pandora-cli-skills 1.1.48 → 1.1.49

package/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: pandora-cli-skills
 summary: Canonical skill and operator guide for Pandora CLI including mirror, polymarket, resolve, and LP flows.
-version: 1.1.48
+version: 1.1.49
 ---
 
 # Pandora CLI & Skills

package/cli/lib/error_recovery_service.cjs

@@ -43,6 +43,24 @@ function buildMirrorDeployRetryCommand(cliName) {
   return `${cliName} mirror deploy --dry-run --plan-file <plan-file>`;
 }
 
+function buildMirrorVerifyRetryCommand(cliName, details) {
+  const pandoraMarketAddress = toAddressOrPlaceholder(details && details.pandoraMarketAddress);
+  const polymarketMarketId = cleanToken(details && details.polymarketMarketId, '');
+  const polymarketSlug = cleanToken(details && details.polymarketSlug, '');
+  const manifestFile = cleanToken(details && details.manifestFile, '');
+  const command = [
+    `${cliName} mirror verify`,
+    `--market-address ${pandoraMarketAddress}`,
+    polymarketMarketId ? `--polymarket-market-id ${polymarketMarketId}` : null,
+    !polymarketMarketId && polymarketSlug ? `--polymarket-slug ${polymarketSlug}` : null,
+    '--trust-deploy',
+    manifestFile ? `--manifest-file ${manifestFile}` : null,
+  ]
+    .filter(Boolean)
+    .join(' ');
+  return command;
+}
+
 function buildMirrorSyncRetryCommand(cliName) {
   return `${cliName} mirror sync once --paper --pandora-market-address <address> --polymarket-market-id <id>`;
 }
@@ -197,13 +215,19 @@ function createErrorRecoveryService(options = {}) {
         };
       case 'MIRROR_DEPLOY_FAILED':
       case 'MIRROR_GO_FAILED':
-      case 'MIRROR_GO_VERIFY_FAILED':
       case 'MIRROR_GO_PREFLIGHT_FAILED':
         return {
           action: 'Re-run mirror deploy/verify in dry-run mode',
           command: buildMirrorDeployRetryCommand(cliName),
           retryable: true,
         };
+      case 'MIRROR_GO_VERIFY_FAILED':
+      case 'MIRROR_GO_VERIFY_PENDING':
+        return {
+          action: 'Retry verification against the existing deployed market (do not redeploy)',
+          command: buildMirrorVerifyRetryCommand(cliName, details),
+          retryable: true,
+        };
       case 'MIRROR_SYNC_FAILED':
       case 'MIRROR_GO_SYNC_FAILED':
       case 'MIRROR_SYNC_PREFLIGHT_FAILED':

package/cli/lib/lp_command_service.cjs

@@ -14,6 +14,8 @@ function createRunLpCommand(deps) {
   const includesHelpFlag = requireDep(deps, 'includesHelpFlag');
   const emitSuccess = requireDep(deps, 'emitSuccess');
   const commandHelpPayload = requireDep(deps, 'commandHelpPayload');
+  const parseIndexerSharedFlags = requireDep(deps, 'parseIndexerSharedFlags');
+  const maybeLoadTradeEnv = requireDep(deps, 'maybeLoadTradeEnv');
   const parseLpFlags = requireDep(deps, 'parseLpFlags');
   const runLp = requireDep(deps, 'runLp');
   const renderSingleEntityTable = requireDep(deps, 'renderSingleEntityTable');
@@ -27,18 +29,26 @@ function createRunLpCommand(deps) {
           context.outputMode,
           'lp.help',
           commandHelpPayload(
-            'pandora [--output table|json] lp add|remove|positions [--market-address <address>] [--wallet <address>] [--amount-usdc <n>] [--lp-tokens <n>] [--dry-run|--execute] [--fork] [--fork-rpc-url <url>] [--fork-chain-id <id>] [--chain-id <id>] [--rpc-url <url>] [--private-key <hex>] [--usdc <address>] [--deadline-seconds <n>] [--indexer-url <url>] [--timeout-ms <ms>]',
+            'pandora [--output table|json] lp add|remove|positions [--market-address <address>] [--wallet <address>] [--amount-usdc <n>] [--lp-tokens <n>|--all] [--dry-run|--execute] [--fork] [--fork-rpc-url <url>] [--fork-chain-id <id>] [--chain-id <id>] [--rpc-url <url>] [--private-key <hex>] [--usdc <address>] [--deadline-seconds <n>] [--indexer-url <url>] [--timeout-ms <ms>]',
           ),
         );
       } else {
         // eslint-disable-next-line no-console
         console.log(
-          'Usage: pandora [--output table|json] lp add|remove|positions [--market-address <address>] [--wallet <address>] [--amount-usdc <n>] [--lp-tokens <n>] [--dry-run|--execute] [--fork] [--fork-rpc-url <url>] [--fork-chain-id <id>] [--chain-id <id>] [--rpc-url <url>] [--private-key <hex>] [--usdc <address>] [--deadline-seconds <n>] [--indexer-url <url>] [--timeout-ms <ms>]',
+          'Usage: pandora [--output table|json] lp add|remove|positions [--market-address <address>] [--wallet <address>] [--amount-usdc <n>] [--lp-tokens <n>|--all] [--dry-run|--execute] [--fork] [--fork-rpc-url <url>] [--fork-chain-id <id>] [--chain-id <id>] [--rpc-url <url>] [--private-key <hex>] [--usdc <address>] [--deadline-seconds <n>] [--indexer-url <url>] [--timeout-ms <ms>]',
         );
       }
       return;
     }
-    const options = parseLpFlags(args);
+    const shared = parseIndexerSharedFlags(args);
+    maybeLoadTradeEnv(shared);
+    const options = parseLpFlags(shared.rest);
+    if (shared.indexerUrl) {
+      options.indexerUrl = shared.indexerUrl;
+    }
+    if (Number.isFinite(shared.timeoutMs)) {
+      options.timeoutMs = shared.timeoutMs;
+    }
     if (options.execute && options.action !== 'positions' && assertLiveWriteAllowed) {
       await assertLiveWriteAllowed(`lp.${options.action}.execute`, {
         notionalUsdc: options.action === 'add' ? options.amountUsdc : null,

package/cli/lib/market_admin_service.cjs

@@ -813,7 +813,7 @@ async function runLpRemove(options = {}) {
     status: options.execute ? 'submitted' : 'planned',
     action: 'remove',
     marketAddress: options.marketAddress,
-    lpTokens: options.lpTokens,
+    lpTokens: options.lpAll ? 'all' : options.lpTokens,
     deadlineSeconds,
     txPlan: null,
     preflight: null,
@@ -835,6 +835,20 @@ async function runLpRemove(options = {}) {
 
   if (!options.execute) {
     const deadline = BigInt(Math.floor(Date.now() / 1000) + deadlineSeconds);
+    if (options.lpAll) {
+      payload.txPlan = {
+        lpTokenDecimalsAssumed: 18,
+        sharesToBurnRaw: null,
+        sharesToBurnMode: 'all-onchain-balance-at-execution',
+        minCollateralOutRaw: '0',
+        deadline: deadline.toString(),
+        removeLiquidityArgOrder: 'sharesToBurn, minCollateralOut, deadline',
+      };
+      payload.diagnostics.push(
+        'Dry-run with --all defers LP token amount resolution to execution-time on-chain balance.',
+      );
+      return payload;
+    }
     payload.txPlan = {
       lpTokenDecimalsAssumed: 18,
       sharesToBurnRaw: parseUnits(String(options.lpTokens), 18).toString(),
@@ -849,7 +863,26 @@ async function runLpRemove(options = {}) {
   await ensureContractCode(publicClient, marketAddress, 'Market');
 
   const lpTokenDecimals = await readDecimals(publicClient, marketAddress, 18);
-  const sharesToBurnRaw = parseUnits(String(options.lpTokens), lpTokenDecimals);
+  let sharesToBurnRaw;
+  if (options.lpAll) {
+    const balanceRaw = await publicClient.readContract({
+      address: marketAddress,
+      abi: LP_TOKEN_ABI,
+      functionName: 'balanceOf',
+      args: [account.address],
+    });
+    if (typeof balanceRaw !== 'bigint' || balanceRaw <= 0n) {
+      throw createServiceError('LP_REMOVE_ZERO_BALANCE', 'No LP token balance available to remove with --all.', {
+        marketAddress,
+        account: account.address,
+      });
+    }
+    sharesToBurnRaw = balanceRaw;
+    payload.lpTokens = formatUnits(balanceRaw, lpTokenDecimals);
+    payload.diagnostics.push('Using full LP token balance (--all) from on-chain balanceOf(account).');
+  } else {
+    sharesToBurnRaw = parseUnits(String(options.lpTokens), lpTokenDecimals);
+  }
   const deadline = BigInt(Math.floor(Date.now() / 1000) + deadlineSeconds);
   const minCollateralOutRaw = 0n;
   const preview = await readCalcRemoveLiquidity(publicClient, marketAddress, sharesToBurnRaw);

package/cli/lib/mirror_command_service.cjs

@@ -4,7 +4,7 @@
  * @type {string}
  */
 const MIRROR_GO_USAGE =
-  'pandora [--output table|json] mirror go --polymarket-market-id <id>|--polymarket-slug <slug> [--liquidity-usdc <n>] [--fee-tier <500-50000>] [--max-imbalance <n>] [--arbiter <address>] [--category <n>] [--paper|--dry-run|--execute-live|--execute] [--auto-sync] [--sync-once] [--sync-interval-ms <ms>] [--hedge-ratio <n>] [--no-hedge] [--max-rebalance-usdc <n>] [--max-hedge-usdc <n>] [--max-open-exposure-usdc <n>] [--max-trades-per-day <n>] [--cooldown-ms <ms>] [--chain-id <id>] [--rpc-url <url>] [--private-key <hex>] [--funder <address>] [--usdc <address>] [--oracle <address>] [--factory <address>] [--sources <url...>] [--manifest-file <path>] [--trust-deploy] [--skip-gate] [--polymarket-host <url>] [--polymarket-gamma-url <url>] [--polymarket-gamma-mock-url <url>] [--polymarket-mock-url <url>] [--with-rules] [--include-similarity] [--min-close-lead-seconds <n>]';
+  'pandora [--output table|json] mirror go --polymarket-market-id <id>|--polymarket-slug <slug> [--liquidity-usdc <n>] [--fee-tier <500-50000>] [--max-imbalance <n>] [--arbiter <address>] [--category <n>] [--paper|--dry-run|--execute-live|--execute] [--auto-sync] [--sync-once] [--sync-interval-ms <ms>] [--hedge-ratio <n>] [--no-hedge] [--max-rebalance-usdc <n>] [--max-hedge-usdc <n>] [--max-open-exposure-usdc <n>] [--max-trades-per-day <n>] [--cooldown-ms <ms>] [--chain-id <id>] [--rpc-url <url>] [--polymarket-rpc-url <url>] [--private-key <hex>] [--funder <address>] [--usdc <address>] [--oracle <address>] [--factory <address>] [--sources <url...>] [--manifest-file <path>] [--trust-deploy] [--skip-gate] [--polymarket-host <url>] [--polymarket-gamma-url <url>] [--polymarket-gamma-mock-url <url>] [--polymarket-mock-url <url>] [--with-rules] [--include-similarity] [--min-close-lead-seconds <n>]';
 
 /**
  * Canonical usage string for `mirror sync`.
@@ -12,7 +12,7 @@ const MIRROR_GO_USAGE =
  * @type {string}
  */
 const MIRROR_SYNC_USAGE =
-  'pandora [--output table|json] mirror sync run|once|start --pandora-market-address <address>|--market-address <address> --polymarket-market-id <id>|--polymarket-slug <slug> [--paper|--dry-run|--execute-live|--execute] [--private-key <hex>] [--funder <address>] [--usdc <address>] [--trust-deploy] [--manifest-file <path>] [--skip-gate] [--daemon] [--stream|--no-stream] [--interval-ms <ms>] [--drift-trigger-bps <n>] [--hedge-trigger-usdc <n>] [--hedge-ratio <n>] [--no-hedge] [--max-rebalance-usdc <n>] [--max-hedge-usdc <n>] [--max-open-exposure-usdc <n>] [--max-trades-per-day <n>] [--cooldown-ms <ms>] [--depth-slippage-bps <n>] [--min-time-to-close-sec <n>] [--iterations <n>] [--state-file <path>] [--kill-switch-file <path>] [--chain-id <id>] [--rpc-url <url>] [--polymarket-host <url>] [--polymarket-gamma-url <url>] [--polymarket-gamma-mock-url <url>] [--polymarket-mock-url <url>] [--webhook-url <url>] [--telegram-bot-token <token>] [--telegram-chat-id <id>] [--discord-webhook-url <url>]';
+  'pandora [--output table|json] mirror sync run|once|start --pandora-market-address <address>|--market-address <address> --polymarket-market-id <id>|--polymarket-slug <slug> [--paper|--dry-run|--execute-live|--execute] [--private-key <hex>] [--funder <address>] [--usdc <address>] [--trust-deploy] [--manifest-file <path>] [--skip-gate] [--daemon] [--stream|--no-stream] [--interval-ms <ms>] [--drift-trigger-bps <n>] [--hedge-trigger-usdc <n>] [--hedge-ratio <n>] [--no-hedge] [--max-rebalance-usdc <n>] [--max-hedge-usdc <n>] [--max-open-exposure-usdc <n>] [--max-trades-per-day <n>] [--cooldown-ms <ms>] [--depth-slippage-bps <n>] [--min-time-to-close-sec <n>] [--iterations <n>] [--state-file <path>] [--kill-switch-file <path>] [--chain-id <id>] [--rpc-url <url>] [--polymarket-rpc-url <url>] [--polymarket-host <url>] [--polymarket-gamma-url <url>] [--polymarket-gamma-mock-url <url>] [--polymarket-mock-url <url>] [--webhook-url <url>] [--telegram-bot-token <token>] [--telegram-chat-id <id>] [--discord-webhook-url <url>]';
 
 const INVALID_SUBCOMMAND_MESSAGE =
   'mirror requires subcommand: browse|plan|deploy|verify|lp-explain|hedge-calc|simulate|go|sync|status|close';

package/cli/lib/mirror_handlers/go.cjs

@@ -16,6 +16,9 @@ module.exports = async function handleMirrorGo({ shared, context, deps, mirrorGo
     buildMirrorPlan,
     deployMirror,
     resolveTrustedDeployPair,
+    findMirrorPair,
+    defaultMirrorManifestFile,
+    hasContractCodeAtAddress,
     verifyMirror,
     runLivePolymarketPreflightForMirror,
     runMirrorSync,
@@ -46,32 +49,19 @@ module.exports = async function handleMirrorGo({ shared, context, deps, mirrorGo
     console.error(`Warning: ${deprecatedForceGateWarning}`);
   }
 
+  const diagnostics = [];
+  if (deprecatedForceGateWarning) diagnostics.push(deprecatedForceGateWarning);
   let planPayload;
-  let deployPayload;
   try {
     planPayload = await buildMirrorPlan({
       ...options,
       indexerUrl,
       timeoutMs: shared.timeoutMs,
     });
-    if (options.executeLive && typeof assertLiveWriteAllowed === 'function') {
-      await assertLiveWriteAllowed('mirror.go.deploy.execute', {
-        notionalUsdc: options.liquidityUsdc,
-        runtimeMode: 'live',
-      });
-    }
-    deployPayload = await deployMirror({
-      ...options,
-      planData: planPayload,
-      execute: options.executeLive,
-      indexerUrl,
-      timeoutMs: shared.timeoutMs,
-    });
   } catch (err) {
     throw coerceMirrorServiceError(err, 'MIRROR_GO_FAILED');
   }
 
-  const pandoraMarketAddress = deployPayload && deployPayload.pandora ? deployPayload.pandora.marketAddress : null;
   const sourceSelector = {
     polymarketMarketId:
       (planPayload && planPayload.sourceMarket && planPayload.sourceMarket.marketId) || options.polymarketMarketId || null,
@@ -79,17 +69,115 @@ module.exports = async function handleMirrorGo({ shared, context, deps, mirrorGo
       (planPayload && planPayload.sourceMarket && planPayload.sourceMarket.slug) || options.polymarketSlug || null,
   };
 
+  let reusedManifestLookup = null;
+  if (
+    options.executeLive &&
+    typeof findMirrorPair === 'function' &&
+    (sourceSelector.polymarketMarketId || sourceSelector.polymarketSlug)
+  ) {
+    const manifestFilePath =
+      options.manifestFile || (typeof defaultMirrorManifestFile === 'function' ? defaultMirrorManifestFile() : null);
+    if (manifestFilePath) {
+      try {
+        const lookup = findMirrorPair(manifestFilePath, sourceSelector);
+        if (
+          lookup &&
+          lookup.pair &&
+          lookup.pair.trusted !== false &&
+          lookup.pair.pandoraMarketAddress
+        ) {
+          let allowReuse = true;
+          if (typeof hasContractCodeAtAddress === 'function') {
+            try {
+              const hasCode = await hasContractCodeAtAddress({
+                marketAddress: lookup.pair.pandoraMarketAddress,
+                chainId: options.chainId,
+                rpcUrl: options.rpcUrl,
+              });
+              if (!hasCode) {
+                allowReuse = false;
+                diagnostics.push(
+                  `Trusted mirror pair exists but has no bytecode at ${lookup.pair.pandoraMarketAddress}; continuing with fresh deploy.`,
+                );
+              }
+            } catch (err) {
+              diagnostics.push(
+                `On-chain deploy dedupe probe failed (${lookup.pair.pandoraMarketAddress}): ${err && err.message ? err.message : String(err)}. Conservatively reusing trusted pair to avoid duplicate spend.`,
+              );
+            }
+          }
+          if (allowReuse) {
+            reusedManifestLookup = lookup;
+            diagnostics.push(
+              `Trusted mirror pair already exists (${lookup.pair.pandoraMarketAddress}); deploy step skipped to prevent duplicate market creation.`,
+            );
+          }
+        }
+      } catch (err) {
+        diagnostics.push(`Mirror manifest lookup failed: ${err && err.message ? err.message : String(err)}`);
+      }
+    }
+  }
+
+  let deployPayload;
+  try {
+    if (reusedManifestLookup) {
+      deployPayload = {
+        schemaVersion: '1.0.0',
+        generatedAt: new Date().toISOString(),
+        mode: 'execute',
+        dryRun: false,
+        sourceMarket: planPayload && planPayload.sourceMarket ? planPayload.sourceMarket : null,
+        planDigest: planPayload && planPayload.planDigest ? planPayload.planDigest : null,
+        pandora: {
+          marketAddress: reusedManifestLookup.pair.pandoraMarketAddress,
+          pollAddress: reusedManifestLookup.pair.pandoraPollAddress || null,
+        },
+        trustManifest: {
+          filePath: reusedManifestLookup.filePath,
+          pair: reusedManifestLookup.pair,
+        },
+        diagnostics: [
+          'Deploy skipped because trusted manifest already maps this source to an on-chain market.',
+        ],
+      };
+    } else {
+      if (options.executeLive && typeof assertLiveWriteAllowed === 'function') {
+        await assertLiveWriteAllowed('mirror.go.deploy.execute', {
+          notionalUsdc: options.liquidityUsdc,
+          runtimeMode: 'live',
+        });
+      }
+      deployPayload = await deployMirror({
+        ...options,
+        planData: planPayload,
+        execute: options.executeLive,
+        indexerUrl,
+        timeoutMs: shared.timeoutMs,
+      });
+    }
+  } catch (err) {
+    throw coerceMirrorServiceError(err, 'MIRROR_GO_FAILED');
+  }
+
+  const pandoraMarketAddress = deployPayload && deployPayload.pandora ? deployPayload.pandora.marketAddress : null;
+
   let verifyPayload = null;
   let syncPayload = null;
   let polymarketPreflight = null;
   let suggestedSyncCommand = null;
-  let trustManifest = deployPayload && deployPayload.trustManifest ? deployPayload.trustManifest : null;
+  let trustManifest =
+    (deployPayload && deployPayload.trustManifest ? deployPayload.trustManifest : null)
+    || (reusedManifestLookup
+      ? {
+          filePath: reusedManifestLookup.filePath,
+          pair: reusedManifestLookup.pair,
+        }
+      : null);
   let trustDeploy = Boolean(options.trustDeploy);
   if (!trustDeploy && trustManifest && trustManifest.pair) {
     trustDeploy = true;
   }
-  const diagnostics = [];
-  if (deprecatedForceGateWarning) diagnostics.push(deprecatedForceGateWarning);
 
   if (pandoraMarketAddress) {
     if (!trustManifest && (options.executeLive || options.trustDeploy)) {
@@ -127,6 +215,23 @@ module.exports = async function handleMirrorGo({ shared, context, deps, mirrorGo
         allowRuleMismatch: false,
       });
     } catch (err) {
+      if (options.executeLive) {
+        throw new CliError(
+          'MIRROR_GO_VERIFY_PENDING',
+          `Mirror market ${pandoraMarketAddress} is deployed, but verification failed (likely indexer/indexing lag). Do not rerun mirror go --execute-live; run mirror verify against this market address.`,
+          {
+            pandoraMarketAddress,
+            polymarketMarketId: sourceSelector.polymarketMarketId || null,
+            polymarketSlug: sourceSelector.polymarketSlug || null,
+            manifestFile:
+              (trustManifest && trustManifest.filePath)
+              || options.manifestFile
+              || (typeof defaultMirrorManifestFile === 'function' ? defaultMirrorManifestFile() : null),
+            reusedManifestPair: Boolean(reusedManifestLookup),
+            cause: err && err.message ? err.message : String(err),
+          },
+        );
+      }
       throw coerceMirrorServiceError(err, 'MIRROR_GO_VERIFY_FAILED');
     }
 
@@ -139,7 +244,8 @@ module.exports = async function handleMirrorGo({ shared, context, deps, mirrorGo
       if (options.executeLive) {
         try {
           polymarketPreflight = await runLivePolymarketPreflightForMirror({
-            rpcUrl: options.rpcUrl,
+            rpcUrl: options.polymarketRpcUrl || options.rpcUrl,
+            polymarketRpcUrl: options.polymarketRpcUrl,
             privateKey: options.privateKey,
             funder: options.funder,
           });
@@ -173,6 +279,7 @@ module.exports = async function handleMirrorGo({ shared, context, deps, mirrorGo
         killSwitchFile: null,
         chainId: options.chainId,
         rpcUrl: options.rpcUrl,
+        polymarketRpcUrl: options.polymarketRpcUrl,
         privateKey: options.privateKey,
         funder: options.funder,
         usdc: options.usdc,
@@ -248,6 +355,7 @@ module.exports = async function handleMirrorGo({ shared, context, deps, mirrorGo
           ? `--polymarket-slug ${sourceSelector.polymarketSlug}`
           : null,
         '--paper',
+        options.polymarketRpcUrl ? `--polymarket-rpc-url ${options.polymarketRpcUrl}` : null,
         `--drift-trigger-bps ${options.driftTriggerBps}`,
         `--hedge-trigger-usdc ${options.hedgeTriggerUsdc}`,
         options.forceGate

package/cli/lib/mirror_handlers/sync.cjs

@@ -53,6 +53,7 @@ module.exports = async function handleMirrorSync({ shared, context, deps, mirror
           liveHedgeEnv: [
             'POLYMARKET_PRIVATE_KEY',
             'POLYMARKET_FUNDER',
+            'POLYMARKET_RPC_URL',
             'POLYMARKET_API_KEY',
             'POLYMARKET_API_SECRET',
             'POLYMARKET_API_PASSPHRASE',
@@ -75,7 +76,7 @@ module.exports = async function handleMirrorSync({ shared, context, deps, mirror
       console.log('Daemon stop: pandora mirror sync stop --pid-file <path>|--strategy-hash <hash>');
       console.log('Daemon status: pandora mirror sync status --pid-file <path>|--strategy-hash <hash>');
       console.log(
-        'Live hedge env: POLYMARKET_PRIVATE_KEY, POLYMARKET_FUNDER, POLYMARKET_API_KEY, POLYMARKET_API_SECRET, POLYMARKET_API_PASSPHRASE, POLYMARKET_HOST.',
+        'Live hedge env: POLYMARKET_PRIVATE_KEY, POLYMARKET_FUNDER, POLYMARKET_RPC_URL, POLYMARKET_API_KEY, POLYMARKET_API_SECRET, POLYMARKET_API_PASSPHRASE, POLYMARKET_HOST.',
       );
       console.log('POLYMARKET_FUNDER must be your Polymarket proxy wallet (Gnosis Safe), not your EOA wallet address.');
       console.log('Polymarket CLOB collateral is Polygon USDC.e; ensure proxy wallet USDC.e balance and approvals are configured.');
@@ -216,7 +217,8 @@ module.exports = async function handleMirrorSync({ shared, context, deps, mirror
   if (options.executeLive) {
     try {
       polymarketPreflight = await runLivePolymarketPreflightForMirror({
-        rpcUrl: options.rpcUrl,
+        rpcUrl: options.polymarketRpcUrl || options.rpcUrl,
+        polymarketRpcUrl: options.polymarketRpcUrl,
         privateKey: options.privateKey,
         funder: options.funder,
       });

package/cli/lib/mirror_service.cjs

@@ -270,7 +270,17 @@ async function deployMirror(options = {}) {
       : Number(planData.distributionHint && planData.distributionHint.distributionNo);
 
   const sources = normalizeSources(options.sources);
-  if (sources.length < 2) {
+  if (options.sourcesProvided && sources.length < 2) {
+    throw createServiceError(
+      'INVALID_FLAG_VALUE',
+      '--sources requires at least two non-empty URLs when explicitly provided.',
+      {
+        providedCount: Array.isArray(options.sources) ? options.sources.length : 0,
+        normalizedCount: sources.length,
+      },
+    );
+  }
+  if (!options.sourcesProvided && sources.length < 2) {
     diagnostics.push('Using fallback source URLs because explicit --sources were not provided.');
   }
 

package/cli/lib/parsers/lp_flags.cjs

@@ -42,6 +42,7 @@ function createParseLpFlags(deps) {
       wallet: null,
       amountUsdc: null,
       lpTokens: null,
+      lpAll: false,
       chainId: null,
       dryRun: false,
       execute: false,
@@ -78,6 +79,10 @@ function createParseLpFlags(deps) {
         i += 1;
         continue;
       }
+      if (token === '--all') {
+        options.lpAll = true;
+        continue;
+      }
       if (token === '--chain-id') {
         options.chainId = parseInteger(requireFlagValue(rest, i, '--chain-id'), '--chain-id');
         i += 1;
@@ -172,8 +177,11 @@ function createParseLpFlags(deps) {
     if (action === 'add' && options.amountUsdc === null) {
       throw new CliError('MISSING_REQUIRED_FLAG', 'Missing liquidity amount. Use --amount-usdc <amount>.');
     }
-    if (action === 'remove' && options.lpTokens === null) {
-      throw new CliError('MISSING_REQUIRED_FLAG', 'Missing LP token amount. Use --lp-tokens <amount>.');
+    if (action === 'remove' && options.lpTokens === null && !options.lpAll) {
+      throw new CliError('MISSING_REQUIRED_FLAG', 'Missing LP token amount. Use --lp-tokens <amount> or --all.');
+    }
+    if (action === 'remove' && options.lpTokens !== null && options.lpAll) {
+      throw new CliError('INVALID_ARGS', 'Use only one remove mode: --lp-tokens <amount> or --all.');
     }
     if (options.dryRun === options.execute) {
       throw new CliError('INVALID_ARGS', 'Use exactly one mode: --dry-run or --execute.');

package/cli/lib/parsers/mirror_deploy_flags.cjs

@@ -36,6 +36,7 @@ function createParseMirrorDeployFlags(deps) {
       arbiter: null,
       category: 3,
       sources: [],
+      sourcesProvided: false,
       chainId: null,
       rpcUrl: null,
       privateKey: null,
@@ -123,6 +124,7 @@ function createParseMirrorDeployFlags(deps) {
         if (!entries.length) {
           throw new CliError('MISSING_FLAG_VALUE', 'Missing value for --sources');
         }
+        options.sourcesProvided = true;
         options.sources.push(...entries);
         i = j - 1;
         continue;
@@ -175,7 +177,14 @@ function createParseMirrorDeployFlags(deps) {
         continue;
       }
       if (token === '--polymarket-host') {
-        options.polymarketHost = requireFlagValue(args, i, '--polymarket-host');
+        const polymarketHost = requireFlagValue(args, i, '--polymarket-host');
+        if (!isSecureHttpUrlOrLocal(polymarketHost)) {
+          throw new CliError(
+            'INVALID_FLAG_VALUE',
+            '--polymarket-host must use https:// (or http://localhost/127.0.0.1 for local testing).',
+          );
+        }
+        options.polymarketHost = polymarketHost;
         i += 1;
         continue;
       }

package/cli/lib/parsers/mirror_go_flags.cjs

@@ -49,12 +49,14 @@ function createParseMirrorGoFlags(deps) {
       cooldownMs: 60_000,
       chainId: null,
       rpcUrl: null,
+      polymarketRpcUrl: null,
       privateKey: null,
       funder: null,
       usdc: null,
       oracle: null,
       factory: null,
       sources: [],
+      sourcesProvided: false,
       manifestFile: null,
       trustDeploy: false,
       forceGate: false,
@@ -200,6 +202,18 @@ function createParseMirrorGoFlags(deps) {
         i += 1;
         continue;
       }
+      if (token === '--polymarket-rpc-url') {
+        const polymarketRpcUrl = requireFlagValue(args, i, '--polymarket-rpc-url');
+        if (!isSecureHttpUrlOrLocal(polymarketRpcUrl)) {
+          throw new CliError(
+            'INVALID_FLAG_VALUE',
+            '--polymarket-rpc-url must use https:// (or http://localhost/127.0.0.1 for local testing).',
+          );
+        }
+        options.polymarketRpcUrl = polymarketRpcUrl;
+        i += 1;
+        continue;
+      }
       if (token === '--private-key') {
         options.privateKey = parsePrivateKeyFlag(requireFlagValue(args, i, '--private-key'), '--private-key');
         i += 1;
@@ -235,6 +249,7 @@ function createParseMirrorGoFlags(deps) {
         if (!entries.length) {
           throw new CliError('MISSING_FLAG_VALUE', 'Missing value for --sources');
         }
+        options.sourcesProvided = true;
         options.sources.push(...entries);
         i = j - 1;
         continue;
@@ -329,11 +344,14 @@ function createParseMirrorGoFlags(deps) {
       throw new CliError('INVALID_FLAG_VALUE', '--hedge-ratio must be <= 2.');
     }
     if (options.executeLive) {
-      if (options.maxOpenExposureUsdc === null) {
-        throw new CliError('MISSING_REQUIRED_FLAG', 'Live mode requires --max-open-exposure-usdc.');
-      }
-      if (options.maxTradesPerDay === null) {
-        throw new CliError('MISSING_REQUIRED_FLAG', 'Live mode requires --max-trades-per-day.');
+      const missing = [];
+      if (options.maxOpenExposureUsdc === null) missing.push('--max-open-exposure-usdc');
+      if (options.maxTradesPerDay === null) missing.push('--max-trades-per-day');
+      if (missing.length) {
+        throw new CliError(
+          'MISSING_REQUIRED_FLAG',
+          `Live mode requires companion risk flags: ${missing.join(', ')}.`,
+        );
       }
     }
 

package/cli/lib/parsers/mirror_sync_flags.cjs

@@ -78,6 +78,7 @@ function createParseMirrorSyncFlags(deps) {
       manifestFile: null,
       chainId: null,
       rpcUrl: null,
+      polymarketRpcUrl: null,
       privateKey: null,
       funder: null,
       usdc: null,
@@ -256,6 +257,18 @@ function createParseMirrorSyncFlags(deps) {
         i += 1;
         continue;
       }
+      if (token === '--polymarket-rpc-url') {
+        const polymarketRpcUrl = requireFlagValue(rest, i, '--polymarket-rpc-url');
+        if (!isSecureHttpUrlOrLocal(polymarketRpcUrl)) {
+          throw new CliError(
+            'INVALID_FLAG_VALUE',
+            '--polymarket-rpc-url must use https:// (or http://localhost/127.0.0.1 for local testing).',
+          );
+        }
+        options.polymarketRpcUrl = polymarketRpcUrl;
+        i += 1;
+        continue;
+      }
       if (token === '--private-key') {
         options.privateKey = parsePrivateKeyFlag(requireFlagValue(rest, i, '--private-key'), '--private-key');
         i += 1;
@@ -356,11 +369,14 @@ function createParseMirrorSyncFlags(deps) {
     }
 
     if (options.executeLive) {
-      if (options.maxOpenExposureUsdc === null) {
-        throw new CliError('MISSING_REQUIRED_FLAG', 'Live mode requires --max-open-exposure-usdc.');
-      }
-      if (options.maxTradesPerDay === null) {
-        throw new CliError('MISSING_REQUIRED_FLAG', 'Live mode requires --max-trades-per-day.');
+      const missing = [];
+      if (options.maxOpenExposureUsdc === null) missing.push('--max-open-exposure-usdc');
+      if (options.maxTradesPerDay === null) missing.push('--max-trades-per-day');
+      if (missing.length) {
+        throw new CliError(
+          'MISSING_REQUIRED_FLAG',
+          `Live mode requires companion risk flags: ${missing.join(', ')}.`,
+        );
       }
     } else {
       if (options.maxOpenExposureUsdc === null) options.maxOpenExposureUsdc = Number.POSITIVE_INFINITY;