minara 0.2.7 → 0.2.9

package/README.md

@@ -128,7 +128,8 @@ minara swap --dry-run              # Simulate without executing
 | --------------------------- | ----------------------------------------------------- |
 | `minara perps positions`    | View all open positions with PnL                      |
 | `minara perps order`        | Place an order (interactive builder)                  |
-| `minara perps cancel`       | Cancel open orders                                    |
+| `minara perps close`        | Close an open position at market price                |
+| `minara perps cancel`       | Cancel open orders (selectable list)                  |
 | `minara perps leverage`     | Update leverage for a symbol                          |
 | `minara perps trades`       | View trade history (Hyperliquid fills)                |
 | `minara perps deposit`      | Deposit USDC to perps (or use `minara deposit perps`) |
@@ -140,6 +141,8 @@ minara swap --dry-run              # Simulate without executing
 ```bash
 minara perps positions             # List positions with equity, margin, PnL
 minara perps order                 # Interactive: symbol selector → side → size → confirm
+minara perps close                 # Close a position: pick from list → market close
+minara perps cancel                # Cancel an order: pick from open orders list
 minara perps leverage              # Interactive: shows max leverage per asset
 minara perps trades                # Recent fills from Hyperliquid (default 7 days)
 minara perps trades -d 30          # Last 30 days of trade history
@@ -149,6 +152,10 @@ minara perps autopilot             # Toggle AI autopilot, create/update strategy
 minara perps ask                   # AI analysis → optional quick order
 ```
 
+> **Close position:** Select an open position from the list, and it will be closed at market price with a reduce-only order in the opposite direction — no manual price or size entry needed.
+>
+> **Cancel order:** Open orders are fetched from Hyperliquid and shown as a selectable list with coin, side, size, and price — no need to look up order IDs.
+>
 > **Autopilot:** When autopilot is ON, manual order placement (`minara perps order`) is blocked to prevent conflicts with AI-managed trades. Turn off autopilot first via `minara perps autopilot`.
 >
 > **Ask AI → Quick Order:** After the AI analysis, you can instantly place a market order based on the recommended direction, entry price, and position size — no need to re-enter parameters.
@@ -303,7 +310,7 @@ Minara CLI supports macOS Touch ID to protect all fund-related operations. When
 minara config                     # Select "Touch ID" to enable / disable
 ```
 
-**Protected operations:** `withdraw`, `transfer`, `swap`, `deposit` (Spot→Perps transfer), `perps deposit`, `perps withdraw`, `perps order`, `limit-order create`
+**Protected operations:** `withdraw`, `transfer`, `swap`, `deposit` (Spot→Perps transfer), `perps deposit`, `perps withdraw`, `perps order`, `perps close`, `limit-order create`
 
 > **Note:** Touch ID requires macOS with Touch ID hardware. The `--yes` flag skips the initial confirmation prompt but does **not** bypass transaction confirmation or Touch ID.
 

package/dist/api/perps.d.ts

@@ -63,6 +63,16 @@ export interface HlAssetInfo extends HlAssetMeta {
 }
 /** Fetch perpetuals universe metadata + live prices from Hyperliquid (cached per session). */
 export declare function getAssetMeta(): Promise<HlAssetInfo[]>;
+export interface HlOpenOrder {
+    coin: string;
+    limitPx: string;
+    oid: number;
+    side: string;
+    sz: string;
+    timestamp: number;
+}
+/** Fetch user's open orders from Hyperliquid. */
+export declare function getOpenOrders(address: string): Promise<HlOpenOrder[]>;
 export interface HlFill {
     coin: string;
     px: string;

package/dist/api/perps.js

@@ -111,6 +111,21 @@ export async function getAssetMeta() {
         return [];
     }
 }
+/** Fetch user's open orders from Hyperliquid. */
+export async function getOpenOrders(address) {
+    try {
+        const res = await fetch('https://api.hyperliquid.xyz/info', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ type: 'openOrders', user: address }),
+        });
+        const data = await res.json();
+        return Array.isArray(data) ? data : [];
+    }
+    catch {
+        return [];
+    }
+}
 /** Fetch user trade fills directly from Hyperliquid (last 7 days by default). */
 export async function getUserFills(address, days = 7) {
     try {

package/dist/commands/config.js

@@ -41,7 +41,10 @@ export const configCommand = new Command('config')
                 default: config.baseUrl,
                 validate: (v) => {
                     try {
-                        new URL(v);
+                        const u = new URL(v);
+                        if (u.protocol !== 'https:' && u.hostname !== 'localhost' && u.hostname !== '127.0.0.1') {
+                            return 'Base URL must use HTTPS (HTTP allowed only for localhost)';
+                        }
                         return true;
                     }
                     catch {

package/dist/commands/deposit.js

@@ -53,7 +53,7 @@ async function showSpotDeposit(token) {
     console.log('');
 }
 // ─── moonpay (credit card on-ramp) ───────────────────────────────────────
-const MOONPAY_PK = 'pk_live_yIf64w79W6ufwip4j51PWbymdwGtI';
+const MOONPAY_PK = process.env.MOONPAY_PK ?? 'pk_live_yIf64w79W6ufwip4j51PWbymdwGtI';
 const MOONPAY_CURRENCIES = [
     { name: 'USDC (Base)', code: 'usdc_base', network: 'base' },
     { name: 'USDC (Ethereum)', code: 'usdc', network: 'ethereum' },

package/dist/commands/perps.js

@@ -3,7 +3,7 @@ import { input, select, confirm, number as numberPrompt } from '@inquirer/prompt
 import chalk from 'chalk';
 import * as perpsApi from '../api/perps.js';
 import { requireAuth } from '../config.js';
-import { success, info, warn, spinner, assertApiOk, formatOrderSide, wrapAction, requireTransactionConfirmation } from '../utils.js';
+import { success, info, warn, spinner, assertApiOk, formatOrderSide, wrapAction, requireTransactionConfirmation, validateAddress } from '../utils.js';
 import { requireTouchId } from '../touchid.js';
 import { printTxResult, printTable, printKV, POSITION_COLUMNS, FILL_COLUMNS } from '../formatters.js';
 // ─── deposit ─────────────────────────────────────────────────────────────
@@ -48,7 +48,7 @@ const withdrawCmd = new Command('withdraw')
         : await numberPrompt({ message: 'USDC amount to withdraw:', min: 0.01, required: true });
     const toAddress = opts.to ?? await input({
         message: 'Destination address:',
-        validate: (v) => (v.length > 5 ? true : 'Enter a valid address'),
+        validate: (v) => validateAddress(v, 'arbitrum'),
     });
     console.log(`\n  Withdraw : ${chalk.bold(amount)} USDC → ${chalk.yellow(toAddress)}\n`);
     warn('Withdrawals may take time to process.');
@@ -181,7 +181,7 @@ const orderCmd = new Command('order')
         marketPx = assetMeta?.markPx;
         if (marketPx && marketPx > 0) {
             const slippagePx = isBuy ? marketPx * 1.01 : marketPx * 0.99;
-            limitPx = slippagePx.toPrecision(6);
+            limitPx = slippagePx.toPrecision(5);
             info(`Market order at ~$${marketPx}`);
         }
         else {
@@ -240,44 +240,127 @@ const cancelCmd = new Command('cancel')
     .option('-y, --yes', 'Skip confirmation')
     .action(wrapAction(async (opts) => {
     const creds = requireAuth();
-    const metaSpin = spinner('Fetching assets…');
-    const assets = await perpsApi.getAssetMeta();
-    metaSpin.stop();
-    let asset;
-    if (assets.length > 0) {
-        asset = await select({
-            message: 'Asset to cancel:',
-            choices: assets.map((a) => {
-                const pxStr = a.markPx > 0 ? `$${a.markPx.toLocaleString()}` : '';
-                return {
-                    name: `${a.name.padEnd(6)} ${chalk.dim(pxStr.padStart(12))}  ${chalk.dim(`max ${a.maxLeverage}x`)}`,
-                    value: a.name,
-                };
-            }),
-        });
+    const spin = spinner('Fetching open orders…');
+    const address = await perpsApi.getPerpsAddress(creds.accessToken);
+    if (!address) {
+        spin.stop();
+        warn('Could not find your perps wallet address. Make sure your perps account is initialized.');
+        return;
     }
-    else {
-        asset = await input({ message: 'Asset symbol to cancel (e.g. BTC):' });
-    }
-    const oid = await input({
-        message: 'Order ID (oid):',
-        validate: (v) => {
-            const n = parseInt(v, 10);
-            return isNaN(n) ? 'Please enter a valid numeric order ID' : true;
-        },
+    const openOrders = await perpsApi.getOpenOrders(address);
+    spin.stop();
+    if (openOrders.length === 0) {
+        info('No open orders to cancel.');
+        return;
+    }
+    const selected = await select({
+        message: 'Select order to cancel:',
+        choices: openOrders.map((o) => {
+            const side = o.side === 'B' ? chalk.green('BUY') : chalk.red('SELL');
+            const px = `$${Number(o.limitPx).toLocaleString()}`;
+            return {
+                name: `${chalk.bold(o.coin.padEnd(6))} ${side}  ${o.sz} @ ${chalk.yellow(px)}  ${chalk.dim(`oid:${o.oid}`)}`,
+                value: o,
+            };
+        }),
     });
     if (!opts.yes) {
-        const ok = await confirm({ message: `Cancel order ${oid} for ${asset}?`, default: false });
+        const sideLabel = selected.side === 'B' ? 'BUY' : 'SELL';
+        const ok = await confirm({
+            message: `Cancel ${sideLabel} ${selected.coin} ${selected.sz} @ $${Number(selected.limitPx).toLocaleString()}?`,
+            default: false,
+        });
         if (!ok)
             return;
     }
-    const spin = spinner('Cancelling…');
-    const res = await perpsApi.cancelOrders(creds.accessToken, { cancels: [{ a: asset, o: parseInt(oid, 10) }] });
-    spin.stop();
+    const cancelSpin = spinner('Cancelling…');
+    const res = await perpsApi.cancelOrders(creds.accessToken, {
+        cancels: [{ a: selected.coin, o: selected.oid }],
+    });
+    cancelSpin.stop();
     assertApiOk(res, 'Order cancellation failed');
     success('Order cancelled');
     printTxResult(res.data);
 }));
+// ─── close position ─────────────────────────────────────────────────────
+const closeCmd = new Command('close')
+    .description('Close an open perps position at market price')
+    .option('-y, --yes', 'Skip confirmation')
+    .action(wrapAction(async (opts) => {
+    const creds = requireAuth();
+    const spin = spinner('Fetching positions…');
+    const res = await perpsApi.getAccountSummary(creds.accessToken);
+    const assets = await perpsApi.getAssetMeta();
+    spin.stop();
+    if (!res.success || !res.data) {
+        warn('Could not fetch positions.');
+        return;
+    }
+    const d = res.data;
+    const positions = Array.isArray(d.positions) ? d.positions : [];
+    if (positions.length === 0) {
+        info('No open positions to close.');
+        return;
+    }
+    const fmt = (n) => `$${n.toLocaleString('en-US', { minimumFractionDigits: 2, maximumFractionDigits: 2 })}`;
+    const pnlFmt = (n) => {
+        const color = n >= 0 ? chalk.green : chalk.red;
+        return color(`${n >= 0 ? '+' : ''}${fmt(n)}`);
+    };
+    const selected = await select({
+        message: 'Select position to close:',
+        choices: positions.map((p) => {
+            const symbol = String(p.symbol ?? '');
+            const side = String(p.side ?? '').toLowerCase();
+            const sideLabel = side === 'long' || side === 'buy' ? chalk.green('LONG') : chalk.red('SHORT');
+            const sz = String(p.size ?? '');
+            const entry = fmt(Number(p.entryPrice ?? 0));
+            const pnl = pnlFmt(Number(p.unrealizedPnl ?? 0));
+            return {
+                name: `${chalk.bold(symbol.padEnd(6))} ${sideLabel}  ${sz} @ ${chalk.yellow(entry)}  PnL: ${pnl}`,
+                value: p,
+            };
+        }),
+    });
+    const symbol = String(selected.symbol ?? '');
+    const side = String(selected.side ?? '').toLowerCase();
+    const sz = String(selected.size ?? '');
+    const isLong = side === 'long' || side === 'buy';
+    const isBuy = !isLong;
+    const assetMeta = assets.find((a) => a.name.toUpperCase() === symbol.toUpperCase());
+    const marketPx = assetMeta?.markPx;
+    if (!marketPx || marketPx <= 0) {
+        warn(`Could not fetch current price for ${symbol}. Cannot place market close order.`);
+        return;
+    }
+    const slippagePx = isBuy ? marketPx * 1.01 : marketPx * 0.99;
+    const limitPx = slippagePx.toPrecision(5);
+    const order = {
+        a: symbol,
+        b: isBuy,
+        p: limitPx,
+        s: sz,
+        r: true,
+        t: { trigger: { triggerPx: String(marketPx), tpsl: 'tp', isMarket: true } },
+    };
+    const sideLabel = isLong ? 'LONG' : 'SHORT';
+    console.log('');
+    console.log(chalk.bold('Close Position:'));
+    console.log(`  Asset    : ${chalk.bold(symbol)}`);
+    console.log(`  Position : ${formatOrderSide(isLong ? 'buy' : 'sell')} ${sz}`);
+    console.log(`  Close    : ${formatOrderSide(isBuy ? 'buy' : 'sell')} (market ~$${marketPx.toLocaleString()})`);
+    console.log('');
+    if (!opts.yes) {
+        await requireTransactionConfirmation(`Close ${sideLabel} ${symbol} · size ${sz} @ Market (~$${marketPx.toLocaleString()})`);
+    }
+    await requireTouchId();
+    const orderSpin = spinner('Closing position…');
+    const orderRes = await perpsApi.placeOrders(creds.accessToken, { orders: [order], grouping: 'na' });
+    orderSpin.stop();
+    assertApiOk(orderRes, 'Close position failed');
+    success(`Position closed — ${sideLabel} ${symbol} ${sz}`);
+    printTxResult(orderRes.data);
+}));
 // ─── leverage ────────────────────────────────────────────────────────────
 const leverageCmd = new Command('leverage')
     .description('Update leverage for a symbol')
@@ -615,7 +698,7 @@ const askCmd = new Command('ask')
     const order = {
         a: symbol,
         b: isBuy,
-        p: slippagePx.toPrecision(6),
+        p: slippagePx.toPrecision(5),
         s: String(size),
         r: false,
         t: { trigger: { triggerPx: String(entryPrice), tpsl: 'tp', isMarket: true } },
@@ -707,6 +790,7 @@ export const perpsCommand = new Command('perps')
     .addCommand(positionsCmd)
     .addCommand(orderCmd)
     .addCommand(cancelCmd)
+    .addCommand(closeCmd)
     .addCommand(leverageCmd)
     .addCommand(tradesCmd)
     .addCommand(depositCmd)
@@ -724,6 +808,7 @@ export const perpsCommand = new Command('perps')
         choices: [
             { name: 'View positions', value: 'positions' },
             { name: 'Place order', value: 'order' },
+            { name: 'Close position', value: 'close' },
             { name: 'Cancel order', value: 'cancel' },
             { name: 'Update leverage', value: 'leverage' },
             { name: 'View trade history', value: 'trades' },

package/dist/commands/transfer.js

@@ -2,7 +2,7 @@ import { Command } from 'commander';
 import { input } from '@inquirer/prompts';
 import { transfer } from '../api/crosschain.js';
 import { requireAuth } from '../config.js';
-import { success, spinner, assertApiOk, selectChain, wrapAction, requireTransactionConfirmation, lookupToken } from '../utils.js';
+import { success, spinner, assertApiOk, selectChain, wrapAction, requireTransactionConfirmation, lookupToken, validateAddress } from '../utils.js';
 import { requireTouchId } from '../touchid.js';
 import { printTxResult } from '../formatters.js';
 export const transferCommand = new Command('transfer')
@@ -33,7 +33,7 @@ export const transferCommand = new Command('transfer')
     // ── 4. Recipient ─────────────────────────────────────────────────────
     const recipient = opts.to ?? await input({
         message: 'Recipient address:',
-        validate: (v) => (v.length > 5 ? true : 'Enter a valid address'),
+        validate: (v) => validateAddress(v, chain),
     });
     // ── 5. Confirm & Touch ID ──────────────────────────────────────────
     if (!opts.yes) {

package/dist/commands/withdraw.js

@@ -3,7 +3,7 @@ import { input } from '@inquirer/prompts';
 import chalk from 'chalk';
 import { transfer, getAssets } from '../api/crosschain.js';
 import { requireAuth } from '../config.js';
-import { success, spinner, assertApiOk, selectChain, wrapAction, requireTransactionConfirmation, lookupToken } from '../utils.js';
+import { success, spinner, assertApiOk, selectChain, wrapAction, requireTransactionConfirmation, lookupToken, validateAddress } from '../utils.js';
 import { requireTouchId } from '../touchid.js';
 import { printTxResult } from '../formatters.js';
 export const withdrawCommand = new Command('withdraw')
@@ -57,7 +57,7 @@ export const withdrawCommand = new Command('withdraw')
     // ── 5. Destination ───────────────────────────────────────────────────
     const recipient = opts.to ?? await input({
         message: 'Destination address (your external wallet):',
-        validate: (v) => (v.length > 5 ? true : 'Enter a valid address'),
+        validate: (v) => validateAddress(v, chain),
     });
     // ── 6. Confirm & Touch ID ──────────────────────────────────────────
     if (!opts.yes) {

package/dist/config.js

@@ -14,8 +14,7 @@ function ensureDir() {
 // ─── Credentials ─────────────────────────────────────────────────────────────
 export function saveCredentials(creds) {
     ensureDir();
-    writeFileSync(CREDENTIALS_FILE, JSON.stringify(creds, null, 2), 'utf-8');
-    chmodSync(CREDENTIALS_FILE, 0o600);
+    writeFileSync(CREDENTIALS_FILE, JSON.stringify(creds, null, 2), { encoding: 'utf-8', mode: 0o600 });
 }
 export function loadCredentials() {
     if (!existsSync(CREDENTIALS_FILE))
@@ -65,7 +64,7 @@ export function saveConfig(config) {
     ensureDir();
     const current = loadConfig();
     const merged = { ...current, ...config };
-    writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2), 'utf-8');
+    writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2), { encoding: 'utf-8', mode: 0o600 });
 }
 export function getMinaraDir() {
     ensureDir();

package/dist/oauth-server.js

@@ -11,6 +11,15 @@
  */
 import { createServer } from 'node:http';
 import { URL } from 'node:url';
+// ── Helpers ───────────────────────────────────────────────────────────────
+function escapeHtml(str) {
+    return str
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
 // ── HTML responses ────────────────────────────────────────────────────────
 const SUCCESS_HTML = `<!DOCTYPE html>
 <html>
@@ -48,7 +57,7 @@ const ERROR_HTML = (msg) => `<!DOCTYPE html>
 <body>
   <div class="card">
     <h1>✖ Login Failed</h1>
-    <p>${msg}</p>
+    <p>${escapeHtml(msg)}</p>
     <p>Please return to the terminal and try again.</p>
   </div>
 </body>

package/dist/utils.d.ts

@@ -75,5 +75,10 @@ export declare function requireTransactionConfirmation(description: string, toke
     amount?: string;
     destination?: string;
 }): Promise<void>;
+/**
+ * Validate a blockchain address based on the target chain.
+ * Returns `true` on success or an error message string on failure.
+ */
+export declare function validateAddress(address: string, chain?: string): true | string;
 /** Open a URL in the user's default browser (cross-platform). */
 export declare function openBrowser(url: string): void;

package/dist/utils.js

@@ -1,6 +1,6 @@
 import chalk from 'chalk';
 import ora from 'ora';
-import { exec } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import { platform } from 'node:os';
 import { select, confirm } from '@inquirer/prompts';
 import { SUPPORTED_CHAINS } from './types.js';
@@ -340,16 +340,54 @@ export async function requireTransactionConfirmation(description, token, details
         process.exit(0);
     }
 }
+// ─── Address validation ──────────────────────────────────────────────────────
+const SOLANA_ADDR_RE = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+const EVM_ADDR_RE = /^0x[0-9a-fA-F]{40}$/;
+/**
+ * Validate a blockchain address based on the target chain.
+ * Returns `true` on success or an error message string on failure.
+ */
+export function validateAddress(address, chain) {
+    const v = address.trim();
+    if (!v)
+        return 'Address is required';
+    const c = chain?.toLowerCase();
+    if (c === 'solana' || c === 'sol' || c === '101') {
+        if (!SOLANA_ADDR_RE.test(v))
+            return 'Invalid Solana address (expected base58, 32–44 chars)';
+        return true;
+    }
+    if (c && c !== 'solana') {
+        if (!EVM_ADDR_RE.test(v))
+            return 'Invalid EVM address (expected 0x + 40 hex chars)';
+        return true;
+    }
+    // Unknown chain — accept either format
+    if (!SOLANA_ADDR_RE.test(v) && !EVM_ADDR_RE.test(v)) {
+        return 'Invalid address format';
+    }
+    return true;
+}
 // ─── Browser ──────────────────────────────────────────────────────────────────
 /** Open a URL in the user's default browser (cross-platform). */
 export function openBrowser(url) {
     const plat = platform();
-    const cmd = plat === 'darwin' ? 'open' :
-        plat === 'win32' ? 'start ""' :
-            /* linux / others */ 'xdg-open';
-    exec(`${cmd} "${url}"`, (err) => {
+    let cmd;
+    let args;
+    if (plat === 'darwin') {
+        cmd = 'open';
+        args = [url];
+    }
+    else if (plat === 'win32') {
+        cmd = 'cmd';
+        args = ['/c', 'start', '', url];
+    }
+    else {
+        cmd = 'xdg-open';
+        args = [url];
+    }
+    execFile(cmd, args, (err) => {
         if (err) {
-            // Don't crash — the user can manually open the URL
             console.log(chalk.dim(`Could not open browser automatically. Please open this URL manually:`));
             console.log(chalk.cyan(url));
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "minara",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "CLI client for Minara.ai — login, trade, deposit/withdraw, chat and more from your terminal.",
   "type": "module",
   "main": "dist/index.js",