nansen-cli 1.23.0 → 1.23.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 1.23.1
+
+### Patch Changes
+
+- [#361](https://github.com/nansen-ai/nansen-cli/pull/361) [`ff22da3`](https://github.com/nansen-ai/nansen-cli/commit/ff22da376c1072ef06e84054f6ee31c058e6e08c) Thanks [@TimNooren](https://github.com/TimNooren)! - fix(alerts): error when --webhook-secret is passed without --webhook
+
+  Previously, passing --webhook-secret with a non-webhook channel (e.g. --telegram)
+  silently discarded the secret with no warning. The alert was created successfully
+  but without any signing, giving the false impression that the secret was active.
+
+  Now throws an actionable error: "--webhook-secret requires --webhook".
+
+- [#358](https://github.com/nansen-ai/nansen-cli/pull/358) [`70ee712`](https://github.com/nansen-ai/nansen-cli/commit/70ee71205343fb2d003eb5f50144e266bdc6109e) Thanks [@TimNooren](https://github.com/TimNooren)! - Add pre-quote trade input validation: rejects same-token swaps, invalid address formats, and non-positive amounts before any network call.
+
 ## 1.23.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nansen-cli",
-  "version": "1.23.0",
+  "version": "1.23.1",
   "description": "Command-line interface for Nansen API - designed for AI agents",
   "main": "src/index.js",
   "type": "module",

package/src/commands/alerts.js

@@ -560,8 +560,11 @@ USAGE:
         return;
       }
 
-      // Build channels array from --telegram/--slack/--discord flags
+      // Build channels array from --telegram/--slack/--discord/--webhook flags
       function buildChannels() {
+        if (options["webhook-secret"] && !options.webhook) {
+          throw new NansenError('--webhook-secret requires --webhook', ErrorCode.INVALID_PARAMS);
+        }
         const channels = [];
         if (options.telegram) channels.push({ type: 'telegram', data: { chatId: String(options.telegram) } });
         if (options.slack) channels.push({ type: 'slack', data: { webhookUrl: options.slack } });

package/src/trade-validation.js

@@ -0,0 +1,54 @@
+/**
+ * Trade input validation for the Nansen CLI.
+ * Catches common agent errors (wrong addresses, same-token swaps,
+ * bad amounts) before any network call.
+ */
+
+import { validateAddress } from './api.js';
+
+const SUPPORTED_CHAINS = ['solana', 'base'];
+
+/**
+ * Validate quote inputs before any network call.
+ * Throws on validation failure with an actionable error message.
+ */
+export function validateQuoteInput({ chain, from, to, amount }) {
+  // 1. Chain must be supported
+  const normalizedChain = chain?.toLowerCase();
+  if (!SUPPORTED_CHAINS.includes(normalizedChain)) {
+    throw new Error(
+      `Unsupported chain "${chain}". Supported chains: ${SUPPORTED_CHAINS.join(', ')}.`
+    );
+  }
+
+  // 2. Amount must be a positive finite number
+  const numAmount = Number(amount);
+  if (!Number.isFinite(numAmount) || numAmount <= 0) {
+    throw new Error(
+      `Invalid amount "${amount}". Must be a positive number.`
+    );
+  }
+
+  // 3. Token address format must match the chain (reuses api.js validateAddress)
+  const fromResult = validateAddress(from, normalizedChain);
+  if (!fromResult.valid) {
+    throw new Error(
+      `Invalid sell token address for ${normalizedChain}. ${fromResult.error}`
+    );
+  }
+  const toResult = validateAddress(to, normalizedChain);
+  if (!toResult.valid) {
+    throw new Error(
+      `Invalid buy token address for ${normalizedChain}. ${toResult.error}`
+    );
+  }
+
+  // 4. Sell and buy tokens must be different
+  const fromNorm = normalizedChain === 'solana' ? from : from.toLowerCase();
+  const toNorm = normalizedChain === 'solana' ? to : to.toLowerCase();
+  if (fromNorm === toNorm) {
+    throw new Error(
+      `Cannot swap ${from} for itself. Sell and buy tokens must be different.`
+    );
+  }
+}

package/src/trading.js

@@ -13,6 +13,7 @@ import { base58Decode } from './transfer.js';
 import { keccak256, signSecp256k1, rlpEncode } from './crypto.js';
 import { getWalletConnectAddress, sendTransactionViaWalletConnect, sendSolanaTransactionViaWalletConnect, sendApprovalViaWalletConnect } from './walletconnect-trading.js';
 import { retrievePassword } from './keychain.js';
+import { validateQuoteInput } from './trade-validation.js';
 import { CHAIN_RPCS } from './rpc-urls.js';
 
 // ============= Constants =============
@@ -877,6 +878,16 @@ EXAMPLES:
         return;
       }
 
+      // Static input validation — catches common agent errors (wrong addresses,
+      // same-token swaps, bad amounts) before any network or wallet call.
+      try {
+        validateQuoteInput({ chain, from, to, amount });
+      } catch (validationErr) {
+        log(`Error: ${validationErr.message}`);
+        exit(1);
+        return;
+      }
+
       // When --amount-unit token is used, resolve decimals and convert to base units.
       // Otherwise, validate that the amount is already in base units (integer).
       let resolvedAmount = amount;