tollkit-wallet 0.2.0 → 0.2.2

package/README.md

@@ -25,7 +25,7 @@ Swaps cost a flat 0.5%, shown before every trade. On some Base and Ethereum pair
 ```
 npm install -g tollkit-wallet
 tollkit-wallet init                 # choose a password; prints your Base/Ethereum and Solana addresses
-tollkit-wallet budget               # see limits; change with e.g. budget per_trade_usd=100
+tollkit-wallet budget               # see limits; change with e.g. budget per_trade_usd=100 (or in the dashboard's Settings tab)
 tollkit-wallet telegram <bot-token> <chat-id>   # optional: approvals in Telegram
 ```
 
@@ -56,7 +56,11 @@ The agent has no tool for this.
 }
 ```
 
-Tools: `wallet_status`, `wallet_balances`, `swap_quote`, `swap`, `pay_fetch`, `seller_check`, `receipts`, `autopilot_propose`, `autopilot_rules`, `autopilot_cancel`, `paper_swap`, `paper_status`. There is no tool for changing limits, approvals or keys.
+Tools: `wallet_status`, `wallet_balances`, `swap_quote`, `swap`, `pay_fetch`, `seller_check`, `receipts`, `market_prices`, `price_history`, `autopilot_propose`, `autopilot_rules`, `autopilot_cancel`, `paper_swap`, `paper_status`. There is no tool for changing limits, approvals or keys.
+
+The easiest way: open the dashboard (`tollkit-wallet ui`), click **Connect your AI**, type your wallet password and click **Add** next to your app. It finds Claude desktop, Claude Code, Cursor, Codex and Gemini CLI on your computer and adds the wallet to their settings for you (keeping a backup of any file it changes); VS Code opens to confirm. Each app also has the steps to do it by hand.
+
+The app needs to unlock the wallet on its own, so adding an app saves your password to `~/.tollkit-wallet/password`, readable only by your user account (or run `tollkit-wallet password-file` to do just that step). Anyone who can read that file and your wallet folder can spend within your limits, so keep both on this computer.
 
 ## Use with Coinbase AgentKit
 
@@ -69,7 +73,7 @@ const wallet = await TollkitWallet.open(process.env.TOLLKIT_WALLET_PASSWORD!);
 const agentkit = await AgentKit.from({ walletProvider, actionProviders: [tollkitWalletActionProvider(wallet)] });
 ```
 
-This adds `tollkit_swap`, `tollkit_swap_quote`, `tollkit_pay_fetch`, `tollkit_wallet_balances`, `tollkit_wallet_status`, `tollkit_seller_check` and `tollkit_receipts`. They use the Tollkit wallet's own keys and limits, whatever AgentKit wallet provider you use.
+This adds the same 14 tools as the MCP server, with a `tollkit_` prefix (`tollkit_swap`, `tollkit_pay_fetch`, `tollkit_autopilot_propose`, …). They use the Tollkit wallet's own keys and limits, whatever AgentKit wallet provider you use.
 
 ## Use with ElizaOS
 
@@ -80,6 +84,14 @@ import { tollkitWalletPlugin } from "tollkit-wallet/elizaos";
 
 Set `TOLLKIT_WALLET_PASSWORD` (or `TOLLKIT_WALLET_PASSWORD_FILE`) in the agent's settings or environment. The agent's model reads the request ("swap 25 USDC to SOL"), and the wallet checks it against your limits before anything is signed.
 
+## Use with websites (browser extension)
+
+The Tollkit extension for Chrome, Brave and Edge lets websites connect to this wallet the way they connect to MetaMask or Phantom: Base and Ethereum apps through the standard Ethereum provider (EIP-1193/EIP-6963), Solana apps through the Wallet Standard.
+
+Keys stay in Tollkit. When a site asks to connect, sign or send, the request shows up in the dashboard's Approvals tab with the site's name and the details. Transactions are checked against the network first. Nothing happens until you approve. Read-only calls go straight through.
+
+To add it: run `tollkit-wallet extension` for the folder and steps (Developer mode, then Load unpacked), then pair it from **Settings → Pair a browser**. Connected sites are listed in Settings, where you can disconnect them. The dashboard has to be open for sites to use the wallet.
+
 ## Use from code
 
 ```ts
@@ -88,6 +100,45 @@ const w = await TollkitWallet.open(process.env.TOLLKIT_WALLET_PASSWORD!);
 const r = await w.pay("https://api.example.com/paid-endpoint");
 ```
 
+## Backup and recovery
+
+New wallets (0.2.2 and later) are made from a 12-word recovery phrase. It's shown once when you create the wallet, and you can see it again with `tollkit-wallet backup` or **Back up** in the dashboard (password needed). The dashboard asks you to confirm three of the words before it counts as backed up.
+
+The phrase uses the same derivation paths as MetaMask and Phantom (Base/Ethereum `m/44'/60'/0'/0/0`, Solana `m/44'/501'/0'/0'`), so it restores the same addresses there too.
+
+To restore: `tollkit-wallet restore` and type the phrase. Wallets made before 0.2.2 have no phrase; their backup is the two private keys (`tollkit-wallet backup` shows them), restored with `tollkit-wallet restore --keys`. Add `--replace` to restore over an existing wallet; its files are kept, renamed with `.replaced-<time>`.
+
+## Tokens and price charts
+
+The dashboard's Home tab lists every token the wallet holds that has a price, with its value and 24-hour change. Tap a token for a price chart (1D, 1W, 1M, 1Y). Prices and charts come from DefiLlama.
+
+How tokens are found:
+- Solana: every SPL and Token-2022 token account the address owns.
+- Ethereum: Blockscout's public token list for the address.
+- Base: tokens you've swapped into with this wallet, plus any you add with **Add a token** (paste the contract address). Base has no free public token index that works without a key, so the wallet doesn't scan for others.
+
+Tokens with no price (most airdropped spam) are hidden and counted below the list. Added tokens are saved in `tokens.json` in the wallet folder.
+
+## Buy crypto with a card
+
+**Buy** on the Home tab opens Coinbase's checkout to buy USDC or ETH on Base or Ethereum, or USDC or SOL on Solana, sent straight to this wallet's address. The wallet asks Tollkit's server for a single-use Coinbase Onramp link; only your public address, the network, the coin and the amount are sent. Coinbase handles the payment and any ID checks, and its own fees and limits apply.
+
+## Cash out to your bank
+
+**Sell** on the Home tab sells USDC, ETH or SOL through Coinbase to your bank or PayPal. You need a Coinbase account. The wallet opens Coinbase's sell page; you choose where the money goes and click **Cash out now**. Coinbase then gives an address to send the crypto to, and the dashboard shows it with the amount, Coinbase's fee and what you'll receive. Nothing is sent until you confirm with your password. Coinbase allows 30 minutes for the send. Only your public address, the network, the coin and the amount go to Tollkit's server.
+
+## Move between networks
+
+**Move** on the Home tab sends your own USDC between Base, Ethereum and Solana, or ETH between Base and Ethereum, to this wallet's address on the other network.
+
+- USDC uses Circle's own transfer (CCTP): it's burned on one network and minted on the other by Circle, usually in 8 to 20 seconds. Circle's forwarding service pays the network fee on arrival, so you don't need gas there.
+- ETH goes through Across, usually in under a minute.
+- Tollkit's fee is 0.25%. Circle's or Across's fee, and the amount you'll receive at least, are shown before you confirm. Moves need your password and don't count against your spending limits.
+
+## Stake SOL
+
+**Stake** on the Home tab stakes SOL with a validator you pick from the ones currently voting, listed by how much SOL is staked with them, with their fee. The minimum is set by the network (1 SOL as of October 2026) and read live. Stakes start earning after the current epoch ends (about a day). Unstake any time; once the epoch ends, **Withdraw** returns the SOL to your wallet. The wallet keeps both stake and withdraw authority, and staking needs your password.
+
 ## Where things live
 
 `~/.tollkit-wallet/` (or `TOLLKIT_WALLET_HOME`) holds:
@@ -116,10 +167,18 @@ tollkit-wallet rule pause <id>       # or: rule on <id>, rule cancel <id>
 Or use the **Autopilot** tab in the dashboard (`tollkit-wallet ui`). Rule types: limit buy, limit sell, take-profit, stop-loss, trailing stop, and recurring buys (hourly, daily, weekly or a set weekday, with an optional count and maximum price). A take-profit and a stop-loss on the same token are linked: when one fills, the other cancels.
 
 - Every fill goes through the same limits, approvals and receipts as any swap, and pays the same 0.5% fee.
-- Rules an agent suggests (`autopilot_propose`) wait for you to turn them on, unless you tick "Let agents turn on autopilot rules without asking me" in Limits (or `budget agent_rules=auto`).
+- Rules an agent suggests (`autopilot_propose`) wait for you to turn them on, unless you tick "Let agents turn on autopilot rules without asking me" in Settings (or `budget agent_rules=auto`).
 - The autopilot runs while the wallet runs: keep the dashboard open, or run `tollkit-wallet autopilot` on a computer or small server that stays on. Only one copy runs rules at a time.
 - Limit orders fill only at their price or better (within 1% for fees and spread). Stops always sell. When selling all of a chain's coin, a little is kept for network fees.
 
+### Chat with your AI on the Autopilot tab
+
+If Claude Code is installed and signed in on this computer, the Autopilot tab is a chat. Say what you want in your own words ("protect my ETH if it drops hard", "buy SOL on dips, $20 at a time"); Claude checks your balances, live prices and recent price history, explains its thinking, and suggests rules as cards you turn on with one tap. It runs on your own Claude plan.
+
+For these chats Claude Code runs with its own tools switched off and only the wallet's advisor tools available (`tollkit-wallet mcp --advisor`: balances, limits, receipts, prices, price history, your rules, and suggesting rules). It can't trade, pay, withdraw or change limits, and its suggestions always wait for you, even if you let other agents turn rules on.
+
+**Check-ins:** pick every 1, 4, 12 or 24 hours and Claude reviews your rules against the market and what you've told it, then suggests changes (for example raising a stop-loss after a rise). A suggested change replaces the old rule only when you turn it on. If Telegram is set up, check-in suggestions also arrive there with Approve and Deny. Check-ins run while the dashboard is open.
+
 ## Paper trading
 
 Practise with pretend money at real live prices, fees included, under the same limits:

package/THIRD_PARTY_NOTICES.md

@@ -11,3 +11,11 @@ Coin and chain logos in `src/coin-icons.ts` come from web3icons (`@web3icons/cor
 > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 The coin and network names and logos are trademarks of their owners and are used only to identify the assets and networks the wallet supports.
+
+## Simple Icons
+
+The Claude, Cursor, GitHub Copilot and Gemini logos in the dashboard's "Connect your AI" picker (`src/ai-icons.ts`) come from Simple Icons (https://simpleicons.org), whose data is released under CC0 1.0. The logos are trademarks of their owners and are shown only to say which apps work with the wallet.
+
+## Wallet Standard (extension/inpage.js)
+
+The Solana wallet registration in `extension/inpage.js` follows `registerWallet` from `@wallet-standard/wallet` (https://github.com/wallet-standard/wallet-standard), Apache License 2.0. The feature names and shapes come from `@wallet-standard/features` and `@solana/wallet-standard-features` (Apache License 2.0).

package/dist/actions.d.ts

@@ -5,6 +5,7 @@
  * addresses.
  */
 import { z } from "zod";
+export { isLocalUrl } from "./netguard.js";
 import type { TollkitWallet } from "./wallet.js";
 export declare const SwapArgs: z.ZodObject<{
     chain: z.ZodEnum<["base", "ethereum", "solana"]>;
@@ -32,12 +33,12 @@ export declare const PayArgs: z.ZodObject<{
     body: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     url: string;
-    method?: "POST" | "GET" | "PUT" | "PATCH" | "DELETE" | undefined;
+    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | undefined;
     headers?: Record<string, string> | undefined;
     body?: string | undefined;
 }, {
     url: string;
-    method?: "POST" | "GET" | "PUT" | "PATCH" | "DELETE" | undefined;
+    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | undefined;
     headers?: Record<string, string> | undefined;
     body?: string | undefined;
 }>;
@@ -80,12 +81,15 @@ export declare const ProposeArgs: z.ZodObject<{
         max_price: z.ZodOptional<z.ZodNumber>;
         group: z.ZodOptional<z.ZodString>;
         expires_at: z.ZodOptional<z.ZodString>;
+        reason: z.ZodOptional<z.ZodString>;
+        replaces: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        chain: "base" | "ethereum" | "solana";
         kind: "limit_buy" | "limit_sell" | "stop_loss" | "take_profit" | "trailing_stop" | "dca";
+        chain: "base" | "ethereum" | "solana";
         token: string;
         every?: "hour" | "day" | "week" | undefined;
         name?: string | undefined;
+        reason?: string | undefined;
         sell_amount?: string | undefined;
         amount_usd?: number | undefined;
         sell_percent?: number | undefined;
@@ -96,12 +100,14 @@ export declare const ProposeArgs: z.ZodObject<{
         max_price?: number | undefined;
         group?: string | undefined;
         expires_at?: string | undefined;
+        replaces?: string | undefined;
     }, {
-        chain: "base" | "ethereum" | "solana";
         kind: "limit_buy" | "limit_sell" | "stop_loss" | "take_profit" | "trailing_stop" | "dca";
+        chain: "base" | "ethereum" | "solana";
         token: string;
         every?: "hour" | "day" | "week" | undefined;
         name?: string | undefined;
+        reason?: string | undefined;
         sell_amount?: string | undefined;
         amount_usd?: number | undefined;
         sell_percent?: number | undefined;
@@ -112,14 +118,16 @@ export declare const ProposeArgs: z.ZodObject<{
         max_price?: number | undefined;
         group?: string | undefined;
         expires_at?: string | undefined;
+        replaces?: string | undefined;
     }>, "many">>;
 }, "strip", z.ZodTypeAny, {
     rules?: {
-        chain: "base" | "ethereum" | "solana";
         kind: "limit_buy" | "limit_sell" | "stop_loss" | "take_profit" | "trailing_stop" | "dca";
+        chain: "base" | "ethereum" | "solana";
         token: string;
         every?: "hour" | "day" | "week" | undefined;
         name?: string | undefined;
+        reason?: string | undefined;
         sell_amount?: string | undefined;
         amount_usd?: number | undefined;
         sell_percent?: number | undefined;
@@ -130,15 +138,17 @@ export declare const ProposeArgs: z.ZodObject<{
         max_price?: number | undefined;
         group?: string | undefined;
         expires_at?: string | undefined;
+        replaces?: string | undefined;
     }[] | undefined;
     text?: string | undefined;
 }, {
     rules?: {
-        chain: "base" | "ethereum" | "solana";
         kind: "limit_buy" | "limit_sell" | "stop_loss" | "take_profit" | "trailing_stop" | "dca";
+        chain: "base" | "ethereum" | "solana";
         token: string;
         every?: "hour" | "day" | "week" | undefined;
         name?: string | undefined;
+        reason?: string | undefined;
         sell_amount?: string | undefined;
         amount_usd?: number | undefined;
         sell_percent?: number | undefined;
@@ -149,15 +159,16 @@ export declare const ProposeArgs: z.ZodObject<{
         max_price?: number | undefined;
         group?: string | undefined;
         expires_at?: string | undefined;
+        replaces?: string | undefined;
     }[] | undefined;
     text?: string | undefined;
 }>;
 export declare const RulesListArgs: z.ZodObject<{
     status: z.ZodOptional<z.ZodEnum<["proposed", "active", "paused", "done", "cancelled", "expired", "error"]>>;
 }, "strip", z.ZodTypeAny, {
-    status?: "done" | "error" | "proposed" | "active" | "paused" | "cancelled" | "expired" | undefined;
+    status?: "error" | "done" | "proposed" | "active" | "paused" | "cancelled" | "expired" | undefined;
 }, {
-    status?: "done" | "error" | "proposed" | "active" | "paused" | "cancelled" | "expired" | undefined;
+    status?: "error" | "done" | "proposed" | "active" | "paused" | "cancelled" | "expired" | undefined;
 }>;
 export declare const RuleIdArgs: z.ZodObject<{
     id: z.ZodString;
@@ -166,6 +177,58 @@ export declare const RuleIdArgs: z.ZodObject<{
 }, {
     id: string;
 }>;
+export declare const HistoryArgs: z.ZodObject<{
+    token: z.ZodEnum<["ETH", "WETH", "SOL"]>;
+    interval: z.ZodOptional<z.ZodEnum<["15m", "1h", "6h", "1d"]>>;
+    points: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    token: "ETH" | "WETH" | "SOL";
+    points?: number | undefined;
+    interval?: "1h" | "1d" | "15m" | "6h" | undefined;
+}, {
+    token: "ETH" | "WETH" | "SOL";
+    points?: number | undefined;
+    interval?: "1h" | "1d" | "15m" | "6h" | undefined;
+}>;
+/** Coinbase Exchange public candles: [time, low, high, open, close, volume], newest first, at most 300, no key. */
+export declare function priceHistory(a: z.infer<typeof HistoryArgs>, f?: typeof fetch): Promise<{
+    ok: boolean;
+    refused: {
+        code: string;
+        reason: string;
+    };
+    token?: undefined;
+    interval?: undefined;
+    source?: undefined;
+    from?: undefined;
+    to?: undefined;
+    open?: undefined;
+    last?: undefined;
+    change_pct?: undefined;
+    high?: undefined;
+    low?: undefined;
+    candles?: undefined;
+} | {
+    ok: boolean;
+    token: "ETH" | "WETH" | "SOL";
+    interval: "1h" | "1d" | "15m" | "6h";
+    source: string;
+    from: string;
+    to: string;
+    open: number;
+    last: number;
+    change_pct: number;
+    high: number;
+    low: number;
+    candles: {
+        t: string;
+        open: number;
+        high: number;
+        low: number;
+        close: number;
+    }[];
+    refused?: undefined;
+}>;
 export interface WalletAction<S extends z.ZodTypeAny = z.ZodTypeAny> {
     name: string;
     description: string;
@@ -216,12 +279,12 @@ export declare const ACTIONS: readonly [WalletAction<z.ZodObject<{}, "strip", z.
     body: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     url: string;
-    method?: "POST" | "GET" | "PUT" | "PATCH" | "DELETE" | undefined;
+    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | undefined;
     headers?: Record<string, string> | undefined;
     body?: string | undefined;
 }, {
     url: string;
-    method?: "POST" | "GET" | "PUT" | "PATCH" | "DELETE" | undefined;
+    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | undefined;
     headers?: Record<string, string> | undefined;
     body?: string | undefined;
 }>>, WalletAction<z.ZodObject<{
@@ -242,6 +305,18 @@ export declare const ACTIONS: readonly [WalletAction<z.ZodObject<{}, "strip", z.
 }, {
     since?: string | undefined;
     limit?: number | undefined;
+}>>, WalletAction<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>, WalletAction<z.ZodObject<{
+    token: z.ZodEnum<["ETH", "WETH", "SOL"]>;
+    interval: z.ZodOptional<z.ZodEnum<["15m", "1h", "6h", "1d"]>>;
+    points: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    token: "ETH" | "WETH" | "SOL";
+    points?: number | undefined;
+    interval?: "1h" | "1d" | "15m" | "6h" | undefined;
+}, {
+    token: "ETH" | "WETH" | "SOL";
+    points?: number | undefined;
+    interval?: "1h" | "1d" | "15m" | "6h" | undefined;
 }>>, WalletAction<z.ZodObject<{
     text: z.ZodOptional<z.ZodString>;
     rules: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -260,12 +335,15 @@ export declare const ACTIONS: readonly [WalletAction<z.ZodObject<{}, "strip", z.
         max_price: z.ZodOptional<z.ZodNumber>;
         group: z.ZodOptional<z.ZodString>;
         expires_at: z.ZodOptional<z.ZodString>;
+        reason: z.ZodOptional<z.ZodString>;
+        replaces: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        chain: "base" | "ethereum" | "solana";
         kind: "limit_buy" | "limit_sell" | "stop_loss" | "take_profit" | "trailing_stop" | "dca";
+        chain: "base" | "ethereum" | "solana";
         token: string;
         every?: "hour" | "day" | "week" | undefined;
         name?: string | undefined;
+        reason?: string | undefined;
         sell_amount?: string | undefined;
         amount_usd?: number | undefined;
         sell_percent?: number | undefined;
@@ -276,12 +354,14 @@ export declare const ACTIONS: readonly [WalletAction<z.ZodObject<{}, "strip", z.
         max_price?: number | undefined;
         group?: string | undefined;
         expires_at?: string | undefined;
+        replaces?: string | undefined;
     }, {
-        chain: "base" | "ethereum" | "solana";
         kind: "limit_buy" | "limit_sell" | "stop_loss" | "take_profit" | "trailing_stop" | "dca";
+        chain: "base" | "ethereum" | "solana";
         token: string;
         every?: "hour" | "day" | "week" | undefined;
         name?: string | undefined;
+        reason?: string | undefined;
         sell_amount?: string | undefined;
         amount_usd?: number | undefined;
         sell_percent?: number | undefined;
@@ -292,14 +372,16 @@ export declare const ACTIONS: readonly [WalletAction<z.ZodObject<{}, "strip", z.
         max_price?: number | undefined;
         group?: string | undefined;
         expires_at?: string | undefined;
+        replaces?: string | undefined;
     }>, "many">>;
 }, "strip", z.ZodTypeAny, {
     rules?: {
-        chain: "base" | "ethereum" | "solana";
         kind: "limit_buy" | "limit_sell" | "stop_loss" | "take_profit" | "trailing_stop" | "dca";
+        chain: "base" | "ethereum" | "solana";
         token: string;
         every?: "hour" | "day" | "week" | undefined;
         name?: string | undefined;
+        reason?: string | undefined;
         sell_amount?: string | undefined;
         amount_usd?: number | undefined;
         sell_percent?: number | undefined;
@@ -310,15 +392,17 @@ export declare const ACTIONS: readonly [WalletAction<z.ZodObject<{}, "strip", z.
         max_price?: number | undefined;
         group?: string | undefined;
         expires_at?: string | undefined;
+        replaces?: string | undefined;
     }[] | undefined;
     text?: string | undefined;
 }, {
     rules?: {
-        chain: "base" | "ethereum" | "solana";
         kind: "limit_buy" | "limit_sell" | "stop_loss" | "take_profit" | "trailing_stop" | "dca";
+        chain: "base" | "ethereum" | "solana";
         token: string;
         every?: "hour" | "day" | "week" | undefined;
         name?: string | undefined;
+        reason?: string | undefined;
         sell_amount?: string | undefined;
         amount_usd?: number | undefined;
         sell_percent?: number | undefined;
@@ -329,14 +413,15 @@ export declare const ACTIONS: readonly [WalletAction<z.ZodObject<{}, "strip", z.
         max_price?: number | undefined;
         group?: string | undefined;
         expires_at?: string | undefined;
+        replaces?: string | undefined;
     }[] | undefined;
     text?: string | undefined;
 }>>, WalletAction<z.ZodObject<{
     status: z.ZodOptional<z.ZodEnum<["proposed", "active", "paused", "done", "cancelled", "expired", "error"]>>;
 }, "strip", z.ZodTypeAny, {
-    status?: "done" | "error" | "proposed" | "active" | "paused" | "cancelled" | "expired" | undefined;
+    status?: "error" | "done" | "proposed" | "active" | "paused" | "cancelled" | "expired" | undefined;
 }, {
-    status?: "done" | "error" | "proposed" | "active" | "paused" | "cancelled" | "expired" | undefined;
+    status?: "error" | "done" | "proposed" | "active" | "paused" | "cancelled" | "expired" | undefined;
 }>>, WalletAction<z.ZodObject<{
     id: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -362,3 +447,98 @@ export declare const ACTIONS: readonly [WalletAction<z.ZodObject<{}, "strip", z.
     buy: string;
     slippage_bps?: number | undefined;
 }>>, WalletAction<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>>];
+export declare function proposeRules(w: TollkitWallet, a: z.infer<typeof ProposeArgs>, o?: {
+    neverAuto?: boolean;
+}): Promise<{
+    ok: boolean;
+    refused: {
+        code: string;
+        reason: string;
+    };
+    unparsed: string[];
+    rules?: undefined;
+    note?: undefined;
+} | {
+    ok: boolean;
+    refused: {
+        code: string;
+        reason: string;
+    };
+    rules: {
+        id: string;
+        status: import("./rules.js").RuleStatus;
+        description: string;
+        created_by: "owner" | "agent";
+        last_price: number | undefined;
+        fills: number;
+        last_fill: import("./rules.js").Fill | undefined;
+        error: string | undefined;
+        rule: {
+            state: undefined;
+            id: string;
+            status: import("./rules.js").RuleStatus;
+            created_by: "owner" | "agent";
+            created_at: string;
+            activated_at?: string;
+            kind: "limit_buy" | "limit_sell" | "stop_loss" | "take_profit" | "trailing_stop" | "dca";
+            chain: "base" | "ethereum" | "solana";
+            token: string;
+            every?: "hour" | "day" | "week" | undefined;
+            name?: string | undefined;
+            reason?: string | undefined;
+            sell_amount?: string | undefined;
+            amount_usd?: number | undefined;
+            sell_percent?: number | undefined;
+            trigger_price?: number | undefined;
+            trail_pct?: number | undefined;
+            weekday?: number | undefined;
+            times?: number | undefined;
+            max_price?: number | undefined;
+            group?: string | undefined;
+            expires_at?: string | undefined;
+            replaces?: string | undefined;
+        };
+    }[];
+    unparsed: string[];
+    note?: undefined;
+} | {
+    ok: boolean;
+    rules: {
+        id: string;
+        status: import("./rules.js").RuleStatus;
+        description: string;
+        created_by: "owner" | "agent";
+        last_price: number | undefined;
+        fills: number;
+        last_fill: import("./rules.js").Fill | undefined;
+        error: string | undefined;
+        rule: {
+            state: undefined;
+            id: string;
+            status: import("./rules.js").RuleStatus;
+            created_by: "owner" | "agent";
+            created_at: string;
+            activated_at?: string;
+            kind: "limit_buy" | "limit_sell" | "stop_loss" | "take_profit" | "trailing_stop" | "dca";
+            chain: "base" | "ethereum" | "solana";
+            token: string;
+            every?: "hour" | "day" | "week" | undefined;
+            name?: string | undefined;
+            reason?: string | undefined;
+            sell_amount?: string | undefined;
+            amount_usd?: number | undefined;
+            sell_percent?: number | undefined;
+            trigger_price?: number | undefined;
+            trail_pct?: number | undefined;
+            weekday?: number | undefined;
+            times?: number | undefined;
+            max_price?: number | undefined;
+            group?: string | undefined;
+            expires_at?: string | undefined;
+            replaces?: string | undefined;
+        };
+    }[];
+    unparsed: string[];
+    note: string;
+    refused?: undefined;
+}>;

package/dist/actions.js

@@ -5,6 +5,8 @@
  * addresses.
  */
 import { z } from "zod";
+import { isLocalUrl } from "./netguard.js";
+export { isLocalUrl } from "./netguard.js";
 import { resolveToken, toAtomic } from "./tokens.js";
 import { checkSeller } from "./seller.js";
 import { RuleInput, describeRule, ruleProblem } from "./rules.js";
@@ -36,6 +38,30 @@ export const ProposeArgs = z.object({
 });
 export const RulesListArgs = z.object({ status: z.enum(["proposed", "active", "paused", "done", "cancelled", "expired", "error"]).optional() });
 export const RuleIdArgs = z.object({ id: z.string().min(4).max(40) });
+export const HistoryArgs = z.object({
+    token: z.enum(["ETH", "WETH", "SOL"]).describe("ETH (also WETH) or SOL; prices from Coinbase Exchange"),
+    interval: z.enum(["15m", "1h", "6h", "1d"]).optional().describe("Candle size (default 1h)"),
+    points: z.number().int().min(5).max(200).optional().describe("How many candles, newest last (default 48)"),
+});
+const GRAN = { "15m": 900, "1h": 3600, "6h": 21600, "1d": 86400 };
+/** Coinbase Exchange public candles: [time, low, high, open, close, volume], newest first, at most 300, no key. */
+export async function priceHistory(a, f = fetch) {
+    const product = a.token === "SOL" ? "SOL-USD" : "ETH-USD", interval = a.interval ?? "1h";
+    const r = await f(`https://api.exchange.coinbase.com/products/${product}/candles?granularity=${GRAN[interval]}`, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(10_000) });
+    if (!r.ok)
+        return { ok: false, refused: { code: "unavailable", reason: `Price history isn't available right now (HTTP ${r.status}).` } };
+    const rows = (await r.json()).sort((x, y) => x[0] - y[0]).slice(-(a.points ?? 48));
+    if (!rows.length)
+        return { ok: false, refused: { code: "unavailable", reason: "No price history returned." } };
+    const closes = rows.map((x) => x[4]), first = rows[0][3], last = closes.at(-1);
+    return {
+        ok: true, token: a.token, interval, source: "Coinbase Exchange",
+        from: new Date(rows[0][0] * 1000).toISOString(), to: new Date(rows.at(-1)[0] * 1000).toISOString(),
+        open: first, last, change_pct: +(((last - first) / first) * 100).toFixed(2),
+        high: Math.max(...rows.map((x) => x[2])), low: Math.min(...rows.map((x) => x[1])),
+        candles: rows.map(([t, low, high, open, close]) => ({ t: new Date(t * 1000).toISOString(), open, high, low, close })),
+    };
+}
 async function swapRequest(w, a) {
     const chain = a.chain;
     const [sell, buy] = await Promise.all([resolveToken(chain, a.sell), resolveToken(chain, a.buy)]);
@@ -71,7 +97,9 @@ export const ACTIONS = [
     def({ name: "pay_fetch", spends: true, schema: PayArgs,
         description: "Fetch a URL and pay for it if it asks (x402 or MPP, USDC/USDT on Base, Ethereum or Solana). Checks the seller, screens the recipient against OFAC, stays within the owner's limits. Returns the response body.",
         run: async (w, a) => {
-            const r = await w.pay(a.url, { method: a.method ?? (a.body ? "POST" : "GET"), headers: a.headers, body: a.body });
+            if (isLocalUrl(a.url))
+                return { paid: false, status: 0, refused: { code: "local_address", reason: "pay_fetch only calls public internet addresses." } };
+            const r = await w.pay(a.url, { method: a.method ?? (a.body ? "POST" : "GET"), headers: a.headers, body: a.body }, { publicOnly: true });
             let body;
             if (r.response) {
                 const t = await r.response.text();
@@ -85,8 +113,14 @@ export const ACTIONS = [
     def({ name: "receipts", spends: false, schema: ReceiptArgs,
         description: "Recent trades, payments and withdrawals with amounts, fees and transaction hashes.",
         run: async (w, a) => w.receipts(a.since).slice(-(a.limit ?? 50)) }),
+    def({ name: "market_prices", spends: false, schema: NoArgs,
+        description: "Live USD prices and 24-hour change for ETH, SOL and USDT (Coinbase Exchange; USDC is $1).",
+        run: async () => { const f = new PriceFeed(); await f.refresh(); return f.snapshot(); } }),
+    def({ name: "price_history", spends: false, schema: HistoryArgs,
+        description: "Recent price candles for ETH or SOL (open, high, low, close) with the period's change, high and low. Use it to judge trends and to set sensible trigger prices.",
+        run: async (_w, a) => priceHistory(a) }),
     def({ name: "autopilot_propose", spends: false, schema: ProposeArgs,
-        description: "Set up autopilot rules: limit buy/sell, stop-loss, take-profit, trailing stop, recurring buy (DCA). Give plain English in `text` (e.g. \"buy $25 of SOL every Monday; sell half my ETH if it rises 10% and all if it falls 8%\") or exact `rules`. Unless the owner allows auto, rules wait for the owner to turn them on in the dashboard; fills follow the owner's limits.",
+        description: "Set up autopilot rules: limit buy/sell, stop-loss, take-profit, trailing stop, recurring buy (DCA). Give plain English in `text` (e.g. \"buy $25 of SOL every Monday; sell half my ETH if it rises 10% and all if it falls 8%\") or exact `rules`. Give each rule a short plain `reason`; to change an existing rule, propose its replacement with `replaces: <id>`. Unless the owner allows auto, rules wait for the owner to turn them on in the dashboard; fills follow the owner's limits.",
         run: async (w, a) => proposeRules(w, a) }),
     def({ name: "autopilot_rules", spends: false, schema: RulesListArgs,
         description: "The autopilot's rules with a plain description of each, status, last price seen, fills and any error.",
@@ -116,7 +150,7 @@ function showRule(r) {
     const last = r.state.fills.at(-1);
     return { id: r.id, status: r.status, description: describeRule(r), created_by: r.created_by, last_price: r.state.last_price, fills: r.state.fills.filter((f) => f.ok).length, last_fill: last, error: r.state.last_error, rule: { ...r, state: undefined } };
 }
-async function proposeRules(w, a) {
+export async function proposeRules(w, a, o = {}) {
     let drafts = [...(a.rules ?? [])], unparsed = [];
     if (a.text) {
         const feed = new PriceFeed();
@@ -132,9 +166,15 @@ async function proposeRules(w, a) {
         if (why)
             return { ok: false, refused: { code: "bad_rule", reason: `${describeRule(d)}: ${why}` }, unparsed };
     }
-    const store = w.rules(), auto = w.policy.agent_rules === "auto", made = [];
-    for (const d of drafts)
-        made.push(showRule(await store.add(d, "agent", auto)));
+    const store = w.rules(), auto = !o.neverAuto && w.policy.agent_rules === "auto", made = [];
+    for (const d of drafts) {
+        try {
+            made.push(showRule(await store.add(d, "agent", auto)));
+        }
+        catch (e) {
+            return { ok: false, refused: { code: "bad_rule", reason: `${describeRule(d)}: ${e.message}` }, rules: made, unparsed };
+        }
+    }
     return {
         ok: true, rules: made, unparsed,
         note: auto ? "These rules are on. The autopilot runs while the wallet's dashboard or `tollkit-wallet autopilot` is running." : "These rules are waiting for the owner to turn them on in the dashboard (Autopilot tab) or with `tollkit-wallet rule on <id>`.",