nansen-cli 1.35.0 → 1.36.0

package/src/hl-env.js

@@ -0,0 +1,37 @@
+/**
+ * Nansen CLI — which Hyperliquid network we are talking to.
+ *
+ * Its own module because both halves of the HL path need it and neither should
+ * have to import the other: hl-action.js builds actions (pure, golden-vector
+ * pinned) and hl-client.js submits them. Deriving the network from one place
+ * keeps a signed action in step with the URL it is submitted to.
+ */
+
+export const HL_MAINNET_API_URL = 'https://api.hyperliquid.xyz';
+export const HL_TESTNET_API_URL = 'https://api.hyperliquid-testnet.xyz';
+
+// Resolve the HL API base. NANSEN_HL_API_URL overrides it (tests, or pointing at
+// the testnet); defaults to mainnet.
+export function hlApiUrl() {
+  return process.env.NANSEN_HL_API_URL || HL_MAINNET_API_URL;
+}
+
+// Which HL network the resolved base URL points at.
+//
+// Actions are network-specific in two places: the L1 phantom agent's `source`
+// ("a" mainnet, "b" testnet) and the `hyperliquidChain` field of a user-signed
+// action ("Mainnet"/"Testnet"). Both used to be hardcoded to mainnet, so
+// pointing NANSEN_HL_API_URL at the testnet signed mainnet-shaped actions that
+// the testnet rejects.
+//
+// Anything not recognisably the testnet host is treated as mainnet, which keeps
+// a local mock (tests) on the mainnet vectors.
+export function hlNetwork() {
+  let host;
+  try {
+    host = new URL(hlApiUrl()).hostname.toLowerCase();
+  } catch {
+    return 'Mainnet';
+  }
+  return host.includes('hyperliquid-testnet') ? 'Testnet' : 'Mainnet';
+}

package/src/keychain.js

@@ -73,7 +73,9 @@ function keychainRetrieve() {
         '-a', ACCOUNT,
         '-w',
       ], { timeout: TIMEOUT_MS, stdio: ['pipe', 'pipe', 'pipe'] });
-      const pw = result.toString().trim();
+      // Strip only the trailing newline the OS tool appends — trimming all
+      // whitespace would corrupt a password with leading/trailing spaces.
+      const pw = result.toString().replace(/\r?\n$/, '');
       return pw || null;
     }
 
@@ -83,7 +85,9 @@ function keychainRetrieve() {
         'service', SERVICE,
         'account', ACCOUNT,
       ], { timeout: TIMEOUT_MS, stdio: ['pipe', 'pipe', 'pipe'] });
-      const pw = result.toString().trim();
+      // Strip only the trailing newline the OS tool appends — trimming all
+      // whitespace would corrupt a password with leading/trailing spaces.
+      const pw = result.toString().replace(/\r?\n$/, '');
       return pw || null;
     }
 

package/src/limit-order.js

@@ -381,14 +381,20 @@ export function parseExpiry(expiryStr) {
   const match = expiryStr.match(/^(\d+)(h|d)$/i);
   if (match) {
     const value = parseInt(match[1], 10);
+    if (value <= 0) {
+      throw new Error(`Invalid expiry "${expiryStr}". Duration must be greater than 0.`);
+    }
     const unit = match[2].toLowerCase();
     const ms = unit === 'h' ? value * 3600 * 1000 : value * 24 * 3600 * 1000;
     return Date.now() + ms;
   }
 
-  // Try as raw epoch ms
+  // Try as raw epoch ms — must be in the future, or the order expires on arrival.
   const num = Number(expiryStr);
-  if (!isNaN(num) && num > Date.now() - 86400000) {
+  if (!isNaN(num)) {
+    if (num <= Date.now()) {
+      throw new Error(`Expiry "${expiryStr}" is in the past. Provide a future time (e.g. "24h", "7d", or a future epoch in ms).`);
+    }
     return num;
   }
 
@@ -432,8 +438,16 @@ function formatAmount(amount, mintAddress) {
   if (!amount) return '?';
   const info = KNOWN_SOLANA_TOKENS[mintAddress];
   if (!info) return `${amount} ${mintAddress || '?'}`;
-  const raw = BigInt(amount);
-  const divisor = BigInt(10 ** info.decimals);
+  // amount is backend-controlled; a float or scientific-notation string makes
+  // BigInt() throw. Fall back to the raw amount rather than aborting the whole
+  // list render.
+  let raw;
+  try {
+    raw = BigInt(amount);
+  } catch {
+    return `${amount} ${info.symbol}`;
+  }
+  const divisor = 10n ** BigInt(info.decimals);
   const whole = raw / divisor;
   const frac = raw % divisor;
   const fracStr = frac.toString().padStart(info.decimals, '0').replace(/0+$/, '');