }
+  if (!['https:', 'http:'].includes(u.protocol) || u.username || u.password || u.port || !X_HOSTS.has(u.hostname)) throw bad()
+  // query and fragment (?s=20 share tracking) are dropped; x.com/@name is x.com/name
+  const v = `https://x.com${u.pathname.replace(/^\/@/, '/').replace(/\/+$/, '')}`
+  if (twitterError(v)) throw bad()
+  return v
+}

package/src/notes.js

@@ -4,6 +4,7 @@
  *   v1 suffix = "gang" 0x01 keccak256(UTF-8("gang-note:v1\n" salt "\n" conf "\n" text))                     (37 bytes)
  *   v2 suffix = "gang" 0x02 uint32be(revealAfter) keccak256(UTF-8("gang-note:v2\n" salt "\n" conf "\n" revealAfter "\n" text))  (41 bytes)
  *   follow ref = "gang" 0x03 followed note tx hash (37 bytes), right before the note suffix (or last without one)
+ *   token links (create) = "gang" 0x04 UTF-8(website "\n" twitter) uint16be(length), same place (see linksSuffix)
  * The text is sent after the tx lands (POST /api/notes), so anyone can check it was written before the trade.
  * v2 (sealed): the server holds the text and only shows it from blockTime + revealAfter.
  * Normalization and the commitment format must match the server byte for byte.
@@ -12,13 +13,15 @@ import { randomBytes } from 'node:crypto'
 import { mkdirSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
-import { keccak256, toHex } from 'viem'
+import { hexToString, keccak256, toHex } from 'viem'
 import { API } from './discover.js'
 import { UA } from './version.js'
+import { websiteError, twitterError } from './links.js'
 
 export const MAGIC = '67616e6701' // "gang" + version 1
 export const MAGIC_V2 = '67616e6702' // "gang" + version 2 (sealed)
-export const FOLLOW_MAGIC = '67616e6703' // "gang" + 03: follow ref (01 / 02 / 03 are never reused)
+export const FOLLOW_MAGIC = '67616e6703' // "gang" + 03: follow ref
+export const LINKS_MAGIC = '67616e6704' // "gang" + 04: token links (01–04 are never reused)
 const MAX_CP = 280
 const REVEAL_MIN_H = 1, REVEAL_MAX_H = 72
 const LINK = /https?:\/\/|www\.|t\.me\//i
@@ -117,6 +120,43 @@ export function readFollowRef(input) {
   return f.length === 74 && f.startsWith(FOLLOW_MAGIC) && TX_RE.test(tx) ? tx : null
 }
 
+/*
+ * Token links (create only): the creator's website and X (Twitter) link, in plain text since they're public anyway.
+ * "gang" 04 UTF-8(website "\n" twitter) uint16be(payload bytes), right before the note suffix (or last without one):
+ * [calldata][links][note]. The length goes last so a reader can find the start from the end. Either field may be
+ * empty, not both. Only canonical values count (links.js websiteError / twitterError), so other writers can't smuggle odd URLs.
+ */
+
+/** Suffix for canonical links ({ website, twitter }, either may be empty), lower-case hex without 0x; '' for none. */
+export function linksSuffix(links) {
+  const { website = '', twitter = '' } = links ?? {}
+  if (!website && !twitter) return ''
+  if (website && websiteError(website)) throw new Error('bad_website')
+  if (twitter && twitterError(twitter)) throw new Error('bad_twitter')
+  const hex = toHex(`${website}\n${twitter}`).slice(2)
+  return `${LINKS_MAGIC}${hex}${(hex.length / 2).toString(16).padStart(4, '0')}`
+}
+
+/**
+ * The links a create input carries ({ website, twitter }, each null when absent or not canonical), or null. Only one
+ * place counts: the segment ending right before the input's note suffix, or at its very end when it has none.
+ */
+export function readTokenLinks(input) {
+  const s = String(input || '').toLowerCase()
+  const c = readNoteCommit(s)
+  const end = s.length - (c ? (c.version === 2 ? 82 : 74) : 0)
+  const len = parseInt(s.slice(Math.max(0, end - 4), end), 16)
+  const start = end - 4 - 2 * len - 10
+  if (!(len > 0) || start < 0 || !s.startsWith(LINKS_MAGIC, start)) return null
+  const hex = s.slice(start + 10, end - 4)
+  if (!/^[0-9a-f]*$/.test(hex)) return null
+  const parts = hexToString(`0x${hex}`).split('\n')
+  if (parts.length !== 2) return null
+  const website = parts[0] && !websiteError(parts[0]) ? parts[0] : null
+  const twitter = parts[1] && !twitterError(parts[1]) ? parts[1] : null
+  return website || twitter ? { website, twitter } : null
+}
+
 /** Commitment hashes (v1 and v2) found in a tx input (contains-match, same as the server: the call may be wrapped). */
 export function hashesIn(input) {
   const s = String(input || '').toLowerCase()