Conversation
Add optional --strategy-id flag to `order` and `close`. When provided
and non-empty, the plugin pushes an order-level attribution payload to
the OKX backend via `onchainos wallet report-plugin-info` after the
order succeeds.
Payload fields:
wallet, proxyAddress (empty for HL), order_id (HL oid as string),
tx_hashes (empty at submit — backend uses userFillsByTime by oid
to fetch settlement hash + closedPnl + fee), market_id (coin
symbol), asset_id (empty), side (BUY/SELL; for close: the order
direction, not position direction), amount, symbol ("USDC"; the
collateral asset), price (avg fill when available, else limit),
timestamp, strategy_id, plugin_name.
Behavior:
- Omitting --strategy-id (or passing empty) skips reporting entirely.
- Report failures log a Warning to stderr and never affect the trade
result — the order is already acknowledged by HL by the time the
report fires.
- close.rs now also extracts avg_px / oid from the response so the
report payload is complete.
Smoke-tested locally: v2.2.9 onchainos (no report-plugin-info
subcommand) produces the expected non-fatal Warning on stderr while
the order succeeds normally on stdout.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
📋 Phase 3: AI Code Review Report — Score: 92/100
1. Plugin Overview
Summary: A Rust-based plugin for trading perpetuals and spot on Hyperliquid DEX. Provides commands for checking positions/prices, placing market/limit orders with TP/SL brackets, closing positions, depositing USDC from Arbitrum, withdrawing, and transferring between perp/spot accounts. All signing is delegated to onchainos CLI (TEE-based). Target Users: DeFi traders who use Hyperliquid perps and want an agent-friendly CLI interface with structured JSON output for positions, orders, and risk management. 2. Architecture AnalysisComponents: Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Note: Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin executes perpetual/spot trading on Hyperliquid, bridges USDC from Arbitrum, withdraws to Arbitrum, and performs cross-chain swaps via relay.link. It does NOT hold private keys directly — all signing is delegated to onchainos (TEE-based). All write operations are gated by 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — all signing and contract calls are routed through onchainos subprocess invocations. On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantAll private-key operations are delegated to onchainos. The plugin performs ABI encoding and HL action construction client-side (which is expected — it's not a key operation), then hands off to onchainos for signing. HL exchange API submission of signed payloads is per HL protocol, not a chain broadcast. 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
All other static rules (C02-C09, H01-H04, H06-H09, M01, M02, M04-M06, M08, L01, L02) do not match. No hardcoded secrets, no eval/exec, no persistence hooks, no credential access, no obfuscation, no DAN/jailbreak, no Base64 payloads, no HTML comments with shell commands. LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)No toxic flows detected. TF006 does not apply because M07 is not triggered (data boundary is declared). Prompt Injection ScanNo injection patterns found. No Result: ✅ Clean Dangerous Operations CheckThe plugin handles transfers, signing, contract calls, and transaction broadcasting. Every write operation requires Result: ✅ Safe Data Exfiltration RiskNo suspicious outbound traffic. Data reports go only to Hyperliquid API (expected) and the auto-injected CI stats endpoints (skipped per instructions). Strategy attribution via Result: ✅ No Risk Overall Security Rating: 🟢 Low Risk6. Source Code SecurityLanguage & Build ConfigRust, entry point Dependency Analysis
All dependencies are well-maintained, widely used, and pinned via Cargo.lock. No suspicious crates. Code Safety Audit
Subprocess invocations: Manual ABI encoding (deposit.rs) is reviewed: correct Keccak256 selector derivation, proper padding, uses One minor observation: in Does SKILL.md accurately describe what the source code does?Yes. Every documented command maps to a corresponding handler in Verdict: ✅ Source Safe7. Code ReviewQuality Score: 92/100
Strengths
Issues Found
8. SUMMARY.md Review
Sections are present but not numbered. Content is well-structured and concise. 10. Recommendations
11. Reviewer SummaryOne-line verdict: Well-structured Rust plugin for Hyperliquid perps trading with strong security posture — all signing delegated to onchainos TEE, all writes gated by Merge recommendation: ✅ Ready to merge Minor non-blocking suggestions: verify Generated by Claude AI via Anthropic API — review the full report before approving. |
2 participants
Summary
Add optional
--strategy-idflag toorderandclosecommands. When provided and non-empty, the plugin pushes an order-level attribution payload to the OKX backend viaonchainos wallet report-plugin-infoafter the order succeeds. Mirrors the attribution change just landed in polymarket-plugin (#324) so the OKX backend receives a uniform schema across prediction-market and perp plugins.Payload shape
{ "wallet": "0x... (EOA)", "proxyAddress": "", "order_id": "<HL oid as string>", "tx_hashes": [], "market_id": "BTC / ETH / etc (coin symbol)", "asset_id": "", "side": "BUY | SELL", "amount": "<size in base units>", "symbol": "USDC", "price": "<avg fill when available, else limit>", "timestamp": 1776856156, "strategy_id": "<user-provided>", "plugin_name": "hyperliquid-plugin" }proxyAddressis always empty for HL (no proxy concept).tx_hashesis always empty at submit time — the on-chain settlementhashis available later via/info userFillsByTimekeyed byoid, which is the backend's normal verification path.Behavior
--strategy-id(or passing"") skips reporting entirely. No change to default command behavior.onchainos wallet report-plugin-infofails (subcommand not installed, backend unreachable, error response), the plugin logs aWarningto stderr and returns the normal order-success JSON on stdout. The order is already acknowledged by HL by the time the report fires — reporting failures must never affect trade results.close,sideis the order direction, not the position direction. Closing a long →SELL; closing a short →BUY.Files changed (8 files, +122 / −11)
src/onchainos.rs— newreport_plugin_info()wrapper (syncstd::process::Command, chain 42161). +27src/commands/order.rs—OrderArgsgains--strategy-id; payload constructed + reported afterresultis extracted. +34src/commands/close.rs—CloseArgsgains--strategy-id; now also extractsavg_px/oidfrom the response (previously unused); payload + report. +44SKILL.md—orderandclosesections document--strategy-idsemantics; CHANGELOG v0.3.8 entry; version refs bumped (5 places). +20 / −9plugin.yaml/Cargo.toml/.claude-plugin/plugin.json— 0.3.7 → 0.3.8Test plan
cargo build --release— cleanhyperliquid order --help/close --helpboth show--strategy-id--strategy-idbehaves unchanged (no report, no warning)--strategy-id— order succeeds, report code path verified via the expected stderr Warning when run against onchainos v2.2.9 (which does not have thereport-plugin-infosubcommand). Order returnedoid: 392545390502,avg_px: 78083.0; stdout JSON unchanged.