3 Commits

Author	SHA1	Message	Date
shinchan-zhai	456570c37c	security: add safe.ReadAllLimited — bound all HTTP response body reads to 10MB ... - Created safe/io.go with ReadAllLimited helper (default 10MB limit) - Replaced 62 unbounded io.ReadAll(resp.Body) calls across 32 files - Covers all exchange traders (Hyperliquid, Bybit, Binance, OKX, Aster, KuCoin, Gate, Bitget, Lighter, Indodax), providers (CoinAnk, Alpaca, TwelveData), MCP client/x402, market data, wallet, telegram, kernel - Prevents OOM from malicious/buggy exchange API responses - Previously fixed: brain.go, sentinel.go already had manual LimitReader	2026-03-25 01:05:54 +08:00
Hao Fu	64935b9d47	feat(strategy): Add Hyperliquid coin sources (hyper_all, hyper_main) (#1388) ... Add two new coin source options for Hyperliquid trading: - hyper_all: All available Hyperliquid perpetual coins (229 coins) - hyper_main: Top N coins by 24h volume (default 20) Changes: - Add CoinSourceConfig fields: UseHyperAll, UseHyperMain, HyperMainLimit - Add provider/hyperliquid/coins.go with caching (24h) and volume-based sorting - Add source types 'hyper_all' and 'hyper_main' to GetCandidateCoins() - Support mixing with other sources in 'mixed' mode - Add source tag formatting for UI display This ensures traders using Hyperliquid can select coins that are actually available on the exchange, avoiding 'symbol not found' errors.	2026-02-22 17:03:05 +08:00
tinkle-community	47bff87966	feat: add xyz dex balance calculation, market data providers, and UI improvements ... - Fix xyz dex balance calculation (use marginSummary for isolated margin) - Add Alpaca provider for US stocks market data - Add TwelveData provider for forex & metals market data - Add Hyperliquid kline provider - Centralize API keys in config system - Add builder fee for order routing - Improve chart UI with compact design - Fix position history fee display precision - Add comprehensive balance calculation tests	2025-12-29 22:16:48 +08:00