pandora-cli-skills 1.1.21 → 1.1.23

package/cli/lib/autopilot_state_store.cjs

@@ -111,8 +111,13 @@ function saveState(filePath, state) {
   const lockFd = acquireLock(lockPath);
   try {
     const tmp = `${resolved}.${process.pid}.${Date.now()}.${crypto.randomBytes(4).toString('hex')}.tmp`;
-    fs.writeFileSync(tmp, JSON.stringify(state, null, 2));
+    fs.writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 0o600 });
     fs.renameSync(tmp, resolved);
+    try {
+      fs.chmodSync(resolved, 0o600);
+    } catch {
+      // best-effort permission hardening
+    }
   } finally {
     try {
       fs.closeSync(lockFd);

package/cli/lib/mirror_daemon_service.cjs

@@ -8,6 +8,13 @@ const { expandHome } = require('./mirror_state_store.cjs');
 const MIRROR_DAEMON_SCHEMA_VERSION = '1.0.0';
 const STOP_TIMEOUT_MS = 5_000;
 const STOP_POLL_MS = 100;
+const SENSITIVE_CLI_FLAGS = new Set([
+  '--private-key',
+  '--webhook-secret',
+  '--telegram-bot-token',
+  '--discord-webhook-url',
+  '--webhook-template',
+]);
 
 function createServiceError(code, message, details = undefined) {
   const err = new Error(message);
@@ -30,6 +37,34 @@ function resolvePath(filePath) {
   return path.resolve(expandHome(String(filePath || '').trim()));
 }
 
+function sanitizeCliArgs(args = []) {
+  const sanitized = [];
+  for (let i = 0; i < args.length; i += 1) {
+    const token = String(args[i] || '');
+    const eqIndex = token.indexOf('=');
+    if (eqIndex > 0) {
+      const flag = token.slice(0, eqIndex);
+      if (SENSITIVE_CLI_FLAGS.has(flag)) {
+        sanitized.push(`${flag}=[redacted]`);
+        continue;
+      }
+    }
+
+    if (SENSITIVE_CLI_FLAGS.has(token)) {
+      sanitized.push(token);
+      const next = i + 1 < args.length ? String(args[i + 1] || '') : '';
+      if (next && !next.startsWith('--')) {
+        sanitized.push('[redacted]');
+        i += 1;
+      }
+      continue;
+    }
+
+    sanitized.push(token);
+  }
+  return sanitized;
+}
+
 function defaultPidFile(strategyHash) {
   const hash = normalizeStrategyHash(strategyHash);
   return path.join(os.homedir(), '.pandora', 'mirror', 'daemon', `${hash}.json`);
@@ -44,8 +79,13 @@ function writeJsonFile(filePath, payload) {
   fs.mkdirSync(path.dirname(filePath), { recursive: true });
   const tmpPath = `${filePath}.${process.pid}.${Date.now()}.${crypto.randomBytes(4).toString('hex')}.tmp`;
   const serialized = JSON.stringify(payload, null, 2);
-  fs.writeFileSync(tmpPath, serialized);
+  fs.writeFileSync(tmpPath, serialized, { mode: 0o600 });
   fs.renameSync(tmpPath, filePath);
+  try {
+    fs.chmodSync(filePath, 0o600);
+  } catch {
+    // best-effort permission hardening
+  }
 }
 
 function readJsonFile(filePath) {
@@ -131,6 +171,7 @@ function startDaemon(options = {}) {
   });
   child.unref();
   fs.closeSync(logFd);
+  const sanitizedCliArgs = sanitizeCliArgs(cliArgs);
 
   const metadata = {
     schemaVersion: MIRROR_DAEMON_SCHEMA_VERSION,
@@ -143,7 +184,7 @@ function startDaemon(options = {}) {
     pidFile,
     logFile,
     cliPath,
-    cliArgs,
+    cliArgs: sanitizedCliArgs,
     stateFile: options.stateFile || null,
     killSwitchFile: options.killSwitchFile || null,
     mode: options.mode || 'run',
@@ -151,7 +192,7 @@ function startDaemon(options = {}) {
     pandoraMarketAddress: options.pandoraMarketAddress || null,
     polymarketMarketId: options.polymarketMarketId || null,
     polymarketSlug: options.polymarketSlug || null,
-    launchCommand: [process.execPath, cliPath, ...cliArgs].join(' '),
+    launchCommand: [process.execPath, cliPath, ...sanitizedCliArgs].join(' '),
   };
   writeJsonFile(pidFile, metadata);
 

package/cli/lib/mirror_state_store.cjs

@@ -84,13 +84,18 @@ function saveState(filePath, state) {
   fs.mkdirSync(path.dirname(resolved), { recursive: true });
   const tmpPath = `${resolved}.${process.pid}.${Date.now()}.${crypto.randomBytes(4).toString('hex')}.tmp`;
   const serialized = JSON.stringify(state, null, 2);
-  fs.writeFileSync(tmpPath, serialized);
+  fs.writeFileSync(tmpPath, serialized, { mode: 0o600 });
   try {
     fs.renameSync(tmpPath, resolved);
+    try {
+      fs.chmodSync(resolved, 0o600);
+    } catch {
+      // best-effort permission hardening
+    }
   } catch (err) {
     if (err && err.code === 'ENOENT') {
       fs.mkdirSync(path.dirname(resolved), { recursive: true });
-      fs.writeFileSync(resolved, serialized);
+      fs.writeFileSync(resolved, serialized, { mode: 0o600 });
       if (fs.existsSync(tmpPath)) {
         try {
           fs.unlinkSync(tmpPath);

package/cli/lib/mirror_sync_service.cjs

@@ -504,27 +504,37 @@ async function runMirrorSync(options, deps = {}) {
             if (options.executeLive) {
               const envCreds = readTradingCredsFromEnv();
               let hedgeResult;
-              try {
-                hedgeResult = await hedgeFn({
-                  host: options.polymarketHost,
-                  mockUrl: options.polymarketMockUrl,
-                  tokenId,
-                  side: hedgeSide,
-                  amountUsd: plannedHedgeUsdc,
-                  privateKey: options.privateKey || envCreds.privateKey,
-                  funder: options.funder || envCreds.funder,
-                  apiKey: envCreds.apiKey,
-                  apiSecret: envCreds.apiSecret,
-                  apiPassphrase: envCreds.apiPassphrase,
-                });
-              } catch (err) {
+              if (!options.privateKey && envCreds.privateKeyInvalid) {
                 hedgeResult = {
                   ok: false,
                   error: {
-                    code: err && err.code ? String(err.code) : null,
-                    message: err && err.message ? String(err.message) : String(err),
+                    code: 'INVALID_ENV',
+                    message: 'POLYMARKET_PRIVATE_KEY must be a valid private key (0x + 64 hex chars).',
                   },
                 };
+              } else {
+                try {
+                  hedgeResult = await hedgeFn({
+                    host: options.polymarketHost,
+                    mockUrl: options.polymarketMockUrl,
+                    tokenId,
+                    side: hedgeSide,
+                    amountUsd: plannedHedgeUsdc,
+                    privateKey: options.privateKey || envCreds.privateKey,
+                    funder: options.funder || envCreds.funder,
+                    apiKey: envCreds.apiKey,
+                    apiSecret: envCreds.apiSecret,
+                    apiPassphrase: envCreds.apiPassphrase,
+                  });
+                } catch (err) {
+                  hedgeResult = {
+                    ok: false,
+                    error: {
+                      code: err && err.code ? String(err.code) : null,
+                      message: err && err.message ? String(err.message) : String(err),
+                    },
+                  };
+                }
               }
               action.hedge = {
                 tokenId,

package/cli/lib/polymarket_trade_adapter.cjs

@@ -35,6 +35,10 @@ function isConditionId(value) {
   return /^0x[a-fA-F0-9]{64}$/.test(String(value || '').trim());
 }
 
+function isValidPrivateKey(value) {
+  return /^0x[a-fA-F0-9]{64}$/.test(String(value || '').trim());
+}
+
 function toStringOrNull(value) {
   const normalized = String(value || '').trim();
   return normalized || null;
@@ -1032,8 +1036,11 @@ async function browsePolymarketMarkets(options = {}) {
 }
 
 function readTradingCredsFromEnv(env = process.env) {
+  const rawPrivateKey = String(env.POLYMARKET_PRIVATE_KEY || '').trim();
+  const privateKey = rawPrivateKey && isValidPrivateKey(rawPrivateKey) ? rawPrivateKey : null;
   const creds = {
-    privateKey: env.POLYMARKET_PRIVATE_KEY || null,
+    privateKey,
+    privateKeyInvalid: Boolean(rawPrivateKey && !privateKey),
     funder: env.POLYMARKET_FUNDER || null,
     apiKey: env.POLYMARKET_API_KEY || null,
     apiSecret: env.POLYMARKET_API_SECRET || null,
@@ -1281,6 +1288,9 @@ async function fetchPolymarketPositionSummary(options = {}) {
   }
 
   const envCreds = readTradingCredsFromEnv(options.env || process.env);
+  if (!options.privateKey && envCreds.privateKeyInvalid) {
+    diagnostics.push('POLYMARKET_PRIVATE_KEY is set but invalid (expected 0x + 64 hex chars).');
+  }
   const privateKey = options.privateKey || envCreds.privateKey;
   const funder = options.funder || envCreds.funder;
   const apiKey = options.apiKey || envCreds.apiKey;
@@ -1413,6 +1423,8 @@ async function buildTradingClient(options = {}) {
   const signatureType = resolveSignatureType(options);
   const cacheKey = buildTradingCacheKey(host, chain, options);
   const allowCache = options.disableCache !== true;
+  const timeoutMs = Number.isInteger(options.timeoutMs) && options.timeoutMs > 0 ? options.timeoutMs : 12_000;
+  const ClobCtor = options.clobClientClass || ClobClient;
 
   if (allowCache && tradingClientCache.has(cacheKey)) {
     return tradingClientCache.get(cacheKey);
@@ -1443,7 +1455,7 @@ async function buildTradingClient(options = {}) {
     if (allowCache && derivedCredsCache.has(cacheKey)) {
       creds = derivedCredsCache.get(cacheKey);
     } else {
-      const bootstrap = new ClobClient(
+      const bootstrap = new ClobCtor(
         host,
         chain,
         signer,
@@ -1459,12 +1471,27 @@ async function buildTradingClient(options = {}) {
       if (typeof bootstrap.deriveApiKey === 'function') {
         try {
           // deriveApiKey expects nonce, not signature type; default to nonce 0.
-          creds = await bootstrap.deriveApiKey(0);
-        } catch {
-          creds = await bootstrap.deriveApiKey();
+          creds = await callWithTimeout(
+            () => bootstrap.deriveApiKey(0),
+            timeoutMs,
+            'Polymarket deriveApiKey(0)',
+          );
+        } catch (err) {
+          if (err && typeof err.message === 'string' && err.message.includes('timed out')) {
+            throw err;
+          }
+          creds = await callWithTimeout(
+            () => bootstrap.deriveApiKey(),
+            timeoutMs,
+            'Polymarket deriveApiKey()',
+          );
         }
       } else if (typeof bootstrap.createOrDeriveApiKey === 'function') {
-        creds = await bootstrap.createOrDeriveApiKey();
+        creds = await callWithTimeout(
+          () => bootstrap.createOrDeriveApiKey(),
+          timeoutMs,
+          'Polymarket createOrDeriveApiKey()',
+        );
       } else {
         throw new Error('CLOB client does not support API key derivation.');
       }
@@ -1474,7 +1501,7 @@ async function buildTradingClient(options = {}) {
     }
   }
 
-  const client = new ClobClient(
+  const client = new ClobCtor(
     host,
     chain,
     signer,
@@ -1528,25 +1555,44 @@ async function placeHedgeOrder(options = {}) {
   const host = options.host || DEFAULT_POLYMARKET_HOST;
   const chain = options.chain || DEFAULT_POLYMARKET_CHAIN;
   const cacheKey = buildTradingCacheKey(host, chain, options);
+  const timeoutMs = Number.isInteger(options.timeoutMs) && options.timeoutMs > 0 ? options.timeoutMs : 12_000;
   const client = options.client || (await buildTradingClient(options));
   const side = resolveOrderSide(options.side || 'buy');
   try {
-    const tickSize = options.tickSize || (await client.getTickSize(tokenId));
-    const negRisk = typeof options.negRisk === 'boolean' ? options.negRisk : await client.getNegRisk(tokenId);
+    const tickSize =
+      options.tickSize ||
+      (await callWithTimeout(
+        () => client.getTickSize(tokenId),
+        timeoutMs,
+        `Polymarket getTickSize(${tokenId})`,
+      ));
+    const negRisk =
+      typeof options.negRisk === 'boolean'
+        ? options.negRisk
+        : await callWithTimeout(
+            () => client.getNegRisk(tokenId),
+            timeoutMs,
+            `Polymarket getNegRisk(${tokenId})`,
+          );
 
-    const response = await client.createAndPostMarketOrder(
-      {
-        tokenID: tokenId,
-        amount: amountUsd,
-        side,
-        orderType: OrderType.FAK,
-      },
-      {
-        tickSize,
-        negRisk,
-      },
-      OrderType.FAK,
-      false,
+    const response = await callWithTimeout(
+      () =>
+        client.createAndPostMarketOrder(
+          {
+            tokenID: tokenId,
+            amount: amountUsd,
+            side,
+            orderType: OrderType.FAK,
+          },
+          {
+            tickSize,
+            negRisk,
+          },
+          OrderType.FAK,
+          false,
+        ),
+      timeoutMs,
+      `Polymarket createAndPostMarketOrder(${tokenId})`,
     );
     const ok = responseIndicatesSuccess(response);
     if (!ok && classifyAuthFailure(response)) {

package/cli/pandora.cjs

@@ -572,7 +572,7 @@ function emitJson(payload) {
 }
 
 function emitJsonError(payload) {
-  console.error(JSON.stringify(payload, null, 2));
+  console.log(JSON.stringify(payload, null, 2));
 }
 
 function toErrorEnvelope(error) {
@@ -861,11 +861,17 @@ function parseAddressFlag(value, flagName) {
   return value.toLowerCase();
 }
 
+function redactSensitiveValue(value) {
+  const text = String(value || '').trim();
+  if (!text || text.length <= 10) return '[redacted]';
+  return `${text.slice(0, 6)}...${text.slice(-4)}`;
+}
+
 function parsePrivateKeyFlag(value, flagName = '--private-key') {
   if (!isValidPrivateKey(value)) {
     throw new CliError(
       'INVALID_FLAG_VALUE',
-      `${flagName} must be a valid private key (0x + 64 hex chars). Received: "${value}"`,
+      `${flagName} must be a valid private key (0x + 64 hex chars). Received: "${redactSensitiveValue(value)}"`,
     );
   }
   return value;
@@ -5018,7 +5024,14 @@ function hasPolymarketDoctorInputs() {
 }
 
 function validateEnvValues() {
-  const missing = REQUIRED_ENV_KEYS.filter((key) => !process.env[key] || !String(process.env[key]).trim());
+  const missing = REQUIRED_ENV_KEYS.filter((key) => {
+    if (key === 'PRIVATE_KEY') {
+      const primary = String(process.env.PANDORA_PRIVATE_KEY || '').trim();
+      const legacy = String(process.env.PRIVATE_KEY || '').trim();
+      return !primary && !legacy;
+    }
+    return !process.env[key] || !String(process.env[key]).trim();
+  });
   const missingSet = new Set(missing);
   const errors = [];
 
@@ -5038,9 +5051,11 @@ function validateEnvValues() {
     errors.push(`RPC_URL must be a valid http/https URL. Received: "${rpcUrl}"`);
   }
 
-  const privateKey = String(process.env.PRIVATE_KEY || '').trim();
+  const privateKey = String(process.env.PANDORA_PRIVATE_KEY || process.env.PRIVATE_KEY || '').trim();
   if (!missingSet.has('PRIVATE_KEY') && !isValidPrivateKey(privateKey)) {
-    errors.push('PRIVATE_KEY must be a full 32-byte hex key (0x + 64 hex chars), not a placeholder.');
+    errors.push(
+      'PANDORA_PRIVATE_KEY (preferred) or PRIVATE_KEY must be a full 32-byte hex key (0x + 64 hex chars), not a placeholder.',
+    );
   }
 
   for (const key of ['ORACLE', 'FACTORY', 'USDC']) {
@@ -7240,9 +7255,12 @@ function resolveTradeRuntimeConfig(options) {
     throw new CliError('INVALID_FLAG_VALUE', `RPC URL must be a valid http/https URL. Received: "${rpcUrl}"`);
   }
 
-  const privateKey = options.privateKey || process.env.PRIVATE_KEY || process.env.DEPLOYER_PRIVATE_KEY;
+  const privateKey = options.privateKey || process.env.PANDORA_PRIVATE_KEY || process.env.PRIVATE_KEY;
   if (!privateKey || !isValidPrivateKey(privateKey)) {
-    throw new CliError('INVALID_FLAG_VALUE', 'Missing or invalid private key. Set PRIVATE_KEY or pass --private-key.');
+    throw new CliError(
+      'INVALID_FLAG_VALUE',
+      'Missing or invalid private key. Set PANDORA_PRIVATE_KEY (preferred) or PRIVATE_KEY, or pass --private-key.',
+    );
   }
 
   const usdc = options.usdc || String(process.env.USDC || '').trim();
@@ -9909,6 +9927,12 @@ async function runPolymarketCommand(args, context) {
     }
 
     const envCreds = readTradingCredsFromEnv();
+    if (!options.privateKey && envCreds.privateKeyInvalid) {
+      throw new CliError(
+        'INVALID_FLAG_VALUE',
+        'POLYMARKET_PRIVATE_KEY must be a valid private key (0x + 64 hex chars).',
+      );
+    }
     let result;
     try {
       result = await placeHedgeOrder({
@@ -10530,7 +10554,7 @@ async function main() {
     outputMode = parsed.outputMode;
     args = parsed.args;
   } catch (err) {
-    emitFailure(outputMode, err);
+    emitFailure('json', err);
     return;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pandora-cli-skills",
-  "version": "1.1.21",
+  "version": "1.1.23",
   "description": "Pandora CLI & Skills",
   "main": "cli/pandora.cjs",
   "bin": {

package/scripts/.env.example

@@ -1,6 +1,9 @@
 # Runtime variables for market launcher scripts
 CHAIN_ID=1
 RPC_URL=https://ethereum.publicnode.com
+# Preferred key name for Pandora execution commands:
+PANDORA_PRIVATE_KEY=0x...
+# Backward-compatible legacy key name (still supported):
 PRIVATE_KEY=0x...
 ORACLE=0x259308E7d8557e4Ba192De1aB8Cf7e0E21896442
 FACTORY=0xaB120F1FD31FB1EC39893B75d80a3822b1Cd8d0c