feat(hyperliquid): add quickstart command with guided onboarding (v0.3.6)#6
feat(hyperliquid): add quickstart command with guided onboarding (v0.3.6)#6GeoGu360 wants to merge 1 commit intomig-pre:testfrom
Conversation
…3.6) - New `quickstart` subcommand: checks ARB USDC + HL perp account in parallel - Detects 5 states: active/ready/needs_deposit/low_balance/no_funds - Emits `about` (one-liner description) and `onboarding_steps` with wallet address embedded for new-user cases - Output matches gmx-v2 quickstart pattern for consistency - Also includes accumulated fixes since v0.3.4: cancel, close, deposit, evm_send, get_gas, order, spot_cancel, spot_order, tpsl improvements Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Resubmitting to okx/plugin-store instead |
❌ Phase 1: Structure Validation — FAILED→ Please fix the errors above and push again. |
📋 Phase 3: AI Code Review Report — Score: 88/100
1. Plugin Overview
Summary: A Rust CLI binary providing Hyperliquid DEX integration — check perp positions, place market/limit orders with TP/SL brackets, manage spot trades, deposit USDC from Arbitrum via bridge, withdraw to Arbitrum, and transfer between perp/spot accounts. All write operations require Target Users: Crypto traders who want to trade perpetual futures on Hyperliquid L1 via AI agents with leverage up to 100x, using an onchainos-managed wallet. 2. Architecture AnalysisComponents:
Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
All onchainos commands are validated to exist in the provided source code. Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin can: read wallet addresses and balances; construct and sign perpetual futures orders (with leverage up to 100x); open/close positions; set TP/SL; cancel orders; deposit USDC from Arbitrum via bridge; withdraw USDC back to Arbitrum; transfer funds between perp and spot accounts; swap USDC for HYPE gas via relay.link; and send USDC from HyperCore to HyperEVM. All signing is delegated to onchainos (TEE). All write operations are gated by explicit 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — all signing and EVM contract calls are routed through onchainos. On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries DetectedNo direct web3 libraries (no ethers/web3). Uses raw JSON-RPC via reqwest for read-only queries. All signing delegated to onchainos. Verdict: ✅ Fully CompliantAll write operations that require private keys delegate to onchainos. The plugin only constructs unsigned payloads, lets onchainos sign, then forwards the signed result to Hyperliquid's exchange REST API (which is the expected flow for HL since it's not a standard EVM chain). 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
No CRITICAL or HIGH rules matched in the developer-submitted content. LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)No toxic flows detected. The auto-injected curl|sh in the Pre-flight block (per review instructions, must be skipped) is not combined with user-submitted financial actions in a way that creates a TF005 risk, because the developer-submitted code uses onchainos for signing (no custom financial signing path vulnerable to script substitution). Prompt Injection ScanNo instruction override, identity manipulation, hidden behavior, confirmation bypass attempts, base64-encoded payloads, or invisible characters detected. The document contains clear, legitimate trading instructions with proper risk warnings. Result: ✅ Clean Dangerous Operations CheckThe plugin performs: transfers (deposit/withdraw/transfer), signing (all write ops), contract calls (deposit, get-gas, evm-send), and HL exchange submissions (orders, cancels, close, tpsl). All are gated by explicit Result: ✅ Safe Data Exfiltration RiskNo environment variable extraction, no reads from sensitive paths (~/.ssh, ~/.aws, ~/.env), no base64-encoded command substitution, no backtick injection. External API calls are all to declared endpoints for documented trading purposes. Result: ✅ No Risk Overall Security Rating: 🟢 Low Risk(Low from a supply-chain/prompt-injection perspective. Inherent financial risk remains HIGH for users due to perpetuals trading — but this is properly disclosed.) 6. Source Code SecurityLanguage & Build Config
Dependency Analysis
All dependencies are well-known, actively maintained crates with no known security issues. Minimal dep tree. Code Safety Audit
Does SKILL.md accurately describe what the source code does?Yes. All 19 subcommands documented in SKILL.md map directly to the source code. Signing flow (onchainos → EIP-712 → HL exchange) is accurately described. Withdrawal fee ($1 USDC) is documented and enforced in withdraw.rs. Chain IDs match (999, 42161). Verdict: ✅ Source Safe7. Code ReviewQuality Score: 88/100
Strengths
Issues Found
8. Language Check
Both files are primarily in English. Chinese content appears only in trigger phrase mappings (acceptable pattern for internationalization). 9. Recommendations
10. Reviewer SummaryOne-line verdict: Well-architected Hyperliquid DEX plugin with strong security controls — all signing delegated to onchainos, all write ops confirmation-gated, clear data boundaries, and accurate documentation. Merge recommendation: ✅ Ready to merge The plugin correctly uses onchainos for all signing operations, gates every write with Generated by Claude AI via Anthropic API — review the full report before approving. |
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
… validation Balance pre-checks (all 8 write commands): - Added erc20_balance_of() to onchainos.rs — direct eth_call balanceOf, avoids SDK round-trip - Each command checks wallet balance against required amount before calling Pendle SDK - redeem-py checks both PT and YT balances independently - Guard skips during --dry-run (offline mode); active for preview and --confirm SDK calldata validation (api.rs): - validate_sdk_calldata() called inside extract_sdk_calldata() on every write path - Rejects calldata shorter than 4 bytes or containing non-hex characters - Rejects router_to addresses not in Pendle Router v3 / known aggregator whitelist - Rejects selectors matching ERC-20/ERC-721 drain operations (transfer, transferFrom, approve, setApprovalForAll, safeTransferFrom) Addresses Phase 3 AI Code Review recommendations #1 and #6. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 participant
Summary
quickstartsubcommand — checks Arbitrum USDC balance + Hyperliquid perp account in parallel, then guides the user to their next actionactive/ready/needs_deposit/low_balance/no_fundsaboutfield (one-liner about Hyperliquid) andonboarding_steps[]with wallet address embedded for new-user casesgmx-v2 quickstartfor consistencyChanges
src/commands/quickstart.rs— new commandsrc/commands/mod.rs+src/main.rs— wire up Quickstart subcommandSKILL.md— document new commandplugin.yaml/Cargo.toml/.claude-plugin/plugin.json— version bump to 0.3.6Test plan
hyperliquid quickstartwith funded HL account → status: active/readyhyperliquid quickstartwith ARB USDC only → status: needs_deposit, shows deposit commandhyperliquid quickstartwith no funds → status: no_funds, shows wallet address in onboarding_stepsaboutfield present in all casesonboarding_stepsomitted for active case🤖 Generated with Claude Code