solana-traderclaw 1.0.39 → 1.0.42

package/README.md

@@ -1,13 +1,13 @@
-# solana-traderclaw (TraderClaw V1 — team features)
+# solana-traderclaw (V1-Upgraded)
 
-Team edition of the TraderClaw V1 plugin for autonomous Solana memecoin trading. Full V1 trading capabilities plus 5 X/Twitter tools for journaling and community engagement. Connects OpenClaw to a trading orchestrator that handles market data, risk enforcement, and trade execution. Includes a full memory layer with local persistence, episodic logging, deterministic compute tools, and OpenClaw-native memory integration.
+Public edition of the upgraded TraderClaw V1 plugin for autonomous Solana memecoin trading. Identical to the team edition with one difference: X/Twitter tools are read-only (social intel only, no posting). 94 Solana tools + 3 X/Twitter read tools = 97 total. Full trading lifecycle. Connects OpenClaw to a trading orchestrator that handles market data, risk enforcement, and trade execution. Includes a full memory layer with local persistence, episodic logging, deterministic compute tools, intelligence lab, standardized tool envelopes, prompt scrubbing, and OpenClaw-native memory integration.
 
 ## Architecture
 
 ```
 OpenClaw Agent (brain: reasoning, decisions, strategy evolution)
        │
-       │ calls 72 typed tools (67 trading + 5 X)
+       │ calls 97 typed tools (94 trading + 3 X read-only)
        ▼
 Plugin (this package)
   ├── HTTP ──→ Orchestrator (data + risk + execution)
@@ -18,9 +18,8 @@ Plugin (this package)
   ├── Local persistence (state, decisions, bulletin, patterns)
   │     └── .traderclaw-v1-data/
   │
-  └── OpenClaw workspace (default ~/.openclaw/workspace/, auto-loaded every session)
-        ├── STATE.md (machine-written durable state from solana_state_save)
-        ├── MEMORY.md (optional — your narrative notes; not overwritten by state save)
+  └── OpenClaw native memory (auto-loaded every session)
+        ├── MEMORY.md (durable facts — always in context)
         └── memory/YYYY-MM-DD.md (daily logs — today + yesterday)
 ```
 
@@ -35,20 +34,16 @@ The plugin gives OpenClaw tools to interact with the Solana trading orchestrator
 
 ### 1. Install the plugin
 
-Install the **npm package** **`solana-traderclaw`**. The **OpenClaw plugin id** in `openclaw.json` stays **`solana-trader`** (same as `openclaw.plugin.json`). The global CLI binary is **`traderclaw`**.
-
 ```bash
-npm install -g solana-traderclaw@1.0.20
+npm install -g solana-traderclaw
 ```
 
 Or install directly into OpenClaw:
 
 ```bash
-openclaw plugins install solana-traderclaw@1.0.20
+openclaw plugins install solana-traderclaw
 ```
 
-**Names:** `solana-traderclaw` is the canonical npm package (this release includes X/Twitter journal tools). Older names may still resolve on npm for a time; prefer **`solana-traderclaw`**. OpenClaw may log a benign id hint if the npm package name and manifest `id` differ — config keys remain **`plugins.entries.solana-trader`**.
-
 ### 2. Run setup
 
 ```bash
@@ -73,7 +68,7 @@ openclaw gateway restart
 traderclaw install --wizard
 ```
 
-This opens a localhost UI that runs prechecks, lane-aware setup, gateway validation, optional Telegram setup, and final verification. **X (Twitter) OAuth fields in the wizard are optional** — leave all four blank to run without X; you can add credentials later in `openclaw.json` or via env (`X_CONSUMER_KEY`, `X_CONSUMER_SECRET`, per-agent `X_ACCESS_TOKEN_*`). It also installs **`HEARTBEAT.md` into your OpenClaw agent workspace root** (default `~/.openclaw/workspace/HEARTBEAT.md`) from the packaged skill so heartbeats load the TraderClaw checklist without manual `cp`. `traderclaw setup` does the same.
+This opens a localhost UI that runs prechecks, lane-aware setup, gateway validation, optional Telegram setup, and final verification.
 
 ### Optional: Run CLI prechecks directly
 
@@ -150,14 +145,6 @@ traderclaw config reset         # Remove all plugin config
 
 Available config keys: `orchestratorUrl`, `walletId`, `apiKey`, `apiTimeout`, `refreshToken`, `walletPublicKey`, `walletPrivateKey`, `gatewayBaseUrl`, `gatewayToken`, `agentId`
 
-Wallet proof note: if login/session challenge requires wallet ownership proof, provide the key at runtime with `--wallet-private-key` or `TRADERCLAW_WALLET_PRIVATE_KEY`. It is used for local signing only and is not stored in `~/.openclaw/openclaw.json`.
-
-**Gateway process:** Telegram and other channels talk to the **OpenClaw gateway** process. That process must be able to read `TRADERCLAW_WALLET_PRIVATE_KEY` when the session refresh fails and a new challenge runs. Exporting the variable only in your SSH session does **not** set it for **systemd** (or Docker, etc.). Configure it in the gateway unit’s environment per the troubleshooting guide below.
-
-**`traderclaw login`:** Uses the saved refresh token when valid (no wallet key needed). Use `traderclaw login --force-reauth` when you intentionally want a full API challenge (e.g. after `traderclaw logout`).
-
-**Session / auth / startup issues:** follow the official guide — [Installation → Troubleshooting (session expired, auth, logged out)](https://docs.traderclaw.ai/docs/installation#troubleshooting-session-expired-auth-errors-or-the-agent-logged-out).
-
 ### `traderclaw --help`
 
 Print all available commands and options.
@@ -199,9 +186,9 @@ openclaw gateway restart
 
 The plugin implements a 3-layer memory architecture that uses OpenClaw's native infrastructure plus custom tools to eliminate amnesia between sessions.
 
-### Layer 1: Durable state (`STATE.md`) and narrative (`MEMORY.md`)
+### Layer 1: Durable Facts (`MEMORY.md`)
 
-OpenClaw loads workspace markdown from the agent workspace root. **`STATE.md`** is updated by `solana_state_save` with a human-readable mirror of durable facts (tier, wallet, mode, strategy version, watchlist, permanent learnings, regime canary). **`MEMORY.md`** is for your own notes — the plugin does not overwrite it. JSON state still lives under `.traderclaw-v1-data/state/` as before.
+OpenClaw automatically loads `MEMORY.md` into agent context at every session start — zero tool calls needed. When `solana_state_save` is called, it writes both a JSON state file AND updates `MEMORY.md` with curated durable facts: tier, wallet, mode, strategy version, watchlist, permanent learnings, and regime canary.
 
 ### Layer 2: Episodic Memory (Daily Logs + Bootstrap Injection)
 
@@ -215,7 +202,7 @@ Unlimited retention via the orchestrator API. `solana_memory_write` / `solana_me
 
 ### Memory Flush Hook
 
-The `memory:flush` hook fires automatically when OpenClaw is about to trim context. It syncs **`STATE.md`** from the last persisted JSON state and writes a compaction marker to the daily log. This is an automatic safety net — no agent action needed.
+The `memory:flush` hook fires automatically when OpenClaw is about to trim context. It syncs `MEMORY.md` from the last persisted state and writes a compaction marker to the daily log. This is an automatic safety net — no agent action needed.
 
 ### Bootstrap Hook (`agent:bootstrap`)
 
@@ -241,29 +228,20 @@ Entitlement fallback chain: live API fetch → cached file → durable state →
 │   └── shared/             # Team bulletin (JSONL)
 ```
 
-Plus OpenClaw workspace paths (default `~/.openclaw/workspace/`):
+Plus OpenClaw-native paths at project root:
 ```
-STATE.md                    # Machine-written durable state mirror (from solana_state_save)
-MEMORY.md                   # Optional agent narrative (not overwritten by the plugin)
+MEMORY.md                   # Curated durable facts (auto-loaded by OpenClaw)
 memory/
 ├── 2026-03-19.md           # Today's daily log (auto-loaded by OpenClaw)
 ├── 2026-03-18.md           # Yesterday's daily log (auto-loaded by OpenClaw)
 └── ...                     # Auto-pruned after 7 days
 ```
 
-## X/Twitter Setup
-
-The team edition includes 5 X/Twitter tools for trade journaling and community engagement. Setup requires an X Developer App.
+## X/Twitter Setup (Read-Only Social Intel)
 
-### 1. Create an X Developer App
+The public edition includes 3 read-only X/Twitter tools for social intelligence gathering (search tweets, read mentions, get threads). X posting is not included in the public edition.
 
-1. Go to [developer.x.com](https://developer.x.com) and sign in
-2. Create a new App (Free tier is sufficient for posting — 1,500 tweets/month)
-3. Note your **Consumer Key** and **Consumer Secret**
-4. Under "User authentication settings", enable OAuth 1.0a with Read and Write permissions
-5. Generate **Access Token** and **Access Token Secret** for the account that will post
-
-### 2. Configure via Environment Variables
+### Configure via Environment Variables
 
 ```bash
 export X_CONSUMER_KEY="your-app-consumer-key"
@@ -272,9 +250,7 @@ export X_ACCESS_TOKEN_MAIN="your-access-token"
 export X_ACCESS_TOKEN_MAIN_SECRET="your-access-token-secret"
 ```
 
-The installer will pick these up automatically during the `x_credentials` step.
-
-### 3. Or Configure via Plugin Config
+### Or Configure via Plugin Config
 
 Add to `~/.openclaw/openclaw.json` under the plugin entry:
 
@@ -297,17 +273,17 @@ Add to `~/.openclaw/openclaw.json` under the plugin entry:
 
 | Tier | Cost | Capabilities |
 |------|------|-------------|
-| Free | $0 | 1,500 posts/month (write-only) |
 | Pay-as-you-go | Per-credit | Read access (mentions, search, threads) |
 | Basic | $200/month | Higher limits, more read access |
 
-Free tier is sufficient for daily trade journaling. Pay-as-you-go is recommended if you want to read mentions and search.
+Pay-as-you-go or Basic tier is required for the read-only social intel tools.
 
-## Available Tools (72 — 67 trading + 5 X)
+## Available Tools (97 — 94 trading + 3 X read-only)
 
 ### Scanning
 | Tool | Description |
 |------|-------------|
+| `solana_scan` | Broad market scan — launches + hot pairs combined |
 | `solana_scan_launches` | Find new Solana token launches |
 | `solana_scan_hot_pairs` | Find high-volume trading pairs |
 | `solana_market_regime` | Get macro market state (bullish/bearish/neutral) |
@@ -330,7 +306,8 @@ Free tier is sufficient for daily trade journaling. Pay-as-you-go is recommended
 | Tool | Description |
 |------|-------------|
 | `solana_trade_precheck` | Pre-trade risk validation |
-| `solana_trade_execute` | Execute trade via SpyFly bot |
+| `solana_trade_execute` | Execute trade via SpyFly bot (full params) |
+| `solana_trade` | Execute trade (shorthand) |
 
 ### Reflection & Server-Side Memory
 | Tool | Description |
@@ -361,6 +338,8 @@ Free tier is sufficient for daily trade journaling. Pay-as-you-go is recommended
 | `solana_funding_instructions` | Deposit instructions |
 | `solana_wallets` | List all wallets |
 | `solana_wallet_create` | Create a new wallet |
+| `solana_wallet_token_balance` | Get SPL token balance for a specific mint |
+| `solana_sweep_dead_tokens` | Sell losing positions below loss threshold to cut losses and reclaim SOL |
 
 ### Entitlements
 | Tool | Description |
@@ -385,6 +364,13 @@ Free tier is sufficient for daily trade journaling. Pay-as-you-go is recommended
 | `solana_alpha_signals` | Retrieve buffered alpha signals |
 | `solana_alpha_history` | Query historical alpha signals |
 | `solana_alpha_sources` | Get source reputation statistics |
+| `solana_alpha_submit` | Submit candidate to alpha buffer for next heartbeat evaluation |
+
+### Firehose
+| Tool | Description |
+|------|-------------|
+| `solana_firehose_config` | Configure firehose filter parameters (volume, buyers, whale detection) |
+| `solana_firehose_status` | Check firehose health, throughput, and connection state |
 
 ### Bitquery Deep Scans
 | Tool | Description |
@@ -412,7 +398,7 @@ Free tier is sufficient for daily trade journaling. Pay-as-you-go is recommended
 ### Local Durable State
 | Tool | Description |
 |------|-------------|
-| `solana_state_save` | Save agent state to local JSON (also writes STATE.md under the workspace) |
+| `solana_state_save` | Save agent state to local JSON (also writes MEMORY.md) |
 | `solana_state_read` | Read agent state from local JSON |
 
 ### Episodic Decision Log
@@ -438,7 +424,29 @@ Free tier is sufficient for daily trade journaling. Pay-as-you-go is recommended
 | `solana_compute_confidence` | Weighted confidence score (on-chain, signal, social, smart money, risk penalty) |
 | `solana_compute_freshness_decay` | Freshness decay factor by signal age |
 | `solana_compute_position_limits` | Full position sizing ladder with reduction breakdown |
-| `solana_classify_deployer_risk` | Deployer wallet risk classification (LOW/MODERATE/HIGH/CRITICAL) |
+| `solana_compute_deployer_risk` | Deployer wallet risk classification (LOW/MEDIUM/HIGH) |
+| `solana_classify_deployer_risk` | Backward-compatible alias for solana_compute_deployer_risk |
+
+### Intelligence Lab (New in V1-Upgraded)
+| Tool | Description |
+|------|-------------|
+| `solana_candidate_write` | Write a trading candidate for evaluation |
+| `solana_candidate_get` | Get a trading candidate by ID |
+| `solana_candidate_label_outcome` | Label a candidate with actual outcome |
+| `solana_candidate_delta` | Compute prediction delta for a candidate |
+| `solana_source_trust_refresh` | Refresh trust scores for intelligence sources |
+| `solana_source_trust_get` | Get current trust score for a source |
+| `solana_model_score_candidate` | Score a candidate using the active model |
+| `solana_model_registry` | List registered scoring models |
+| `solana_model_promote` | Promote a challenger model to active |
+| `solana_contradiction_check` | Check for contradictions in signal data |
+| `solana_dataset_export` | Export labeled dataset for analysis |
+| `solana_deployer_trust_get` | Get deployer trust profile |
+| `solana_deployer_trust_refresh` | Refresh deployer trust from on-chain data |
+| `solana_evaluation_report` | Generate intelligence evaluation report |
+| `solana_replay_run` | Run a replay of historical decisions |
+| `solana_replay_report` | Get results of a replay run |
+| `solana_scrub_untrusted_text` | Scrub untrusted text for prompt injection |
 
 ### Deep Analysis
 | Tool | Description |
@@ -451,13 +459,11 @@ Free tier is sufficient for daily trade journaling. Pay-as-you-go is recommended
 |------|-------------|
 | `solana_daily_log` | Append to today's daily log (auto-loaded by OpenClaw next session, 7-day prune) |
 
-### X/Twitter
+### X/Twitter (Read-Only Social Intel)
 | Tool | Description |
 |------|-------------|
-| `x_post_tweet` | Post a tweet from the agent's configured X profile (max 280 chars) |
-| `x_reply_tweet` | Reply to a specific tweet |
-| `x_read_mentions` | Read recent @mentions (pay-as-you-go tier) |
 | `x_search_tweets` | Search recent tweets by keyword/hashtag |
+| `x_read_mentions` | Read recent @mentions (pay-as-you-go tier) |
 | `x_get_thread` | Read a full conversation thread |
 
 ## Hooks (2)
@@ -465,7 +471,7 @@ Free tier is sufficient for daily trade journaling. Pay-as-you-go is recommended
 | Hook | Trigger | What It Does |
 |------|---------|--------------|
 | `agent:bootstrap` | Every session start | Injects durable state, decisions, bulletin, snapshot, and entitlements into context |
-| `memory:flush` | Before OpenClaw context compaction | Syncs STATE.md from persisted state, writes compaction marker to daily log |
+| `memory:flush` | Before OpenClaw context compaction | Syncs MEMORY.md from persisted state, writes compaction marker to daily log |
 
 ## Skills
 
@@ -473,7 +479,7 @@ Free tier is sufficient for daily trade journaling. Pay-as-you-go is recommended
 The primary skill that teaches OpenClaw the complete trading lifecycle:
 
 1. **SCAN** — Find opportunities with launch/hot-pair scanners
-2. **ANALYZE** — Deep dive with 5 token analysis tools
+2. **ANALYZE** — Deep dive with 6 token analysis tools
 3. **THESIS** — Assemble full context with build_thesis
 4. **DECIDE** — Agent reasons over data using confidence scoring
 5. **PRECHECK** — Validate against risk rules
@@ -527,13 +533,6 @@ Trade executed. TradeId: 15, PositionId: 4, TX: 5xK...
 I'll monitor this position and review after exit.
 ```
 
-## Session and file reload
-
-- **Telegram:** use **`/new`** to start a fresh chat thread or **`/reset`** to reset session state with your provider, as supported by your Telegram bot integration.
-- **After editing workspace files** (`HEARTBEAT.md`, `STATE.md`, `MEMORY.md`, skills): restart the gateway so changes are picked up consistently: `openclaw gateway restart`.
-- **History:** OpenClaw may not ship `openclaw agents clear-history` on your build — do not rely on that subcommand; prefer Telegram session commands and gateway restart.
-- **Heartbeats:** fresh installs set `heartbeat.target: "telegram"`, `isolatedSession: true`, `lightContext: true`, and `channels.defaults.heartbeat.showOk: true` so scheduled cycles deliver reliably (see installer `configureGatewayScheduling`).
-
 ## Troubleshooting
 
 **Plugin won't load:**
@@ -554,29 +553,6 @@ I'll monitor this position and review after exit.
 - Run `traderclaw setup` to create or select a wallet
 - Verify the wallet ID: `traderclaw config show`
 
-**Wizard (`traderclaw install --wizard`) fails on `install_plugin_package` with `ENOENT` / `…/solana-traderclaw/package.json` / `file:solana-traderclaw`:**
-- Older installers used `spawn` with `shell: true`, which on Linux could drop npm’s argv so npm treated the package as a **local folder** under cwd (`/root` or `/tmp`). Current installers use **`shell: false`**, explicit **`--registry https://registry.npmjs.org/`** for registry installs, **`solana-traderclaw@latest`**, and a temp **`cwd`**. Upgrade `solana-traderclaw` and retry. If a stray directory `./solana-traderclaw` exists under that cwd, remove it: `rm -rf /tmp/solana-traderclaw` (and under `/root` if present).
-
-**Heartbeat not sending messages to Telegram:**
-- **Fresh `traderclaw setup`:** the installer runs `configureGatewayScheduling`, which sets a custom `heartbeat.prompt` on the `main` agent (no `HEARTBEAT_OK` escape). You only need the manual `openclaw config set` command below if you are on an older install or overwrote `agents.list`.
-- **`HEARTBEAT.md` must live in the agent workspace root** (default `~/.openclaw/workspace/HEARTBEAT.md`, next to `AGENTS.md`). A copy under `workspace/.openclaw/` or only inside the plugin package is **not** loaded as the heartbeat checklist. Copy from `skills/solana-trader/HEARTBEAT.md` in the installed package if needed. See [OpenClaw agent workspace](https://docs.openclaw.ai/concepts/agent-workspace).
-- OpenClaw's default heartbeat prompt tells the model "If nothing needs attention, reply HEARTBEAT_OK" — which is stripped and never delivered. Run `traderclaw setup` again (v1.0.16+) to set a custom prompt, or apply manually:
-
-```bash
-openclaw config set agents.list '[{"id":"main","default":true,"heartbeat":{"every":"30m","target":"telegram","isolatedSession":true,"lightContext":true,"prompt":"Read HEARTBEAT.md if it exists (workspace context). Follow it strictly. Execute a full trading cycle: Steps 0 through 10. The cycle is NOT complete until all 10 steps are done including Step 8 (memory write-back), Step 9 (X post), and Step 10 (report). Do not stop early. Do not infer or repeat old tasks from prior chats. Never reply HEARTBEAT_OK. Never end your message with a question."}}]'
-openclaw gateway restart
-```
-
-- Verify with `openclaw config get agents` — the `main` agent should have `heartbeat.prompt`, `target`, `isolatedSession`, and `lightContext`.
-- Confirm Telegram is healthy: `openclaw channels status --probe`
-- Prefer `target: "telegram"` over `"last"` so delivery does not depend on a prior channel contact.
-
-**Scheduled cron jobs run but you never see Telegram/WhatsApp output:**
-- The installer merges **six** prescriptive managed jobs (`alpha-scan`, `dead-money-sweep`, `source-reputation-recalc`, `meta-rotation-analysis`, `strategy-evolution`, `daily-performance-report`). Older templates such as `subscription-cleanup` or `whale-watch` are no longer in that managed set; re-run **`traderclaw setup`** to refresh `~/.openclaw/cron/jobs.json`, or edit jobs manually. User-defined cron jobs whose ids are not in the template set are preserved on merge.
-- TraderClaw templates merged into `~/.openclaw/cron/jobs.json` use **`delivery.mode: "announce"`** with **`channel: "last"`** so each completed isolated job posts a summary to the same channel you last used (see [OpenClaw cron delivery](https://docs.clawd.bot/automation/cron-jobs)).
-- If you installed before this behavior: run **`traderclaw setup`** again so the installer re-merges cron jobs, or stop the gateway and edit managed job entries in `~/.openclaw/cron/jobs.json` — set **`delivery`** to `{ "mode": "announce", "channel": "last", "bestEffort": true }` for each TraderClaw job (or remove `delivery` entirely; isolated jobs default to announce when omitted).
-- The same **`last`** requirement as heartbeat applies: message the bot at least once so the gateway knows where to deliver.
-
 **Tools returning errors:**
 - Run `traderclaw status` to check system health
 - Check if kill switch is enabled
@@ -585,7 +561,5 @@ openclaw gateway restart
 **Memory/state not persisting:**
 - Check that the `dataDir` config points to a writable location
 - Default is `<cwd>/.traderclaw-v1-data` — verify permissions
-- Check **`STATE.md`** exists under `~/.openclaw/workspace/` after first `solana_state_save` call (not `process.cwd()` — required for systemd installs)
-- Check `memory/` under the same workspace for daily log files
-
-**X / Twitter posting:** with X credentials and skills aligned, `x_post_tweet` has been validated end-to-end in production installs after config + workspace updates.
+- Check `MEMORY.md` exists at project root after first `solana_state_save` call
+- Check `memory/` directory for daily log files

package/bin/openclaw-trader.mjs

@@ -413,6 +413,17 @@ async function doRefresh(orchestratorUrl, refreshToken) {
   return res.data;
 }
 
+async function doRecoverSecret(orchestratorUrl, apiKey, recoverySecret) {
+  const res = await httpRequest(`${orchestratorUrl}/api/session/recover-secret`, {
+    method: "POST",
+    body: { apiKey, recoverySecret, clientLabel: "openclaw-trader-cli" },
+  });
+  if (!res.ok) {
+    throw new Error(`recover-secret failed (HTTP ${res.status}): ${JSON.stringify(res.data)}`);
+  }
+  return res.data;
+}
+
 async function doLogout(orchestratorUrl, refreshToken) {
   const res = await httpRequest(`${orchestratorUrl}/api/session/logout`, {
     method: "POST",
@@ -437,6 +448,23 @@ async function establishSession(orchestratorUrl, pluginConfig, walletPrivateKeyI
     throw new Error("No apiKey configured. Run 'traderclaw setup' first.");
   }
 
+  if (pluginConfig.recoverySecret) {
+    printInfo("  Attempting session recovery via consumable secret...");
+    try {
+      const tokens = await doRecoverSecret(orchestratorUrl, pluginConfig.apiKey, pluginConfig.recoverySecret);
+      pluginConfig.refreshToken = tokens.refreshToken;
+      if (tokens.recoverySecret) {
+        pluginConfig.recoverySecret = tokens.recoverySecret;
+      }
+      printSuccess("  Session recovered via consumable secret");
+      printInfo(`  Tier: ${tokens.session?.tier || "unknown"}`);
+      return tokens;
+    } catch (err) {
+      printWarn(`  Consumable recovery failed: ${err.message || err}`);
+      printWarn("  Falling back to wallet challenge...");
+    }
+  }
+
   printInfo("  Starting challenge flow...");
   const challenge = await doChallenge(orchestratorUrl, pluginConfig.apiKey, pluginConfig.walletPublicKey);
 
@@ -500,6 +528,7 @@ async function cmdSetup(args) {
   let signedUpThisSession = false;
   let writeGatewayEnvFlag = false;
   let noEnsureGatewayPersistent = false;
+  let signupRecoverySecret = undefined;
 
   for (let i = 0; i < args.length; i++) {
     if ((args[i] === "--api-key" || args[i] === "-k") && args[i + 1]) {
@@ -565,6 +594,9 @@ async function cmdSetup(args) {
       try {
         const signupResult = await doSignup(orchestratorUrl, externalUserId);
         apiKey = signupResult.apiKey;
+        if (signupResult.recoverySecret) {
+          signupRecoverySecret = signupResult.recoverySecret;
+        }
         signedUpThisSession = true;
         printSuccess(`  Signup successful!`);
         printInfo(`  Tier: ${signupResult.tier}`);
@@ -618,6 +650,8 @@ async function cmdSetup(args) {
 
   print("\nEstablishing session...\n");
 
+  const existingForRecovery = readConfig();
+  const prevPlugin = getPluginConfig(existingForRecovery);
   const pluginConfig = {
     orchestratorUrl,
     walletId: null,
@@ -626,6 +660,7 @@ async function cmdSetup(args) {
     refreshToken: undefined,
     walletPublicKey: undefined,
     agentId: "main",
+    recoverySecret: signupRecoverySecret ?? prevPlugin?.recoverySecret,
   };
 
   let lastSeenWalletPrivateKey = runtimeWalletPrivateKey || "";

package/config/gateway-v1-upgraded.json5

@@ -0,0 +1,160 @@
+// OpenClaw Gateway Configuration — TraderClaw V1-Upgraded (Single Agent)
+// Single "main" agent with 5-minute heartbeat + cron jobs for autonomous operation.
+// V1-Upgraded: All cron jobs use sessionTarget:"isolated" + delivery:{mode:"none"}.
+// New cron jobs: intelligence_lab_eval (12h), source_trust_refresh (6h).
+{
+  agents: {
+    list: [
+      {
+        id: "main",
+        default: true,
+        heartbeat: { every: "5m", target: "last" }
+      }
+    ]
+  },
+
+  cron: {
+    enabled: true,
+    maxConcurrentRuns: 2,
+    sessionRetention: "24h",
+    runLog: {
+      maxBytes: "2mb",
+      keepLines: 2000
+    },
+    jobs: [
+      // ── Strategy & Learning ───────────────────────────────────────
+      {
+        id: "strategy-evolution",
+        schedule: "0 */4 * * *",
+        agentId: "main",
+        sessionTarget: "isolated",
+        delivery: { mode: "none" },
+        message: "CRON_JOB: strategy_evolution\n\nStep 1: Call solana_journal_summary to get aggregate performance stats (win rate, avg PnL, trade count). If fewer than 20 closed trades since the last strategy evolution, skip weight updates but still run pattern detection.\n\nStep 2: Call solana_memory_search for 'strategy_evolution' — find last 3 evolution cycle results. Call solana_memory_search for 'strategy_drift_warning' — find drift warnings since last evolution. Call solana_memory_search for 'pre_trade_rationale' — recent decision patterns.\n\nStep 3: Run Recurring Pattern Detection — search for learning_entry tags, group by area, check linked chains (3+ = confirmed pattern), investigate drift warnings.\n\nStep 4: Call solana_strategy_state to read current feature weights.\n\nStep 5: Call solana_trades to get recent closed trades. Apply ADL checks (direction consistency, weight velocity, reversion check).\n\nStep 6: Compute proposed weight changes. Score each with VFM (Frequency + Failure Reduction + Self-Cost). Only apply changes scoring >= 3/5.\n\nStep 7: Verify guardrails: maxDeltaOk, sumWeightsOk, minTradesOk, floorCapOk. If all pass, call solana_strategy_update with incremented version.\n\nStep 8: Run Named Pattern Recognition — search for winning trade clusters, catalog new patterns, evolve existing ones.\n\nStep 9: Evaluate discovery filter performance. Log all results via solana_memory_write with tags: strategy_evolution, vfm_scorecard, pattern_detection, named_pattern.\n\nFORMATTING RULES:\n- Every token reference MUST use SYMBOL (full_CA) format.\n- Do not execute trades. Do not ask questions.",
+        enabled: true
+      },
+      {
+        id: "source-reputation",
+        schedule: "0 */3 * * *",
+        agentId: "main",
+        sessionTarget: "isolated",
+        delivery: { mode: "none" },
+        message: "CRON_JOB: source_reputation_recalc\n\nStep 1: Call solana_alpha_sources to get per-source performance stats.\n\nStep 2: Call solana_alpha_history to get recent signal history.\n\nStep 3: Call solana_trades to get recent trade outcomes. Cross-reference each trade to its originating signal source.\n\nStep 4: For each source, calculate: win rate, average PnL, signal-to-trade conversion rate.\n\nStep 5: Assign tier rankings:\n- TIER-1 (LOCK): Win rate above 60% AND 5+ trades AND positive avg PnL\n- TIER-2 (CONDITIONAL): Win rate 30-60% OR fewer than 5 trades\n- TIER-3 (BLACKLIST): Win rate below 30% with 5+ trades\n\nStep 6: Write scorecard to memory using solana_memory_write with tag 'source_reputation'.\n\nFORMATTING RULES:\n- Every token reference MUST use SYMBOL (full_CA) format.\n- Do not execute trades. Do not ask questions.",
+        enabled: true
+      },
+
+      // ── Risk & Audit ──────────────────────────────────────────────
+      {
+        id: "risk-audit",
+        schedule: "0 */2 * * *",
+        agentId: "main",
+        sessionTarget: "isolated",
+        delivery: { mode: "none" },
+        message: "CRON_JOB: portfolio_risk_audit\n\nStep 1: Call solana_capital_status for wallet balance and portfolio value.\n\nStep 2: Call solana_positions for all open positions.\n\nStep 3: For each position, call solana_token_snapshot for current price and volume.\n\nStep 4: Run concentration check — flag WARNING if any position > 30% of portfolio, CRITICAL if > 50%.\n\nStep 5: Run exposure check — flag WARNING if total exposure > 50% of wallet, CRITICAL if > 75%.\n\nStep 6: Run drawdown check — CRITICAL if drawdown exceeds 25% from peak.\n\nStep 7: Calculate portfolio heat. Flag WARNING > 50%, CRITICAL > 75%.\n\nStep 8: Run liquidity check — WARNING if position > 2% of pool depth.\n\nStep 9: Check solana_killswitch_status.\n\nStep 10: Write risk report via solana_memory_write with tag 'risk_audit'.\n\nFORMATTING RULES:\n- Every token reference MUST use SYMBOL (full_CA) format.\n- Do not execute trades. Do not ask questions.",
+        enabled: true
+      },
+
+      // ── On-Chain Intelligence ─────────────────────────────────────
+      {
+        id: "meta-rotation",
+        schedule: "30 */3 * * *",
+        agentId: "main",
+        sessionTarget: "isolated",
+        delivery: { mode: "none" },
+        message: "CRON_JOB: meta_rotation_analysis\n\nStep 1: Call solana_scan_launches to get recent launches (last 3-6 hours).\n\nStep 2: Categorize each token by narrative cluster: AI/Agents, Animal Memes, Political, Celebrity/IP, DeFi, Gaming, Culture/Humor, Other.\n\nStep 3: For each cluster, aggregate: token count, total volume, average market cap.\n\nStep 4: Call solana_memory_search for 'meta_rotation' to compare with prior scan.\n\nStep 5: Classify each narrative: GAINING, SATURATED, COOLING, DORMANT.\n\nStep 6: Write rotation report via solana_memory_write with tag 'meta_rotation'.\n\nFORMATTING RULES:\n- Every token reference MUST use SYMBOL (full_CA) format.\n- Do not execute trades. Do not ask questions.",
+        enabled: true
+      },
+
+      // ── Portfolio Maintenance ─────────────────────────────────────
+      {
+        id: "dead-money-sweep",
+        schedule: "0 */2 * * *",
+        agentId: "main",
+        sessionTarget: "isolated",
+        delivery: { mode: "none" },
+        message: "CRON_JOB: dead_money_sweep\n\nStep 1: Call solana_positions to get all open LOCAL_MANAGED positions.\n\nStep 2: For each position, call solana_token_snapshot for current price and 24h volume.\n\nStep 3: Apply dead money criteria (ALL four must be true):\n- Loss > 40%\n- Held 90+ min AND still down 5%+\n- 24h volume < $5,000\n- Price flat (±5%) for 4+ hours\n\nStep 4: For flagged positions, execute exit via solana_trade_execute with side 'sell', max slippage 2000bps.\n\nStep 5: Call solana_trade_review for each exit.\n\nStep 6: Write sweep report via solana_memory_write with tag 'dead_money'.\n\nFORMATTING RULES:\n- Every token reference MUST use SYMBOL (full_CA) format.\n- Every TX MUST include solscan link.",
+        enabled: true
+      },
+      {
+        id: "subscription-cleanup",
+        schedule: "0 * * * *",
+        agentId: "main",
+        sessionTarget: "isolated",
+        delivery: { mode: "none" },
+        message: "CRON_JOB: subscription_cleanup\n\nStep 1: Call solana_positions to get open position CAs.\n\nStep 2: Call solana_bitquery_subscriptions to list active subscriptions.\n\nStep 3: Build matched vs orphaned lists.\n\nStep 4: Unsubscribe orphans via solana_bitquery_unsubscribe.\n\nStep 5: Reopen subscriptions nearing 24h expiry via solana_bitquery_subscription_reopen.\n\nStep 6: Write summary via solana_memory_write with tag 'subscription_cleanup'.\n\nFORMATTING RULES:\n- Every token reference MUST use SYMBOL (full_CA) format.\n- Do not execute trades. Do not ask questions.",
+        enabled: true
+      },
+
+      // ── Reporting ─────────────────────────────────────────────────
+      {
+        id: "daily-report",
+        schedule: "0 4 * * *",
+        agentId: "main",
+        sessionTarget: "isolated",
+        delivery: { mode: "none" },
+        message: "CRON_JOB: daily_performance_report\n\nStep 1: Call solana_journal_summary for last 24h aggregate stats.\n\nStep 2: Call solana_capital_status for current balance.\n\nStep 3: Call solana_positions for open positions.\n\nStep 4: Call solana_trades for all trades in last 24h.\n\nStep 5: Call solana_strategy_state for current version and weights.\n\nStep 6: Call solana_memory_search for 'source_reputation' and 'daily_report' (yesterday's for comparison).\n\nStep 7: Build comprehensive report: executive summary, trade log, best/worst trades, source performance, capital trajectory, strategy status, open positions.\n\nStep 8: Write report via solana_memory_write with tag 'daily_performance'.\n\nFORMATTING RULES:\n- Every token reference MUST use SYMBOL (full_CA) format.\n- Every trade MUST include solscan TX link.\n- Do not execute trades. Do not ask questions.",
+        enabled: true
+      },
+
+      // ── Whale / Smart Money Tracking ──────────────────────────────
+      {
+        id: "whale-watch",
+        schedule: "0 */2 * * *",
+        agentId: "main",
+        sessionTarget: "isolated",
+        delivery: { mode: "none" },
+        message: "CRON_JOB: whale_activity_scan\n\nStep 1: Call solana_positions to get open position CAs.\n\nStep 2: For each held token, call solana_token_holders for top 10 distribution.\n\nStep 3: Call solana_memory_search for 'whale_activity' baseline.\n\nStep 4: Compare distributions. Flag: NEW_WHALE, WHALE_EXIT, DEPLOYER_MOVE, CONCENTRATION_SPIKE, FRESH_WALLET_SURGE.\n\nStep 5: Assign priority: HIGH for whale exit/deployer move on held positions, MEDIUM for concentration changes, LOW for watchlist-only.\n\nStep 6: Write findings via solana_memory_write with tag 'whale_activity'.\n\nFORMATTING RULES:\n- Every token reference MUST use SYMBOL (full_CA) format.\n- Do not execute trades. Do not ask questions.",
+        enabled: true
+      },
+
+      // ── Alpha Scanning ──────────────────────────────────────────────
+      {
+        id: "alpha-scan",
+        schedule: "0 * * * *",
+        agentId: "main",
+        sessionTarget: "isolated",
+        delivery: { mode: "none" },
+        message: "CRON_JOB: alpha_scan\n\nStep 1: Call solana_scan_launches to find new token launches from the last hour. The response includes volume data per token — use THIS volume as the primary filter (not solana_token_snapshot volumeUsd24h, which often returns 0 for fresh tokens).\n\nStep 2: Filter candidates from the scan_launches results:\n- 24h volume above 50000 USD (use the volume field from scan_launches)\n- Market cap above 10000 USD (use mcap from scan_launches if available)\nTokens must pass BOTH filters to qualify. Tokens that fail either filter are eliminated. Log the top 3 rejected tokens by volume for reference.\n\nStep 3: For each token that passes the volume/mcap filter, call solana_token_holders to check holder distribution. Skip if the top single holder owns more than 30 percent (concentration risk). Skip if total top-10 concentration exceeds 60 percent.\n\nStep 4: For each token that passes holder checks, call solana_token_risk to check for mint authority or freeze authority. Hard skip if either is present (rug risk).\n\nStep 5: Website legitimacy check — for each token that passes risk checks, call solana_bitquery_catalog with templatePath 'pumpFunMetadata.tokenMetadataByAddress' and variables { token: CA } to get on-chain metadata. If the metadata contains a 'website' field, call web_fetch_url with the website URL. Analyze the response: check if the site has real content (not just a generic template), check if socialLinks.twitter matches the on-chain metadata twitter field. Include findings in the alpha submission thesis. If no website exists, note 'no website' — this is neutral, not a skip. Cache rule: check solana_memory_search for 'website_analyzed' with the same URL before fetching. If analyzed in the last 48 hours, reuse the cached result. After analysis, write findings via solana_memory_write with tag 'website_analyzed'.\n\nStep 6: Scrub any external text via solana_scrub_untrusted_text before using in analysis.\n\nStep 7: For each token that passes ALL checks, call solana_alpha_submit to add it to the alpha buffer for the next heartbeat evaluation. Include the thesis: volume, mcap, holder concentration, risk flags, narrative cluster, website legitimacy findings.\n\nStep 8: Write scan report to memory using solana_memory_write with tag 'alpha_scan'. Include: total launches scanned, unique tokens, tokens passed each filter stage (volume → holders → risk → website → submitted), top 3 rejected tokens with reason.\n\nFORMATTING RULES:\n- Every token reference MUST use SYMBOL (full_CA) format.\n- Include solscan token link: https://solscan.io/token/{CA} for each qualifying token.\n- Do not execute trades directly — only submit to alpha buffer.\n- Do not ask questions.",
+        enabled: true
+      },
+
+      // ── Intelligence Lab (V1-Upgraded NEW) ──────────────────────────
+      {
+        id: "intelligence-lab-eval",
+        schedule: "0 */12 * * *",
+        agentId: "main",
+        sessionTarget: "isolated",
+        delivery: { mode: "none" },
+        message: "CRON_JOB: intelligence_lab_eval\n\nStep 1: Check candidate dataset size via solana_candidate_get. If fewer than 20 labeled candidates, log 'insufficient data for evaluation' and exit.\n\nStep 2: Run evaluation report via solana_evaluation_report — get confusion matrix, accuracy, precision, recall, F1 for current champion model.\n\nStep 3: Check model registry via solana_model_registry for any challenger models.\n\nStep 4: If challenger exists, run replay via solana_replay_run comparing champion vs challenger on recent candidates.\n\nStep 5: Generate replay report via solana_replay_report.\n\nStep 6: If challenger outperforms champion (higher F1 AND accuracy), promote via solana_model_promote.\n\nStep 7: Log evaluation results via solana_memory_write with tag 'intelligence_lab_eval'. Include: model accuracy, F1, promotion decision, dataset size.\n\nDo not execute trades. Do not ask questions.",
+        enabled: true
+      },
+      {
+        id: "source-trust-refresh",
+        schedule: "0 */6 * * *",
+        agentId: "main",
+        sessionTarget: "isolated",
+        delivery: { mode: "none" },
+        message: "CRON_JOB: source_trust_refresh\n\nStep 1: Call solana_source_trust_refresh to recalculate trust scores for all tracked alpha sources based on recent trade outcomes.\n\nStep 2: Call solana_deployer_trust_refresh to recalculate deployer trust scores based on recent token performance.\n\nStep 3: Call solana_source_trust_get to read updated scores. Flag any sources that dropped below 30 trust score.\n\nStep 4: Call solana_deployer_trust_get to read deployer scores. Flag any deployers with 3+ failed tokens.\n\nStep 5: Log trust score updates via solana_memory_write with tag 'trust_refresh'. Include: sources updated, deployers updated, flagged sources/deployers.\n\nDo not execute trades. Do not ask questions.",
+        enabled: true
+      }
+    ]
+  },
+
+  hooks: {
+    enabled: true,
+    token: "REPLACE_WITH_SECURE_TOKEN",
+    mappings: [
+      {
+        match: { path: "alpha-signal" },
+        action: "agent",
+        agentId: "main",
+        deliver: true
+      },
+      {
+        match: { path: "firehose-alert" },
+        action: "agent",
+        agentId: "main",
+        deliver: true
+      }
+    ]
+  }
+}