chore: simplify PR template (OpenClaw-style)

The pr-template-suggester workflow was triggered on opened/edited/synchronize
events and forcefully replaced the PR body with a template when body < 100 chars.
This caused user-written descriptions to be overwritten.

Replace with a lightweight labeler (OpenClaw-style) that:
- Only adds labels (backend/frontend/docs, size: XS/S/M/L/XL)
- Never modifies the PR body
- Simplified unified PR template at .github/pull_request_template.md

.env.example

@@ -52,10 +52,6 @@ TRANSPORT_ENCRYPTION=false
 # Optional: External Services
 # ===========================================
 
-# Telegram notifications (optional)
-# TELEGRAM_BOT_TOKEN=your-bot-token
-# TELEGRAM_CHAT_ID=your-chat-id
-
 DB_TYPE=postgres
 DB_HOST=10.
 DB_PORT=5432

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,100 +1,50 @@
-# Pull Request
+## Summary
 
-> **📋 Choose Specialized Template**
->
-> We now offer specialized templates for different types of PRs to help you fill out the information faster:
->
-> - 🔧 **[Backend PR Template](./PULL_REQUEST_TEMPLATE/backend.md)** - For Go/API/Trading changes
-> - 🎨 **[Frontend PR Template](./PULL_REQUEST_TEMPLATE/frontend.md)** - For UI/UX changes
-> - 📝 **[Documentation PR Template](./PULL_REQUEST_TEMPLATE/docs.md)** - For documentation updates
-> - 📦 **[General PR Template](./PULL_REQUEST_TEMPLATE/general.md)** - For mixed or other changes
->
-> **How to use?**
-> - When creating a PR, add `?template=backend.md` or other template name to the URL
-> - Or simply copy and paste the content from the corresponding template
+- Problem:
+- What changed:
+- What did NOT change (scope boundary):
 
----
+## Change Type
 
-> **💡 Tip:** Recommended PR title format `type(scope): description`
-> Example: `feat(trader): add new strategy` | `fix(api): resolve auth issue`
+- [ ] Bug fix
+- [ ] Feature
+- [ ] Refactoring
+- [ ] Docs
+- [ ] Security fix
+- [ ] Chore / infra
 
----
+## Scope
 
-## 📝 Description
+- [ ] Trading engine / strategies
+- [ ] MCP / AI clients
+- [ ] API / server
+- [ ] Telegram bot / agent
+- [ ] Web UI / frontend
+- [ ] Config / deployment
+- [ ] CI/CD / infra
 
-<!-- Describe your changes in detail -->
-
-
----
-
-## 🎯 Type of Change
-
-- [ ] 🐛 Bug fix
-- [ ] ✨ New feature
-- [ ] 💥 Breaking change
-- [ ] 📝 Documentation update
-- [ ] 🎨 Code style update
-- [ ] ♻️ Refactoring
-- [ ] ⚡ Performance improvement
-- [ ] ✅ Test update
-- [ ] 🔧 Build/config change
-- [ ] 🔒 Security fix
-
----
-
-## 🔗 Related Issues
+## Linked Issues
 
 - Closes #
-- Related to #
+- Related #
 
----
+## Testing
 
-## 📋 Changes Made
+What you verified and how:
 
-<!-- List the specific changes made -->
--
--
+- [ ] `go build ./...` passes
+- [ ] `go test ./...` passes
+- [ ] Manual testing done (describe below)
 
----
+## Security Impact
 
-## 🧪 Testing
+- Secrets/keys handling changed? (`Yes/No`)
+- New/changed API endpoints? (`Yes/No`)
+- User input validation affected? (`Yes/No`)
 
-- [ ] Tested locally
-- [ ] Tests pass
-- [ ] Verified no existing functionality broke
+## Compatibility
 
----
-
-## ✅ Checklist
-
-### Code Quality
-- [ ] Code follows project style
-- [ ] Self-review completed
-- [ ] Comments added for complex logic
-
-### Documentation
-- [ ] Updated relevant documentation
-
-### Git
-- [ ] Commits follow conventional format
-- [ ] Rebased on latest `dev` branch
-- [ ] No merge conflicts
-
----
-
-## 📚 Additional Notes
-
-<!-- Any additional information or context -->
-
-
----
-
-**By submitting this PR, I confirm:**
-
-- [ ] I have read the [Contributing Guidelines](../CONTRIBUTING.md)
-- [ ] I agree to the [Code of Conduct](../CODE_OF_CONDUCT.md)
-- [ ] My contribution is licensed under AGPL-3.0
-
----
-
-🌟 **Thank you for your contribution!**
+- Backward compatible? (`Yes/No`)
+- Config/env changes? (`Yes/No`)
+- Migration needed? (`Yes/No`)
+- If yes, upgrade steps:

.github/workflows/pr-template-suggester.yml

@@ -1,22 +1,18 @@
-name: PR Template Suggester
+name: PR Labeler
 
 on:
   pull_request:
-    types: [opened, edited, synchronize]
+    types: [opened, synchronize, reopened]
 
 permissions:
   pull-requests: write
-  issues: write
   contents: read
 
 jobs:
-  suggest-template:
+  label-pr:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Analyze PR files and auto-apply template
+      - name: Analyze PR and apply labels
         uses: actions/github-script@v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -25,166 +21,72 @@ jobs:
               owner: context.repo.owner,
               repo: context.repo.repo,
               pull_number: context.issue.number,
+              per_page: 100,
             });
 
             let goFiles = 0, jsFiles = 0, tsFiles = 0, mdFiles = 0, otherFiles = 0;
+            let additions = 0, deletions = 0;
 
             for (const file of files) {
-              const filename = file.filename.toLowerCase();
-              if (filename.endsWith('.go')) goFiles++;
-              else if (filename.endsWith('.js') || filename.endsWith('.jsx')) jsFiles++;
-              else if (filename.endsWith('.ts') || filename.endsWith('.tsx') || filename.endsWith('.vue')) tsFiles++;
-              else if (filename.endsWith('.md')) mdFiles++;
+              const name = file.filename.toLowerCase();
+              additions += file.additions || 0;
+              deletions += file.deletions || 0;
+              if (name.endsWith('.go')) goFiles++;
+              else if (name.endsWith('.js') || name.endsWith('.jsx')) jsFiles++;
+              else if (name.endsWith('.ts') || name.endsWith('.tsx') || name.endsWith('.vue')) tsFiles++;
+              else if (name.endsWith('.md')) mdFiles++;
               else otherFiles++;
             }
 
             const totalFiles = goFiles + jsFiles + tsFiles + mdFiles + otherFiles;
-            if (totalFiles === 0) { console.log('No files changed'); return; }
+            if (totalFiles === 0) return;
 
-            let suggestedTemplate = null, templateEmoji = '', templateLabel = '';
+            // --- Scope label ---
+            const labels = [];
+            if (goFiles / totalFiles > 0.5) labels.push('backend');
+            else if ((jsFiles + tsFiles) / totalFiles > 0.5) labels.push('frontend');
+            else if (mdFiles / totalFiles > 0.7) labels.push('documentation');
+            else labels.push('fullstack');
 
-            if (goFiles / totalFiles > 0.5) {
-              suggestedTemplate = 'backend'; templateEmoji = '🔧'; templateLabel = 'backend';
-            } else if ((jsFiles + tsFiles) / totalFiles > 0.5) {
-              suggestedTemplate = 'frontend'; templateEmoji = '🎨'; templateLabel = 'frontend';
-            } else if (mdFiles / totalFiles > 0.7) {
-              suggestedTemplate = 'docs'; templateEmoji = '📝'; templateLabel = 'documentation';
+            // --- Size label (like OpenClaw) ---
+            const totalChanged = additions + deletions;
+            const sizeLabels = ['size: XS', 'size: S', 'size: M', 'size: L', 'size: XL'];
+            let sizeLabel = 'size: XL';
+            if (totalChanged < 50) sizeLabel = 'size: XS';
+            else if (totalChanged < 200) sizeLabel = 'size: S';
+            else if (totalChanged < 500) sizeLabel = 'size: M';
+            else if (totalChanged < 1000) sizeLabel = 'size: L';
+            labels.push(sizeLabel);
+
+            // Ensure size labels exist
+            for (const sl of sizeLabels) {
+              try {
+                await github.rest.issues.getLabel({ owner: context.repo.owner, repo: context.repo.repo, name: sl });
+              } catch (e) {
+                if (e.status === 404) {
+                  await github.rest.issues.createLabel({ owner: context.repo.owner, repo: context.repo.repo, name: sl, color: 'b76e79' });
+                }
+              }
             }
 
-            const { data: pr } = await github.rest.pulls.get({
+            // Remove stale size labels
+            const { data: currentLabels } = await github.rest.issues.listLabelsOnIssue({
+              owner: context.repo.owner, repo: context.repo.repo, issue_number: context.issue.number,
+            });
+            for (const cl of currentLabels) {
+              if (sizeLabels.includes(cl.name) && cl.name !== sizeLabel) {
+                await github.rest.issues.removeLabel({
+                  owner: context.repo.owner, repo: context.repo.repo, issue_number: context.issue.number, name: cl.name,
+                }).catch(() => {});
+              }
+            }
+
+            // Apply labels
+            await github.rest.issues.addLabels({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              pull_number: context.issue.number,
+              issue_number: context.issue.number,
+              labels: labels,
             });
 
-            const prBody = pr.body || '';
-            const usesBackendTemplate = prBody.includes('Pull Request - Backend');
-            const usesFrontendTemplate = prBody.includes('Pull Request - Frontend');
-            const usesDocsTemplate = prBody.includes('Pull Request - Documentation');
-            const usesGeneralTemplate = prBody.includes('Pull Request - General');
-            const usingDefaultTemplate = !usesBackendTemplate && !usesFrontendTemplate && !usesDocsTemplate && !usesGeneralTemplate;
-
-            if (templateLabel) {
-              try {
-                await github.rest.issues.addLabels({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: context.issue.number,
-                  labels: [templateLabel]
-                });
-                console.log('Added label: ' + templateLabel);
-              } catch (error) {
-                console.log('Label might not exist, skipping...');
-              }
-            }
-
-            function isPRBodyEmpty(body) {
-              if (!body || body.trim().length < 100) return true;
-              const hasEmptyDescription = body.includes('**English:**') && body.match(/\*\*English:\*\*\s*\n\s*\n\s*\n/);
-              const hasEmptyChanges = body.includes('具体变更') && body.match(/\*\*中文：\*\*\s*\n\s*-\s*\n\s*-\s*\n/);
-              if (hasEmptyDescription || hasEmptyChanges) return true;
-              const descMatch = body.match(/\*\*English:\*\*[｜|]\s*\*\*中文：\*\*\s*\n\s*(.+)/);
-              if (!descMatch || descMatch[1].trim().length < 10) return true;
-              return false;
-            }
-
-            if (suggestedTemplate && usingDefaultTemplate) {
-              const shouldAutoApply = isPRBodyEmpty(prBody);
-              const templatePath = '.github/PULL_REQUEST_TEMPLATE/' + suggestedTemplate + '.md';
-
-              if (shouldAutoApply) {
-                try {
-                  const { data: templateFile } = await github.rest.repos.getContent({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    path: templatePath,
-                    ref: context.payload.pull_request.head.ref
-                  });
-
-                  const templateContent = Buffer.from(templateFile.content, 'base64').toString('utf-8');
-
-                  await github.rest.pulls.update({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    pull_number: context.issue.number,
-                    body: templateContent
-                  });
-
-                  console.log('Auto-applied ' + suggestedTemplate + ' template');
-
-                  let fileStats = [];
-                  if (goFiles > 0) fileStats.push('- 🔧 Go files: ' + goFiles);
-                  if (jsFiles > 0) fileStats.push('- 🎨 JavaScript files: ' + jsFiles);
-                  if (tsFiles > 0) fileStats.push('- 🎨 TypeScript files: ' + tsFiles);
-                  if (mdFiles > 0) fileStats.push('- 📝 Markdown files: ' + mdFiles);
-                  if (otherFiles > 0) fileStats.push('- 📦 Other files: ' + otherFiles);
-                  const fileStatsText = fileStats.join('\n');
-
-                  const notifyComment = '## ' + templateEmoji + ' 已自动应用专用模板 | Auto-Applied Template\n\n' +
-                    '检测到您的PR主要包含 **' + suggestedTemplate + '** 相关的变更，系统已自动为您应用相应的模板。\n\n' +
-                    'Detected that your PR primarily contains **' + suggestedTemplate + '** changes. The appropriate template has been automatically applied.\n\n' +
-                    '**文件统计 | File Statistics**\n' + fileStatsText + '\n\n' +
-                    '**已应用模板 | Applied Template**\n`' + templatePath + '`\n\n' +
-                    '✨ 您现在可以直接在PR描述中填写相关信息了！\n\n' +
-                    '✨ You can now fill in the relevant information in the PR description!';
-
-                  await github.rest.issues.createComment({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    issue_number: context.issue.number,
-                    body: notifyComment
-                  });
-
-                } catch (error) {
-                  console.log('Failed to fetch or apply template: ' + error.message);
-                  const templateUrl = 'https://raw.githubusercontent.com/' + context.repo.owner + '/' + context.repo.repo + '/dev/.github/PULL_REQUEST_TEMPLATE/' + suggestedTemplate + '.md';
-                  const fallbackComment = '## ' + templateEmoji + ' 建议使用专用模板 | Suggested Template\n\n' +
-                    '您的PR主要包含 **' + suggestedTemplate + '** 相关的变更。\n\n' +
-                    '**推荐模板 | Recommended Template:** `.github/PULL_REQUEST_TEMPLATE/' + suggestedTemplate + '.md`\n\n' +
-                    '**如何使用 | How to use:** [点击查看模板内容](' + templateUrl + ')';
-
-                  await github.rest.issues.createComment({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    issue_number: context.issue.number,
-                    body: fallbackComment
-                  });
-                }
-              } else {
-                console.log('PR body has content, sending suggestion only');
-
-                let fileStats = [];
-                if (goFiles > 0) fileStats.push('- 🔧 Go files: ' + goFiles);
-                if (jsFiles > 0) fileStats.push('- 🎨 JavaScript files: ' + jsFiles);
-                if (tsFiles > 0) fileStats.push('- 🎨 TypeScript files: ' + tsFiles);
-                if (mdFiles > 0) fileStats.push('- 📝 Markdown files: ' + mdFiles);
-                if (otherFiles > 0) fileStats.push('- 📦 Other files: ' + otherFiles);
-                const fileStatsText = fileStats.join('\n');
-
-                const templateUrl = 'https://raw.githubusercontent.com/' + context.repo.owner + '/' + context.repo.repo + '/dev/.github/PULL_REQUEST_TEMPLATE/' + suggestedTemplate + '.md';
-
-                const comment = '## ' + templateEmoji + ' 建议使用专用模板 | Suggested Template\n\n' +
-                  '您的PR主要包含 **' + suggestedTemplate + '** 相关的变更。我们建议使用更适合的模板以简化填写。\n\n' +
-                  'Your PR primarily contains **' + suggestedTemplate + '** changes. We suggest using a more suitable template to simplify filling.\n\n' +
-                  '**文件统计 | File Statistics**\n' + fileStatsText + '\n\n' +
-                  '**推荐模板 | Recommended Template**\n```\n.github/PULL_REQUEST_TEMPLATE/' + suggestedTemplate + '.md\n```\n\n' +
-                  '**如何使用 | How to use**\n' +
-                  '1. 编辑PR描述 | Edit PR description\n' +
-                  '2. 复制 [' + suggestedTemplate + ' 模板内容](' + templateUrl + ') | Copy [' + suggestedTemplate + ' template content](' + templateUrl + ')\n' +
-                  '3. 或在创建PR时使用URL参数 | Or use URL parameter when creating PR\n' +
-                  '   `?template=' + suggestedTemplate + '.md`\n\n' +
-                  '_这是一个自动建议，您可以继续使用当前模板。_\n\n' +
-                  '_This is an automated suggestion. You may continue using the current template._';
-
-                await github.rest.issues.createComment({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  issue_number: context.issue.number,
-                  body: comment
-                });
-              }
-            } else if (suggestedTemplate && !usingDefaultTemplate) {
-              console.log('PR already uses a specific template');
-            } else {
-              console.log('No specific template suggestion needed - mixed changes');
-            }
+            console.log(`Applied labels: ${labels.join(', ')} (${totalChanged} lines changed)`);

.gitignore

@@ -16,6 +16,7 @@ nofx_test
 # Go 相关
 *.test
 *.out
+.gocache/
 
 # 操作系统
 .DS_Store

api/backtest.go

@@ -832,6 +832,8 @@ func (s *Server) hydrateBacktestAIConfig(cfg *backtest.BacktestConfig) error {
 			provider = "google"
 		} else if strings.Contains(modelNameLower, "deepseek") {
 			provider = "deepseek"
+		} else if strings.Contains(modelNameLower, "minimax") {
+			provider = "minimax"
 		} else if model.CustomAPIURL != "" {
 			provider = "custom"
 		} else {

api/register_otp_test.go

@@ -1,252 +0,0 @@
-package api
-
-import (
-	"testing"
-)
-
-// MockUser Mock user structure
-type MockUser struct {
-	ID          int
-	Email       string
-	OTPSecret   string
-	OTPVerified bool
-}
-
-// TestOTPRefetchLogic Test OTP refetch logic
-func TestOTPRefetchLogic(t *testing.T) {
-	tests := []struct {
-		name            string
-		existingUser    *MockUser
-		userExists      bool
-		expectedAction  string // "allow_refetch", "reject_duplicate", "create_new"
-		expectedMessage string
-	}{
-		{
-			name:            "New user registration - email does not exist",
-			existingUser:    nil,
-			userExists:      false,
-			expectedAction:  "create_new",
-			expectedMessage: "Create new user",
-		},
-		{
-			name: "Incomplete OTP verification - allow refetch",
-			existingUser: &MockUser{
-				ID:          1,
-				Email:       "test@example.com",
-				OTPSecret:   "SECRET123",
-				OTPVerified: false,
-			},
-			userExists:      true,
-			expectedAction:  "allow_refetch",
-			expectedMessage: "Incomplete registration detected, please continue OTP setup",
-		},
-		{
-			name: "Completed OTP verification - reject duplicate registration",
-			existingUser: &MockUser{
-				ID:          2,
-				Email:       "verified@example.com",
-				OTPSecret:   "SECRET456",
-				OTPVerified: true,
-			},
-			userExists:      true,
-			expectedAction:  "reject_duplicate",
-			expectedMessage: "Email already registered",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Simulate logic processing flow
-			var actualAction string
-			var actualMessage string
-
-			if !tt.userExists {
-				// User does not exist, create new user
-				actualAction = "create_new"
-				actualMessage = "Create new user"
-			} else {
-				// User exists, check OTP verification status
-				if !tt.existingUser.OTPVerified {
-					// OTP verification incomplete, allow refetch
-					actualAction = "allow_refetch"
-					actualMessage = "Incomplete registration detected, please continue OTP setup"
-				} else {
-					// Verification completed, reject duplicate registration
-					actualAction = "reject_duplicate"
-					actualMessage = "Email already registered"
-				}
-			}
-
-			// Verify results
-			if actualAction != tt.expectedAction {
-				t.Errorf("Action mismatch: got %s, want %s", actualAction, tt.expectedAction)
-			}
-			if actualMessage != tt.expectedMessage {
-				t.Errorf("Message mismatch: got %s, want %s", actualMessage, tt.expectedMessage)
-			}
-		})
-	}
-}
-
-// TestOTPVerificationStates Test OTP verification state determination
-func TestOTPVerificationStates(t *testing.T) {
-	tests := []struct {
-		name               string
-		otpVerified        bool
-		shouldAllowRefetch bool
-	}{
-		{
-			name:               "OTP verified - disallow refetch",
-			otpVerified:        true,
-			shouldAllowRefetch: false,
-		},
-		{
-			name:               "OTP not verified - allow refetch",
-			otpVerified:        false,
-			shouldAllowRefetch: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Simulate verification logic
-			allowRefetch := !tt.otpVerified
-
-			if allowRefetch != tt.shouldAllowRefetch {
-				t.Errorf("Refetch logic error: OTPVerified=%v, allowRefetch=%v, expected=%v",
-					tt.otpVerified, allowRefetch, tt.shouldAllowRefetch)
-			}
-		})
-	}
-}
-
-// TestRegistrationFlow Test complete registration flow logic branches
-func TestRegistrationFlow(t *testing.T) {
-	tests := []struct {
-		name           string
-		scenario       string
-		userExists     bool
-		otpVerified    bool
-		expectHTTPCode int // Simulated HTTP status code
-		expectResponse string
-	}{
-		{
-			name:           "Scenario 1: New user first registration",
-			scenario:       "New user first accesses registration endpoint",
-			userExists:     false,
-			otpVerified:    false,
-			expectHTTPCode: 200,
-			expectResponse: "Create user and return OTP setup information",
-		},
-		{
-			name:           "Scenario 2: User re-accesses after interrupting registration",
-			scenario:       "User registered previously but did not complete OTP setup, now re-accessing",
-			userExists:     true,
-			otpVerified:    false,
-			expectHTTPCode: 200,
-			expectResponse: "Return existing user's OTP information, allow continuation",
-		},
-		{
-			name:           "Scenario 3: Registered user attempts duplicate registration",
-			scenario:       "User already completed registration, attempts to register again with same email",
-			userExists:     true,
-			otpVerified:    true,
-			expectHTTPCode: 409, // Conflict
-			expectResponse: "Email already registered",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Simulate registration flow logic
-			var actualHTTPCode int
-			var actualResponse string
-
-			if !tt.userExists {
-				// New user, create and return OTP information
-				actualHTTPCode = 200
-				actualResponse = "Create user and return OTP setup information"
-			} else {
-				// User exists
-				if !tt.otpVerified {
-					// OTP verification incomplete, allow refetch
-					actualHTTPCode = 200
-					actualResponse = "Return existing user's OTP information, allow continuation"
-				} else {
-					// Verification completed, reject duplicate registration
-					actualHTTPCode = 409
-					actualResponse = "Email already registered"
-				}
-			}
-
-			// Verify
-			if actualHTTPCode != tt.expectHTTPCode {
-				t.Errorf("HTTP code mismatch: got %d, want %d (scenario: %s)",
-					actualHTTPCode, tt.expectHTTPCode, tt.scenario)
-			}
-			if actualResponse != tt.expectResponse {
-				t.Errorf("Response mismatch: got %s, want %s (scenario: %s)",
-					actualResponse, tt.expectResponse, tt.scenario)
-			}
-
-			t.Logf("✓ %s: HTTP %d, %s", tt.scenario, actualHTTPCode, actualResponse)
-		})
-	}
-}
-
-// TestEdgeCases Test edge cases
-func TestEdgeCases(t *testing.T) {
-	tests := []struct {
-		name        string
-		user        *MockUser
-		expectAllow bool
-		description string
-	}{
-		{
-			name: "User ID is 0 - treated as new user",
-			user: &MockUser{
-				ID:          0,
-				Email:       "new@example.com",
-				OTPVerified: false,
-			},
-			expectAllow: true,
-			description: "ID of 0 usually indicates user has not been created yet",
-		},
-		{
-			name: "OTPSecret is empty - still can refetch",
-			user: &MockUser{
-				ID:          1,
-				Email:       "test@example.com",
-				OTPSecret:   "",
-				OTPVerified: false,
-			},
-			expectAllow: true,
-			description: "Even if OTPSecret is empty, as long as not verified, refetch is allowed",
-		},
-		{
-			name: "OTPSecret exists but already verified - not allowed",
-			user: &MockUser{
-				ID:          2,
-				Email:       "verified@example.com",
-				OTPSecret:   "SECRET789",
-				OTPVerified: true,
-			},
-			expectAllow: false,
-			description: "Users with verified OTP cannot refetch",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Core logic: as long as OTPVerified is false, refetch is allowed
-			allowRefetch := !tt.user.OTPVerified
-
-			if allowRefetch != tt.expectAllow {
-				t.Errorf("Edge case failed: %s\nUser: ID=%d, OTPVerified=%v\nExpected allow=%v, got=%v",
-					tt.description, tt.user.ID, tt.user.OTPVerified, tt.expectAllow, allowRefetch)
-			}
-
-			t.Logf("✓ %s", tt.description)
-		})
-	}
-}

api/route_registry.go

@@ -0,0 +1,66 @@
+package api
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+// RouteDoc holds documentation for a single API route.
+type RouteDoc struct {
+	Method      string
+	Path        string
+	Description string
+	Schema      string // optional: full parameter/body schema documentation
+}
+
+// routeRegistry stores all documented routes. Populated via s.route() calls in setupRoutes.
+var routeRegistry []RouteDoc
+
+// route registers an HTTP route with a one-line description.
+func (s *Server) route(g *gin.RouterGroup, method, path, description string, h gin.HandlerFunc) {
+	s.routeWithSchema(g, method, path, description, "", h)
+}
+
+// routeWithSchema registers an HTTP route with full parameter schema documentation.
+// schema is injected verbatim into the API docs seen by the LLM.
+func (s *Server) routeWithSchema(g *gin.RouterGroup, method, path, description, schema string, h gin.HandlerFunc) {
+	fullPath := strings.TrimSuffix(g.BasePath(), "/") + "/" + strings.TrimPrefix(path, "/")
+	routeRegistry = append(routeRegistry, RouteDoc{
+		Method:      method,
+		Path:        fullPath,
+		Description: description,
+		Schema:      schema,
+	})
+	switch method {
+	case "GET":
+		g.GET(path, h)
+	case "POST":
+		g.POST(path, h)
+	case "PUT":
+		g.PUT(path, h)
+	case "DELETE":
+		g.DELETE(path, h)
+	}
+}
+
+// GetAPIDocs returns formatted API documentation for injection into the LLM system prompt.
+// Routes with schema documentation include full parameter details.
+func GetAPIDocs() string {
+	var sb strings.Builder
+	for _, r := range routeRegistry {
+		sb.WriteString(fmt.Sprintf("%-8s %s\n", r.Method, r.Path))
+		sb.WriteString(fmt.Sprintf("         %s\n", r.Description))
+		if r.Schema != "" {
+			// Indent each schema line for readability
+			for _, line := range strings.Split(strings.TrimSpace(r.Schema), "\n") {
+				sb.WriteString("         ")
+				sb.WriteString(line)
+				sb.WriteByte('\n')
+			}
+		}
+		sb.WriteByte('\n')
+	}
+	return sb.String()
+}

api/server.go

@@ -12,6 +12,7 @@ import (
 	"nofx/crypto"
 	"nofx/logger"
 	"nofx/manager"
+	"nofx/security"
 	"nofx/market"
 	"nofx/provider/alpaca"
 	"nofx/provider/coinank/coinank_api"
@@ -39,14 +40,15 @@ import (
 
 // Server HTTP API server
 type Server struct {
-	router          *gin.Engine
-	traderManager   *manager.TraderManager
-	store           *store.Store
-	cryptoHandler   *CryptoHandler
-	backtestManager *backtest.Manager
-	debateHandler   *DebateHandler
-	httpServer      *http.Server
-	port            int
+	router           *gin.Engine
+	traderManager    *manager.TraderManager
+	store            *store.Store
+	cryptoHandler    *CryptoHandler
+	backtestManager  *backtest.Manager
+	debateHandler    *DebateHandler
+	httpServer       *http.Server
+	port             int
+	telegramReloadCh chan<- struct{} // signal Telegram bot to reload
 }
 
 // NewServer Creates API server
@@ -113,109 +115,276 @@ func (s *Server) setupRoutes() {
 		// Admin login (used in admin mode, public)
 
 		// System supported models and exchanges (no authentication required)
-		api.GET("/supported-models", s.handleGetSupportedModels)
-		api.GET("/supported-exchanges", s.handleGetSupportedExchanges)
+		s.route(api, "GET", "/supported-models", "List supported AI model providers", s.handleGetSupportedModels)
+		s.route(api, "GET", "/supported-exchanges", "List supported exchange types", s.handleGetSupportedExchanges)
 
 		// System config (no authentication required, for frontend to determine admin mode/registration status)
-		api.GET("/config", s.handleGetSystemConfig)
+		s.route(api, "GET", "/config", "Get system configuration", s.handleGetSystemConfig)
 
-		// Crypto related endpoints (no authentication required)
+		// Crypto related endpoints (no authentication required, not exposed to bot)
 		api.GET("/crypto/config", s.cryptoHandler.HandleGetCryptoConfig)
 		api.GET("/crypto/public-key", s.cryptoHandler.HandleGetPublicKey)
 		api.POST("/crypto/decrypt", s.cryptoHandler.HandleDecryptSensitiveData)
 
 		// Public competition data (no authentication required)
-		api.GET("/traders", s.handlePublicTraderList)
-		api.GET("/competition", s.handlePublicCompetition)
-		api.GET("/top-traders", s.handleTopTraders)
-		api.GET("/equity-history", s.handleEquityHistory)
-		api.POST("/equity-history-batch", s.handleEquityHistoryBatch)
-		api.GET("/traders/:id/public-config", s.handleGetPublicTraderConfig)
+		s.route(api, "GET", "/traders", "Public trader list", s.handlePublicTraderList)
+		s.route(api, "GET", "/competition", "Public competition data", s.handlePublicCompetition)
+		s.route(api, "GET", "/top-traders", "Top traders leaderboard", s.handleTopTraders)
+		s.route(api, "GET", "/equity-history", "Equity history for a trader", s.handleEquityHistory)
+		s.route(api, "POST", "/equity-history-batch", "Batch equity history for multiple traders", s.handleEquityHistoryBatch)
+		s.route(api, "GET", "/traders/:id/public-config", "Public trader configuration", s.handleGetPublicTraderConfig)
 
 		// Market data (no authentication required)
-		api.GET("/klines", s.handleKlines)
-		api.GET("/symbols", s.handleSymbols)
+		s.route(api, "GET", "/klines", "Candlestick data (?symbol=&interval=&limit=)", s.handleKlines)
+		s.route(api, "GET", "/symbols", "Available trading symbols", s.handleSymbols)
 
 		// Public strategy market (no authentication required)
-		api.GET("/strategies/public", s.handlePublicStrategies)
+		s.route(api, "GET", "/strategies/public", "Public strategy market", s.handlePublicStrategies)
 
 		// Authentication related routes (no authentication required)
-		api.POST("/register", s.handleRegister)
-		api.POST("/login", s.handleLogin)
-		api.POST("/verify-otp", s.handleVerifyOTP)
-		api.POST("/complete-registration", s.handleCompleteRegistration)
+		s.route(api, "POST", "/register", "Register new user", s.handleRegister)
+		s.route(api, "POST", "/login", "User login, returns JWT token", s.handleLogin)
+		s.route(api, "POST", "/reset-password", "Reset password", s.handleResetPassword)
 
 		// Routes requiring authentication
 		protected := api.Group("/", s.authMiddleware())
 		{
 			// Logout (add to blacklist)
-			protected.POST("/logout", s.handleLogout)
+			s.route(protected, "POST", "/logout", "Logout (blacklist token)", s.handleLogout)
+
+			// User account management
+			s.routeWithSchema(protected, "PUT", "/user/password", "Change current user password",
+				`Body: {"new_password":"<string, min 8 chars>"}`,
+				s.handleChangePassword)
 
 			// Server IP query (requires authentication, for whitelist configuration)
-			protected.GET("/server-ip", s.handleGetServerIP)
+			s.route(protected, "GET", "/server-ip", "Get server public IP (for exchange whitelist)", s.handleGetServerIP)
 
 			// AI trader management
-			protected.GET("/my-traders", s.handleTraderList)
-			protected.GET("/traders/:id/config", s.handleGetTraderConfig)
-			protected.POST("/traders", s.handleCreateTrader)
-			protected.PUT("/traders/:id", s.handleUpdateTrader)
-			protected.DELETE("/traders/:id", s.handleDeleteTrader)
-			protected.POST("/traders/:id/start", s.handleStartTrader)
-			protected.POST("/traders/:id/stop", s.handleStopTrader)
-			protected.PUT("/traders/:id/prompt", s.handleUpdateTraderPrompt)
-			protected.POST("/traders/:id/sync-balance", s.handleSyncBalance)
-			protected.POST("/traders/:id/close-position", s.handleClosePosition)
-			protected.PUT("/traders/:id/competition", s.handleToggleCompetition)
-			protected.GET("/traders/:id/grid-risk", s.handleGetGridRiskInfo)
+			s.routeWithSchema(protected, "GET", "/my-traders", "List user's traders with status",
+				`Returns: [{"trader_id":"<EXACT id — use this as trader_id in all ?trader_id= queries and POST /traders/:id/start|stop>","trader_name":"<string>","is_running":<bool>}]
+NOTE: The id field is "trader_id" (NOT "id"). Always read trader_id from this endpoint before querying data.`,
+				s.handleTraderList)
+			s.routeWithSchema(protected, "GET", "/traders/:id/config", "Get full trader configuration",
+				`:id = trader_id from GET /api/my-traders`,
+				s.handleGetTraderConfig)
+			s.routeWithSchema(protected, "POST", "/traders", "Create a new AI trader",
+				`Body: {"name":"<string, required>","ai_model_id":"<EXACT id field from GET /api/models — e.g. 'abc123_deepseek', NOT the provider name 'deepseek'>","exchange_id":"<EXACT id field from GET /api/exchanges — e.g. '05785d3b-841e-...', NOT the type name>","strategy_id":"<EXACT id field from GET /api/strategies>","scan_interval_minutes":<int, default 3, minimum 3>}
+IMPORTANT: ai_model_id and exchange_id must be the full "id" value from the Account State, not the provider/type name.`,
+				s.handleCreateTrader)
+			s.routeWithSchema(protected, "PUT", "/traders/:id", "Update trader configuration",
+				`:id = trader_id from GET /api/my-traders
+Body: {"name":"<string>","ai_model_id":"<EXACT id from GET /api/models>","exchange_id":"<EXACT id from GET /api/exchanges>","strategy_id":"<EXACT id from GET /api/strategies>","scan_interval_minutes":<int, min 3>,"is_cross_margin":<bool>}
+Only include fields you want to change.`,
+				s.handleUpdateTrader)
+			s.routeWithSchema(protected, "DELETE", "/traders/:id", "Delete trader",
+				`:id = trader_id from GET /api/my-traders. Stops and permanently removes the trader and all its data.`,
+				s.handleDeleteTrader)
+			s.routeWithSchema(protected, "POST", "/traders/:id/start", "Start trader — begins live trading",
+				`:id = trader_id from GET /api/my-traders. No request body needed. The trader must have a valid exchange and AI model configured.`,
+				s.handleStartTrader)
+			s.routeWithSchema(protected, "POST", "/traders/:id/stop", "Stop trader — halts live trading",
+				`:id = trader_id from GET /api/my-traders. No request body needed. Gracefully stops the trading loop.`,
+				s.handleStopTrader)
+			s.routeWithSchema(protected, "PUT", "/traders/:id/prompt", "Override the trader's AI system prompt",
+				`Body: {"prompt":"<string — the full custom prompt text>"}`,
+				s.handleUpdateTraderPrompt)
+			s.routeWithSchema(protected, "POST", "/traders/:id/sync-balance", "Sync account balance from exchange",
+				`:id = trader_id from GET /api/my-traders. No request body needed. Refreshes initial_balance from the exchange.`,
+				s.handleSyncBalance)
+			s.routeWithSchema(protected, "POST", "/traders/:id/close-position", "Force-close an open position",
+				`:id = trader_id from GET /api/my-traders.
+Body: {"symbol":"<string, e.g. BTCUSDT — must match an open position symbol from GET /api/positions>"}`,
+				s.handleClosePosition)
+			s.routeWithSchema(protected, "PUT", "/traders/:id/competition", "Toggle competition leaderboard visibility",
+				`:id = trader_id from GET /api/my-traders.
+Body: {"show_in_competition":<bool>}`,
+				s.handleToggleCompetition)
+			s.routeWithSchema(protected, "GET", "/traders/:id/grid-risk", "Get grid trading risk info",
+				`:id = trader_id from GET /api/my-traders.`,
+				s.handleGetGridRiskInfo)
 
 			// AI model configuration
-			protected.GET("/models", s.handleGetModelConfigs)
-			protected.PUT("/models", s.handleUpdateModelConfigs)
+			s.routeWithSchema(protected, "GET", "/models", "List AI model configs",
+				`Returns: [{"id":"<EXACT id — use this as ai_model_id when creating/updating a trader>","name":"<display name>","provider":"<short provider name — NOT a valid id>","enabled":<bool>}]
+CRITICAL: The "id" field (e.g. "abc123_deepseek") is what you must use for ai_model_id. The "provider" field ("deepseek") is NOT valid as an id.`,
+				s.handleGetModelConfigs)
+			s.routeWithSchema(protected, "PUT", "/models", "Configure an AI model provider",
+				`Body: {"models":{"<model_id>":{"enabled":<bool>,"api_key":"<string>","custom_api_url":"<string, leave empty to use provider default>","custom_model_name":"<string, leave empty to use provider default>"}}}
+model_id values: "openai","deepseek","qwen","kimi","grok","gemini","claude"
+Defaults when custom fields empty: openai→api.openai.com/v1, deepseek→api.deepseek.com, qwen→dashscope.aliyuncs.com/compatible-mode/v1, kimi→api.moonshot.ai/v1, grok→api.x.ai/v1, gemini→generativelanguage.googleapis.com/v1beta/openai, claude→api.anthropic.com/v1`,
+				s.handleUpdateModelConfigs)
 
 			// Exchange configuration
-			protected.GET("/exchanges", s.handleGetExchangeConfigs)
-			protected.POST("/exchanges", s.handleCreateExchange)
-			protected.PUT("/exchanges", s.handleUpdateExchangeConfigs)
-			protected.DELETE("/exchanges/:id", s.handleDeleteExchange)
+			s.routeWithSchema(protected, "GET", "/exchanges", "List exchange accounts",
+				`Returns: [{"id":"<EXACT id — use this as exchange_id when creating/updating a trader>","exchange_type":"<e.g. okx, binance>","account_name":"<user label>","enabled":<bool>}]
+CRITICAL: Always use the "id" field for exchange_id. Do not use "exchange_type" as an id.`,
+				s.handleGetExchangeConfigs)
+			s.routeWithSchema(protected, "POST", "/exchanges", "Create a new exchange account",
+				`Body: {"exchange_type":"<string>","account_name":"<string, user label>","enabled":true,"api_key":"<string>","secret_key":"<string>","passphrase":"<string, required for okx/gate/kucoin>"}
+exchange_type values: "binance","bybit","okx","bitget","gate","kucoin","indodax" (CEX) | "hyperliquid","aster","lighter" (DEX)
+Required fields by exchange:
+  binance/bybit/bitget/indodax: api_key + secret_key
+  okx/gate/kucoin: api_key + secret_key + passphrase
+  hyperliquid: hyperliquid_wallet_addr
+  aster: aster_user + aster_signer + aster_private_key
+  lighter: lighter_wallet_addr + lighter_private_key + lighter_api_key_private_key + lighter_api_key_index`,
+				s.handleCreateExchange)
+			s.routeWithSchema(protected, "PUT", "/exchanges", "Update an existing exchange account configuration",
+				`Body: {"id":"<EXACT id from GET /api/exchanges>","exchange_type":"<string>","account_name":"<string>","enabled":<bool>,"api_key":"<string>","secret_key":"<string>","passphrase":"<string, for okx/gate/kucoin>"}
+Use this to enable/disable an exchange or update API credentials. The "id" field is required to identify which exchange to update.`,
+				s.handleUpdateExchangeConfigs)
+			s.routeWithSchema(protected, "DELETE", "/exchanges/:id", "Delete exchange account",
+				`:id = EXACT id from GET /api/exchanges. Permanently removes the exchange account and disconnects any traders using it.`,
+				s.handleDeleteExchange)
+
+			// Telegram bot configuration
+			s.routeWithSchema(protected, "GET", "/telegram", "Get Telegram bot configuration",
+				`Returns: {"bot_token":"<string>","model_id":"<EXACT id of configured AI model>","chat_id":"<bound Telegram chat id, empty if not bound>"}`,
+				s.handleGetTelegramConfig)
+			s.routeWithSchema(protected, "POST", "/telegram", "Set Telegram bot token and AI model",
+				`Body: {"bot_token":"<string — Telegram BotFather token>","model_id":"<EXACT id from GET /api/models>"}
+Both fields are required. After saving, the user must send /start in Telegram to bind their account.`,
+				s.handleUpdateTelegramConfig)
+			s.routeWithSchema(protected, "POST", "/telegram/model", "Update Telegram bot AI model only",
+				`Body: {"model_id":"<EXACT id from GET /api/models>"}`,
+				s.handleUpdateTelegramModel)
+			s.routeWithSchema(protected, "DELETE", "/telegram/binding", "Unbind Telegram account",
+				`No body needed. Clears the Telegram chat_id binding so the user can re-bind with /start.`,
+				s.handleUnbindTelegram)
 
 			// Strategy management
-			protected.GET("/strategies", s.handleGetStrategies)
-			protected.GET("/strategies/active", s.handleGetActiveStrategy)
-			protected.GET("/strategies/default-config", s.handleGetDefaultStrategyConfig)
-			protected.POST("/strategies/preview-prompt", s.handlePreviewPrompt)
-			protected.POST("/strategies/test-run", s.handleStrategyTestRun)
-			protected.GET("/strategies/:id", s.handleGetStrategy)
-			protected.POST("/strategies", s.handleCreateStrategy)
-			protected.PUT("/strategies/:id", s.handleUpdateStrategy)
-			protected.DELETE("/strategies/:id", s.handleDeleteStrategy)
-			protected.POST("/strategies/:id/activate", s.handleActivateStrategy)
-			protected.POST("/strategies/:id/duplicate", s.handleDuplicateStrategy)
+			s.routeWithSchema(protected, "GET", "/strategies", "List user's strategies",
+				`Returns: [{"id":"<EXACT id — use as strategy_id when creating/updating a trader>","name":"<string>","is_active":<bool>,"is_default":<bool>}]
+CRITICAL: Always use the "id" field for strategy_id.`,
+				s.handleGetStrategies)
+			s.routeWithSchema(protected, "GET", "/strategies/active", "Get the currently active strategy",
+				`Returns the strategy marked is_active=true for this user, or the system default. Use this to find which strategy is currently in use.`,
+				s.handleGetActiveStrategy)
+			s.routeWithSchema(protected, "GET", "/strategies/default-config", "Get default strategy config with all fields and sensible values — use as reference for building configs",
+				`No parameters needed. Returns a complete StrategyConfig object with all fields populated with recommended defaults. Read this before building a custom config.`,
+				s.handleGetDefaultStrategyConfig)
+			s.route(protected, "POST", "/strategies/preview-prompt", "Preview the AI prompt that will be generated from a config", s.handlePreviewPrompt)
+			s.route(protected, "POST", "/strategies/test-run", "Test-run strategy AI analysis", s.handleStrategyTestRun)
+			s.route(protected, "GET", "/strategies/:id", "Get strategy by ID", s.handleGetStrategy)
+			s.routeWithSchema(protected, "POST", "/strategies", "Create a new trading strategy",
+				`Body: {"name":"<string, required>","description":"<string, optional>","lang":"zh|en","config":<StrategyConfig object, OPTIONAL — if omitted the system applies complete working defaults automatically (ai500 top coins, all standard indicators, standard risk control)>}
+IMPORTANT: For most use cases just POST {"name":"<name>"} — the backend fills everything in. Only include "config" when the user explicitly requests custom settings (specific coins, custom leverage, custom timeframes).
+
+StrategyConfig fields:
+  coin_source.source_type: "static"(fixed coin list) | "ai500"(AI top500 ranking) | "oi_top"(OI increasing, suited for long) | "oi_low"(OI decreasing, suited for short) | "mixed"
+  coin_source.static_coins: ["BTCUSDT","ETHUSDT"] — only when source_type="static"
+  coin_source.use_ai500, ai500_limit: number of coins from AI500 pool (default 10)
+  coin_source.use_oi_top/use_oi_low, oi_top_limit/oi_low_limit: OI-based coin selection
+  indicators.klines.primary_timeframe: "1m"|"3m"|"5m"|"15m"|"1h"|"4h" — scalping→"5m", trend/swing→"1h"/"4h"
+  indicators.klines.primary_count: number of candles (20-100)
+  indicators.klines.enable_multi_timeframe: true for trend/swing analysis
+  indicators.klines.selected_timeframes: e.g. ["5m","15m","1h","4h"]
+  indicators.enable_raw_klines: ALWAYS true (raw OHLCV required)
+  indicators.enable_ema: true for trend-following (EMA crossover signals)
+  indicators.enable_macd: true for trend + momentum confirmation
+  indicators.enable_rsi: true for overbought/oversold, divergence detection
+  indicators.enable_boll: true for volatility, range trading, breakout strategies
+  indicators.enable_atr: true for volatility measurement and stop-loss sizing
+  indicators.enable_volume: ALWAYS true
+  indicators.enable_oi: ALWAYS true (open interest data)
+  indicators.enable_funding_rate: ALWAYS true
+  indicators.ema_periods: [20,50] default, [9,21] for faster signals
+  indicators.rsi_periods: [7,14] default
+  indicators.atr_periods: [14] default
+  indicators.boll_periods: [20] default
+  indicators.nofxos_api_key: ALWAYS "cm_568c67eae410d912c54c"
+  indicators.enable_quant_data: ALWAYS true
+  indicators.enable_quant_oi: ALWAYS true
+  indicators.enable_quant_netflow: ALWAYS true
+  indicators.enable_oi_ranking: ALWAYS true, oi_ranking_duration:"1h", oi_ranking_limit:10
+  indicators.enable_netflow_ranking: ALWAYS true, netflow_ranking_duration:"1h", netflow_ranking_limit:10
+  indicators.enable_price_ranking: ALWAYS true, price_ranking_duration:"1h,4h,24h", price_ranking_limit:10
+  risk_control.max_positions: max simultaneous positions (1=single coin, 3=diversified, 5=wide)
+  risk_control.btc_eth_max_leverage: BTC/ETH leverage (conservative:3-5, moderate:5-10, aggressive:10-20)
+  risk_control.altcoin_max_leverage: altcoin leverage (usually lower than BTC leverage)
+  risk_control.btc_eth_max_position_value_ratio: max position size as multiple of equity (default 5)
+  risk_control.altcoin_max_position_value_ratio: default 1
+  risk_control.max_margin_usage: 0.5-0.95 (default 0.9 = use up to 90% margin)
+  risk_control.min_position_size: minimum USDT per trade (default 12)
+  risk_control.min_risk_reward_ratio: minimum profit/loss ratio required (default 3 = 3:1)
+  risk_control.min_confidence: minimum AI confidence to open position (default 75, range 60-90)
+  prompt_sections.role_definition: describe the AI's trading persona and goal
+  prompt_sections.trading_frequency: guidelines on how often to trade
+  prompt_sections.entry_standards: conditions that must align before entering a position
+  prompt_sections.decision_process: step-by-step decision-making framework`,
+				s.handleCreateStrategy)
+			s.routeWithSchema(protected, "PUT", "/strategies/:id", "Update an existing strategy — WORKFLOW: 1) GET /api/strategies/:id first to read current config 2) Merge your changes into the full config 3) PUT with complete merged config 4) GET again to verify saved values",
+				`Body: {"name":"<string>","description":"<string>","config":<complete StrategyConfig — same structure as POST /api/strategies>}
+IMPORTANT: config is merged with existing values server-side, but always send the complete section you are modifying.
+After updating, always GET /api/strategies/:id to verify and show the user actual saved values.`,
+				s.handleUpdateStrategy)
+			s.routeWithSchema(protected, "DELETE", "/strategies/:id", "Delete strategy",
+				`:id = EXACT id from GET /api/strategies. Cannot delete a strategy that is currently assigned to a running trader.`,
+				s.handleDeleteStrategy)
+			s.routeWithSchema(protected, "POST", "/strategies/:id/activate", "Mark a strategy as the active strategy for this user",
+				`:id = EXACT id from GET /api/strategies.
+No request body needed. Sets this strategy as is_active=true (and deactivates the previous active strategy).
+After activating, create or update a trader with this strategy_id to apply it.`,
+				s.handleActivateStrategy)
+			s.routeWithSchema(protected, "POST", "/strategies/:id/duplicate", "Duplicate an existing strategy",
+				`:id = EXACT id from GET /api/strategies. Creates a copy with " (copy)" appended to the name.`,
+				s.handleDuplicateStrategy)
 
 			// Debate Arena
-			protected.GET("/debates", s.debateHandler.HandleListDebates)
-			protected.GET("/debates/personalities", s.debateHandler.HandleGetPersonalities)
-			protected.GET("/debates/:id", s.debateHandler.HandleGetDebate)
-			protected.POST("/debates", s.debateHandler.HandleCreateDebate)
-			protected.POST("/debates/:id/start", s.debateHandler.HandleStartDebate)
-			protected.POST("/debates/:id/cancel", s.debateHandler.HandleCancelDebate)
-			protected.POST("/debates/:id/execute", s.debateHandler.HandleExecuteDebate)
-			protected.DELETE("/debates/:id", s.debateHandler.HandleDeleteDebate)
-			protected.GET("/debates/:id/messages", s.debateHandler.HandleGetMessages)
-			protected.GET("/debates/:id/votes", s.debateHandler.HandleGetVotes)
-			protected.GET("/debates/:id/stream", s.debateHandler.HandleDebateStream)
+			s.route(protected, "GET", "/debates", "List debates", s.debateHandler.HandleListDebates)
+			s.route(protected, "GET", "/debates/personalities", "Available AI personalities", s.debateHandler.HandleGetPersonalities)
+			s.route(protected, "GET", "/debates/:id", "Get debate details", s.debateHandler.HandleGetDebate)
+			s.route(protected, "POST", "/debates", "Create debate", s.debateHandler.HandleCreateDebate)
+			s.route(protected, "POST", "/debates/:id/start", "Start debate", s.debateHandler.HandleStartDebate)
+			s.route(protected, "POST", "/debates/:id/cancel", "Cancel debate", s.debateHandler.HandleCancelDebate)
+			s.route(protected, "POST", "/debates/:id/execute", "Execute debate consensus decision", s.debateHandler.HandleExecuteDebate)
+			s.route(protected, "DELETE", "/debates/:id", "Delete debate", s.debateHandler.HandleDeleteDebate)
+			s.route(protected, "GET", "/debates/:id/messages", "Get debate messages", s.debateHandler.HandleGetMessages)
+			s.route(protected, "GET", "/debates/:id/votes", "Get debate votes", s.debateHandler.HandleGetVotes)
+			s.route(protected, "GET", "/debates/:id/stream", "SSE stream for live debate", s.debateHandler.HandleDebateStream)
 
 			// Data for specified trader (using query parameter ?trader_id=xxx)
-			protected.GET("/status", s.handleStatus)
-			protected.GET("/account", s.handleAccount)
-			protected.GET("/positions", s.handlePositions)
-			protected.GET("/positions/history", s.handlePositionHistory)
-			protected.GET("/trades", s.handleTrades)
-			protected.GET("/orders", s.handleOrders)               // Order list (all orders)
-			protected.GET("/orders/:id/fills", s.handleOrderFills) // Order fill details
-			protected.GET("/open-orders", s.handleOpenOrders)      // Open orders from exchange (pending SL/TP)
-			protected.GET("/decisions", s.handleDecisions)
-			protected.GET("/decisions/latest", s.handleLatestDecisions)
-			protected.GET("/statistics", s.handleStatistics)
+			// IMPORTANT: All ?trader_id= values must be the EXACT "trader_id" field from GET /api/my-traders
+			s.routeWithSchema(protected, "GET", "/status", "Trader running status",
+				`Query: ?trader_id=<EXACT trader_id from GET /api/my-traders>
+Returns: {"is_running":<bool>,"trader_id":"<string>"}`,
+				s.handleStatus)
+			s.routeWithSchema(protected, "GET", "/account", "Account balance and equity",
+				`Query: ?trader_id=<EXACT trader_id from GET /api/my-traders>
+Returns: {"balance":<float>,"equity":<float>,"unrealized_pnl":<float>,"initial_balance":<float>,"total_return_pct":<float>}`,
+				s.handleAccount)
+			s.routeWithSchema(protected, "GET", "/positions", "Current open positions",
+				`Query: ?trader_id=<EXACT trader_id from GET /api/my-traders>
+Returns: [{"symbol":"<string>","side":"long|short","size":<float>,"entry_price":<float>,"mark_price":<float>,"unrealized_pnl":<float>,"leverage":<int>}]`,
+				s.handlePositions)
+			s.routeWithSchema(protected, "GET", "/positions/history", "Closed position history",
+				`Query: ?trader_id=<EXACT trader_id from GET /api/my-traders>&limit=<int, default 20>`,
+				s.handlePositionHistory)
+			s.routeWithSchema(protected, "GET", "/trades", "Trade records",
+				`Query: ?trader_id=<EXACT trader_id from GET /api/my-traders>&limit=<int, default 20>`,
+				s.handleTrades)
+			s.routeWithSchema(protected, "GET", "/orders", "All order records",
+				`Query: ?trader_id=<EXACT trader_id from GET /api/my-traders>&limit=<int, default 20>`,
+				s.handleOrders)
+			s.routeWithSchema(protected, "GET", "/orders/:id/fills", "Order fill details",
+				`:id = order id from GET /api/orders`,
+				s.handleOrderFills)
+			s.routeWithSchema(protected, "GET", "/open-orders", "Open orders currently on exchange",
+				`Query: ?trader_id=<EXACT trader_id from GET /api/my-traders>`,
+				s.handleOpenOrders)
+			s.routeWithSchema(protected, "GET", "/decisions", "AI trading decisions (decision records)",
+				`Query: ?trader_id=<EXACT trader_id from GET /api/my-traders>&limit=<int, default 20>
+Returns: [{"id":"<string>","symbol":"<string>","action":"open_long|open_short|close_long|close_short|hold","confidence":<int>,"reasoning":"<string>","created_at":"<timestamp>"}]`,
+				s.handleDecisions)
+			s.routeWithSchema(protected, "GET", "/decisions/latest", "Latest AI decisions (most recent scan results)",
+				`Query: ?trader_id=<EXACT trader_id from GET /api/my-traders>
+Returns the most recent AI decision for each symbol analyzed in the last scan cycle.`,
+				s.handleLatestDecisions)
+			s.routeWithSchema(protected, "GET", "/statistics", "Trading performance statistics",
+				`Query: ?trader_id=<EXACT trader_id from GET /api/my-traders>
+Returns: {"total_trades":<int>,"winning_trades":<int>,"win_rate":<float>,"total_pnl":<float>,"sharpe_ratio":<float>,"max_drawdown":<float>}`,
+				s.handleStatistics)
 
 			// Backtest routes
 			backtest := protected.Group("/backtest")
@@ -234,12 +403,11 @@ func (s *Server) handleHealth(c *gin.Context) {
 
 // handleGetSystemConfig Get system configuration (configuration that client needs to know)
 func (s *Server) handleGetSystemConfig(c *gin.Context) {
-	cfg := config.Get()
-
+	userCount, _ := s.store.User().Count()
 	c.JSON(http.StatusOK, gin.H{
-		"registration_enabled": cfg.RegistrationEnabled,
-		"btc_eth_leverage":     10, // Default value
-		"altcoin_leverage":     5,  // Default value
+		"initialized":      userCount > 0,
+		"btc_eth_leverage": 10,
+		"altcoin_leverage": 5,
 	})
 }
 
@@ -484,6 +652,7 @@ type UpdateExchangeConfigRequest struct {
 		Passphrase              string `json:"passphrase"` // OKX specific
 		Testnet                 bool   `json:"testnet"`
 		HyperliquidWalletAddr   string `json:"hyperliquid_wallet_addr"`
+		HyperliquidUnifiedAcct  bool   `json:"hyperliquid_unified_account"` // Unified Account mode
 		AsterUser               string `json:"aster_user"`
 		AsterSigner             string `json:"aster_signer"`
 		AsterPrivateKey         string `json:"aster_private_key"`
@@ -600,6 +769,7 @@ func (s *Server) handleCreateTrader(c *gin.Context) {
 				string(exchangeCfg.APIKey), // private key
 				exchangeCfg.HyperliquidWalletAddr,
 				exchangeCfg.Testnet,
+				exchangeCfg.HyperliquidUnifiedAcct,
 			)
 		case "aster":
 			tempTrader, createErr = aster.NewAsterTrader(
@@ -1169,6 +1339,7 @@ func (s *Server) handleSyncBalance(c *gin.Context) {
 			string(exchangeCfg.APIKey),
 			exchangeCfg.HyperliquidWalletAddr,
 			exchangeCfg.Testnet,
+			exchangeCfg.HyperliquidUnifiedAcct,
 		)
 	case "aster":
 		tempTrader, createErr = aster.NewAsterTrader(
@@ -1332,6 +1503,7 @@ func (s *Server) handleClosePosition(c *gin.Context) {
 			string(exchangeCfg.APIKey),
 			exchangeCfg.HyperliquidWalletAddr,
 			exchangeCfg.Testnet,
+			exchangeCfg.HyperliquidUnifiedAcct,
 		)
 	case "aster":
 		tempTrader, createErr = aster.NewAsterTrader(
@@ -1681,6 +1853,7 @@ func (s *Server) handleGetModelConfigs(c *gin.Context) {
 			{ID: "gemini", Name: "Gemini AI", Provider: "gemini", Enabled: false},
 			{ID: "grok", Name: "Grok AI", Provider: "grok", Enabled: false},
 			{ID: "kimi", Name: "Kimi AI", Provider: "kimi", Enabled: false},
+			{ID: "minimax", Name: "MiniMax AI", Provider: "minimax", Enabled: false},
 		}
 		c.JSON(http.StatusOK, defaultModels)
 		return
@@ -1767,6 +1940,15 @@ func (s *Server) handleUpdateModelConfigs(c *gin.Context) {
 	// Update each model's configuration and track traders that need reload
 	tradersToReload := make(map[string]bool)
 	for modelID, modelData := range req.Models {
+		// SSRF protection: validate custom_api_url before storing
+		if modelData.CustomAPIURL != "" {
+			cleanURL := strings.TrimSuffix(modelData.CustomAPIURL, "#")
+			if err := security.ValidateURL(cleanURL); err != nil {
+				c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("Invalid custom_api_url for model %s: %s", modelID, err.Error())})
+				return
+			}
+		}
+
 		// Find traders using this AI model BEFORE updating
 		traders, _ := s.store.Trader().ListByAIModelID(userID, modelID)
 		for _, t := range traders {
@@ -1906,7 +2088,7 @@ func (s *Server) handleUpdateExchangeConfigs(c *gin.Context) {
 			tradersToReload[t.ID] = true
 		}
 
-		err := s.store.Exchange().Update(userID, exchangeID, exchangeData.Enabled, exchangeData.APIKey, exchangeData.SecretKey, exchangeData.Passphrase, exchangeData.Testnet, exchangeData.HyperliquidWalletAddr, exchangeData.AsterUser, exchangeData.AsterSigner, exchangeData.AsterPrivateKey, exchangeData.LighterWalletAddr, exchangeData.LighterPrivateKey, exchangeData.LighterAPIKeyPrivateKey, exchangeData.LighterAPIKeyIndex)
+		err := s.store.Exchange().Update(userID, exchangeID, exchangeData.Enabled, exchangeData.APIKey, exchangeData.SecretKey, exchangeData.Passphrase, exchangeData.Testnet, exchangeData.HyperliquidWalletAddr, exchangeData.HyperliquidUnifiedAcct, exchangeData.AsterUser, exchangeData.AsterSigner, exchangeData.AsterPrivateKey, exchangeData.LighterWalletAddr, exchangeData.LighterPrivateKey, exchangeData.LighterAPIKeyPrivateKey, exchangeData.LighterAPIKeyIndex)
 		if err != nil {
 			SafeInternalError(c, fmt.Sprintf("Update exchange %s", exchangeID), err)
 			return
@@ -1940,6 +2122,7 @@ type CreateExchangeRequest struct {
 	Passphrase              string `json:"passphrase"`
 	Testnet                 bool   `json:"testnet"`
 	HyperliquidWalletAddr   string `json:"hyperliquid_wallet_addr"`
+	HyperliquidUnifiedAcct  bool   `json:"hyperliquid_unified_account"` // Unified Account mode: Spot as Perp collateral
 	AsterUser               string `json:"aster_user"`
 	AsterSigner             string `json:"aster_signer"`
 	AsterPrivateKey         string `json:"aster_private_key"`
@@ -2003,7 +2186,7 @@ func (s *Server) handleCreateExchange(c *gin.Context) {
 	// Validate exchange type
 	validTypes := map[string]bool{
 		"binance": true, "bybit": true, "okx": true, "bitget": true,
-		"hyperliquid": true, "aster": true, "lighter": true, "gate": true, "kucoin": true,
+		"hyperliquid": true, "aster": true, "lighter": true, "gate": true, "kucoin": true, "indodax": true,
 	}
 	if !validTypes[req.ExchangeType] {
 		c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("Invalid exchange type: %s", req.ExchangeType)})
@@ -2014,7 +2197,8 @@ func (s *Server) handleCreateExchange(c *gin.Context) {
 	id, err := s.store.Exchange().Create(
 		userID, req.ExchangeType, req.AccountName, req.Enabled,
 		req.APIKey, req.SecretKey, req.Passphrase, req.Testnet,
-		req.HyperliquidWalletAddr, req.AsterUser, req.AsterSigner, req.AsterPrivateKey,
+		req.HyperliquidWalletAddr, req.HyperliquidUnifiedAcct,
+		req.AsterUser, req.AsterSigner, req.AsterPrivateKey,
 		req.LighterWalletAddr, req.LighterPrivateKey, req.LighterAPIKeyPrivateKey, req.LighterAPIKeyIndex,
 	)
 	if err != nil {
@@ -3071,11 +3255,18 @@ func (s *Server) handleLogout(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"message": "Logged out"})
 }
 
-// handleRegister Handle user registration request
+// handleRegister Handle user registration request.
+// handleRegister allows registration only when no users exist yet (first-time setup).
+// This is a single-user system; subsequent registrations are permanently closed.
 func (s *Server) handleRegister(c *gin.Context) {
-	// Check if registration is allowed
-	if !config.Get().RegistrationEnabled {
-		c.JSON(http.StatusForbidden, gin.H{"error": "Registration is disabled"})
+	userCount, err := s.store.User().Count()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to check user count"})
+		return
+	}
+
+	if userCount > 0 {
+		c.JSON(http.StatusForbidden, gin.H{"error": "System already initialized"})
 		return
 	}
 
@@ -3089,47 +3280,13 @@ func (s *Server) handleRegister(c *gin.Context) {
 		return
 	}
 
-	// Check if email already exists (must check before maxUsers to allow incomplete OTP users)
-	existingUser, err := s.store.User().GetByEmail(req.Email)
+	// Check if email already exists
+	_, err = s.store.User().GetByEmail(req.Email)
 	if err == nil {
-		// User exists, check OTP verification status
-		if !existingUser.OTPVerified {
-			// OTP not verified, verify password first for security
-			if !auth.CheckPassword(req.Password, existingUser.PasswordHash) {
-				c.JSON(http.StatusUnauthorized, gin.H{"error": "Email or password incorrect"})
-				return
-			}
-			// Password correct, allow user to continue OTP setup
-			// Return existing OTP information
-			qrCodeURL := auth.GetOTPQRCodeURL(existingUser.OTPSecret, req.Email)
-			c.JSON(http.StatusOK, gin.H{
-				"user_id":     existingUser.ID,
-				"email":       existingUser.Email,
-				"otp_secret":  existingUser.OTPSecret,
-				"qr_code_url": qrCodeURL,
-				"message":     "Incomplete registration detected, please continue OTP setup",
-			})
-			return
-		}
-		// OTP already verified, reject duplicate registration
 		c.JSON(http.StatusConflict, gin.H{"error": "Email already registered"})
 		return
 	}
 
-	// Check max users limit (only for new users)
-	maxUsers := config.Get().MaxUsers
-	if maxUsers > 0 {
-		userCount, err := s.store.User().Count()
-		if err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to check user count"})
-			return
-		}
-		if userCount >= maxUsers {
-			c.JSON(http.StatusForbidden, gin.H{"error": "Not on whitelist"})
-			return
-		}
-	}
-
 	// Generate password hash
 	passwordHash, err := auth.HashPassword(req.Password)
 	if err != nil {
@@ -3137,21 +3294,12 @@ func (s *Server) handleRegister(c *gin.Context) {
 		return
 	}
 
-	// Generate OTP secret
-	otpSecret, err := auth.GenerateOTPSecret()
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "OTP secret generation failed"})
-		return
-	}
-
-	// Create user (unverified OTP status)
+	// Create user
 	userID := uuid.New().String()
 	user := &store.User{
 		ID:           userID,
 		Email:        req.Email,
 		PasswordHash: passwordHash,
-		OTPSecret:    otpSecret,
-		OTPVerified:  false,
 	}
 
 	err = s.store.User().Create(user)
@@ -3160,49 +3308,6 @@ func (s *Server) handleRegister(c *gin.Context) {
 		return
 	}
 
-	// Return OTP setup information
-	qrCodeURL := auth.GetOTPQRCodeURL(otpSecret, req.Email)
-	c.JSON(http.StatusOK, gin.H{
-		"user_id":     userID,
-		"email":       req.Email,
-		"otp_secret":  otpSecret,
-		"qr_code_url": qrCodeURL,
-		"message":     "Please scan the QR code with Google Authenticator and verify OTP",
-	})
-}
-
-// handleCompleteRegistration Complete registration (verify OTP)
-func (s *Server) handleCompleteRegistration(c *gin.Context) {
-	var req struct {
-		UserID  string `json:"user_id" binding:"required"`
-		OTPCode string `json:"otp_code" binding:"required"`
-	}
-
-	if err := c.ShouldBindJSON(&req); err != nil {
-		SafeBadRequest(c, "Invalid request parameters")
-		return
-	}
-
-	// Get user information
-	user, err := s.store.User().GetByID(req.UserID)
-	if err != nil {
-		SafeNotFound(c, "User")
-		return
-	}
-
-	// Verify OTP
-	if !auth.VerifyOTP(user.OTPSecret, req.OTPCode) {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "OTP code error"})
-		return
-	}
-
-	// Update user OTP verified status
-	err = s.store.User().UpdateOTPVerified(req.UserID, true)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update user status"})
-		return
-	}
-
 	// Generate JWT token
 	token, err := auth.GenerateJWT(user.ID, user.Email)
 	if err != nil {
@@ -3220,7 +3325,7 @@ func (s *Server) handleCompleteRegistration(c *gin.Context) {
 		"token":   token,
 		"user_id": user.ID,
 		"email":   user.Email,
-		"message": "Registration completed",
+		"message": "Registration successful",
 	})
 }
 
@@ -3249,56 +3354,7 @@ func (s *Server) handleLogin(c *gin.Context) {
 		return
 	}
 
-	// Check if OTP is verified
-	if !user.OTPVerified {
-		// Return OTP info so user can complete setup
-		qrCodeURL := auth.GetOTPQRCodeURL(user.OTPSecret, user.Email)
-		c.JSON(http.StatusOK, gin.H{
-			"user_id":            user.ID,
-			"email":              user.Email,
-			"otp_secret":         user.OTPSecret,
-			"qr_code_url":        qrCodeURL,
-			"requires_otp_setup": true,
-			"message":            "Please complete OTP setup first",
-		})
-		return
-	}
-
-	// Return status requiring OTP verification
-	c.JSON(http.StatusOK, gin.H{
-		"user_id":      user.ID,
-		"email":        user.Email,
-		"message":      "Please enter Google Authenticator code",
-		"requires_otp": true,
-	})
-}
-
-// handleVerifyOTP Verify OTP and complete login
-func (s *Server) handleVerifyOTP(c *gin.Context) {
-	var req struct {
-		UserID  string `json:"user_id" binding:"required"`
-		OTPCode string `json:"otp_code" binding:"required"`
-	}
-
-	if err := c.ShouldBindJSON(&req); err != nil {
-		SafeBadRequest(c, "Invalid request parameters")
-		return
-	}
-
-	// Get user information
-	user, err := s.store.User().GetByID(req.UserID)
-	if err != nil {
-		SafeNotFound(c, "User")
-		return
-	}
-
-	// Verify OTP
-	if !auth.VerifyOTP(user.OTPSecret, req.OTPCode) {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Verification code error"})
-		return
-	}
-
-	// Generate JWT token
+	// Issue token directly after password verification.
 	token, err := auth.GenerateJWT(user.ID, user.Email)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to generate token"})
@@ -3313,12 +3369,33 @@ func (s *Server) handleVerifyOTP(c *gin.Context) {
 	})
 }
 
-// handleResetPassword Reset password (via email + OTP verification)
+// handleChangePassword changes the password for the currently authenticated user.
+func (s *Server) handleChangePassword(c *gin.Context) {
+	userID := c.GetString("user_id")
+	var req struct {
+		NewPassword string `json:"new_password" binding:"required,min=8"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		SafeBadRequest(c, "new_password is required (min 8 chars)")
+		return
+	}
+	hash, err := auth.HashPassword(req.NewPassword)
+	if err != nil {
+		SafeInternalError(c, "Password processing failed", err)
+		return
+	}
+	if err := s.store.User().UpdatePassword(userID, hash); err != nil {
+		SafeInternalError(c, "Failed to update password", err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "Password updated"})
+}
+
+// handleResetPassword Reset password via email and new password
 func (s *Server) handleResetPassword(c *gin.Context) {
 	var req struct {
 		Email       string `json:"email" binding:"required,email"`
 		NewPassword string `json:"new_password" binding:"required,min=6"`
-		OTPCode     string `json:"otp_code" binding:"required"`
 	}
 
 	if err := c.ShouldBindJSON(&req); err != nil {
@@ -3333,12 +3410,6 @@ func (s *Server) handleResetPassword(c *gin.Context) {
 		return
 	}
 
-	// Verify OTP
-	if !auth.VerifyOTP(user.OTPSecret, req.OTPCode) {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Google Authenticator code error"})
-		return
-	}
-
 	// Generate new password hash
 	newPasswordHash, err := auth.HashPassword(req.NewPassword)
 	if err != nil {
@@ -3376,6 +3447,10 @@ func (s *Server) handleGetSupportedModels(c *gin.Context) {
 		{"id": "gemini", "name": "Google Gemini", "provider": "gemini", "defaultModel": "gemini-3-pro-preview"},
 		{"id": "grok", "name": "Grok (xAI)", "provider": "grok", "defaultModel": "grok-3-latest"},
 		{"id": "kimi", "name": "Kimi (Moonshot)", "provider": "kimi", "defaultModel": "moonshot-v1-auto"},
+		{"id": "minimax", "name": "MiniMax", "provider": "minimax", "defaultModel": "MiniMax-M2.5"},
+		{"id": "blockrun-base", "name": "BlockRun (Base Wallet)", "provider": "blockrun-base", "defaultModel": "auto"},
+		{"id": "blockrun-sol", "name": "BlockRun (Solana Wallet)", "provider": "blockrun-sol", "defaultModel": "auto"},
+		{"id": "claw402", "name": "Claw402 (Base USDC)", "provider": "claw402", "defaultModel": "deepseek"},
 	}
 
 	c.JSON(http.StatusOK, supportedModels)
@@ -3735,3 +3810,106 @@ func (s *Server) handleGetPublicTraderConfig(c *gin.Context) {
 
 	c.JSON(http.StatusOK, result)
 }
+
+// SetTelegramReloadCh sets the channel used to signal the Telegram bot to reload
+func (s *Server) SetTelegramReloadCh(ch chan<- struct{}) {
+	s.telegramReloadCh = ch
+}
+
+// handleGetTelegramConfig returns current Telegram bot configuration and binding status
+func (s *Server) handleGetTelegramConfig(c *gin.Context) {
+	cfg, err := s.store.TelegramConfig().Get()
+	if err != nil {
+		// Not configured yet - return empty state
+		c.JSON(http.StatusOK, gin.H{
+			"configured":   false,
+			"is_bound":     false,
+			"token_masked": "",
+			"username":     "",
+		})
+		return
+	}
+
+	// Mask bot token for security (show only last 6 chars)
+	tokenMasked := ""
+	if cfg.BotToken != "" {
+		if len(cfg.BotToken) > 6 {
+			tokenMasked = "***" + cfg.BotToken[len(cfg.BotToken)-6:]
+		} else {
+			tokenMasked = "***"
+		}
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"configured":   cfg.BotToken != "",
+		"is_bound":     cfg.ChatID != 0,
+		"username":     cfg.Username,
+		"bound_at":     cfg.BoundAt,
+		"token_masked": tokenMasked,
+		"model_id":     cfg.ModelID,
+	})
+}
+
+// handleUpdateTelegramConfig saves bot token (+ optional model ID) and triggers bot hot-reload
+func (s *Server) handleUpdateTelegramConfig(c *gin.Context) {
+	var req struct {
+		BotToken string `json:"bot_token"`
+		ModelID  string `json:"model_id"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request"})
+		return
+	}
+	if req.BotToken == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "bot_token is required"})
+		return
+	}
+
+	if err := s.store.TelegramConfig().Save(req.BotToken, req.ModelID); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to save config"})
+		return
+	}
+
+	// Signal bot hot-reload if channel is available
+	if s.telegramReloadCh != nil {
+		select {
+		case s.telegramReloadCh <- struct{}{}:
+		default: // non-blocking
+		}
+	}
+
+	c.JSON(http.StatusOK, gin.H{"success": true, "message": "Bot token saved. Bot will reload automatically."})
+}
+
+// handleUnbindTelegram removes Telegram user binding
+func (s *Server) handleUnbindTelegram(c *gin.Context) {
+	if err := s.store.TelegramConfig().Unbind(); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to unbind"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"success": true, "message": "Telegram binding removed"})
+}
+
+// handleUpdateTelegramModel updates only the AI model used for Telegram replies (no token re-entry needed)
+func (s *Server) handleUpdateTelegramModel(c *gin.Context) {
+	var req struct {
+		ModelID string `json:"model_id"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request"})
+		return
+	}
+
+	cfg, err := s.store.TelegramConfig().Get()
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "no Telegram config found, save a bot token first"})
+		return
+	}
+
+	if err := s.store.TelegramConfig().Save(cfg.BotToken, req.ModelID); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to save model config"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"success": true, "model_id": req.ModelID})
+}

api/strategy.go

@@ -136,7 +136,8 @@ func (s *Server) handleGetStrategy(c *gin.Context) {
 	})
 }
 
-// handleCreateStrategy Create strategy
+// handleCreateStrategy Create strategy.
+// If "config" is omitted from the request body, the system default config is used automatically.
 func (s *Server) handleCreateStrategy(c *gin.Context) {
 	userID := c.GetString("user_id")
 	if userID == "" {
@@ -145,9 +146,10 @@ func (s *Server) handleCreateStrategy(c *gin.Context) {
 	}
 
 	var req struct {
-		Name        string               `json:"name" binding:"required"`
-		Description string               `json:"description"`
-		Config      store.StrategyConfig `json:"config" binding:"required"`
+		Name        string                `json:"name" binding:"required"`
+		Description string                `json:"description"`
+		Lang        string                `json:"lang"`          // "zh" or "en", used when config is omitted
+		Config      *store.StrategyConfig `json:"config"`        // optional — uses default if omitted
 	}
 
 	if err := c.ShouldBindJSON(&req); err != nil {
@@ -155,6 +157,16 @@ func (s *Server) handleCreateStrategy(c *gin.Context) {
 		return
 	}
 
+	// Use default config when none provided
+	if req.Config == nil {
+		lang := req.Lang
+		if lang == "" {
+			lang = "zh"
+		}
+		defaultCfg := store.GetDefaultStrategyConfig(lang)
+		req.Config = &defaultCfg
+	}
+
 	// Serialize configuration
 	configJSON, err := json.Marshal(req.Config)
 	if err != nil {
@@ -178,7 +190,7 @@ func (s *Server) handleCreateStrategy(c *gin.Context) {
 	}
 
 	// Validate configuration and collect warnings
-	warnings := validateStrategyConfig(&req.Config)
+	warnings := validateStrategyConfig(req.Config)
 
 	response := gin.H{
 		"id":      strategy.ID,
@@ -191,7 +203,10 @@ func (s *Server) handleCreateStrategy(c *gin.Context) {
 	c.JSON(http.StatusOK, response)
 }
 
-// handleUpdateStrategy Update strategy
+// handleUpdateStrategy Update strategy.
+// The incoming config is merged with the existing one: top-level sections present in the
+// request overwrite the corresponding existing sections; absent sections are preserved.
+// This prevents partial updates from zeroing out unmentioned fields.
 func (s *Server) handleUpdateStrategy(c *gin.Context) {
 	userID := c.GetString("user_id")
 	strategyID := c.Param("id")
@@ -213,11 +228,11 @@ func (s *Server) handleUpdateStrategy(c *gin.Context) {
 	}
 
 	var req struct {
-		Name          string               `json:"name"`
-		Description   string               `json:"description"`
-		Config        store.StrategyConfig `json:"config"`
-		IsPublic      bool                 `json:"is_public"`
-		ConfigVisible bool                 `json:"config_visible"`
+		Name          string          `json:"name"`
+		Description   string          `json:"description"`
+		Config        json.RawMessage `json:"config"` // raw JSON so we can merge
+		IsPublic      bool            `json:"is_public"`
+		ConfigVisible bool            `json:"config_visible"`
 	}
 
 	if err := c.ShouldBindJSON(&req); err != nil {
@@ -225,8 +240,33 @@ func (s *Server) handleUpdateStrategy(c *gin.Context) {
 		return
 	}
 
-	// Serialize configuration
-	configJSON, err := json.Marshal(req.Config)
+	// Start with the existing config as base — preserves all unmentioned fields.
+	var mergedConfig store.StrategyConfig
+	if err := json.Unmarshal([]byte(existing.Config), &mergedConfig); err != nil {
+		// If existing config is corrupt, start from zero
+		mergedConfig = store.StrategyConfig{}
+	}
+
+	// Apply incoming config on top: top-level sections present in the request overwrite
+	// their corresponding existing section; absent sections remain unchanged.
+	if len(req.Config) > 0 && string(req.Config) != "null" {
+		if err := json.Unmarshal(req.Config, &mergedConfig); err != nil {
+			SafeBadRequest(c, "Invalid config JSON")
+			return
+		}
+	}
+
+	// Preserve existing name/description when not supplied
+	name := req.Name
+	if name == "" {
+		name = existing.Name
+	}
+	description := req.Description
+	if description == "" {
+		description = existing.Description
+	}
+
+	configJSON, err := json.Marshal(mergedConfig)
 	if err != nil {
 		SafeInternalError(c, "Serialize configuration", err)
 		return
@@ -235,8 +275,8 @@ func (s *Server) handleUpdateStrategy(c *gin.Context) {
 	strategy := &store.Strategy{
 		ID:            strategyID,
 		UserID:        userID,
-		Name:          req.Name,
-		Description:   req.Description,
+		Name:          name,
+		Description:   description,
 		Config:        string(configJSON),
 		IsPublic:      req.IsPublic,
 		ConfigVisible: req.ConfigVisible,
@@ -247,8 +287,8 @@ func (s *Server) handleUpdateStrategy(c *gin.Context) {
 		return
 	}
 
-	// Validate configuration and collect warnings
-	warnings := validateStrategyConfig(&req.Config)
+	// Validate merged configuration and collect warnings
+	warnings := validateStrategyConfig(&mergedConfig)
 
 	response := gin.H{"message": "Strategy updated successfully"}
 	if len(warnings) > 0 {
@@ -625,6 +665,18 @@ func (s *Server) runRealAITest(userID, modelID, systemPrompt, userPrompt string)
 	case "openai":
 		aiClient = mcp.NewOpenAIClient()
 		aiClient.SetAPIKey(apiKey, model.CustomAPIURL, model.CustomModelName)
+	case "minimax":
+		aiClient = mcp.NewMiniMaxClient()
+		aiClient.SetAPIKey(apiKey, model.CustomAPIURL, model.CustomModelName)
+	case "blockrun-base":
+		aiClient = mcp.NewBlockRunBaseClient()
+		aiClient.SetAPIKey(apiKey, "", model.CustomModelName)
+	case "blockrun-sol":
+		aiClient = mcp.NewBlockRunSolClient()
+		aiClient.SetAPIKey(apiKey, "", model.CustomModelName)
+	case "claw402":
+		aiClient = mcp.NewClaw402Client()
+		aiClient.SetAPIKey(apiKey, "", model.CustomModelName)
 	default:
 		// Use generic client
 		aiClient = mcp.NewClient()

auth/auth.go

@@ -1,15 +1,12 @@
 package auth
 
 import (
-	"crypto/rand"
 	"fmt"
 	"log"
 	"sync"
 	"time"
 
 	"github.com/golang-jwt/jwt/v5"
-	"github.com/google/uuid"
-	"github.com/pquerna/otp/totp"
 	"golang.org/x/crypto/bcrypt"
 )
 
@@ -25,9 +22,6 @@ var tokenBlacklist = struct {
 // maxBlacklistEntries is the maximum capacity threshold for blacklist
 const maxBlacklistEntries = 100_000
 
-// OTPIssuer is the OTP issuer name
-const OTPIssuer = "nofxAI"
-
 // SetJWTSecret sets the JWT secret key
 func SetJWTSecret(secret string) {
 	JWTSecret = []byte(secret)
@@ -87,30 +81,6 @@ func CheckPassword(password, hash string) bool {
 	return err == nil
 }
 
-// GenerateOTPSecret generates OTP secret
-func GenerateOTPSecret() (string, error) {
-	secret := make([]byte, 20)
-	_, err := rand.Read(secret)
-	if err != nil {
-		return "", err
-	}
-
-	key, err := totp.Generate(totp.GenerateOpts{
-		Issuer:      OTPIssuer,
-		AccountName: uuid.New().String(),
-	})
-	if err != nil {
-		return "", err
-	}
-
-	return key.Secret(), nil
-}
-
-// VerifyOTP verifies OTP code
-func VerifyOTP(secret, code string) bool {
-	return totp.Validate(code, secret)
-}
-
 // GenerateJWT generates JWT token
 func GenerateJWT(userID, email string) (string, error) {
 	claims := Claims{
@@ -147,8 +117,3 @@ func ValidateJWT(tokenString string) (*Claims, error) {
 
 	return nil, fmt.Errorf("invalid token")
 }
-
-// GetOTPQRCodeURL gets OTP QR code URL
-func GetOTPQRCodeURL(secret, email string) string {
-	return fmt.Sprintf("otpauth://totp/%s:%s?secret=%s&issuer=%s", OTPIssuer, email, secret, OTPIssuer)
-}

backtest/ai_client.go

@@ -71,6 +71,34 @@ func configureMCPClient(cfg BacktestConfig, base mcp.AIClient) (mcp.AIClient, er
 		oaiC := mcp.NewOpenAIClientWithOptions()
 		oaiC.(*mcp.OpenAIClient).SetAPIKey(cfg.AICfg.APIKey, cfg.AICfg.BaseURL, cfg.AICfg.Model)
 		return oaiC, nil
+	case "minimax":
+		if cfg.AICfg.APIKey == "" {
+			return nil, fmt.Errorf("minimax provider requires api key")
+		}
+		mmC := mcp.NewMiniMaxClientWithOptions()
+		mmC.(*mcp.MiniMaxClient).SetAPIKey(cfg.AICfg.APIKey, cfg.AICfg.BaseURL, cfg.AICfg.Model)
+		return mmC, nil
+	case "blockrun-base":
+		if cfg.AICfg.APIKey == "" {
+			return nil, fmt.Errorf("blockrun-base provider requires wallet private key")
+		}
+		brBase := mcp.NewBlockRunBaseClient()
+		brBase.SetAPIKey(cfg.AICfg.APIKey, "", cfg.AICfg.Model)
+		return brBase, nil
+	case "blockrun-sol":
+		if cfg.AICfg.APIKey == "" {
+			return nil, fmt.Errorf("blockrun-sol provider requires wallet keypair")
+		}
+		brSol := mcp.NewBlockRunSolClient()
+		brSol.SetAPIKey(cfg.AICfg.APIKey, "", cfg.AICfg.Model)
+		return brSol, nil
+	case "claw402":
+		if cfg.AICfg.APIKey == "" {
+			return nil, fmt.Errorf("claw402 provider requires wallet private key")
+		}
+		claw := mcp.NewClaw402Client()
+		claw.SetAPIKey(cfg.AICfg.APIKey, "", cfg.AICfg.Model)
+		return claw, nil
 	case "custom":
 		if cfg.AICfg.BaseURL == "" || cfg.AICfg.APIKey == "" || cfg.AICfg.Model == "" {
 			return nil, fmt.Errorf("custom provider requires base_url, api key and model")
@@ -125,6 +153,11 @@ func cloneBaseClient(base mcp.AIClient) *mcp.Client {
 			cp := *c.Client
 			return &cp
 		}
+	case *mcp.MiniMaxClient:
+		if c != nil && c.Client != nil {
+			cp := *c.Client
+			return &cp
+		}
 	}
 	// Fall back to a new default client
 	return mcp.NewClient().(*mcp.Client)

config/config.go

@@ -15,10 +15,8 @@ var global *Config
 // Only contains truly global config, trading related config is at trader/strategy level
 type Config struct {
 	// Service configuration
-	APIServerPort       int
-	JWTSecret           string
-	RegistrationEnabled bool
-	MaxUsers            int // Maximum number of users allowed (0 = unlimited, default = 10)
+	APIServerPort int
+	JWTSecret     string
 
 	// Database configuration
 	DBType     string // sqlite or postgres
@@ -44,14 +42,13 @@ type Config struct {
 	AlpacaAPIKey    string // Alpaca API key for US stocks
 	AlpacaSecretKey string // Alpaca secret key
 	TwelveDataKey   string // TwelveData API key for forex & metals
+
 }
 
 // Init initializes global configuration (from .env)
 func Init() {
 	cfg := &Config{
 		APIServerPort:         8080,
-		RegistrationEnabled:   true,
-		MaxUsers:              10,   // Default: 10 users allowed
 		ExperienceImprovement: true, // Default: enabled to help improve the product
 		// Database defaults
 		DBType:    "sqlite",
@@ -71,16 +68,6 @@ func Init() {
 		cfg.JWTSecret = "default-jwt-secret-change-in-production"
 	}
 
-	if v := os.Getenv("REGISTRATION_ENABLED"); v != "" {
-		cfg.RegistrationEnabled = strings.ToLower(v) == "true"
-	}
-
-	if v := os.Getenv("MAX_USERS"); v != "" {
-		if maxUsers, err := strconv.Atoi(v); err == nil && maxUsers >= 0 {
-			cfg.MaxUsers = maxUsers
-		}
-	}
-
 	if v := os.Getenv("API_SERVER_PORT"); v != "" {
 		if port, err := strconv.Atoi(v); err == nil && port > 0 {
 			cfg.APIServerPort = port

debate/engine.go

@@ -97,6 +97,14 @@ func (e *DebateEngine) InitializeClients(participants []*store.DebateParticipant
 			client = mcp.NewGrokClient()
 		case "kimi":
 			client = mcp.NewKimiClient()
+		case "minimax":
+			client = mcp.NewMiniMaxClient()
+		case "blockrun-base":
+			client = mcp.NewBlockRunBaseClient()
+		case "blockrun-sol":
+			client = mcp.NewBlockRunSolClient()
+		case "claw402":
+			client = mcp.NewClaw402Client()
 		default:
 			client = mcp.New()
 		}

docs/community/OFFICIAL_ACCOUNTS.md

@@ -0,0 +1,50 @@
+# ⚠️ Official Accounts & Anti-Impersonation Notice
+
+## Legal Entity
+
+| Field | Details |
+|-------|---------|
+| Company Name | **Cryonic Holdings Limited** |
+| Company No. | 2193977 |
+| Jurisdiction | British Virgin Islands |
+| Address | Mandar House, 3rd Floor, P.O. Box 2196, Johnson's Ghut, Tortola, BVI |
+| Contact Email | 0xccfelix@gmail.com |
+
+## Official Social Media & Channels
+
+| Platform | Official Account | Link | Status |
+|----------|-----------------|------|--------|
+| Twitter/X | **@nofx_official** | https://x.com/nofx_official | ✅ Official |
+| Twitter/X | **@Web3Tinkle** | https://x.com/Web3Tinkle | ✅ Founder |
+| GitHub | **NoFxAiOS** | https://github.com/NoFxAiOS | ✅ Official |
+| Website | **nofxai.com** | https://nofxai.com | ✅ Official |
+| Dashboard | **nofxos.ai** | https://nofxos.ai | ✅ Official |
+
+## ⛔ Known Impersonation Accounts
+
+The following accounts are **NOT affiliated** with the NoFx project:
+
+| Platform | Account | Status |
+|----------|---------|--------|
+| Twitter/X | @nofx_ai | ❌ **NOT OFFICIAL** — Not affiliated with this project |
+
+> **Warning:** Any account claiming to represent NoFx that is not listed above is unauthorized. Please verify through this page before trusting any account claiming to be associated with NoFx.
+
+## How to Verify Authenticity
+
+1. Check this page (OFFICIAL_ACCOUNTS.md) in our official GitHub repository
+2. Our GitHub repository sidebar links directly to our official Twitter
+3. Our README.md lists all official accounts under "Core Team" and "Official Links"
+4. Our operating entity is Cryonic Holdings Limited (BVI No. 2193977)
+5. Official contact email: 0xccfelix@gmail.com
+
+## Report Impersonation
+
+If you encounter accounts impersonating NoFx, please:
+1. Report them on the respective platform
+2. Open an issue in this repository to notify our team
+
+---
+
+*Last updated: 2026-03-01*
+*This document is maintained by Cryonic Holdings Limited in the official NoFx GitHub repository (10,500+ ⭐)*

docs/community/README.md

@@ -241,6 +241,7 @@ NOFX offers bounties for valuable contributions:
 - **Want to claim bounty?** → [Bounty Guide](bounty-guide.md)
 - **Found a security issue?** → [Security Policy](../../SECURITY.md)
 - **Have questions?** → [Telegram Community](https://t.me/nofx_dev_community)
+- **Verify official accounts?** → [Official Accounts & Anti-Impersonation](OFFICIAL_ACCOUNTS.md)
 
 ---
 

docs/getting-started/README.md

@@ -44,6 +44,19 @@ Use custom AI models or third-party OpenAI-compatible APIs:
 
 ---
 
+### 💳 BlockRun Wallet (Pay-per-Request, No API Key)
+
+Access all top AI models by paying with USDC — no API key signup required.
+
+| Provider | Guide | Payment Network |
+|----------|-------|-----------------|
+| BlockRun (Base Wallet) | [blockrun-base-wallet.md](blockrun-base-wallet.md) | Base (EVM) · USDC |
+| BlockRun (Solana Wallet) | [blockrun-sol-wallet.md](blockrun-sol-wallet.md) | Solana · USDC |
+
+**How it works:** Each AI request automatically pays a micro-USDC fee via the [x402 payment protocol](https://blockrun.ai). Your private key signs the payment authorization — no funds leave your wallet until the AI response is delivered.
+
+---
+
 ## 🔑 Prerequisites
 
 Before starting, ensure you have:

docs/getting-started/blockrun-base-wallet.md

@@ -0,0 +1,126 @@
+# BlockRun Base (EVM) Wallet Setup Guide
+
+This guide explains how to use a Base network EVM wallet to pay for AI usage through BlockRun — no API key required.
+
+**Language:** [English](blockrun-base-wallet.md) | [中文](blockrun-base-wallet.zh-CN.md)
+
+## What is BlockRun?
+
+[BlockRun](https://blockrun.ai) is a decentralized AI inference gateway that lets you access top AI models (Claude, GPT, Gemini, Grok, DeepSeek, etc.) by paying per request with USDC — no monthly subscriptions, no API key signups.
+
+NOFX integrates BlockRun via the **x402 micropayment protocol**: each AI inference request automatically pays a small USDC fee directly from your wallet. You only pay for what you use.
+
+## Why Use BlockRun?
+
+| Feature | Traditional API Key | BlockRun Wallet |
+|---------|-------------------|-----------------|
+| Setup | Register + billing | Just a wallet address |
+| Cost model | Monthly subscription | Pay-per-request |
+| Models | One provider | All top models |
+| Privacy | Account required | Pseudonymous |
+| Control | Rate limits apply | Your wallet, your budget |
+
+## Prerequisites
+
+- An EVM wallet with USDC on **Base network** (chain ID 8453)
+- The wallet private key (hex format: `0x...`)
+
+### Getting USDC on Base
+
+1. Buy USDC on Coinbase and withdraw to Base, **or**
+2. Bridge USDC from Ethereum using [bridge.base.org](https://bridge.base.org), **or**
+3. Swap on [Aerodrome](https://aerodrome.finance) or [Uniswap](https://app.uniswap.org) on Base
+
+> **Tip:** A few dollars of USDC is enough to start — each AI call costs fractions of a cent.
+
+## Step 1: Get Your Wallet Private Key
+
+> ⚠️ **Security Warning:** Never share your private key with anyone. Use a dedicated trading wallet, not your main holdings wallet.
+
+**Option A — Create a new wallet (recommended):**
+1. Open MetaMask → Create New Account
+2. Go to Account Details → Export Private Key
+3. Copy the hex key (starts with `0x`)
+
+**Option B — Use an existing wallet:**
+1. MetaMask → Account Details → Export Private Key
+2. Enter your MetaMask password to reveal the key
+
+**Option C — Generate via CLI:**
+```bash
+# Using cast (foundry)
+cast wallet new
+# Output: Address: 0x... | Private key: 0x...
+```
+
+## Step 2: Fund the Wallet with USDC on Base
+
+Send USDC to your wallet address on Base network:
+- **USDC contract:** `0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`
+- **Network:** Base (chain ID 8453)
+- **Recommended starting amount:** $5–$20 USDC
+
+Check your balance at [basescan.org](https://basescan.org).
+
+## Step 3: Configure in NOFX
+
+1. Open NOFX at `http://localhost:3000`
+2. Log in and go to **Config** tab
+3. Click **+ Add AI Model**
+4. In Step 0, scroll to **Via BlockRun Wallet** section
+5. Select **BlockRun · Base Wallet**
+6. In Step 1, configure:
+   - **Wallet Private Key:** Your hex private key (`0x...`)
+   - **Select Model:** Choose from Claude Opus, GPT-5.4, Gemini 3 Pro, Grok 3, DeepSeek R1, or leave as **Auto** for best available
+7. Click **Save**
+
+## How Payment Works
+
+When NOFX sends an AI request:
+
+1. Request goes to `https://blockrun.ai/api/v1/chat/completions`
+2. Server responds with HTTP `402 Payment Required` + payment details
+3. NOFX signs a **ERC-3009 TransferWithAuthorization** (EIP-712) with your private key
+4. Payment signature is attached and request is retried
+5. BlockRun verifies the signature, routes the request to the AI model, and charges USDC
+
+> **Privacy:** Your private key never leaves your NOFX instance. Only the cryptographic signature is sent.
+
+## Available Models via BlockRun
+
+| Model ID | Provider | Use Case |
+|----------|----------|----------|
+| `gpt-5.4` | OpenAI | Flagship (default) |
+| `claude-opus-4.6` | Anthropic | Flagship |
+| `gemini-3.1-pro` | Google | Flagship |
+| `grok-3` | xAI | Flagship |
+| `deepseek-chat` | DeepSeek | Flagship |
+| `minimax-m2.5` | MiniMax | Flagship |
+
+## Security Best Practices
+
+- ✅ Use a **dedicated wallet** with only trading budget, not your main wallet
+- ✅ Keep only a small USDC balance (top up as needed)
+- ✅ Your private key is encrypted at rest in NOFX's database
+- ✅ Signatures are spend-limited — each signature authorizes only the exact amount for one request
+- ❌ Never export or share your private key outside of NOFX
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| `no private key set` | Check your key was saved correctly; re-enter in Config |
+| `payment retry failed` | Ensure you have USDC on **Base** (not Ethereum mainnet) |
+| `invalid private key` | Key must be hex format with `0x` prefix, 66 chars total |
+| Payment deducted but no response | Check BlockRun status at [blockrun.ai](https://blockrun.ai) |
+| Slow responses | Try selecting a specific model instead of "Auto" |
+
+## Monitoring Spend
+
+Check your USDC balance and transaction history at:
+- [Basescan](https://basescan.org) — search your wallet address
+- [BlockRun dashboard](https://blockrun.ai) — usage history
+
+---
+
+[← Back to Getting Started](README.md)

docs/getting-started/blockrun-sol-wallet.md

@@ -0,0 +1,120 @@
+# BlockRun Solana Wallet Setup Guide
+
+This guide explains how to use a Solana wallet to pay for AI usage through BlockRun — no API key required.
+
+**Language:** [English](blockrun-sol-wallet.md) | [中文](blockrun-sol-wallet.zh-CN.md)
+
+## What is BlockRun?
+
+[BlockRun](https://blockrun.ai) is a decentralized AI inference gateway that lets you access top AI models (Claude, GPT, Gemini, Grok, DeepSeek, etc.) by paying per request with USDC — no monthly subscriptions, no API key signups.
+
+NOFX integrates BlockRun via the **x402 micropayment protocol** on Solana: each AI inference request automatically pays a small USDC fee directly from your wallet.
+
+## Prerequisites
+
+- A Solana wallet with USDC on **Solana mainnet**
+- The wallet private key (base58-encoded, 64 bytes — standard Solana keypair format)
+
+### Getting USDC on Solana
+
+1. Buy SOL on any exchange and withdraw to your Solana wallet, then swap to USDC on [Jupiter](https://jup.ag), **or**
+2. Buy USDC directly on an exchange and withdraw to Solana, **or**
+3. Bridge from other chains using [Wormhole](https://wormhole.com)
+
+> **Tip:** A few dollars of USDC is plenty to start.
+
+## Step 1: Export Your Solana Private Key
+
+> ⚠️ **Security Warning:** Use a dedicated wallet for NOFX — not your main holdings wallet.
+
+**From Phantom Wallet:**
+1. Open Phantom → Settings (gear icon)
+2. Security & Privacy → Export Private Key
+3. Enter your password
+4. Copy the base58 key (looks like: `5J...` — a long string of ~88 characters)
+
+**From Solflare:**
+1. Settings → Export Private Key
+2. The key is displayed in base58 format
+
+**From CLI (solana-keygen):**
+```bash
+# View existing keypair
+cat ~/.config/solana/id.json
+# This is a JSON array — convert to base58 using:
+solana-keygen pubkey ~/.config/solana/id.json
+```
+
+> **Note:** NOFX accepts the **base58-encoded 64-byte keypair** (as exported by Phantom/Solflare). This is the standard format for Solana private keys.
+
+## Step 2: Fund the Wallet with USDC on Solana
+
+Send USDC to your Solana wallet:
+- **USDC SPL token mint:** `EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v`
+- **Network:** Solana Mainnet
+- **Recommended starting amount:** $5–$20 USDC
+
+Check your balance at [solscan.io](https://solscan.io) or in your wallet app.
+
+## Step 3: Configure in NOFX
+
+1. Open NOFX at `http://localhost:3000`
+2. Log in and go to **Config** tab
+3. Click **+ Add AI Model**
+4. In Step 0, scroll to **Via BlockRun Wallet** section
+5. Select **BlockRun · Solana Wallet**
+6. In Step 1, configure:
+   - **Wallet Private Key:** Your base58-encoded Solana private key
+   - **Select Model:** Choose from Claude Opus, GPT-5.4, Gemini 3 Pro, Grok 3, DeepSeek R1, or leave as **Auto** for best available
+7. Click **Save**
+
+## How Payment Works
+
+When NOFX sends an AI request:
+
+1. Request goes to `https://sol.blockrun.ai/api/v1/chat/completions`
+2. Server responds with HTTP `402 Payment Required` + payment details (nonce, recipient, amount)
+3. NOFX signs the payment message `blockrun-payment:{nonce}:{recipient}:{amount}` with your **Ed25519** private key
+4. Payment signature is attached and request is retried
+5. BlockRun verifies the Ed25519 signature on-chain and routes to the AI model
+
+> **Privacy:** Your private key never leaves your NOFX instance. Only the cryptographic signature is sent.
+
+## Available Models via BlockRun
+
+| Model ID | Provider | Use Case |
+|----------|----------|----------|
+| `gpt-5.4` | OpenAI | Flagship (default) |
+| `claude-opus-4.6` | Anthropic | Flagship |
+| `gemini-3.1-pro` | Google | Flagship |
+| `grok-3` | xAI | Flagship |
+| `deepseek-chat` | DeepSeek | Flagship |
+| `minimax-m2.5` | MiniMax | Flagship |
+
+## Security Best Practices
+
+- ✅ Use a **dedicated trading wallet** with only your AI budget
+- ✅ Keep only a small USDC balance (top up as needed)
+- ✅ Your private key is AES-256 encrypted at rest in NOFX's database
+- ✅ Ed25519 signatures are one-time — each authorizes only one specific payment
+- ❌ Never use your main SOL holdings wallet as the NOFX trading wallet
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| `unexpected key length` | Ensure you exported the full 64-byte keypair (not just the 32-byte seed) |
+| `failed to decode base58` | Key must be base58 encoded (standard Phantom/Solflare export format) |
+| `payment retry failed` | Ensure you have USDC on **Solana mainnet** (not devnet) |
+| No response from server | Check `sol.blockrun.ai` is reachable from your server |
+| Slow responses | Try selecting a specific model instead of "Auto" |
+
+## Monitoring Spend
+
+Check your USDC balance and transaction history at:
+- [Solscan](https://solscan.io) — search your wallet address, filter by USDC token
+- [BlockRun dashboard](https://blockrun.ai) — usage history
+
+---
+
+[← Back to Getting Started](README.md)

go.mod

@@ -12,7 +12,6 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
 	github.com/joho/godotenv v1.5.1
-	github.com/pquerna/otp v1.4.0
 	github.com/rs/zerolog v1.34.0
 	github.com/sirupsen/logrus v1.9.3
 	github.com/sonirico/go-hyperliquid v0.26.0
@@ -22,11 +21,14 @@ require (
 )
 
 require (
+	filippo.io/edwards25519 v1.0.0-rc.1 // indirect
 	github.com/ProjectZKM/Ziren/crates/go-runtime/zkvm_runtime v0.0.0-20251001021608-1fe7b43fc4d6 // indirect
+	github.com/andres-erbsen/clock v0.0.0-20160526145045-9e14626cd129 // indirect
 	github.com/antihax/optional v1.0.0 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/bitly/go-simplejson v0.5.1 // indirect
 	github.com/bits-and-blooms/bitset v1.24.0 // indirect
+	github.com/blendle/zapdriver v1.3.1 // indirect
 	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
 	github.com/bybit-exchange/bybit.go.api v0.0.0-20250727214011-c9347d6804d6 // indirect
 	github.com/bytedance/sonic v1.14.0 // indirect
@@ -44,7 +46,11 @@ require (
 	github.com/elliottech/poseidon_crypto v0.0.11 // indirect
 	github.com/ethereum/c-kzg-4844/v2 v2.1.5 // indirect
 	github.com/ethereum/go-verkle v0.2.2 // indirect
+	github.com/fatih/color v1.16.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
+	github.com/gagliardetto/binary v0.8.0 // indirect
+	github.com/gagliardetto/solana-go v1.14.0 // indirect
+	github.com/gagliardetto/treeout v0.1.4 // indirect
 	github.com/gateio/gateapi-go/v6 v6.104.3 // indirect
 	github.com/gin-contrib/sse v1.1.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
@@ -62,15 +68,20 @@ require (
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/jpillora/backoff v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/compress v1.16.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/lib/pq v1.10.9 // indirect
+	github.com/logrusorgru/aurora v2.0.3+incompatible // indirect
 	github.com/mailru/easyjson v0.9.1 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-sqlite3 v1.14.32 // indirect
+	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/mostynb/zstdpool-freelist v0.0.0-20201229113212-927304c0c3b1 // indirect
+	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
@@ -82,6 +93,7 @@ require (
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sonirico/vago v0.10.0 // indirect
 	github.com/sonirico/vago/lol v0.0.0-20250901170347-2d1d82c510bd // indirect
+	github.com/streamingfast/logging v0.0.0-20230608130331-f22c91403091 // indirect
 	github.com/supranational/blst v0.3.16 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.3.0 // indirect
@@ -91,14 +103,21 @@ require (
 	go.elastic.co/apm/module/apmzerolog/v2 v2.7.1 // indirect
 	go.elastic.co/apm/v2 v2.7.1 // indirect
 	go.elastic.co/fastjson v1.5.1 // indirect
+	go.mongodb.org/mongo-driver v1.12.2 // indirect
+	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/mock v0.5.0 // indirect
+	go.uber.org/multierr v1.6.0 // indirect
+	go.uber.org/ratelimit v0.2.0 // indirect
+	go.uber.org/zap v1.21.0 // indirect
 	golang.org/x/arch v0.20.0 // indirect
 	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
 	golang.org/x/mod v0.27.0 // indirect
 	golang.org/x/net v0.43.0 // indirect
 	golang.org/x/sync v0.17.0 // indirect
 	golang.org/x/sys v0.36.0 // indirect
+	golang.org/x/term v0.35.0 // indirect
 	golang.org/x/text v0.29.0 // indirect
+	golang.org/x/time v0.9.0 // indirect
 	golang.org/x/tools v0.36.0 // indirect
 	google.golang.org/protobuf v1.36.9 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect

go.sum

@@ -1,3 +1,5 @@
+filippo.io/edwards25519 v1.0.0-rc.1 h1:m0VOOB23frXZvAOK44usCgLWvtsxIoMCTBGJZlpmGfU=
+filippo.io/edwards25519 v1.0.0-rc.1/go.mod h1:N1IkdkCkiLB6tki+MYJoSx2JTY9NUlxZE7eHn5EwJns=
 github.com/ProjectZKM/Ziren/crates/go-runtime/zkvm_runtime v0.0.0-20251001021608-1fe7b43fc4d6 h1:1zYrtlhrZ6/b6SAjLSfKzWtdgqK0U+HtH/VcBWh1BaU=
 github.com/ProjectZKM/Ziren/crates/go-runtime/zkvm_runtime v0.0.0-20251001021608-1fe7b43fc4d6/go.mod h1:ioLG6R+5bUSO1oeGSDxOV3FADARuMoytZCSX6MEMQkI=
 github.com/StackExchange/wmi v1.2.1 h1:VIkavFPXSjcnS+O8yTq7NI32k0R5Aj+v39y29VYDOSA=
@@ -8,16 +10,21 @@ github.com/adshao/go-binance/v2 v2.8.9 h1:NX+4u/LgEmrjTS7OMWU+9ZgfHKFM61RPhnr9/S
 github.com/adshao/go-binance/v2 v2.8.9/go.mod h1:XkkuecSyJKPolaCGf/q4ovJYB3t0P+7RUYTbGr+LMGM=
 github.com/agiledragon/gomonkey/v2 v2.13.0 h1:B24Jg6wBI1iB8EFR1c+/aoTg7QN/Cum7YffG8KMIyYo=
 github.com/agiledragon/gomonkey/v2 v2.13.0/go.mod h1:ap1AmDzcVOAz1YpeJ3TCzIgstoaWLA6jbbgxfB4w2iY=
+github.com/andres-erbsen/clock v0.0.0-20160526145045-9e14626cd129 h1:MzBOUgng9orim59UnfUTLRjMpd09C5uEVQ6RPGeCaVI=
+github.com/andres-erbsen/clock v0.0.0-20160526145045-9e14626cd129/go.mod h1:rFgpPQZYZ8vdbc+48xibu8ALc3yeyd64IhHS+PU6Yyg=
 github.com/antihax/optional v1.0.0 h1:xK2lYat7ZLaVVcIuj82J8kIro4V6kDe0AUDFboUCwcg=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/bitly/go-simplejson v0.5.0 h1:6IH+V8/tVMab511d5bn4M7EwGXZf9Hj6i2xSwkNEM+Y=
 github.com/bitly/go-simplejson v0.5.0/go.mod h1:cXHtHw4XUPsvGaxgjIAn8PhEWG9NfngEKAMDJEczWVA=
 github.com/bitly/go-simplejson v0.5.1 h1:xgwPbetQScXt1gh9BmoJ6j9JMr3TElvuIyjR8pgdoow=
 github.com/bitly/go-simplejson v0.5.1/go.mod h1:YOPVLzCfwK14b4Sff3oP1AmGhI9T9Vsg84etUnlyp+Q=
 github.com/bits-and-blooms/bitset v1.24.0 h1:H4x4TuulnokZKvHLfzVRTHJfFfnHEeSYJizujEZvmAM=
 github.com/bits-and-blooms/bitset v1.24.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
+github.com/blendle/zapdriver v1.3.1 h1:C3dydBOWYRiOk+B8X9IVZ5IOe+7cl+tGOexN4QqHfpE=
+github.com/blendle/zapdriver v1.3.1/go.mod h1:mdXfREi6u5MArG4j9fewC+FGnXaBR+T4Ox4J2u4eHCc=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
@@ -66,10 +73,18 @@ github.com/ethereum/go-ethereum v1.16.7 h1:qeM4TvbrWK0UC0tgkZ7NiRsmBGwsjqc64BHo2
 github.com/ethereum/go-ethereum v1.16.7/go.mod h1:Fs6QebQbavneQTYcA39PEKv2+zIjX7rPUZ14DER46wk=
 github.com/ethereum/go-verkle v0.2.2 h1:I2W0WjnrFUIzzVPwm8ykY+7pL2d4VhlsePn4j7cnFk8=
 github.com/ethereum/go-verkle v0.2.2/go.mod h1:M3b90YRnzqKyyzBEWJGqj8Qff4IDeXnzFw0P9bFw3uk=
+github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
+github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
 github.com/ferranbt/fastssz v0.1.4 h1:OCDB+dYDEQDvAgtAGnTSidK1Pe2tW3nFV40XyMkTeDY=
 github.com/ferranbt/fastssz v0.1.4/go.mod h1:Ea3+oeoRGGLGm5shYAeDgu6PGUlcvQhE2fILyD9+tGg=
 github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
 github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
+github.com/gagliardetto/binary v0.8.0 h1:U9ahc45v9HW0d15LoN++vIXSJyqR/pWw8DDlhd7zvxg=
+github.com/gagliardetto/binary v0.8.0/go.mod h1:2tfj51g5o9dnvsc+fL3Jxr22MuWzYXwx9wEoN0XQ7/c=
+github.com/gagliardetto/solana-go v1.14.0 h1:3WfAi70jOOjAJ0deFMjdhFYlLXATF4tOQXsDNWJtOLw=
+github.com/gagliardetto/solana-go v1.14.0/go.mod h1:l/qqqIN6qJJPtxW/G1PF4JtcE3Zg2vD2EliZrr9Gn5k=
+github.com/gagliardetto/treeout v0.1.4 h1:ozeYerrLCmCubo1TcIjFiOWTTGteOOHND1twdFpgwaw=
+github.com/gagliardetto/treeout v0.1.4/go.mod h1:loUefvXTrlRG5rYmJmExNryyBRh8f89VZhmMOyCyqok=
 github.com/gateio/gateapi-go/v6 v6.104.3 h1:JQ2+s1pG4bL+JeLQyGy9c7YLr7hxRI8g7vkAuQYl75k=
 github.com/gateio/gateapi-go/v6 v6.104.3/go.mod h1:racCcjrdyOUbRDO5eCUGUiyDPrF/ZmwBj/bupPZTVLY=
 github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
@@ -99,8 +114,10 @@ github.com/golang-jwt/jwt/v5 v5.2.0 h1:d/ix8ftRUorsN+5eMIlF4T6J8CAt9rch3My2winC1
 github.com/golang-jwt/jwt/v5 v5.2.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
 github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
+github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=
 github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -137,10 +154,18 @@ github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
+github.com/klauspost/compress v1.11.4/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
+github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
+github.com/klauspost/compress v1.16.0 h1:iULayQNOReoYUe+1qtKOqw9CwJv3aNQu8ivo7lw1HU4=
+github.com/klauspost/compress v1.16.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
@@ -151,6 +176,8 @@ github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/logrusorgru/aurora v2.0.3+incompatible h1:tOpm7WcpBTn4fjmVfgpQq0EfczGlG91VSDkswnjF5A8=
+github.com/logrusorgru/aurora v2.0.3+incompatible/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
 github.com/mailru/easyjson v0.9.1 h1:LbtsOm5WAswyWbvTEOqhypdPeZzHavpZx96/n553mR8=
 github.com/mailru/easyjson v0.9.1/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
@@ -166,6 +193,8 @@ github.com/mattn/go-sqlite3 v1.14.32 h1:JD12Ag3oLy1zQA+BNn74xRgaBbdhbNIDYvQUEuuE
 github.com/mattn/go-sqlite3 v1.14.32/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/minio/sha256-simd v1.0.0 h1:v1ta+49hkWZyvaKwrQB8elexRqm6Y0aMLjCNsrYxo6g=
 github.com/minio/sha256-simd v1.0.0/go.mod h1:OuYzVNI5vcoYIAmbIvHPl3N3jUzVedXbKy5RFepssQM=
+github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU=
+github.com/mitchellh/go-testing-interface v1.14.1/go.mod h1:gfgS7OtZj6MA4U1UrDRp04twqAjfvlZyCfX3sDjEym8=
 github.com/mitchellh/mapstructure v1.4.1 h1:CpVNEelQCZBooIPDn+AR3NpivK/TIKU8bDxdASFVQag=
 github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421 h1:ZqeYNhU3OHLH3mGKHDcjJRFFRrJa6eAM5H+CtDdOsPc=
@@ -174,20 +203,24 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
+github.com/mostynb/zstdpool-freelist v0.0.0-20201229113212-927304c0c3b1 h1:mPMvm6X6tf4w8y7j9YIt6V9jfWhL6QlbEc7CCmeQlWk=
+github.com/mostynb/zstdpool-freelist v0.0.0-20201229113212-927304c0c3b1/go.mod h1:ye2e/VUEtE2BHE+G/QcKkcLQVAEJoYRFj5VUOQatCRE=
+github.com/mr-tron/base58 v1.2.0 h1:T/HDJBh4ZCPbU39/+c3rRvE0uKBQlU27+QI8LJ4t64o=
+github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
 github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
 github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg=
-github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
 github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0=
 github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw=
 github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
@@ -205,6 +238,7 @@ github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
 github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
 github.com/shirou/gopsutil v3.21.4-0.20210419000835-c7a38de76ee5+incompatible h1:Bn1aCHHRnjv4Bl16T8rcaFjYSrGrIZvpiGO6P3Q4GpU=
 github.com/shirou/gopsutil v3.21.4-0.20210419000835-c7a38de76ee5+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA=
+github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
@@ -221,12 +255,15 @@ github.com/sonirico/vago v0.10.0 h1:y+4Wo56tK+88a5lUwVrZUO2RRLaPcBgjI5cupKpT1Oc=
 github.com/sonirico/vago v0.10.0/go.mod h1:HCfnyPHId7V+zBZ5BLfIsdHIO+ewo6+uhF1N0hxlldc=
 github.com/sonirico/vago/lol v0.0.0-20250901170347-2d1d82c510bd h1:rbvNORW8/0AtH/8W/SUwUykbuh2SeQBrNgFLqYpGTWY=
 github.com/sonirico/vago/lol v0.0.0-20250901170347-2d1d82c510bd/go.mod h1:pteYccB32seEf19i0TPk7DKdEZdWJ/n9K9DF8AFeXGU=
+github.com/streamingfast/logging v0.0.0-20230608130331-f22c91403091 h1:RN5mrigyirb8anBEtdjtHFIufXdacyTi6i4KBfeNXeo=
+github.com/streamingfast/logging v0.0.0-20230608130331-f22c91403091/go.mod h1:VlduQ80JcGJSargkRU4Sg9Xo63wZD/l8A5NC/Uo1/uU=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
@@ -235,6 +272,7 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/supranational/blst v0.3.16 h1:bTDadT+3fK497EvLdWRQEjiGnUtzJ7jjIUMF0jqwYhE=
 github.com/supranational/blst v0.3.16/go.mod h1:jZJtfjgudtNl4en1tzwPIV3KjUnQUvG3/j+w+fVonLw=
+github.com/test-go/testify v1.1.4/go.mod h1:rH7cfJo/47vWGdi4GPj16x3/t1xGOj2YxzmNQzk2ghU=
 github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
 github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
 github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
@@ -251,53 +289,120 @@ github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IU
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
+github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
+github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3kKLN4=
+github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
+github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
+github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.elastic.co/apm/module/apmzerolog/v2 v2.7.1 h1:C9+KrlqS8F4SZFu+ct0Jmv2YLmzDhWsI8htK6exd3vg=
 go.elastic.co/apm/module/apmzerolog/v2 v2.7.1/go.mod h1:wXViB7paxMUrERgZrmUb+0FCqgb13Dull1JOOd8Hcj0=
 go.elastic.co/apm/v2 v2.7.1 h1:OFjARuESjBsxw7wHrEAnfSVNCHGBATXSI/kPvBARY/A=
 go.elastic.co/apm/v2 v2.7.1/go.mod h1:tQhBAjwh93b2leuAdzGwta/sP7Yc7QoKTSjeIHHDuog=
 go.elastic.co/fastjson v1.5.1 h1:zeh1xHrFH79aQ6Xsw7YxixvnOdAl3OSv0xch/jRDzko=
 go.elastic.co/fastjson v1.5.1/go.mod h1:WtvH5wz8z9pDOPqNYSYKoLLv/9zCWZLeejHWuvdL/EM=
+go.mongodb.org/mongo-driver v1.12.2 h1:gbWY1bJkkmUB9jjZzcdhOL8O85N9H+Vvsf2yFN0RDws=
+go.mongodb.org/mongo-driver v1.12.2/go.mod h1:/rGBTebI3XYboVmgz+Wv3Bcbl3aD0QF9zl6kDDw18rQ=
+go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw=
+go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
 go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
 go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
+go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4=
+go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
+go.uber.org/ratelimit v0.2.0 h1:UQE2Bgi7p2B85uP5dC2bbRtig0C+OeNRnNEafLjsLPA=
+go.uber.org/ratelimit v0.2.0/go.mod h1:YYBV4e4naJvhpitQrWJu1vCpgB7CboMe0qhltKt6mUg=
+go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+go.uber.org/zap v1.21.0 h1:WefMeulhovoZ2sYXz7st6K0sLj7bBhpiFaud4r4zST8=
+go.uber.org/zap v1.21.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw=
 golang.org/x/arch v0.20.0 h1:dx1zTU0MAE98U+TQ8BLl7XsJbgze2WnNKF/8tGp/Q6c=
 golang.org/x/arch v0.20.0/go.mod h1:bdwinDaKcfZUGpH09BB7ZmOfhalA8lQdzl62l8gGWsk=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20220214200702-86341886e292/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
 golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
 golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
 golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
+golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
 golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
 golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
 golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
 golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ=
+golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
 golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
 golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
 google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/dnaeon/go-vcr.v4 v4.0.5 h1:I0hpTIvD5rII+8LgYGrHMA2d4SQPoL6u7ZvJakWKsiA=
 gopkg.in/dnaeon/go-vcr.v4 v4.0.5/go.mod h1:dRos81TkW9C1WJt6tTaE+uV2Lo8qJT3AG2b35+CB/nQ=
 gopkg.in/dnaeon/go-vcr.v4 v4.0.6 h1:PiJkrakkmzc5s7EfBnZOnyiLwi7o7A9fwPzN0X2uwe0=
 gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gorm.io/driver/postgres v1.6.0 h1:2dxzU8xJ+ivvqTRph34QX+WrRaJlmfyPqXmoGVjMBa4=

kernel/engine.go

@@ -1,6 +1,7 @@
 package kernel
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -8,6 +9,7 @@ import (
 	"nofx/logger"
 	"nofx/market"
 	"nofx/mcp"
+	"nofx/provider/hyperliquid"
 	"nofx/provider/nofxos"
 	"nofx/security"
 	"nofx/store"
@@ -490,6 +492,44 @@ func (e *StrategyEngine) GetCandidateCoins() ([]CandidateCoin, error) {
 		// 空列表是正常情况，直接返回
 		return e.filterExcludedCoins(coins), nil
 
+	case "hyper_all":
+		// All Hyperliquid perp coins
+		if !coinSource.UseHyperAll {
+			logger.Infof("⚠️  source_type is 'hyper_all' but use_hyper_all is false, falling back to static coins")
+			for _, symbol := range coinSource.StaticCoins {
+				symbol = market.Normalize(symbol)
+				candidates = append(candidates, CandidateCoin{
+					Symbol:  symbol,
+					Sources: []string{"static"},
+				})
+			}
+			return e.filterExcludedCoins(candidates), nil
+		}
+		coins, err := e.getHyperAllCoins()
+		if err != nil {
+			return nil, err
+		}
+		return e.filterExcludedCoins(coins), nil
+
+	case "hyper_main":
+		// Top N Hyperliquid coins by 24h volume
+		if !coinSource.UseHyperMain {
+			logger.Infof("⚠️  source_type is 'hyper_main' but use_hyper_main is false, falling back to static coins")
+			for _, symbol := range coinSource.StaticCoins {
+				symbol = market.Normalize(symbol)
+				candidates = append(candidates, CandidateCoin{
+					Symbol:  symbol,
+					Sources: []string{"static"},
+				})
+			}
+			return e.filterExcludedCoins(candidates), nil
+		}
+		coins, err := e.getHyperMainCoins(coinSource.HyperMainLimit)
+		if err != nil {
+			return nil, err
+		}
+		return e.filterExcludedCoins(coins), nil
+
 	case "mixed":
 		if coinSource.UseAI500 {
 			poolCoins, err := e.getAI500Coins(coinSource.AI500Limit)
@@ -524,6 +564,28 @@ func (e *StrategyEngine) GetCandidateCoins() ([]CandidateCoin, error) {
 			}
 		}
 
+		if coinSource.UseHyperAll {
+			hyperCoins, err := e.getHyperAllCoins()
+			if err != nil {
+				logger.Infof("⚠️  Failed to get Hyperliquid All coins: %v", err)
+			} else {
+				for _, coin := range hyperCoins {
+					symbolSources[coin.Symbol] = append(symbolSources[coin.Symbol], "hyper_all")
+				}
+			}
+		}
+
+		if coinSource.UseHyperMain {
+			hyperMainCoins, err := e.getHyperMainCoins(coinSource.HyperMainLimit)
+			if err != nil {
+				logger.Infof("⚠️  Failed to get Hyperliquid Main coins: %v", err)
+			} else {
+				for _, coin := range hyperMainCoins {
+					symbolSources[coin.Symbol] = append(symbolSources[coin.Symbol], "hyper_main")
+				}
+			}
+		}
+
 		for _, symbol := range coinSource.StaticCoins {
 			symbol = market.Normalize(symbol)
 			if _, exists := symbolSources[symbol]; !exists {
@@ -640,6 +702,52 @@ func (e *StrategyEngine) getOILowCoins(limit int) ([]CandidateCoin, error) {
 	return candidates, nil
 }
 
+// getHyperAllCoins returns all available Hyperliquid perpetual coins
+func (e *StrategyEngine) getHyperAllCoins() ([]CandidateCoin, error) {
+	ctx := context.Background()
+	symbols, err := hyperliquid.GetAllCoinSymbols(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get Hyperliquid coins: %w", err)
+	}
+
+	var candidates []CandidateCoin
+	for _, symbol := range symbols {
+		// Add USDT suffix for compatibility
+		normalizedSymbol := market.Normalize(symbol + "USDT")
+		candidates = append(candidates, CandidateCoin{
+			Symbol:  normalizedSymbol,
+			Sources: []string{"hyper_all"},
+		})
+	}
+	logger.Infof("✅ Loaded %d Hyperliquid coins (hyper_all)", len(candidates))
+	return candidates, nil
+}
+
+// getHyperMainCoins returns top N Hyperliquid coins by 24h volume
+func (e *StrategyEngine) getHyperMainCoins(limit int) ([]CandidateCoin, error) {
+	if limit <= 0 {
+		limit = 20
+	}
+
+	ctx := context.Background()
+	symbols, err := hyperliquid.GetMainCoinSymbols(ctx, limit)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get Hyperliquid main coins: %w", err)
+	}
+
+	var candidates []CandidateCoin
+	for _, symbol := range symbols {
+		// Add USDT suffix for compatibility
+		normalizedSymbol := market.Normalize(symbol + "USDT")
+		candidates = append(candidates, CandidateCoin{
+			Symbol:  normalizedSymbol,
+			Sources: []string{"hyper_main"},
+		})
+	}
+	logger.Infof("✅ Loaded %d Hyperliquid main coins (hyper_main) by 24h volume", len(candidates))
+	return candidates, nil
+}
+
 // ============================================================================
 // External & Quant Data
 // ============================================================================
@@ -1350,6 +1458,8 @@ func (e *StrategyEngine) formatCoinSourceTag(sources []string) string {
 		hasAI500 := false
 		hasOITop := false
 		hasOILow := false
+		hasHyperAll := false
+		hasHyperMain := false
 		for _, s := range sources {
 			switch s {
 			case "ai500":
@@ -1358,6 +1468,10 @@ func (e *StrategyEngine) formatCoinSourceTag(sources []string) string {
 				hasOITop = true
 			case "oi_low":
 				hasOILow = true
+			case "hyper_all":
+				hasHyperAll = true
+			case "hyper_main":
+				hasHyperMain = true
 			}
 		}
 		if hasAI500 && hasOITop {
@@ -1369,6 +1483,12 @@ func (e *StrategyEngine) formatCoinSourceTag(sources []string) string {
 		if hasOITop && hasOILow {
 			return " (OI_Top+OI_Low)"
 		}
+		if hasHyperMain && hasAI500 {
+			return " (HyperMain+AI500)"
+		}
+		if hasHyperAll || hasHyperMain {
+			return " (Hyperliquid)"
+		}
 		return " (Multiple sources)"
 	} else if len(sources) == 1 {
 		switch sources[0] {
@@ -1380,6 +1500,10 @@ func (e *StrategyEngine) formatCoinSourceTag(sources []string) string {
 			return " (OI_Low 持仓减少)"
 		case "static":
 			return " (Manual selection)"
+		case "hyper_all":
+			return " (Hyperliquid All)"
+		case "hyper_main":
+			return " (Hyperliquid Top20)"
 		}
 	}
 	return ""

main.go

@@ -11,6 +11,7 @@ import (
 	"nofx/manager"
 	"nofx/mcp"
 	"nofx/store"
+	"nofx/telegram"
 	"os"
 	"os/signal"
 	"path/filepath"
@@ -130,12 +131,21 @@ func main() {
 
 	// Start API server
 	server := api.NewServer(traderManager, st, cryptoService, backtestManager, cfg.APIServerPort)
+
+	// Create hot-reload channel for Telegram bot; wire it to the API server
+	// so that POST /api/telegram can trigger a bot restart when the token changes.
+	telegramReloadCh := make(chan struct{}, 1)
+	server.SetTelegramReloadCh(telegramReloadCh)
+
 	go func() {
 		if err := server.Start(); err != nil {
 			logger.Fatalf("❌ Failed to start API server: %v", err)
 		}
 	}()
 
+	// Start Telegram bot (if TELEGRAM_BOT_TOKEN is configured)
+	go telegram.Start(cfg, st, telegramReloadCh)
+
 	// Wait for interrupt signal
 	quit := make(chan os.Signal, 1)
 	signal.Notify(quit, syscall.SIGINT, syscall.SIGTERM)

manager/trader_manager.go

@@ -407,7 +407,6 @@ func (tm *TraderManager) GetTopTradersData() (map[string]interface{}, error) {
 	return result, nil
 }
 
-
 // RemoveTrader removes a trader from memory (does not affect database)
 // Used to force reload when updating trader configuration
 // If the trader is running, it will be stopped first
@@ -664,11 +663,11 @@ func (tm *TraderManager) addTraderFromStore(traderCfg *store.Trader, aiModelCfg
 		QwenKey:               "",
 		CustomAPIURL:          aiModelCfg.CustomAPIURL,
 		CustomModelName:       aiModelCfg.CustomModelName,
-		ScanInterval:         time.Duration(traderCfg.ScanIntervalMinutes) * time.Minute,
-		InitialBalance:       traderCfg.InitialBalance,
-		IsCrossMargin:        traderCfg.IsCrossMargin,
-		ShowInCompetition:    traderCfg.ShowInCompetition,
-		StrategyConfig:       strategyConfig,
+		ScanInterval:          time.Duration(traderCfg.ScanIntervalMinutes) * time.Minute,
+		InitialBalance:        traderCfg.InitialBalance,
+		IsCrossMargin:         traderCfg.IsCrossMargin,
+		ShowInCompetition:     traderCfg.ShowInCompetition,
+		StrategyConfig:        strategyConfig,
 	}
 
 	logger.Infof("📊 Loading trader %s: ScanIntervalMinutes=%d (from DB), ScanInterval=%v",
@@ -700,6 +699,7 @@ func (tm *TraderManager) addTraderFromStore(traderCfg *store.Trader, aiModelCfg
 	case "hyperliquid":
 		traderConfig.HyperliquidPrivateKey = string(exchangeCfg.APIKey)
 		traderConfig.HyperliquidWalletAddr = exchangeCfg.HyperliquidWalletAddr
+		traderConfig.HyperliquidUnifiedAcct = exchangeCfg.HyperliquidUnifiedAcct
 	case "aster":
 		traderConfig.AsterUser = exchangeCfg.AsterUser
 		traderConfig.AsterSigner = exchangeCfg.AsterSigner
@@ -710,6 +710,9 @@ func (tm *TraderManager) addTraderFromStore(traderCfg *store.Trader, aiModelCfg
 		traderConfig.LighterAPIKeyPrivateKey = string(exchangeCfg.LighterAPIKeyPrivateKey)
 		traderConfig.LighterAPIKeyIndex = exchangeCfg.LighterAPIKeyIndex
 		traderConfig.LighterTestnet = exchangeCfg.Testnet
+	case "indodax":
+		traderConfig.IndodaxAPIKey = string(exchangeCfg.APIKey)
+		traderConfig.IndodaxSecretKey = string(exchangeCfg.SecretKey)
 	}
 
 	// Set API keys based on AI model (convert EncryptedString to string)

mcp/blockrun_base.go

@@ -0,0 +1,345 @@
+package mcp
+
+import (
+	"crypto/ecdsa"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"math/big"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/ethereum/go-ethereum/crypto"
+	"golang.org/x/crypto/sha3"
+)
+
+const (
+	ProviderBlockRunBase   = "blockrun-base"
+	DefaultBlockRunBaseURL = "https://blockrun.ai"
+	DefaultBlockRunModel = "gpt-5.4"
+	BlockRunChatEndpoint   = "/api/v1/chat/completions"
+	BaseUSDCContract       = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"
+	BaseChainID      int64 = 8453
+	BaseNetwork            = "eip155:8453"
+)
+
+// EIP-712 type hashes for USDC TransferWithAuthorization (ERC-3009)
+var (
+	eip712DomainTypeHash    = keccak256String("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)")
+	transferWithAuthTypeHash = keccak256String("TransferWithAuthorization(address from,address to,uint256 value,uint256 validAfter,uint256 validBefore,bytes32 nonce)")
+)
+
+func keccak256String(s string) []byte {
+	h := sha3.NewLegacyKeccak256()
+	h.Write([]byte(s))
+	return h.Sum(nil)
+}
+
+func keccak256Bytes(data ...[]byte) []byte {
+	h := sha3.NewLegacyKeccak256()
+	for _, b := range data {
+		h.Write(b)
+	}
+	return h.Sum(nil)
+}
+
+// BlockRunBaseClient implements AIClient using BlockRun's API with x402 v2 EIP-712 payment signing.
+type BlockRunBaseClient struct {
+	*Client
+	privateKey *ecdsa.PrivateKey
+}
+
+// NewBlockRunBaseClient creates a BlockRun Base wallet client (backward compatible).
+func NewBlockRunBaseClient() AIClient {
+	return NewBlockRunBaseClientWithOptions()
+}
+
+// NewBlockRunBaseClientWithOptions creates a BlockRun Base wallet client.
+func NewBlockRunBaseClientWithOptions(opts ...ClientOption) AIClient {
+	baseOpts := []ClientOption{
+		WithProvider(ProviderBlockRunBase),
+		WithModel(DefaultBlockRunModel),
+		WithBaseURL(DefaultBlockRunBaseURL),
+	}
+	allOpts := append(baseOpts, opts...)
+	baseClient := NewClient(allOpts...).(*Client)
+	baseClient.UseFullURL = true
+	baseClient.BaseURL = DefaultBlockRunBaseURL + BlockRunChatEndpoint
+
+	c := &BlockRunBaseClient{Client: baseClient}
+	baseClient.hooks = c
+	return c
+}
+
+// SetAPIKey stores the EVM private key (hex, with or without 0x prefix).
+// customModel selects the AI model to use (e.g. "claude-sonnet-4.6"); empty means default.
+func (c *BlockRunBaseClient) SetAPIKey(apiKey string, customURL string, customModel string) {
+	hexKey := strings.TrimPrefix(apiKey, "0x")
+	privKey, err := crypto.HexToECDSA(hexKey)
+	if err != nil {
+		c.logger.Warnf("⚠️  [MCP] BlockRun Base: invalid private key: %v", err)
+	} else {
+		c.privateKey = privKey
+		c.APIKey = apiKey
+		addr := crypto.PubkeyToAddress(privKey.PublicKey).Hex()
+		c.logger.Infof("🔧 [MCP] BlockRun Base wallet: %s", addr)
+	}
+	if customModel != "" {
+		c.Model = customModel
+		c.logger.Infof("🔧 [MCP] BlockRun Base model: %s", customModel)
+	} else {
+		c.logger.Infof("🔧 [MCP] BlockRun Base model: %s", DefaultBlockRunModel)
+	}
+}
+
+func (c *BlockRunBaseClient) setAuthHeader(h http.Header) { x402SetAuthHeader(h) }
+
+func (c *BlockRunBaseClient) call(systemPrompt, userPrompt string) (string, error) {
+	return x402Call(c.Client, c.signPayment, "BlockRun Base", systemPrompt, userPrompt)
+}
+
+func (c *BlockRunBaseClient) CallWithRequestFull(req *Request) (*LLMResponse, error) {
+	return x402CallFull(c.Client, c.signPayment, "BlockRun Base", req)
+}
+
+// signPayment parses the Payment-Required header (x402 v2) and returns a signed payment value.
+func (c *BlockRunBaseClient) signPayment(paymentHeaderB64 string) (string, error) {
+	return signBasePaymentHeader(c.privateKey, paymentHeaderB64, "BlockRun Base")
+}
+
+// signX402Payment is the shared EIP-712 signing logic for x402 v2 on Base USDC.
+// Used by both BlockRunBaseClient and Claw402Client.
+func signX402Payment(privateKey *ecdsa.PrivateKey, senderAddr string, opt x402AcceptOption, resource *x402Resource) (string, error) {
+	recipient := opt.PayTo
+	amount := opt.Amount
+	network := opt.Network
+	asset := opt.Asset
+	extra := opt.Extra
+	maxTimeout := opt.MaxTimeoutSeconds
+	if maxTimeout == 0 {
+		maxTimeout = 300
+	}
+
+	resourceURL := ""
+	resourceDesc := ""
+	resourceMime := "application/json"
+	if resource != nil {
+		resourceURL = resource.URL
+		resourceDesc = resource.Description
+		resourceMime = resource.MimeType
+	}
+
+	now := time.Now().Unix()
+	validAfter := int64(0)
+	validBefore := now + int64(maxTimeout)
+
+	nonceBytes := make([]byte, 32)
+	if _, err := rand.Read(nonceBytes); err != nil {
+		return "", fmt.Errorf("failed to generate nonce: %w", err)
+	}
+	nonce := "0x" + hex.EncodeToString(nonceBytes)
+
+	domainName := "USD Coin"
+	domainVersion := "2"
+	if extra != nil {
+		if v, ok := extra["name"]; ok && v != "" {
+			domainName = v
+		}
+		if v, ok := extra["version"]; ok && v != "" {
+			domainVersion = v
+		}
+	}
+
+	domainSeparator, err := buildDomainSeparatorDynamic(domainName, domainVersion, network, asset)
+	if err != nil {
+		return "", fmt.Errorf("failed to build domain separator: %w", err)
+	}
+
+	amountBig, err := parseBigInt(amount)
+	if err != nil {
+		return "", fmt.Errorf("invalid amount: %w", err)
+	}
+
+	structHash, err := buildTransferWithAuthHashDynamic(senderAddr, recipient, amountBig, validAfter, validBefore, nonce)
+	if err != nil {
+		return "", fmt.Errorf("failed to build struct hash: %w", err)
+	}
+
+	digest := make([]byte, 0, 66)
+	digest = append(digest, 0x19, 0x01)
+	digest = append(digest, domainSeparator...)
+	digest = append(digest, structHash...)
+	hash := keccak256Bytes(digest)
+
+	sig, err := crypto.Sign(hash, privateKey)
+	if err != nil {
+		return "", fmt.Errorf("failed to sign: %w", err)
+	}
+	if sig[64] < 27 {
+		sig[64] += 27
+	}
+
+	sigHex := "0x" + hex.EncodeToString(sig)
+
+	paymentData := map[string]interface{}{
+		"x402Version": 2,
+		"resource": map[string]string{
+			"url":         resourceURL,
+			"description": resourceDesc,
+			"mimeType":    resourceMime,
+		},
+		"accepted": map[string]interface{}{
+			"scheme":            "exact",
+			"network":           network,
+			"amount":            amount,
+			"asset":             asset,
+			"payTo":             recipient,
+			"maxTimeoutSeconds": maxTimeout,
+			"extra":             extra,
+		},
+		"payload": map[string]interface{}{
+			"signature": sigHex,
+			"authorization": map[string]string{
+				"from":        senderAddr,
+				"to":          recipient,
+				"value":       amount,
+				"validAfter":  fmt.Sprintf("%d", validAfter),
+				"validBefore": fmt.Sprintf("%d", validBefore),
+				"nonce":       nonce,
+			},
+		},
+		"extensions": map[string]interface{}{},
+	}
+
+	resultJSON, err := json.Marshal(paymentData)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal payment result: %w", err)
+	}
+
+	return base64.StdEncoding.EncodeToString(resultJSON), nil
+}
+
+// buildDomainSeparatorDynamic builds the EIP-712 domain separator using runtime values.
+func buildDomainSeparatorDynamic(name, version, network, asset string) ([]byte, error) {
+	// Extract chain ID from network string like "eip155:8453"
+	chainID := new(big.Int).SetInt64(BaseChainID)
+	if strings.HasPrefix(network, "eip155:") {
+		parts := strings.SplitN(network, ":", 2)
+		if len(parts) == 2 {
+			if n, ok := new(big.Int).SetString(parts[1], 10); ok {
+				chainID = n
+			}
+		}
+	}
+
+	contractAddr, err := hex.DecodeString(strings.TrimPrefix(asset, "0x"))
+	if err != nil {
+		return nil, fmt.Errorf("invalid contract address: %w", err)
+	}
+
+	nameHash := keccak256String(name)
+	versionHash := keccak256String(version)
+
+	encoded := make([]byte, 0, 5*32)
+	encoded = append(encoded, leftPad32(eip712DomainTypeHash)...)
+	encoded = append(encoded, leftPad32(nameHash)...)
+	encoded = append(encoded, leftPad32(versionHash)...)
+	encoded = append(encoded, leftPad32(chainID.Bytes())...)
+	addrPadded := make([]byte, 32)
+	copy(addrPadded[32-len(contractAddr):], contractAddr)
+	encoded = append(encoded, addrPadded...)
+
+	return keccak256Bytes(encoded), nil
+}
+
+// buildTransferWithAuthHashDynamic builds the struct hash for TransferWithAuthorization.
+func buildTransferWithAuthHashDynamic(from, to string, value *big.Int, validAfter, validBefore int64, nonce string) ([]byte, error) {
+	fromBytes, err := hexToAddress(from)
+	if err != nil {
+		return nil, fmt.Errorf("invalid from address: %w", err)
+	}
+	toBytes, err := hexToAddress(to)
+	if err != nil {
+		return nil, fmt.Errorf("invalid to address: %w", err)
+	}
+	nonceBytes, err := hexToBytes32(nonce)
+	if err != nil {
+		return nil, fmt.Errorf("invalid nonce: %w", err)
+	}
+
+	validAfterBig := new(big.Int).SetInt64(validAfter)
+	validBeforeBig := new(big.Int).SetInt64(validBefore)
+
+	encoded := make([]byte, 0, 7*32)
+	encoded = append(encoded, leftPad32(transferWithAuthTypeHash)...)
+	encoded = append(encoded, leftPad32(fromBytes)...)
+	encoded = append(encoded, leftPad32(toBytes)...)
+	encoded = append(encoded, leftPad32(value.Bytes())...)
+	encoded = append(encoded, leftPad32(validAfterBig.Bytes())...)
+	encoded = append(encoded, leftPad32(validBeforeBig.Bytes())...)
+	encoded = append(encoded, leftPad32(nonceBytes)...)
+
+	return keccak256Bytes(encoded), nil
+}
+
+func hexToAddress(s string) ([]byte, error) {
+	s = strings.TrimPrefix(s, "0x")
+	b, err := hex.DecodeString(s)
+	if err != nil {
+		return nil, err
+	}
+	if len(b) != 20 {
+		return nil, fmt.Errorf("address must be 20 bytes, got %d", len(b))
+	}
+	return b, nil
+}
+
+func hexToBytes32(s string) ([]byte, error) {
+	s = strings.TrimPrefix(s, "0x")
+	b, err := hex.DecodeString(s)
+	if err != nil {
+		return nil, err
+	}
+	if len(b) > 32 {
+		return nil, fmt.Errorf("nonce too long: %d bytes", len(b))
+	}
+	return b, nil
+}
+
+func parseBigInt(s string) (*big.Int, error) {
+	n := new(big.Int)
+	// Only treat as hex when explicitly prefixed with 0x/0X.
+	// x402 amounts are always decimal strings (e.g. "3000" = 0.003 USDC).
+	if strings.HasPrefix(s, "0x") || strings.HasPrefix(s, "0X") {
+		if _, ok := n.SetString(s[2:], 16); ok {
+			return n, nil
+		}
+		return nil, fmt.Errorf("cannot parse hex big.Int from %q", s)
+	}
+	if _, ok := n.SetString(s, 10); ok {
+		return n, nil
+	}
+	return nil, fmt.Errorf("cannot parse big.Int from %q", s)
+}
+
+// leftPad32 pads a byte slice to 32 bytes on the left (ABI encoding).
+func leftPad32(b []byte) []byte {
+	if len(b) >= 32 {
+		return b[:32]
+	}
+	padded := make([]byte, 32)
+	copy(padded[32-len(b):], b)
+	return padded
+}
+
+// buildUrl returns the full BlockRun endpoint URL.
+func (c *BlockRunBaseClient) buildUrl() string {
+	return DefaultBlockRunBaseURL + BlockRunChatEndpoint
+}
+
+func (c *BlockRunBaseClient) buildRequest(url string, jsonData []byte) (*http.Request, error) {
+	return x402BuildRequest(url, jsonData)
+}

mcp/blockrun_sol.go

@@ -0,0 +1,277 @@
+package mcp
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gagliardetto/solana-go"
+	"github.com/gagliardetto/solana-go/programs/compute-budget"
+	"github.com/gagliardetto/solana-go/programs/token"
+	"github.com/gagliardetto/solana-go/rpc"
+)
+
+const (
+	ProviderBlockRunSol   = "blockrun-sol"
+	DefaultBlockRunSolURL = "https://sol.blockrun.ai"
+	SolanaUSDCMint        = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v"
+	SolanaNetwork         = "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"
+	SolanaMainnetRPC      = "https://api.mainnet-beta.solana.com"
+
+	// Compute budget defaults (match @x402/svm)
+	computeUnitLimit = uint32(8000)
+	computeUnitPrice = uint64(1)
+)
+
+// BlockRunSolClient implements AIClient using BlockRun's Solana x402 v2 payment protocol.
+type BlockRunSolClient struct {
+	*Client
+	keypair solana.PrivateKey
+}
+
+// NewBlockRunSolClient creates a BlockRun Solana wallet client (backward compatible).
+func NewBlockRunSolClient() AIClient {
+	return NewBlockRunSolClientWithOptions()
+}
+
+// NewBlockRunSolClientWithOptions creates a BlockRun Solana wallet client.
+func NewBlockRunSolClientWithOptions(opts ...ClientOption) AIClient {
+	baseOpts := []ClientOption{
+		WithProvider(ProviderBlockRunSol),
+		WithModel(DefaultBlockRunModel),
+		WithBaseURL(DefaultBlockRunSolURL),
+	}
+	allOpts := append(baseOpts, opts...)
+	baseClient := NewClient(allOpts...).(*Client)
+	baseClient.UseFullURL = true
+	baseClient.BaseURL = DefaultBlockRunSolURL + BlockRunChatEndpoint
+
+	c := &BlockRunSolClient{Client: baseClient}
+	baseClient.hooks = c
+	return c
+}
+
+// SetAPIKey stores the Solana wallet private key (base58-encoded 64-byte keypair).
+// customModel selects the AI model; empty means default.
+func (c *BlockRunSolClient) SetAPIKey(apiKey string, customURL string, customModel string) {
+	kp, err := solana.PrivateKeyFromBase58(strings.TrimSpace(apiKey))
+	if err != nil {
+		c.logger.Warnf("⚠️  [MCP] BlockRun Sol: failed to parse private key: %v", err)
+		return
+	}
+	c.keypair = kp
+	c.APIKey = apiKey
+	c.logger.Infof("🔧 [MCP] BlockRun Sol wallet: %s", kp.PublicKey().String())
+
+	if customModel != "" {
+		c.Model = customModel
+		c.logger.Infof("🔧 [MCP] BlockRun Sol model: %s", customModel)
+	} else {
+		c.logger.Infof("🔧 [MCP] BlockRun Sol model: %s", DefaultBlockRunModel)
+	}
+}
+
+func (c *BlockRunSolClient) setAuthHeader(h http.Header) { x402SetAuthHeader(h) }
+
+func (c *BlockRunSolClient) call(systemPrompt, userPrompt string) (string, error) {
+	return x402Call(c.Client, c.signSolanaPayment, "BlockRun Sol", systemPrompt, userPrompt)
+}
+
+func (c *BlockRunSolClient) CallWithRequestFull(req *Request) (*LLMResponse, error) {
+	return x402CallFull(c.Client, c.signSolanaPayment, "BlockRun Sol", req)
+}
+
+// signSolanaPayment parses the Payment-Required header and builds a signed x402 v2 Solana payload.
+func (c *BlockRunSolClient) signSolanaPayment(paymentHeaderB64 string) (string, error) {
+	if c.keypair == nil {
+		return "", fmt.Errorf("no private key set for BlockRun Sol wallet")
+	}
+
+	decoded, err := x402DecodeHeader(paymentHeaderB64)
+	if err != nil {
+		return "", err
+	}
+
+	var req x402v2PaymentRequired
+	if err := json.Unmarshal(decoded, &req); err != nil {
+		return "", fmt.Errorf("failed to parse x402 v2 Solana header: %w", err)
+	}
+
+	// Find the Solana option
+	var opt *x402AcceptOption
+	for i := range req.Accepts {
+		if strings.HasPrefix(req.Accepts[i].Network, "solana:") {
+			opt = &req.Accepts[i]
+			break
+		}
+	}
+	if opt == nil {
+		return "", fmt.Errorf("no Solana payment option in x402 response")
+	}
+
+	recipient := opt.PayTo
+	amount := opt.Amount
+	feePayer := ""
+	if opt.Extra != nil {
+		feePayer = opt.Extra["feePayer"]
+	}
+	if feePayer == "" {
+		return "", fmt.Errorf("feePayer missing from Solana x402 extra")
+	}
+
+	maxTimeout := opt.MaxTimeoutSeconds
+	if maxTimeout == 0 {
+		maxTimeout = 300
+	}
+
+	resourceURL := DefaultBlockRunSolURL + BlockRunChatEndpoint
+	resourceDesc := ""
+	resourceMime := "application/json"
+	if req.Resource != nil {
+		resourceURL = req.Resource.URL
+		resourceDesc = req.Resource.Description
+		resourceMime = req.Resource.MimeType
+	}
+
+	// Build the SPL TransferChecked transaction
+	txB64, err := c.buildSolanaTransferTx(recipient, feePayer, amount)
+	if err != nil {
+		return "", fmt.Errorf("failed to build Solana transfer tx: %w", err)
+	}
+
+	// Build x402 v2 payment payload
+	paymentData := map[string]interface{}{
+		"x402Version": 2,
+		"resource": map[string]string{
+			"url":         resourceURL,
+			"description": resourceDesc,
+			"mimeType":    resourceMime,
+		},
+		"accepted": map[string]interface{}{
+			"scheme":            "exact",
+			"network":           SolanaNetwork,
+			"amount":            amount,
+			"asset":             SolanaUSDCMint,
+			"payTo":             recipient,
+			"maxTimeoutSeconds": maxTimeout,
+			"extra":             opt.Extra,
+		},
+		"payload": map[string]string{
+			"transaction": txB64,
+		},
+		"extensions": map[string]interface{}{},
+	}
+
+	resultJSON, err := json.Marshal(paymentData)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal Solana payment: %w", err)
+	}
+
+	return base64.StdEncoding.EncodeToString(resultJSON), nil
+}
+
+// buildSolanaTransferTx builds a partial-signed VersionedTransaction for SPL USDC TransferChecked.
+// The fee payer (CDP facilitator) slot is left with a zero signature; only the user signs.
+func (c *BlockRunSolClient) buildSolanaTransferTx(recipient, feePayer, amountStr string) (string, error) {
+	ownerPubkey := c.keypair.PublicKey()
+
+	// Parse recipient and feePayer
+	recipientPK, err := solana.PublicKeyFromBase58(recipient)
+	if err != nil {
+		return "", fmt.Errorf("invalid recipient address: %w", err)
+	}
+	feePayerPK, err := solana.PublicKeyFromBase58(feePayer)
+	if err != nil {
+		return "", fmt.Errorf("invalid feePayer address: %w", err)
+	}
+	mintPK := solana.MustPublicKeyFromBase58(SolanaUSDCMint)
+
+	// Parse amount
+	var amountU64 uint64
+	if _, err := fmt.Sscanf(amountStr, "%d", &amountU64); err != nil {
+		return "", fmt.Errorf("invalid amount %q: %w", amountStr, err)
+	}
+
+	// Derive ATAs
+	sourceATA, _, err := solana.FindAssociatedTokenAddress(ownerPubkey, mintPK)
+	if err != nil {
+		return "", fmt.Errorf("failed to derive source ATA: %w", err)
+	}
+	destATA, _, err := solana.FindAssociatedTokenAddress(recipientPK, mintPK)
+	if err != nil {
+		return "", fmt.Errorf("failed to derive dest ATA: %w", err)
+	}
+
+	// Fetch latest blockhash from Solana mainnet
+	rpcClient := rpc.New(SolanaMainnetRPC)
+	bhResp, err := rpcClient.GetLatestBlockhash(context.Background(), rpc.CommitmentFinalized)
+	if err != nil {
+		return "", fmt.Errorf("failed to fetch blockhash: %w", err)
+	}
+	recentBlockhash := bhResp.Value.Blockhash
+
+	// Build instructions: ComputeBudgetSetLimit, ComputeBudgetSetPrice, TransferChecked
+	setLimitIx, err := computebudget.NewSetComputeUnitLimitInstruction(computeUnitLimit).ValidateAndBuild()
+	if err != nil {
+		return "", fmt.Errorf("failed to build SetComputeUnitLimit: %w", err)
+	}
+	setPriceIx, err := computebudget.NewSetComputeUnitPriceInstruction(computeUnitPrice).ValidateAndBuild()
+	if err != nil {
+		return "", fmt.Errorf("failed to build SetComputeUnitPrice: %w", err)
+	}
+	transferIx, err := token.NewTransferCheckedInstruction(
+		amountU64,
+		6, // USDC decimals
+		sourceATA,
+		mintPK,
+		destATA,
+		ownerPubkey,
+		[]solana.PublicKey{},
+	).ValidateAndBuild()
+	if err != nil {
+		return "", fmt.Errorf("failed to build TransferChecked: %w", err)
+	}
+
+	// Build transaction with feePayer as payer (matches Python SDK)
+	tx, err := solana.NewTransaction(
+		[]solana.Instruction{setLimitIx, setPriceIx, transferIx},
+		recentBlockhash,
+		solana.TransactionPayer(feePayerPK),
+	)
+	if err != nil {
+		return "", fmt.Errorf("failed to build transaction: %w", err)
+	}
+
+	// Partial sign: user signs; fee_payer (CDP) co-signs on server side
+	// The transaction has 2 signers: [feePayer (index 0), owner (index 1)]
+	// We sign only our index (owner).
+	_, err = tx.Sign(func(key solana.PublicKey) *solana.PrivateKey {
+		if key.Equals(ownerPubkey) {
+			return &c.keypair
+		}
+		return nil // feePayer will be signed by BlockRun CDP
+	})
+	if err != nil {
+		return "", fmt.Errorf("failed to sign transaction: %w", err)
+	}
+
+	// Serialize transaction
+	txBytes, err := tx.MarshalBinary()
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize transaction: %w", err)
+	}
+
+	return base64.StdEncoding.EncodeToString(txBytes), nil
+}
+
+// buildUrl returns the full BlockRun Solana endpoint URL.
+func (c *BlockRunSolClient) buildUrl() string {
+	return DefaultBlockRunSolURL + BlockRunChatEndpoint
+}
+
+func (c *BlockRunSolClient) buildRequest(url string, jsonData []byte) (*http.Request, error) {
+	return x402BuildRequest(url, jsonData)
+}

mcp/claude_client.go

@@ -1,3 +1,19 @@
+// Package mcp — ClaudeClient implements the Anthropic Messages API.
+//
+// Wire-format differences from the OpenAI-compatible base Client:
+//
+//	┌─────────────────────┬───────────────────────────┬─────────────────────────────────┐
+//	│ Concept             │ OpenAI format              │ Anthropic format                │
+//	├─────────────────────┼───────────────────────────┼─────────────────────────────────┤
+//	│ Endpoint            │ /v1/chat/completions       │ /v1/messages                    │
+//	│ Auth header         │ Authorization: Bearer xxx  │ x-api-key: xxx                  │
+//	│ System prompt       │ messages[0] role=system    │ top-level "system" field        │
+//	│ Tool definition     │ type=function + parameters │ name + description + input_schema│
+//	│ Tool choice         │ "auto" (string)            │ {"type":"auto"} (object)        │
+//	│ Assistant tool call │ tool_calls array           │ content[{type:tool_use,...}]    │
+//	│ Tool result         │ role=tool + tool_call_id   │ role=user content[tool_result]  │
+//	│ Max tokens          │ max_tokens                 │ max_tokens (same)               │
+//	└─────────────────────┴───────────────────────────┴─────────────────────────────────┘
 package mcp
 
 import (
@@ -12,75 +28,64 @@ const (
 	DefaultClaudeModel   = "claude-opus-4-6"
 )
 
+// ClaudeClient wraps the base Client and overrides the methods that differ
+// for the Anthropic Messages API.  All other behaviour (retry, timeout,
+// logging) is inherited unchanged.
 type ClaudeClient struct {
 	*Client
 }
 
-// NewClaudeClient creates Claude client (backward compatible)
+// NewClaudeClient creates a ClaudeClient with default settings.
 func NewClaudeClient() AIClient {
 	return NewClaudeClientWithOptions()
 }
 
-// NewClaudeClientWithOptions creates Claude client (supports options pattern)
+// NewClaudeClientWithOptions creates a ClaudeClient with optional overrides.
 func NewClaudeClientWithOptions(opts ...ClientOption) AIClient {
-	// 1. Create Claude preset options
-	claudeOpts := []ClientOption{
+	baseClient := NewClient(append([]ClientOption{
 		WithProvider(ProviderClaude),
 		WithModel(DefaultClaudeModel),
 		WithBaseURL(DefaultClaudeBaseURL),
-	}
+	}, opts...)...).(*Client)
 
-	// 2. Merge user options (user options have higher priority)
-	allOpts := append(claudeOpts, opts...)
-
-	// 3. Create base client
-	baseClient := NewClient(allOpts...).(*Client)
-
-	// 4. Create Claude client
-	claudeClient := &ClaudeClient{
-		Client: baseClient,
-	}
-
-	// 5. Set hooks to point to ClaudeClient (implement dynamic dispatch)
-	baseClient.hooks = claudeClient
-
-	return claudeClient
+	c := &ClaudeClient{Client: baseClient}
+	baseClient.hooks = c // wire dynamic dispatch to ClaudeClient
+	return c
 }
 
-func (c *ClaudeClient) SetAPIKey(apiKey string, customURL string, customModel string) {
-	c.APIKey = apiKey
+// ── Hook overrides ────────────────────────────────────────────────────────────
 
+// SetAPIKey stores credentials and optional custom endpoint / model.
+func (c *ClaudeClient) SetAPIKey(apiKey, customURL, customModel string) {
+	c.APIKey = apiKey
 	if len(apiKey) > 8 {
 		c.logger.Infof("🔧 [MCP] Claude API Key: %s...%s", apiKey[:4], apiKey[len(apiKey)-4:])
 	}
 	if customURL != "" {
 		c.BaseURL = customURL
-		c.logger.Infof("🔧 [MCP] Claude using custom BaseURL: %s", customURL)
-	} else {
-		c.logger.Infof("🔧 [MCP] Claude using default BaseURL: %s", c.BaseURL)
+		c.logger.Infof("🔧 [MCP] Claude BaseURL: %s", customURL)
 	}
 	if customModel != "" {
 		c.Model = customModel
-		c.logger.Infof("🔧 [MCP] Claude using custom Model: %s", customModel)
-	} else {
-		c.logger.Infof("🔧 [MCP] Claude using default Model: %s", c.Model)
+		c.logger.Infof("🔧 [MCP] Claude Model: %s", customModel)
 	}
 }
 
-// setAuthHeader Claude uses x-api-key header instead of Authorization Bearer
-func (c *ClaudeClient) setAuthHeader(reqHeaders http.Header) {
-	reqHeaders.Set("x-api-key", c.APIKey)
-	reqHeaders.Set("anthropic-version", "2023-06-01")
+// setAuthHeader uses x-api-key instead of Authorization: Bearer.
+func (c *ClaudeClient) setAuthHeader(h http.Header) {
+	h.Set("x-api-key", c.APIKey)
+	h.Set("anthropic-version", "2023-06-01")
 }
 
-// buildUrl Claude uses /messages endpoint
+// buildUrl targets /messages instead of /chat/completions.
 func (c *ClaudeClient) buildUrl() string {
 	return fmt.Sprintf("%s/messages", c.BaseURL)
 }
 
-// buildMCPRequestBody Claude has different request format
+// buildMCPRequestBody builds the Anthropic wire format for the simple
+// CallWithMessages path (no tool support).
 func (c *ClaudeClient) buildMCPRequestBody(systemPrompt, userPrompt string) map[string]any {
-	requestBody := map[string]any{
+	return map[string]any{
 		"model":      c.Model,
 		"max_tokens": c.MaxTokens,
 		"system":     systemPrompt,
@@ -88,16 +93,175 @@ func (c *ClaudeClient) buildMCPRequestBody(systemPrompt, userPrompt string) map[
 			{"role": "user", "content": userPrompt},
 		},
 	}
-
-	return requestBody
 }
 
-// parseMCPResponse Claude has different response format
+// buildRequestBodyFromRequest converts a *Request into the Anthropic Messages
+// API wire format.  This is the key override that makes tool calling work
+// correctly with Claude.
+//
+// Conversions applied:
+//
+//   - System messages are lifted to the top-level "system" field.
+//   - Tool definitions: parameters → input_schema, wrapper removed.
+//   - Assistant messages with ToolCalls → content[{type:tool_use,...}].
+//   - Tool result messages (role=tool) → role=user with tool_result blocks.
+//     Consecutive tool results are merged into a single user turn (Anthropic
+//     requires strictly alternating user/assistant turns).
+//   - tool_choice "auto"/"any" → {"type":"auto"/"any"} object.
+func (c *ClaudeClient) buildRequestBodyFromRequest(req *Request) map[string]any {
+	// ── 1. Separate system prompt from conversation messages ──────────────────
+	var systemPrompt string
+	var convMsgs []Message
+	for _, m := range req.Messages {
+		if m.Role == "system" {
+			systemPrompt = m.Content
+		} else {
+			convMsgs = append(convMsgs, m)
+		}
+	}
+
+	// ── 2. Convert messages to Anthropic format ───────────────────────────────
+	anthropicMsgs := convertMessagesToAnthropic(convMsgs)
+
+	// ── 3. Convert tool definitions (parameters → input_schema) ──────────────
+	var anthropicTools []map[string]any
+	for _, t := range req.Tools {
+		anthropicTools = append(anthropicTools, map[string]any{
+			"name":         t.Function.Name,
+			"description":  t.Function.Description,
+			"input_schema": t.Function.Parameters,
+		})
+	}
+
+	// ── 4. Assemble request body ──────────────────────────────────────────────
+	body := map[string]any{
+		"model":      req.Model,
+		"max_tokens": c.MaxTokens,
+		"system":     systemPrompt,
+		"messages":   anthropicMsgs,
+	}
+
+	if len(anthropicTools) > 0 {
+		body["tools"] = anthropicTools
+	}
+
+	// tool_choice: Anthropic uses an object, not a string.
+	switch req.ToolChoice {
+	case "auto":
+		body["tool_choice"] = map[string]any{"type": "auto"}
+	case "any":
+		body["tool_choice"] = map[string]any{"type": "any"}
+	case "none", "":
+		// omit — no tool_choice sent
+	}
+
+	if req.Temperature != nil {
+		body["temperature"] = *req.Temperature
+	}
+
+	return body
+}
+
+// convertMessagesToAnthropic translates from the OpenAI-shaped mcp.Message
+// slice to Anthropic's messages array.
+//
+// Rules:
+//  1. role=assistant + ToolCalls → role=assistant, content=[tool_use, ...]
+//  2. role=tool (result)         → role=user, content=[tool_result, ...]
+//     Consecutive tool-result messages are merged into one user turn so the
+//     conversation always alternates user/assistant.
+//  3. All other messages         → {role, content} as-is.
+func convertMessagesToAnthropic(msgs []Message) []map[string]any {
+	var out []map[string]any
+
+	for i := 0; i < len(msgs); {
+		msg := msgs[i]
+
+		switch {
+		// ── Assistant message carrying tool calls ─────────────────────────────
+		case msg.Role == "assistant" && len(msg.ToolCalls) > 0:
+			var blocks []map[string]any
+			for _, tc := range msg.ToolCalls {
+				// Arguments are a JSON string; Claude wants a parsed object.
+				var input map[string]any
+				if err := json.Unmarshal([]byte(tc.Function.Arguments), &input); err != nil {
+					input = map[string]any{"_raw": tc.Function.Arguments}
+				}
+				blocks = append(blocks, map[string]any{
+					"type":  "tool_use",
+					"id":    tc.ID,
+					"name":  tc.Function.Name,
+					"input": input,
+				})
+			}
+			out = append(out, map[string]any{
+				"role":    "assistant",
+				"content": blocks,
+			})
+			i++
+
+		// ── Tool result message(s) → single user turn ─────────────────────────
+		case msg.Role == "tool":
+			// Collect all consecutive tool-result messages.
+			var blocks []map[string]any
+			for i < len(msgs) && msgs[i].Role == "tool" {
+				blocks = append(blocks, map[string]any{
+					"type":        "tool_result",
+					"tool_use_id": msgs[i].ToolCallID,
+					"content":     msgs[i].Content,
+				})
+				i++
+			}
+			out = append(out, map[string]any{
+				"role":    "user",
+				"content": blocks,
+			})
+
+		// ── Regular user / assistant text message ─────────────────────────────
+		default:
+			out = append(out, map[string]any{
+				"role":    msg.Role,
+				"content": msg.Content,
+			})
+			i++
+		}
+	}
+
+	return out
+}
+
+// ── Response parsers ──────────────────────────────────────────────────────────
+
+// parseMCPResponse extracts the plain-text reply from an Anthropic response.
+// Used by CallWithMessages / CallWithRequest (no tool support).
 func (c *ClaudeClient) parseMCPResponse(body []byte) (string, error) {
-	var response struct {
+	r, err := c.parseMCPResponseFull(body)
+	if err != nil {
+		return "", err
+	}
+	return r.Content, nil
+}
+
+// parseMCPResponseFull extracts both text and tool calls from an Anthropic
+// response envelope.
+//
+// Anthropic response shape:
+//
+//	{
+//	  "content": [
+//	    {"type": "text",     "text": "..."},
+//	    {"type": "tool_use", "id": "...", "name": "...", "input": {...}}
+//	  ],
+//	  "stop_reason": "tool_use" | "end_turn"
+//	}
+func (c *ClaudeClient) parseMCPResponseFull(body []byte) (*LLMResponse, error) {
+	var raw struct {
 		Content []struct {
-			Type string `json:"type"`
-			Text string `json:"text"`
+			Type  string          `json:"type"`
+			Text  string          `json:"text,omitempty"`
+			ID    string          `json:"id,omitempty"`
+			Name  string          `json:"name,omitempty"`
+			Input json.RawMessage `json:"input,omitempty"`
 		} `json:"content"`
 		Usage struct {
 			InputTokens  int `json:"input_tokens"`
@@ -109,36 +273,46 @@ func (c *ClaudeClient) parseMCPResponse(body []byte) (string, error) {
 		} `json:"error"`
 	}
 
-	if err := json.Unmarshal(body, &response); err != nil {
-		return "", fmt.Errorf("failed to parse Claude response: %w, body: %s", err, string(body))
+	if err := json.Unmarshal(body, &raw); err != nil {
+		return nil, fmt.Errorf("failed to parse Anthropic response: %w — body: %s", err, body)
+	}
+	if raw.Error != nil {
+		return nil, fmt.Errorf("Anthropic API error: %s — %s", raw.Error.Type, raw.Error.Message)
 	}
 
-	if response.Error != nil {
-		return "", fmt.Errorf("Claude API error: %s - %s", response.Error.Type, response.Error.Message)
-	}
-
-	if len(response.Content) == 0 {
-		return "", fmt.Errorf("Claude returned empty content, body: %s", string(body))
-	}
-
-	// Report token usage if callback is set
-	totalTokens := response.Usage.InputTokens + response.Usage.OutputTokens
-	if TokenUsageCallback != nil && totalTokens > 0 {
+	total := raw.Usage.InputTokens + raw.Usage.OutputTokens
+	if TokenUsageCallback != nil && total > 0 {
 		TokenUsageCallback(TokenUsage{
 			Provider:         c.Provider,
 			Model:            c.Model,
-			PromptTokens:     response.Usage.InputTokens,
-			CompletionTokens: response.Usage.OutputTokens,
-			TotalTokens:      totalTokens,
+			PromptTokens:     raw.Usage.InputTokens,
+			CompletionTokens: raw.Usage.OutputTokens,
+			TotalTokens:      total,
 		})
 	}
 
-	// Find text content
-	for _, content := range response.Content {
-		if content.Type == "text" {
-			return content.Text, nil
+	result := &LLMResponse{}
+	for _, block := range raw.Content {
+		switch block.Type {
+		case "text":
+			result.Content = block.Text
+
+		case "tool_use":
+			// Input is a JSON object; serialise back to a JSON string so it
+			// matches the ToolCallFunction.Arguments field (always a string).
+			argsJSON, err := json.Marshal(block.Input)
+			if err != nil {
+				argsJSON = []byte("{}")
+			}
+			result.ToolCalls = append(result.ToolCalls, ToolCall{
+				ID:   block.ID,
+				Type: "function",
+				Function: ToolCallFunction{
+					Name:      block.Name,
+					Arguments: string(argsJSON),
+				},
+			})
 		}
 	}
-
-	return "", fmt.Errorf("no text content in Claude response")
+	return result, nil
 }

mcp/claude_client_test.go

@@ -0,0 +1,248 @@
+package mcp
+
+import (
+	"encoding/json"
+	"net/http"
+	"testing"
+)
+
+// ── buildRequestBodyFromRequest ────────────────────────────────────────────────
+
+func TestClaudeClient_BuildRequestBody_SystemPromptLifted(t *testing.T) {
+	c := newTestClaudeClient()
+	req := &Request{
+		Model: "claude-opus-4-6",
+		Messages: []Message{
+			{Role: "system", Content: "You are helpful."},
+			{Role: "user", Content: "Hello"},
+		},
+	}
+	body := c.buildRequestBodyFromRequest(req)
+
+	if body["system"] != "You are helpful." {
+		t.Errorf("system not lifted to top level: %v", body["system"])
+	}
+	msgs := body["messages"].([]map[string]any)
+	if len(msgs) != 1 || msgs[0]["role"] != "user" {
+		t.Errorf("system message should be removed from messages array: %v", msgs)
+	}
+}
+
+func TestClaudeClient_BuildRequestBody_ToolsUseInputSchema(t *testing.T) {
+	c := newTestClaudeClient()
+	req := &Request{
+		Model:   "claude-opus-4-6",
+		Messages: []Message{{Role: "user", Content: "hi"}},
+		Tools: []Tool{{
+			Type: "function",
+			Function: FunctionDef{
+				Name:        "my_tool",
+				Description: "does stuff",
+				Parameters:  map[string]any{"type": "object"},
+			},
+		}},
+	}
+	body := c.buildRequestBodyFromRequest(req)
+
+	tools, ok := body["tools"].([]map[string]any)
+	if !ok || len(tools) != 1 {
+		t.Fatalf("tools not set correctly: %v", body["tools"])
+	}
+	tool := tools[0]
+	if tool["name"] != "my_tool" {
+		t.Errorf("tool name wrong: %v", tool["name"])
+	}
+	if tool["input_schema"] == nil {
+		t.Error("tool must use input_schema, not parameters")
+	}
+	if _, hasParams := tool["parameters"]; hasParams {
+		t.Error("tool must NOT have parameters key (Anthropic uses input_schema)")
+	}
+}
+
+func TestClaudeClient_BuildRequestBody_ToolChoiceObject(t *testing.T) {
+	c := newTestClaudeClient()
+	req := &Request{
+		Model:      "claude-opus-4-6",
+		Messages:   []Message{{Role: "user", Content: "hi"}},
+		ToolChoice: "auto",
+	}
+	body := c.buildRequestBodyFromRequest(req)
+
+	tc, ok := body["tool_choice"].(map[string]any)
+	if !ok {
+		t.Fatalf("tool_choice must be an object, got: %T %v", body["tool_choice"], body["tool_choice"])
+	}
+	if tc["type"] != "auto" {
+		t.Errorf("tool_choice.type must be 'auto', got: %v", tc["type"])
+	}
+}
+
+// ── convertMessagesToAnthropic ─────────────────────────────────────────────────
+
+func TestConvertMessages_AssistantToolCall(t *testing.T) {
+	msgs := []Message{
+		{
+			Role: "assistant",
+			ToolCalls: []ToolCall{{
+				ID:   "tc1",
+				Type: "function",
+				Function: ToolCallFunction{Name: "api_request", Arguments: `{"method":"GET","path":"/api/x","body":{}}`},
+			}},
+		},
+	}
+	out := convertMessagesToAnthropic(msgs)
+
+	if len(out) != 1 {
+		t.Fatalf("expected 1 message, got %d", len(out))
+	}
+	msg := out[0]
+	if msg["role"] != "assistant" {
+		t.Errorf("role should be assistant: %v", msg["role"])
+	}
+	blocks := msg["content"].([]map[string]any)
+	if len(blocks) != 1 || blocks[0]["type"] != "tool_use" {
+		t.Errorf("content should be tool_use block: %v", blocks)
+	}
+	if blocks[0]["id"] != "tc1" {
+		t.Errorf("tool_use id wrong: %v", blocks[0]["id"])
+	}
+	// Input must be parsed JSON object, not a string.
+	input, ok := blocks[0]["input"].(map[string]any)
+	if !ok {
+		t.Errorf("tool_use input must be map, got %T", blocks[0]["input"])
+	}
+	if input["method"] != "GET" {
+		t.Errorf("input.method wrong: %v", input)
+	}
+}
+
+func TestConvertMessages_ToolResultMergedIntoUserTurn(t *testing.T) {
+	// Anthropic requires strictly alternating turns; consecutive tool results
+	// must be merged into a single user message.
+	msgs := []Message{
+		{Role: "tool", ToolCallID: "tc1", Content: `{"result":"a"}`},
+		{Role: "tool", ToolCallID: "tc2", Content: `{"result":"b"}`},
+	}
+	out := convertMessagesToAnthropic(msgs)
+
+	if len(out) != 1 {
+		t.Fatalf("consecutive tool results must be merged into one user turn, got %d messages", len(out))
+	}
+	if out[0]["role"] != "user" {
+		t.Errorf("tool results must become role=user: %v", out[0]["role"])
+	}
+	blocks := out[0]["content"].([]map[string]any)
+	if len(blocks) != 2 {
+		t.Errorf("expected 2 tool_result blocks, got %d", len(blocks))
+	}
+	if blocks[0]["type"] != "tool_result" || blocks[1]["type"] != "tool_result" {
+		t.Errorf("blocks should be tool_result: %v", blocks)
+	}
+	if blocks[0]["tool_use_id"] != "tc1" || blocks[1]["tool_use_id"] != "tc2" {
+		t.Errorf("tool_use_id mismatch: %v", blocks)
+	}
+}
+
+// ── parseMCPResponseFull ───────────────────────────────────────────────────────
+
+func TestClaudeClient_ParseResponse_TextOnly(t *testing.T) {
+	c := newTestClaudeClient()
+	body := []byte(`{
+		"content": [{"type":"text","text":"Hello from Claude"}],
+		"usage": {"input_tokens": 10, "output_tokens": 5}
+	}`)
+	resp, err := c.parseMCPResponseFull(body)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if resp.Content != "Hello from Claude" {
+		t.Errorf("content mismatch: %q", resp.Content)
+	}
+	if len(resp.ToolCalls) != 0 {
+		t.Errorf("expected no tool calls: %v", resp.ToolCalls)
+	}
+}
+
+func TestClaudeClient_ParseResponse_ToolUse(t *testing.T) {
+	c := newTestClaudeClient()
+	body := []byte(`{
+		"content": [{
+			"type": "tool_use",
+			"id": "toolu_01abc",
+			"name": "api_request",
+			"input": {"method":"POST","path":"/api/strategies","body":{"name":"BTC策略"}}
+		}],
+		"usage": {"input_tokens": 100, "output_tokens": 30}
+	}`)
+	resp, err := c.parseMCPResponseFull(body)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(resp.ToolCalls) != 1 {
+		t.Fatalf("expected 1 tool call, got %d", len(resp.ToolCalls))
+	}
+	tc := resp.ToolCalls[0]
+	if tc.ID != "toolu_01abc" {
+		t.Errorf("tool call ID wrong: %v", tc.ID)
+	}
+	if tc.Function.Name != "api_request" {
+		t.Errorf("function name wrong: %v", tc.Function.Name)
+	}
+	// Arguments must be a valid JSON string.
+	var args map[string]any
+	if err := json.Unmarshal([]byte(tc.Function.Arguments), &args); err != nil {
+		t.Errorf("arguments not valid JSON: %q — %v", tc.Function.Arguments, err)
+	}
+	if args["method"] != "POST" {
+		t.Errorf("args.method wrong: %v", args)
+	}
+}
+
+func TestClaudeClient_ParseResponse_APIError(t *testing.T) {
+	c := newTestClaudeClient()
+	body := []byte(`{"error":{"type":"authentication_error","message":"invalid x-api-key"}}`)
+	_, err := c.parseMCPResponseFull(body)
+	if err == nil {
+		t.Fatal("expected error for API error response")
+	}
+	if err.Error() == "" {
+		t.Error("error message should not be empty")
+	}
+}
+
+// ── Auth header ────────────────────────────────────────────────────────────────
+
+func TestClaudeClient_SetAuthHeader(t *testing.T) {
+	c := newTestClaudeClient()
+	c.APIKey = "sk-ant-test123"
+
+	// net/http.Header canonicalizes keys (x-api-key → X-Api-Key).
+	h := make(http.Header)
+	c.setAuthHeader(h)
+
+	if got := h.Get("x-api-key"); got != "sk-ant-test123" {
+		t.Errorf("x-api-key header not set correctly: %q", got)
+	}
+	if h.Get("anthropic-version") == "" {
+		t.Error("anthropic-version header must be set")
+	}
+	// Must NOT use Authorization: Bearer (that's OpenAI format).
+	if h.Get("Authorization") != "" {
+		t.Error("Claude must use x-api-key, not Authorization header")
+	}
+}
+
+func TestClaudeClient_BuildUrl(t *testing.T) {
+	c := newTestClaudeClient()
+	url := c.buildUrl()
+	if url != DefaultClaudeBaseURL+"/messages" {
+		t.Errorf("URL should be /messages endpoint, got: %s", url)
+	}
+}
+
+// ── helpers ────────────────────────────────────────────────────────────────────
+
+func newTestClaudeClient() *ClaudeClient {
+	return NewClaudeClientWithOptions().(*ClaudeClient)
+}

mcp/claw402.go

@@ -0,0 +1,166 @@
+package mcp
+
+import (
+	"crypto/ecdsa"
+	"net/http"
+	"strings"
+
+	"github.com/ethereum/go-ethereum/crypto"
+)
+
+const (
+	ProviderClaw402    = "claw402"
+	DefaultClaw402URL  = "https://claw402.ai"
+	DefaultClaw402Model = "deepseek"
+)
+
+// claw402ModelEndpoints maps user-friendly model names to claw402 API paths.
+var claw402ModelEndpoints = map[string]string{
+	// OpenAI
+	"gpt-5.4":     "/api/v1/ai/openai/chat/5.4",
+	"gpt-5.4-pro": "/api/v1/ai/openai/chat/5.4-pro",
+	"gpt-5.3":     "/api/v1/ai/openai/chat/5.3",
+	"gpt-5-mini":  "/api/v1/ai/openai/chat/5-mini",
+	// Anthropic
+	"claude-opus": "/api/v1/ai/anthropic/messages/opus",
+	// DeepSeek
+	"deepseek":          "/api/v1/ai/deepseek/chat",
+	"deepseek-reasoner": "/api/v1/ai/deepseek/chat/reasoner",
+	// Qwen
+	"qwen-max":   "/api/v1/ai/qwen/chat/max",
+	"qwen-plus":  "/api/v1/ai/qwen/chat/plus",
+	"qwen-turbo": "/api/v1/ai/qwen/chat/turbo",
+	"qwen-flash": "/api/v1/ai/qwen/chat/flash",
+	// Grok
+	"grok-4.1": "/api/v1/ai/grok/chat/4.1",
+	// Gemini
+	"gemini-3.1-pro": "/api/v1/ai/gemini/chat/3.1-pro",
+	// Kimi
+	"kimi-k2.5": "/api/v1/ai/kimi/chat/k2.5",
+}
+
+// Claw402Client implements AIClient using claw402.ai's x402 v2 USDC payment gateway.
+// Reuses the same EIP-712 signing as BlockRunBaseClient (same Base chain + USDC contract).
+// When the selected model routes to an Anthropic endpoint, it automatically uses
+// the Anthropic wire format for requests and responses (via an internal ClaudeClient).
+type Claw402Client struct {
+	*Client
+	privateKey  *ecdsa.PrivateKey
+	claudeProxy *ClaudeClient // non-nil when endpoint is /anthropic/
+}
+
+// NewClaw402Client creates a claw402 client (backward compatible).
+func NewClaw402Client() AIClient {
+	return NewClaw402ClientWithOptions()
+}
+
+// NewClaw402ClientWithOptions creates a claw402 client with options.
+func NewClaw402ClientWithOptions(opts ...ClientOption) AIClient {
+	baseOpts := []ClientOption{
+		WithProvider(ProviderClaw402),
+		WithModel(DefaultClaw402Model),
+		WithBaseURL(DefaultClaw402URL),
+	}
+	allOpts := append(baseOpts, opts...)
+	baseClient := NewClient(allOpts...).(*Client)
+	baseClient.UseFullURL = true
+	baseClient.BaseURL = DefaultClaw402URL + claw402ModelEndpoints[DefaultClaw402Model]
+
+	c := &Claw402Client{Client: baseClient}
+	baseClient.hooks = c
+	return c
+}
+
+// SetAPIKey stores the EVM private key and selects the model endpoint.
+func (c *Claw402Client) SetAPIKey(apiKey string, _ string, customModel string) {
+	hexKey := strings.TrimPrefix(apiKey, "0x")
+	privKey, err := crypto.HexToECDSA(hexKey)
+	if err != nil {
+		c.logger.Warnf("⚠️  [MCP] Claw402: invalid private key: %v", err)
+	} else {
+		c.privateKey = privKey
+		c.APIKey = apiKey
+		addr := crypto.PubkeyToAddress(privKey.PublicKey).Hex()
+		c.logger.Infof("🔧 [MCP] Claw402 wallet: %s", addr)
+	}
+	if customModel != "" {
+		c.Model = customModel
+	}
+	endpoint := c.resolveEndpoint()
+	c.BaseURL = DefaultClaw402URL + endpoint
+
+	// Anthropic endpoints need different wire format (Messages API)
+	if strings.Contains(endpoint, "/anthropic/") {
+		c.claudeProxy = &ClaudeClient{Client: c.Client}
+		c.logger.Infof("🔧 [MCP] Claw402 model: %s → %s (Anthropic format)", c.Model, endpoint)
+	} else {
+		c.claudeProxy = nil
+		c.logger.Infof("🔧 [MCP] Claw402 model: %s → %s", c.Model, endpoint)
+	}
+}
+
+// resolveEndpoint returns the API path for the configured model.
+func (c *Claw402Client) resolveEndpoint() string {
+	if ep, ok := claw402ModelEndpoints[c.Model]; ok {
+		return ep
+	}
+	// Allow raw path override (e.g. "/api/v1/ai/openai/chat/5.4")
+	if strings.HasPrefix(c.Model, "/api/") {
+		return c.Model
+	}
+	return claw402ModelEndpoints[DefaultClaw402Model]
+}
+
+func (c *Claw402Client) setAuthHeader(h http.Header) { x402SetAuthHeader(h) }
+
+func (c *Claw402Client) call(systemPrompt, userPrompt string) (string, error) {
+	return x402Call(c.Client, c.signPayment, "Claw402", systemPrompt, userPrompt)
+}
+
+func (c *Claw402Client) CallWithRequestFull(req *Request) (*LLMResponse, error) {
+	return x402CallFull(c.Client, c.signPayment, "Claw402", req)
+}
+
+// signPayment signs x402 v2 EIP-712 payment (same Base chain + USDC as BlockRunBase).
+func (c *Claw402Client) signPayment(paymentHeaderB64 string) (string, error) {
+	return signBasePaymentHeader(c.privateKey, paymentHeaderB64, "Claw402")
+}
+
+// ── Format overrides for Anthropic endpoints ─────────────────────────────────
+
+func (c *Claw402Client) buildMCPRequestBody(systemPrompt, userPrompt string) map[string]any {
+	if c.claudeProxy != nil {
+		return c.claudeProxy.buildMCPRequestBody(systemPrompt, userPrompt)
+	}
+	return c.Client.buildMCPRequestBody(systemPrompt, userPrompt)
+}
+
+func (c *Claw402Client) buildRequestBodyFromRequest(req *Request) map[string]any {
+	if c.claudeProxy != nil {
+		return c.claudeProxy.buildRequestBodyFromRequest(req)
+	}
+	return c.Client.buildRequestBodyFromRequest(req)
+}
+
+func (c *Claw402Client) parseMCPResponse(body []byte) (string, error) {
+	if c.claudeProxy != nil {
+		return c.claudeProxy.parseMCPResponse(body)
+	}
+	return c.Client.parseMCPResponse(body)
+}
+
+func (c *Claw402Client) parseMCPResponseFull(body []byte) (*LLMResponse, error) {
+	if c.claudeProxy != nil {
+		return c.claudeProxy.parseMCPResponseFull(body)
+	}
+	return c.Client.parseMCPResponseFull(body)
+}
+
+// buildUrl returns the full claw402 endpoint URL.
+func (c *Claw402Client) buildUrl() string {
+	return c.BaseURL
+}
+
+func (c *Claw402Client) buildRequest(url string, jsonData []byte) (*http.Request, error) {
+	return x402BuildRequest(url, jsonData)
+}

mcp/client.go

@@ -1,7 +1,9 @@
 package mcp
 
 import (
+	"bufio"
 	"bytes"
+	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -232,10 +234,21 @@ func (client *Client) marshalRequestBody(requestBody map[string]any) ([]byte, er
 }
 
 func (client *Client) parseMCPResponse(body []byte) (string, error) {
+	r, err := client.parseMCPResponseFull(body)
+	if err != nil {
+		return "", err
+	}
+	return r.Content, nil
+}
+
+// parseMCPResponseFull parses the OpenAI-format response body and returns both
+// the text content and any tool calls.
+func (client *Client) parseMCPResponseFull(body []byte) (*LLMResponse, error) {
 	var result struct {
 		Choices []struct {
 			Message struct {
-				Content string `json:"content"`
+				Content   string     `json:"content"`
+				ToolCalls []ToolCall `json:"tool_calls"`
 			} `json:"message"`
 		} `json:"choices"`
 		Usage struct {
@@ -246,11 +259,11 @@ func (client *Client) parseMCPResponse(body []byte) (string, error) {
 	}
 
 	if err := json.Unmarshal(body, &result); err != nil {
-		return "", fmt.Errorf("failed to parse response: %w", err)
+		return nil, fmt.Errorf("failed to parse response: %w", err)
 	}
 
 	if len(result.Choices) == 0 {
-		return "", fmt.Errorf("API returned empty response")
+		return nil, fmt.Errorf("API returned empty response")
 	}
 
 	// Report token usage if callback is set
@@ -264,7 +277,11 @@ func (client *Client) parseMCPResponse(body []byte) (string, error) {
 		})
 	}
 
-	return result.Choices[0].Message.Content, nil
+	msg := result.Choices[0].Message
+	return &LLMResponse{
+		Content:   msg.Content,
+		ToolCalls: msg.ToolCalls,
+	}, nil
 }
 
 func (client *Client) buildUrl() string {
@@ -425,50 +442,106 @@ func (client *Client) CallWithRequest(req *Request) (string, error) {
 	return "", fmt.Errorf("still failed after %d retries: %w", maxRetries, lastErr)
 }
 
+// CallWithRequestFull calls the AI API and returns both text content and tool calls.
+func (client *Client) CallWithRequestFull(req *Request) (*LLMResponse, error) {
+	if client.APIKey == "" {
+		return nil, fmt.Errorf("AI API key not set, please call SetAPIKey first")
+	}
+	if req.Model == "" {
+		req.Model = client.Model
+	}
+
+	var lastErr error
+	maxRetries := client.config.MaxRetries
+	for attempt := 1; attempt <= maxRetries; attempt++ {
+		if attempt > 1 {
+			client.logger.Warnf("⚠️  AI API call failed, retrying (%d/%d)...", attempt, maxRetries)
+		}
+		result, err := client.callWithRequestFull(req)
+		if err == nil {
+			return result, nil
+		}
+		lastErr = err
+		if !client.hooks.isRetryableError(err) {
+			return nil, err
+		}
+		if attempt < maxRetries {
+			waitTime := client.config.RetryWaitBase * time.Duration(attempt)
+			time.Sleep(waitTime)
+		}
+	}
+	return nil, fmt.Errorf("still failed after %d retries: %w", maxRetries, lastErr)
+}
+
+// callWithRequestFull single call that returns LLMResponse (content + tool calls).
+func (client *Client) callWithRequestFull(req *Request) (*LLMResponse, error) {
+	client.logger.Infof("📡 [%s] Request AI Server (full): BaseURL: %s", client.String(), client.BaseURL)
+
+	requestBody := client.hooks.buildRequestBodyFromRequest(req)
+	jsonData, err := client.hooks.marshalRequestBody(requestBody)
+	if err != nil {
+		return nil, err
+	}
+
+	url := client.hooks.buildUrl()
+	httpReq, err := client.hooks.buildRequest(url, jsonData)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	resp, err := client.httpClient.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("failed to send request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("API returned error (status %d): %s", resp.StatusCode, string(body))
+	}
+
+	return client.hooks.parseMCPResponseFull(body)
+}
+
 // callWithRequest single AI API call (using Request object)
 func (client *Client) callWithRequest(req *Request) (string, error) {
 	// Print current AI configuration
 	client.logger.Infof("📡 [%s] Request AI Server with Builder: BaseURL: %s", client.String(), client.BaseURL)
 	client.logger.Debugf("[%s] Messages count: %d", client.String(), len(req.Messages))
 
-	// Build request body (from Request object)
-	requestBody := client.buildRequestBodyFromRequest(req)
+	requestBody := client.hooks.buildRequestBodyFromRequest(req)
 
-	// Serialize request body
 	jsonData, err := client.hooks.marshalRequestBody(requestBody)
 	if err != nil {
 		return "", err
 	}
 
-	// Build URL
 	url := client.hooks.buildUrl()
 	client.logger.Infof("📡 [MCP %s] Request URL: %s", client.String(), url)
 
-	// Create HTTP request
 	httpReq, err := client.hooks.buildRequest(url, jsonData)
 	if err != nil {
 		return "", fmt.Errorf("failed to create request: %w", err)
 	}
 
-	// Send HTTP request
 	resp, err := client.httpClient.Do(httpReq)
 	if err != nil {
 		return "", fmt.Errorf("failed to send request: %w", err)
 	}
 	defer resp.Body.Close()
 
-	// Read response body
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return "", fmt.Errorf("failed to read response: %w", err)
 	}
 
-	// Check HTTP status code
 	if resp.StatusCode != http.StatusOK {
 		return "", fmt.Errorf("API returned error (status %d): %s", resp.StatusCode, string(body))
 	}
 
-	// Parse response
 	result, err := client.hooks.parseMCPResponse(body)
 	if err != nil {
 		return "", fmt.Errorf("fail to parse AI server response: %w", err)
@@ -479,13 +552,23 @@ func (client *Client) callWithRequest(req *Request) (string, error) {
 
 // buildRequestBodyFromRequest builds request body from Request object
 func (client *Client) buildRequestBodyFromRequest(req *Request) map[string]any {
-	// Convert Message to API format
-	messages := make([]map[string]string, 0, len(req.Messages))
+	// Convert Message to API format — must use map[string]any to support
+	// tool-call messages (tool_calls, tool_call_id fields).
+	messages := make([]map[string]any, 0, len(req.Messages))
 	for _, msg := range req.Messages {
-		messages = append(messages, map[string]string{
-			"role":    msg.Role,
-			"content": msg.Content,
-		})
+		m := map[string]any{"role": msg.Role}
+		if len(msg.ToolCalls) > 0 {
+			// Assistant message that contains tool invocations.
+			// content must be null/omitted for OpenAI compatibility.
+			m["tool_calls"] = msg.ToolCalls
+		} else if msg.ToolCallID != "" {
+			// Tool result message (role="tool").
+			m["tool_call_id"] = msg.ToolCallID
+			m["content"] = msg.Content
+		} else {
+			m["content"] = msg.Content
+		}
+		messages = append(messages, m)
 	}
 
 	// Build basic request body
@@ -544,3 +627,124 @@ func (client *Client) buildRequestBodyFromRequest(req *Request) map[string]any {
 
 	return requestBody
 }
+
+// CallWithRequestStream streams the LLM response via SSE (Server-Sent Events).
+// onChunk is called with the full accumulated text so far after each received chunk.
+// Returns the complete final text when the stream ends.
+//
+// Idle timeout: if no chunk arrives for 30 seconds the stream is cancelled automatically.
+// This prevents the scanner from blocking indefinitely on a hung or stalled connection.
+func (client *Client) CallWithRequestStream(req *Request, onChunk func(string)) (string, error) {
+	if client.APIKey == "" {
+		return "", fmt.Errorf("AI API key not set")
+	}
+	if req.Model == "" {
+		req.Model = client.Model
+	}
+	req.Stream = true
+
+	requestBody := client.hooks.buildRequestBodyFromRequest(req)
+	jsonData, err := client.hooks.marshalRequestBody(requestBody)
+	if err != nil {
+		return "", err
+	}
+
+	url := client.hooks.buildUrl()
+	httpReq, err := client.hooks.buildRequest(url, jsonData)
+	if err != nil {
+		return "", err
+	}
+
+	// Idle-timeout watchdog: cancel the request if no SSE line arrives for 30 seconds.
+	// This breaks the scanner out of an indefinitely blocking Read on a hung connection.
+	const idleTimeout = 60 * time.Second
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	resetCh := make(chan struct{}, 1)
+	go func() {
+		t := time.NewTimer(idleTimeout)
+		defer t.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-t.C:
+				cancel() // idle timeout: kill the connection
+				return
+			case <-resetCh:
+				// received a line — reset the idle timer
+				if !t.Stop() {
+					select {
+					case <-t.C:
+					default:
+					}
+				}
+				t.Reset(idleTimeout)
+			}
+		}
+	}()
+
+	httpReq = httpReq.WithContext(ctx)
+	resp, err := client.httpClient.Do(httpReq)
+	if err != nil {
+		return "", fmt.Errorf("streaming request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return "", fmt.Errorf("API error (status %d): %s", resp.StatusCode, string(body))
+	}
+
+	var accumulated strings.Builder
+	scanner := bufio.NewScanner(resp.Body)
+
+	for scanner.Scan() {
+		// Ping the watchdog: we received a line, reset the idle timer.
+		select {
+		case resetCh <- struct{}{}:
+		default:
+		}
+
+		line := scanner.Text()
+		if !strings.HasPrefix(line, "data: ") {
+			continue
+		}
+		data := strings.TrimPrefix(line, "data: ")
+		if data == "[DONE]" {
+			break
+		}
+
+		// Parse the SSE JSON chunk
+		var chunk struct {
+			Choices []struct {
+				Delta struct {
+					Content string `json:"content"`
+				} `json:"delta"`
+				FinishReason *string `json:"finish_reason"`
+			} `json:"choices"`
+		}
+		if err := json.Unmarshal([]byte(data), &chunk); err != nil {
+			continue // skip malformed chunks
+		}
+		if len(chunk.Choices) == 0 {
+			continue
+		}
+
+		delta := chunk.Choices[0].Delta.Content
+		if delta == "" {
+			continue
+		}
+
+		accumulated.WriteString(delta)
+		if onChunk != nil {
+			onChunk(accumulated.String())
+		}
+	}
+
+	if err := scanner.Err(); err != nil {
+		return accumulated.String(), fmt.Errorf("stream interrupted: %w", err)
+	}
+
+	return accumulated.String(), nil
+}

mcp/config.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"nofx/logger"
+	"nofx/security"
 )
 
 // Config client configuration (centralized management of all configurations)
@@ -48,7 +49,7 @@ func DefaultConfig() *Config {
 
 		// Default dependencies (use global logger)
 		Logger:     logger.NewMCPLogger(),
-		HTTPClient: &http.Client{Timeout: DefaultTimeout},
+		HTTPClient: security.SafeHTTPClient(DefaultTimeout),
 	}
 }
 

mcp/interface.go

@@ -10,21 +10,52 @@ type AIClient interface {
 	SetAPIKey(apiKey string, customURL string, customModel string)
 	SetTimeout(timeout time.Duration)
 	CallWithMessages(systemPrompt, userPrompt string) (string, error)
-	CallWithRequest(req *Request) (string, error) // Builder pattern API (supports advanced features)
+	CallWithRequest(req *Request) (string, error)
+	// CallWithRequestStream streams the LLM response via SSE.
+	// onChunk is called with the full accumulated text so far (not raw deltas).
+	// Returns the complete final text when done.
+	CallWithRequestStream(req *Request, onChunk func(string)) (string, error)
+	// CallWithRequestFull returns both text content and tool calls.
+	// Use this when the request includes Tools — the LLM may respond with
+	// either a plain text reply (LLMResponse.Content) or tool invocations
+	// (LLMResponse.ToolCalls), but not both.
+	CallWithRequestFull(req *Request) (*LLMResponse, error)
 }
 
-// clientHooks internal hook interface (for subclass to override specific steps)
-// These methods are only used inside the package to implement dynamic dispatch
+// clientHooks is the internal dispatch interface used to implement per-provider
+// polymorphism without Go's lack of virtual methods.
+//
+// Each method can be overridden by an embedding struct (e.g. ClaudeClient).
+// The base *Client provides OpenAI-compatible defaults; providers with a
+// different wire format (Anthropic, Gemini native, etc.) override only what
+// differs.  All call-path methods in client.go invoke these via c.hooks so
+// that the override is always picked up at runtime.
 type clientHooks interface {
-	// Hook methods that can be overridden by subclass
-
+	// ── Simple CallWithMessages path ────────────────────────────────────────
 	call(systemPrompt, userPrompt string) (string, error)
-
 	buildMCPRequestBody(systemPrompt, userPrompt string) map[string]any
+
+	// ── Shared request plumbing ─────────────────────────────────────────────
 	buildUrl() string
 	buildRequest(url string, jsonData []byte) (*http.Request, error)
 	setAuthHeader(reqHeaders http.Header)
 	marshalRequestBody(requestBody map[string]any) ([]byte, error)
+
+	// ── Advanced (Request-object) path ──────────────────────────────────────
+	// buildRequestBodyFromRequest converts a *Request into the provider's
+	// native wire-format map.  Providers that use a different protocol (e.g.
+	// Anthropic uses "input_schema" for tools, "tool_use" content blocks, and
+	// a top-level "system" field) override this method.
+	buildRequestBodyFromRequest(req *Request) map[string]any
+
+	// parseMCPResponse extracts the plain-text reply from a non-streaming
+	// response body.
 	parseMCPResponse(body []byte) (string, error)
+
+	// parseMCPResponseFull extracts both text and tool calls.  Providers whose
+	// response envelope differs from the OpenAI choices[] structure (e.g.
+	// Anthropic content[] with tool_use blocks) override this method.
+	parseMCPResponseFull(body []byte) (*LLMResponse, error)
+
 	isRetryableError(err error) bool
 }

mcp/minimax_client.go

@@ -0,0 +1,83 @@
+package mcp
+
+import (
+	"net/http"
+)
+
+const (
+	ProviderMiniMax       = "minimax"
+	DefaultMiniMaxBaseURL = "https://api.minimax.io/v1"
+	DefaultMiniMaxModel   = "MiniMax-M2.5"
+)
+
+type MiniMaxClient struct {
+	*Client
+}
+
+// NewMiniMaxClient creates MiniMax client (backward compatible)
+func NewMiniMaxClient() AIClient {
+	return NewMiniMaxClientWithOptions()
+}
+
+// NewMiniMaxClientWithOptions creates MiniMax client (supports options pattern)
+//
+// Usage examples:
+//
+//	// Basic usage
+//	client := mcp.NewMiniMaxClientWithOptions()
+//
+//	// Custom configuration
+//	client := mcp.NewMiniMaxClientWithOptions(
+//	    mcp.WithAPIKey("sk-xxx"),
+//	    mcp.WithLogger(customLogger),
+//	    mcp.WithTimeout(60*time.Second),
+//	)
+func NewMiniMaxClientWithOptions(opts ...ClientOption) AIClient {
+	// 1. Create MiniMax preset options
+	minimaxOpts := []ClientOption{
+		WithProvider(ProviderMiniMax),
+		WithModel(DefaultMiniMaxModel),
+		WithBaseURL(DefaultMiniMaxBaseURL),
+	}
+
+	// 2. Merge user options (user options have higher priority)
+	allOpts := append(minimaxOpts, opts...)
+
+	// 3. Create base client
+	baseClient := NewClient(allOpts...).(*Client)
+
+	// 4. Create MiniMax client
+	minimaxClient := &MiniMaxClient{
+		Client: baseClient,
+	}
+
+	// 5. Set hooks to point to MiniMaxClient (implement dynamic dispatch)
+	baseClient.hooks = minimaxClient
+
+	return minimaxClient
+}
+
+func (c *MiniMaxClient) SetAPIKey(apiKey string, customURL string, customModel string) {
+	c.APIKey = apiKey
+
+	if len(apiKey) > 8 {
+		c.logger.Infof("🔧 [MCP] MiniMax API Key: %s...%s", apiKey[:4], apiKey[len(apiKey)-4:])
+	}
+	if customURL != "" {
+		c.BaseURL = customURL
+		c.logger.Infof("🔧 [MCP] MiniMax using custom BaseURL: %s", customURL)
+	} else {
+		c.logger.Infof("🔧 [MCP] MiniMax using default BaseURL: %s", c.BaseURL)
+	}
+	if customModel != "" {
+		c.Model = customModel
+		c.logger.Infof("🔧 [MCP] MiniMax using custom Model: %s", customModel)
+	} else {
+		c.logger.Infof("🔧 [MCP] MiniMax using default Model: %s", c.Model)
+	}
+}
+
+// MiniMax uses standard OpenAI-compatible API with Bearer auth
+func (c *MiniMaxClient) setAuthHeader(reqHeaders http.Header) {
+	c.Client.setAuthHeader(reqHeaders)
+}

mcp/minimax_client_test.go

@@ -0,0 +1,272 @@
+package mcp
+
+import (
+	"testing"
+	"time"
+)
+
+// ============================================================
+// Test MiniMaxClient Creation and Configuration
+// ============================================================
+
+func TestNewMiniMaxClient_Default(t *testing.T) {
+	client := NewMiniMaxClient()
+
+	if client == nil {
+		t.Fatal("client should not be nil")
+	}
+
+	// Type assertion check
+	mmClient, ok := client.(*MiniMaxClient)
+	if !ok {
+		t.Fatal("client should be *MiniMaxClient")
+	}
+
+	// Verify default values
+	if mmClient.Provider != ProviderMiniMax {
+		t.Errorf("Provider should be '%s', got '%s'", ProviderMiniMax, mmClient.Provider)
+	}
+
+	if mmClient.BaseURL != DefaultMiniMaxBaseURL {
+		t.Errorf("BaseURL should be '%s', got '%s'", DefaultMiniMaxBaseURL, mmClient.BaseURL)
+	}
+
+	if mmClient.Model != DefaultMiniMaxModel {
+		t.Errorf("Model should be '%s', got '%s'", DefaultMiniMaxModel, mmClient.Model)
+	}
+
+	if mmClient.logger == nil {
+		t.Error("logger should not be nil")
+	}
+
+	if mmClient.httpClient == nil {
+		t.Error("httpClient should not be nil")
+	}
+}
+
+func TestNewMiniMaxClientWithOptions(t *testing.T) {
+	mockLogger := NewMockLogger()
+	customModel := "MiniMax-M2.5-highspeed"
+	customAPIKey := "sk-custom-key"
+
+	client := NewMiniMaxClientWithOptions(
+		WithLogger(mockLogger),
+		WithModel(customModel),
+		WithAPIKey(customAPIKey),
+		WithMaxTokens(4000),
+	)
+
+	mmClient := client.(*MiniMaxClient)
+
+	// Verify custom options are applied
+	if mmClient.logger != mockLogger {
+		t.Error("logger should be set from option")
+	}
+
+	if mmClient.Model != customModel {
+		t.Error("Model should be set from option")
+	}
+
+	if mmClient.APIKey != customAPIKey {
+		t.Error("APIKey should be set from option")
+	}
+
+	if mmClient.MaxTokens != 4000 {
+		t.Error("MaxTokens should be 4000")
+	}
+
+	// Verify MiniMax default values are retained
+	if mmClient.Provider != ProviderMiniMax {
+		t.Errorf("Provider should still be '%s'", ProviderMiniMax)
+	}
+
+	if mmClient.BaseURL != DefaultMiniMaxBaseURL {
+		t.Errorf("BaseURL should still be '%s'", DefaultMiniMaxBaseURL)
+	}
+}
+
+// ============================================================
+// Test SetAPIKey
+// ============================================================
+
+func TestMiniMaxClient_SetAPIKey(t *testing.T) {
+	mockLogger := NewMockLogger()
+	client := NewMiniMaxClientWithOptions(
+		WithLogger(mockLogger),
+	)
+
+	mmClient := client.(*MiniMaxClient)
+
+	// Test setting API Key (default URL and Model)
+	mmClient.SetAPIKey("sk-test-key-12345678", "", "")
+
+	if mmClient.APIKey != "sk-test-key-12345678" {
+		t.Errorf("APIKey should be 'sk-test-key-12345678', got '%s'", mmClient.APIKey)
+	}
+
+	// Verify logging
+	logs := mockLogger.GetLogsByLevel("INFO")
+	if len(logs) == 0 {
+		t.Error("should have logged API key setting")
+	}
+
+	// Verify BaseURL and Model remain default
+	if mmClient.BaseURL != DefaultMiniMaxBaseURL {
+		t.Error("BaseURL should remain default")
+	}
+
+	if mmClient.Model != DefaultMiniMaxModel {
+		t.Error("Model should remain default")
+	}
+}
+
+func TestMiniMaxClient_SetAPIKey_WithCustomURL(t *testing.T) {
+	mockLogger := NewMockLogger()
+	client := NewMiniMaxClientWithOptions(
+		WithLogger(mockLogger),
+	)
+
+	mmClient := client.(*MiniMaxClient)
+
+	customURL := "https://api.minimaxi.com/v1"
+	mmClient.SetAPIKey("sk-test-key-12345678", customURL, "")
+
+	if mmClient.BaseURL != customURL {
+		t.Errorf("BaseURL should be '%s', got '%s'", customURL, mmClient.BaseURL)
+	}
+
+	// Verify logging
+	logs := mockLogger.GetLogsByLevel("INFO")
+	hasCustomURLLog := false
+	for _, log := range logs {
+		if log.Format == "🔧 [MCP] MiniMax using custom BaseURL: %s" {
+			hasCustomURLLog = true
+			break
+		}
+	}
+
+	if !hasCustomURLLog {
+		t.Error("should have logged custom BaseURL")
+	}
+}
+
+func TestMiniMaxClient_SetAPIKey_WithCustomModel(t *testing.T) {
+	mockLogger := NewMockLogger()
+	client := NewMiniMaxClientWithOptions(
+		WithLogger(mockLogger),
+	)
+
+	mmClient := client.(*MiniMaxClient)
+
+	customModel := "MiniMax-M2.5-highspeed"
+	mmClient.SetAPIKey("sk-test-key-12345678", "", customModel)
+
+	if mmClient.Model != customModel {
+		t.Errorf("Model should be '%s', got '%s'", customModel, mmClient.Model)
+	}
+
+	// Verify logging
+	logs := mockLogger.GetLogsByLevel("INFO")
+	hasCustomModelLog := false
+	for _, log := range logs {
+		if log.Format == "🔧 [MCP] MiniMax using custom Model: %s" {
+			hasCustomModelLog = true
+			break
+		}
+	}
+
+	if !hasCustomModelLog {
+		t.Error("should have logged custom Model")
+	}
+}
+
+// ============================================================
+// Test Integration Features
+// ============================================================
+
+func TestMiniMaxClient_CallWithMessages_Success(t *testing.T) {
+	mockHTTP := NewMockHTTPClient()
+	mockHTTP.SetSuccessResponse("MiniMax AI response")
+	mockLogger := NewMockLogger()
+
+	client := NewMiniMaxClientWithOptions(
+		WithHTTPClient(mockHTTP.ToHTTPClient()),
+		WithLogger(mockLogger),
+		WithAPIKey("sk-test-key"),
+	)
+
+	result, err := client.CallWithMessages("system prompt", "user prompt")
+
+	if err != nil {
+		t.Fatalf("should not error: %v", err)
+	}
+
+	if result != "MiniMax AI response" {
+		t.Errorf("expected 'MiniMax AI response', got '%s'", result)
+	}
+
+	// Verify request
+	requests := mockHTTP.GetRequests()
+	if len(requests) != 1 {
+		t.Fatalf("expected 1 request, got %d", len(requests))
+	}
+
+	req := requests[0]
+
+	// Verify URL
+	expectedURL := DefaultMiniMaxBaseURL + "/chat/completions"
+	if req.URL.String() != expectedURL {
+		t.Errorf("expected URL '%s', got '%s'", expectedURL, req.URL.String())
+	}
+
+	// Verify Authorization header
+	authHeader := req.Header.Get("Authorization")
+	if authHeader != "Bearer sk-test-key" {
+		t.Errorf("expected 'Bearer sk-test-key', got '%s'", authHeader)
+	}
+
+	// Verify Content-Type
+	if req.Header.Get("Content-Type") != "application/json" {
+		t.Error("Content-Type should be application/json")
+	}
+}
+
+func TestMiniMaxClient_Timeout(t *testing.T) {
+	client := NewMiniMaxClientWithOptions(
+		WithTimeout(30 * time.Second),
+	)
+
+	mmClient := client.(*MiniMaxClient)
+
+	if mmClient.httpClient.Timeout != 30*time.Second {
+		t.Errorf("expected timeout 30s, got %v", mmClient.httpClient.Timeout)
+	}
+
+	// Test SetTimeout
+	client.SetTimeout(60 * time.Second)
+
+	if mmClient.httpClient.Timeout != 60*time.Second {
+		t.Errorf("expected timeout 60s after SetTimeout, got %v", mmClient.httpClient.Timeout)
+	}
+}
+
+// ============================================================
+// Test hooks Mechanism
+// ============================================================
+
+func TestMiniMaxClient_HooksIntegration(t *testing.T) {
+	client := NewMiniMaxClientWithOptions()
+	mmClient := client.(*MiniMaxClient)
+
+	// Verify hooks point to mmClient itself (implements polymorphism)
+	if mmClient.hooks != mmClient {
+		t.Error("hooks should point to mmClient for polymorphism")
+	}
+
+	// Verify buildUrl uses MiniMax configuration
+	url := mmClient.buildUrl()
+	expectedURL := DefaultMiniMaxBaseURL + "/chat/completions"
+	if url != expectedURL {
+		t.Errorf("expected URL '%s', got '%s'", expectedURL, url)
+	}
+}

mcp/openai_client.go

@@ -7,7 +7,7 @@ import (
 const (
 	ProviderOpenAI       = "openai"
 	DefaultOpenAIBaseURL = "https://api.openai.com/v1"
-	DefaultOpenAIModel   = "gpt-5.2"
+	DefaultOpenAIModel   = "gpt-5.4"
 )
 
 type OpenAIClient struct {

mcp/options.go

@@ -22,7 +22,11 @@ func WithLogger(logger Logger) ClientOption {
 	}
 }
 
-// WithHTTPClient sets custom HTTP client
+// WithHTTPClient sets custom HTTP client.
+//
+// WARNING: The default client uses security.SafeHTTPClient() with SSRF protection
+// (blocks private IPs, cloud metadata, validates redirects). Overriding it bypasses
+// these protections. Only use in tests or with a client providing equivalent safeguards.
 //
 // Usage example:
 //   httpClient := &http.Client{Timeout: 60 * time.Second}
@@ -160,3 +164,17 @@ func WithQwenConfig(apiKey string) ClientOption {
 		c.Model = DefaultQwenModel
 	}
 }
+
+// WithMiniMaxConfig sets MiniMax configuration
+//
+// Usage example:
+//
+//	client := mcp.NewClient(mcp.WithMiniMaxConfig("sk-xxx"))
+func WithMiniMaxConfig(apiKey string) ClientOption {
+	return func(c *Config) {
+		c.Provider = ProviderMiniMax
+		c.APIKey = apiKey
+		c.BaseURL = DefaultMiniMaxBaseURL
+		c.Model = DefaultMiniMaxModel
+	}
+}

mcp/request.go

@@ -1,9 +1,34 @@
 package mcp
 
-// Message represents a conversation message
+// Message represents a conversation message.
+// Supports plain messages (Role+Content), assistant tool-call messages (ToolCalls),
+// and tool result messages (Role="tool", ToolCallID, Content).
 type Message struct {
-	Role    string `json:"role"`    // "system", "user", "assistant"
-	Content string `json:"content"` // Message content
+	Role       string     `json:"role"`                  // "system", "user", "assistant", "tool"
+	Content    string     `json:"content,omitempty"`     // Text content (omitted when ToolCalls present)
+	ToolCalls  []ToolCall `json:"tool_calls,omitempty"`  // Set by assistant when calling tools
+	ToolCallID string     `json:"tool_call_id,omitempty"` // Set on role="tool" result messages
+}
+
+// ToolCall is a single function call requested by the LLM.
+type ToolCall struct {
+	ID       string           `json:"id"`       // Unique call ID (e.g. "call_abc123")
+	Type     string           `json:"type"`     // Always "function"
+	Function ToolCallFunction `json:"function"` // Function name and JSON-serialised arguments
+}
+
+// ToolCallFunction holds the function name and raw JSON arguments string.
+type ToolCallFunction struct {
+	Name      string `json:"name"`      // Function name
+	Arguments string `json:"arguments"` // JSON-encoded argument object
+}
+
+// LLMResponse is returned by CallWithRequestFull and carries both the assistant
+// text reply (Content) and any structured tool calls (ToolCalls).
+// Exactly one of the two fields will be non-empty for a well-formed response.
+type LLMResponse struct {
+	Content   string     // Plain-text reply (final answer)
+	ToolCalls []ToolCall // Structured tool invocations
 }
 
 // Tool represents a tool/function that AI can call

mcp/x402.go

@@ -0,0 +1,219 @@
+package mcp
+
+import (
+	"bytes"
+	"crypto/ecdsa"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+
+	"github.com/ethereum/go-ethereum/crypto"
+)
+
+// ── Shared x402 types ────────────────────────────────────────────────────────
+
+// x402v2PaymentRequired is the structure of the Payment-Required header (x402 v2).
+type x402v2PaymentRequired struct {
+	X402Version int              `json:"x402Version"`
+	Accepts     []x402AcceptOption `json:"accepts"`
+	Resource    *x402Resource    `json:"resource"`
+}
+
+// x402AcceptOption is a payment option from the x402 v2 header.
+type x402AcceptOption struct {
+	Scheme            string            `json:"scheme"`
+	Network           string            `json:"network"`
+	Amount            string            `json:"amount"`
+	Asset             string            `json:"asset"`
+	PayTo             string            `json:"payTo"`
+	MaxTimeoutSeconds int               `json:"maxTimeoutSeconds"`
+	Extra             map[string]string `json:"extra"`
+}
+
+// x402Resource describes the resource being paid for.
+type x402Resource struct {
+	URL         string `json:"url"`
+	Description string `json:"description"`
+	MimeType    string `json:"mimeType"`
+}
+
+// x402SignFunc is a callback that signs an x402 payment header and returns the
+// base64-encoded payment signature.
+type x402SignFunc func(paymentHeaderB64 string) (string, error)
+
+// ── Shared x402 helpers ──────────────────────────────────────────────────────
+
+// x402DecodeHeader decodes a base64-encoded x402 Payment-Required header,
+// trying RawStdEncoding first then StdEncoding as fallback.
+func x402DecodeHeader(b64 string) ([]byte, error) {
+	decoded, err := base64.RawStdEncoding.DecodeString(b64)
+	if err != nil {
+		decoded, err = base64.StdEncoding.DecodeString(b64)
+		if err != nil {
+			return nil, fmt.Errorf("failed to base64-decode payment header: %w", err)
+		}
+	}
+	return decoded, nil
+}
+
+// signBasePaymentHeader decodes a base64 x402 header, parses it, and signs with
+// EIP-712 (USDC TransferWithAuthorization). Shared by BlockRunBase and Claw402.
+func signBasePaymentHeader(privateKey *ecdsa.PrivateKey, paymentHeaderB64 string, providerName string) (string, error) {
+	if privateKey == nil {
+		return "", fmt.Errorf("no private key set for %s wallet", providerName)
+	}
+
+	decoded, err := x402DecodeHeader(paymentHeaderB64)
+	if err != nil {
+		return "", err
+	}
+
+	var req x402v2PaymentRequired
+	if err := json.Unmarshal(decoded, &req); err != nil {
+		return "", fmt.Errorf("failed to parse x402 v2 payment header: %w", err)
+	}
+	if len(req.Accepts) == 0 {
+		return "", fmt.Errorf("no payment options in x402 response")
+	}
+
+	senderAddr := crypto.PubkeyToAddress(privateKey.PublicKey).Hex()
+	return signX402Payment(privateKey, senderAddr, req.Accepts[0], req.Resource)
+}
+
+// doX402Request executes an HTTP request and handles the x402 v2 payment flow.
+// On a 402 response it reads the Payment-Required (or X-Payment-Required) header,
+// signs via signFn, retries with Payment-Signature, and logs the Payment-Response
+// header (tx hash) on success.
+func doX402Request(
+	httpClient *http.Client,
+	buildReqFn func() (*http.Request, error),
+	signFn x402SignFunc,
+	providerTag string,
+	logger Logger,
+) ([]byte, error) {
+	req, err := buildReqFn()
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to send request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusPaymentRequired {
+		paymentHeader := resp.Header.Get("Payment-Required")
+		if paymentHeader == "" {
+			paymentHeader = resp.Header.Get("X-Payment-Required")
+		}
+		if paymentHeader == "" {
+			body, _ := io.ReadAll(resp.Body)
+			return nil, fmt.Errorf("received 402 but no Payment-Required header found. Body: %s", string(body))
+		}
+
+		// Drain 402 body to allow HTTP connection reuse.
+		_, _ = io.Copy(io.Discard, resp.Body)
+
+		paymentSig, err := signFn(paymentHeader)
+		if err != nil {
+			return nil, fmt.Errorf("failed to sign x402 payment: %w", err)
+		}
+
+		req2, err := buildReqFn()
+		if err != nil {
+			return nil, fmt.Errorf("failed to build retry request: %w", err)
+		}
+		req2.Header.Set("X-Payment", paymentSig)
+		req2.Header.Set("Payment-Signature", paymentSig)
+
+		resp2, err := httpClient.Do(req2)
+		if err != nil {
+			return nil, fmt.Errorf("failed to send payment retry: %w", err)
+		}
+		defer resp2.Body.Close()
+
+		body2, err := io.ReadAll(resp2.Body)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read payment retry response: %w", err)
+		}
+		if resp2.StatusCode != http.StatusOK {
+			return nil, fmt.Errorf("%s payment retry failed (status %d): %s", providerTag, resp2.StatusCode, string(body2))
+		}
+
+		if txHash := resp2.Header.Get("Payment-Response"); txHash != "" {
+			logger.Infof("💰 [%s] Payment tx: %s", providerTag, txHash)
+		}
+
+		return body2, nil
+	}
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("%s API error (status %d): %s", providerTag, resp.StatusCode, string(body))
+	}
+	return body, nil
+}
+
+// x402BuildRequest creates a POST request with Content-Type but no auth header.
+func x402BuildRequest(url string, jsonData []byte) (*http.Request, error) {
+	req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
+	if err != nil {
+		return nil, fmt.Errorf("fail to build request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	return req, nil
+}
+
+// x402SetAuthHeader is a no-op — x402 providers authenticate via payment signing.
+func x402SetAuthHeader(_ http.Header) {}
+
+// x402Call handles the x402 payment flow for the simple CallWithMessages path.
+func x402Call(c *Client, signFn x402SignFunc, tag string, systemPrompt, userPrompt string) (string, error) {
+	c.logger.Infof("📡 [%s] Request AI Server: %s", tag, c.BaseURL)
+
+	requestBody := c.hooks.buildMCPRequestBody(systemPrompt, userPrompt)
+	jsonData, err := c.hooks.marshalRequestBody(requestBody)
+	if err != nil {
+		return "", err
+	}
+
+	body, err := doX402Request(c.httpClient, func() (*http.Request, error) {
+		return c.hooks.buildRequest(c.hooks.buildUrl(), jsonData)
+	}, signFn, tag, c.logger)
+	if err != nil {
+		return "", err
+	}
+	return c.hooks.parseMCPResponse(body)
+}
+
+// x402CallFull handles the x402 payment flow for the advanced Request path.
+func x402CallFull(c *Client, signFn x402SignFunc, tag string, req *Request) (*LLMResponse, error) {
+	if c.APIKey == "" {
+		return nil, fmt.Errorf("AI API key not set, please call SetAPIKey first")
+	}
+	if req.Model == "" {
+		req.Model = c.Model
+	}
+
+	c.logger.Infof("📡 [%s] Request AI (full): %s", tag, c.BaseURL)
+
+	requestBody := c.hooks.buildRequestBodyFromRequest(req)
+	jsonData, err := c.hooks.marshalRequestBody(requestBody)
+	if err != nil {
+		return nil, err
+	}
+
+	body, err := doX402Request(c.httpClient, func() (*http.Request, error) {
+		return c.hooks.buildRequest(c.hooks.buildUrl(), jsonData)
+	}, signFn, tag, c.logger)
+	if err != nil {
+		return nil, err
+	}
+	return c.hooks.parseMCPResponseFull(body)
+}

nginx/nginx.conf

@@ -15,11 +15,18 @@ server {
     gzip_min_length 1024;
     gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss application/javascript application/json;
 
+    # index.html — never cache (so new deploys take effect immediately)
+    location = /index.html {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        add_header Pragma "no-cache";
+        add_header Expires 0;
+    }
+
     # Frontend routes (SPA) with static asset caching
     location / {
         try_files $uri $uri/ /index.html;
 
-        # Cache static assets
+        # Cache hashed static assets (js/css have content hashes in filenames)
         location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
             expires 1y;
             add_header Cache-Control "public, immutable";

provider/hyperliquid/coins.go

@@ -0,0 +1,223 @@
+package hyperliquid
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"nofx/logger"
+	"sort"
+	"sync"
+	"time"
+)
+
+const (
+	hyperliquidInfoURL = "https://api.hyperliquid.xyz/info"
+	cacheDuration      = 24 * time.Hour // Cache for 24 hours
+)
+
+// CoinInfo represents basic coin information
+type CoinInfo struct {
+	Symbol   string  `json:"symbol"`
+	Volume24h float64 `json:"volume_24h"` // 24h volume in USD
+}
+
+// CoinProvider provides Hyperliquid coin lists
+type CoinProvider struct {
+	mu            sync.RWMutex
+	allCoins      []CoinInfo
+	mainCoins     []CoinInfo
+	lastUpdated   time.Time
+	httpClient    *http.Client
+}
+
+var (
+	defaultProvider *CoinProvider
+	providerOnce    sync.Once
+)
+
+// GetProvider returns the singleton CoinProvider instance
+func GetProvider() *CoinProvider {
+	providerOnce.Do(func() {
+		defaultProvider = &CoinProvider{
+			httpClient: &http.Client{Timeout: 30 * time.Second},
+		}
+	})
+	return defaultProvider
+}
+
+// metaResponse represents the response from Hyperliquid meta endpoint
+type metaResponse struct {
+	Universe []struct {
+		Name string `json:"name"`
+	} `json:"universe"`
+}
+
+// assetCtx represents asset context with volume data
+type assetCtx struct {
+	DayNtlVlm string `json:"dayNtlVlm"` // 24h notional volume
+}
+
+// fetchCoins fetches all coins from Hyperliquid API and sorts by volume
+func (p *CoinProvider) fetchCoins(ctx context.Context) error {
+	// Request metaAndAssetCtxs to get both coin names and volume data
+	reqBody := []byte(`{"type": "metaAndAssetCtxs"}`)
+	
+	req, err := http.NewRequestWithContext(ctx, "POST", hyperliquidInfoURL, 
+		bytes.NewReader(reqBody))
+	if err != nil {
+		return fmt.Errorf("failed to create request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := p.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("failed to fetch coin data: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("API returned status %d", resp.StatusCode)
+	}
+
+	// Response is an array: [meta, [assetCtxs...]]
+	var rawResp []json.RawMessage
+	if err := json.NewDecoder(resp.Body).Decode(&rawResp); err != nil {
+		return fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	if len(rawResp) < 2 {
+		return fmt.Errorf("unexpected response format")
+	}
+
+	// Parse meta
+	var meta metaResponse
+	if err := json.Unmarshal(rawResp[0], &meta); err != nil {
+		return fmt.Errorf("failed to parse meta: %w", err)
+	}
+
+	// Parse asset contexts
+	var ctxs []assetCtx
+	if err := json.Unmarshal(rawResp[1], &ctxs); err != nil {
+		return fmt.Errorf("failed to parse asset contexts: %w", err)
+	}
+
+	// Build coin list with volume
+	var coins []CoinInfo
+	for i, u := range meta.Universe {
+		var vol float64
+		if i < len(ctxs) {
+			fmt.Sscanf(ctxs[i].DayNtlVlm, "%f", &vol)
+		}
+		coins = append(coins, CoinInfo{
+			Symbol:    u.Name,
+			Volume24h: vol,
+		})
+	}
+
+	// Sort by volume descending
+	sort.Slice(coins, func(i, j int) bool {
+		return coins[i].Volume24h > coins[j].Volume24h
+	})
+
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	p.allCoins = coins
+	// Main coins are top 20 by volume
+	if len(coins) > 20 {
+		p.mainCoins = coins[:20]
+	} else {
+		p.mainCoins = coins
+	}
+	p.lastUpdated = time.Now()
+
+	logger.Infof("✅ Hyperliquid coin list updated: %d total coins, top 20 by volume cached", len(coins))
+	
+	return nil
+}
+
+// ensureUpdated checks if cache is stale and refreshes if needed
+func (p *CoinProvider) ensureUpdated(ctx context.Context) error {
+	p.mu.RLock()
+	needsUpdate := time.Since(p.lastUpdated) > cacheDuration || len(p.allCoins) == 0
+	p.mu.RUnlock()
+
+	if needsUpdate {
+		return p.fetchCoins(ctx)
+	}
+	return nil
+}
+
+// GetAllCoins returns all available Hyperliquid perp coins
+func (p *CoinProvider) GetAllCoins(ctx context.Context) ([]CoinInfo, error) {
+	if err := p.ensureUpdated(ctx); err != nil {
+		return nil, err
+	}
+
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+
+	// Return a copy to avoid mutation
+	result := make([]CoinInfo, len(p.allCoins))
+	copy(result, p.allCoins)
+	return result, nil
+}
+
+// GetMainCoins returns top N coins by 24h volume
+func (p *CoinProvider) GetMainCoins(ctx context.Context, limit int) ([]CoinInfo, error) {
+	if err := p.ensureUpdated(ctx); err != nil {
+		return nil, err
+	}
+
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+
+	if limit <= 0 {
+		limit = 20
+	}
+
+	// Return top N coins
+	count := limit
+	if count > len(p.allCoins) {
+		count = len(p.allCoins)
+	}
+
+	result := make([]CoinInfo, count)
+	copy(result, p.allCoins[:count])
+	return result, nil
+}
+
+// GetCoinSymbols returns just the symbol names (for compatibility)
+func GetAllCoinSymbols(ctx context.Context) ([]string, error) {
+	coins, err := GetProvider().GetAllCoins(ctx)
+	if err != nil {
+		return nil, err
+	}
+	
+	symbols := make([]string, len(coins))
+	for i, c := range coins {
+		symbols[i] = c.Symbol
+	}
+	return symbols, nil
+}
+
+// GetMainCoinSymbols returns top N coin symbols by volume
+func GetMainCoinSymbols(ctx context.Context, limit int) ([]string, error) {
+	coins, err := GetProvider().GetMainCoins(ctx, limit)
+	if err != nil {
+		return nil, err
+	}
+	
+	symbols := make([]string, len(coins))
+	for i, c := range coins {
+		symbols[i] = c.Symbol
+	}
+	return symbols, nil
+}
+
+// ForceRefresh forces a refresh of the coin cache
+func (p *CoinProvider) ForceRefresh(ctx context.Context) error {
+	return p.fetchCoins(ctx)
+}

start.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 # ═══════════════════════════════════════════════════════════════
-# NOFX AI Trading System - Docker Quick Start Script
+# NOFX AI Trading System - Docker Management Script
 # Usage: ./start.sh [command]
 # ═══════════════════════════════════════════════════════════════
 
@@ -45,10 +45,10 @@ detect_compose_cmd() {
     elif command -v docker-compose &> /dev/null; then
         COMPOSE_CMD="docker-compose"
     else
-        print_error "Docker Compose 未安装！请先安装 Docker Compose"
+        print_error "Docker Compose not found. Please install Docker Compose first."
         exit 1
     fi
-    print_info "使用 Docker Compose 命令: $COMPOSE_CMD"
+    print_info "Using Docker Compose: $COMPOSE_CMD"
 }
 
 # ------------------------------------------------------------------------
@@ -56,12 +56,12 @@ detect_compose_cmd() {
 # ------------------------------------------------------------------------
 check_docker() {
     if ! command -v docker &> /dev/null; then
-        print_error "Docker 未安装！请先安装 Docker: https://docs.docker.com/get-docker/"
+        print_error "Docker not found. Please install Docker: https://docs.docker.com/get-docker/"
         exit 1
     fi
 
     detect_compose_cmd
-    print_success "Docker 和 Docker Compose 已安装"
+    print_success "Docker and Docker Compose are installed"
 }
 
 # ------------------------------------------------------------------------
@@ -69,11 +69,11 @@ check_docker() {
 # ------------------------------------------------------------------------
 check_env() {
     if [ ! -f ".env" ]; then
-        print_warning ".env 不存在，从模板复制..."
+        print_warning ".env not found, copying from template..."
         cp .env.example .env
-        print_info "已创建 .env 文件"
+        print_info ".env file created"
     fi
-    print_success "环境变量文件存在"
+    print_success "Environment file exists"
 }
 
 # ------------------------------------------------------------------------
@@ -83,15 +83,15 @@ is_env_configured() {
     local var_name="$1"
     local value=$(grep "^${var_name}=" .env 2>/dev/null | cut -d'=' -f2-)
 
-    # 去除引号
+    # Strip quotes
     value=$(echo "$value" | tr -d '"'"'")
 
-    # 检查是否为空或占位符
+    # Check empty
     if [ -z "$value" ]; then
         return 1
     fi
 
-    # 检查是否是示例值
+    # Check placeholder values
     case "$value" in
         *your-*|*YOUR_*|*change-this*|*CHANGE_THIS*|*example*|*EXAMPLE*)
             return 1
@@ -102,22 +102,23 @@ is_env_configured() {
 }
 
 # ------------------------------------------------------------------------
-# Helper: Generate and set env var in .env file
+# Helper: Set env var in .env file
 # ------------------------------------------------------------------------
 set_env_var() {
     local var_name="$1"
     local var_value="$2"
 
-    # 如果变量已存在（即使是占位符），替换它
     if grep -q "^${var_name}=" .env 2>/dev/null; then
-        # macOS 和 Linux 兼容的 sed
         if [[ "$OSTYPE" == "darwin"* ]]; then
             sed -i '' "s|^${var_name}=.*|${var_name}=${var_value}|" .env
         else
             sed -i "s|^${var_name}=.*|${var_name}=${var_value}|" .env
         fi
     else
-        # 变量不存在，追加
+        # Ensure .env ends with a newline before appending
+        if [ -s ".env" ] && [ "$(tail -c1 .env | wc -l)" -eq 0 ]; then
+            echo "" >> .env
+        fi
         echo "${var_name}=${var_value}" >> .env
     fi
 }
@@ -126,51 +127,46 @@ set_env_var() {
 # Validation: Encryption Keys in .env
 # ------------------------------------------------------------------------
 check_encryption() {
-    print_info "检查加密密钥配置..."
+    print_info "Checking encryption keys..."
 
     local generated=false
 
-    # 检查并生成 JWT_SECRET
     if ! is_env_configured "JWT_SECRET"; then
-        print_warning "JWT_SECRET 未配置，正在生成..."
+        print_warning "JWT_SECRET not set, generating..."
         local jwt_secret=$(openssl rand -base64 32)
         set_env_var "JWT_SECRET" "$jwt_secret"
-        print_success "JWT_SECRET 已生成"
+        print_success "JWT_SECRET generated"
         generated=true
     fi
 
-    # 检查并生成 DATA_ENCRYPTION_KEY
     if ! is_env_configured "DATA_ENCRYPTION_KEY"; then
-        print_warning "DATA_ENCRYPTION_KEY 未配置，正在生成..."
+        print_warning "DATA_ENCRYPTION_KEY not set, generating..."
         local data_key=$(openssl rand -base64 32)
         set_env_var "DATA_ENCRYPTION_KEY" "$data_key"
-        print_success "DATA_ENCRYPTION_KEY 已生成"
+        print_success "DATA_ENCRYPTION_KEY generated"
         generated=true
     fi
 
-    # 检查并生成 RSA_PRIVATE_KEY
     if ! is_env_configured "RSA_PRIVATE_KEY"; then
-        print_warning "RSA_PRIVATE_KEY 未配置，正在生成..."
-        # 生成 RSA 密钥并转换为单行格式（\n 替换为 \\n）
+        print_warning "RSA_PRIVATE_KEY not set, generating..."
         local rsa_key=$(openssl genrsa 2048 2>/dev/null | awk '{printf "%s\\n", $0}')
         set_env_var "RSA_PRIVATE_KEY" "\"$rsa_key\""
-        print_success "RSA_PRIVATE_KEY 已生成"
+        print_success "RSA_PRIVATE_KEY generated"
         generated=true
     fi
 
     if [ "$generated" = true ]; then
         echo ""
-        print_success "所有缺失的密钥已自动生成并保存到 .env"
-        print_warning "请妥善保管 .env 文件，不要提交到版本控制系统"
+        print_success "Missing keys generated and saved to .env"
+        print_warning "Keep .env safe — do not commit it to version control"
         echo ""
     fi
 
-    print_success "加密密钥检查完成"
+    print_success "Encryption keys OK"
     print_info "  • JWT_SECRET: OK"
     print_info "  • DATA_ENCRYPTION_KEY: OK"
     print_info "  • RSA_PRIVATE_KEY: OK"
 
-    # 修复 .env 文件权限
     chmod 600 .env 2>/dev/null || true
 }
 
@@ -197,13 +193,12 @@ read_env_vars() {
 # Validation: Database Directory (data/)
 # ------------------------------------------------------------------------
 check_database() {
-    # Ensure data directory exists
     if [ ! -d "data" ]; then
-        print_warning "数据目录不存在，创建 data/ 目录..."
+        print_warning "Data directory missing, creating data/..."
         install -m 700 -d data
-        print_success "已创建 data/ 目录"
+        print_success "data/ directory created"
     else
-        print_success "数据目录存在"
+        print_success "Data directory exists"
     fi
 }
 
@@ -211,47 +206,58 @@ check_database() {
 # Service Management: Start
 # ------------------------------------------------------------------------
 start() {
-    print_info "正在启动 NOFX AI Trading System..."
+    echo ""
+    echo -e "${CYAN}╔══════════════════════════════════════════════════════╗${NC}"
+    echo -e "${CYAN}║         🚀 NOFX AI Trading Bot — Startup             ║${NC}"
+    echo -e "${CYAN}╚══════════════════════════════════════════════════════╝${NC}"
+    echo ""
 
     read_env_vars
 
     if [ ! -d "data" ]; then
-        print_info "创建数据目录..."
         install -m 700 -d data
     fi
 
+    echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+    print_info "Starting services..."
+
     if [ "$1" == "--build" ]; then
-        print_info "重新构建镜像..."
         $COMPOSE_CMD up -d --build
     else
-        print_info "启动容器..."
         $COMPOSE_CMD up -d
     fi
 
-    print_success "服务已启动！"
-    print_info "Web 界面: http://localhost:${NOFX_FRONTEND_PORT}"
-    print_info "API 端点: http://localhost:${NOFX_BACKEND_PORT}"
-    print_info ""
-    print_info "查看日志: ./start.sh logs"
-    print_info "停止服务: ./start.sh stop"
+    echo ""
+    echo -e "${GREEN}╔══════════════════════════════════════════════════════╗${NC}"
+    echo -e "${GREEN}║  ✅ Started! Next steps:                             ║${NC}"
+    echo -e "${GREEN}╚══════════════════════════════════════════════════════╝${NC}"
+    echo ""
+    echo "  1. Open the web dashboard to register and configure"
+    echo "  2. Add an AI model and exchange in Settings"
+    echo "  3. (Optional) Add a Telegram bot token in Settings → Telegram"
+    echo ""
+    echo -e "  Web dashboard: ${BLUE}http://localhost:${NOFX_FRONTEND_PORT}${NC}"
+    echo -e "  View logs:     ${YELLOW}./start.sh logs${NC}"
+    echo -e "  Stop:          ${YELLOW}./start.sh stop${NC}"
+    echo ""
 }
 
 # ------------------------------------------------------------------------
 # Service Management: Stop
 # ------------------------------------------------------------------------
 stop() {
-    print_info "正在停止服务..."
+    print_info "Stopping services..."
     $COMPOSE_CMD stop
-    print_success "服务已停止"
+    print_success "Services stopped"
 }
 
 # ------------------------------------------------------------------------
 # Service Management: Restart
 # ------------------------------------------------------------------------
 restart() {
-    print_info "正在重启服务..."
+    print_info "Restarting services..."
     $COMPOSE_CMD restart
-    print_success "服务已重启"
+    print_success "Services restarted"
 }
 
 # ------------------------------------------------------------------------
@@ -271,25 +277,25 @@ logs() {
 status() {
     read_env_vars
 
-    print_info "服务状态:"
+    print_info "Service status:"
     $COMPOSE_CMD ps
     echo ""
-    print_info "健康检查:"
-    curl -s "http://localhost:${NOFX_BACKEND_PORT}/api/health" | jq '.' || echo "后端未响应"
+    print_info "Health check:"
+    curl -s "http://localhost:${NOFX_BACKEND_PORT}/api/health" | jq '.' || echo "Backend not responding"
 }
 
 # ------------------------------------------------------------------------
 # Maintenance: Clean (Destructive)
 # ------------------------------------------------------------------------
 clean() {
-    print_warning "这将删除所有容器和数据！"
-    read -p "确认删除？(yes/no): " confirm
+    print_warning "This will delete all containers and data!"
+    read -p "Confirm? (yes/no): " confirm
     if [ "$confirm" == "yes" ]; then
-        print_info "正在清理..."
+        print_info "Cleaning up..."
         $COMPOSE_CMD down -v
-        print_success "清理完成"
+        print_success "Cleanup complete"
     else
-        print_info "已取消"
+        print_info "Cancelled"
     fi
 }
 
@@ -297,77 +303,74 @@ clean() {
 # Maintenance: Update
 # ------------------------------------------------------------------------
 update() {
-    print_info "正在更新..."
+    print_info "Updating..."
     git pull
     $COMPOSE_CMD up -d --build
-    print_success "更新完成"
+    print_success "Update complete"
 }
 
 # ------------------------------------------------------------------------
 # Command: Regenerate all keys (force)
 # ------------------------------------------------------------------------
 regenerate_keys() {
-    print_warning "这将重新生成所有加密密钥！"
-    print_warning "如果已有加密数据，重新生成后将无法解密！"
+    print_warning "This will regenerate ALL encryption keys!"
+    print_warning "Any existing encrypted data will become unreadable!"
     echo ""
-    read -p "确认重新生成？(yes/no): " confirm
+    read -p "Confirm? (yes/no): " confirm
     if [ "$confirm" != "yes" ]; then
-        print_info "已取消"
+        print_info "Cancelled"
         return
     fi
 
     check_env
 
-    print_info "正在生成新的密钥..."
+    print_info "Generating new keys..."
 
-    # 生成 JWT_SECRET
     local jwt_secret=$(openssl rand -base64 32)
     set_env_var "JWT_SECRET" "$jwt_secret"
-    print_success "JWT_SECRET 已生成"
+    print_success "JWT_SECRET generated"
 
-    # 生成 DATA_ENCRYPTION_KEY
     local data_key=$(openssl rand -base64 32)
     set_env_var "DATA_ENCRYPTION_KEY" "$data_key"
-    print_success "DATA_ENCRYPTION_KEY 已生成"
+    print_success "DATA_ENCRYPTION_KEY generated"
 
-    # 生成 RSA_PRIVATE_KEY
     local rsa_key=$(openssl genrsa 2048 2>/dev/null | awk '{printf "%s\\n", $0}')
     set_env_var "RSA_PRIVATE_KEY" "\"$rsa_key\""
-    print_success "RSA_PRIVATE_KEY 已生成"
+    print_success "RSA_PRIVATE_KEY generated"
 
     chmod 600 .env 2>/dev/null || true
 
     echo ""
-    print_success "所有密钥已重新生成并保存到 .env"
-    print_warning "请妥善保管 .env 文件"
+    print_success "All keys regenerated and saved to .env"
+    print_warning "Keep .env safe"
 }
 
 # ------------------------------------------------------------------------
 # Help: Usage Information
 # ------------------------------------------------------------------------
 show_help() {
-    echo "NOFX AI Trading System - Docker 管理脚本"
+    echo "NOFX AI Trading System - Docker Management Script"
     echo ""
-    echo "用法: ./start.sh [command] [options]"
+    echo "Usage: ./start.sh [command] [options]"
     echo ""
-    echo "命令:"
-    echo "  start [--build]    启动服务（可选：重新构建）"
-    echo "  stop               停止服务"
-    echo "  restart            重启服务"
-    echo "  logs [service]     查看日志（可选：指定服务名 backend/frontend）"
-    echo "  status             查看服务状态"
-    echo "  clean              清理所有容器和数据"
-    echo "  update             更新代码并重启"
-    echo "  regenerate-keys    重新生成所有加密密钥（慎用）"
-    echo "  help               显示此帮助信息"
+    echo "Commands:"
+    echo "  start [--build]    Start services (optional: rebuild images)"
+    echo "  stop               Stop services"
+    echo "  restart            Restart services"
+    echo "  logs [service]     View logs (optional: backend / frontend)"
+    echo "  status             Show service status"
+    echo "  clean              Remove all containers and data"
+    echo "  update             Pull latest code and rebuild"
+    echo "  regenerate-keys    Regenerate all encryption keys (destructive)"
+    echo "  help               Show this help"
     echo ""
-    echo "示例:"
-    echo "  ./start.sh start --build    # 构建并启动"
-    echo "  ./start.sh logs backend     # 查看后端日志"
-    echo "  ./start.sh status           # 查看状态"
+    echo "Examples:"
+    echo "  ./start.sh start --build    # Build and start"
+    echo "  ./start.sh logs backend     # View backend logs"
+    echo "  ./start.sh status           # Check status"
     echo ""
-    echo "首次使用:"
-    echo "  直接运行 ./start.sh 即可，缺失的密钥会自动生成"
+    echo "First time:"
+    echo "  Just run ./start.sh — missing keys are generated automatically"
 }
 
 # ------------------------------------------------------------------------
@@ -408,7 +411,7 @@ main() {
             show_help
             ;;
         *)
-            print_error "未知命令: $1"
+            print_error "Unknown command: $1"
             show_help
             exit 1
             ;;

store/ai_model.go

@@ -137,6 +137,19 @@ func (s *AIModelStore) firstEnabled(userID string) (*AIModel, error) {
 	return &model, nil
 }
 
+// GetAnyEnabled returns the first enabled AI model across all users.
+// Used by single-user features (e.g. Telegram bot) that need any working LLM client.
+func (s *AIModelStore) GetAnyEnabled() (*AIModel, error) {
+	var model AIModel
+	err := s.db.Where("enabled = ? AND api_key != ''", true).
+		Order("updated_at DESC, id ASC").
+		First(&model).Error
+	if err != nil {
+		return nil, err
+	}
+	return &model, nil
+}
+
 // Update updates AI model, creates if not exists
 // IMPORTANT: If apiKey is empty string, the existing API key will be preserved (not overwritten)
 func (s *AIModelStore) Update(userID, id string, enabled bool, apiKey, customAPIURL, customModelName string) error {

store/exchange.go

@@ -17,27 +17,28 @@ type ExchangeStore struct {
 
 // Exchange exchange configuration
 type Exchange struct {
-	ID                      string          `gorm:"primaryKey" json:"id"`
-	ExchangeType            string          `gorm:"column:exchange_type;not null;default:''" json:"exchange_type"`
-	AccountName             string          `gorm:"column:account_name;not null;default:''" json:"account_name"`
-	UserID                  string          `gorm:"column:user_id;not null;default:default;index" json:"user_id"`
-	Name                    string          `gorm:"not null" json:"name"`
-	Type                    string          `gorm:"not null" json:"type"` // "cex" or "dex"
-	Enabled                 bool            `gorm:"default:false" json:"enabled"`
+	ID                      string                 `gorm:"primaryKey" json:"id"`
+	ExchangeType            string                 `gorm:"column:exchange_type;not null;default:''" json:"exchange_type"`
+	AccountName             string                 `gorm:"column:account_name;not null;default:''" json:"account_name"`
+	UserID                  string                 `gorm:"column:user_id;not null;default:default;index" json:"user_id"`
+	Name                    string                 `gorm:"not null" json:"name"`
+	Type                    string                 `gorm:"not null" json:"type"` // "cex" or "dex"
+	Enabled                 bool                   `gorm:"default:false" json:"enabled"`
 	APIKey                  crypto.EncryptedString `gorm:"column:api_key;default:''" json:"apiKey"`
 	SecretKey               crypto.EncryptedString `gorm:"column:secret_key;default:''" json:"secretKey"`
 	Passphrase              crypto.EncryptedString `gorm:"column:passphrase;default:''" json:"passphrase"`
-	Testnet                 bool            `gorm:"default:false" json:"testnet"`
-	HyperliquidWalletAddr   string          `gorm:"column:hyperliquid_wallet_addr;default:''" json:"hyperliquidWalletAddr"`
-	AsterUser               string          `gorm:"column:aster_user;default:''" json:"asterUser"`
-	AsterSigner             string          `gorm:"column:aster_signer;default:''" json:"asterSigner"`
+	Testnet                 bool                   `gorm:"default:false" json:"testnet"`
+	HyperliquidWalletAddr   string                 `gorm:"column:hyperliquid_wallet_addr;default:''" json:"hyperliquidWalletAddr"`
+	HyperliquidUnifiedAcct  bool                   `gorm:"column:hyperliquid_unified_account;default:true" json:"hyperliquidUnifiedAccount"` // Unified Account mode (Spot as collateral)
+	AsterUser               string                 `gorm:"column:aster_user;default:''" json:"asterUser"`
+	AsterSigner             string                 `gorm:"column:aster_signer;default:''" json:"asterSigner"`
 	AsterPrivateKey         crypto.EncryptedString `gorm:"column:aster_private_key;default:''" json:"asterPrivateKey"`
-	LighterWalletAddr       string          `gorm:"column:lighter_wallet_addr;default:''" json:"lighterWalletAddr"`
+	LighterWalletAddr       string                 `gorm:"column:lighter_wallet_addr;default:''" json:"lighterWalletAddr"`
 	LighterPrivateKey       crypto.EncryptedString `gorm:"column:lighter_private_key;default:''" json:"lighterPrivateKey"`
 	LighterAPIKeyPrivateKey crypto.EncryptedString `gorm:"column:lighter_api_key_private_key;default:''" json:"lighterAPIKeyPrivateKey"`
-	LighterAPIKeyIndex      int             `gorm:"column:lighter_api_key_index;default:0" json:"lighterAPIKeyIndex"`
-	CreatedAt               time.Time       `json:"created_at"`
-	UpdatedAt               time.Time       `json:"updated_at"`
+	LighterAPIKeyIndex      int                    `gorm:"column:lighter_api_key_index;default:0" json:"lighterAPIKeyIndex"`
+	CreatedAt               time.Time              `json:"created_at"`
+	UpdatedAt               time.Time              `json:"updated_at"`
 }
 
 func (Exchange) TableName() string { return "exchanges" }
@@ -173,6 +174,8 @@ func getExchangeNameAndType(exchangeType string) (name string, typ string) {
 		return "Aster DEX", "dex"
 	case "lighter":
 		return "LIGHTER DEX", "dex"
+	case "indodax":
+		return "Indodax", "cex"
 	default:
 		return exchangeType + " Exchange", "cex"
 	}
@@ -181,7 +184,8 @@ func getExchangeNameAndType(exchangeType string) (name string, typ string) {
 // Create creates a new exchange account with UUID
 func (s *ExchangeStore) Create(userID, exchangeType, accountName string, enabled bool,
 	apiKey, secretKey, passphrase string, testnet bool,
-	hyperliquidWalletAddr, asterUser, asterSigner, asterPrivateKey,
+	hyperliquidWalletAddr string, hyperliquidUnifiedAcct bool,
+	asterUser, asterSigner, asterPrivateKey,
 	lighterWalletAddr, lighterPrivateKey, lighterApiKeyPrivateKey string, lighterApiKeyIndex int) (string, error) {
 
 	id := uuid.New().String()
@@ -207,6 +211,7 @@ func (s *ExchangeStore) Create(userID, exchangeType, accountName string, enabled
 		Passphrase:              crypto.EncryptedString(passphrase),
 		Testnet:                 testnet,
 		HyperliquidWalletAddr:   hyperliquidWalletAddr,
+		HyperliquidUnifiedAcct:  hyperliquidUnifiedAcct,
 		AsterUser:               asterUser,
 		AsterSigner:             asterSigner,
 		AsterPrivateKey:         crypto.EncryptedString(asterPrivateKey),
@@ -224,19 +229,21 @@ func (s *ExchangeStore) Create(userID, exchangeType, accountName string, enabled
 
 // Update updates exchange configuration by UUID
 func (s *ExchangeStore) Update(userID, id string, enabled bool, apiKey, secretKey, passphrase string, testnet bool,
-	hyperliquidWalletAddr, asterUser, asterSigner, asterPrivateKey, lighterWalletAddr, lighterPrivateKey, lighterApiKeyPrivateKey string, lighterApiKeyIndex int) error {
+	hyperliquidWalletAddr string, hyperliquidUnifiedAcct bool,
+	asterUser, asterSigner, asterPrivateKey, lighterWalletAddr, lighterPrivateKey, lighterApiKeyPrivateKey string, lighterApiKeyIndex int) error {
 
 	logger.Debugf("🔧 ExchangeStore.Update: userID=%s, id=%s, enabled=%v", userID, id, enabled)
 
 	updates := map[string]interface{}{
-		"enabled":                 enabled,
-		"testnet":                 testnet,
-		"hyperliquid_wallet_addr": hyperliquidWalletAddr,
-		"aster_user":              asterUser,
-		"aster_signer":            asterSigner,
-		"lighter_wallet_addr":     lighterWalletAddr,
-		"lighter_api_key_index":   lighterApiKeyIndex,
-		"updated_at":              time.Now().UTC(),
+		"enabled":                     enabled,
+		"testnet":                     testnet,
+		"hyperliquid_wallet_addr":     hyperliquidWalletAddr,
+		"hyperliquid_unified_account": hyperliquidUnifiedAcct,
+		"aster_user":                  asterUser,
+		"aster_signer":                asterSigner,
+		"lighter_wallet_addr":         lighterWalletAddr,
+		"lighter_api_key_index":       lighterApiKeyIndex,
+		"updated_at":                  time.Now().UTC(),
 	}
 
 	// Only update encrypted fields if not empty
@@ -307,7 +314,8 @@ func (s *ExchangeStore) CreateLegacy(userID, id, name, typ string, enabled bool,
 	// Check if this is an old-style ID (exchange type as ID)
 	if id == "binance" || id == "bybit" || id == "okx" || id == "bitget" || id == "hyperliquid" || id == "aster" || id == "lighter" {
 		_, err := s.Create(userID, id, "Default", enabled, apiKey, secretKey, "", testnet,
-			hyperliquidWalletAddr, asterUser, asterSigner, asterPrivateKey, "", "", "", 0)
+			hyperliquidWalletAddr, true, // Default to Unified Account mode
+			asterUser, asterSigner, asterPrivateKey, "", "", "", 0)
 		return err
 	}
 

store/store.go

@@ -18,17 +18,18 @@ type Store struct {
 	driver *DBDriver // Database driver for abstraction (legacy)
 
 	// Sub-stores (lazy initialization)
-	user     *UserStore
-	aiModel  *AIModelStore
-	exchange *ExchangeStore
-	trader   *TraderStore
-	decision *DecisionStore
-	backtest *BacktestStore
-	position *PositionStore
-	strategy *StrategyStore
-	equity   *EquityStore
-	order    *OrderStore
-	grid     *GridStore
+	user           *UserStore
+	aiModel        *AIModelStore
+	exchange       *ExchangeStore
+	trader         *TraderStore
+	decision       *DecisionStore
+	backtest       *BacktestStore
+	position       *PositionStore
+	strategy       *StrategyStore
+	equity         *EquityStore
+	order          *OrderStore
+	grid           *GridStore
+	telegramConfig TelegramConfigStore
 
 	mu sync.RWMutex
 }
@@ -160,6 +161,9 @@ func (s *Store) initTables() error {
 	if err := s.Grid().InitTables(); err != nil {
 		return fmt.Errorf("failed to initialize grid tables: %w", err)
 	}
+	if err := s.TelegramConfig().(*telegramConfigStore).initTables(); err != nil {
+		return fmt.Errorf("failed to initialize telegram config tables: %w", err)
+	}
 	return nil
 }
 
@@ -293,6 +297,16 @@ func (s *Store) Grid() *GridStore {
 	return s.grid
 }
 
+// TelegramConfig gets Telegram bot configuration storage
+func (s *Store) TelegramConfig() TelegramConfigStore {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.telegramConfig == nil {
+		s.telegramConfig = NewTelegramConfigStore(s.gdb)
+	}
+	return s.telegramConfig
+}
+
 // Close closes database connection
 func (s *Store) Close() error {
 	if s.driver != nil {

store/strategy.go

@@ -119,6 +119,12 @@ type CoinSourceConfig struct {
 	UseOILow bool `json:"use_oi_low"`
 	// OI Low maximum count
 	OILowLimit int `json:"oi_low_limit,omitempty"`
+	// whether to use Hyperliquid All coins (all available perp pairs)
+	UseHyperAll bool `json:"use_hyper_all"`
+	// whether to use Hyperliquid Main coins (top N by 24h volume)
+	UseHyperMain bool `json:"use_hyper_main"`
+	// Hyperliquid Main maximum count (default 20)
+	HyperMainLimit int `json:"hyper_main_limit,omitempty"`
 	// Note: API URLs are now built automatically using NofxOSAPIKey from IndicatorConfig
 }
 

store/telegram_config.go

@@ -0,0 +1,164 @@
+package store
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+// TelegramConfig stores the Telegram bot binding (single row, always ID=1)
+type TelegramConfig struct {
+	ID        uint      `gorm:"primaryKey"`
+	BotToken  string    `gorm:"column:bot_token"`
+	ChatID    int64     `gorm:"column:chat_id"`
+	Username  string    `gorm:"column:username"` // @username for display
+	BoundAt   time.Time `gorm:"column:bound_at"`
+	ModelID   string    `gorm:"column:model_id;default:''"` // AI model used for Telegram replies
+	Language  string    `gorm:"column:language;default:''"` // "zh" or "en"; empty = not chosen yet
+	CreatedAt time.Time
+	UpdatedAt time.Time
+}
+
+// String returns a safe string representation of TelegramConfig with the token masked.
+func (tc TelegramConfig) String() string {
+	token := "***"
+	if tc.BotToken == "" {
+		token = "<not set>"
+	}
+	return fmt.Sprintf("TelegramConfig{ID:%d, ChatID:%d, Username:%q, BotToken:%s, BoundAt:%v}",
+		tc.ID, tc.ChatID, tc.Username, token, tc.BoundAt)
+}
+
+// TelegramConfigStore defines the interface for Telegram bot binding operations
+type TelegramConfigStore interface {
+	Get() (*TelegramConfig, error)                    // Get current config (may not exist)
+	SaveToken(botToken string) error                  // Save bot token only (Web UI sets this)
+	Save(botToken, modelID string) error              // Save bot token + selected AI model
+	BindUser(chatID int64, username string) error     // Called on first /start
+	IsBound() (bool, error)                           // Check if any user is bound
+	GetBoundChatID() (int64, error)                   // Get bound chat ID (0 if not bound)
+	Unbind() error                                    // Remove binding
+	SetLanguage(lang string) error                    // Set UI language ("en" or "zh")
+	GetLanguage() string                              // Get UI language; returns "en" if not set
+}
+
+type telegramConfigStore struct {
+	db *gorm.DB
+	mu sync.RWMutex
+}
+
+// NewTelegramConfigStore creates a new TelegramConfigStore
+func NewTelegramConfigStore(db *gorm.DB) TelegramConfigStore {
+	return &telegramConfigStore{db: db}
+}
+
+func (s *telegramConfigStore) initTables() error {
+	return s.db.AutoMigrate(&TelegramConfig{})
+}
+
+func (s *telegramConfigStore) Get() (*TelegramConfig, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	var cfg TelegramConfig
+	if err := s.db.First(&cfg, 1).Error; err != nil {
+		return nil, err
+	}
+	return &cfg, nil
+}
+
+func (s *telegramConfigStore) SaveToken(botToken string) error {
+	return s.Save(botToken, "")
+}
+
+func (s *telegramConfigStore) Save(botToken, modelID string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	var cfg TelegramConfig
+	result := s.db.First(&cfg, 1)
+	if result.Error != nil && !errors.Is(result.Error, gorm.ErrRecordNotFound) {
+		return result.Error
+	}
+	cfg.ID = 1
+	cfg.BotToken = botToken
+	cfg.ModelID = modelID
+	return s.db.Save(&cfg).Error
+}
+
+func (s *telegramConfigStore) BindUser(chatID int64, username string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	var cfg TelegramConfig
+	result := s.db.First(&cfg, 1)
+	if result.Error != nil && !errors.Is(result.Error, gorm.ErrRecordNotFound) {
+		return result.Error
+	}
+	cfg.ID = 1
+	cfg.ChatID = chatID
+	cfg.Username = username
+	cfg.BoundAt = time.Now()
+	return s.db.Save(&cfg).Error
+}
+
+func (s *telegramConfigStore) IsBound() (bool, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	var cfg TelegramConfig
+	if err := s.db.First(&cfg, 1).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return false, nil
+		}
+		return false, err
+	}
+	return cfg.ChatID != 0, nil
+}
+
+func (s *telegramConfigStore) GetBoundChatID() (int64, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	var cfg TelegramConfig
+	if err := s.db.First(&cfg, 1).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return 0, nil
+		}
+		return 0, err
+	}
+	return cfg.ChatID, nil
+}
+
+func (s *telegramConfigStore) Unbind() error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.db.Model(&TelegramConfig{}).Where("id = 1").Updates(map[string]interface{}{
+		"chat_id":  0,
+		"username": "",
+	}).Error
+}
+
+func (s *telegramConfigStore) SetLanguage(lang string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	var cfg TelegramConfig
+	result := s.db.First(&cfg, 1)
+	if result.Error != nil && !errors.Is(result.Error, gorm.ErrRecordNotFound) {
+		return result.Error
+	}
+	cfg.ID = 1
+	cfg.Language = lang
+	return s.db.Save(&cfg).Error
+}
+
+func (s *telegramConfigStore) GetLanguage() string {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	var cfg TelegramConfig
+	if err := s.db.First(&cfg, 1).Error; err != nil {
+		return "en" // default: English
+	}
+	if cfg.Language == "" {
+		return "en"
+	}
+	return cfg.Language
+}

store/user.go

@@ -1,8 +1,6 @@
 package store
 
 import (
-	"crypto/rand"
-	"encoding/base32"
 	"time"
 
 	"gorm.io/gorm"
@@ -18,24 +16,12 @@ type User struct {
 	ID           string    `gorm:"primaryKey" json:"id"`
 	Email        string    `gorm:"uniqueIndex:idx_users_email;not null" json:"email"`
 	PasswordHash string    `gorm:"column:password_hash;not null" json:"-"`
-	OTPSecret    string    `gorm:"column:otp_secret" json:"-"`
-	OTPVerified  bool      `gorm:"column:otp_verified;default:false" json:"otp_verified"`
 	CreatedAt    time.Time `json:"created_at"`
 	UpdatedAt    time.Time `json:"updated_at"`
 }
 
 func (User) TableName() string { return "users" }
 
-// GenerateOTPSecret generates OTP secret
-func GenerateOTPSecret() (string, error) {
-	secret := make([]byte, 20)
-	_, err := rand.Read(secret)
-	if err != nil {
-		return "", err
-	}
-	return base32.StdEncoding.EncodeToString(secret), nil
-}
-
 // NewUserStore creates a new UserStore
 func NewUserStore(db *gorm.DB) *UserStore {
 	return &UserStore{db: db}
@@ -54,9 +40,6 @@ func (s *UserStore) initTables() error {
 			s.db.Exec(`ALTER TABLE users ADD COLUMN IF NOT EXISTS password_hash TEXT NOT NULL DEFAULT ''`)
 			s.db.Exec(`ALTER TABLE users ADD COLUMN IF NOT EXISTS created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP`)
 			s.db.Exec(`ALTER TABLE users ADD COLUMN IF NOT EXISTS updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP`)
-			// OTP columns (added later)
-			s.db.Exec(`ALTER TABLE users ADD COLUMN IF NOT EXISTS otp_secret TEXT DEFAULT ''`)
-			s.db.Exec(`ALTER TABLE users ADD COLUMN IF NOT EXISTS otp_verified BOOLEAN DEFAULT FALSE`)
 
 			// Ensure unique index exists on email (don't care about the name)
 			var indexExists int64
@@ -114,9 +97,11 @@ func (s *UserStore) GetAllIDs() ([]string, error) {
 	return userIDs, err
 }
 
-// UpdateOTPVerified updates OTP verification status
-func (s *UserStore) UpdateOTPVerified(userID string, verified bool) error {
-	return s.db.Model(&User{}).Where("id = ?", userID).Update("otp_verified", verified).Error
+// GetAll returns all users ordered by creation time.
+func (s *UserStore) GetAll() ([]User, error) {
+	var users []User
+	err := s.db.Model(&User{}).Order("created_at").Find(&users).Error
+	return users, err
 }
 
 // UpdatePassword updates password
@@ -138,7 +123,5 @@ func (s *UserStore) EnsureAdmin() error {
 		ID:           "admin",
 		Email:        "admin@localhost",
 		PasswordHash: "",
-		OTPSecret:    "",
-		OTPVerified:  true,
 	})
 }

telegram/agent/agent.go

@@ -0,0 +1,285 @@
+package agent
+
+import (
+	"encoding/json"
+	"fmt"
+	"nofx/auth"
+	"nofx/logger"
+	"nofx/mcp"
+	"nofx/telegram/session"
+	"strings"
+)
+
+const maxIterations = 10
+
+// apiRequestTool is the single tool exposed to the LLM.
+// Native function calling means the LLM returns EITHER ToolCalls OR Content — never both.
+// This makes narration structurally impossible: text cannot appear alongside a tool call.
+var apiRequestTool = mcp.Tool{
+	Type: "function",
+	Function: mcp.FunctionDef{
+		Name:        "api_request",
+		Description: "Call the NOFX trading system REST API",
+		Parameters: map[string]any{
+			"type": "object",
+			"properties": map[string]any{
+				"method": map[string]any{
+					"type":        "string",
+					"enum":        []string{"GET", "POST", "PUT", "DELETE"},
+					"description": "HTTP method",
+				},
+				"path": map[string]any{
+					"type":        "string",
+					"description": "API path; include query params in path: /api/positions?trader_id=xxx",
+				},
+				"body": map[string]any{
+					"type":        "object",
+					"description": "Request body; use {} for GET requests",
+				},
+			},
+			"required": []string{"method", "path", "body"},
+		},
+	},
+}
+
+// Agent is a stateful AI agent for one Telegram chat.
+// It exposes a single "api_request" tool and runs a loop until the LLM
+// returns a plain-text reply (no tool calls).
+type Agent struct {
+	apiTool      *apiCallTool
+	getLLM       func() mcp.AIClient
+	memory       *session.Memory
+	systemPrompt string
+	userID       string
+}
+
+// New creates an Agent for one chat session.
+func New(apiPort int, botToken, userID string, getLLM func() mcp.AIClient, systemPrompt string) *Agent {
+	return &Agent{
+		apiTool:      newAPICallTool(apiPort, botToken),
+		getLLM:       getLLM,
+		memory:       session.NewMemory(getLLM()),
+		systemPrompt: systemPrompt,
+		userID:       userID,
+	}
+}
+
+// GenerateBotToken creates a long-lived JWT for the bot's internal API calls.
+// userID must match the actual registered user's ID so bot-made changes
+// are visible in the frontend (shared user namespace).
+func GenerateBotToken(userID string) (string, error) {
+	return auth.GenerateJWT(userID, "bot@internal")
+}
+
+// buildAccountContext fetches the live account state (models, exchanges, strategies, traders,
+// and per-trader account summary + statistics) and returns it as a formatted string for
+// injection into the LLM context at the start of each conversation.
+func (a *Agent) buildAccountContext() string {
+	var sb strings.Builder
+	sb.WriteString(fmt.Sprintf("[Current Account State — User: %s]\n\n", a.userID))
+
+	// ── AI Models ─────────────────────────────────────────────────────────────
+	modelsRaw := a.apiTool.execute(&apiRequest{Method: "GET", Path: "/api/models"})
+	sb.WriteString("## AI Models\n")
+	sb.WriteString("⚠️  When creating a trader, use the EXACT \"id\" value below for \"ai_model_id\".\n")
+	sb.WriteString("    DO NOT use the \"provider\" field — it is NOT a valid ai_model_id.\n\n")
+
+	var models []struct {
+		ID       string `json:"id"`
+		Name     string `json:"name"`
+		Provider string `json:"provider"`
+		Enabled  bool   `json:"enabled"`
+	}
+	if err := json.Unmarshal([]byte(modelsRaw), &models); err == nil && len(models) > 0 {
+		for _, m := range models {
+			status := "disabled"
+			if m.Enabled {
+				status = "ENABLED"
+			}
+			sb.WriteString(fmt.Sprintf("  • ai_model_id=\"%s\"  provider=%s  name=%s  [%s]\n", m.ID, m.Provider, m.Name, status))
+		}
+	} else {
+		sb.WriteString(modelsRaw)
+	}
+	sb.WriteString("\n")
+
+	// ── Exchanges ─────────────────────────────────────────────────────────────
+	exchangesRaw := a.apiTool.execute(&apiRequest{Method: "GET", Path: "/api/exchanges"})
+	sb.WriteString("## Exchanges\n")
+	sb.WriteString("⚠️  Use the EXACT \"id\" value below for \"exchange_id\" when creating a trader.\n\n")
+
+	var exchanges []struct {
+		ID           string `json:"id"`
+		Name         string `json:"name"`
+		ExchangeType string `json:"exchange_type"`
+		AccountName  string `json:"account_name"`
+		Enabled      bool   `json:"enabled"`
+	}
+	if err := json.Unmarshal([]byte(exchangesRaw), &exchanges); err == nil && len(exchanges) > 0 {
+		for _, e := range exchanges {
+			status := "disabled"
+			if e.Enabled {
+				status = "ENABLED"
+			}
+			sb.WriteString(fmt.Sprintf("  • exchange_id=\"%s\"  type=%s  account=%s  [%s]\n", e.ID, e.ExchangeType, e.AccountName, status))
+		}
+	} else {
+		sb.WriteString(exchangesRaw)
+	}
+	sb.WriteString("\n")
+
+	// ── Strategies ────────────────────────────────────────────────────────────
+	strategiesRaw := a.apiTool.execute(&apiRequest{Method: "GET", Path: "/api/strategies"})
+	sb.WriteString("## Strategies\n")
+
+	var strategies []struct {
+		ID   string `json:"id"`
+		Name string `json:"name"`
+	}
+	if err := json.Unmarshal([]byte(strategiesRaw), &strategies); err == nil && len(strategies) > 0 {
+		for _, s := range strategies {
+			sb.WriteString(fmt.Sprintf("  • strategy_id=\"%s\"  name=%s\n", s.ID, s.Name))
+		}
+	} else {
+		sb.WriteString(strategiesRaw)
+	}
+	sb.WriteString("\n")
+
+	// ── Traders ───────────────────────────────────────────────────────────────
+	tradersRaw := a.apiTool.execute(&apiRequest{Method: "GET", Path: "/api/my-traders"})
+	sb.WriteString("## Traders\n")
+
+	var traders []struct {
+		TraderID  string `json:"trader_id"`
+		Name      string `json:"trader_name"`
+		IsRunning bool   `json:"is_running"`
+	}
+	if err := json.Unmarshal([]byte(tradersRaw), &traders); err == nil && len(traders) > 0 {
+		for _, t := range traders {
+			status := "stopped"
+			if t.IsRunning {
+				status = "RUNNING"
+			}
+			sb.WriteString(fmt.Sprintf("  • trader_id=\"%s\"  name=%s  [%s]\n", t.TraderID, t.Name, status))
+		}
+	} else {
+		sb.WriteString(tradersRaw)
+	}
+	sb.WriteString("\n")
+
+	// ── Per-trader live data (running traders only) ────────────────────────────
+	for _, t := range traders {
+		if !t.IsRunning {
+			continue
+		}
+		acct := a.apiTool.execute(&apiRequest{Method: "GET", Path: "/api/account?trader_id=" + t.TraderID})
+		sb.WriteString(fmt.Sprintf("Account [%s]:\n%s\n\n", t.Name, acct))
+		stats := a.apiTool.execute(&apiRequest{Method: "GET", Path: "/api/statistics?trader_id=" + t.TraderID})
+		sb.WriteString(fmt.Sprintf("Statistics [%s]:\n%s\n\n", t.Name, stats))
+	}
+
+	return sb.String()
+}
+
+// Run processes one user message through the native function-calling agent loop.
+//
+// Architecture:
+//   - LLM receives the api_request tool definition alongside conversation history.
+//   - LLM response is EITHER ToolCalls (execute API) OR Content (final reply) — never both.
+//     This is enforced by the protocol: narration is structurally impossible.
+//   - Loop continues until the LLM returns a plain-text reply (no tool calls).
+//
+// On the first message of a conversation the live account state is fetched and injected.
+// onChunk is optional; when set it is called once with the complete final reply text.
+func (a *Agent) Run(userMessage string, onChunk func(string)) string {
+	llm := a.getLLM()
+	if llm == nil {
+		return "AI assistant unavailable. Please configure an AI model in the Web UI."
+	}
+
+	// Build initial user message: prepend account state on first turn, history on subsequent turns.
+	histCtx := a.memory.BuildContext()
+	var firstUserContent string
+	if histCtx == "" {
+		accountCtx := a.buildAccountContext()
+		firstUserContent = accountCtx + "\n[User Message]\n" + userMessage
+	} else {
+		firstUserContent = histCtx + "\n---\nUser: " + userMessage
+	}
+
+	turnMsgs := []mcp.Message{mcp.NewUserMessage(firstUserContent)}
+
+	for i := 0; i < maxIterations; i++ {
+		req, err := mcp.NewRequestBuilder().
+			WithSystemPrompt(a.systemPrompt).
+			AddConversationHistory(turnMsgs).
+			AddTool(apiRequestTool).
+			WithToolChoice("auto").
+			Build()
+		if err != nil {
+			logger.Errorf("Agent: failed to build request: %v", err)
+			break
+		}
+
+		resp, err := llm.CallWithRequestFull(req)
+		if err != nil {
+			logger.Errorf("Agent: LLM call failed (iteration %d): %v", i+1, err)
+			return "AI assistant temporarily unavailable. Please try again."
+		}
+
+		// No tool calls → LLM returned a final text reply.
+		if len(resp.ToolCalls) == 0 {
+			reply := strings.TrimSpace(resp.Content)
+			if onChunk != nil {
+				onChunk(reply)
+			}
+			a.memory.Add("user", userMessage)
+			a.memory.Add("assistant", reply)
+			return reply
+		}
+
+		// Tool call iteration — show thinking indicator.
+		if onChunk != nil {
+			onChunk("⏳")
+		}
+
+		// Append assistant message carrying the tool calls (no content field).
+		turnMsgs = append(turnMsgs, mcp.Message{
+			Role:      "assistant",
+			ToolCalls: resp.ToolCalls,
+		})
+
+		// Execute each tool call and append the results as tool messages.
+		for _, tc := range resp.ToolCalls {
+			var apiReq apiRequest
+			if err := json.Unmarshal([]byte(tc.Function.Arguments), &apiReq); err != nil {
+				logger.Errorf("Agent: invalid tool args for call %s: %v", tc.ID, err)
+				turnMsgs = append(turnMsgs, mcp.Message{
+					Role:       "tool",
+					ToolCallID: tc.ID,
+					Content:    fmt.Sprintf(`{"error":"invalid arguments: %s"}`, err.Error()),
+				})
+				continue
+			}
+			logger.Infof("Agent: iter=%d tool=%s %s %s", i+1, tc.ID, apiReq.Method, apiReq.Path)
+			result := a.apiTool.execute(&apiReq)
+			turnMsgs = append(turnMsgs, mcp.Message{
+				Role:       "tool",
+				ToolCallID: tc.ID,
+				Content:    result,
+			})
+		}
+	}
+
+	// Safety: max iterations reached.
+	logger.Warnf("Agent: max iterations (%d) reached for message: %q", maxIterations, userMessage)
+	reply := "操作已完成，请检查您的账户查看最新状态。"
+	a.memory.Add("user", userMessage)
+	a.memory.Add("assistant", reply)
+	return reply
+}
+
+// ResetMemory clears conversation history (called on /start).
+func (a *Agent) ResetMemory() {
+	a.memory.ResetFull()
+}

telegram/agent/agent_test.go

@@ -0,0 +1,439 @@
+package agent
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"nofx/mcp"
+)
+
+// mockLLM implements mcp.AIClient using pre-programmed LLMResponse objects.
+// Native function calling: CallWithRequestFull is the primary method;
+// CallWithRequest and CallWithRequestStream are stubs kept for interface compliance.
+type mockLLM struct {
+	responses []*mcp.LLMResponse
+	calls     int
+	lastMsgs  []mcp.Message
+}
+
+func (m *mockLLM) SetAPIKey(_, _, _ string)   {}
+func (m *mockLLM) SetTimeout(_ time.Duration) {}
+
+func (m *mockLLM) CallWithMessages(_, _ string) (string, error) { return "", nil }
+
+func (m *mockLLM) CallWithRequest(req *mcp.Request) (string, error) {
+	r, err := m.next()
+	if err != nil {
+		return "", err
+	}
+	return r.Content, nil
+}
+
+func (m *mockLLM) CallWithRequestStream(req *mcp.Request, onChunk func(string)) (string, error) {
+	r, err := m.next()
+	if err != nil {
+		return "", err
+	}
+	if onChunk != nil {
+		onChunk(r.Content)
+	}
+	return r.Content, nil
+}
+
+func (m *mockLLM) CallWithRequestFull(req *mcp.Request) (*mcp.LLMResponse, error) {
+	m.lastMsgs = req.Messages
+	return m.next()
+}
+
+func (m *mockLLM) next() (*mcp.LLMResponse, error) {
+	if m.calls < len(m.responses) {
+		r := m.responses[m.calls]
+		m.calls++
+		return r, nil
+	}
+	return &mcp.LLMResponse{Content: "OK"}, nil
+}
+
+// toolCall builds a mock LLM response that contains a single tool invocation.
+func toolCall(id, method, path string, body string) *mcp.LLMResponse {
+	if body == "" {
+		body = "{}"
+	}
+	return &mcp.LLMResponse{
+		ToolCalls: []mcp.ToolCall{{
+			ID:   id,
+			Type: "function",
+			Function: mcp.ToolCallFunction{
+				Name:      "api_request",
+				Arguments: fmt.Sprintf(`{"method":%q,"path":%q,"body":%s}`, method, path, body),
+			},
+		}},
+	}
+}
+
+// textReply builds a mock LLM response with a plain-text final answer.
+func textReply(content string) *mcp.LLMResponse {
+	return &mcp.LLMResponse{Content: content}
+}
+
+func mockGetLLM(llm *mockLLM) func() mcp.AIClient {
+	return func() mcp.AIClient { return llm }
+}
+
+const testPrompt = "You are a test assistant."
+
+// mockAPIServer creates a test HTTP server with configurable route handlers.
+func mockAPIServer(handlers map[string]string) (*httptest.Server, int) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		key := r.Method + " " + r.URL.Path
+		if body, ok := handlers[key]; ok {
+			w.Write([]byte(body)) //nolint:errcheck
+			return
+		}
+		// Also try path-only match (for GET)
+		if body, ok := handlers[r.URL.Path]; ok {
+			w.Write([]byte(body)) //nolint:errcheck
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+		w.Write([]byte(`{"error":"not found"}`)) //nolint:errcheck
+	}))
+	var port int
+	fmt.Sscanf(srv.Listener.Addr().String(), "127.0.0.1:%d", &port)
+	return srv, port
+}
+
+// ── Basic agent behaviour ──────────────────────────────────────────────────
+
+// TestAgentDirectReply: LLM replies with text (no tool calls) — one LLM call.
+func TestAgentDirectReply(t *testing.T) {
+	llm := &mockLLM{responses: []*mcp.LLMResponse{textReply("Hello! How can I help you?")}}
+	a := New(8080, "tok", "test-user", mockGetLLM(llm), testPrompt)
+
+	reply := a.Run("hello", nil)
+
+	if reply != "Hello! How can I help you?" {
+		t.Fatalf("unexpected reply: %q", reply)
+	}
+	if llm.calls != 1 {
+		t.Fatalf("expected 1 LLM call, got %d", llm.calls)
+	}
+}
+
+// TestAgentAPICall: LLM makes one tool call, gets result, gives final reply — two LLM calls.
+func TestAgentAPICall(t *testing.T) {
+	srv, port := mockAPIServer(map[string]string{
+		"/api/my-traders": `[{"trader_id":"t1","trader_name":"BTC Trader","is_running":false}]`,
+	})
+	defer srv.Close()
+
+	llm := &mockLLM{responses: []*mcp.LLMResponse{
+		toolCall("c1", "GET", "/api/my-traders", "{}"),
+		textReply("You have one trader: BTC Trader."),
+	}}
+	a := New(port, "tok", "test-user", mockGetLLM(llm), testPrompt)
+
+	reply := a.Run("list my traders", nil)
+
+	if reply != "You have one trader: BTC Trader." {
+		t.Fatalf("unexpected reply: %q", reply)
+	}
+	if llm.calls != 2 {
+		t.Fatalf("expected 2 LLM calls, got %d", llm.calls)
+	}
+}
+
+// TestAgentMultiStep: LLM chains two tool calls before final reply — three LLM calls.
+func TestAgentMultiStep(t *testing.T) {
+	srv, port := mockAPIServer(map[string]string{
+		"/api/account":   `{"total_equity":1000}`,
+		"/api/positions": `[]`,
+	})
+	defer srv.Close()
+
+	llm := &mockLLM{responses: []*mcp.LLMResponse{
+		toolCall("c1", "GET", "/api/account", "{}"),
+		toolCall("c2", "GET", "/api/positions", "{}"),
+		textReply("Account looks healthy and no open positions."),
+	}}
+	a := New(port, "tok", "test-user", mockGetLLM(llm), testPrompt)
+
+	reply := a.Run("show me account status", nil)
+
+	if llm.calls != 3 {
+		t.Fatalf("expected 3 LLM calls (2 tool + 1 final), got %d", llm.calls)
+	}
+	if reply != "Account looks healthy and no open positions." {
+		t.Fatalf("unexpected final reply: %q", reply)
+	}
+}
+
+// TestAgentAPIResultInContext: tool result must appear as a tool message in the next LLM call.
+func TestAgentAPIResultInContext(t *testing.T) {
+	srv, port := mockAPIServer(map[string]string{
+		"/api/account": `{"balance":1234.56}`,
+	})
+	defer srv.Close()
+
+	llm := &mockLLM{responses: []*mcp.LLMResponse{
+		toolCall("c1", "GET", "/api/account", "{}"),
+		textReply("Balance is 1234.56 USDT."),
+	}}
+	a := New(port, "tok", "test-user", mockGetLLM(llm), testPrompt)
+	a.Run("show balance", nil)
+
+	// The last request must contain a tool-result message with the balance data.
+	found := false
+	for _, msg := range llm.lastMsgs {
+		if msg.Role == "tool" && strings.Contains(msg.Content, "balance") {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("tool result message not found in subsequent LLM context; messages: %+v", llm.lastMsgs)
+	}
+}
+
+// ── Narration-free architecture tests ─────────────────────────────────────
+
+// TestNarrationStructurallyImpossible: when ToolCalls are present in the response,
+// any Content field is ignored and never surfaced to the user.
+// In real LLM APIs, Content is always empty alongside ToolCalls, but we verify
+// our agent handles a malformed response defensively.
+func TestNarrationStructurallyImpossible(t *testing.T) {
+	srv, port := mockAPIServer(map[string]string{
+		"/api/strategies": `[{"id":"s1","name":"BTC Trend"}]`,
+	})
+	defer srv.Close()
+
+	// Simulate a (malformed) response that has both Content and ToolCalls.
+	malformed := &mcp.LLMResponse{
+		Content: "现在我将为您查询策略。", // narration — must NOT reach user
+		ToolCalls: []mcp.ToolCall{{
+			ID:   "c1",
+			Type: "function",
+			Function: mcp.ToolCallFunction{
+				Name:      "api_request",
+				Arguments: `{"method":"GET","path":"/api/strategies","body":{}}`,
+			},
+		}},
+	}
+
+	llm := &mockLLM{responses: []*mcp.LLMResponse{
+		malformed,
+		textReply("你有1个策略：BTC Trend。"),
+	}}
+	a := New(port, "tok", "test-user", mockGetLLM(llm), testPrompt)
+	reply := a.Run("查询我的策略", nil)
+
+	if strings.Contains(reply, "现在我将") {
+		t.Fatalf("narration leaked into final reply: %q", reply)
+	}
+	if reply != "你有1个策略：BTC Trend。" {
+		t.Fatalf("unexpected reply: %q", reply)
+	}
+}
+
+// TestOnChunkCalledWithFinalReply: onChunk receives the complete final reply.
+func TestOnChunkCalledWithFinalReply(t *testing.T) {
+	srv, port := mockAPIServer(map[string]string{
+		"/api/account": `{"equity":500}`,
+	})
+	defer srv.Close()
+
+	llm := &mockLLM{responses: []*mcp.LLMResponse{
+		toolCall("c1", "GET", "/api/account", "{}"),
+		textReply("Equity: 500 USDT."),
+	}}
+	a := New(port, "tok", "test-user", mockGetLLM(llm), testPrompt)
+
+	var chunks []string
+	reply := a.Run("show equity", func(chunk string) {
+		chunks = append(chunks, chunk)
+	})
+
+	if reply != "Equity: 500 USDT." {
+		t.Fatalf("unexpected reply: %q", reply)
+	}
+	// Should have received ⏳ for the tool call, then the final reply.
+	if len(chunks) < 2 {
+		t.Fatalf("expected at least 2 chunks (⏳ + final), got: %v", chunks)
+	}
+	lastChunk := chunks[len(chunks)-1]
+	if lastChunk != "Equity: 500 USDT." {
+		t.Fatalf("last chunk should be final reply, got: %q", lastChunk)
+	}
+}
+
+// ── Workflow tests ─────────────────────────────────────────────────────────
+
+// TestCreateStrategyWorkflow: simulates creating a BTC trend strategy.
+// Verifies: POST strategy → GET verify → final reply shows strategy info.
+func TestCreateStrategyWorkflow(t *testing.T) {
+	srv, port := mockAPIServer(map[string]string{
+		"POST /api/strategies":   `{"id":"s1","name":"BTC趋势"}`,
+		"GET /api/strategies/s1": `{"id":"s1","name":"BTC趋势","config":{"coin_source":{"source_type":"static","static_coins":["BTC/USDT"]},"leverage":5}}`,
+	})
+	defer srv.Close()
+
+	llm := &mockLLM{responses: []*mcp.LLMResponse{
+		toolCall("c1", "POST", "/api/strategies", `{"name":"BTC趋势","config":{}}`),
+		toolCall("c2", "GET", "/api/strategies/s1", "{}"),
+		textReply("策略已创建：BTC趋势，币种 BTC/USDT，杠杆 5x。"),
+	}}
+	a := New(port, "tok", "test-user", mockGetLLM(llm), testPrompt)
+	reply := a.Run("帮我配置个btc趋势交易的策略", nil)
+
+	if llm.calls != 3 {
+		t.Fatalf("expected 3 LLM calls, got %d", llm.calls)
+	}
+	if reply == "" {
+		t.Fatalf("empty final reply")
+	}
+}
+
+// TestFullSetupWorkflow: create strategy → verify → create trader → start trader.
+// This is the "帮我配置策略并跑起来" workflow.
+func TestFullSetupWorkflow(t *testing.T) {
+	calls := map[string]int{}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		key := r.Method + " " + r.URL.Path
+		calls[key]++
+		switch key {
+		case "POST /api/strategies":
+			w.Write([]byte(`{"id":"s1","name":"BTC趋势"}`)) //nolint:errcheck
+		case "GET /api/strategies/s1":
+			w.Write([]byte(`{"id":"s1","name":"BTC趋势","config":{}}`)) //nolint:errcheck
+		case "POST /api/traders":
+			w.Write([]byte(`{"id":"tr1","name":"BTC趋势交易员"}`)) //nolint:errcheck
+		case "POST /api/traders/tr1/start":
+			w.Write([]byte(`{"ok":true}`)) //nolint:errcheck
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer srv.Close()
+	var port int
+	fmt.Sscanf(srv.Listener.Addr().String(), "127.0.0.1:%d", &port)
+
+	llm := &mockLLM{responses: []*mcp.LLMResponse{
+		toolCall("c1", "POST", "/api/strategies", `{"name":"BTC趋势"}`),
+		toolCall("c2", "GET", "/api/strategies/s1", "{}"),
+		toolCall("c3", "POST", "/api/traders", `{"name":"BTC趋势交易员","strategy_id":"s1"}`),
+		toolCall("c4", "POST", "/api/traders/tr1/start", "{}"),
+		textReply("策略和交易员已创建并启动！BTC趋势交易员正在运行。"),
+	}}
+	a := New(port, "tok", "test-user", mockGetLLM(llm), testPrompt)
+	reply := a.Run("帮我配置个btc趋势交易的策略交易 跑起来", nil)
+
+	if llm.calls != 5 {
+		t.Fatalf("expected 5 LLM calls, got %d", llm.calls)
+	}
+	if calls["POST /api/strategies"] != 1 {
+		t.Errorf("expected 1 POST /api/strategies, got %d", calls["POST /api/strategies"])
+	}
+	if calls["POST /api/traders"] != 1 {
+		t.Errorf("expected 1 POST /api/traders, got %d", calls["POST /api/traders"])
+	}
+	if calls["POST /api/traders/tr1/start"] != 1 {
+		t.Errorf("expected 1 POST /api/traders/tr1/start, got %d", calls["POST /api/traders/tr1/start"])
+	}
+	if reply == "" {
+		t.Fatalf("empty final reply")
+	}
+}
+
+// TestStartExistingTrader: when trader already exists, just start it.
+func TestStartExistingTrader(t *testing.T) {
+	calls := map[string]int{}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		key := r.Method + " " + r.URL.Path
+		calls[key]++
+		switch key {
+		case "GET /api/my-traders":
+			w.Write([]byte(`[{"trader_id":"tr1","trader_name":"BTC Trader","is_running":false}]`)) //nolint:errcheck
+		case "POST /api/traders/tr1/start":
+			w.Write([]byte(`{"ok":true}`)) //nolint:errcheck
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer srv.Close()
+	var port int
+	fmt.Sscanf(srv.Listener.Addr().String(), "127.0.0.1:%d", &port)
+
+	llm := &mockLLM{responses: []*mcp.LLMResponse{
+		toolCall("c1", "GET", "/api/my-traders", "{}"),
+		toolCall("c2", "POST", "/api/traders/tr1/start", "{}"),
+		textReply("交易员 BTC Trader 已启动。"),
+	}}
+	a := New(port, "tok", "test-user", mockGetLLM(llm), testPrompt)
+	reply := a.Run("启动交易员", nil)
+
+	if calls["POST /api/traders/tr1/start"] != 1 {
+		t.Errorf("expected trader to be started, got %d start calls", calls["POST /api/traders/tr1/start"])
+	}
+	if reply != "交易员 BTC Trader 已启动。" {
+		t.Fatalf("unexpected reply: %q", reply)
+	}
+}
+
+// ── Safety limit ───────────────────────────────────────────────────────────
+
+// TestMaxIterations: agent terminates after maxIterations and returns fallback message.
+func TestMaxIterations(t *testing.T) {
+	srv, port := mockAPIServer(map[string]string{
+		"/api/account": `{"ok":true}`,
+	})
+	defer srv.Close()
+
+	// Always returns another tool call — should hit max iterations.
+	responses := make([]*mcp.LLMResponse, maxIterations+2)
+	for i := range responses {
+		responses[i] = toolCall(fmt.Sprintf("c%d", i), "GET", "/api/account", "{}")
+	}
+
+	llm := &mockLLM{responses: responses}
+	a := New(port, "tok", "test-user", mockGetLLM(llm), testPrompt)
+	reply := a.Run("loop forever", nil)
+
+	if reply == "" {
+		t.Fatalf("expected a fallback reply, got empty string")
+	}
+	// Agent should have made exactly maxIterations tool-call LLM calls.
+	if llm.calls != maxIterations {
+		t.Fatalf("expected %d LLM calls (max iterations), got %d", maxIterations, llm.calls)
+	}
+}
+
+// TestToolCallIDPropagated: tool result messages carry the correct ToolCallID.
+func TestToolCallIDPropagated(t *testing.T) {
+	srv, port := mockAPIServer(map[string]string{
+		"/api/account": `{"balance":999}`,
+	})
+	defer srv.Close()
+
+	llm := &mockLLM{responses: []*mcp.LLMResponse{
+		toolCall("call-xyz-123", "GET", "/api/account", "{}"),
+		textReply("Balance is 999."),
+	}}
+	a := New(port, "tok", "test-user", mockGetLLM(llm), testPrompt)
+	a.Run("check balance", nil)
+
+	// Find the tool result message and verify ToolCallID matches.
+	found := false
+	for _, msg := range llm.lastMsgs {
+		if msg.Role == "tool" && msg.ToolCallID == "call-xyz-123" {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatalf("tool result with ToolCallID='call-xyz-123' not found in messages: %+v", llm.lastMsgs)
+	}
+}

telegram/agent/apicall.go

@@ -0,0 +1,88 @@
+package agent
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"nofx/logger"
+	"strings"
+	"time"
+)
+
+// apiCallTool executes HTTP requests against the NOFX API server.
+// This is the only tool available to the agent.
+type apiCallTool struct {
+	baseURL string
+	token   string
+	client  *http.Client
+}
+
+// apiRequest holds the arguments decoded from the LLM's api_request tool call.
+type apiRequest struct {
+	Method string         `json:"method"`
+	Path   string         `json:"path"`
+	Body   map[string]any `json:"body"`
+}
+
+func newAPICallTool(port int, token string) *apiCallTool {
+	return &apiCallTool{
+		baseURL: fmt.Sprintf("http://127.0.0.1:%d", port),
+		token:   token,
+		client:  &http.Client{Timeout: 30 * time.Second},
+	}
+}
+
+// execute calls the API and returns the response as a string for LLM consumption.
+func (t *apiCallTool) execute(req *apiRequest) string {
+	if req.Method == "" || req.Path == "" {
+		return "error: method and path are required"
+	}
+	if !strings.HasPrefix(req.Path, "/") {
+		req.Path = "/" + req.Path
+	}
+
+	var bodyReader io.Reader
+	if req.Method != "GET" && len(req.Body) > 0 {
+		b, err := json.Marshal(req.Body)
+		if err != nil {
+			return fmt.Sprintf("error marshaling body: %v", err)
+		}
+		bodyReader = bytes.NewReader(b)
+	}
+
+	httpReq, err := http.NewRequest(req.Method, t.baseURL+req.Path, bodyReader)
+	if err != nil {
+		return fmt.Sprintf("error creating request: %v", err)
+	}
+	httpReq.Header.Set("Content-Type", "application/json")
+	httpReq.Header.Set("Authorization", "Bearer "+t.token)
+
+	resp, err := t.client.Do(httpReq)
+	if err != nil {
+		return fmt.Sprintf("API call failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return fmt.Sprintf("error reading response: %v", err)
+	}
+
+	logger.Infof("Agent api_call: %s %s -> %d", req.Method, req.Path, resp.StatusCode)
+
+	if resp.StatusCode >= 400 {
+		return fmt.Sprintf("API error %d: %s", resp.StatusCode, string(body))
+	}
+
+	// Pretty-print JSON for better LLM readability
+	var v any
+	if json.Unmarshal(body, &v) == nil {
+		if pretty, err := json.MarshalIndent(v, "", "  "); err == nil {
+			return string(pretty)
+		}
+	}
+	return string(body)
+}
+

telegram/agent/manager.go

@@ -0,0 +1,79 @@
+package agent
+
+import (
+	"nofx/logger"
+	"nofx/mcp"
+	"sync"
+	"time"
+)
+
+// Manager holds one Agent per Telegram chat ID.
+// Messages for the same chat are serialized (OpenClaw Lane Queue pattern).
+type Manager struct {
+	mu           sync.Mutex
+	agents       map[int64]*Agent
+	lanes        map[int64]chan struct{}
+	apiPort      int
+	botToken     string
+	userID       string
+	getLLM       func() mcp.AIClient
+	systemPrompt string
+}
+
+// NewManager creates a Manager. Call api.GetAPIDocs() before this and pass the result as apiDocs.
+// userEmail is the registered email shown to the user when they ask "who am I".
+// userID is the internal DB UUID used for API authentication.
+func NewManager(apiPort int, botToken, userEmail, userID string, getLLM func() mcp.AIClient, apiDocs string) *Manager {
+	return &Manager{
+		agents:       make(map[int64]*Agent),
+		lanes:        make(map[int64]chan struct{}),
+		apiPort:      apiPort,
+		botToken:     botToken,
+		userID:       userID,
+		getLLM:       getLLM,
+		systemPrompt: BuildAgentPrompt(apiDocs, userEmail, userID),
+	}
+}
+
+// Run processes a message for the given chat ID.
+// If the same chat is already processing a message, this call blocks until it completes
+// or the lane wait times out (60 s), whichever comes first.
+// onChunk is optional — when set, LLM reply chunks are forwarded progressively (SSE streaming).
+func (m *Manager) Run(chatID int64, userMessage string, onChunk func(string)) string {
+	a, lane := m.getOrCreate(chatID)
+	select {
+	case lane <- struct{}{}:
+	case <-time.After(60 * time.Second):
+		logger.Warnf("Agent: lane wait timeout for chat %d — previous message still processing", chatID)
+		return "上一条消息仍在处理中，请稍等片刻后再试。"
+	}
+	defer func() { <-lane }()
+	return a.Run(userMessage, onChunk)
+}
+
+// Reset clears memory for the given chat (called on /start).
+func (m *Manager) Reset(chatID int64) {
+	m.mu.Lock()
+	a, ok := m.agents[chatID]
+	m.mu.Unlock()
+	if ok {
+		a.ResetMemory()
+	}
+}
+
+func (m *Manager) getOrCreate(chatID int64) (*Agent, chan struct{}) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	a, ok := m.agents[chatID]
+	if !ok {
+		a = New(m.apiPort, m.botToken, m.userID, m.getLLM, m.systemPrompt)
+		m.agents[chatID] = a
+	}
+	lane, ok := m.lanes[chatID]
+	if !ok {
+		lane = make(chan struct{}, 1) // binary semaphore: one message at a time per chat
+		m.lanes[chatID] = lane
+	}
+	return a, lane
+}

telegram/agent/prompt.go

@@ -0,0 +1,97 @@
+package agent
+
+import "fmt"
+
+// BuildAgentPrompt constructs the full system prompt with live API documentation injected.
+// apiDocs is the output of api.GetAPIDocs() — reflects all currently registered routes with full schemas.
+// userEmail is the registered email of the bound user (shown when user asks "who am I").
+// userID is the internal DB UUID used for API authentication only.
+func BuildAgentPrompt(apiDocs, userEmail, userID string) string {
+	return fmt.Sprintf(`You are the NOFX quantitative trading system AI assistant.
+
+## Your Identity
+- You are operating as: %s
+- Internal user ID (for API calls only): %s
+- When asked "which user / account / email" — answer with the email address above
+- All API calls are made on behalf of this user
+
+## Tool: api_request
+Use the api_request tool to call the NOFX REST API:
+- method: "GET" | "POST" | "PUT" | "DELETE"
+- path: API path; query params go in the path: /api/positions?trader_id=xxx
+- body: JSON object (use {} for GET requests)
+
+## NOFX API Documentation
+
+%s
+
+## CRITICAL: Exact ID Rule (read this before every API call)
+API fields like "ai_model_id", "exchange_id", "strategy_id", "trader_id" require the EXACT "id" value
+from the corresponding API response. NEVER use "provider", "type", or any other field as a substitute.
+
+Wrong:  {"ai_model_id": "deepseek"}          ← "deepseek" is the provider, NOT the id
+Correct: {"ai_model_id": "abc123_deepseek"}  ← full "id" from GET /api/models
+
+The Account State block at the start of this conversation lists every resource with its exact id.
+Read the id field from there and copy it verbatim — do not abbreviate, shorten, or guess.
+
+## Behavior Rules
+1. Reply in the same language the user used (中文→中文, English→English)
+2. Keep final replies concise — show results, not process
+3. Ask for ALL missing required info in ONE message — never ask one field at a time
+4. When user provides enough info, act immediately — no confirmation needed
+5. Be decisive — infer intent from context, use schema to fill in smart defaults
+
+## Verification Rule (CRITICAL)
+After ANY PUT or POST that creates or modifies a resource:
+1. Immediately GET the resource to read actual saved values
+2. Show the user the KEY fields they care about from the GET response
+3. NEVER just say "updated successfully" without showing the actual values
+4. If saved values look wrong, correct them automatically
+
+## Error Handling
+- 400: explain what was wrong, ask user to correct
+- 404: resource doesn't exist — you may have used the wrong ID format; check the Account State for the exact id
+- "AI model not enabled": tell user to enable the model first via PUT /api/models
+- "Exchange not enabled": tell user to enable the exchange first
+- 5xx: server error, ask user to try again
+
+## Account State (injected at conversation start)
+At the start of each new conversation, a [Current Account State] block is provided with:
+- AI Models: all configured models with their IDs and enabled status
+- Exchanges: all configured exchanges with their IDs and enabled status
+- Strategies: all existing strategies with their IDs
+- Traders: all existing traders with their IDs and running status
+
+Use this to:
+- NEVER ask for exchange/model info that is already configured — use the existing IDs directly
+- Know instantly if the user has 0 or N resources of each type
+- If only one exchange/model exists and user doesn't specify, use it directly without asking
+- If multiple exist, list them and ask which one to use
+
+## Common Workflows
+
+**Create strategy** (independent from traders):
+- Never GET trader info just to create a strategy.
+- POST {"name":"<descriptive name>"} — config is OPTIONAL. Backend applies complete working defaults automatically (ai500 top coins, all indicators, standard risk control). Strategy is immediately usable.
+- Only include "config" when user explicitly requests custom settings (specific coins, custom leverage, different timeframes).
+- After POST: GET /api/strategies/:id to verify → show user: name, coin_source.source_type, key risk_control values
+
+**"帮我配置策略并跑起来" / "create strategy and start" (full setup workflow)**:
+Execute these steps IN ORDER with NO user confirmation between them:
+1. POST /api/strategies — body: {"name":"<descriptive name>"} — no config needed, defaults are complete
+2. GET /api/strategies/:id — verify strategy was saved
+3. POST /api/traders — create trader: use exchange_id and model_id from Account State (if only one each, use directly); set strategy_id from step 1; set name matching the strategy
+4. POST /api/traders/:id/start — start the trader
+5. Final reply: show strategy name, trader name, coin source, confirm running
+
+**Update strategy config**:
+1. GET /api/strategies/:id to read current full config
+2. Modify only what user asked (keep all other fields)
+3. PUT /api/strategies/:id with complete merged config
+4. GET /api/strategies/:id to verify → show user actual saved values for changed fields
+
+**Start/stop existing trader**: From Account State, if only one trader, act directly. If multiple, list and ask.
+
+**Query data**: Use trader_id from Account State, then query /api/positions?trader_id=xxx or /api/account?trader_id=xxx etc.`, userEmail, userID, apiDocs)
+}

telegram/bot.go

@@ -0,0 +1,479 @@
+package telegram
+
+import (
+	"nofx/api"
+	"nofx/config"
+	"nofx/logger"
+	"nofx/mcp"
+	"nofx/store"
+	"nofx/telegram/agent"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	tgbotapi "github.com/go-telegram-bot-api/telegram-bot-api/v5"
+)
+
+// Start initializes and runs the Telegram bot in a blocking supervisor loop.
+// Supports hot-reload: when a signal is sent on reloadCh, the bot restarts
+// with the latest token (re-read from DB or env). Must be called as a goroutine from main.go.
+func Start(cfg *config.Config, st *store.Store, reloadCh <-chan struct{}) {
+	for {
+		token := resolveToken(cfg, st)
+		if token == "" {
+			logger.Info("Telegram bot disabled (no token configured), waiting for reload signal...")
+			<-reloadCh
+			continue
+		}
+
+		stopped := runBot(token, cfg, st)
+		if !stopped {
+			return
+		}
+
+		select {
+		case <-reloadCh:
+			logger.Info("Reloading Telegram bot with new token...")
+		}
+	}
+}
+
+// resolveToken returns the bot token from DB (configured via Web UI).
+func resolveToken(cfg *config.Config, st *store.Store) string {
+	dbCfg, err := st.TelegramConfig().Get()
+	if err == nil && dbCfg.BotToken != "" {
+		return dbCfg.BotToken
+	}
+	return ""
+}
+
+// runBot runs the bot until the updates channel closes (clean stop → true) or a fatal error (false).
+func runBot(token string, cfg *config.Config, st *store.Store) bool {
+	bot, err := tgbotapi.NewBotAPI(token)
+	if err != nil {
+		logger.Errorf("Telegram bot failed to start: %v", err)
+		return false
+	}
+	logger.Infof("Telegram bot @%s started", bot.Self.UserName)
+
+	// Allowed chat ID: read from DB binding (0 = unbound, first /start will bind).
+	allowedChatID := int64(0)
+	if id, err := st.TelegramConfig().GetBoundChatID(); err == nil && id != 0 {
+		allowedChatID = id
+	}
+
+	// botUserID / botToken / agents are resolved lazily and refresh when user registers.
+	var (
+		botUserID    string
+		botUserEmail string
+		botToken     string
+		agents       *agent.Manager
+	)
+
+	resolveBotUser := func() bool {
+		users, err := st.User().GetAll()
+		if err != nil || len(users) == 0 {
+			return false
+		}
+		u := users[0]
+		if u.ID == botUserID {
+			return true
+		}
+		newToken, err := agent.GenerateBotToken(u.ID)
+		if err != nil {
+			logger.Errorf("Failed to generate bot JWT for user %s: %v", u.ID, err)
+			return false
+		}
+		prev := botUserID
+		botUserID = u.ID
+		botUserEmail = u.Email
+		botToken = newToken
+		agents = agent.NewManager(cfg.APIServerPort, botToken, botUserEmail, botUserID,
+			func() mcp.AIClient { return newLLMClient(st, botUserID) },
+			api.GetAPIDocs(),
+		)
+		if prev == "" {
+			logger.Infof("Bot: resolved user %s (%s)", botUserID, botUserEmail)
+		} else {
+			logger.Infof("Bot: user changed → %s (%s)", botUserID, botUserEmail)
+		}
+		return true
+	}
+	resolveBotUser()
+
+	u := tgbotapi.NewUpdate(0)
+	u.Timeout = 60
+	updates := bot.GetUpdatesChan(u)
+
+	// awaitingLang is set only when the user explicitly runs /lang.
+	awaitingLang := false
+
+	for update := range updates {
+		if update.Message == nil {
+			continue
+		}
+		chatID := update.Message.Chat.ID
+		text := strings.TrimSpace(update.Message.Text)
+
+		// ── Language selection (triggered only by /lang) ──────────────────────
+		if awaitingLang && chatID == allowedChatID {
+			if lang := parseLangChoice(text); lang != "" {
+				awaitingLang = false
+				st.TelegramConfig().SetLanguage(lang) //nolint:errcheck
+				sendMarkdownMsg(bot, chatID, statusMsg(st, botUserID, cfg.APIServerPort, lang))
+			} else {
+				sendMarkdownMsg(bot, chatID, langMenuMsg())
+			}
+			continue
+		}
+
+		// ── /start ────────────────────────────────────────────────────────────
+		if text == "/start" {
+			resolveBotUser()
+			if botUserID == "" {
+				sendMsg(bot, chatID,
+					"No account found.\nOpen the web dashboard to register, then send /start.")
+				continue
+			}
+			if allowedChatID == 0 {
+				username := update.Message.From.UserName
+				if err := st.TelegramConfig().BindUser(chatID, "@"+username); err != nil {
+					logger.Errorf("Failed to bind Telegram user: %v", err)
+					sendMsg(bot, chatID, "Binding failed. Please try again.")
+					continue
+				}
+				allowedChatID = chatID
+				logger.Infof("Telegram bound to @%s (chatID: %d)", username, chatID)
+			} else if chatID != allowedChatID {
+				sendMsg(bot, chatID, "This bot is already bound to another account.")
+				continue
+			} else {
+				agents.Reset(chatID)
+			}
+			lang := st.TelegramConfig().GetLanguage()
+			sendMarkdownMsg(bot, chatID, statusMsg(st, botUserID, cfg.APIServerPort, lang))
+			continue
+		}
+
+		// ── /lang ─────────────────────────────────────────────────────────────
+		if text == "/lang" {
+			awaitingLang = true
+			sendMarkdownMsg(bot, chatID, langMenuMsg())
+			continue
+		}
+
+		// ── /help ─────────────────────────────────────────────────────────────
+		if text == "/help" {
+			lang := st.TelegramConfig().GetLanguage()
+			sendMarkdownMsg(bot, chatID, helpMsg(lang))
+			continue
+		}
+
+		// ── Access control ────────────────────────────────────────────────────
+		if allowedChatID != 0 && chatID != allowedChatID {
+			sendMsg(bot, chatID, "Unauthorized.")
+			continue
+		}
+		if allowedChatID == 0 {
+			sendMsg(bot, chatID, "Send /start first.")
+			continue
+		}
+		if text == "" {
+			continue
+		}
+
+		// ── Refresh user before every AI call ────────────────────────────────
+		resolveBotUser()
+		if botUserID == "" {
+			sendMsg(bot, chatID, "No account found. Open the web dashboard to register.")
+			continue
+		}
+
+		lang := st.TelegramConfig().GetLanguage()
+
+		// ── Guard: show status if not ready for trading ───────────────────────
+		if newLLMClient(st, botUserID) == nil {
+			sendMarkdownMsg(bot, chatID, statusMsg(st, botUserID, cfg.APIServerPort, lang))
+			continue
+		}
+
+		// ── AI agent ─────────────────────────────────────────────────────────
+		go func(chatID int64, text string) {
+			sent, err := bot.Send(tgbotapi.NewMessage(chatID, "⏳"))
+			placeholderID := 0
+			if err == nil {
+				placeholderID = sent.MessageID
+			}
+
+			var (
+				mu       sync.Mutex
+				lastEdit time.Time
+			)
+			onChunk := func(accumulated string) {
+				if placeholderID == 0 {
+					return
+				}
+				mu.Lock()
+				defer mu.Unlock()
+				if accumulated != "⏳" && time.Since(lastEdit) < time.Second {
+					return
+				}
+				lastEdit = time.Now()
+				edit := tgbotapi.NewEditMessageText(chatID, placeholderID, accumulated)
+				bot.Send(edit) //nolint:errcheck
+			}
+
+			reply := agents.Run(chatID, text, onChunk)
+
+			if placeholderID != 0 {
+				edit := tgbotapi.NewEditMessageText(chatID, placeholderID, reply)
+				edit.ParseMode = "Markdown"
+				if _, err := bot.Send(edit); err != nil {
+					edit2 := tgbotapi.NewEditMessageText(chatID, placeholderID, reply)
+					bot.Send(edit2) //nolint:errcheck
+				}
+			} else {
+				msg := tgbotapi.NewMessage(chatID, reply)
+				msg.ParseMode = "Markdown"
+				if _, err := bot.Send(msg); err != nil {
+					msg.ParseMode = ""
+					bot.Send(msg) //nolint:errcheck
+				}
+			}
+		}(chatID, text)
+	}
+
+	return true
+}
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+func sendMsg(bot *tgbotapi.BotAPI, chatID int64, text string) {
+	msg := tgbotapi.NewMessage(chatID, text)
+	bot.Send(msg) //nolint:errcheck
+}
+
+func sendMarkdownMsg(bot *tgbotapi.BotAPI, chatID int64, text string) {
+	msg := tgbotapi.NewMessage(chatID, text)
+	msg.ParseMode = "Markdown"
+	if _, err := bot.Send(msg); err != nil {
+		plain := tgbotapi.NewMessage(chatID, text)
+		bot.Send(plain) //nolint:errcheck
+	}
+}
+
+// ── LLM client ───────────────────────────────────────────────────────────────
+
+func newLLMClient(st *store.Store, userID string) mcp.AIClient {
+	// 1. Prefer the model explicitly configured for Telegram (Settings → Telegram → AI Model)
+	if tgCfg, err := st.TelegramConfig().Get(); err == nil && tgCfg.ModelID != "" {
+		if model, err := st.AIModel().Get(userID, tgCfg.ModelID); err == nil && model.Enabled {
+			apiKey := string(model.APIKey)
+			if apiKey != "" {
+				client := clientForProvider(model.Provider)
+				client.SetAPIKey(apiKey, model.CustomAPIURL, model.CustomModelName)
+				if isUSDCProvider(model.Provider) {
+					logger.Infof("Telegram agent: provider=%s (USDC payment) user=%s", model.Provider, userID)
+				} else {
+					logger.Infof("Telegram agent: provider=%s user=%s", model.Provider, userID)
+				}
+				return client
+			}
+		}
+	}
+
+	// 2. Fall back to first enabled model
+	if model, err := st.AIModel().GetDefault(userID); err == nil {
+		apiKey := string(model.APIKey)
+		if apiKey != "" {
+			client := clientForProvider(model.Provider)
+			client.SetAPIKey(apiKey, model.CustomAPIURL, model.CustomModelName)
+			if isUSDCProvider(model.Provider) {
+				logger.Infof("Telegram agent: provider=%s (USDC payment) user=%s", model.Provider, userID)
+			} else {
+				logger.Infof("Telegram agent: provider=%s user=%s", model.Provider, userID)
+			}
+			return client
+		}
+	}
+
+	// 3. Environment variable fallback
+	for _, pair := range []struct{ provider, key, url string }{
+		{"deepseek", os.Getenv("DEEPSEEK_API_KEY"), mcp.DefaultDeepSeekBaseURL},
+		{"openai", os.Getenv("OPENAI_API_KEY"), ""},
+		{"claude", os.Getenv("ANTHROPIC_API_KEY"), ""},
+	} {
+		if pair.key != "" {
+			client := clientForProvider(pair.provider)
+			client.SetAPIKey(pair.key, pair.url, "")
+			return client
+		}
+	}
+	return nil
+}
+
+// isUSDCProvider returns true for providers that pay per call with USDC (x402 protocol).
+func isUSDCProvider(provider string) bool {
+	return provider == "blockrun-base" || provider == "blockrun-sol" || provider == "claw402"
+}
+
+func clientForProvider(provider string) mcp.AIClient {
+	switch provider {
+	case "openai":
+		return mcp.NewOpenAIClient()
+	case "deepseek":
+		return mcp.NewDeepSeekClient()
+	case "claude":
+		return mcp.NewClaudeClient()
+	case "qwen":
+		return mcp.NewQwenClient()
+	case "kimi":
+		return mcp.NewKimiClient()
+	case "grok":
+		return mcp.NewGrokClient()
+	case "gemini":
+		return mcp.NewGeminiClient()
+	case "minimax":
+		return mcp.NewMiniMaxClient()
+	case "blockrun-base":
+		return mcp.NewBlockRunBaseClient()
+	case "blockrun-sol":
+		return mcp.NewBlockRunSolClient()
+	case "claw402":
+		return mcp.NewClaw402Client()
+	default:
+		return mcp.NewDeepSeekClient()
+	}
+}
+
+// ── Status message ────────────────────────────────────────────────────────────
+
+// statusMsg is the single entry-point message shown after /start.
+// It checks what's configured and shows either a setup prompt or the ready state.
+func statusMsg(st *store.Store, userID string, apiPort int, lang string) string {
+	webURL := "http://localhost:3000"
+
+	// Determine what's missing.
+	hasModel := false
+	if _, err := st.AIModel().GetDefault(userID); err == nil {
+		hasModel = true
+	}
+
+	hasExchange := false
+	if exchanges, err := st.Exchange().List(userID); err == nil {
+		for _, e := range exchanges {
+			if e.Enabled {
+				hasExchange = true
+				break
+			}
+		}
+	}
+
+	if !hasModel || !hasExchange {
+		missing := ""
+		if lang == "zh" {
+			if !hasModel {
+				missing += "\n❌ AI 模型 → 设置 → AI 模型 → 添加"
+			}
+			if !hasExchange {
+				missing += "\n❌ 交易所 → 设置 → 交易所 → 添加"
+			}
+			return "⚙️ *需要完成初始配置*\n\n打开 Web 管理界面完成配置：\n→ " + webURL + "\n" + missing + "\n\n配置完成后发送 /start"
+		}
+		if !hasModel {
+			missing += "\n❌ AI Model → Settings → AI Models → Add"
+		}
+		if !hasExchange {
+			missing += "\n❌ Exchange → Settings → Exchanges → Add"
+		}
+		return "⚙️ *Setup required*\n\nOpen the web dashboard to complete setup:\n→ " + webURL + "\n" + missing + "\n\nSend /start when done."
+	}
+
+	// All configured — show ready state.
+	if lang == "zh" {
+		return `✅ *NOFX 就绪，开始交易吧！*
+
+直接告诉我你想做什么：
+
+📊 "查看我的持仓"
+💰 "账户余额多少"
+🤖 "帮我创建 BTC 趋势策略并启动"
+⏹ "停止所有交易员"
+
+/help 查看更多 · /lang 切换语言`
+	}
+	return `✅ *NOFX is ready!*
+
+Just tell me what you want:
+
+📊 "Show my positions"
+💰 "What's my balance?"
+🤖 "Create a BTC trend strategy and start it"
+⏹ "Stop all traders"
+
+/help for more · /lang to change language`
+}
+
+// ── Language ──────────────────────────────────────────────────────────────────
+
+func langMenuMsg() string {
+	return "🌐 *Choose your language*\n\n1 — English\n2 — 中文\n\nReply with 1 or 2"
+}
+
+func parseLangChoice(text string) string {
+	switch strings.TrimSpace(text) {
+	case "1", "en", "EN", "English", "english":
+		return "en"
+	case "2", "zh", "ZH", "中文", "chinese", "Chinese":
+		return "zh"
+	}
+	return ""
+}
+
+// ── Help ──────────────────────────────────────────────────────────────────────
+
+func helpMsg(lang string) string {
+	if lang == "zh" {
+		return `*NOFX 使用指南*
+
+*查询*
+• "查看我的持仓"
+• "账户余额多少"
+• "列出我的交易员"
+
+*创建 & 启动*
+• "帮我创建 BTC 趋势策略并跑起来"
+• "保守型策略，只交易 BTC 和 ETH"
+
+*控制*
+• "启动交易员"
+• "暂停交易员"
+• "停止所有交易"
+
+*命令*
+/start — 刷新状态
+/lang  — 切换语言
+/help  — 帮助`
+	}
+	return `*NOFX Help*
+
+*Query*
+• "Show my positions"
+• "What's my balance?"
+• "List my traders"
+
+*Create & start*
+• "Create a BTC trend strategy and start it"
+• "Conservative strategy, BTC and ETH only"
+
+*Control*
+• "Start trader"
+• "Stop trader"
+• "Stop all trading"
+
+*Commands*
+/start — refresh status
+/lang  — change language
+/help  — show this`
+}

telegram/session/memory.go

@@ -0,0 +1,105 @@
+package session
+
+import (
+	"fmt"
+	"nofx/mcp"
+	"strings"
+)
+
+const (
+	compactionThresholdTokens = 3000
+	charsPerToken             = 3 // rough estimate for token counting
+)
+
+type Message struct {
+	Role    string // "user" or "assistant"
+	Content string
+}
+
+// Memory manages conversation history with automatic compaction.
+// Inspired by openclaw's compaction pattern:
+// when ShortTerm exceeds threshold, LLM silently summarizes it into LongTerm.
+type Memory struct {
+	LongTerm  string    // Durable summary (survives compaction, user never sees this happen)
+	ShortTerm []Message // Recent conversation (cleared on compaction)
+	llm       mcp.AIClient
+}
+
+func NewMemory(llm mcp.AIClient) *Memory {
+	return &Memory{llm: llm}
+}
+
+// Add appends a message and triggers compaction if threshold exceeded
+func (m *Memory) Add(role, content string) {
+	m.ShortTerm = append(m.ShortTerm, Message{Role: role, Content: content})
+	if m.estimateTokens() > compactionThresholdTokens {
+		m.compact()
+	}
+}
+
+// BuildContext returns context string for the agent's conversation history.
+func (m *Memory) BuildContext() string {
+	var sb strings.Builder
+	if m.LongTerm != "" {
+		sb.WriteString("[Summary of earlier conversation]\n")
+		sb.WriteString(m.LongTerm)
+		sb.WriteString("\n\n")
+	}
+	if len(m.ShortTerm) > 0 {
+		sb.WriteString("[Recent conversation]\n")
+		for _, msg := range m.ShortTerm {
+			sb.WriteString(fmt.Sprintf("%s: %s\n", msg.Role, msg.Content))
+		}
+	}
+	return sb.String()
+}
+
+// Reset clears short-term history (LongTerm preserved intentionally)
+func (m *Memory) Reset() {
+	m.ShortTerm = []Message{}
+}
+
+// ResetFull clears everything including long-term memory
+func (m *Memory) ResetFull() {
+	m.ShortTerm = []Message{}
+	m.LongTerm = ""
+}
+
+func (m *Memory) estimateTokens() int {
+	total := len(m.LongTerm)
+	for _, msg := range m.ShortTerm {
+		total += len(msg.Content)
+	}
+	return total / charsPerToken
+}
+
+// compact summarizes short-term history into long-term memory.
+// This runs silently - the user never sees it happen.
+// If LLM call fails, short-term is preserved as-is (no data loss).
+func (m *Memory) compact() {
+	if m.llm == nil || len(m.ShortTerm) == 0 {
+		return
+	}
+	history := m.BuildContext()
+	systemPrompt := `You are a conversation summarizer. Compress the following trading assistant conversation into a concise summary.
+
+Must preserve:
+- What the user is configuring (strategy/exchange/model/trader)
+- Confirmed parameters (trading pairs, leverage, stop loss, indicators, etc.)
+- Pending or missing parameters
+- User preferences and requirements
+
+Output: plain text summary, under 200 words.`
+
+	summary, err := m.llm.CallWithMessages(systemPrompt, history)
+	if err != nil {
+		// Compaction failed: keep short-term as-is, never lose user data
+		return
+	}
+	if m.LongTerm != "" {
+		m.LongTerm = m.LongTerm + "\n" + summary
+	} else {
+		m.LongTerm = summary
+	}
+	m.ShortTerm = []Message{}
+}

trader/auto_trader.go

@@ -16,6 +16,7 @@ import (
 	"nofx/trader/bybit"
 	"nofx/trader/gate"
 	"nofx/trader/hyperliquid"
+	"nofx/trader/indodax"
 	"nofx/trader/kucoin"
 	"nofx/trader/lighter"
 	"nofx/trader/okx"
@@ -44,13 +45,13 @@ type AutoTraderConfig struct {
 	BybitSecretKey string
 
 	// OKX API configuration
-	OKXAPIKey    string
-	OKXSecretKey string
+	OKXAPIKey     string
+	OKXSecretKey  string
 	OKXPassphrase string
 
 	// Bitget API configuration
-	BitgetAPIKey    string
-	BitgetSecretKey string
+	BitgetAPIKey     string
+	BitgetSecretKey  string
 	BitgetPassphrase string
 
 	// Gate API configuration
@@ -58,14 +59,19 @@ type AutoTraderConfig struct {
 	GateSecretKey string
 
 	// KuCoin API configuration
-	KuCoinAPIKey    string
-	KuCoinSecretKey string
+	KuCoinAPIKey     string
+	KuCoinSecretKey  string
 	KuCoinPassphrase string
 
+	// Indodax API configuration
+	IndodaxAPIKey    string
+	IndodaxSecretKey string
+
 	// Hyperliquid configuration
-	HyperliquidPrivateKey string
-	HyperliquidWalletAddr string
-	HyperliquidTestnet    bool
+	HyperliquidPrivateKey  string
+	HyperliquidWalletAddr  string
+	HyperliquidTestnet     bool
+	HyperliquidUnifiedAcct bool // Unified Account mode: Spot USDC as Perp collateral
 
 	// Aster configuration
 	AsterUser       string // Aster main wallet address
@@ -121,9 +127,9 @@ type AutoTrader struct {
 	config                AutoTraderConfig
 	trader                Trader // Use Trader interface (supports multiple platforms)
 	mcpClient             mcp.AIClient
-	store                 *store.Store             // Data storage (decision records, etc.)
+	store                 *store.Store           // Data storage (decision records, etc.)
 	strategyEngine        *kernel.StrategyEngine // Strategy engine (uses strategy configuration)
-	cycleNumber           int                      // Current cycle number
+	cycleNumber           int                    // Current cycle number
 	initialBalance        float64
 	dailyPnL              float64
 	customPrompt          string // Custom trading strategy prompt
@@ -195,6 +201,26 @@ func NewAutoTrader(config AutoTraderConfig, st *store.Store, userID string) (*Au
 		mcpClient.SetAPIKey(config.CustomAPIKey, config.CustomAPIURL, config.CustomModelName)
 		logger.Infof("🤖 [%s] Using OpenAI", config.Name)
 
+	case "minimax":
+		mcpClient = mcp.NewMiniMaxClient()
+		mcpClient.SetAPIKey(config.CustomAPIKey, config.CustomAPIURL, config.CustomModelName)
+		logger.Infof("🤖 [%s] Using MiniMax AI", config.Name)
+
+	case "blockrun-base":
+		mcpClient = mcp.NewBlockRunBaseClient()
+		mcpClient.SetAPIKey(config.CustomAPIKey, "", config.CustomModelName)
+		logger.Infof("🤖 [%s] Using BlockRun (Base Wallet) AI", config.Name)
+
+	case "blockrun-sol":
+		mcpClient = mcp.NewBlockRunSolClient()
+		mcpClient.SetAPIKey(config.CustomAPIKey, "", config.CustomModelName)
+		logger.Infof("🤖 [%s] Using BlockRun (Solana Wallet) AI", config.Name)
+
+	case "claw402":
+		mcpClient = mcp.NewClaw402Client()
+		mcpClient.SetAPIKey(config.CustomAPIKey, "", config.CustomModelName)
+		logger.Infof("🤖 [%s] Using Claw402 (Base USDC) AI", config.Name)
+
 	case "qwen":
 		mcpClient = mcp.NewQwenClient()
 		apiKey := config.QwenKey
@@ -260,7 +286,7 @@ func NewAutoTrader(config AutoTraderConfig, st *store.Store, userID string) (*Au
 		trader = kucoin.NewKuCoinTrader(config.KuCoinAPIKey, config.KuCoinSecretKey, config.KuCoinPassphrase)
 	case "hyperliquid":
 		logger.Infof("🏦 [%s] Using Hyperliquid trading", config.Name)
-		trader, err = hyperliquid.NewHyperliquidTrader(config.HyperliquidPrivateKey, config.HyperliquidWalletAddr, config.HyperliquidTestnet)
+		trader, err = hyperliquid.NewHyperliquidTrader(config.HyperliquidPrivateKey, config.HyperliquidWalletAddr, config.HyperliquidTestnet, config.HyperliquidUnifiedAcct)
 		if err != nil {
 			return nil, fmt.Errorf("failed to initialize Hyperliquid trader: %w", err)
 		}
@@ -288,6 +314,9 @@ func NewAutoTrader(config AutoTraderConfig, st *store.Store, userID string) (*Au
 			return nil, fmt.Errorf("failed to initialize LIGHTER trader: %w", err)
 		}
 		logger.Infof("✓ LIGHTER trader initialized successfully")
+	case "indodax":
+		logger.Infof("🏦 [%s] Using Indodax Spot trading", config.Name)
+		trader = indodax.NewIndodaxTrader(config.IndodaxAPIKey, config.IndodaxSecretKey)
 	default:
 		return nil, fmt.Errorf("unsupported trading platform: %s", config.Exchange)
 	}
@@ -2180,22 +2209,22 @@ func (at *AutoTrader) recordOrderFill(orderRecordID int64, exchangeOrderID, symb
 	normalizedSymbol := market.Normalize(symbol)
 
 	fill := &store.TraderFill{
-		TraderID:         at.id,
-		ExchangeID:       at.exchangeID,
-		ExchangeType:     at.exchange,
-		OrderID:          orderRecordID,
-		ExchangeOrderID:  exchangeOrderID,
-		ExchangeTradeID:  tradeID,
-		Symbol:           normalizedSymbol,
-		Side:             side,
-		Price:            price,
-		Quantity:         quantity,
-		QuoteQuantity:    price * quantity,
-		Commission:       fee,
-		CommissionAsset:  "USDT",
-		RealizedPnL:      0, // Will be calculated for close orders
-		IsMaker:          false, // Market orders are usually taker
-		CreatedAt:        time.Now().UTC().UnixMilli(),
+		TraderID:        at.id,
+		ExchangeID:      at.exchangeID,
+		ExchangeType:    at.exchange,
+		OrderID:         orderRecordID,
+		ExchangeOrderID: exchangeOrderID,
+		ExchangeTradeID: tradeID,
+		Symbol:          normalizedSymbol,
+		Side:            side,
+		Price:           price,
+		Quantity:        quantity,
+		QuoteQuantity:   price * quantity,
+		Commission:      fee,
+		CommissionAsset: "USDT",
+		RealizedPnL:     0,     // Will be calculated for close orders
+		IsMaker:         false, // Market orders are usually taker
+		CreatedAt:       time.Now().UTC().UnixMilli(),
 	}
 
 	// Calculate realized PnL for close orders
@@ -2323,4 +2352,3 @@ func getSideFromAction(action string) string {
 func (at *AutoTrader) GetOpenOrders(symbol string) ([]OpenOrder, error) {
 	return at.trader.GetOpenOrders(symbol)
 }
-

trader/hyperliquid/trader.go

@@ -21,12 +21,13 @@ import (
 
 // HyperliquidTrader Hyperliquid trader
 type HyperliquidTrader struct {
-	exchange      *hyperliquid.Exchange
-	ctx           context.Context
-	walletAddr    string
-	meta          *hyperliquid.Meta // Cache meta information (including precision)
-	metaMutex     sync.RWMutex      // Protect concurrent access to meta field
-	isCrossMargin bool              // Whether to use cross margin mode
+	exchange         *hyperliquid.Exchange
+	ctx              context.Context
+	walletAddr       string
+	meta             *hyperliquid.Meta // Cache meta information (including precision)
+	metaMutex        sync.RWMutex      // Protect concurrent access to meta field
+	isCrossMargin    bool              // Whether to use cross margin mode
+	isUnifiedAccount bool              // Whether to use Unified Account mode (Spot as collateral for Perps)
 	// xyz dex support (stocks, forex, commodities)
 	xyzMeta      *xyzDexMeta
 	xyzMetaMutex sync.RWMutex
@@ -80,7 +81,8 @@ func isXyzDexAsset(symbol string) bool {
 }
 
 // NewHyperliquidTrader creates a Hyperliquid trader
-func NewHyperliquidTrader(privateKeyHex string, walletAddr string, testnet bool) (*HyperliquidTrader, error) {
+// unifiedAccount: when true, Spot USDC balance is used as collateral for Perp trading
+func NewHyperliquidTrader(privateKeyHex string, walletAddr string, testnet bool, unifiedAccount bool) (*HyperliquidTrader, error) {
 	// Remove 0x prefix from private key (if present, case-insensitive)
 	privateKeyHex = strings.TrimPrefix(strings.ToLower(privateKeyHex), "0x")
 
@@ -175,14 +177,19 @@ func NewHyperliquidTrader(privateKeyHex string, walletAddr string, testnet bool)
 		}
 	}
 
+	if unifiedAccount {
+		logger.Infof("✓ Unified Account mode enabled: Spot USDC will be used as collateral for Perp trading")
+	}
+
 	return &HyperliquidTrader{
-		exchange:      exchange,
-		ctx:           ctx,
-		walletAddr:    walletAddr,
-		meta:          meta,
-		isCrossMargin: true, // Use cross margin mode by default
-		privateKey:    privateKey,
-		isTestnet:     testnet,
+		exchange:         exchange,
+		ctx:              ctx,
+		walletAddr:       walletAddr,
+		meta:             meta,
+		isCrossMargin:    true,           // Use cross margin mode by default
+		isUnifiedAccount: unifiedAccount, // Unified Account: Spot as Perp collateral
+		privateKey:       privateKey,
+		isTestnet:        testnet,
 	}, nil
 }
 
@@ -304,9 +311,18 @@ func (t *HyperliquidTrader) GetBalance() (map[string]interface{}, error) {
 	// Note: totalWalletBalance + totalUnrealizedPnlAll should equal this
 	totalEquityCalculated := accountValue + spotUSDCBalance + xyzAccountValue
 
+	// ✅ Step 7: Unified Account mode - Spot USDC is used as collateral for Perps
+	// In this mode, available balance includes Spot USDC since it can be used for Perp margin
+	if t.isUnifiedAccount && spotUSDCBalance > 0 {
+		// Add Spot balance to available balance for trading
+		availableBalance = availableBalance + spotUSDCBalance
+		logger.Infof("✓ Unified Account: Spot %.2f USDC added to available balance (total: %.2f)", 
+			spotUSDCBalance, availableBalance)
+	}
+
 	result["totalWalletBalance"] = totalWalletBalance       // Total assets (Perp + Spot + xyz) - unrealized
 	result["totalEquity"] = totalEquityCalculated           // Total equity = Perp AV + Spot + xyz AV
-	result["availableBalance"] = availableBalance           // Available balance (Perpetuals only)
+	result["availableBalance"] = availableBalance           // Available balance (Perp + Spot if unified)
 	result["totalUnrealizedProfit"] = totalUnrealizedPnlAll // Unrealized PnL (Perpetuals + xyz)
 	result["spotBalance"] = spotUSDCBalance                 // Spot balance
 	result["xyzDexBalance"] = xyzAccountValue               // xyz dex equity (stock perps, forex, commodities)

trader/indodax/trader.go

@@ -0,0 +1,878 @@
+package indodax
+
+import (
+	"crypto/hmac"
+	"crypto/sha512"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"math"
+	"net/http"
+	"net/url"
+	"nofx/logger"
+	"nofx/trader/types"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+// Indodax API endpoints
+const (
+	indodaxBaseURL    = "https://indodax.com"
+	indodaxPublicAPI  = "/api"
+	indodaxPrivateAPI = "/tapi"
+)
+
+// IndodaxTrader implements types.Trader interface for Indodax Spot Exchange
+// Indodax is Indonesia's largest crypto exchange, supporting IDR (Indonesian Rupiah) pairs.
+// Since Indodax is spot-only, futures-specific methods (OpenShort, CloseShort, leverage, etc.)
+// are gracefully stubbed.
+type IndodaxTrader struct {
+	apiKey    string
+	secretKey string
+
+	httpClient *http.Client
+	nonce      int64
+	nonceMutex sync.Mutex
+
+	// Cache for pair info
+	pairCache      map[string]*IndodaxPair
+	pairCacheMutex sync.RWMutex
+	pairCacheTime  time.Time
+
+	// Cache for balance
+	cachedBalance     map[string]interface{}
+	cachedPositions   []map[string]interface{}
+	balanceCacheTime  time.Time
+	positionCacheTime time.Time
+	cacheDuration     time.Duration
+	cacheMutex        sync.RWMutex
+}
+
+// IndodaxPair represents a trading pair on Indodax
+type IndodaxPair struct {
+	ID                     string  `json:"id"`
+	Symbol                 string  `json:"symbol"`
+	BaseCurrency           string  `json:"base_currency"`
+	TradedCurrency         string  `json:"traded_currency"`
+	TradedCurrencyUnit     string  `json:"traded_currency_unit"`
+	Description            string  `json:"description"`
+	TickerID               string  `json:"ticker_id"`
+	VolumePrecision        int     `json:"volume_precision"`
+	PricePrecision         float64 `json:"price_precision"`
+	PriceRound             int     `json:"price_round"`
+	Pricescale             float64 `json:"pricescale"`
+	TradeMinBaseCurrency   float64 `json:"trade_min_base_currency"`
+	TradeMinTradedCurrency float64 `json:"trade_min_traded_currency"`
+}
+
+// IndodaxResponse represents the standard Indodax private API response
+type IndodaxResponse struct {
+	Success   int             `json:"success"`
+	Return    json.RawMessage `json:"return,omitempty"`
+	Error     string          `json:"error,omitempty"`
+	ErrorCode string          `json:"error_code,omitempty"`
+}
+
+// IndodaxTicker represents ticker data
+type IndodaxTicker struct {
+	High       string `json:"high"`
+	Low        string `json:"low"`
+	Last       string `json:"last"`
+	Buy        string `json:"buy"`
+	Sell       string `json:"sell"`
+	ServerTime int64  `json:"server_time"`
+}
+
+// IndodaxTickerResponse wraps ticker response
+type IndodaxTickerResponse struct {
+	Ticker IndodaxTicker `json:"ticker"`
+}
+
+// NewIndodaxTrader creates a new Indodax trader instance
+func NewIndodaxTrader(apiKey, secretKey string) *IndodaxTrader {
+	return &IndodaxTrader{
+		apiKey:        apiKey,
+		secretKey:     secretKey,
+		httpClient:    &http.Client{Timeout: 30 * time.Second},
+		nonce:         time.Now().UnixMilli(),
+		pairCache:     make(map[string]*IndodaxPair),
+		cacheDuration: 15 * time.Second,
+	}
+}
+
+// getNonce returns a unique incrementing nonce for each request
+func (t *IndodaxTrader) getNonce() int64 {
+	t.nonceMutex.Lock()
+	defer t.nonceMutex.Unlock()
+	t.nonce++
+	return t.nonce
+}
+
+// sign generates HMAC-SHA512 signature for request body
+func (t *IndodaxTrader) sign(body string) string {
+	mac := hmac.New(sha512.New, []byte(t.secretKey))
+	mac.Write([]byte(body))
+	return hex.EncodeToString(mac.Sum(nil))
+}
+
+// doPublicRequest makes a public API GET request
+func (t *IndodaxTrader) doPublicRequest(path string) ([]byte, error) {
+	reqURL := indodaxBaseURL + indodaxPublicAPI + path
+
+	req, err := http.NewRequest("GET", reqURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	resp, err := t.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(data))
+	}
+
+	return data, nil
+}
+
+// doPrivateRequest makes a signed private API POST request
+func (t *IndodaxTrader) doPrivateRequest(params url.Values) ([]byte, error) {
+	reqURL := indodaxBaseURL + indodaxPrivateAPI
+
+	// Add nonce
+	params.Set("nonce", strconv.FormatInt(t.getNonce(), 10))
+
+	body := params.Encode()
+	signature := t.sign(body)
+
+	req, err := http.NewRequest("POST", reqURL, strings.NewReader(body))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Key", t.apiKey)
+	req.Header.Set("Sign", signature)
+
+	resp, err := t.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	if resp.StatusCode == http.StatusTooManyRequests {
+		return nil, fmt.Errorf("rate limit exceeded, please try again later")
+	}
+
+	// Parse response to check success
+	var apiResp IndodaxResponse
+	if err := json.Unmarshal(data, &apiResp); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w (body: %s)", err, string(data))
+	}
+
+	if apiResp.Success != 1 {
+		return nil, fmt.Errorf("API error: %s (code: %s)", apiResp.Error, apiResp.ErrorCode)
+	}
+
+	return apiResp.Return, nil
+}
+
+// convertSymbol converts standard symbol to Indodax format
+// e.g. BTCIDR -> btc_idr, ETHIDR -> eth_idr
+func (t *IndodaxTrader) convertSymbol(symbol string) string {
+	s := strings.ToLower(symbol)
+
+	// Already in Indodax format (contains underscore)
+	if strings.Contains(s, "_") {
+		return s
+	}
+
+	// Try to split by known base currencies
+	for _, base := range []string{"idr", "btc", "usdt"} {
+		if strings.HasSuffix(s, base) {
+			traded := strings.TrimSuffix(s, base)
+			if traded != "" {
+				return traded + "_" + base
+			}
+		}
+	}
+
+	return s
+}
+
+// convertSymbolBack converts Indodax format back to standard
+// e.g. btc_idr -> BTCIDR
+func (t *IndodaxTrader) convertSymbolBack(indodaxSymbol string) string {
+	return strings.ToUpper(strings.ReplaceAll(indodaxSymbol, "_", ""))
+}
+
+// getCoinFromSymbol extracts the traded currency from a symbol
+// e.g. btc_idr -> btc, eth_idr -> eth
+func (t *IndodaxTrader) getCoinFromSymbol(symbol string) string {
+	pair := t.convertSymbol(symbol)
+	parts := strings.Split(pair, "_")
+	if len(parts) >= 1 {
+		return parts[0]
+	}
+	return strings.ToLower(symbol)
+}
+
+// loadPairs loads trading pair information from the public API
+func (t *IndodaxTrader) loadPairs() error {
+	t.pairCacheMutex.RLock()
+	if len(t.pairCache) > 0 && time.Since(t.pairCacheTime) < 5*time.Minute {
+		t.pairCacheMutex.RUnlock()
+		return nil
+	}
+	t.pairCacheMutex.RUnlock()
+
+	data, err := t.doPublicRequest("/pairs")
+	if err != nil {
+		return fmt.Errorf("failed to load pairs: %w", err)
+	}
+
+	var pairs []IndodaxPair
+	if err := json.Unmarshal(data, &pairs); err != nil {
+		return fmt.Errorf("failed to parse pairs: %w", err)
+	}
+
+	t.pairCacheMutex.Lock()
+	defer t.pairCacheMutex.Unlock()
+
+	t.pairCache = make(map[string]*IndodaxPair)
+	for i := range pairs {
+		p := pairs[i]
+		t.pairCache[p.TickerID] = &p
+		// Also index by ID (e.g. "btcidr")
+		t.pairCache[p.ID] = &p
+	}
+	t.pairCacheTime = time.Now()
+
+	logger.Infof("[Indodax] Loaded %d trading pairs", len(pairs))
+	return nil
+}
+
+// getPair gets pair info for a symbol
+func (t *IndodaxTrader) getPair(symbol string) (*IndodaxPair, error) {
+	if err := t.loadPairs(); err != nil {
+		return nil, err
+	}
+
+	pairID := t.convertSymbol(symbol)
+
+	t.pairCacheMutex.RLock()
+	defer t.pairCacheMutex.RUnlock()
+
+	if pair, ok := t.pairCache[pairID]; ok {
+		return pair, nil
+	}
+
+	// Try without underscore
+	noUnderscore := strings.ReplaceAll(pairID, "_", "")
+	if pair, ok := t.pairCache[noUnderscore]; ok {
+		return pair, nil
+	}
+
+	return nil, fmt.Errorf("pair not found: %s", symbol)
+}
+
+// clearCache clears cached data
+func (t *IndodaxTrader) clearCache() {
+	t.cacheMutex.Lock()
+	defer t.cacheMutex.Unlock()
+	t.cachedBalance = nil
+	t.cachedPositions = nil
+}
+
+// ============================================================
+// types.Trader interface implementation
+// ============================================================
+
+// GetBalance gets account balance from Indodax
+func (t *IndodaxTrader) GetBalance() (map[string]interface{}, error) {
+	// Check cache
+	t.cacheMutex.RLock()
+	if t.cachedBalance != nil && time.Since(t.balanceCacheTime) < t.cacheDuration {
+		cached := t.cachedBalance
+		t.cacheMutex.RUnlock()
+		return cached, nil
+	}
+	t.cacheMutex.RUnlock()
+
+	params := url.Values{}
+	params.Set("method", "getInfo")
+
+	data, err := t.doPrivateRequest(params)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get account info: %w", err)
+	}
+
+	var result struct {
+		ServerTime  int64                  `json:"server_time"`
+		Balance     map[string]interface{} `json:"balance"`
+		BalanceHold map[string]interface{} `json:"balance_hold"`
+		UserID      string                 `json:"user_id"`
+		Name        string                 `json:"name"`
+		Email       string                 `json:"email"`
+	}
+
+	if err := json.Unmarshal(data, &result); err != nil {
+		return nil, fmt.Errorf("failed to parse balance: %w", err)
+	}
+
+	// Calculate total balance in IDR
+	idrBalance := parseFloat(result.Balance["idr"])
+	idrHold := parseFloat(result.BalanceHold["idr"])
+	totalIDR := idrBalance + idrHold
+
+	balance := map[string]interface{}{
+		"totalWalletBalance":    totalIDR,
+		"availableBalance":      idrBalance,
+		"totalUnrealizedProfit": 0.0,
+		"totalEquity":           totalIDR,
+		"balance":               totalIDR,
+		"idr_balance":           idrBalance,
+		"idr_hold":              idrHold,
+		"currency":              "IDR",
+		"user_id":               result.UserID,
+		"server_time":           result.ServerTime,
+	}
+
+	// Add individual crypto balances
+	for currency, amount := range result.Balance {
+		if currency != "idr" {
+			balance["balance_"+currency] = parseFloat(amount)
+		}
+	}
+	for currency, amount := range result.BalanceHold {
+		if currency != "idr" {
+			balance["hold_"+currency] = parseFloat(amount)
+		}
+	}
+
+	// Update cache
+	t.cacheMutex.Lock()
+	t.cachedBalance = balance
+	t.balanceCacheTime = time.Now()
+	t.cacheMutex.Unlock()
+
+	return balance, nil
+}
+
+// GetPositions returns currently held crypto balances as "positions"
+// Since Indodax is spot-only, each non-zero crypto balance is treated as a position
+func (t *IndodaxTrader) GetPositions() ([]map[string]interface{}, error) {
+	// Check cache
+	t.cacheMutex.RLock()
+	if t.cachedPositions != nil && time.Since(t.positionCacheTime) < t.cacheDuration {
+		cached := t.cachedPositions
+		t.cacheMutex.RUnlock()
+		return cached, nil
+	}
+	t.cacheMutex.RUnlock()
+
+	params := url.Values{}
+	params.Set("method", "getInfo")
+
+	data, err := t.doPrivateRequest(params)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get positions: %w", err)
+	}
+
+	var result struct {
+		Balance     map[string]interface{} `json:"balance"`
+		BalanceHold map[string]interface{} `json:"balance_hold"`
+	}
+
+	if err := json.Unmarshal(data, &result); err != nil {
+		return nil, fmt.Errorf("failed to parse positions: %w", err)
+	}
+
+	var positions []map[string]interface{}
+
+	for currency, amountRaw := range result.Balance {
+		if currency == "idr" {
+			continue
+		}
+
+		amount := parseFloat(amountRaw)
+		holdAmount := parseFloat(result.BalanceHold[currency])
+		totalAmount := amount + holdAmount
+
+		if totalAmount <= 0 {
+			continue
+		}
+
+		// Get market price for this coin
+		markPrice, _ := t.GetMarketPrice(strings.ToUpper(currency) + "IDR")
+
+		// Calculate position value in IDR
+		notionalValue := totalAmount * markPrice
+
+		position := map[string]interface{}{
+			"symbol":           strings.ToUpper(currency) + "IDR",
+			"side":             "LONG",
+			"positionAmt":      totalAmount,
+			"entryPrice":       markPrice, // Spot doesn't track entry price
+			"markPrice":        markPrice,
+			"unRealizedProfit": 0.0, // Spot doesn't track unrealized PnL
+			"leverage":         1.0,
+			"mgnMode":          "spot",
+			"notionalValue":    notionalValue,
+			"currency":         currency,
+			"available":        amount,
+			"hold":             holdAmount,
+		}
+
+		positions = append(positions, position)
+	}
+
+	// Update cache
+	t.cacheMutex.Lock()
+	t.cachedPositions = positions
+	t.positionCacheTime = time.Now()
+	t.cacheMutex.Unlock()
+
+	return positions, nil
+}
+
+// OpenLong opens a spot buy order
+func (t *IndodaxTrader) OpenLong(symbol string, quantity float64, leverage int) (map[string]interface{}, error) {
+	t.clearCache()
+
+	pair := t.convertSymbol(symbol)
+	coin := t.getCoinFromSymbol(symbol)
+
+	// Get market price to calculate IDR amount
+	price, err := t.GetMarketPrice(symbol)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get market price: %w", err)
+	}
+
+	params := url.Values{}
+	params.Set("method", "trade")
+	params.Set("pair", pair)
+	params.Set("type", "buy")
+	params.Set("price", strconv.FormatFloat(price, 'f', 0, 64))
+	params.Set(coin, strconv.FormatFloat(quantity, 'f', 8, 64))
+	params.Set("order_type", "limit")
+
+	data, err := t.doPrivateRequest(params)
+	if err != nil {
+		return nil, fmt.Errorf("failed to place buy order: %w", err)
+	}
+
+	var result map[string]interface{}
+	if err := json.Unmarshal(data, &result); err != nil {
+		return nil, fmt.Errorf("failed to parse trade response: %w", err)
+	}
+
+	logger.Infof("[Indodax] Buy order placed: %s qty=%.8f price=%.0f", symbol, quantity, price)
+
+	return map[string]interface{}{
+		"orderId": result["order_id"],
+		"symbol":  symbol,
+		"side":    "BUY",
+		"price":   price,
+		"qty":     quantity,
+		"status":  "NEW",
+	}, nil
+}
+
+// OpenShort is not supported on Indodax (spot-only exchange)
+func (t *IndodaxTrader) OpenShort(symbol string, quantity float64, leverage int) (map[string]interface{}, error) {
+	return nil, fmt.Errorf("short selling is not supported on Indodax (spot-only exchange)")
+}
+
+// CloseLong closes a spot position by selling
+func (t *IndodaxTrader) CloseLong(symbol string, quantity float64) (map[string]interface{}, error) {
+	t.clearCache()
+
+	pair := t.convertSymbol(symbol)
+	coin := t.getCoinFromSymbol(symbol)
+
+	// If quantity is 0, sell all available balance
+	if quantity <= 0 {
+		balance, err := t.GetBalance()
+		if err != nil {
+			return nil, fmt.Errorf("failed to get balance for close all: %w", err)
+		}
+		available := parseFloat(balance["balance_"+coin])
+		if available <= 0 {
+			return nil, fmt.Errorf("no %s balance to sell", coin)
+		}
+		quantity = available
+	}
+
+	// Get market price
+	price, err := t.GetMarketPrice(symbol)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get market price: %w", err)
+	}
+
+	params := url.Values{}
+	params.Set("method", "trade")
+	params.Set("pair", pair)
+	params.Set("type", "sell")
+	params.Set("price", strconv.FormatFloat(price, 'f', 0, 64))
+	params.Set(coin, strconv.FormatFloat(quantity, 'f', 8, 64))
+	params.Set("order_type", "limit")
+
+	data, err := t.doPrivateRequest(params)
+	if err != nil {
+		return nil, fmt.Errorf("failed to place sell order: %w", err)
+	}
+
+	var result map[string]interface{}
+	if err := json.Unmarshal(data, &result); err != nil {
+		return nil, fmt.Errorf("failed to parse trade response: %w", err)
+	}
+
+	logger.Infof("[Indodax] Sell order placed: %s qty=%.8f price=%.0f", symbol, quantity, price)
+
+	return map[string]interface{}{
+		"orderId": result["order_id"],
+		"symbol":  symbol,
+		"side":    "SELL",
+		"price":   price,
+		"qty":     quantity,
+		"status":  "NEW",
+	}, nil
+}
+
+// CloseShort is not supported on Indodax (spot-only exchange)
+func (t *IndodaxTrader) CloseShort(symbol string, quantity float64) (map[string]interface{}, error) {
+	return nil, fmt.Errorf("short selling is not supported on Indodax (spot-only exchange)")
+}
+
+// SetLeverage is a no-op for Indodax (spot-only, no leverage)
+func (t *IndodaxTrader) SetLeverage(symbol string, leverage int) error {
+	logger.Infof("[Indodax] SetLeverage ignored (spot-only exchange, no leverage support)")
+	return nil
+}
+
+// SetMarginMode is a no-op for Indodax (spot-only, no margin)
+func (t *IndodaxTrader) SetMarginMode(symbol string, isCrossMargin bool) error {
+	logger.Infof("[Indodax] SetMarginMode ignored (spot-only exchange, no margin support)")
+	return nil
+}
+
+// GetMarketPrice gets the current market price for a symbol
+func (t *IndodaxTrader) GetMarketPrice(symbol string) (float64, error) {
+	pairID := strings.ToLower(strings.ReplaceAll(t.convertSymbol(symbol), "_", ""))
+
+	data, err := t.doPublicRequest("/ticker/" + pairID)
+	if err != nil {
+		return 0, fmt.Errorf("failed to get ticker: %w", err)
+	}
+
+	var tickerResp IndodaxTickerResponse
+	if err := json.Unmarshal(data, &tickerResp); err != nil {
+		return 0, fmt.Errorf("failed to parse ticker: %w", err)
+	}
+
+	price, err := strconv.ParseFloat(tickerResp.Ticker.Last, 64)
+	if err != nil {
+		return 0, fmt.Errorf("failed to parse price '%s': %w", tickerResp.Ticker.Last, err)
+	}
+
+	return price, nil
+}
+
+// SetStopLoss is not supported on Indodax (spot-only exchange)
+func (t *IndodaxTrader) SetStopLoss(symbol string, positionSide string, quantity, stopPrice float64) error {
+	return fmt.Errorf("stop-loss orders are not supported on Indodax (spot-only exchange)")
+}
+
+// SetTakeProfit is not supported on Indodax (spot-only exchange)
+func (t *IndodaxTrader) SetTakeProfit(symbol string, positionSide string, quantity, takeProfitPrice float64) error {
+	return fmt.Errorf("take-profit orders are not supported on Indodax (spot-only exchange)")
+}
+
+// CancelStopLossOrders is a no-op for Indodax
+func (t *IndodaxTrader) CancelStopLossOrders(symbol string) error {
+	return nil
+}
+
+// CancelTakeProfitOrders is a no-op for Indodax
+func (t *IndodaxTrader) CancelTakeProfitOrders(symbol string) error {
+	return nil
+}
+
+// CancelAllOrders cancels all open orders for a given symbol
+func (t *IndodaxTrader) CancelAllOrders(symbol string) error {
+	t.clearCache()
+
+	pair := t.convertSymbol(symbol)
+
+	// First get open orders
+	params := url.Values{}
+	params.Set("method", "openOrders")
+	params.Set("pair", pair)
+
+	data, err := t.doPrivateRequest(params)
+	if err != nil {
+		return fmt.Errorf("failed to get open orders: %w", err)
+	}
+
+	var result struct {
+		Orders []struct {
+			OrderID   json.Number `json:"order_id"`
+			Type      string      `json:"type"`
+			OrderType string      `json:"order_type"`
+		} `json:"orders"`
+	}
+
+	if err := json.Unmarshal(data, &result); err != nil {
+		return fmt.Errorf("failed to parse open orders: %w", err)
+	}
+
+	// Cancel each order
+	for _, order := range result.Orders {
+		cancelParams := url.Values{}
+		cancelParams.Set("method", "cancelOrder")
+		cancelParams.Set("pair", pair)
+		cancelParams.Set("order_id", order.OrderID.String())
+		cancelParams.Set("type", order.Type)
+
+		if _, err := t.doPrivateRequest(cancelParams); err != nil {
+			logger.Warnf("[Indodax] Failed to cancel order %s: %v", order.OrderID, err)
+		} else {
+			logger.Infof("[Indodax] Cancelled order: %s", order.OrderID)
+		}
+	}
+
+	return nil
+}
+
+// CancelStopOrders is a no-op for Indodax (no stop orders)
+func (t *IndodaxTrader) CancelStopOrders(symbol string) error {
+	return nil
+}
+
+// FormatQuantity formats quantity to correct precision for Indodax
+func (t *IndodaxTrader) FormatQuantity(symbol string, quantity float64) (string, error) {
+	pair, err := t.getPair(symbol)
+	if err != nil {
+		// Default: 8 decimal places
+		return strconv.FormatFloat(quantity, 'f', 8, 64), nil
+	}
+
+	precision := pair.PriceRound
+	if precision <= 0 {
+		precision = 8
+	}
+
+	// Round down to avoid exceeding balance
+	factor := math.Pow(10, float64(precision))
+	rounded := math.Floor(quantity*factor) / factor
+
+	return strconv.FormatFloat(rounded, 'f', precision, 64), nil
+}
+
+// GetOrderStatus gets the status of a specific order
+func (t *IndodaxTrader) GetOrderStatus(symbol string, orderID string) (map[string]interface{}, error) {
+	pair := t.convertSymbol(symbol)
+
+	params := url.Values{}
+	params.Set("method", "getOrder")
+	params.Set("pair", pair)
+	params.Set("order_id", orderID)
+
+	data, err := t.doPrivateRequest(params)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get order status: %w", err)
+	}
+
+	var result struct {
+		Order struct {
+			OrderID       string `json:"order_id"`
+			Price         string `json:"price"`
+			Type          string `json:"type"`
+			Status        string `json:"status"`
+			SubmitTime    string `json:"submit_time"`
+			FinishTime    string `json:"finish_time"`
+			ClientOrderID string `json:"client_order_id"`
+		} `json:"order"`
+	}
+
+	if err := json.Unmarshal(data, &result); err != nil {
+		return nil, fmt.Errorf("failed to parse order: %w", err)
+	}
+
+	// Map Indodax status to standard status
+	status := "NEW"
+	switch result.Order.Status {
+	case "filled":
+		status = "FILLED"
+	case "cancelled":
+		status = "CANCELED"
+	case "open":
+		status = "NEW"
+	}
+
+	price, _ := strconv.ParseFloat(result.Order.Price, 64)
+
+	return map[string]interface{}{
+		"status":      status,
+		"avgPrice":    price,
+		"executedQty": 0.0, // Indodax doesn't return executed qty in getOrder
+		"commission":  0.0,
+		"orderId":     result.Order.OrderID,
+	}, nil
+}
+
+// GetClosedPnL gets closed position PnL records (trade history)
+func (t *IndodaxTrader) GetClosedPnL(startTime time.Time, limit int) ([]types.ClosedPnLRecord, error) {
+	// Indodax trade history is limited to 7 days range
+	params := url.Values{}
+	params.Set("method", "tradeHistory")
+	params.Set("pair", "btc_idr") // Default pair; Indodax requires a pair
+	if limit > 0 {
+		params.Set("count", strconv.Itoa(limit))
+	}
+	if !startTime.IsZero() {
+		params.Set("since", strconv.FormatInt(startTime.Unix(), 10))
+	}
+
+	data, err := t.doPrivateRequest(params)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get trade history: %w", err)
+	}
+
+	var result struct {
+		Trades []struct {
+			TradeID       string `json:"trade_id"`
+			OrderID       string `json:"order_id"`
+			Type          string `json:"type"`
+			Price         string `json:"price"`
+			Fee           string `json:"fee"`
+			TradeTime     string `json:"trade_time"`
+			ClientOrderID string `json:"client_order_id"`
+		} `json:"trades"`
+	}
+
+	if err := json.Unmarshal(data, &result); err != nil {
+		// Trade history might return empty, that's fine
+		return nil, nil
+	}
+
+	var records []types.ClosedPnLRecord
+	for _, trade := range result.Trades {
+		price, _ := strconv.ParseFloat(trade.Price, 64)
+		fee, _ := strconv.ParseFloat(trade.Fee, 64)
+		tradeTime, _ := strconv.ParseInt(trade.TradeTime, 10, 64)
+
+		side := "long"
+		if trade.Type == "sell" {
+			side = "long" // Selling from a spot position is closing long
+		}
+
+		records = append(records, types.ClosedPnLRecord{
+			Symbol:    "BTCIDR",
+			Side:      side,
+			ExitPrice: price,
+			Fee:       fee,
+			ExitTime:  time.Unix(tradeTime, 0),
+			OrderID:   trade.OrderID,
+			CloseType: "manual",
+		})
+	}
+
+	return records, nil
+}
+
+// GetOpenOrders gets open/pending orders
+func (t *IndodaxTrader) GetOpenOrders(symbol string) ([]types.OpenOrder, error) {
+	pair := t.convertSymbol(symbol)
+
+	params := url.Values{}
+	params.Set("method", "openOrders")
+	if pair != "" {
+		params.Set("pair", pair)
+	}
+
+	data, err := t.doPrivateRequest(params)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get open orders: %w", err)
+	}
+
+	var result struct {
+		Orders []struct {
+			OrderID       json.Number `json:"order_id"`
+			ClientOrderID string      `json:"client_order_id"`
+			SubmitTime    string      `json:"submit_time"`
+			Price         string      `json:"price"`
+			Type          string      `json:"type"`
+			OrderType     string      `json:"order_type"`
+		} `json:"orders"`
+	}
+
+	if err := json.Unmarshal(data, &result); err != nil {
+		return nil, fmt.Errorf("failed to parse open orders: %w", err)
+	}
+
+	var orders []types.OpenOrder
+	for _, order := range result.Orders {
+		price, _ := strconv.ParseFloat(order.Price, 64)
+
+		side := "BUY"
+		if order.Type == "sell" {
+			side = "SELL"
+		}
+
+		orders = append(orders, types.OpenOrder{
+			OrderID:      order.OrderID.String(),
+			Symbol:       t.convertSymbolBack(pair),
+			Side:         side,
+			PositionSide: "LONG",
+			Type:         "LIMIT",
+			Price:        price,
+			Status:       "NEW",
+		})
+	}
+
+	return orders, nil
+}
+
+// ============================================================
+// Helper functions
+// ============================================================
+
+// parseFloat safely parses a float from interface{}
+func parseFloat(v interface{}) float64 {
+	if v == nil {
+		return 0
+	}
+	switch val := v.(type) {
+	case float64:
+		return val
+	case string:
+		f, _ := strconv.ParseFloat(val, 64)
+		return f
+	case json.Number:
+		f, _ := val.Float64()
+		return f
+	case int:
+		return float64(val)
+	case int64:
+		return float64(val)
+	default:
+		return 0
+	}
+}

trader/indodax/trader_test.go

@@ -0,0 +1,374 @@
+package indodax
+
+import (
+	"os"
+	"testing"
+	"time"
+
+	"nofx/trader/types"
+)
+
+// Test credentials - set via environment variables
+func getIndodaxTestCredentials(t *testing.T) (string, string) {
+	apiKey := os.Getenv("INDODAX_TEST_API_KEY")
+	secretKey := os.Getenv("INDODAX_TEST_SECRET_KEY")
+
+	if apiKey == "" || secretKey == "" {
+		t.Skip("Indodax test credentials not set (INDODAX_TEST_API_KEY, INDODAX_TEST_SECRET_KEY)")
+	}
+
+	return apiKey, secretKey
+}
+
+func createIndodaxTestTrader(t *testing.T) *IndodaxTrader {
+	apiKey, secretKey := getIndodaxTestCredentials(t)
+	trader := NewIndodaxTrader(apiKey, secretKey)
+	return trader
+}
+
+// TestIndodaxTrader_InterfaceCompliance tests that IndodaxTrader implements types.Trader
+func TestIndodaxTrader_InterfaceCompliance(t *testing.T) {
+	var _ types.Trader = (*IndodaxTrader)(nil)
+}
+
+// TestNewIndodaxTrader tests creating Indodax trader instance
+func TestNewIndodaxTrader(t *testing.T) {
+	trader := NewIndodaxTrader("test_api_key", "test_secret_key")
+
+	if trader == nil {
+		t.Fatal("Expected non-nil trader")
+	}
+	if trader.apiKey != "test_api_key" {
+		t.Errorf("Expected apiKey 'test_api_key', got '%s'", trader.apiKey)
+	}
+	if trader.secretKey != "test_secret_key" {
+		t.Errorf("Expected secretKey 'test_secret_key', got '%s'", trader.secretKey)
+	}
+	if trader.httpClient == nil {
+		t.Error("Expected non-nil httpClient")
+	}
+	if trader.cacheDuration != 15*time.Second {
+		t.Errorf("Expected cacheDuration 15s, got %v", trader.cacheDuration)
+	}
+}
+
+// TestIndodaxTrader_SymbolConversion tests symbol format conversion
+func TestIndodaxTrader_SymbolConversion(t *testing.T) {
+	trader := NewIndodaxTrader("test", "test")
+
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{"BTCIDR to btc_idr", "BTCIDR", "btc_idr"},
+		{"ETHIDR to eth_idr", "ETHIDR", "eth_idr"},
+		{"SOLIDR to sol_idr", "SOLIDR", "sol_idr"},
+		{"Already converted", "btc_idr", "btc_idr"},
+		{"BTC pair", "ETHBTC", "eth_btc"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := trader.convertSymbol(tt.input)
+			if result != tt.expected {
+				t.Errorf("convertSymbol(%s) = %s, want %s", tt.input, result, tt.expected)
+			}
+		})
+	}
+}
+
+// TestIndodaxTrader_SymbolConversionBack tests symbol reversion
+func TestIndodaxTrader_SymbolConversionBack(t *testing.T) {
+	trader := NewIndodaxTrader("test", "test")
+
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{"btc_idr to BTCIDR", "btc_idr", "BTCIDR"},
+		{"eth_idr to ETHIDR", "eth_idr", "ETHIDR"},
+		{"Already standard", "BTCIDR", "BTCIDR"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := trader.convertSymbolBack(tt.input)
+			if result != tt.expected {
+				t.Errorf("convertSymbolBack(%s) = %s, want %s", tt.input, result, tt.expected)
+			}
+		})
+	}
+}
+
+// TestIndodaxTrader_GetCoinFromSymbol tests coin extraction
+func TestIndodaxTrader_GetCoinFromSymbol(t *testing.T) {
+	trader := NewIndodaxTrader("test", "test")
+
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{"BTCIDR", "btc"},
+		{"ETHIDR", "eth"},
+		{"btc_idr", "btc"},
+		{"eth_idr", "eth"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.input, func(t *testing.T) {
+			result := trader.getCoinFromSymbol(tt.input)
+			if result != tt.expected {
+				t.Errorf("getCoinFromSymbol(%s) = %s, want %s", tt.input, result, tt.expected)
+			}
+		})
+	}
+}
+
+// TestIndodaxTrader_Sign tests HMAC-SHA512 signature generation
+func TestIndodaxTrader_Sign(t *testing.T) {
+	trader := NewIndodaxTrader("api_key", "secret_key")
+
+	body := "method=getInfo&nonce=1000"
+	signature := trader.sign(body)
+
+	if signature == "" {
+		t.Error("Expected non-empty signature")
+	}
+	if len(signature) != 128 { // SHA-512 hex = 128 chars
+		t.Errorf("Expected signature length 128, got %d", len(signature))
+	}
+
+	// Same input should produce same signature
+	signature2 := trader.sign(body)
+	if signature != signature2 {
+		t.Error("Signature should be deterministic")
+	}
+
+	// Different input should produce different signature
+	signature3 := trader.sign("method=getInfo&nonce=1001")
+	if signature == signature3 {
+		t.Error("Different input should produce different signature")
+	}
+}
+
+// TestIndodaxTrader_Nonce tests nonce incrementation
+func TestIndodaxTrader_Nonce(t *testing.T) {
+	trader := NewIndodaxTrader("test", "test")
+
+	nonce1 := trader.getNonce()
+	nonce2 := trader.getNonce()
+	nonce3 := trader.getNonce()
+
+	if nonce2 <= nonce1 {
+		t.Errorf("Nonce should be increasing: %d <= %d", nonce2, nonce1)
+	}
+	if nonce3 <= nonce2 {
+		t.Errorf("Nonce should be increasing: %d <= %d", nonce3, nonce2)
+	}
+}
+
+// TestIndodaxTrader_SpotOnlyRestrictions tests that futures-only methods return errors
+func TestIndodaxTrader_SpotOnlyRestrictions(t *testing.T) {
+	trader := NewIndodaxTrader("test", "test")
+
+	// OpenShort should fail
+	_, err := trader.OpenShort("BTCIDR", 0.001, 1)
+	if err == nil {
+		t.Error("OpenShort should return error on spot exchange")
+	}
+
+	// CloseShort should fail
+	_, err = trader.CloseShort("BTCIDR", 0.001)
+	if err == nil {
+		t.Error("CloseShort should return error on spot exchange")
+	}
+
+	// SetStopLoss should fail
+	err = trader.SetStopLoss("BTCIDR", "LONG", 0.001, 500000000)
+	if err == nil {
+		t.Error("SetStopLoss should return error on spot exchange")
+	}
+
+	// SetTakeProfit should fail
+	err = trader.SetTakeProfit("BTCIDR", "LONG", 0.001, 600000000)
+	if err == nil {
+		t.Error("SetTakeProfit should return error on spot exchange")
+	}
+
+	// SetLeverage should NOT fail (no-op)
+	err = trader.SetLeverage("BTCIDR", 10)
+	if err != nil {
+		t.Errorf("SetLeverage should not fail (no-op): %v", err)
+	}
+
+	// SetMarginMode should NOT fail (no-op)
+	err = trader.SetMarginMode("BTCIDR", true)
+	if err != nil {
+		t.Errorf("SetMarginMode should not fail (no-op): %v", err)
+	}
+}
+
+// TestIndodaxTrader_ParseFloat tests parseFloat helper
+func TestIndodaxTrader_ParseFloat(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    interface{}
+		expected float64
+	}{
+		{"float64", 123.45, 123.45},
+		{"string", "123.45", 123.45},
+		{"int", 123, 123.0},
+		{"int64", int64(123), 123.0},
+		{"nil", nil, 0.0},
+		{"zero string", "0", 0.0},
+		{"empty string", "", 0.0},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := parseFloat(tt.input)
+			if result != tt.expected {
+				t.Errorf("parseFloat(%v) = %f, want %f", tt.input, result, tt.expected)
+			}
+		})
+	}
+}
+
+// TestIndodaxTrader_ClearCache tests cache clearing
+func TestIndodaxTrader_ClearCache(t *testing.T) {
+	trader := NewIndodaxTrader("test", "test")
+
+	// Set some cached data
+	trader.cachedBalance = map[string]interface{}{"test": "data"}
+	trader.cachedPositions = []map[string]interface{}{{"test": "data"}}
+
+	// Clear cache
+	trader.clearCache()
+
+	if trader.cachedBalance != nil {
+		t.Error("Cache should be cleared")
+	}
+	if trader.cachedPositions != nil {
+		t.Error("Position cache should be cleared")
+	}
+}
+
+// ============================================================
+// Integration tests (require INDODAX_TEST_API_KEY env vars)
+// ============================================================
+
+// TestIndodaxConnection tests basic API connectivity
+func TestIndodaxConnection(t *testing.T) {
+	trader := createIndodaxTestTrader(t)
+
+	balance, err := trader.GetBalance()
+	if err != nil {
+		t.Fatalf("Failed to get balance: %v", err)
+	}
+
+	t.Logf("✅ Connection OK")
+	t.Logf("  totalWalletBalance: %v", balance["totalWalletBalance"])
+	t.Logf("  availableBalance: %v", balance["availableBalance"])
+	t.Logf("  totalEquity: %v", balance["totalEquity"])
+	t.Logf("  currency: %v", balance["currency"])
+	t.Logf("  user_id: %v", balance["user_id"])
+}
+
+// TestIndodaxGetPositions tests position retrieval
+func TestIndodaxGetPositions(t *testing.T) {
+	trader := createIndodaxTestTrader(t)
+
+	positions, err := trader.GetPositions()
+	if err != nil {
+		t.Fatalf("Failed to get positions: %v", err)
+	}
+
+	t.Logf("📊 Found %d positions (crypto balances):", len(positions))
+	for i, pos := range positions {
+		t.Logf("  [%d] %s: qty=%.8f markPrice=%.0f value=%.0f IDR",
+			i+1,
+			pos["symbol"],
+			pos["positionAmt"],
+			pos["markPrice"],
+			pos["notionalValue"],
+		)
+	}
+}
+
+// TestIndodaxGetMarketPrice tests market price retrieval
+func TestIndodaxGetMarketPrice(t *testing.T) {
+	trader := createIndodaxTestTrader(t)
+
+	pairs := []string{"BTCIDR", "ETHIDR"}
+
+	for _, pair := range pairs {
+		price, err := trader.GetMarketPrice(pair)
+		if err != nil {
+			t.Errorf("Failed to get price for %s: %v", pair, err)
+			continue
+		}
+		t.Logf("  %s: %.0f IDR", pair, price)
+	}
+}
+
+// TestIndodaxGetOpenOrders tests open orders retrieval
+func TestIndodaxGetOpenOrders(t *testing.T) {
+	trader := createIndodaxTestTrader(t)
+
+	orders, err := trader.GetOpenOrders("BTCIDR")
+	if err != nil {
+		t.Fatalf("Failed to get open orders: %v", err)
+	}
+
+	t.Logf("📋 Found %d open orders:", len(orders))
+	for i, order := range orders {
+		t.Logf("  [%d] %s %s: price=%.0f orderID=%s",
+			i+1, order.Symbol, order.Side, order.Price, order.OrderID)
+	}
+}
+
+// TestIndodaxGetClosedPnL tests trade history retrieval
+func TestIndodaxGetClosedPnL(t *testing.T) {
+	trader := createIndodaxTestTrader(t)
+
+	startTime := time.Now().Add(-7 * 24 * time.Hour)
+	records, err := trader.GetClosedPnL(startTime, 10)
+	if err != nil {
+		t.Fatalf("Failed to get closed PnL: %v", err)
+	}
+
+	t.Logf("📋 Found %d trade records:", len(records))
+	for i, record := range records {
+		t.Logf("  [%d] %s %s: price=%.0f fee=%.4f time=%s",
+			i+1, record.Symbol, record.Side, record.ExitPrice, record.Fee,
+			record.ExitTime.Format("2006-01-02 15:04:05"))
+	}
+}
+
+// TestIndodaxLoadPairs tests loading trading pairs
+func TestIndodaxLoadPairs(t *testing.T) {
+	trader := createIndodaxTestTrader(t)
+
+	err := trader.loadPairs()
+	if err != nil {
+		t.Fatalf("Failed to load pairs: %v", err)
+	}
+
+	trader.pairCacheMutex.RLock()
+	defer trader.pairCacheMutex.RUnlock()
+
+	t.Logf("📊 Loaded %d pairs", len(trader.pairCache))
+
+	// Check some known pairs
+	knownPairs := []string{"btc_idr", "eth_idr"}
+	for _, pairID := range knownPairs {
+		if pair, ok := trader.pairCache[pairID]; ok {
+			t.Logf("  %s: min_base=%v, min_traded=%v, precision=%d",
+				pair.Description, pair.TradeMinBaseCurrency, pair.TradeMinTradedCurrency, pair.PriceRound)
+		} else {
+			t.Errorf("Expected pair %s not found", pairID)
+		}
+	}
+}

web/public/exchange-icons/indodax.svg

@@ -0,0 +1,3 @@
+<svg width="300" height="300" viewBox="0 0 300 300" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path d="M23.8095 0.263396C16.8864 1.28889 10.9524 4.62174 6.15385 10.2253C3.99267 12.7524 1.50183 17.8066 0.659341 21.3592C0.03663 24.1061 0 29.3434 0 150.022C0 270.7 0.03663 275.938 0.659341 278.684C1.50183 282.274 3.99267 287.291 6.26374 289.928C10.1832 294.58 15.7143 298.022 21.3187 299.341C24.0659 299.963 29.304 300 150 300C270.696 300 275.934 299.963 278.681 299.341C284.286 298.022 289.817 294.58 293.736 289.928C296.007 287.291 298.498 282.274 299.341 278.684C299.963 275.938 300 270.7 300 150.022C300 29.3434 299.963 24.1061 299.341 21.3592C297.033 11.6171 289.341 3.66949 279.414 0.849391L276.557 0.0436474L151.282 0.00702266C81.3919 -0.0296021 25.0549 0.0802721 23.8095 0.263396ZM92.381 77.2119C96.1905 81.0941 104.469 89.5911 110.769 96.037L122.234 107.83L124.249 108.05C126.777 108.343 128.645 109.295 130.293 111.126C131.905 112.921 132.564 114.789 132.527 117.426C132.454 122.517 128.645 126.216 123.443 126.216C118.681 126.216 115.421 123.432 114.322 118.525C114.139 117.682 108.901 112.189 89.1209 91.9717L85.1648 87.9429L77.3993 95.7074L69.5971 103.508L89.7436 123.652L109.89 143.796H116.374C119.963 143.796 122.894 143.905 122.894 144.089C122.894 144.235 110.952 156.065 96.337 170.349C81.7216 184.669 69.7802 196.425 69.7802 196.535C69.7802 196.645 73.2967 200.234 77.5824 204.519L85.4212 212.32L110.842 186.537L136.264 160.716L150.403 160.68L164.506 160.643L168.901 165.148C174.249 170.642 177.729 174.231 198.169 195.546L214.249 212.32L222.051 204.519C226.337 200.234 229.817 196.608 229.744 196.425C229.707 196.279 224.286 190.492 217.692 183.57C206.557 171.887 205.568 170.971 203.956 170.495C201.685 169.872 198.718 166.979 198.059 164.818C196.337 158.922 199.927 153.318 205.824 152.695C211.136 152.146 215.348 155.772 215.897 161.339L216.117 163.829L231.319 180.054C239.67 188.954 246.557 196.462 246.63 196.682C246.667 196.901 239.414 204.483 230.476 213.529L214.286 229.974L189.194 203.824C175.421 189.43 162.821 176.318 161.209 174.634L158.278 171.63H150.733H143.187L133.333 181.592C127.912 187.086 114.908 200.198 104.432 210.746L85.3846 229.9L68.6813 213.199L52.0147 196.535L75.2747 173.279L98.5348 150.022L75.2747 126.765L52.0147 103.508L68.6813 86.8442C77.8388 77.688 85.348 70.18 85.3846 70.18C85.4212 70.18 88.5348 73.3663 92.381 77.2119ZM231.355 86.5512C240.403 95.5243 247.802 103.032 247.802 103.215C247.802 103.435 242.381 109.039 235.788 115.704C209.121 142.697 191.209 161.009 191.209 161.375C191.209 161.559 196.374 167.382 202.674 174.304L214.139 186.903L216.154 187.342C220.366 188.295 223.26 191.957 223.26 196.352C223.26 201.553 219.341 205.435 214.103 205.398C209.414 205.398 205.751 202.102 205.018 197.304C204.762 195.473 204.652 195.363 188.205 178.443C179.084 169.067 171.612 161.229 171.612 161.046C171.612 160.863 172.711 159.691 174.103 158.409C177.802 154.93 229.67 104.168 229.78 103.875C229.927 103.508 214.506 88.0528 214.139 88.1993C213.846 88.3092 194.029 107.684 169.78 131.563L161.172 140.06L136.813 139.877L112.454 139.694L99.0843 126.399C86.4103 113.8 85.641 113.104 84.1392 112.884C81.0256 112.408 78.0586 110.138 76.8865 107.317C76.1538 105.559 76.2637 101.787 77.0696 100.029C77.9487 98.1246 80.696 95.5975 82.4542 95.1214C87.9487 93.5831 93.2234 96.623 94.359 101.934L94.7985 104.058L107.106 116.217L119.414 128.377H137.912L156.41 128.413L185.531 99.2966C201.538 83.2916 214.689 70.18 214.762 70.18C214.835 70.18 222.271 77.5415 231.355 86.5512ZM216.813 95.4876C218.718 96.0004 221.978 99.26 222.491 101.164C224.103 106.915 220.733 112.481 215.128 113.251C213.626 113.47 212.344 114.642 191.392 135.042L169.231 156.578L151.832 156.614H134.432L114.615 176.465C96.63 194.484 94.7253 196.499 94.5055 197.817C93.2967 204.812 85.2747 207.742 79.4506 203.311C75.3846 200.198 75.4212 192.69 79.5238 189.284C80.9158 188.112 83.7729 187.013 85.3846 187.013C85.9341 187.013 92.3443 180.86 107.802 165.404L129.414 143.796H146.923H164.469L184.432 124.311C204.249 104.937 204.396 104.79 204.652 103.032C205.568 97.209 210.952 93.8761 216.813 95.4876Z" fill="#0184B5"/>
+</svg>

web/public/icons/blockrun.svg

@@ -0,0 +1,6 @@
+<svg viewBox="0 0 100 100" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <rect x="30" y="20" width="55" height="60" rx="14" stroke="#FFFFFF" stroke-width="8" fill="none"/>
+  <path d="M15 35 L25 35" stroke="#FFFFFF" stroke-width="6" stroke-linecap="round"/>
+  <path d="M10 50 L25 50" stroke="#FFFFFF" stroke-width="6" stroke-linecap="round"/>
+  <path d="M15 65 L25 65" stroke="#FFFFFF" stroke-width="6" stroke-linecap="round"/>
+</svg>

web/public/icons/claw402.svg

@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 120 120" fill="none">
+  <defs>
+    <linearGradient id="claw402_bg" x1="0" y1="0" x2="120" y2="120" gradientUnits="userSpaceOnUse">
+      <stop offset="0%" stop-color="#2563EB"/>
+      <stop offset="100%" stop-color="#7C3AED"/>
+    </linearGradient>
+  </defs>
+  <rect width="120" height="120" rx="24" fill="url(#claw402_bg)"/>
+  <!-- Diamond/gem shape -->
+  <path d="M60 22L88 50L60 98L32 50L60 22Z" fill="white" fill-opacity="0.95"/>
+  <path d="M60 22L88 50L60 50L32 50L60 22Z" fill="white" fill-opacity="0.7"/>
+  <path d="M60 50L88 50L60 98Z" fill="white" fill-opacity="0.85"/>
+  <path d="M60 50L32 50L60 98Z" fill="white" fill-opacity="0.6"/>
+  <!-- Subtle USDC circle hint -->
+  <circle cx="60" cy="58" r="12" fill="none" stroke="white" stroke-width="2" stroke-opacity="0.3"/>
+  <text x="60" y="63" text-anchor="middle" fill="white" fill-opacity="0.4" font-size="12" font-weight="700" font-family="system-ui">$</text>
+</svg>

web/public/icons/minimax.svg

@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="150" height="150">
+  <defs>
+    <linearGradient id="minimax-gradient" x1="0%" y1="50%" x2="100%" y2="50%">
+      <stop offset="0%" stop-color="#E2167E"/>
+      <stop offset="100%" stop-color="#FE603C"/>
+    </linearGradient>
+  </defs>
+  <path fill="url(#minimax-gradient)" fill-rule="nonzero" d="M16.278 2c1.156 0 2.093.927 2.093 2.07v12.501a.74.74 0 00.744.709.74.74 0 00.743-.709V9.099a2.06 2.06 0 012.071-2.049A2.06 2.06 0 0124 9.1v6.561a.649.649 0 01-.652.645.649.649 0 01-.653-.645V9.1a.762.762 0 00-.766-.758.762.762 0 00-.766.758v7.472a2.037 2.037 0 01-2.048 2.026 2.037 2.037 0 01-2.048-2.026v-12.5a.785.785 0 00-.788-.753.785.785 0 00-.789.752l-.001 15.904A2.037 2.037 0 0113.441 22a2.037 2.037 0 01-2.048-2.026V18.04c0-.356.292-.645.652-.645.36 0 .652.289.652.645v1.934c0 .263.142.506.372.638.23.131.514.131.744 0a.734.734 0 00.372-.638V4.07c0-1.143.937-2.07 2.093-2.07zm-5.674 0c1.156 0 2.093.927 2.093 2.07v11.523a.648.648 0 01-.652.645.648.648 0 01-.652-.645V4.07a.785.785 0 00-.789-.78.785.785 0 00-.789.78v14.013a2.06 2.06 0 01-2.07 2.048 2.06 2.06 0 01-2.071-2.048V9.1a.762.762 0 00-.766-.758.762.762 0 00-.766.758v3.8a2.06 2.06 0 01-2.071 2.049A2.06 2.06 0 010 12.9v-1.378c0-.357.292-.646.652-.646.36 0 .653.29.653.646V12.9c0 .418.343.757.766.757s.766-.339.766-.757V9.099a2.06 2.06 0 012.07-2.048 2.06 2.06 0 012.071 2.048v8.984c0 .419.343.758.767.758.423 0 .766-.339.766-.758V4.07c0-1.143.937-2.07 2.093-2.07z"/>
+</svg>

web/src/App.tsx

@@ -6,7 +6,8 @@ import { TraderDashboardPage } from './pages/TraderDashboardPage'
 
 import { AITradersPage } from './components/AITradersPage'
 import { LoginPage } from './components/LoginPage'
-import { RegisterPage } from './components/RegisterPage'
+import { SetupPage } from './components/SetupPage'
+import { SettingsPage } from './pages/SettingsPage'
 import { ResetPasswordPage } from './components/ResetPasswordPage'
 import { CompetitionPage } from './components/CompetitionPage'
 import { LandingPage } from './pages/LandingPage'
@@ -53,7 +54,7 @@ type Page =
 function App() {
   const { language, setLanguage } = useLanguage()
   const { user, token, logout, isLoading } = useAuth()
-  const { loading: configLoading } = useSystemConfig()
+  const { config: systemConfig, loading: configLoading } = useSystemConfig()
   const [route, setRoute] = useState(window.location.pathname)
 
   // Debug log
@@ -341,12 +342,22 @@ function App() {
     )
   }
 
+  // First-time setup: redirect to /setup if system not initialized
+  if (systemConfig && !systemConfig.initialized && !user) {
+    return <SetupPage />
+  }
+
   // Handle specific routes regardless of authentication
   if (route === '/login') {
     return <LoginPage />
   }
-  if (route === '/register') {
-    return <RegisterPage />
+  if (route === '/setup') {
+    // If already initialized, redirect to login
+    if (systemConfig?.initialized) {
+      window.location.href = '/login'
+      return null
+    }
+    return <SetupPage />
   }
   if (route === '/faq') {
     return (
@@ -376,6 +387,26 @@ function App() {
   if (route === '/reset-password') {
     return <ResetPasswordPage />
   }
+  if (route === '/settings') {
+    if (!user || !token) {
+      window.location.href = '/login'
+      return null
+    }
+    return (
+      <div className="min-h-screen" style={{ background: '#0B0E11', color: '#EAECEF' }}>
+        <HeaderBar
+          isLoggedIn={!!user}
+          language={language}
+          onLanguageChange={setLanguage}
+          user={user}
+          onLogout={logout}
+          onLoginRequired={handleLoginRequired}
+          onPageChange={navigateToPage}
+        />
+        <SettingsPage />
+      </div>
+    )
+  }
   // Data page - publicly accessible with embedded dashboard
   if (route === '/data') {
     const dataPageNavigate = (page: Page) => {

web/src/components/AITradersPage.tsx

@@ -16,6 +16,7 @@ import { getModelIcon } from './ModelIcons'
 import { TraderConfigModal } from './TraderConfigModal'
 import { DeepVoidBackground } from './DeepVoidBackground'
 import { ExchangeConfigModal } from './traders/ExchangeConfigModal'
+import { TelegramConfigModal } from './traders/TelegramConfigModal'
 import { PunkAvatar, getTraderAvatar } from './PunkAvatar'
 import {
   Bot,
@@ -31,6 +32,7 @@ import {
   ExternalLink,
   Copy,
   Check,
+  MessageCircle,
 } from 'lucide-react'
 import { confirmToast } from '../lib/notify'
 import { toast } from 'sonner'
@@ -55,6 +57,32 @@ function getShortName(fullName: string): string {
   return parts.length > 1 ? parts[parts.length - 1] : fullName
 }
 
+// Top models available through BlockRun wallet providers
+const BLOCKRUN_MODELS = [
+  { id: 'gpt-5.4', name: 'GPT-5.4', desc: 'OpenAI · Flagship' },
+  { id: 'claude-opus-4.6', name: 'Claude Opus 4.6', desc: 'Anthropic · Flagship' },
+  { id: 'gemini-3.1-pro', name: 'Gemini 3.1 Pro', desc: 'Google · Flagship' },
+  { id: 'grok-3', name: 'Grok 3', desc: 'xAI · Flagship' },
+  { id: 'deepseek-chat', name: 'DeepSeek Chat', desc: 'DeepSeek · Flagship' },
+  { id: 'minimax-m2.5', name: 'MiniMax M2.5', desc: 'MiniMax · Flagship' },
+]
+
+// Models available through Claw402 (x402 USDC payment protocol)
+const CLAW402_MODELS = [
+  { id: 'gpt-5.4', name: 'GPT-5.4', provider: 'OpenAI', desc: 'Flagship · Fast', icon: '⚡' },
+  { id: 'gpt-5.4-pro', name: 'GPT-5.4 Pro', provider: 'OpenAI', desc: 'Reasoning · Pro', icon: '🧠' },
+  { id: 'gpt-5.3', name: 'GPT-5.3', provider: 'OpenAI', desc: 'Balanced', icon: '💡' },
+  { id: 'gpt-5-mini', name: 'GPT-5 Mini', provider: 'OpenAI', desc: 'Fast · Cheap', icon: '🚀' },
+  { id: 'claude-opus', name: 'Claude Opus', provider: 'Anthropic', desc: 'Flagship · Deep', icon: '🎯' },
+  { id: 'deepseek', name: 'DeepSeek V3', provider: 'DeepSeek', desc: 'Best Value', icon: '🔥' },
+  { id: 'deepseek-reasoner', name: 'DeepSeek R1', provider: 'DeepSeek', desc: 'Reasoning', icon: '🤔' },
+  { id: 'qwen-max', name: 'Qwen Max', provider: 'Alibaba', desc: 'Flagship', icon: '🌟' },
+  { id: 'qwen-plus', name: 'Qwen Plus', provider: 'Alibaba', desc: 'Balanced', icon: '✨' },
+  { id: 'grok-4.1', name: 'Grok 4.1', provider: 'xAI', desc: 'Flagship', icon: '⚡' },
+  { id: 'gemini-3.1-pro', name: 'Gemini 3.1 Pro', provider: 'Google', desc: 'Flagship', icon: '💎' },
+  { id: 'kimi-k2.5', name: 'Kimi K2.5', provider: 'Moonshot', desc: 'Balanced', icon: '🌙' },
+]
+
 // AI Provider configuration - default models and API links
 const AI_PROVIDER_CONFIG: Record<string, {
   defaultModel: string
@@ -96,6 +124,26 @@ const AI_PROVIDER_CONFIG: Record<string, {
     apiUrl: 'https://platform.moonshot.ai/console/api-keys',
     apiName: 'Moonshot',
   },
+  minimax: {
+    defaultModel: 'MiniMax-M2.5',
+    apiUrl: 'https://platform.minimax.io',
+    apiName: 'MiniMax',
+  },
+  claw402: {
+    defaultModel: 'deepseek',
+    apiUrl: 'https://claw402.ai',
+    apiName: 'Claw402',
+  },
+  'blockrun-base': {
+    defaultModel: 'gpt-5.4',
+    apiUrl: 'https://blockrun.ai',
+    apiName: 'BlockRun',
+  },
+  'blockrun-sol': {
+    defaultModel: 'gpt-5.4',
+    apiUrl: 'https://sol.blockrun.ai',
+    apiName: 'BlockRun',
+  },
 }
 
 interface AITradersPageProps {
@@ -148,6 +196,7 @@ export function AITradersPage({ onTraderSelect }: AITradersPageProps) {
   const [showEditModal, setShowEditModal] = useState(false)
   const [showModelModal, setShowModelModal] = useState(false)
   const [showExchangeModal, setShowExchangeModal] = useState(false)
+  const [showTelegramModal, setShowTelegramModal] = useState(false)
   const [editingModel, setEditingModel] = useState<string | null>(null)
   const [editingExchange, setEditingExchange] = useState<string | null>(null)
   const [editingTrader, setEditingTrader] = useState<any>(null)
@@ -849,6 +898,16 @@ export function AITradersPage({ onTraderSelect }: AITradersPageProps) {
               </div>
             </button>
 
+            <button
+              onClick={() => setShowTelegramModal(true)}
+              className="px-4 py-2 rounded text-xs font-mono uppercase tracking-wider transition-all border border-sky-900/50 bg-black/20 text-sky-500 hover:text-sky-300 hover:border-sky-700 whitespace-nowrap backdrop-blur-sm"
+            >
+              <div className="flex items-center gap-2">
+                <MessageCircle className="w-3 h-3" />
+                <span>TELEGRAM_BOT</span>
+              </div>
+            </button>
+
             <button
               onClick={() => setShowCreateModal(true)}
               disabled={configuredModels.length === 0 || configuredExchanges.length === 0}
@@ -1379,6 +1438,14 @@ export function AITradersPage({ onTraderSelect }: AITradersPageProps) {
             language={language}
           />
         )}
+
+        {/* Telegram Bot Modal */}
+        {showTelegramModal && (
+          <TelegramConfigModal
+            onClose={() => setShowTelegramModal(false)}
+            language={language}
+          />
+        )}
       </div>
     </DeepVoidBackground>
   )
@@ -1478,7 +1545,7 @@ function ModelCard({
 }
 
 // Model Configuration Modal Component
-function ModelConfigModal({
+export function ModelConfigModal({
   allModels,
   configuredModels,
   editingModelId,
@@ -1506,9 +1573,11 @@ function ModelConfigModal({
   const [baseUrl, setBaseUrl] = useState('')
   const [modelName, setModelName] = useState('')
 
-  const selectedModel = editingModelId
-    ? configuredModels?.find((m) => m.id === selectedModelId)
-    : allModels?.find((m) => m.id === selectedModelId)
+  // Always prefer allModels (supportedModels) for provider/id lookup;
+  // fall back to configuredModels for edit mode details (apiKey etc.)
+  const selectedModel =
+    allModels?.find((m) => m.id === selectedModelId) ||
+    configuredModels?.find((m) => m.id === selectedModelId)
 
   useEffect(() => {
     if (editingModelId && selectedModel) {
@@ -1594,8 +1663,53 @@ function ModelConfigModal({
               <div className="text-sm font-semibold" style={{ color: '#EAECEF' }}>
                 {language === 'zh' ? '选择 AI 模型提供商' : 'Choose Your AI Provider'}
               </div>
+
+              {/* Claw402 Featured Card — always first, always prominent */}
+              {availableModels.some(m => m.provider === 'claw402') && (
+                <button
+                  type="button"
+                  onClick={() => {
+                    const claw = availableModels.find(m => m.provider === 'claw402')
+                    if (claw) handleSelectModel(claw.id)
+                  }}
+                  className="w-full p-5 rounded-xl text-left transition-all hover:scale-[1.01]"
+                  style={{ background: 'linear-gradient(135deg, rgba(37, 99, 235, 0.15) 0%, rgba(139, 92, 246, 0.15) 100%)', border: '1.5px solid rgba(37, 99, 235, 0.4)' }}
+                >
+                  <div className="flex items-center justify-between">
+                    <div className="flex items-center gap-3">
+                      <div className="w-10 h-10 rounded-xl flex items-center justify-center overflow-hidden">
+                        <img src="/icons/claw402.png" alt="Claw402" width={40} height={40} />
+                      </div>
+                      <div>
+                        <div className="font-bold text-base" style={{ color: '#EAECEF' }}>
+                          Claw402
+                        </div>
+                        <div className="text-xs mt-0.5" style={{ color: '#A0AEC0' }}>
+                          {language === 'zh'
+                            ? 'USDC 按次付费 · 支持全部 AI 模型 · 无需 API Key'
+                            : 'Pay-per-call USDC · All AI Models · No API Key'}
+                        </div>
+                      </div>
+                    </div>
+                    <div className="flex items-center gap-2">
+                      {configuredIds.has(availableModels.find(m => m.provider === 'claw402')?.id || '') && (
+                        <div className="w-2 h-2 rounded-full" style={{ background: '#00E096' }} />
+                      )}
+                      <div className="px-3 py-1.5 rounded-full text-xs font-bold" style={{ background: 'linear-gradient(135deg, #2563EB, #7C3AED)', color: '#fff' }}>
+                        {language === 'zh' ? '🔥 推荐' : '🔥 Best'}
+                      </div>
+                    </div>
+                  </div>
+                  <div className="flex items-center gap-3 mt-3 ml-[52px]">
+                    <span className="text-[11px] px-2 py-0.5 rounded-full" style={{ background: 'rgba(0, 224, 150, 0.1)', color: '#00E096', border: '1px solid rgba(0, 224, 150, 0.2)' }}>
+                      GPT · Claude · DeepSeek · Gemini · Grok · Qwen · Kimi
+                    </span>
+                  </div>
+                </button>
+              )}
+
               <div className="grid grid-cols-3 sm:grid-cols-4 gap-3">
-                {availableModels.map((model) => (
+                {availableModels.filter(m => !m.provider?.startsWith('blockrun') && m.provider !== 'claw402').map((model) => (
                   <ModelCard
                     key={model.id}
                     model={model}
@@ -1605,14 +1719,197 @@ function ModelConfigModal({
                   />
                 ))}
               </div>
+              {availableModels.some(m => m.provider?.startsWith('blockrun')) && (
+                <>
+                  <div className="flex items-center gap-3 pt-2">
+                    <div className="flex-1 h-px" style={{ background: '#2B3139' }} />
+                    <span className="text-xs font-medium px-2" style={{ color: '#848E9C' }}>
+                      {language === 'zh' ? '通过钱包支付' : 'Via BlockRun Wallet'}
+                    </span>
+                    <div className="flex-1 h-px" style={{ background: '#2B3139' }} />
+                  </div>
+                  <div className="grid grid-cols-2 gap-3">
+                    {availableModels.filter(m => m.provider?.startsWith('blockrun')).map((model) => (
+                      <ModelCard
+                        key={model.id}
+                        model={model}
+                        selected={selectedModelId === model.id}
+                        onClick={() => handleSelectModel(model.id)}
+                        configured={configuredIds.has(model.id)}
+                      />
+                    ))}
+                  </div>
+                </>
+              )}
               <div className="text-xs text-center pt-2" style={{ color: '#848E9C' }}>
                 {language === 'zh' ? '带金色标记的模型已配置' : 'Models with gold badge are already configured'}
               </div>
             </div>
           )}
 
-          {/* Step 1: Configure */}
-          {(currentStep === 1 || editingModelId) && selectedModel && (
+          {/* Step 1: Configure — Claw402 Dedicated UI */}
+          {(currentStep === 1 || editingModelId) && selectedModel && (selectedModel.provider === 'claw402' || selectedModel.id === 'claw402') && (
+            <form onSubmit={handleSubmit} className="space-y-5">
+              {/* Claw402 Hero Header */}
+              <div className="p-5 rounded-xl text-center" style={{ background: 'linear-gradient(135deg, rgba(37, 99, 235, 0.12) 0%, rgba(139, 92, 246, 0.12) 100%)', border: '1px solid rgba(37, 99, 235, 0.3)' }}>
+                <div className="w-14 h-14 mx-auto rounded-2xl flex items-center justify-center mb-3 overflow-hidden">
+                  <img src="/icons/claw402.png" alt="Claw402" width={56} height={56} />
+                </div>
+                <div className="text-lg font-bold" style={{ color: '#EAECEF' }}>
+                  Claw402
+                </div>
+                <div className="text-sm mt-1" style={{ color: '#A0AEC0' }}>
+                  {language === 'zh'
+                    ? '用 USDC 按次付费，支持所有主流 AI 模型'
+                    : 'Pay-per-call with USDC — supports all major AI models'}
+                </div>
+                <div className="flex items-center justify-center gap-3 mt-3 flex-wrap">
+                  {['GPT', 'Claude', 'DeepSeek', 'Gemini', 'Grok', 'Qwen', 'Kimi'].map(name => (
+                    <span key={name} className="text-[11px] px-2 py-0.5 rounded-full" style={{ background: 'rgba(255,255,255,0.06)', color: '#A0AEC0' }}>
+                      {name}
+                    </span>
+                  ))}
+                </div>
+              </div>
+
+              {/* Step 1: Select AI Model */}
+              <div className="space-y-3">
+                <label className="flex items-center gap-2 text-sm font-semibold" style={{ color: '#EAECEF' }}>
+                  <Brain className="w-4 h-4" style={{ color: '#2563EB' }} />
+                  {language === 'zh' ? '① 选择 AI 模型' : '① Choose AI Model'}
+                </label>
+                <div className="text-xs mb-2" style={{ color: '#848E9C' }}>
+                  {language === 'zh'
+                    ? '所有模型通过 Claw402 统一调用，创建后可随时切换'
+                    : 'All models unified via Claw402. Switch anytime after setup.'}
+                </div>
+                <div className="grid grid-cols-2 sm:grid-cols-3 gap-2">
+                  {CLAW402_MODELS.map((m) => {
+                    const isSelected = (modelName || 'deepseek') === m.id
+                    return (
+                      <button
+                        key={m.id}
+                        type="button"
+                        onClick={() => setModelName(m.id)}
+                        className="flex items-start gap-2 px-3 py-2.5 rounded-xl text-left transition-all hover:scale-[1.02]"
+                        style={{
+                          background: isSelected ? 'rgba(37, 99, 235, 0.2)' : '#0B0E11',
+                          border: isSelected ? '1.5px solid #2563EB' : '1px solid #2B3139',
+                        }}
+                      >
+                        <span className="text-base mt-0.5">{m.icon}</span>
+                        <div className="flex-1 min-w-0">
+                          <div className="text-xs font-semibold truncate" style={{ color: isSelected ? '#60A5FA' : '#EAECEF' }}>
+                            {m.name}
+                          </div>
+                          <div className="text-[10px] truncate" style={{ color: '#848E9C' }}>
+                            {m.provider} · {m.desc}
+                          </div>
+                        </div>
+                        {isSelected && (
+                          <span className="text-[10px] mt-1" style={{ color: '#60A5FA' }}>✓</span>
+                        )}
+                      </button>
+                    )
+                  })}
+                </div>
+              </div>
+
+              {/* Step 2: Wallet Setup */}
+              <div className="space-y-3">
+                <label className="flex items-center gap-2 text-sm font-semibold" style={{ color: '#EAECEF' }}>
+                  <svg className="w-4 h-4" style={{ color: '#2563EB' }} fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M3 10h18M7 15h1m4 0h1m-7 4h12a3 3 0 003-3V8a3 3 0 00-3-3H6a3 3 0 00-3 3v8a3 3 0 003 3z" />
+                  </svg>
+                  {language === 'zh' ? '② 设置钱包' : '② Setup Wallet'}
+                </label>
+
+                <div className="p-3 rounded-xl" style={{ background: 'rgba(37, 99, 235, 0.06)', border: '1px solid rgba(37, 99, 235, 0.15)' }}>
+                  <div className="text-xs mb-2" style={{ color: '#A0AEC0' }}>
+                    {language === 'zh'
+                      ? '💡 Claw402 使用 Base 链上的 USDC 付费，你需要一个 EVM 钱包'
+                      : '💡 Claw402 uses USDC on Base chain. You need an EVM wallet.'}
+                  </div>
+                  <div className="text-xs space-y-1" style={{ color: '#848E9C' }}>
+                    <div className="flex items-center gap-1.5">
+                      <span style={{ color: '#00E096' }}>•</span>
+                      {language === 'zh'
+                        ? '可以用 MetaMask、Rabby 等钱包导出私钥'
+                        : 'Export private key from MetaMask, Rabby, etc.'}
+                    </div>
+                    <div className="flex items-center gap-1.5">
+                      <span style={{ color: '#00E096' }}>•</span>
+                      {language === 'zh'
+                        ? '建议新建一个专用钱包，充入少量 USDC 即可'
+                        : 'Recommended: create a dedicated wallet with a small USDC balance'}
+                    </div>
+                  </div>
+                </div>
+
+                <div className="space-y-1.5">
+                  <div className="text-xs font-medium" style={{ color: '#A0AEC0' }}>
+                    {language === 'zh' ? '钱包私钥（Base 链 EVM）' : 'Wallet Private Key (Base Chain EVM)'}
+                  </div>
+                  <input
+                    type="password"
+                    value={apiKey}
+                    onChange={(e) => setApiKey(e.target.value)}
+                    placeholder="0x..."
+                    className="w-full px-4 py-3 rounded-xl font-mono text-sm"
+                    style={{ background: '#0B0E11', border: '1px solid #2B3139', color: '#EAECEF' }}
+                    required
+                  />
+                  <div className="flex items-start gap-1.5 text-[11px]" style={{ color: '#848E9C' }}>
+                    <span className="mt-px">🔒</span>
+                    <span>
+                      {language === 'zh'
+                        ? '私钥仅在本地签名使用，不会上传或发送交易。无需 ETH，无 Gas 费用。'
+                        : 'Private key is only used locally for signing. Never uploaded. No ETH or gas needed.'}
+                    </span>
+                  </div>
+                </div>
+              </div>
+
+              {/* USDC Recharge Guide */}
+              <div className="p-4 rounded-xl" style={{ background: 'rgba(0, 224, 150, 0.05)', border: '1px solid rgba(0, 224, 150, 0.15)' }}>
+                <div className="text-sm font-semibold mb-2 flex items-center gap-2" style={{ color: '#00E096' }}>
+                  💰 {language === 'zh' ? '如何充值 USDC' : 'How to Fund USDC'}
+                </div>
+                <div className="text-xs space-y-1.5" style={{ color: '#848E9C' }}>
+                  <div className="flex items-start gap-2">
+                    <span className="font-bold" style={{ color: '#A0AEC0' }}>1.</span>
+                    <span>{language === 'zh' ? '从交易所（Binance / OKX / Coinbase）提 USDC 到你的钱包地址' : 'Withdraw USDC from exchange (Binance/OKX/Coinbase) to your wallet'}</span>
+                  </div>
+                  <div className="flex items-start gap-2">
+                    <span className="font-bold" style={{ color: '#A0AEC0' }}>2.</span>
+                    <span>{language === 'zh' ? '选择 Base 网络（手续费极低）' : 'Select Base network (very low fees)'}</span>
+                  </div>
+                  <div className="flex items-start gap-2">
+                    <span className="font-bold" style={{ color: '#A0AEC0' }}>3.</span>
+                    <span>{language === 'zh' ? '充入 $5-10 USDC 即可使用很长时间（约 $0.003/次调用）' : '$5-10 USDC lasts a long time (~$0.003/call)'}</span>
+                  </div>
+                </div>
+              </div>
+
+              {/* Buttons */}
+              <div className="flex gap-3 pt-2">
+                <button type="button" onClick={handleBack} className="flex-1 px-4 py-3 rounded-xl text-sm font-semibold transition-all hover:bg-white/5" style={{ background: '#2B3139', color: '#848E9C' }}>
+                  {editingModelId ? t('cancel', language) : (language === 'zh' ? '返回' : 'Back')}
+                </button>
+                <button
+                  type="submit"
+                  disabled={!apiKey.trim()}
+                  className="flex-1 flex items-center justify-center gap-2 px-4 py-3 rounded-xl text-sm font-bold transition-all hover:scale-[1.02] disabled:opacity-50 disabled:cursor-not-allowed"
+                  style={{ background: apiKey.trim() ? 'linear-gradient(135deg, #2563EB, #7C3AED)' : '#2B3139', color: '#fff' }}
+                >
+                  {language === 'zh' ? '🚀 开始交易' : '🚀 Start Trading'}
+                </button>
+              </div>
+            </form>
+          )}
+
+          {/* Step 1: Configure — Standard Providers (non-claw402) */}
+          {(currentStep === 1 || editingModelId) && selectedModel && selectedModel.provider !== 'claw402' && selectedModel.id !== 'claw402' && (
             <form onSubmit={handleSubmit} className="space-y-5">
               {/* Selected Model Header */}
               <div className="p-4 rounded-xl flex items-center gap-4" style={{ background: '#0B0E11', border: '1px solid #2B3139' }}>
@@ -1639,7 +1936,9 @@ function ModelConfigModal({
                   >
                     <ExternalLink className="w-4 h-4" style={{ color: '#A78BFA' }} />
                     <span className="text-sm font-medium" style={{ color: '#A78BFA' }}>
-                      {language === 'zh' ? '获取 API Key' : 'Get API Key'}
+                      {selectedModel.provider?.startsWith('blockrun')
+                        ? (language === 'zh' ? '开始使用' : 'Get Started')
+                        : (language === 'zh' ? '获取 API Key' : 'Get API Key')}
                     </span>
                   </a>
                 )}
@@ -1657,66 +1956,112 @@ function ModelConfigModal({
                 </div>
               )}
 
-              {/* API Key */}
+              {/* API Key / Wallet Private Key */}
               <div className="space-y-2">
                 <label className="flex items-center gap-2 text-sm font-semibold" style={{ color: '#EAECEF' }}>
                   <svg className="w-4 h-4" style={{ color: '#A78BFA' }} fill="none" stroke="currentColor" viewBox="0 0 24 24">
                     <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z" />
                   </svg>
-                  API Key *
+                  {selectedModel.provider?.startsWith('blockrun')
+                    ? (language === 'zh' ? '钱包私钥 *' : 'Wallet Private Key *')
+                    : 'API Key *'}
                 </label>
                 <input
                   type="password"
                   value={apiKey}
                   onChange={(e) => setApiKey(e.target.value)}
-                  placeholder={t('enterAPIKey', language)}
+                  placeholder={
+                    selectedModel.provider === 'blockrun-base'
+                      ? '0x... (EVM private key)'
+                      : selectedModel.provider === 'blockrun-sol'
+                      ? 'bs58 encoded key (Solana)'
+                      : t('enterAPIKey', language)
+                  }
                   className="w-full px-4 py-3 rounded-xl"
                   style={{ background: '#0B0E11', border: '1px solid #2B3139', color: '#EAECEF' }}
                   required
                 />
               </div>
 
-              {/* Custom Base URL */}
-              <div className="space-y-2">
-                <label className="flex items-center gap-2 text-sm font-semibold" style={{ color: '#EAECEF' }}>
-                  <svg className="w-4 h-4" style={{ color: '#A78BFA' }} fill="none" stroke="currentColor" viewBox="0 0 24 24">
-                    <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M13.828 10.172a4 4 0 00-5.656 0l-4 4a4 4 0 105.656 5.656l1.102-1.101m-.758-4.899a4 4 0 005.656 0l4-4a4 4 0 00-5.656-5.656l-1.1 1.1" />
-                  </svg>
-                  {t('customBaseURL', language)}
-                </label>
-                <input
-                  type="url"
-                  value={baseUrl}
-                  onChange={(e) => setBaseUrl(e.target.value)}
-                  placeholder={t('customBaseURLPlaceholder', language)}
-                  className="w-full px-4 py-3 rounded-xl"
-                  style={{ background: '#0B0E11', border: '1px solid #2B3139', color: '#EAECEF' }}
-                />
-                <div className="text-xs" style={{ color: '#848E9C' }}>
-                  {t('leaveBlankForDefault', language)}
+              {/* Custom Base URL (hidden for BlockRun) */}
+              {!selectedModel.provider?.startsWith('blockrun') && (
+                <div className="space-y-2">
+                  <label className="flex items-center gap-2 text-sm font-semibold" style={{ color: '#EAECEF' }}>
+                    <svg className="w-4 h-4" style={{ color: '#A78BFA' }} fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                      <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M13.828 10.172a4 4 0 00-5.656 0l-4 4a4 4 0 105.656 5.656l1.102-1.101m-.758-4.899a4 4 0 005.656 0l4-4a4 4 0 00-5.656-5.656l-1.1 1.1" />
+                    </svg>
+                    {t('customBaseURL', language)}
+                  </label>
+                  <input
+                    type="url"
+                    value={baseUrl}
+                    onChange={(e) => setBaseUrl(e.target.value)}
+                    placeholder={t('customBaseURLPlaceholder', language)}
+                    className="w-full px-4 py-3 rounded-xl"
+                    style={{ background: '#0B0E11', border: '1px solid #2B3139', color: '#EAECEF' }}
+                  />
+                  <div className="text-xs" style={{ color: '#848E9C' }}>
+                    {t('leaveBlankForDefault', language)}
+                  </div>
                 </div>
-              </div>
+              )}
 
-              {/* Custom Model Name */}
-              <div className="space-y-2">
-                <label className="flex items-center gap-2 text-sm font-semibold" style={{ color: '#EAECEF' }}>
-                  <svg className="w-4 h-4" style={{ color: '#A78BFA' }} fill="none" stroke="currentColor" viewBox="0 0 24 24">
-                    <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M7 7h.01M7 3h5c.512 0 1.024.195 1.414.586l7 7a2 2 0 010 2.828l-7 7a2 2 0 01-2.828 0l-7-7A1.994 1.994 0 013 12V7a4 4 0 014-4z" />
-                  </svg>
-                  {t('customModelName', language)}
-                </label>
-                <input
-                  type="text"
-                  value={modelName}
-                  onChange={(e) => setModelName(e.target.value)}
-                  placeholder={t('customModelNamePlaceholder', language)}
-                  className="w-full px-4 py-3 rounded-xl"
-                  style={{ background: '#0B0E11', border: '1px solid #2B3139', color: '#EAECEF' }}
-                />
-                <div className="text-xs" style={{ color: '#848E9C' }}>
-                  {t('leaveBlankForDefaultModel', language)}
+              {/* Custom Model Name (hidden for BlockRun) */}
+              {!selectedModel.provider?.startsWith('blockrun') && (
+                <div className="space-y-2">
+                  <label className="flex items-center gap-2 text-sm font-semibold" style={{ color: '#EAECEF' }}>
+                    <svg className="w-4 h-4" style={{ color: '#A78BFA' }} fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                      <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M7 7h.01M7 3h5c.512 0 1.024.195 1.414.586l7 7a2 2 0 010 2.828l-7 7a2 2 0 01-2.828 0l-7-7A1.994 1.994 0 013 12V7a4 4 0 014-4z" />
+                    </svg>
+                    {t('customModelName', language)}
+                  </label>
+                  <input
+                    type="text"
+                    value={modelName}
+                    onChange={(e) => setModelName(e.target.value)}
+                    placeholder={t('customModelNamePlaceholder', language)}
+                    className="w-full px-4 py-3 rounded-xl"
+                    style={{ background: '#0B0E11', border: '1px solid #2B3139', color: '#EAECEF' }}
+                  />
+                  <div className="text-xs" style={{ color: '#848E9C' }}>
+                    {t('leaveBlankForDefaultModel', language)}
+                  </div>
                 </div>
-              </div>
+              )}
+
+              {/* BlockRun Model Selector */}
+              {selectedModel.provider?.startsWith('blockrun') && (
+                <div className="space-y-2">
+                  <label className="flex items-center gap-2 text-sm font-semibold" style={{ color: '#EAECEF' }}>
+                    <svg className="w-4 h-4" style={{ color: '#A78BFA' }} fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                      <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M9.75 17L9 20l-1 1h8l-1-1-.75-3M3 13h18M5 17h14a2 2 0 002-2V5a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z" />
+                    </svg>
+                    {language === 'zh' ? '选择模型' : 'Select Model'}
+                  </label>
+                  <div className="grid grid-cols-2 gap-2">
+                    {BLOCKRUN_MODELS.map((m) => {
+                      const isSelected = (modelName || BLOCKRUN_MODELS[0].id) === m.id
+                      return (
+                        <button
+                          key={m.id}
+                          type="button"
+                          onClick={() => setModelName(m.id)}
+                          className="flex flex-col items-start px-3 py-2 rounded-xl text-left transition-all"
+                          style={{
+                            background: isSelected ? 'rgba(37, 99, 235, 0.2)' : '#0B0E11',
+                            border: isSelected ? '1px solid #2563EB' : '1px solid #2B3139',
+                          }}
+                        >
+                          <span className="text-xs font-semibold" style={{ color: isSelected ? '#60A5FA' : '#EAECEF' }}>
+                            {m.name}
+                          </span>
+                          <span className="text-[10px]" style={{ color: '#848E9C' }}>{m.desc}</span>
+                        </button>
+                      )
+                    })}
+                  </div>
+                </div>
+              )}
 
               {/* Info Box */}
               <div className="p-4 rounded-xl" style={{ background: 'rgba(139, 92, 246, 0.1)', border: '1px solid rgba(139, 92, 246, 0.2)' }}>

web/src/components/EquityChart.tsx

@@ -142,7 +142,7 @@ export function EquityChart({ traderId, embedded = false }: EquityChartProps) {
     1000 // 默认值（与创建交易员时的默认配置一致）
 
   // 转换数据格式
-  const chartData = displayHistory.map((point) => {
+  const chartData = displayHistory.map((point, index) => {
     const pnl = point.total_equity - initialBalance
     const pnlPct = ((pnl / initialBalance) * 100).toFixed(2)
     return {
@@ -151,7 +151,7 @@ export function EquityChart({ traderId, embedded = false }: EquityChartProps) {
         minute: '2-digit',
       }),
       value: displayMode === 'dollar' ? point.total_equity : parseFloat(pnlPct),
-      cycle: point.cycle_number,
+      cycle: point.cycle_number ?? index + 1,
       raw_equity: point.total_equity,
       raw_pnl: pnl,
       raw_pnl_pct: parseFloat(pnlPct),
@@ -192,7 +192,7 @@ export function EquityChart({ traderId, embedded = false }: EquityChartProps) {
           style={{ background: '#1E2329', border: '1px solid #2B3139' }}
         >
           <div className="text-xs mb-1" style={{ color: '#848E9C' }}>
-            Cycle #{data.cycle}
+            Cycle #{data.cycle != null ? data.cycle : '—'}
           </div>
           <div className="font-bold mono" style={{ color: '#EAECEF' }}>
             {data.raw_equity.toFixed(2)} USDT

web/src/components/ExchangeIcons.tsx

@@ -17,6 +17,7 @@ const ICON_PATHS: Record<string, string> = {
   hyperliquid: '/exchange-icons/hyperliquid.png',
   aster: '/exchange-icons/aster.svg',
   lighter: '/exchange-icons/lighter.png',
+  indodax: '/exchange-icons/indodax.png',
 }
 
 // 通用图标组件
@@ -101,7 +102,9 @@ export const getExchangeIcon = (
                   ? 'aster'
                   : lowerType.includes('lighter')
                     ? 'lighter'
-                    : lowerType
+                    : lowerType.includes('indodax')
+                      ? 'indodax'
+                      : lowerType
 
   const iconProps = {
     width: props.width || 24,

web/src/components/Header.tsx

@@ -57,6 +57,17 @@ export function Header({ simple = false }: HeaderProps) {
             >
               EN
             </button>
+            <button
+              onClick={() => setLanguage('id')}
+              className="px-3 py-1.5 rounded text-xs font-semibold transition-all"
+              style={
+                language === 'id'
+                  ? { background: '#F0B90B', color: '#000' }
+                  : { background: 'transparent', color: '#848E9C' }
+              }
+            >
+              ID
+            </button>
           </div>
         </div>
       </Container>

web/src/components/HeaderBar.tsx

@@ -1,9 +1,8 @@
 import { useState, useEffect, useRef } from 'react'
 import { useNavigate } from 'react-router-dom'
 import { motion, AnimatePresence } from 'framer-motion'
-import { Menu, X, ChevronDown } from 'lucide-react'
+import { Menu, X, ChevronDown, Settings } from 'lucide-react'
 import { t, type Language } from '../i18n/translations'
-import { useSystemConfig } from '../hooks/useSystemConfig'
 import { OFFICIAL_LINKS } from '../constants/branding'
 
 type Page =
@@ -49,9 +48,6 @@ export default function HeaderBar({
   const [userDropdownOpen, setUserDropdownOpen] = useState(false)
   const dropdownRef = useRef<HTMLDivElement>(null)
   const userDropdownRef = useRef<HTMLDivElement>(null)
-  const { config: systemConfig } = useSystemConfig()
-  const registrationEnabled = systemConfig?.registration_enabled !== false
-
   // Close dropdown when clicking outside
   useEffect(() => {
     function handleClickOutside(event: MouseEvent) {
@@ -99,8 +95,8 @@ export default function HeaderBar({
             {(() => {
               // Define all navigation tabs
               const navTabs: { page: Page; path: string; label: string; requiresAuth: boolean }[] = [
-                { page: 'data', path: '/data', label: language === 'zh' ? '数据' : 'Data', requiresAuth: false },
-                { page: 'strategy-market', path: '/strategy-market', label: language === 'zh' ? '策略市场' : 'Market', requiresAuth: true },
+                { page: 'data', path: '/data', label: language === 'zh' ? '数据' : language === 'id' ? 'Data' : 'Data', requiresAuth: false },
+                { page: 'strategy-market', path: '/strategy-market', label: language === 'zh' ? '策略市场' : language === 'id' ? 'Pasar' : 'Market', requiresAuth: true },
                 { page: 'traders', path: '/traders', label: t('configNav', language), requiresAuth: true },
                 { page: 'trader', path: '/dashboard', label: t('dashboardNav', language), requiresAuth: true },
                 { page: 'strategy', path: '/strategy', label: t('strategyNav', language), requiresAuth: true },
@@ -214,6 +210,16 @@ export default function HeaderBar({
                           {user.email}
                         </div>
                       </div>
+                      <button
+                        onClick={() => {
+                          window.location.href = '/settings'
+                          setUserDropdownOpen(false)
+                        }}
+                        className="w-full flex items-center gap-2 px-3 py-2 text-sm transition-colors hover:bg-white/5 text-nofx-text-muted hover:text-white"
+                      >
+                        <Settings className="w-3.5 h-3.5" />
+                        Settings
+                      </button>
                       {onLogout && (
                         <button
                           onClick={() => {
@@ -240,14 +246,6 @@ export default function HeaderBar({
                   >
                     {t('signIn', language)}
                   </a>
-                  {registrationEnabled && (
-                    <a
-                      href="/register"
-                      className="px-4 py-2 rounded font-semibold text-sm transition-colors hover:opacity-90 bg-nofx-gold text-black"
-                    >
-                      {t('signUp', language)}
-                    </a>
-                  )}
                 </div>
               )
             )}
@@ -259,7 +257,7 @@ export default function HeaderBar({
                 className="flex items-center gap-2 px-3 py-2 rounded transition-colors text-nofx-text-muted hover:bg-white/5"
               >
                 <span className="text-lg">
-                  {language === 'zh' ? '🇨🇳' : '🇺🇸'}
+                  {language === 'zh' ? '🇨🇳' : language === 'id' ? '🇮🇩' : '🇺🇸'}
                 </span>
                 <ChevronDown className="w-4 h-4" />
               </button>
@@ -288,6 +286,17 @@ export default function HeaderBar({
                     <span className="text-base">🇺🇸</span>
                     <span className="text-sm">English</span>
                   </button>
+                  <button
+                    onClick={() => {
+                      onLanguageChange?.('id')
+                      setLanguageDropdownOpen(false)
+                    }}
+                    className={`w-full flex items-center gap-2 px-3 py-2 transition-colors text-nofx-text-muted hover:text-white
+                      ${language === 'id' ? 'bg-nofx-gold/10' : 'hover:bg-white/5'}`}
+                  >
+                    <span className="text-base">🇮🇩</span>
+                    <span className="text-sm">Bahasa</span>
+                  </button>
                 </div>
               )}
             </div>
@@ -329,8 +338,8 @@ export default function HeaderBar({
               <div className="flex flex-col gap-6 mb-12">
                 {(() => {
                   const navTabs: { page: Page; path: string; label: string; requiresAuth: boolean }[] = [
-                    { page: 'data', path: '/data', label: language === 'zh' ? '数据' : 'Data', requiresAuth: false },
-                    { page: 'strategy-market', path: '/strategy-market', label: language === 'zh' ? '策略市场' : 'Market', requiresAuth: true },
+                    { page: 'data', path: '/data', label: language === 'zh' ? '数据' : language === 'id' ? 'Data' : 'Data', requiresAuth: false },
+                    { page: 'strategy-market', path: '/strategy-market', label: language === 'zh' ? '策略市场' : language === 'id' ? 'Pasar' : 'Market', requiresAuth: true },
                     { page: 'traders', path: '/traders', label: t('configNav', language), requiresAuth: true },
                     { page: 'trader', path: '/dashboard', label: t('dashboardNav', language), requiresAuth: true },
                     { page: 'strategy', path: '/strategy', label: t('strategyNav', language), requiresAuth: true },
@@ -429,7 +438,7 @@ export default function HeaderBar({
                 <div className="grid grid-cols-2 gap-4">
                   {/* Lang Switcher */}
                   <div className="flex bg-zinc-900 rounded-lg p-1 border border-zinc-800">
-                    {['zh', 'en'].map((lang) => (
+                    {['zh', 'en', 'id'].map((lang) => (
                       <button
                         key={lang}
                         onClick={() => {
@@ -441,7 +450,7 @@ export default function HeaderBar({
                           : 'text-zinc-500'
                           }`}
                       >
-                        {lang === 'zh' ? 'CN' : 'EN'}
+                        {lang === 'zh' ? 'CN' : lang === 'id' ? 'ID' : 'EN'}
                       </button>
                     ))}
                   </div>

web/src/components/LoginPage.tsx

@@ -1,459 +1,133 @@
 import React, { useState, useEffect } from 'react'
+import { Eye, EyeOff } from 'lucide-react'
+import { toast } from 'sonner'
 import { useAuth } from '../contexts/AuthContext'
 import { useLanguage } from '../contexts/LanguageContext'
 import { t } from '../i18n/translations'
-import { Eye, EyeOff } from 'lucide-react'
 import { DeepVoidBackground } from './DeepVoidBackground'
-// import { Input } from './ui/input' // Removed unused import
-import { toast } from 'sonner'
-import { useSystemConfig } from '../hooks/useSystemConfig'
 
 export function LoginPage() {
   const { language } = useLanguage()
-  const { login, loginAdmin, verifyOTP, completeRegistration } = useAuth()
-  const [step, setStep] = useState<'login' | 'otp' | 'setup-otp'>('login')
+  const { login } = useAuth()
   const [email, setEmail] = useState('')
   const [password, setPassword] = useState('')
   const [showPassword, setShowPassword] = useState(false)
-  const [otpCode, setOtpCode] = useState('')
-  const [userID, setUserID] = useState('')
-  const [qrCodeURL, setQrCodeURL] = useState('') // New state for recovery
-  const [otpSecret, setOtpSecret] = useState('') // New state for recovery
   const [error, setError] = useState('')
   const [loading, setLoading] = useState(false)
-  const [adminPassword, setAdminPassword] = useState('')
-  const adminMode = false
-  const { config: systemConfig } = useSystemConfig()
-  const registrationEnabled = systemConfig?.registration_enabled !== false
   const [expiredToastId, setExpiredToastId] = useState<string | number | null>(null)
 
-  // Show notification if user was redirected here due to 401
   useEffect(() => {
     if (sessionStorage.getItem('from401') === 'true') {
-      const id = toast.warning(t('sessionExpired', language), {
-        duration: Infinity // Keep showing until user dismisses or logs in
-      })
+      const id = toast.warning(t('sessionExpired', language), { duration: Infinity })
       setExpiredToastId(id)
       sessionStorage.removeItem('from401')
     }
   }, [language])
 
-  const handleAdminLogin = async (e: React.FormEvent) => {
-    e.preventDefault()
-    setError('')
-    setLoading(true)
-    const result = await loginAdmin(adminPassword)
-    if (!result.success) {
-      const msg = result.message || t('loginFailed', language)
-      setError(msg)
-      toast.error(msg)
-    } else {
-      // Dismiss the "login expired" toast on successful login
-      if (expiredToastId) {
-        toast.dismiss(expiredToastId)
-      }
-    }
-    setLoading(false)
-  }
-
   const handleLogin = async (e: React.FormEvent) => {
     e.preventDefault()
     setError('')
     setLoading(true)
-
     const result = await login(email, password)
-
-    if (result.success) {
-      // Check for incomplete OTP setup (user registered but didn't complete 2FA)
-      if (result.requiresOTPSetup && result.userID) {
-        setUserID(result.userID)
-        setQrCodeURL(result.qrCodeURL || '')
-        setOtpSecret(result.otpSecret || '')
-        setStep('setup-otp')
-        toast.info("Pending 2FA setup detected. Please complete configuration.")
-      } else if (result.requiresOTP && result.userID) {
-        setUserID(result.userID)
-
-        // Check if backend provided recovery data (meaning 2FA is pending setup)
-        if (result.qrCodeURL) {
-          setQrCodeURL(result.qrCodeURL)
-          setOtpSecret(result.otpSecret || '')
-          setStep('setup-otp')
-          toast.info("Pending 2FA setup detected. Please complete configuration.")
-        } else {
-          setStep('otp')
-        }
-      } else {
-        // Dismiss the "login expired" toast on successful login (no OTP required)
-        if (expiredToastId) {
-          toast.dismiss(expiredToastId)
-        }
-      }
-    } else {
-      // Check if we have recovery data despite the error (e.g. "Account has not completed OTP setup")
-      if (result.qrCodeURL) {
-        setUserID(result.userID || '') // We might need to ensure userID is returned in error case too, or derived
-        setQrCodeURL(result.qrCodeURL)
-        setOtpSecret(result.otpSecret || '')
-        setStep('setup-otp')
-        toast.warning(t('completeGapSetup', language) || "Incomplete setup detected. Please configure 2FA.")
-      } else {
-        const msg = result.message || t('loginFailed', language)
-        setError(msg)
-        toast.error(msg)
-      }
-    }
-
     setLoading(false)
-  }
-
-  const handleOTPVerify = async (e: React.FormEvent) => {
-    e.preventDefault()
-    setError('')
-    setLoading(true)
-
-    // If we have qrCodeURL, it means user needs to complete registration (first time OTP setup)
-    // Otherwise, it's a normal login OTP verification
-    const result = qrCodeURL
-      ? await completeRegistration(userID, otpCode)
-      : await verifyOTP(userID, otpCode)
-
-    if (!result.success) {
-      const msg = result.message || t('verificationFailed', language)
+    if (result.success) {
+      if (expiredToastId) toast.dismiss(expiredToastId)
+    } else {
+      const msg = result.message || t('loginFailed', language)
       setError(msg)
       toast.error(msg)
-    } else {
-      // Dismiss the "login expired" toast on successful OTP verification
-      if (expiredToastId) {
-        toast.dismiss(expiredToastId)
-      }
-      // Clear qrCodeURL after successful completion
-      setQrCodeURL('')
-      setOtpSecret('')
     }
-    // 成功的话AuthContext会自动处理登录状态
-
-    setLoading(false)
-  }
-
-  const copyToClipboard = (text: string) => {
-    navigator.clipboard.writeText(text)
-    toast.success('Copied to clipboard')
   }
 
   return (
-    <DeepVoidBackground className="min-h-screen flex items-center justify-center py-12 font-mono" disableAnimation>
+    <DeepVoidBackground disableAnimation>
+      <div className="flex-1 flex items-center justify-center px-4 py-16">
+        <div className="w-full max-w-sm">
 
-      <div className="w-full max-w-md relative z-10 px-6">
-        {/* Navigation - Top Bar (Mobile/Desktop Friendly) */}
-        <div className="flex justify-between items-center mb-8">
-          <button
-            onClick={() => window.location.href = '/'}
-            className="flex items-center gap-2 text-zinc-500 hover:text-white transition-colors group px-3 py-1.5 rounded border border-transparent hover:border-zinc-700 bg-black/20 backdrop-blur-sm"
-          >
-            <div className="w-2 h-2 rounded-full bg-red-500 group-hover:animate-pulse"></div>
-            <span className="text-xs font-mono uppercase tracking-widest">&lt; CANCEL_LOGIN</span>
-          </button>
-        </div>
-
-        {/* Terminal Header */}
-        <div className="mb-8 text-center">
-          <div className="flex justify-center mb-6">
-            <div className="relative">
-              <div className="absolute -inset-2 bg-nofx-gold/20 rounded-full blur-xl animate-pulse"></div>
-              <img
-                src="/icons/nofx.svg"
-                alt="NoFx Logo"
-                className="w-16 h-16 object-contain relative z-10 opacity-90"
-              />
-            </div>
-          </div>
-          <h1 className="text-3xl font-bold tracking-tighter text-white uppercase mb-2">
-            <span className="text-nofx-gold">SYSTEM</span> ACCESS
-          </h1>
-          <p className="text-zinc-500 text-xs tracking-[0.2em] uppercase">
-            {step === 'login' ? 'Authentication Protocol v3.0' : 'Multi-Factor Verification'}
-          </p>
-        </div>
-
-        {/* Terminal Output / Form Container */}
-        <div className="bg-zinc-900/40 backdrop-blur-md border border-zinc-800 rounded-lg overflow-hidden shadow-2xl relative group">
-          <div className="absolute inset-0 bg-zinc-900/50 opacity-0 group-hover:opacity-100 transition duration-700 pointer-events-none"></div>
-
-          {/* Window Bar */}
-          <div className="flex items-center justify-between px-4 py-2 bg-zinc-900/80 border-b border-zinc-800">
-            <div className="flex gap-1.5">
-              <div
-                className="w-2.5 h-2.5 rounded-full bg-red-500/50 hover:bg-red-500 cursor-pointer transition-colors"
-                onClick={() => window.location.href = '/'}
-                title="Close / Return Home"
-              ></div>
-              <div className="w-2.5 h-2.5 rounded-full bg-yellow-500/50"></div>
-              <div className="w-2.5 h-2.5 rounded-full bg-green-500/50"></div>
-            </div>
-            <div className="text-[10px] text-zinc-600 font-mono flex items-center gap-1">
-              <span className="text-emerald-500">➜</span> login.exe
+          {/* Logo + Title */}
+          <div className="text-center mb-10">
+            <div className="flex justify-center mb-5">
+              <div className="relative">
+                <div className="absolute -inset-3 bg-nofx-gold/15 rounded-full blur-2xl" />
+                <img src="/icons/nofx.svg" alt="NOFX" className="w-14 h-14 relative z-10" />
+              </div>
             </div>
+            <h1 className="text-2xl font-bold text-white mb-1.5">Welcome back</h1>
+            <p className="text-zinc-500 text-sm">Sign in to your account</p>
           </div>
 
-          <div className="p-6 md:p-8 relative">
-            {/* Status Output */}
-            <div className="mb-6 font-mono text-xs space-y-1 text-zinc-500 border-b border-zinc-800/50 pb-4">
-              <div className="flex gap-2">
-                <span className="text-emerald-500">➜</span>
-                <span>Initiating handshake...</span>
+          {/* Card */}
+          <div className="bg-zinc-900/60 backdrop-blur-xl border border-zinc-800/80 rounded-2xl p-8 shadow-2xl">
+            <form onSubmit={handleLogin} className="space-y-5">
+
+              {/* Email */}
+              <div>
+                <label className="block text-xs font-medium text-zinc-400 mb-2">
+                  {t('email', language)}
+                </label>
+                <input
+                  type="email"
+                  value={email}
+                  onChange={(e) => setEmail(e.target.value)}
+                  className="w-full bg-zinc-950/80 border border-zinc-700/80 rounded-xl px-4 py-3 text-sm text-white placeholder-zinc-600 focus:outline-none focus:border-nofx-gold/60 focus:ring-1 focus:ring-nofx-gold/30 transition-all"
+                  placeholder="you@example.com"
+                  required
+                  autoFocus
+                />
               </div>
-              <div className="flex gap-2">
-                <span className="text-emerald-500">➜</span>
-                <span>Target: NOFX CORE HUB</span>
-              </div>
-              <div className="flex gap-2">
-                <span className="text-emerald-500">➜</span>
-                <span>Status: <span className="text-zinc-300">AWAITING CREDENTIALS</span></span>
-              </div>
-            </div>
 
-            {adminMode ? (
-              <form onSubmit={handleAdminLogin} className="space-y-5">
-                <div>
-                  <label className="block text-xs uppercase tracking-wider text-nofx-gold mb-1.5 ml-1">Admin Key</label>
-                  <input
-                    type="password"
-                    value={adminPassword}
-                    onChange={(e) => setAdminPassword(e.target.value)}
-                    className="w-full bg-black/50 border border-zinc-700 rounded px-4 py-3 text-sm focus:border-nofx-gold focus:ring-1 focus:ring-nofx-gold/50 outline-none transition-all placeholder-zinc-700 text-white font-mono"
-                    placeholder="ENTER_ROOT_PASSWORD"
-                    required
-                  />
-                </div>
-
-                {error && (
-                  <div className="text-xs bg-red-500/10 border border-red-500/30 text-red-500 px-3 py-2 rounded font-mono">
-                    [ERROR]: {error}
-                  </div>
-                )}
-
-                <button
-                  type="submit"
-                  disabled={loading}
-                  className="w-full bg-nofx-gold text-black font-bold py-3 px-4 rounded text-sm tracking-wide uppercase hover:bg-yellow-400 transition-all transform active:scale-95 disabled:opacity-50 disabled:cursor-not-allowed font-mono shadow-[0_0_20px_rgba(255,215,0,0.1)] hover:shadow-[0_0_30px_rgba(255,215,0,0.3)]"
-                >
-                  {loading ? '> VERIFYING...' : '> EXECUTE_LOGIN'}
-                </button>
-              </form>
-            ) : step === 'setup-otp' ? (
-              <div className="space-y-6">
-                <div className="text-center bg-zinc-900/50 p-4 rounded border border-zinc-800">
-                  <div className="text-xs font-mono text-zinc-400 mb-2">COMPLETE 2FA CONFIGURATION</div>
-                  {qrCodeURL ? (
-                    <div className="bg-white p-2 rounded inline-block shadow-[0_0_30px_rgba(255,255,255,0.1)]">
-                      <img
-                        src={`https://api.qrserver.com/v1/create-qr-code/?size=150x150&data=${encodeURIComponent(`otpauth://totp/NoFX:${email}?secret=${otpSecret}&issuer=NoFX`)}`}
-                        alt="QR Code"
-                        className="w-32 h-32"
-                      />
-                    </div>
-                  ) : (
-                    <div className="w-32 h-32 bg-zinc-800 animate-pulse rounded inline-block"></div>
-                  )}
-                  <div className="mt-4">
-                    <p className="text-[10px] text-zinc-500 uppercase tracking-widest mb-1">Backup Secret Key</p>
-                    <div className="flex items-center gap-2 justify-center bg-black/50 p-2 rounded border border-zinc-700/50 max-w-[200px] mx-auto">
-                      <code className="text-xs font-mono text-nofx-gold">{otpSecret}</code>
-                      <button
-                        onClick={() => copyToClipboard(otpSecret)}
-                        className="text-zinc-500 hover:text-white transition-colors"
-                      >
-                        <span className="text-[10px] uppercase border border-zinc-700 px-1 rounded">Copy</span>
-                      </button>
-                    </div>
-                  </div>
-                </div>
-
-                <div className="space-y-4 font-mono text-xs text-zinc-400 bg-black/20 p-4 rounded border border-zinc-800/50">
-                  <div className="flex gap-3 items-start">
-                    <span className="text-nofx-gold font-bold mt-0.5">01</span>
-                    <div>
-                      <p className="font-bold text-white mb-1">Install Authenticator App</p>
-                      <p className="mb-2">Recommended: <span className="text-nofx-gold">Google Authenticator</span>.</p>
-                      <div className="flex gap-2">
-                        <span className="px-1.5 py-0.5 bg-zinc-800 rounded text-[10px] text-zinc-300 border border-zinc-700">iOS</span>
-                        <span className="px-1.5 py-0.5 bg-zinc-800 rounded text-[10px] text-zinc-300 border border-zinc-700">Android</span>
-                      </div>
-                    </div>
-                  </div>
-
-                  <div className="w-full h-px bg-zinc-800/50"></div>
-
-                  <div className="flex gap-3 items-start">
-                    <span className="text-nofx-gold font-bold mt-0.5">02</span>
-                    <div>
-                      <p className="font-bold text-white mb-1">Scan & Verify</p>
-                      <p>Scan code above, then enter the 6-digit token below to activate your account.</p>
-                    </div>
-                  </div>
-                </div>
-
-                <button
-                  onClick={() => setStep('otp')}
-                  className="w-full bg-nofx-gold text-black font-bold py-3 px-4 rounded text-sm tracking-wide uppercase hover:bg-yellow-400 transition-colors font-mono shadow-lg"
-                >
-                  I HAVE SCANNED THE CODE →
-                </button>
-              </div>
-            ) : step === 'login' ? (
-              <form onSubmit={handleLogin} className="space-y-5">
-                <div className="space-y-4">
-                  <div>
-                    <label className="block text-xs uppercase tracking-wider text-zinc-500 mb-1.5 ml-1 font-bold">{t('email', language)}</label>
-                    <input
-                      type="email"
-                      value={email}
-                      onChange={(e) => setEmail(e.target.value)}
-                      className="w-full bg-black/50 border border-zinc-700 rounded px-4 py-3 text-sm focus:border-nofx-gold focus:ring-1 focus:ring-nofx-gold/50 outline-none transition-all placeholder-zinc-700 text-white font-mono"
-                      placeholder="user@nofx.os"
-                      required
-                    />
-                  </div>
-
-                  <div>
-                    <div className="flex items-center justify-between mb-1.5 ml-1">
-                      <label className="block text-xs uppercase tracking-wider text-zinc-500 font-bold">{t('password', language)}</label>
-                    </div>
-
-                    <div className="relative">
-                      <input
-                        type={showPassword ? 'text' : 'password'}
-                        value={password}
-                        onChange={(e) => setPassword(e.target.value)}
-                        className="w-full bg-black/50 border border-zinc-700 rounded px-4 py-3 text-sm focus:border-nofx-gold focus:ring-1 focus:ring-nofx-gold/50 outline-none transition-all placeholder-zinc-700 text-white font-mono pr-10"
-                        placeholder="••••••••••••"
-                        required
-                      />
-                      <button
-                        type="button"
-                        onClick={() => setShowPassword(!showPassword)}
-                        className="absolute right-3 top-1/2 -translate-y-1/2 text-zinc-600 hover:text-zinc-400 transition-colors"
-                      >
-                        {showPassword ? <EyeOff size={16} /> : <Eye size={16} />}
-                      </button>
-                    </div>
-                    <div className="text-right mt-2">
-                      <button
-                        type="button"
-                        onClick={() => window.location.href = '/reset-password'}
-                        className="text-[10px] uppercase tracking-wide text-zinc-500 hover:text-nofx-gold transition-colors"
-                      >
-                        &gt; {t('forgotPassword', language)}
-                      </button>
-                    </div>
-                  </div>
-                </div>
-
-                {error && (
-                  <div className="text-xs bg-red-500/10 border border-red-500/30 text-red-500 px-3 py-2 rounded font-mono flex gap-2 items-start">
-                    <span>⚠</span> <span>{error}</span>
-                  </div>
-                )}
-
-                <button
-                  type="submit"
-                  disabled={loading}
-                  className="w-full bg-nofx-gold text-black font-bold py-3 px-4 rounded text-sm tracking-wide uppercase hover:bg-yellow-400 transition-all transform active:scale-[0.98] disabled:opacity-50 disabled:cursor-not-allowed font-mono shadow-[0_0_15px_rgba(255,215,0,0.1)] hover:shadow-[0_0_25px_rgba(255,215,0,0.25)] flex items-center justify-center gap-2 group"
-                >
-                  {loading ? (
-                    <span className="animate-pulse">PROCESSING...</span>
-                  ) : (
-                    <>
-                      <span>AUTHENTICATE</span>
-                      <span className="group-hover:translate-x-1 transition-transform">-&gt;</span>
-                    </>
-                  )}
-                </button>
-              </form>
-            ) : (
-              <form onSubmit={handleOTPVerify} className="space-y-6">
-                <div className="text-center py-2">
-                  <div className="w-12 h-12 bg-zinc-900 rounded-full flex items-center justify-center mx-auto mb-4 border border-zinc-700 text-2xl">
-                    🔐
-                  </div>
-                  <p className="text-xs text-zinc-400 font-mono leading-relaxed">
-                    {t('scanQRCodeInstructions', language)}<br />
-                    {t('enterOTPCode', language)}
-                  </p>
-                </div>
-
-                <div>
-                  <label className="block text-xs uppercase tracking-wider text-nofx-gold mb-2 text-center font-bold">
-                    {t('otpCode', language)}
+              {/* Password */}
+              <div>
+                <div className="flex items-center justify-between mb-2">
+                  <label className="text-xs font-medium text-zinc-400">
+                    {t('password', language)}
                   </label>
-                  <input
-                    type="text"
-                    value={otpCode}
-                    onChange={(e) =>
-                      setOtpCode(e.target.value.replace(/\D/g, '').slice(0, 6))
-                    }
-                    className="w-full bg-black border border-zinc-700 rounded px-4 py-4 text-center text-2xl tracking-[0.5em] font-mono text-white focus:border-nofx-gold focus:ring-1 focus:ring-nofx-gold/50 outline-none transition-all placeholder-zinc-800"
-                    placeholder="000000"
-                    maxLength={6}
-                    required
-                    autoFocus
-                  />
-                </div>
-
-                {error && (
-                  <div className="text-xs bg-red-500/10 border border-red-500/30 text-red-500 px-3 py-2 rounded font-mono text-center">
-                    [ACCESS DENIED]: {error}
-                  </div>
-                )}
-
-                <div className="flex gap-3 pt-2">
                   <button
                     type="button"
-                    onClick={() => setStep('login')}
-                    className="flex-1 bg-zinc-900 border border-zinc-700 text-zinc-400 py-3 rounded text-xs font-mono uppercase hover:bg-zinc-800 transition-colors"
+                    onClick={() => window.location.href = '/reset-password'}
+                    className="text-xs text-zinc-500 hover:text-nofx-gold transition-colors"
                   >
-                    &lt; ABORT
-                  </button>
-                  <button
-                    type="submit"
-                    disabled={loading || otpCode.length !== 6}
-                    className="flex-1 bg-nofx-gold text-black font-bold py-3 rounded text-xs font-mono uppercase hover:bg-yellow-400 transition-colors disabled:opacity-50"
-                  >
-                    {loading ? 'VERIFYING...' : 'CONFIRM IDENTITY'}
+                    {t('forgotPassword', language)}
                   </button>
                 </div>
-              </form>
-            )}
-          </div>
+                <div className="relative">
+                  <input
+                    type={showPassword ? 'text' : 'password'}
+                    value={password}
+                    onChange={(e) => setPassword(e.target.value)}
+                    className="w-full bg-zinc-950/80 border border-zinc-700/80 rounded-xl px-4 py-3 pr-11 text-sm text-white placeholder-zinc-600 focus:outline-none focus:border-nofx-gold/60 focus:ring-1 focus:ring-nofx-gold/30 transition-all"
+                    placeholder="••••••••"
+                    required
+                  />
+                  <button
+                    type="button"
+                    onClick={() => setShowPassword(!showPassword)}
+                    className="absolute right-3.5 top-1/2 -translate-y-1/2 text-zinc-500 hover:text-zinc-300 transition-colors"
+                  >
+                    {showPassword ? <EyeOff size={16} /> : <Eye size={16} />}
+                  </button>
+                </div>
+              </div>
 
-          {/* Terminal Footer Info */}
-          <div className="bg-zinc-900/50 p-3 flex justify-between items-center text-[10px] font-mono text-zinc-600 border-t border-zinc-800">
-            <div>SECURE_CONNECTION: ENCRYPTED</div>
-            <div>{new Date().toISOString().split('T')[0]}</div>
-          </div>
-        </div>
+              {/* Error */}
+              {error && (
+                <p className="text-xs text-red-400 bg-red-500/10 border border-red-500/20 rounded-lg px-3 py-2">
+                  {error}
+                </p>
+              )}
 
-        {/* Register Link */}
-        {!adminMode && registrationEnabled && (
-          <div className="text-center mt-8 space-y-4">
-            <p className="text-xs font-mono text-zinc-500">
-              NEW_USER_DETECTED?{' '}
+              {/* Submit */}
               <button
-                onClick={() => window.location.href = '/register'}
-                className="text-nofx-gold hover:underline hover:text-yellow-300 transition-colors ml-1 uppercase"
+                type="submit"
+                disabled={loading}
+                className="w-full bg-nofx-gold hover:bg-yellow-400 active:scale-[0.98] text-black font-semibold py-3 rounded-xl text-sm transition-all disabled:opacity-50 disabled:cursor-not-allowed mt-2"
               >
-                INITIALIZE REGISTRATION
+                {loading ? t('loggingIn', language) || 'Signing in...' : t('signIn', language) || 'Sign In'}
               </button>
-            </p>
-            <button
-              onClick={() => window.location.href = '/'}
-              className="text-[10px] text-zinc-600 hover:text-red-500 transition-colors uppercase tracking-widest hover:underline decoration-red-500/30 font-mono"
-            >
-              [ ABORT_SESSION_RETURN_HOME ]
-            </button>
+            </form>
           </div>
-        )}
+
+        </div>
       </div>
     </DeepVoidBackground>
   )

web/src/components/LoginRequiredOverlay.tsx

@@ -40,6 +40,20 @@ export function LoginRequiredOverlay({ isOpen, onClose, featureName }: LoginRequ
       login: 'EXECUTE LOGIN',
       register: 'REGISTER NEW ID',
       later: 'ABORT'
+    },
+    id: {
+      title: 'AKSES SISTEM DITOLAK',
+      subtitle: featureName ? `Modul "${featureName}" memerlukan hak akses lebih tinggi` : 'Otorisasi diperlukan untuk modul ini',
+      description: 'Inisialisasi protokol autentikasi untuk membuka kemampuan sistem penuh: konfigurasi Trader AI, aliran data Pasar Strategi, dan inti Simulasi Backtest.',
+      benefits: [
+        'Kontrol Trader AI',
+        'Pasar Strategi HFT',
+        'Mesin Backtest Historis',
+        'Visualisasi Sistem Penuh'
+      ],
+      login: 'JALANKAN LOGIN',
+      register: 'DAFTAR ID BARU',
+      later: 'BATALKAN'
     }
   }
 

web/src/components/ModelIcons.tsx

@@ -13,6 +13,10 @@ const MODEL_COLORS: Record<string, string> = {
   gemini: '#4285F4',
   grok: '#000000',
   openai: '#10A37F',
+  minimax: '#E45735',
+  'blockrun-base': '#2563EB',
+  'blockrun-sol': '#9945FF',
+  claw402: '#7C3AED',
 }
 
 // 获取AI模型图标的函数
@@ -44,6 +48,16 @@ export const getModelIcon = (modelType: string, props: IconProps = {}) => {
     case 'openai':
       iconPath = '/icons/openai.svg'
       break
+    case 'minimax':
+      iconPath = '/icons/minimax.svg'
+      break
+    case 'blockrun-base':
+    case 'blockrun-sol':
+      iconPath = '/icons/blockrun.svg'
+      break
+    case 'claw402':
+      iconPath = '/icons/claw402.png'
+      break
     default:
       return null
   }

web/src/components/PositionHistory.tsx

@@ -1,7 +1,7 @@
 import { useState, useEffect, useMemo } from 'react'
 import { api } from '../lib/api'
 import { useLanguage } from '../contexts/LanguageContext'
-import { t } from '../i18n/translations'
+import { t, type Language } from '../i18n/translations'
 import { MetricTooltip } from './MetricTooltip'
 import { formatPrice, formatQuantity } from '../utils/format'
 import type {
@@ -152,7 +152,7 @@ function SymbolStatsRow({ stat }: { stat: SymbolStats }) {
 }
 
 // Direction Stats Card
-function DirectionStatsCard({ stat, language }: { stat: DirectionStats; language: 'en' | 'zh' }) {
+function DirectionStatsCard({ stat, language }: { stat: DirectionStats; language: Language }) {
   const isLong = (stat.side || '').toLowerCase() === 'long'
   const iconColor = isLong ? '#0ECB81' : '#F6465D'
   const totalPnl = stat.total_pnl || 0

web/src/components/RegisterPage.tsx

@@ -1,33 +1,25 @@
-import React, { useState, useEffect } from 'react'
+import React, { useEffect, useState } from 'react'
+import { Eye, EyeOff } from 'lucide-react'
+import PasswordChecklist from 'react-password-checklist'
+import { toast } from 'sonner'
 import { useAuth } from '../contexts/AuthContext'
 import { useLanguage } from '../contexts/LanguageContext'
 import { t } from '../i18n/translations'
 import { getSystemConfig } from '../lib/config'
-import { toast } from 'sonner'
-import { copyWithToast } from '../lib/clipboard'
-import { Eye, EyeOff } from 'lucide-react'
 import { DeepVoidBackground } from './DeepVoidBackground'
-// import { Input } from './ui/input' // Removed unused import
-import PasswordChecklist from 'react-password-checklist'
 import { RegistrationDisabled } from './RegistrationDisabled'
 import { WhitelistFullPage } from './WhitelistFullPage'
 
 export function RegisterPage() {
   const { language } = useLanguage()
-  const { register, completeRegistration } = useAuth()
-  const [step, setStep] = useState<'register' | 'setup-otp' | 'verify-otp' | 'whitelist-full'>(
-    'register'
-  )
+  const { register } = useAuth()
+  const [view, setView] = useState<'register' | 'whitelist-full'>('register')
   const [email, setEmail] = useState('')
   const [password, setPassword] = useState('')
   const [confirmPassword, setConfirmPassword] = useState('')
   const [betaCode, setBetaCode] = useState('')
   const [betaMode, setBetaMode] = useState(false)
   const [registrationEnabled, setRegistrationEnabled] = useState(true)
-  const [otpCode, setOtpCode] = useState('')
-  const [userID, setUserID] = useState('')
-  const [otpSecret, setOtpSecret] = useState('')
-  const [qrCodeURL, setQrCodeURL] = useState('')
   const [error, setError] = useState('')
   const [loading, setLoading] = useState(false)
   const [passwordValid, setPasswordValid] = useState(false)
@@ -35,32 +27,28 @@ export function RegisterPage() {
   const [showConfirmPassword, setShowConfirmPassword] = useState(false)
 
   useEffect(() => {
-    // 获取系统配置，检查是否开启内测模式和注册功能
     getSystemConfig()
       .then((config) => {
         setBetaMode(config.beta_mode || false)
-        setRegistrationEnabled(config.registration_enabled !== false)
+        setRegistrationEnabled(config.initialized === false)
       })
       .catch((err) => {
         console.error('Failed to fetch system config:', err)
       })
   }, [])
 
-  // 如果注册功能被禁用，显示注册已关闭页面
   if (!registrationEnabled) {
     return <RegistrationDisabled />
   }
 
-  // 如果白名单已满，显示容量已满页面
-  if (step === 'whitelist-full') {
-    return <WhitelistFullPage onBack={() => setStep('register')} />
+  if (view === 'whitelist-full') {
+    return <WhitelistFullPage onBack={() => setView('register')} />
   }
 
   const handleRegister = async (e: React.FormEvent) => {
     e.preventDefault()
     setError('')
 
-    // 使用 PasswordChecklist 的校验结果
     if (!passwordValid) {
       setError(t('passwordNotMeetRequirements', language))
       return
@@ -72,50 +60,44 @@ export function RegisterPage() {
     }
 
     setLoading(true)
-
     try {
       const result = await register(email, password, betaCode.trim() || undefined)
 
-      // Helper to check for whitelist errors
       const isWhitelistError = (msg: string) => {
         const lowerMsg = msg.toLowerCase()
-        return lowerMsg.includes('whitelist') ||
+        return (
+          lowerMsg.includes('whitelist') ||
           lowerMsg.includes('capacity') ||
           lowerMsg.includes('limit') ||
           lowerMsg.includes('permission denied') ||
           lowerMsg.includes('not on whitelist')
+        )
       }
 
-      if (result.success && result.userID) {
-        setUserID(result.userID)
-        setOtpSecret(result.otpSecret || '')
-        setQrCodeURL(result.qrCodeURL || '')
-        setStep('setup-otp')
-      } else {
-        // Check for whitelist/capacity limit error
+      if (!result.success) {
         const msg = result.message || t('registrationFailed', language)
         if (isWhitelistError(msg)) {
-          setStep('whitelist-full')
+          setView('whitelist-full')
           return
         }
         setError(msg)
         toast.error(msg)
       }
+      // success path is handled in AuthContext (auto login + navigation)
     } catch (e) {
       console.error('Registration error:', e)
       const errorMsg = e instanceof Error ? e.message : 'Registration failed due to server error'
-
-      // Check for whitelist error in catch block too
       const lowerMsg = errorMsg.toLowerCase()
-      if (lowerMsg.includes('whitelist') ||
+      if (
+        lowerMsg.includes('whitelist') ||
         lowerMsg.includes('capacity') ||
         lowerMsg.includes('limit') ||
         lowerMsg.includes('permission denied') ||
-        lowerMsg.includes('not on whitelist')) {
-        setStep('whitelist-full')
+        lowerMsg.includes('not on whitelist')
+      ) {
+        setView('whitelist-full')
         return
       }
-
       setError(errorMsg)
       toast.error(errorMsg)
     } finally {
@@ -123,39 +105,12 @@ export function RegisterPage() {
     }
   }
 
-  const handleSetupComplete = () => {
-    setStep('verify-otp')
-  }
-
-  const handleOTPVerify = async (e: React.FormEvent) => {
-    e.preventDefault()
-    setError('')
-    setLoading(true)
-
-    const result = await completeRegistration(userID, otpCode)
-
-    if (!result.success) {
-      const msg = result.message || t('registrationFailed', language)
-      setError(msg)
-      toast.error(msg)
-    }
-    // 成功的话AuthContext会自动处理登录状态
-
-    setLoading(false)
-  }
-
-  const copyToClipboard = (text: string) => {
-    copyWithToast(text)
-  }
-
   return (
     <DeepVoidBackground className="min-h-screen flex items-center justify-center py-12 font-mono" disableAnimation>
-
       <div className="w-full max-w-lg relative z-10 px-6">
-        {/* Navigation - Top Bar (Mobile/Desktop Friendly) */}
         <div className="flex justify-between items-center mb-8">
           <button
-            onClick={() => window.location.href = '/'}
+            onClick={() => (window.location.href = '/')}
             className="flex items-center gap-2 text-zinc-500 hover:text-white transition-colors group px-3 py-1.5 rounded border border-transparent hover:border-zinc-700 bg-black/20 backdrop-blur-sm"
           >
             <div className="w-2 h-2 rounded-full bg-red-500 group-hover:animate-pulse"></div>
@@ -163,38 +118,29 @@ export function RegisterPage() {
           </button>
         </div>
 
-        {/* Terminal Header */}
         <div className="mb-8 text-center">
           <div className="flex justify-center mb-6">
             <div className="relative">
               <div className="absolute -inset-2 bg-nofx-gold/20 rounded-full blur-xl animate-pulse"></div>
-              <img
-                src="/icons/nofx.svg"
-                alt="NoFx Logo"
-                className="w-16 h-16 object-contain relative z-10 opacity-90"
-              />
+              <img src="/icons/nofx.svg" alt="NoFx Logo" className="w-16 h-16 object-contain relative z-10 opacity-90" />
             </div>
           </div>
           <h1 className="text-3xl font-bold tracking-tighter text-white uppercase mb-2">
             <span className="text-nofx-gold">NEW_USER</span> ONBOARDING
           </h1>
           <p className="text-zinc-500 text-xs tracking-[0.2em] uppercase">
-            {step === 'register' && 'Initializing Registration Sequence...'}
-            {step === 'setup-otp' && 'Configuring Security Protocols...'}
-            {step === 'verify-otp' && 'Finalizing Authentication...'}
+            Initializing Registration Sequence...
           </p>
         </div>
 
-        {/* Terminal Output / Form Container */}
         <div className="bg-zinc-900/40 backdrop-blur-md border border-zinc-800 rounded-lg overflow-hidden shadow-2xl relative group">
           <div className="absolute inset-0 bg-zinc-900/50 opacity-0 group-hover:opacity-100 transition duration-700 pointer-events-none"></div>
 
-          {/* Window Bar */}
           <div className="flex items-center justify-between px-4 py-2 bg-zinc-900/80 border-b border-zinc-800">
             <div className="flex gap-1.5">
               <div
                 className="w-2.5 h-2.5 rounded-full bg-red-500/50 hover:bg-red-500 cursor-pointer transition-colors"
-                onClick={() => window.location.href = '/'}
+                onClick={() => (window.location.href = '/')}
                 title="Close / Return Home"
               ></div>
               <div className="w-2.5 h-2.5 rounded-full bg-yellow-500/50"></div>
@@ -206,7 +152,6 @@ export function RegisterPage() {
           </div>
 
           <div className="p-6 md:p-8 relative">
-            {/* Status Output */}
             <div className="mb-6 font-mono text-xs space-y-1 text-zinc-500 border-b border-zinc-800/50 pb-4">
               <div className="flex gap-2">
                 <span className="text-emerald-500">➜</span>
@@ -218,275 +163,151 @@ export function RegisterPage() {
               </div>
             </div>
 
-            {step === 'register' && (
-              <form onSubmit={handleRegister} className="space-y-5">
+            <form onSubmit={handleRegister} className="space-y-5">
+              <div>
+                <label className="block text-xs uppercase tracking-wider text-zinc-500 mb-1.5 ml-1 font-bold">{t('email', language)}</label>
+                <input
+                  type="email"
+                  value={email}
+                  onChange={(e) => setEmail(e.target.value)}
+                  className="w-full bg-black/50 border border-zinc-700 rounded px-4 py-3 text-sm focus:border-nofx-gold focus:ring-1 focus:ring-nofx-gold/50 outline-none transition-all placeholder-zinc-800 text-white font-mono"
+                  placeholder="user@nofx.os"
+                  required
+                />
+              </div>
+
+              <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
                 <div>
-                  <label className="block text-xs uppercase tracking-wider text-zinc-500 mb-1.5 ml-1 font-bold">{t('email', language)}</label>
-                  <input
-                    type="email"
-                    value={email}
-                    onChange={(e) => setEmail(e.target.value)}
-                    className="w-full bg-black/50 border border-zinc-700 rounded px-4 py-3 text-sm focus:border-nofx-gold focus:ring-1 focus:ring-nofx-gold/50 outline-none transition-all placeholder-zinc-800 text-white font-mono"
-                    placeholder="user@nofx.os"
-                    required
+                  <label className="block text-xs uppercase tracking-wider text-zinc-500 mb-1.5 ml-1 font-bold">{t('password', language)}</label>
+                  <div className="relative">
+                    <input
+                      type={showPassword ? 'text' : 'password'}
+                      value={password}
+                      onChange={(e) => setPassword(e.target.value)}
+                      className="w-full bg-black/50 border border-zinc-700 rounded px-4 py-3 text-sm focus:border-nofx-gold focus:ring-1 focus:ring-nofx-gold/50 outline-none transition-all placeholder-zinc-800 text-white font-mono pr-10"
+                      placeholder="••••••••"
+                      required
+                    />
+                    <button
+                      type="button"
+                      onClick={() => setShowPassword(!showPassword)}
+                      className="absolute right-3 top-1/2 -translate-y-1/2 text-zinc-600 hover:text-zinc-400 transition-colors"
+                    >
+                      {showPassword ? <EyeOff size={16} /> : <Eye size={16} />}
+                    </button>
+                  </div>
+                </div>
+
+                <div>
+                  <label className="block text-xs uppercase tracking-wider text-zinc-500 mb-1.5 ml-1 font-bold">{t('confirmPassword', language)}</label>
+                  <div className="relative">
+                    <input
+                      type={showConfirmPassword ? 'text' : 'password'}
+                      value={confirmPassword}
+                      onChange={(e) => setConfirmPassword(e.target.value)}
+                      className="w-full bg-black/50 border border-zinc-700 rounded px-4 py-3 text-sm focus:border-nofx-gold focus:ring-1 focus:ring-nofx-gold/50 outline-none transition-all placeholder-zinc-800 text-white font-mono pr-10"
+                      placeholder="••••••••"
+                      required
+                    />
+                    <button
+                      type="button"
+                      onClick={() => setShowConfirmPassword(!showConfirmPassword)}
+                      className="absolute right-3 top-1/2 -translate-y-1/2 text-zinc-600 hover:text-zinc-400 transition-colors"
+                    >
+                      {showConfirmPassword ? <EyeOff size={16} /> : <Eye size={16} />}
+                    </button>
+                  </div>
+                </div>
+              </div>
+
+              <div className="bg-zinc-900/50 p-3 rounded border border-zinc-800/50">
+                <div className="text-[10px] uppercase tracking-wider text-zinc-500 mb-2 font-bold flex items-center gap-2">
+                  <div className="w-1 h-1 rounded-full bg-zinc-500"></div>
+                  Password Strength Protocol
+                </div>
+                <div className="text-xs font-mono text-zinc-400">
+                  <PasswordChecklist
+                    rules={['minLength', 'capital', 'lowercase', 'number', 'specialChar', 'match']}
+                    minLength={8}
+                    value={password}
+                    valueAgain={confirmPassword}
+                    messages={{
+                      minLength: t('passwordRuleMinLength', language),
+                      capital: t('passwordRuleUppercase', language),
+                      lowercase: t('passwordRuleLowercase', language),
+                      number: t('passwordRuleNumber', language),
+                      specialChar: t('passwordRuleSpecial', language),
+                      match: t('passwordRuleMatch', language),
+                    }}
+                    className="grid grid-cols-2 gap-x-4 gap-y-1"
+                    onChange={(isValid) => setPasswordValid(isValid)}
+                    iconSize={10}
                   />
                 </div>
-
-                <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
-                  <div>
-                    <label className="block text-xs uppercase tracking-wider text-zinc-500 mb-1.5 ml-1 font-bold">{t('password', language)}</label>
-                    <div className="relative">
-                      <input
-                        type={showPassword ? 'text' : 'password'}
-                        value={password}
-                        onChange={(e) => setPassword(e.target.value)}
-                        className="w-full bg-black/50 border border-zinc-700 rounded px-4 py-3 text-sm focus:border-nofx-gold focus:ring-1 focus:ring-nofx-gold/50 outline-none transition-all placeholder-zinc-800 text-white font-mono pr-10"
-                        placeholder="••••••••"
-                        required
-                      />
-                      <button
-                        type="button"
-                        onClick={() => setShowPassword(!showPassword)}
-                        className="absolute right-3 top-1/2 -translate-y-1/2 text-zinc-600 hover:text-zinc-400 transition-colors"
-                      >
-                        {showPassword ? <EyeOff size={16} /> : <Eye size={16} />}
-                      </button>
-                    </div>
-                  </div>
-
-                  <div>
-                    <label className="block text-xs uppercase tracking-wider text-zinc-500 mb-1.5 ml-1 font-bold">{t('confirmPassword', language)}</label>
-                    <div className="relative">
-                      <input
-                        type={showConfirmPassword ? 'text' : 'password'}
-                        value={confirmPassword}
-                        onChange={(e) => setConfirmPassword(e.target.value)}
-                        className="w-full bg-black/50 border border-zinc-700 rounded px-4 py-3 text-sm focus:border-nofx-gold focus:ring-1 focus:ring-nofx-gold/50 outline-none transition-all placeholder-zinc-800 text-white font-mono pr-10"
-                        placeholder="••••••••"
-                        required
-                      />
-                      <button
-                        type="button"
-                        onClick={() => setShowConfirmPassword(!showConfirmPassword)}
-                        className="absolute right-3 top-1/2 -translate-y-1/2 text-zinc-600 hover:text-zinc-400 transition-colors"
-                      >
-                        {showConfirmPassword ? <EyeOff size={16} /> : <Eye size={16} />}
-                      </button>
-                    </div>
-                  </div>
-                </div>
-
-                <div className="bg-zinc-900/50 p-3 rounded border border-zinc-800/50">
-                  <div className="text-[10px] uppercase tracking-wider text-zinc-500 mb-2 font-bold flex items-center gap-2">
-                    <div className="w-1 h-1 rounded-full bg-zinc-500"></div>
-                    Password Strength Protocol
-                  </div>
-                  <div className="text-xs font-mono text-zinc-400">
-                    <PasswordChecklist
-                      rules={['minLength', 'capital', 'lowercase', 'number', 'specialChar', 'match']}
-                      minLength={8}
-                      value={password}
-                      valueAgain={confirmPassword}
-                      messages={{
-                        minLength: t('passwordRuleMinLength', language),
-                        capital: t('passwordRuleUppercase', language),
-                        lowercase: t('passwordRuleLowercase', language),
-                        number: t('passwordRuleNumber', language),
-                        specialChar: t('passwordRuleSpecial', language),
-                        match: t('passwordRuleMatch', language),
-                      }}
-                      className="grid grid-cols-2 gap-x-4 gap-y-1"
-                      onChange={(isValid) => setPasswordValid(isValid)}
-                      iconSize={10}
-                    />
-                  </div>
-                </div>
-
-                {betaMode && (
-                  <div>
-                    <label className="block text-xs uppercase tracking-wider text-nofx-gold mb-1.5 ml-1 font-bold">Priority Access Code</label>
-                    <input
-                      type="text"
-                      value={betaCode}
-                      onChange={(e) => setBetaCode(e.target.value.replace(/[^a-z0-9]/gi, '').toLowerCase())}
-                      className="w-full bg-black/50 border border-zinc-700 rounded px-4 py-3 text-sm focus:border-nofx-gold focus:ring-1 focus:ring-nofx-gold/50 outline-none transition-all placeholder-zinc-800 text-white font-mono tracking-widest"
-                      placeholder="XXXXXX"
-                      maxLength={6}
-                      required={betaMode}
-                    />
-                    <p className="text-[10px] text-zinc-600 font-mono mt-1 ml-1">* CASE SENSITIVE ALPHANUMERIC</p>
-                  </div>
-                )}
-
-                {error && (
-                  <div className="text-xs bg-red-500/10 border border-red-500/30 text-red-500 px-3 py-2 rounded font-mono">
-                    [REGISTRATION_ERROR]: {error}
-                  </div>
-                )}
-
-                <button
-                  type="submit"
-                  disabled={loading || (betaMode && !betaCode.trim()) || !passwordValid}
-                  className="w-full bg-nofx-gold text-black font-bold py-3 px-4 rounded text-sm tracking-wide uppercase hover:bg-yellow-400 transition-all transform active:scale-[0.98] disabled:opacity-50 disabled:cursor-not-allowed font-mono shadow-[0_0_15px_rgba(255,215,0,0.1)] hover:shadow-[0_0_25px_rgba(255,215,0,0.25)] flex items-center justify-center gap-2 group mt-4"
-                >
-                  {loading ? (
-                    <span className="animate-pulse">INITIALIZING...</span>
-                  ) : (
-                    <>
-                      <span>CREATE_ACCOUNT</span>
-                      <span className="group-hover:translate-x-1 transition-transform">-&gt;</span>
-                    </>
-                  )}
-                </button>
-              </form>
-            )}
-
-            {step === 'setup-otp' && (
-              <div className="space-y-6">
-                <div className="text-center bg-zinc-900/50 p-4 rounded border border-zinc-800">
-                  <div className="text-xs font-mono text-zinc-400 mb-2">SCAN_QR_CODE_SEQUENCE</div>
-                  {qrCodeURL ? (
-                    <div className="bg-white p-2 rounded inline-block shadow-[0_0_30px_rgba(255,255,255,0.1)]">
-                      <img
-                        src={`https://api.qrserver.com/v1/create-qr-code/?size=150x150&data=${encodeURIComponent(`otpauth://totp/NoFX:${email}?secret=${otpSecret}&issuer=NoFX`)}`}
-                        alt="QR Code"
-                        className="w-32 h-32"
-                      />
-                    </div>
-                  ) : (
-                    <div className="w-32 h-32 bg-zinc-800 animate-pulse rounded inline-block"></div>
-                  )}
-                  <div className="mt-4">
-                    <p className="text-[10px] text-zinc-500 uppercase tracking-widest mb-1">Backup Secret Key</p>
-                    <div className="flex items-center gap-2 justify-center bg-black/50 p-2 rounded border border-zinc-700/50 max-w-[200px] mx-auto">
-                      <code className="text-xs font-mono text-nofx-gold">{otpSecret}</code>
-                      <button
-                        onClick={() => copyToClipboard(otpSecret)}
-                        className="text-zinc-500 hover:text-white transition-colors"
-                      >
-                        <span className="text-[10px] uppercase border border-zinc-700 px-1 rounded">Copy</span>
-                      </button>
-                    </div>
-                  </div>
-                </div>
-
-                <div className="space-y-4 font-mono text-xs text-zinc-400 bg-black/20 p-4 rounded border border-zinc-800/50">
-                  <div className="flex gap-3 items-start">
-                    <span className="text-nofx-gold font-bold mt-0.5">01</span>
-                    <div>
-                      <p className="font-bold text-white mb-1">Install Authenticator App</p>
-                      <p className="mb-2">We highly recommend <span className="text-nofx-gold">Google Authenticator</span> for compatibility.</p>
-                      <div className="flex gap-2">
-                        <span className="px-1.5 py-0.5 bg-zinc-800 rounded text-[10px] text-zinc-300 border border-zinc-700">iOS</span>
-                        <span className="px-1.5 py-0.5 bg-zinc-800 rounded text-[10px] text-zinc-300 border border-zinc-700">Android</span>
-                      </div>
-                    </div>
-                  </div>
-
-                  <div className="w-full h-px bg-zinc-800/50"></div>
-
-                  <div className="flex gap-3 items-start">
-                    <span className="text-nofx-gold font-bold mt-0.5">02</span>
-                    <div>
-                      <p className="font-bold text-white mb-1">Scan QR Code</p>
-                      <p>Open Google Authenticator, tap the <span className="text-white">+</span> button, and scan the code above.</p>
-                      <p className="text-[10px] text-zinc-500 mt-1 italic">Protocol: Time-Based OTP (TOTP)</p>
-                    </div>
-                  </div>
-
-                  <div className="w-full h-px bg-zinc-800/50"></div>
-
-                  <div className="flex gap-3 items-start">
-                    <span className="text-nofx-gold font-bold mt-0.5">03</span>
-                    <div>
-                      <p className="font-bold text-white mb-1">Verify Token</p>
-                      <p>Enter the 6-digit code generated by the app.</p>
-                      <div className="mt-2 p-2 bg-yellow-500/10 border border-yellow-500/20 rounded text-[10px] text-yellow-500/80 flex gap-2 items-start">
-                        <span className="mt-px">⚠️</span>
-                        <span>Stuck? Ensure your phone's time is set to "Automatic". Time drift causes codes to fail.</span>
-                      </div>
-                    </div>
-                  </div>
-                </div>
-
-                <button
-                  onClick={handleSetupComplete}
-                  className="w-full bg-nofx-gold text-black font-bold py-3 px-4 rounded text-sm tracking-wide uppercase hover:bg-yellow-400 transition-colors font-mono shadow-lg"
-                >
-                  PROCEED TO VERIFICATION
-                </button>
               </div>
-            )}
-
-            {step === 'verify-otp' && (
-              <form onSubmit={handleOTPVerify} className="space-y-6">
-                <div className="text-center">
-                  <p className="text-xs text-zinc-400 font-mono mb-6">
-                    ENTER 6-DIGIT SECURITY TOKEN TO FINALIZE ONBOARDING
-                  </p>
-                </div>
 
+              {betaMode && (
                 <div>
+                  <label className="block text-xs uppercase tracking-wider text-nofx-gold mb-1.5 ml-1 font-bold">Priority Access Code</label>
                   <input
                     type="text"
-                    value={otpCode}
-                    onChange={(e) =>
-                      setOtpCode(e.target.value.replace(/\D/g, '').slice(0, 6))
-                    }
-                    className="w-full bg-black border border-zinc-700 rounded px-4 py-4 text-center text-3xl tracking-[0.5em] font-mono text-white focus:border-nofx-gold focus:ring-1 focus:ring-nofx-gold/50 outline-none transition-all placeholder-zinc-800"
-                    placeholder="000000"
+                    value={betaCode}
+                    onChange={(e) => setBetaCode(e.target.value.replace(/[^a-z0-9]/gi, '').toLowerCase())}
+                    className="w-full bg-black/50 border border-zinc-700 rounded px-4 py-3 text-sm focus:border-nofx-gold focus:ring-1 focus:ring-nofx-gold/50 outline-none transition-all placeholder-zinc-800 text-white font-mono tracking-widest"
+                    placeholder="XXXXXX"
                     maxLength={6}
-                    required
-                    autoFocus
+                    required={betaMode}
                   />
+                  <p className="text-[10px] text-zinc-600 font-mono mt-1 ml-1">* CASE SENSITIVE ALPHANUMERIC</p>
                 </div>
+              )}
 
-                {error && (
-                  <div className="text-xs bg-red-500/10 border border-red-500/30 text-red-500 px-3 py-2 rounded font-mono text-center">
-                    [VERIFICATION_FAILED]: {error}
-                  </div>
+              {error && (
+                <div className="text-xs bg-red-500/10 border border-red-500/30 text-red-500 px-3 py-2 rounded font-mono">
+                  [REGISTRATION_ERROR]: {error}
+                </div>
+              )}
+
+              <button
+                type="submit"
+                disabled={loading || (betaMode && !betaCode.trim()) || !passwordValid}
+                className="w-full bg-nofx-gold text-black font-bold py-3 px-4 rounded text-sm tracking-wide uppercase hover:bg-yellow-400 transition-all transform active:scale-[0.98] disabled:opacity-50 disabled:cursor-not-allowed font-mono shadow-[0_0_15px_rgba(255,215,0,0.1)] hover:shadow-[0_0_25px_rgba(255,215,0,0.25)] flex items-center justify-center gap-2 group mt-4"
+              >
+                {loading ? (
+                  <span className="animate-pulse">INITIALIZING...</span>
+                ) : (
+                  <>
+                    <span>CREATE_ACCOUNT</span>
+                    <span className="group-hover:translate-x-1 transition-transform">-&gt;</span>
+                  </>
                 )}
-
-                <button
-                  type="submit"
-                  disabled={loading || otpCode.length !== 6}
-                  className="w-full bg-nofx-gold text-black font-bold py-3 px-4 rounded text-sm tracking-wide uppercase hover:bg-yellow-400 transition-colors font-mono shadow-lg disabled:opacity-50"
-                >
-                  {loading ? 'VALIDATING...' : 'ACTIVATE ACCOUNT'}
-                </button>
-              </form>
-            )}
-
+              </button>
+            </form>
           </div>
 
-          {/* Terminal Footer Info */}
           <div className="bg-zinc-900/50 p-3 flex justify-between items-center text-[10px] font-mono text-zinc-600 border-t border-zinc-800">
             <div>ENCRYPTION: AES-256</div>
             <div>SECURE_REGISTRY</div>
           </div>
         </div>
 
-        {/* Login Link */}
-        {step === 'register' && (
-          <div className="text-center mt-8 space-y-4">
-            <p className="text-xs font-mono text-zinc-500">
-              EXISTING_OPERATOR?{' '}
-              <button
-                onClick={() => window.location.href = '/login'}
-                className="text-nofx-gold hover:underline hover:text-yellow-300 transition-colors ml-1 uppercase"
-              >
-                ACCESS TERMINAL
-              </button>
-            </p>
+        <div className="text-center mt-8 space-y-4">
+          <p className="text-xs font-mono text-zinc-500">
+            EXISTING_OPERATOR?{' '}
             <button
-              onClick={() => window.location.href = '/'}
-              className="text-[10px] text-zinc-600 hover:text-red-500 transition-colors uppercase tracking-widest hover:underline decoration-red-500/30 font-mono"
+              onClick={() => (window.location.href = '/login')}
+              className="text-nofx-gold hover:underline hover:text-yellow-300 transition-colors ml-1 uppercase"
             >
-              [ ABORT_REGISTRATION_RETURN_HOME ]
+              ACCESS TERMINAL
             </button>
-          </div>
-        )}
-
+          </p>
+          <button
+            onClick={() => (window.location.href = '/')}
+            className="text-[10px] text-zinc-600 hover:text-red-500 transition-colors uppercase tracking-widest hover:underline decoration-red-500/30 font-mono"
+          >
+            [ ABORT_REGISTRATION_RETURN_HOME ]
+          </button>
+        </div>
       </div>
     </DeepVoidBackground>
   )

web/src/components/ResetPasswordPage.tsx

@@ -14,7 +14,6 @@ export function ResetPasswordPage() {
   const [email, setEmail] = useState('')
   const [newPassword, setNewPassword] = useState('')
   const [confirmPassword, setConfirmPassword] = useState('')
-  const [otpCode, setOtpCode] = useState('')
   const [error, setError] = useState('')
   const [success, setSuccess] = useState(false)
   const [loading, setLoading] = useState(false)
@@ -35,7 +34,7 @@ export function ResetPasswordPage() {
 
     setLoading(true)
 
-    const result = await resetPassword(email, newPassword, otpCode)
+    const result = await resetPassword(email, newPassword)
 
     if (result.success) {
       setSuccess(true)
@@ -88,7 +87,7 @@ export function ResetPasswordPage() {
               {t('resetPasswordTitle', language)}
             </h1>
             <p className="text-sm mt-2" style={{ color: '#848E9C' }}>
-              使用邮箱和 Google Authenticator 重置密码
+              使用邮箱和新密码重置账户密码
             </p>
           </div>
 
@@ -230,37 +229,6 @@ export function ResetPasswordPage() {
                   />
                 </div>
 
-                <div>
-                  <label
-                    className="block text-sm font-semibold mb-2"
-                    style={{ color: '#EAECEF' }}
-                  >
-                    {t('otpCode', language)}
-                  </label>
-                  <div className="text-center mb-3">
-                    <div className="text-3xl">📱</div>
-                    <p className="text-xs mt-1" style={{ color: '#848E9C' }}>
-                      打开 Google Authenticator 获取6位验证码
-                    </p>
-                  </div>
-                  <input
-                    type="text"
-                    value={otpCode}
-                    onChange={(e) =>
-                      setOtpCode(e.target.value.replace(/\D/g, '').slice(0, 6))
-                    }
-                    className="w-full px-3 py-2 rounded text-center text-2xl font-mono"
-                    style={{
-                      background: '#0B0E11',
-                      border: '1px solid #2B3139',
-                      color: '#EAECEF',
-                    }}
-                    placeholder={t('otpPlaceholder', language)}
-                    maxLength={6}
-                    required
-                  />
-                </div>
-
                 {error && (
                   <div
                     className="text-sm px-3 py-2 rounded"
@@ -275,7 +243,7 @@ export function ResetPasswordPage() {
 
                 <button
                   type="submit"
-                  disabled={loading || otpCode.length !== 6 || !passwordValid}
+                  disabled={loading || !passwordValid}
                   className="w-full px-4 py-2 rounded text-sm font-semibold transition-all hover:scale-105 disabled:opacity-50"
                   style={{ background: '#F0B90B', color: '#000' }}
                 >

web/src/components/SetupPage.tsx

@@ -0,0 +1,115 @@
+import React, { useState } from 'react'
+import { Eye, EyeOff } from 'lucide-react'
+import { useAuth } from '../contexts/AuthContext'
+import { DeepVoidBackground } from './DeepVoidBackground'
+import { invalidateSystemConfig } from '../lib/config'
+
+export function SetupPage() {
+  const { register } = useAuth()
+  const [email, setEmail] = useState('')
+  const [password, setPassword] = useState('')
+  const [showPassword, setShowPassword] = useState(false)
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault()
+    setError('')
+    if (password.length < 8) {
+      setError('Password must be at least 8 characters')
+      return
+    }
+    setLoading(true)
+    const result = await register(email, password)
+    setLoading(false)
+    if (result.success) {
+      invalidateSystemConfig()
+      window.location.href = '/traders'
+    } else {
+      setError(result.message || 'Setup failed, please try again')
+    }
+  }
+
+  return (
+    <DeepVoidBackground disableAnimation>
+      <div className="flex-1 flex items-center justify-center px-4 py-16">
+        <div className="w-full max-w-sm">
+
+          {/* Logo + Title */}
+          <div className="text-center mb-10">
+            <div className="flex justify-center mb-5">
+              <div className="relative">
+                <div className="absolute -inset-3 bg-nofx-gold/15 rounded-full blur-2xl" />
+                <img src="/icons/nofx.svg" alt="NOFX" className="w-14 h-14 relative z-10" />
+              </div>
+            </div>
+            <h1 className="text-2xl font-bold text-white mb-1.5">Welcome to NOFX</h1>
+            <p className="text-zinc-500 text-sm">Create your account to get started</p>
+          </div>
+
+          {/* Card */}
+          <div className="bg-zinc-900/60 backdrop-blur-xl border border-zinc-800/80 rounded-2xl p-8 shadow-2xl">
+            <form onSubmit={handleSubmit} className="space-y-5">
+
+              {/* Email */}
+              <div>
+                <label className="block text-xs font-medium text-zinc-400 mb-2">Email</label>
+                <input
+                  type="email"
+                  value={email}
+                  onChange={(e) => setEmail(e.target.value)}
+                  className="w-full bg-zinc-950/80 border border-zinc-700/80 rounded-xl px-4 py-3 text-sm text-white placeholder-zinc-600 focus:outline-none focus:border-nofx-gold/60 focus:ring-1 focus:ring-nofx-gold/30 transition-all"
+                  placeholder="you@example.com"
+                  required
+                  autoFocus
+                />
+              </div>
+
+              {/* Password */}
+              <div>
+                <label className="block text-xs font-medium text-zinc-400 mb-2">Password</label>
+                <div className="relative">
+                  <input
+                    type={showPassword ? 'text' : 'password'}
+                    value={password}
+                    onChange={(e) => setPassword(e.target.value)}
+                    className="w-full bg-zinc-950/80 border border-zinc-700/80 rounded-xl px-4 py-3 pr-11 text-sm text-white placeholder-zinc-600 focus:outline-none focus:border-nofx-gold/60 focus:ring-1 focus:ring-nofx-gold/30 transition-all"
+                    placeholder="At least 8 characters"
+                    required
+                  />
+                  <button
+                    type="button"
+                    onClick={() => setShowPassword(!showPassword)}
+                    className="absolute right-3.5 top-1/2 -translate-y-1/2 text-zinc-500 hover:text-zinc-300 transition-colors"
+                  >
+                    {showPassword ? <EyeOff size={16} /> : <Eye size={16} />}
+                  </button>
+                </div>
+              </div>
+
+              {/* Error */}
+              {error && (
+                <p className="text-xs text-red-400 bg-red-500/10 border border-red-500/20 rounded-lg px-3 py-2">
+                  {error}
+                </p>
+              )}
+
+              {/* Submit */}
+              <button
+                type="submit"
+                disabled={loading}
+                className="w-full bg-nofx-gold hover:bg-yellow-400 active:scale-[0.98] text-black font-semibold py-3 rounded-xl text-sm transition-all disabled:opacity-50 disabled:cursor-not-allowed mt-2"
+              >
+                {loading ? 'Creating account...' : 'Get Started'}
+              </button>
+            </form>
+          </div>
+
+          <p className="text-center text-xs text-zinc-600 mt-6">
+            Single-user system &mdash; this is the only account
+          </p>
+        </div>
+      </div>
+    </DeepVoidBackground>
+  )
+}

web/src/components/TraderConfigModal.tsx

@@ -336,9 +336,9 @@ export function TraderConfigModal({
                   <option value="">{t('noStrategyManual', language)}</option>
                   {strategies.map((strategy) => (
                     <option key={strategy.id} value={strategy.id}>
-                      {selectedStrategy.name}
-                      {selectedStrategy.is_active ? t('active', language) : ''}
-                      {selectedStrategy.is_default ? t('default', language) : ''}
+                      {strategy.name}
+                      {strategy.is_active ? t('strategyActive', language) : ''}
+                      {strategy.is_default ? t('strategyDefault', language) : ''}
                     </option>
                   ))}
                 </select>

web/src/components/landing/LoginModal.tsx

@@ -1,16 +1,12 @@
 import { motion } from 'framer-motion'
 import { X } from 'lucide-react'
 import { t, Language } from '../../i18n/translations'
-import { useSystemConfig } from '../../hooks/useSystemConfig'
-
 interface LoginModalProps {
   onClose: () => void
   language: Language
 }
 
 export default function LoginModal({ onClose, language }: LoginModalProps) {
-  const { config: systemConfig } = useSystemConfig()
-  const registrationEnabled = systemConfig?.registration_enabled !== false
 
   return (
     <motion.div
@@ -70,25 +66,6 @@ export default function LoginModal({ onClose, language }: LoginModalProps) {
           >
             {t('signIn', language)}
           </motion.button>
-          {registrationEnabled && (
-            <motion.button
-              onClick={() => {
-                window.history.pushState({}, '', '/register')
-                window.dispatchEvent(new PopStateEvent('popstate'))
-                onClose()
-              }}
-              className="block w-full px-6 py-3 rounded-lg font-semibold text-center"
-              style={{
-                background: 'var(--brand-dark-gray)',
-                color: 'var(--brand-light-gray)',
-                border: '1px solid rgba(240, 185, 11, 0.2)',
-              }}
-              whileHover={{ scale: 1.05, borderColor: 'var(--brand-yellow)' }}
-              whileTap={{ scale: 0.95 }}
-            >
-              {t('registerNewAccount', language)}
-            </motion.button>
-          )}
         </div>
       </motion.div>
     </motion.div>

web/src/components/traders/ExchangeConfigModal.tsx

@@ -30,6 +30,7 @@ const SUPPORTED_EXCHANGE_TEMPLATES = [
   { exchange_type: 'hyperliquid', name: 'Hyperliquid', type: 'dex' as const },
   { exchange_type: 'aster', name: 'Aster DEX', type: 'dex' as const },
   { exchange_type: 'lighter', name: 'Lighter', type: 'dex' as const },
+  { exchange_type: 'indodax', name: 'Indodax', type: 'cex' as const },
 ]
 
 interface ExchangeConfigModalProps {
@@ -204,6 +205,7 @@ export function ExchangeConfigModal({
     hyperliquid: { url: 'https://app.hyperliquid.xyz/join/AITRADING', hasReferral: true },
     aster: { url: 'https://www.asterdex.com/en/referral/fdfc0e', hasReferral: true },
     lighter: { url: 'https://app.lighter.xyz/?referral=68151432', hasReferral: true },
+    indodax: { url: 'https://indodax.com/ref/Saep23/1', hasReferral: true },
   }
 
   // Initialize form when editing
@@ -312,7 +314,7 @@ export function ExchangeConfigModal({
 
     setIsSaving(true)
     try {
-      if (currentExchangeType === 'binance' || currentExchangeType === 'bybit') {
+      if (currentExchangeType === 'binance' || currentExchangeType === 'bybit' || currentExchangeType === 'indodax') {
         if (!apiKey.trim() || !secretKey.trim()) return
         await onSave(exchangeId, exchangeType, trimmedAccountName, apiKey.trim(), secretKey.trim(), '', testnet)
       } else if (currentExchangeType === 'okx' || currentExchangeType === 'bitget' || currentExchangeType === 'kucoin') {
@@ -503,7 +505,7 @@ export function ExchangeConfigModal({
               </div>
 
               {/* CEX Fields */}
-              {(currentExchangeType === 'binance' || currentExchangeType === 'bybit' || currentExchangeType === 'okx' || currentExchangeType === 'bitget' || currentExchangeType === 'gate' || currentExchangeType === 'kucoin') && (
+              {(currentExchangeType === 'binance' || currentExchangeType === 'bybit' || currentExchangeType === 'okx' || currentExchangeType === 'bitget' || currentExchangeType === 'gate' || currentExchangeType === 'kucoin' || currentExchangeType === 'indodax') && (
                 <>
                   {currentExchangeType === 'binance' && (
                     <div

web/src/components/traders/TelegramConfigModal.tsx

@@ -0,0 +1,530 @@
+import React, { useState, useEffect } from 'react'
+import { Check, ChevronLeft, ExternalLink, MessageCircle, Unlink, ArrowRight } from 'lucide-react'
+import { toast } from 'sonner'
+import { api } from '../../lib/api'
+import type { TelegramConfig, AIModel } from '../../types'
+import type { Language } from '../../i18n/translations'
+
+// Step indicator (reused pattern from ExchangeConfigModal)
+function StepIndicator({ currentStep, labels }: { currentStep: number; labels: string[] }) {
+  return (
+    <div className="flex items-center justify-center gap-2 mb-6">
+      {labels.map((label, index) => (
+        <React.Fragment key={index}>
+          <div className="flex items-center gap-2">
+            <div
+              className="w-8 h-8 rounded-full flex items-center justify-center text-sm font-bold transition-all"
+              style={{
+                background: index < currentStep ? '#0ECB81' : index === currentStep ? '#2AABEE' : '#2B3139',
+                color: index <= currentStep ? '#000' : '#848E9C',
+              }}
+            >
+              {index < currentStep ? <Check className="w-4 h-4" /> : index + 1}
+            </div>
+            <span
+              className="text-xs font-medium hidden sm:block"
+              style={{ color: index === currentStep ? '#EAECEF' : '#848E9C' }}
+            >
+              {label}
+            </span>
+          </div>
+          {index < labels.length - 1 && (
+            <div
+              className="w-8 h-0.5 mx-1"
+              style={{ background: index < currentStep ? '#0ECB81' : '#2B3139' }}
+            />
+          )}
+        </React.Fragment>
+      ))}
+    </div>
+  )
+}
+
+interface TelegramConfigModalProps {
+  onClose: () => void
+  language: Language
+}
+
+export function TelegramConfigModal({ onClose, language }: TelegramConfigModalProps) {
+  const [step, setStep] = useState(0)
+  const [token, setToken] = useState('')
+  const [selectedModelId, setSelectedModelId] = useState('')
+  const [isSaving, setIsSaving] = useState(false)
+  const [config, setConfig] = useState<TelegramConfig | null>(null)
+  const [models, setModels] = useState<AIModel[]>([])
+  const [isLoading, setIsLoading] = useState(true)
+  const [isUnbinding, setIsUnbinding] = useState(false)
+
+  const zh = language === 'zh'
+
+  // Load current config and available models
+  useEffect(() => {
+    Promise.all([
+      api.getTelegramConfig().catch(() => null),
+      api.getModelConfigs().catch(() => [] as AIModel[]),
+    ]).then(([cfg, allModels]) => {
+      const enabledModels = allModels.filter((m) => m.enabled)
+      setModels(enabledModels)
+
+      if (cfg) {
+        setConfig(cfg)
+        setSelectedModelId(cfg.model_id ?? '')
+        if (cfg.is_bound) {
+          setStep(2)
+        } else if (cfg.token_masked && cfg.token_masked !== '') {
+          setStep(1)
+        }
+      }
+    }).finally(() => setIsLoading(false))
+  }, [])
+
+  const handleSaveToken = async () => {
+    if (!token.trim()) return
+    if (isSaving) return
+
+    // Basic format validation: looks like "123456789:ABCdef..."
+    if (!/^\d+:[A-Za-z0-9_-]{35,}$/.test(token.trim())) {
+      toast.error(zh ? 'Bot Token 格式不正确，应为 "数字:字母数字串"' : 'Invalid Bot Token format. Expected "numbers:alphanumeric"')
+      return
+    }
+
+    setIsSaving(true)
+    try {
+      await api.updateTelegramConfig(token.trim(), selectedModelId || undefined)
+      toast.success(zh ? 'Bot Token 已保存，等待绑定' : 'Bot Token saved, waiting for binding')
+      const updated = await api.getTelegramConfig()
+      setConfig(updated)
+      setToken('')
+      setStep(1)
+    } catch (err) {
+      toast.error(zh ? '保存失败，请检查 Token 是否正确' : 'Save failed, please verify the token')
+    } finally {
+      setIsSaving(false)
+    }
+  }
+
+  const handleUnbind = async () => {
+    if (isUnbinding) return
+    setIsUnbinding(true)
+    try {
+      await api.unbindTelegram()
+      toast.success(zh ? '已解绑 Telegram 账号' : 'Telegram account unbound')
+      const updated = await api.getTelegramConfig()
+      setConfig(updated)
+      setStep(updated.token_masked ? 1 : 0)
+    } catch {
+      toast.error(zh ? '解绑失败' : 'Unbind failed')
+    } finally {
+      setIsUnbinding(false)
+    }
+  }
+
+  const stepLabels = zh
+    ? ['创建 Bot', '绑定账号', '完成']
+    : ['Create Bot', 'Bind Account', 'Done']
+
+  // Model selector shared between steps
+  const ModelSelector = () => (
+    <div className="space-y-2">
+      <label className="text-sm font-semibold" style={{ color: '#EAECEF' }}>
+        {zh ? '选择 AI 模型（可选）' : 'Select AI Model (optional)'}
+      </label>
+      {models.length === 0 ? (
+        <div
+          className="px-4 py-3 rounded-xl text-xs"
+          style={{ background: '#0B0E11', border: '1px solid #2B3139', color: '#848E9C' }}
+        >
+          {zh ? '暂无启用的模型，请先在「AI 模型」中配置' : 'No enabled models. Configure one in AI Models first.'}
+        </div>
+      ) : (
+        <select
+          value={selectedModelId}
+          onChange={(e) => setSelectedModelId(e.target.value)}
+          className="w-full px-4 py-3 rounded-xl text-sm appearance-none"
+          style={{
+            background: '#0B0E11',
+            border: '1px solid #2B3139',
+            color: selectedModelId ? '#EAECEF' : '#848E9C',
+          }}
+        >
+          <option value="">{zh ? '— 自动选择（推荐）' : '— Auto-select (recommended)'}</option>
+          {models.map((m) => (
+            <option key={m.id} value={m.id}>
+              {m.name} ({m.provider}{m.customModelName ? ` · ${m.customModelName}` : ''})
+            </option>
+          ))}
+        </select>
+      )}
+      <div className="text-xs" style={{ color: '#848E9C' }}>
+        {zh
+          ? '不选则自动使用已启用的模型'
+          : 'Leave blank to auto-use any enabled model'}
+      </div>
+    </div>
+  )
+
+  return (
+    <div className="fixed inset-0 bg-black/60 flex items-center justify-center z-50 p-4 overflow-y-auto backdrop-blur-sm">
+      <div
+        className="rounded-2xl w-full max-w-lg relative my-8 shadow-2xl"
+        style={{ background: 'linear-gradient(180deg, #1E2329 0%, #181A20 100%)' }}
+      >
+        {/* Header */}
+        <div className="flex items-center justify-between p-6 pb-2">
+          <div className="flex items-center gap-3">
+            {step > 0 && !config?.is_bound && (
+              <button
+                type="button"
+                onClick={() => setStep(step - 1)}
+                className="p-2 rounded-lg hover:bg-white/10 transition-colors"
+              >
+                <ChevronLeft className="w-5 h-5" style={{ color: '#848E9C' }} />
+              </button>
+            )}
+            <div className="flex items-center gap-2">
+              <MessageCircle className="w-6 h-6" style={{ color: '#2AABEE' }} />
+              <h3 className="text-xl font-bold" style={{ color: '#EAECEF' }}>
+                {zh ? 'Telegram Bot 配置' : 'Telegram Bot Setup'}
+              </h3>
+            </div>
+          </div>
+          <button
+            type="button"
+            onClick={onClose}
+            className="p-2 rounded-lg hover:bg-white/10 transition-colors"
+            style={{ color: '#848E9C' }}
+          >
+            ✕
+          </button>
+        </div>
+
+        {/* Step Indicator */}
+        <div className="px-6 pt-4">
+          <StepIndicator currentStep={step} labels={stepLabels} />
+        </div>
+
+        {/* Content */}
+        <div className="px-6 pb-6 space-y-5">
+          {isLoading ? (
+            <div className="text-center py-8 text-zinc-500 text-sm font-mono">
+              {zh ? '加载中...' : 'Loading...'}
+            </div>
+          ) : (
+            <>
+              {/* Step 0: Create bot via BotFather */}
+              {step === 0 && (
+                <div className="space-y-5">
+                  <div
+                    className="p-4 rounded-xl space-y-3"
+                    style={{ background: 'rgba(42, 171, 238, 0.1)', border: '1px solid rgba(42, 171, 238, 0.3)' }}
+                  >
+                    <div className="flex items-start gap-3">
+                      <span className="text-2xl">🤖</span>
+                      <div>
+                        <div className="font-semibold mb-1" style={{ color: '#2AABEE' }}>
+                          {zh ? '第一步：在 Telegram 创建你的 Bot' : 'Step 1: Create your Bot in Telegram'}
+                        </div>
+                        <div className="text-xs space-y-1" style={{ color: '#848E9C' }}>
+                          <div>1. {zh ? '打开 Telegram，搜索' : 'Open Telegram, search for'} <code className="text-blue-400">@BotFather</code></div>
+                          <div>2. {zh ? '发送' : 'Send'} <code className="text-blue-400">/newbot</code> {zh ? '命令' : 'command'}</div>
+                          <div>3. {zh ? '按提示输入 Bot 名称和用户名' : 'Follow prompts to set bot name and username'}</div>
+                          <div>4. {zh ? 'BotFather 会返回一个 Token，复制它' : 'BotFather will return a Token, copy it'}</div>
+                        </div>
+                      </div>
+                    </div>
+                  </div>
+
+                  <a
+                    href="https://t.me/BotFather"
+                    target="_blank"
+                    rel="noopener noreferrer"
+                    className="w-full flex items-center justify-center gap-2 px-4 py-3 rounded-xl font-semibold transition-all hover:scale-[1.02]"
+                    style={{ background: '#2AABEE', color: '#000' }}
+                  >
+                    <ExternalLink className="w-4 h-4" />
+                    {zh ? '打开 @BotFather' : 'Open @BotFather'}
+                  </a>
+
+                  <div className="space-y-2">
+                    <label className="text-sm font-semibold" style={{ color: '#EAECEF' }}>
+                      {zh ? '粘贴 Bot Token' : 'Paste Bot Token'}
+                    </label>
+                    <input
+                      type="password"
+                      value={token}
+                      onChange={(e) => setToken(e.target.value)}
+                      placeholder="123456789:ABCdefGHIjklmNOPQRstuvwxYZ"
+                      className="w-full px-4 py-3 rounded-xl font-mono text-sm"
+                      style={{ background: '#0B0E11', border: '1px solid #2B3139', color: '#EAECEF' }}
+                    />
+                    <div className="text-xs" style={{ color: '#848E9C' }}>
+                      {zh ? 'Token 格式：数字:字母数字串，如 123456789:ABCdef...' : 'Format: numbers:alphanumeric, e.g. 123456789:ABCdef...'}
+                    </div>
+                  </div>
+
+                  <ModelSelector />
+
+                  <button
+                    onClick={handleSaveToken}
+                    disabled={isSaving || !token.trim()}
+                    className="w-full flex items-center justify-center gap-2 px-4 py-3 rounded-xl text-sm font-bold transition-all hover:scale-[1.02] disabled:opacity-50 disabled:cursor-not-allowed"
+                    style={{ background: '#2AABEE', color: '#000' }}
+                  >
+                    {isSaving
+                      ? (zh ? '保存中...' : 'Saving...')
+                      : (<>{zh ? '保存并继续' : 'Save & Continue'} <ArrowRight className="w-4 h-4" /></>)
+                    }
+                  </button>
+                </div>
+              )}
+
+              {/* Step 1: Send /start to activate */}
+              {step === 1 && (
+                <div className="space-y-5">
+                  <div
+                    className="p-4 rounded-xl space-y-3"
+                    style={{ background: 'rgba(14, 203, 129, 0.1)', border: '1px solid rgba(14, 203, 129, 0.3)' }}
+                  >
+                    <div className="flex items-start gap-3">
+                      <span className="text-2xl">📱</span>
+                      <div>
+                        <div className="font-semibold mb-1" style={{ color: '#0ECB81' }}>
+                          {zh ? '第二步：向你的 Bot 发送 /start' : 'Step 2: Send /start to your Bot'}
+                        </div>
+                        <div className="text-xs space-y-1" style={{ color: '#848E9C' }}>
+                          <div>1. {zh ? '在 Telegram 中搜索你刚创建的 Bot' : 'Search for your newly created Bot in Telegram'}</div>
+                          <div>2. {zh ? '点击 Start 或发送' : 'Click Start or send'} <code className="text-green-400">/start</code></div>
+                          <div>3. {zh ? 'Bot 会自动绑定到你的账号' : 'Bot will automatically bind to your account'}</div>
+                        </div>
+                      </div>
+                    </div>
+                  </div>
+
+                  {config?.token_masked && (
+                    <div
+                      className="p-3 rounded-xl flex items-center gap-3"
+                      style={{ background: '#0B0E11', border: '1px solid #2B3139' }}
+                    >
+                      <div className="w-2 h-2 rounded-full bg-yellow-500 animate-pulse flex-shrink-0" />
+                      <div>
+                        <div className="text-xs font-mono" style={{ color: '#848E9C' }}>
+                          {zh ? '当前 Token' : 'Current Token'}
+                        </div>
+                        <div className="text-sm font-mono" style={{ color: '#EAECEF' }}>
+                          {config.token_masked}
+                        </div>
+                      </div>
+                    </div>
+                  )}
+
+                  <div
+                    className="p-3 rounded-xl text-center"
+                    style={{ background: 'rgba(240, 185, 11, 0.08)', border: '1px solid rgba(240, 185, 11, 0.2)' }}
+                  >
+                    <div className="text-xs" style={{ color: '#F0B90B' }}>
+                      {zh
+                        ? '⏳ 等待你发送 /start... 发送后刷新页面查看状态'
+                        : '⏳ Waiting for you to send /start... Refresh page after sending'}
+                    </div>
+                  </div>
+
+                  <div className="flex gap-3">
+                    <button
+                      onClick={() => { setStep(0); setToken('') }}
+                      className="flex-1 px-4 py-3 rounded-xl text-sm font-semibold transition-all hover:bg-white/5"
+                      style={{ background: '#2B3139', color: '#848E9C' }}
+                    >
+                      {zh ? '重新配置 Token' : 'Reconfigure Token'}
+                    </button>
+                    <button
+                      onClick={async () => {
+                        try {
+                          const updated = await api.getTelegramConfig()
+                          setConfig(updated)
+                          if (updated.is_bound) {
+                            setStep(2)
+                            toast.success(zh ? '绑定成功！' : 'Bound successfully!')
+                          } else {
+                            toast.info(zh ? '尚未收到 /start，请先向 Bot 发送 /start' : 'No /start received yet. Please send /start to your Bot first')
+                          }
+                        } catch {
+                          toast.error(zh ? '检查失败' : 'Check failed')
+                        }
+                      }}
+                      className="flex-1 flex items-center justify-center gap-2 px-4 py-3 rounded-xl text-sm font-bold transition-all hover:scale-[1.02]"
+                      style={{ background: '#0ECB81', color: '#000' }}
+                    >
+                      <Check className="w-4 h-4" />
+                      {zh ? '检查绑定状态' : 'Check Status'}
+                    </button>
+                  </div>
+                </div>
+              )}
+
+              {/* Step 2: Bound & active */}
+              {step === 2 && (
+                <div className="space-y-5">
+                  <div
+                    className="p-5 rounded-xl text-center space-y-3"
+                    style={{ background: 'rgba(14, 203, 129, 0.1)', border: '1px solid rgba(14, 203, 129, 0.3)' }}
+                  >
+                    <div className="text-4xl">🎉</div>
+                    <div className="font-bold text-lg" style={{ color: '#0ECB81' }}>
+                      {zh ? 'Telegram Bot 已绑定！' : 'Telegram Bot is Active!'}
+                    </div>
+                    <div className="text-xs" style={{ color: '#848E9C' }}>
+                      {zh
+                        ? '你现在可以通过 Telegram 用自然语言控制交易系统'
+                        : 'You can now control the trading system via natural language in Telegram'}
+                    </div>
+                  </div>
+
+                  {config?.token_masked && (
+                    <div
+                      className="p-3 rounded-xl flex items-center gap-3"
+                      style={{ background: '#0B0E11', border: '1px solid #2B3139' }}
+                    >
+                      <div className="w-2 h-2 rounded-full bg-green-500 flex-shrink-0" />
+                      <div className="min-w-0">
+                        <div className="text-xs font-mono" style={{ color: '#848E9C' }}>
+                          {zh ? 'Bot Token' : 'Bot Token'}
+                        </div>
+                        <div className="text-sm font-mono truncate" style={{ color: '#EAECEF' }}>
+                          {config.token_masked}
+                        </div>
+                      </div>
+                    </div>
+                  )}
+
+                  {/* AI Model selector — works on active bot */}
+                  <BoundModelSelector
+                    zh={zh}
+                    models={models}
+                    currentModelId={config?.model_id ?? ''}
+                    onSaved={(modelId) => {
+                      setConfig((prev) => prev ? { ...prev, model_id: modelId } : prev)
+                    }}
+                  />
+
+                  {/* What you can do */}
+                  <div
+                    className="p-4 rounded-xl space-y-2"
+                    style={{ background: '#0B0E11', border: '1px solid #2B3139' }}
+                  >
+                    <div className="text-xs font-semibold uppercase tracking-wide mb-2" style={{ color: '#848E9C' }}>
+                      {zh ? '支持的命令' : 'Supported Commands'}
+                    </div>
+                    {[
+                      { cmd: '/help', desc: zh ? '查看所有命令' : 'Show all commands' },
+                      { cmd: zh ? '查看交易员状态' : 'Show trader status', desc: zh ? '自然语言查询' : 'Natural language' },
+                      { cmd: zh ? '启动/停止交易员' : 'Start/stop trader', desc: zh ? '自然语言控制' : 'Natural language control' },
+                      { cmd: zh ? '查看持仓' : 'View positions', desc: zh ? '实时持仓查询' : 'Real-time position query' },
+                      { cmd: zh ? '配置策略' : 'Configure strategy', desc: zh ? '修改交易策略' : 'Modify trading strategy' },
+                    ].map((item, i) => (
+                      <div key={i} className="flex items-start gap-2 text-xs">
+                        <code className="font-mono px-1.5 py-0.5 rounded flex-shrink-0" style={{ background: '#1E2329', color: '#2AABEE' }}>
+                          {item.cmd}
+                        </code>
+                        <span style={{ color: '#848E9C' }}>{item.desc}</span>
+                      </div>
+                    ))}
+                  </div>
+
+                  <div className="flex gap-3">
+                    <button
+                      onClick={handleUnbind}
+                      disabled={isUnbinding}
+                      className="flex-1 flex items-center justify-center gap-2 px-4 py-3 rounded-xl text-sm font-semibold transition-all hover:bg-white/5 disabled:opacity-50"
+                      style={{ background: 'rgba(246, 70, 93, 0.1)', color: '#F6465D', border: '1px solid rgba(246, 70, 93, 0.2)' }}
+                    >
+                      <Unlink className="w-4 h-4" />
+                      {isUnbinding ? (zh ? '解绑中...' : 'Unbinding...') : (zh ? '解绑账号' : 'Unbind Account')}
+                    </button>
+                    <button
+                      onClick={onClose}
+                      className="flex-1 px-4 py-3 rounded-xl text-sm font-bold transition-all hover:scale-[1.02]"
+                      style={{ background: '#2AABEE', color: '#000' }}
+                    >
+                      {zh ? '完成' : 'Done'}
+                    </button>
+                  </div>
+                </div>
+              )}
+            </>
+          )}
+        </div>
+      </div>
+    </div>
+  )
+}
+
+// BoundModelSelector — lets the user change the AI model when the bot is already active.
+// It updates the model_id without requiring re-entry of the bot token.
+function BoundModelSelector({
+  zh,
+  models,
+  currentModelId,
+  onSaved,
+}: {
+  zh: boolean
+  models: AIModel[]
+  currentModelId: string
+  onSaved: (modelId: string) => void
+}) {
+  const [modelId, setModelId] = useState(currentModelId)
+  const [isSaving, setIsSaving] = useState(false)
+
+  // Keep in sync if parent updates
+  useEffect(() => { setModelId(currentModelId) }, [currentModelId])
+
+  const handleSave = async () => {
+    setIsSaving(true)
+    try {
+      // POST /api/telegram/model — lightweight endpoint for model-only update
+      await api.updateTelegramModel(modelId)
+      onSaved(modelId)
+      toast.success(zh ? 'AI 模型已更新' : 'AI model updated')
+    } catch {
+      toast.error(zh ? '更新失败' : 'Update failed')
+    } finally {
+      setIsSaving(false)
+    }
+  }
+
+  if (models.length === 0) return null
+
+  return (
+    <div className="space-y-2">
+      <label className="text-sm font-semibold" style={{ color: '#EAECEF' }}>
+        {zh ? 'AI 模型（用于自然语言解析）' : 'AI Model (for natural language)'}
+      </label>
+      <div className="flex gap-2">
+        <select
+          value={modelId}
+          onChange={(e) => setModelId(e.target.value)}
+          className="flex-1 px-3 py-2.5 rounded-xl text-sm appearance-none"
+          style={{
+            background: '#0B0E11',
+            border: '1px solid #2B3139',
+            color: modelId ? '#EAECEF' : '#848E9C',
+          }}
+        >
+          <option value="">{zh ? '— 自动选择' : '— Auto-select'}</option>
+          {models.map((m) => (
+            <option key={m.id} value={m.id}>
+              {m.name}{m.customModelName ? ` · ${m.customModelName}` : ''}
+            </option>
+          ))}
+        </select>
+        <button
+          onClick={handleSave}
+          disabled={isSaving || modelId === currentModelId}
+          className="px-4 py-2.5 rounded-xl text-sm font-bold transition-all hover:scale-[1.02] disabled:opacity-40 disabled:cursor-not-allowed"
+          style={{ background: '#F0B90B', color: '#000', whiteSpace: 'nowrap' }}
+        >
+          {isSaving ? '...' : (zh ? '保存' : 'Save')}
+        </button>
+      </div>
+    </div>
+  )
+}

web/src/contexts/AuthContext.tsx

@@ -16,12 +16,6 @@ interface AuthContextType {
   ) => Promise<{
     success: boolean
     message?: string
-    userID?: string
-    requiresOTP?: boolean
-    requiresOTPSetup?: boolean
-    qrCodeURL?: string
-    otpSecret?: string
-    email?: string
   }>
   loginAdmin: (password: string) => Promise<{
     success: boolean
@@ -31,25 +25,10 @@ interface AuthContextType {
     email: string,
     password: string,
     betaCode?: string
-  ) => Promise<{
-    success: boolean
-    message?: string
-    userID?: string
-    otpSecret?: string
-    qrCodeURL?: string
-  }>
-  verifyOTP: (
-    userID: string,
-    otpCode: string
-  ) => Promise<{ success: boolean; message?: string }>
-  completeRegistration: (
-    userID: string,
-    otpCode: string
   ) => Promise<{ success: boolean; message?: string }>
   resetPassword: (
     email: string,
-    newPassword: string,
-    otpCode: string
+    newPassword: string
   ) => Promise<{ success: boolean; message?: string }>
   logout: () => void
   isLoading: boolean
@@ -123,38 +102,37 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
       const data = await response.json()
 
       if (response.ok) {
-        // Check for OTP setup required (incomplete registration)
-        if (data.requires_otp_setup) {
-          return {
-            success: true,
-            userID: data.user_id,
-            requiresOTPSetup: true,
-            message: data.message,
-            qrCodeURL: data.qr_code_url,
-            otpSecret: data.otp_secret,
-            email: data.email
-          }
-        }
-        // Check for OTP verification required (normal login flow)
-        if (data.requires_otp) {
-          return {
-            success: true,
-            userID: data.user_id,
-            requiresOTP: true,
-            message: data.message,
-            qrCodeURL: data.qr_code_url,
-            otpSecret: data.otp_secret
+        if (data.token) {
+          // Reset 401 flag on successful login
+          reset401Flag()
+
+          const userInfo = { id: data.user_id, email: data.email }
+          setToken(data.token)
+          setUser(userInfo)
+          localStorage.setItem('auth_token', data.token)
+          localStorage.setItem('auth_user', JSON.stringify(userInfo))
+
+          // Check and redirect to returnUrl if exists
+          const returnUrl = sessionStorage.getItem('returnUrl')
+          if (returnUrl) {
+            sessionStorage.removeItem('returnUrl')
+            window.history.pushState({}, '', returnUrl)
+            window.dispatchEvent(new PopStateEvent('popstate'))
+          } else {
+            // 跳转到配置页面
+            window.history.pushState({}, '', '/traders')
+            window.dispatchEvent(new PopStateEvent('popstate'))
           }
+
+          return { success: true, message: data.message }
         }
+
         // Unexpected success response
-        return { success: false, message: '登录响应异常' }
+        return { success: false, message: data.message || '登录响应异常' }
       } else {
         return {
           success: false,
           message: data.error,
-          qrCodeURL: data.qr_code_url,
-          otpSecret: data.otp_secret,
-          userID: data.user_id
         }
       }
     } catch (error) {
@@ -219,18 +197,36 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
 
     try {
       const result = await httpClient.post<{
+        token: string
         user_id: string
-        otp_secret: string
-        qr_code_url: string
+        email: string
         message: string
       }>('/api/register', requestBody)
 
       if (result.success && result.data) {
+        // Reset 401 flag on successful login
+        reset401Flag()
+
+        const userInfo = { id: result.data.user_id, email: result.data.email }
+        setToken(result.data.token)
+        setUser(userInfo)
+        localStorage.setItem('auth_token', result.data.token)
+        localStorage.setItem('auth_user', JSON.stringify(userInfo))
+
+        // Check and redirect to returnUrl if exists
+        const returnUrl = sessionStorage.getItem('returnUrl')
+        if (returnUrl) {
+          sessionStorage.removeItem('returnUrl')
+          window.history.pushState({}, '', returnUrl)
+          window.dispatchEvent(new PopStateEvent('popstate'))
+        } else {
+          // 跳转到配置页面
+          window.history.pushState({}, '', '/traders')
+          window.dispatchEvent(new PopStateEvent('popstate'))
+        }
+
         return {
           success: true,
-          userID: result.data.user_id,
-          otpSecret: result.data.otp_secret,
-          qrCodeURL: result.data.qr_code_url,
           message: result.message || result.data.message,
         }
       }
@@ -252,99 +248,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
     }
   }
 
-  const verifyOTP = async (userID: string, otpCode: string) => {
-    try {
-      const response = await fetch('/api/verify-otp', {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify({ user_id: userID, otp_code: otpCode }),
-      })
-
-      const data = await response.json()
-
-      if (response.ok) {
-        // Reset 401 flag on successful login
-        reset401Flag()
-
-        // 登录成功，保存token和用户信息
-        const userInfo = { id: data.user_id, email: data.email }
-        setToken(data.token)
-        setUser(userInfo)
-        localStorage.setItem('auth_token', data.token)
-        localStorage.setItem('auth_user', JSON.stringify(userInfo))
-
-        // Check and redirect to returnUrl if exists
-        const returnUrl = sessionStorage.getItem('returnUrl')
-        if (returnUrl) {
-          sessionStorage.removeItem('returnUrl')
-          window.history.pushState({}, '', returnUrl)
-          window.dispatchEvent(new PopStateEvent('popstate'))
-        } else {
-          // 跳转到配置页面
-          window.history.pushState({}, '', '/traders')
-          window.dispatchEvent(new PopStateEvent('popstate'))
-        }
-
-        return { success: true, message: data.message }
-      } else {
-        return { success: false, message: data.error }
-      }
-    } catch (error) {
-      return { success: false, message: 'OTP验证失败，请重试' }
-    }
-  }
-
-  const completeRegistration = async (userID: string, otpCode: string) => {
-    try {
-      const response = await fetch('/api/complete-registration', {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify({ user_id: userID, otp_code: otpCode }),
-      })
-
-      const data = await response.json()
-
-      if (response.ok) {
-        // Reset 401 flag on successful login
-        reset401Flag()
-
-        // 注册完成，自动登录
-        const userInfo = { id: data.user_id, email: data.email }
-        setToken(data.token)
-        setUser(userInfo)
-        localStorage.setItem('auth_token', data.token)
-        localStorage.setItem('auth_user', JSON.stringify(userInfo))
-
-        // Check and redirect to returnUrl if exists
-        const returnUrl = sessionStorage.getItem('returnUrl')
-        if (returnUrl) {
-          sessionStorage.removeItem('returnUrl')
-          window.history.pushState({}, '', returnUrl)
-          window.dispatchEvent(new PopStateEvent('popstate'))
-        } else {
-          // 跳转到配置页面
-          window.history.pushState({}, '', '/traders')
-          window.dispatchEvent(new PopStateEvent('popstate'))
-        }
-
-        return { success: true, message: data.message }
-      } else {
-        return { success: false, message: data.error }
-      }
-    } catch (error) {
-      return { success: false, message: '注册完成失败，请重试' }
-    }
-  }
-
-  const resetPassword = async (
-    email: string,
-    newPassword: string,
-    otpCode: string
-  ) => {
+  const resetPassword = async (email: string, newPassword: string) => {
     try {
       const response = await fetch('/api/reset-password', {
         method: 'POST',
@@ -354,7 +258,6 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
         body: JSON.stringify({
           email,
           new_password: newPassword,
-          otp_code: otpCode,
         }),
       })
 
@@ -394,8 +297,6 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
         login,
         loginAdmin,
         register,
-        verifyOTP,
-        completeRegistration,
         resetPassword,
         logout,
         isLoading,

web/src/contexts/LanguageContext.tsx

@@ -14,7 +14,7 @@ export function LanguageProvider({ children }: { children: ReactNode }) {
   // Initialize language from localStorage or default to English
   const [language, setLanguage] = useState<Language>(() => {
     const saved = localStorage.getItem('language')
-    return saved === 'en' || saved === 'zh' ? saved : 'en'
+    return saved === 'en' || saved === 'zh' || saved === 'id' ? saved : 'en'
   })
 
   // Save language to localStorage whenever it changes

web/src/i18n/strategy-translations.ts

@@ -0,0 +1,300 @@
+// NOFX i18n Consolidation - Translation Keys
+// Generated by Atlas Orchestrator
+// Branch: feat/i18n-consolidation-patch
+// Purpose: Centralize scattered i18n strings from 8 strategy components
+
+// ============================================================================
+// COIN SOURCE TRANSLATIONS (40 keys)
+// ============================================================================
+export const coinSource = {
+  sourceType: { zh: '数据来源类型', en: 'Source Type', es: 'Tipo de Fuente' },
+  static: { zh: '静态列表', en: 'Static List', es: 'Lista Estática' },
+  ai500: { zh: 'AI500 数据源', en: 'AI500 Data Provider', es: 'Proveedor AI500' },
+  oi_top: { zh: 'OI 持仓增加', en: 'OI Increase', es: 'Aumento OI' },
+  oi_low: { zh: 'OI 持仓减少', en: 'OI Decrease', es: 'Disminución OI' },
+  mixed: { zh: '混合模式', en: 'Mixed Mode', es: 'Modo Mixto' },
+  staticCoins: { zh: '自定义币种', en: 'Custom Coins', es: 'Monedas Personalizadas' },
+  addCoin: { zh: '添加币种', en: 'Add Coin', es: 'Agregar Moneda' },
+  useAI500: { zh: '启用 AI500 数据源', en: 'Enable AI500 Data Provider', es: 'Habilitar AI500' },
+  ai500Limit: { zh: '数量上限', en: 'Limit', es: 'Límite' },
+  useOITop: { zh: '启用 OI 持仓增加榜', en: 'Enable OI Increase', es: 'Habilitar Aumento OI' },
+  oiTopLimit: { zh: '数量上限', en: 'Limit', es: 'Límite' },
+  useOILow: { zh: '启用 OI 持仓减少榜', en: 'Enable OI Decrease', es: 'Habilitar Disminución OI' },
+  oiLowLimit: { zh: '数量上限', en: 'Limit', es: 'Límite' },
+  staticDesc: { zh: '手动指定交易币种列表', en: 'Manually specify trading coins', es: 'Especificar monedas manualmente' },
+  mixedConfig: { zh: '组合数据源配置', en: 'Combined Sources Configuration', es: 'Configuración Combinada' },
+  mixedSummary: { zh: '已选组合', en: 'Selected Sources', es: 'Fuentes Seleccionadas' },
+  maxCoins: { zh: '最多', en: 'Up to', es: 'Hasta' },
+  coins: { zh: '个币种', en: 'coins', es: 'monedas' },
+  dataSourceConfig: { zh: '数据源配置', en: 'Data Source Configuration', es: 'Configuración de Fuente' },
+  excludedCoins: { zh: '排除币种', en: 'Excluded Coins', es: 'Monedas Excluidas' },
+  excludedCoinsDesc: { zh: '这些币种将从所有数据源中排除，不会被交易', en: 'These coins will be excluded from all sources and will not be traded', es: 'Estas monedas serán excluidas de todas las fuentes' },
+  addExcludedCoin: { zh: '添加排除', en: 'Add Excluded', es: 'Agregar Excluida' },
+  nofxosNote: { zh: '使用 NofxOS API Key（在指标配置中设置）', en: 'Uses NofxOS API Key (set in Indicators config)', es: 'Usa API Key de NofxOS' },
+};
+
+// ============================================================================
+// GRID CONFIG TRANSLATIONS (60+ keys)
+// ============================================================================
+export const gridConfig = {
+  tradingPair: { zh: '交易设置', en: 'Trading Setup', es: 'Configuración de Trading' },
+  gridParameters: { zh: '网格参数', en: 'Grid Parameters', es: 'Parámetros de Grid' },
+  priceBounds: { zh: '价格边界', en: 'Price Bounds', es: 'Límites de Precio' },
+  riskControl: { zh: '风险控制', en: 'Risk Control', es: 'Control de Riesgo' },
+  symbol: { zh: '交易对', en: 'Trading Pair', es: 'Par de Trading' },
+  symbolDesc: { zh: '选择要进行网格交易的交易对', en: 'Select trading pair for grid trading', es: 'Seleccionar par para grid trading' },
+  totalInvestment: { zh: '投资金额 (USDT)', en: 'Investment (USDT)', es: 'Inversión (USDT)' },
+  totalInvestmentDesc: { zh: '网格策略的总投资金额', en: 'Total investment for grid strategy', es: 'Inversión total' },
+  leverage: { zh: '杠杆倍数', en: 'Leverage', es: 'Apalancamiento' },
+  leverageDesc: { zh: '交易使用的杠杆倍数 (1-5)', en: 'Leverage for trading (1-5)', es: 'Apalancamiento (1-5)' },
+  gridCount: { zh: '网格数量', en: 'Grid Count', es: 'Cantidad de Grids' },
+  gridCountDesc: { zh: '网格层级数量 (5-50)', en: 'Number of grid levels (5-50)', es: 'Niveles (5-50)' },
+  distribution: { zh: '资金分配方式', en: 'Distribution', es: 'Distribución' },
+  distributionDesc: { zh: '网格层级的资金分配方式', en: 'Fund allocation across grid levels', es: 'Asignación de fondos' },
+  uniform: { zh: '均匀分配', en: 'Uniform', es: 'Uniforme' },
+  gaussian: { zh: '高斯分配 (推荐)', en: 'Gaussian (Recommended)', es: 'Gaussiana (Recomendado)' },
+  pyramid: { zh: '金字塔分配', en: 'Pyramid', es: 'Pirámide' },
+  useAtrBounds: { zh: '自动计算边界 (ATR)', en: 'Auto-calculate Bounds (ATR)', es: 'Calcular Límites (ATR)' },
+  useAtrBoundsDesc: { zh: '基于 ATR 自动计算网格上下边界', en: 'Auto-calculate bounds based on ATR', es: 'Calcular límites automáticamente' },
+  atrMultiplier: { zh: 'ATR 倍数', en: 'ATR Multiplier', es: 'Multiplicador ATR' },
+  atrMultiplierDesc: { zh: '边界距离当前价格的 ATR 倍数', en: 'ATR multiplier for bounds distance', es: 'Distancia en ATR' },
+  upperPrice: { zh: '上边界价格', en: 'Upper Price', es: 'Precio Superior' },
+  upperPriceDesc: { zh: '网格上边界价格 (0=自动计算)', en: 'Grid upper bound (0=auto)', es: 'Límite superior (0=auto)' },
+  lowerPrice: { zh: '下边界价格', en: 'Lower Price', es: 'Precio Inferior' },
+  lowerPriceDesc: { zh: '网格下边界价格 (0=自动计算)', en: 'Grid lower bound (0=auto)', es: 'Límite inferior (0=auto)' },
+  maxDrawdown: { zh: '最大回撤 (%)', en: 'Max Drawdown (%)', es: 'Máximo Drawdown (%)' },
+  maxDrawdownDesc: { zh: '触发紧急退出的最大回撤百分比', en: 'Max drawdown before emergency exit', es: 'Drawdown máximo' },
+  stopLoss: { zh: '止损 (%)', en: 'Stop Loss (%)', es: 'Stop Loss (%)' },
+  stopLossDesc: { zh: '单仓位止损百分比', en: 'Stop loss per position', es: 'Stop loss por posición' },
+  dailyLossLimit: { zh: '日损失限制 (%)', en: 'Daily Loss Limit (%)', es: 'Límite Diario (%)' },
+  dailyLossLimitDesc: { zh: '每日最大亏损百分比', en: 'Maximum daily loss percentage', es: 'Pérdida diaria máxima' },
+  useMakerOnly: { zh: '仅使用 Maker 订单', en: 'Maker Only Orders', es: 'Solo Maker' },
+  useMakerOnlyDesc: { zh: '使用限价单以降低手续费', en: 'Use limit orders for lower fees', es: 'Órdenes límite para menos fees' },
+  directionAdjust: { zh: '方向自动调整', en: 'Direction Auto-Adjust', es: 'Ajuste Automático de Dirección' },
+  enableDirectionAdjust: { zh: '启用方向调整', en: 'Enable Direction Adjust', es: 'Habilitar Ajuste' },
+  enableDirectionAdjustDesc: { zh: '根据箱体突破自动调整网格方向', en: 'Auto-adjust grid direction based on box breakouts', es: 'Ajustar según breaks' },
+  directionBiasRatio: { zh: '偏向强度', en: 'Bias Strength', es: 'Intensidad de Sesgo' },
+  directionBiasRatioDesc: { zh: '偏多/偏空模式的强度', en: 'Strength for long_bias/short_bias modes', es: 'Fuerza del sesgo' },
+  directionBiasExplain: { zh: '偏多模式：X%买 + (100-X)%卖 | 偏空模式：(100-X)%买 + X%卖', en: 'Long bias: X% buy + (100-X)% sell | Short bias: (100-X)% buy + X% sell', es: 'Sesgo largo: X% compra | Sesgo corto: X% venta' },
+  directionExplain: { zh: '短期箱体突破 → 偏向，中期箱体突破 → 全仓，价格回归 → 逐步恢复中性', en: 'Short box breakout → bias, Mid box breakout → full, Price return → gradually recover to neutral', es: 'Break corto → sesgo, Break medio → full' },
+  directionModes: { zh: '方向模式说明', en: 'Direction Modes', es: 'Descripción de Modos' },
+  modeNeutral: { zh: '中性：50%买 + 50%卖（默认）', en: 'Neutral: 50% buy + 50% sell (default)', es: 'Neutral: 50% compra + 50% venta' },
+  modeLongBias: { zh: '偏多：X%买 + (100-X)%卖', en: 'Long Bias: X% buy + (100-X)% sell', es: 'Sesgo Largo: X% compra' },
+  modeLong: { zh: '全多：100%买 + 0%卖', en: 'Long: 100% buy + 0% sell', es: 'Largo: 100% compra' },
+  modeShortBias: { zh: '偏空：(100-X)%买 + X%卖', en: 'Short Bias: (100-X)% buy + X% sell', es: 'Sesgo Corto: X% venta' },
+  modeShort: { zh: '全空：0%买 + 100%卖', en: 'Short: 0% buy + 100% sell', es: 'Corto: 100% venta' },
+};
+
+// ============================================================================
+// GRID RISK TRANSLATIONS (50 keys)
+// ============================================================================
+export const gridRisk = {
+  gridRisk: { zh: '网格风控', en: 'Grid Risk', es: 'Riesgo de Grid' },
+  leverageInfo: { zh: '杠杆', en: 'Leverage', es: 'Apalancamiento' },
+  positionInfo: { zh: '仓位', en: 'Position', es: 'Posición' },
+  liquidationInfo: { zh: '清算', en: 'Liquidation', es: 'Liquidación' },
+  marketState: { zh: '市场', en: 'Market', es: 'Mercado' },
+  boxState: { zh: '箱体', en: 'Box', es: 'Caja' },
+  currentLeverage: { zh: '当前', en: 'Current', es: 'Actual' },
+  effectiveLeverage: { zh: '有效', en: 'Effective', es: 'Efectivo' },
+  recommendedLeverage: { zh: '建议', en: 'Recommend', es: 'Recomendado' },
+  currentPosition: { zh: '当前', en: 'Current', es: 'Actual' },
+  maxPosition: { zh: '最大', en: 'Max', es: 'Máximo' },
+  positionPercent: { zh: '占比', en: 'Usage', es: 'Uso' },
+  liquidationPrice: { zh: '清算价', en: 'Liq Price', es: 'Precio Liquidación' },
+  liquidationDistance: { zh: '距离', en: 'Distance', es: 'Distancia' },
+  regimeLevel: { zh: '波动', en: 'Regime', es: 'Regulación' },
+  currentPrice: { zh: '价格', en: 'Price', es: 'Precio' },
+  breakoutLevel: { zh: '突破', en: 'Breakout', es: 'Breakout' },
+  breakoutDirection: { zh: '方向', en: 'Direction', es: 'Dirección' },
+  shortBox: { zh: '短期', en: 'Short', es: 'Corto' },
+  midBox: { zh: '中期', en: 'Mid', es: 'Medio' },
+  longBox: { zh: '长期', en: 'Long', es: 'Largo' },
+  narrow: { zh: '窄幅', en: 'Narrow', es: 'Estrecho' },
+  standard: { zh: '标准', en: 'Standard', es: 'Estándar' },
+  wide: { zh: '宽幅', en: 'Wide', es: 'Ancho' },
+  volatile: { zh: '剧烈', en: 'Volatile', es: 'Volátil' },
+  trending: { zh: '趋势', en: 'Trending', es: 'Tendencia' },
+  none: { zh: '无', en: 'None', es: 'Ninguno' },
+  short: { zh: '短期', en: 'Short', es: 'Corto' },
+  mid: { zh: '中期', en: 'Mid', es: 'Medio' },
+  long: { zh: '长期', en: 'Long', es: 'Largo' },
+  up: { zh: '↑', en: '↑', es: '↑' },
+  down: { zh: '↓', en: '↓', es: '↓' },
+  loading: { zh: '加载中...', en: 'Loading...', es: 'Cargando...' },
+  error: { zh: '加载失败', en: 'Load Failed', es: 'Error al Cargar' },
+  noData: { zh: '暂无数据', en: 'No Data', es: 'Sin Datos' },
+};
+
+// ============================================================================
+// RISK CONTROL TRANSLATIONS (25+ keys)
+// ============================================================================
+export const riskControl = {
+  positionLimits: { zh: '仓位限制', en: 'Position Limits', es: 'Límites de Posición' },
+  maxPositions: { zh: '最大持仓数量', en: 'Max Positions', es: 'Máximo de Posiciones' },
+  maxPositionsDesc: { zh: '同时持有的最大币种数量', en: 'Maximum coins held simultaneously', es: 'Monedas máximas simultáneas' },
+  tradingLeverage: { zh: '交易杠杆（交易所杠杆）', en: 'Trading Leverage (Exchange)', es: 'Apalancamiento (Exchange)' },
+  btcEthLeverage: { zh: 'BTC/ETH 交易杠杆', en: 'BTC/ETH Trading Leverage', es: 'BTC/ETH Apalancamiento' },
+  btcEthLeverageDesc: { zh: '交易所开仓使用的杠杆倍数', en: 'Exchange leverage for opening positions', es: 'Apalancamiento del exchange' },
+  altcoinLeverage: { zh: '山寨币交易杠杆', en: 'Altcoin Trading Leverage', es: 'Apalancamiento Altcoins' },
+  altcoinLeverageDesc: { zh: '交易所开仓使用的杠杆倍数', en: 'Exchange leverage for opening positions', es: 'Apalancamiento del exchange' },
+  positionValueRatio: { zh: '仓位价值比例（代码强制）', en: 'Position Value Ratio (CODE ENFORCED)', es: 'Ratio de Valor (CÓDIGO)' },
+  positionValueRatioDesc: { zh: '单仓位名义价值 / 账户净值，由代码强制执行', en: 'Position notional value / equity, enforced by code', es: 'Valor nominal / equity' },
+  btcEthPositionValueRatio: { zh: 'BTC/ETH 仓位价值比例', en: 'BTC/ETH Position Value Ratio', es: 'BTC/ETH Ratio de Valor' },
+  btcEthPositionValueRatioDesc: { zh: '单仓最大名义价值 = 净值 × 此值（代码强制）', en: 'Max position value = equity × this ratio (CODE ENFORCED)', es: 'Valor máximo = equity × ratio' },
+  altcoinPositionValueRatio: { zh: '山寨币仓位价值比例', en: 'Altcoin Position Value Ratio', es: 'Altcoin Ratio de Valor' },
+  altcoinPositionValueRatioDesc: { zh: '单仓最大名义价值 = 净值 × 此值（代码强制）', en: 'Max position value = equity × this ratio (CODE ENFORCED)', es: 'Valor máximo = equity × ratio' },
+  riskParameters: { zh: '风险参数', en: 'Risk Parameters', es: 'Parámetros de Riesgo' },
+  minRiskReward: { zh: '最小风险回报比', en: 'Min Risk/Reward Ratio', es: 'Ratio Riesgo/Recompensa Mínimo' },
+  minRiskRewardDesc: { zh: '开仓要求的最低盈亏比', en: 'Minimum profit ratio for entry', es: 'Ratio mínimo para entrada' },
+  maxMarginUsage: { zh: '最大保证金使用率（代码强制）', en: 'Max Margin Usage (CODE ENFORCED)', es: 'Uso Máximo de Margen (CÓDIGO)' },
+  maxMarginUsageDesc: { zh: '保证金使用率上限，由代码强制执行', en: 'Maximum margin utilization, enforced by code', es: 'Límite de margen' },
+  entryRequirements: { zh: '开仓要求', en: 'Entry Requirements', es: 'Requisitos de Entrada' },
+  minPositionSize: { zh: '最小开仓金额', en: 'Min Position Size', es: 'Tamaño Mínimo' },
+  minPositionSizeDesc: { zh: 'USDT 最小名义价值', en: 'Minimum notional value in USDT', es: 'Valor mínimo en USDT' },
+  minConfidence: { zh: '最小信心度', en: 'Min Confidence', es: 'Confianza Mínima' },
+  minConfidenceDesc: { zh: 'AI 开仓信心度阈值', en: 'AI confidence threshold for entry', es: 'Umbral de confianza AI' },
+};
+
+// ============================================================================
+// PROMPT SECTIONS TRANSLATIONS (12+ keys)
+// ============================================================================
+export const promptSections = {
+  promptSections: { zh: 'System Prompt 自定义', en: 'System Prompt Customization', es: 'Personalización de Prompt' },
+  promptSectionsDesc: { zh: '自定义 AI 行为和决策逻辑（输出格式和风控规则不可修改）', en: 'Customize AI behavior and decision logic (output format and risk rules are fixed)', es: 'Personalizar comportamiento AI' },
+  roleDefinition: { zh: '角色定义', en: 'Role Definition', es: 'Definición de Rol' },
+  roleDefinitionDesc: { zh: '定义 AI 的身份和核心目标', en: 'Define AI identity and core objectives', es: 'Definir identidad AI' },
+  tradingFrequency: { zh: '交易频率', en: 'Trading Frequency', es: 'Frecuencia de Trading' },
+  tradingFrequencyDesc: { zh: '设定交易频率预期和过度交易警告', en: 'Set trading frequency expectations and overtrading warnings', es: 'Establecer frecuencia' },
+  entryStandards: { zh: '开仓标准', en: 'Entry Standards', es: 'Estándares de Entrada' },
+  entryStandardsDesc: { zh: '定义开仓信号条件和避免事项', en: 'Define entry signal conditions and avoidances', es: 'Definir señales de entrada' },
+  decisionProcess: { zh: '决策流程', en: 'Decision Process', es: 'Proceso de Decisión' },
+  decisionProcessDesc: { zh: '设定决策步骤和思考流程', en: 'Set decision steps and thinking process', es: 'Establecer proceso' },
+  resetToDefault: { zh: '重置为默认', en: 'Reset to Default', es: 'Restablecer' },
+  chars: { zh: '字符', en: 'chars', es: 'caracteres' },
+};
+
+// ============================================================================
+// INDICATOR TRANSLATIONS (75+ keys)
+// ============================================================================
+export const indicator = {
+  marketData: { zh: '市场数据', en: 'Market Data', es: 'Datos de Mercado' },
+  marketDataDesc: { zh: 'AI 分析所需的核心价格数据', en: 'Core price data for AI analysis', es: 'Datos de precio esenciales' },
+  technicalIndicators: { zh: '技术指标', en: 'Technical Indicators', es: 'Indicadores Técnicos' },
+  technicalIndicatorsDesc: { zh: '可选的技术分析指标，AI 可自行计算', en: 'Optional indicators, AI can calculate them', es: 'Indicadores opcionales' },
+  marketSentiment: { zh: '市场情绪', en: 'Market Sentiment', es: 'Sentimiento de Mercado' },
+  marketSentimentDesc: { zh: '持仓量、资金费率等市场情绪数据', en: 'OI, funding rate and market sentiment data', es: 'OI, funding rate' },
+  quantData: { zh: '量化数据', en: 'Quant Data', es: 'Datos Quant' },
+  quantDataDesc: { zh: '资金流向、大户动向', en: 'Netflow, whale movements', es: 'Netflow, ballenas' },
+  timeframes: { zh: '时间周期', en: 'Timeframes', es: 'Marcos de Tiempo' },
+  timeframesDesc: { zh: '选择 K 线分析周期，★ 为主周期（双击设置）', en: 'Select K-line timeframes, ★ = primary (double-click)', es: 'Seleccionar timeframes' },
+  klineCount: { zh: 'K 线数量', en: 'K-line Count', es: 'Cantidad de Velas' },
+  scalp: { zh: '超短', en: 'Scalp', es: 'Scalp' },
+  intraday: { zh: '日内', en: 'Intraday', es: 'Intradía' },
+  swing: { zh: '波段', en: 'Swing', es: 'Swing' },
+  position: { zh: '趋势', en: 'Position', es: 'Posición' },
+  rawKlines: { zh: 'OHLCV 原始 K 线', en: 'Raw OHLCV K-lines', es: 'Velas OHLCV' },
+  rawKlinesDesc: { zh: '必须 - 开高低收量原始数据，AI 核心分析依据', en: 'Required - Open/High/Low/Close/Volume data for AI', es: 'Datos esenciales para AI' },
+  required: { zh: '必须', en: 'Required', es: 'Requerido' },
+  ema: { zh: 'EMA 均线', en: 'EMA', es: 'EMA' },
+  emaDesc: { zh: '指数移动平均线', en: 'Exponential Moving Average', es: 'Media Móvil Exponencial' },
+  macd: { zh: 'MACD', en: 'MACD', es: 'MACD' },
+  macdDesc: { zh: '异同移动平均线', en: 'Moving Average Convergence Divergence', es: 'Convergencia/Divergencia' },
+  rsi: { zh: 'RSI', en: 'RSI', es: 'RSI' },
+  rsiDesc: { zh: '相对强弱指标', en: 'Relative Strength Index', es: 'Índice de Fuerza Relativa' },
+  atr: { zh: 'ATR', en: 'ATR', es: 'ATR' },
+  atrDesc: { zh: '真实波幅均值', en: 'Average True Range', es: 'Rango Promedio Verdadero' },
+  boll: { zh: 'BOLL 布林带', en: 'Bollinger Bands', es: 'Bandas de Bollinger' },
+  bollDesc: { zh: '布林带指标（上中下轨）', en: 'Upper/Middle/Lower Bands', es: 'Bandas Superior/Inferior' },
+  volume: { zh: '成交量', en: 'Volume', es: 'Volumen' },
+  volumeDesc: { zh: '交易量分析', en: 'Trading volume analysis', es: 'Análisis de volumen' },
+  oi: { zh: '持仓量', en: 'Open Interest', es: 'Interés Abierto' },
+  oiDesc: { zh: '合约未平仓量', en: 'Futures open interest', es: 'Posiciones abiertas' },
+  fundingRate: { zh: '资金费率', en: 'Funding Rate', es: 'Funding Rate' },
+  fundingRateDesc: { zh: '永续合约资金费率', en: 'Perpetual funding rate', es: 'Rate de perpetuo' },
+  oiRanking: { zh: 'OI 排行', en: 'OI Ranking', es: 'Ranking OI' },
+  oiRankingDesc: { zh: '持仓量增减排行', en: 'OI change ranking', es: 'Cambios de OI' },
+  oiRankingNote: { zh: '显示持仓量增加/减少的币种排行，帮助发现资金流向', en: 'Shows coins with OI increase/decrease, helps identify capital flow', es: 'Identificar flujo de capital' },
+  netflowRanking: { zh: '资金流向', en: 'NetFlow', es: 'Flujo de Fondos' },
+  netflowRankingDesc: { zh: '机构/散户资金流向', en: 'Institution/retail fund flow', es: 'Institucional/Retail' },
+  netflowRankingNote: { zh: '显示机构资金流入/流出排行，散户动向对比，发现聪明钱信号', en: 'Shows institution inflow/outflow ranking, retail flow comparison, Smart Money signals', es: 'Señales de Smart Money' },
+  priceRanking: { zh: '涨跌幅排行', en: 'Price Ranking', es: 'Ranking de Precios' },
+  priceRankingDesc: { zh: '涨跌幅排行榜', en: 'Gainers/losers ranking', es: 'Ganadores/Perdedores' },
+  priceRankingNote: { zh: '显示涨幅/跌幅排行，结合资金流和持仓变化分析趋势强度', en: 'Shows top gainers/losers, combined with fund flow and OI for trend analysis', es: 'Analizar fuerza de tendencia' },
+  priceRankingMulti: { zh: '多周期', en: 'Multi-period', es: 'Multi-período' },
+  duration: { zh: '周期', en: 'Duration', es: 'Duración' },
+  limit: { zh: '数量', en: 'Limit', es: 'Límite' },
+  aiCanCalculate: { zh: '💡 提示：AI 可自行计算这些指标，开启可减少 AI 计算量', en: '💡 Tip: AI can calculate these, enabling reduces AI workload', es: '💡 AI puede calcularlos' },
+  nofxosTitle: { zh: 'NofxOS 量化数据源', en: 'NofxOS Data Provider', es: 'Proveedor NofxOS' },
+  nofxosDesc: { zh: '专业加密货币量化数据服务', en: 'Professional crypto quant data service', es: 'Servicio crypto quant' },
+  nofxosFeatures: { zh: 'AI500 · OI排行 · 资金流向 · 涨跌榜', en: 'AI500 · OI Ranking · Fund Flow · Price Ranking', es: 'AI500 · OI · NetFlow · Ranking' },
+  viewApiDocs: { zh: 'API 文档', en: 'API Docs', es: 'Docs API' },
+  apiKey: { zh: 'API Key', en: 'API Key', es: 'API Key' },
+  apiKeyPlaceholder: { zh: '输入 NofxOS API Key', en: 'Enter NofxOS API Key', es: 'Ingresar API Key' },
+  fillDefault: { zh: '填入默认', en: 'Fill Default', es: 'Llenar Default' },
+  connected: { zh: '已配置', en: 'Configured', es: 'Configurado' },
+  notConfigured: { zh: '未配置', en: 'Not Configured', es: 'No Configurado' },
+  nofxosDataSources: { zh: 'NofxOS 数据源', en: 'NofxOS Data Sources', es: 'Fuentes NofxOS' },
+};
+
+// ============================================================================
+// PUBLISH SETTINGS TRANSLATIONS (8 keys)
+// ============================================================================
+export const publishSettings = {
+  publishToMarket: { zh: '发布到策略市场', en: 'Publish to Market', es: 'Publicar al Mercado' },
+  publishDesc: { zh: '策略将在市场公开展示，其他用户可发现并使用', en: 'Strategy will be publicly visible in the marketplace', es: 'Visible públicamente' },
+  showConfig: { zh: '公开配置参数', en: 'Show Config', es: 'Mostrar Config' },
+  showConfigDesc: { zh: '允许他人查看和复制详细配置', en: 'Allow others to view and clone config details', es: 'Permitir clonación' },
+  private: { zh: '私有', en: 'PRIVATE', es: 'PRIVADO' },
+  public: { zh: '公开', en: 'PUBLIC', es: 'PÚBLICO' },
+  hidden: { zh: '隐藏', en: 'HIDDEN', es: 'OCULTO' },
+  visible: { zh: '可见', en: 'VISIBLE', es: 'VISIBLE' },
+};
+
+// ============================================================================
+// CHART TABS TRANSLATIONS (5 keys)
+// ============================================================================
+export const chartTabs = {
+  crypto: { zh: '加密', en: 'Crypto', es: 'Cripto' },
+  stocks: { zh: '美股', en: 'Stocks', es: 'Acciones' },
+  forex: { zh: '外汇', en: 'Forex', es: 'Forex' },
+  metals: { zh: '金属', en: 'Metals', es: 'Metales' },
+  hyperliquid: { zh: 'HL', en: 'HL', es: 'HL' },
+};
+
+// ============================================================================
+// AGGREGATED EXPORTS FOR TRANSLATIONS.TS
+// ============================================================================
+
+export const zhStrategy = {
+  ...Object.fromEntries(Object.entries(coinSource).map(([k, v]) => [k, v.zh])),
+  ...Object.fromEntries(Object.entries(gridConfig).map(([k, v]) => [k, v.zh])),
+  ...Object.fromEntries(Object.entries(gridRisk).map(([k, v]) => [k, v.zh])),
+  ...Object.fromEntries(Object.entries(riskControl).map(([k, v]) => [k, v.zh])),
+  ...Object.fromEntries(Object.entries(promptSections).map(([k, v]) => [k, v.zh])),
+  ...Object.fromEntries(Object.entries(indicator).map(([k, v]) => [k, v.zh])),
+  ...Object.fromEntries(Object.entries(publishSettings).map(([k, v]) => [k, v.zh])),
+  ...Object.fromEntries(Object.entries(chartTabs).map(([k, v]) => [k, v.zh])),
+};
+
+export const enStrategy = {
+  ...Object.fromEntries(Object.entries(coinSource).map(([k, v]) => [k, v.en])),
+  ...Object.fromEntries(Object.entries(gridConfig).map(([k, v]) => [k, v.en])),
+  ...Object.fromEntries(Object.entries(gridRisk).map(([k, v]) => [k, v.en])),
+  ...Object.fromEntries(Object.entries(riskControl).map(([k, v]) => [k, v.en])),
+  ...Object.fromEntries(Object.entries(promptSections).map(([k, v]) => [k, v.en])),
+  ...Object.fromEntries(Object.entries(indicator).map(([k, v]) => [k, v.en])),
+  ...Object.fromEntries(Object.entries(publishSettings).map(([k, v]) => [k, v.en])),
+  ...Object.fromEntries(Object.entries(chartTabs).map(([k, v]) => [k, v.en])),
+};
+
+export const esStrategy = {
+  ...Object.fromEntries(Object.entries(coinSource).map(([k, v]) => [k, v.es])),
+  ...Object.fromEntries(Object.entries(gridConfig).map(([k, v]) => [k, v.es])),
+  ...Object.fromEntries(Object.entries(gridRisk).map(([k, v]) => [k, v.es])),
+  ...Object.fromEntries(Object.entries(riskControl).map(([k, v]) => [k, v.es])),
+  ...Object.fromEntries(Object.entries(promptSections).map(([k, v]) => [k, v.es])),
+  ...Object.fromEntries(Object.entries(indicator).map(([k, v]) => [k, v.es])),
+  ...Object.fromEntries(Object.entries(publishSettings).map(([k, v]) => [k, v.es])),
+  ...Object.fromEntries(Object.entries(chartTabs).map(([k, v]) => [k, v.es])),
+};

web/src/lib/api.ts

@@ -8,6 +8,7 @@ import type {
   TraderConfigData,
   AIModel,
   Exchange,
+  TelegramConfig,
   CreateTraderRequest,
   CreateExchangeRequest,
   UpdateModelConfigRequest,
@@ -785,4 +786,26 @@ export const api = {
     if (!result.success) throw new Error('获取历史仓位失败')
     return result.data!
   },
+
+  // Telegram Bot API
+  async getTelegramConfig(): Promise<TelegramConfig> {
+    const result = await httpClient.get<TelegramConfig>(`${API_BASE}/telegram`)
+    if (!result.success) throw new Error('获取Telegram配置失败')
+    return result.data!
+  },
+
+  async updateTelegramConfig(token: string, modelId?: string): Promise<void> {
+    const result = await httpClient.post(`${API_BASE}/telegram`, { bot_token: token, model_id: modelId ?? '' })
+    if (!result.success) throw new Error('保存Telegram配置失败')
+  },
+
+  async unbindTelegram(): Promise<void> {
+    const result = await httpClient.delete(`${API_BASE}/telegram/binding`)
+    if (!result.success) throw new Error('解绑Telegram失败')
+  },
+
+  async updateTelegramModel(modelId: string): Promise<void> {
+    const result = await httpClient.post(`${API_BASE}/telegram/model`, { model_id: modelId })
+    if (!result.success) throw new Error('更新Telegram模型失败')
+  },
 }

web/src/lib/config.ts

@@ -1,6 +1,6 @@
 export interface SystemConfig {
-  beta_mode: boolean
-  registration_enabled?: boolean
+  initialized: boolean
+  beta_mode?: boolean
 }
 
 let configPromise: Promise<SystemConfig> | null = null
@@ -19,8 +19,11 @@ export function getSystemConfig(): Promise<SystemConfig> {
       cachedConfig = data
       return data
     })
-    .finally(() => {
-      // Keep cachedConfig for reuse; allow re-fetch via explicit invalidation if added later
-    })
   return configPromise
 }
+
+/** Call after first-time setup completes so next check reflects initialized=true */
+export function invalidateSystemConfig() {
+  cachedConfig = null
+  configPromise = null
+}

web/src/pages/DebateArenaPage.tsx

@@ -104,6 +104,7 @@ function AIAvatar({ name, size = 24 }: { name: string; size?: number }) {
     kimi: { bg: 'bg-purple-500', text: 'text-white', letter: 'K' },
     qwen: { bg: 'bg-indigo-500', text: 'text-white', letter: 'Q' },
     openai: { bg: 'bg-emerald-600', text: 'text-white', letter: 'O' },
+    minimax: { bg: 'bg-red-500', text: 'text-white', letter: 'M' },
     gpt: { bg: 'bg-emerald-600', text: 'text-white', letter: 'O' },
   }
   const lower = name.toLowerCase()

web/src/pages/SettingsPage.tsx

@@ -0,0 +1,489 @@
+import { useState, useEffect } from 'react'
+import { toast } from 'sonner'
+import { User, Cpu, Building2, MessageCircle, Eye, EyeOff, ChevronRight, Plus, Pencil } from 'lucide-react'
+import { useAuth } from '../contexts/AuthContext'
+import { useLanguage } from '../contexts/LanguageContext'
+import { api } from '../lib/api'
+import { ExchangeConfigModal } from '../components/traders/ExchangeConfigModal'
+import { TelegramConfigModal } from '../components/traders/TelegramConfigModal'
+import { ModelConfigModal } from '../components/AITradersPage'
+import type { Exchange, AIModel } from '../types'
+
+type Tab = 'account' | 'models' | 'exchanges' | 'telegram'
+
+export function SettingsPage() {
+  const { user } = useAuth()
+  const { language } = useLanguage()
+  const [activeTab, setActiveTab] = useState<Tab>('account')
+
+  // Account state
+  const [newPassword, setNewPassword] = useState('')
+  const [showPassword, setShowPassword] = useState(false)
+  const [changingPassword, setChangingPassword] = useState(false)
+
+  // AI Models state
+  const [configuredModels, setConfiguredModels] = useState<AIModel[]>([])
+  const [supportedModels, setSupportedModels] = useState<AIModel[]>([])
+  const [showModelModal, setShowModelModal] = useState(false)
+  const [editingModel, setEditingModel] = useState<string | null>(null)
+
+  // Exchanges state
+  const [exchanges, setExchanges] = useState<Exchange[]>([])
+  const [showExchangeModal, setShowExchangeModal] = useState(false)
+  const [editingExchange, setEditingExchange] = useState<string | null>(null)
+
+  // Telegram state
+  const [showTelegramModal, setShowTelegramModal] = useState(false)
+
+  // Fetch data when tabs are visited
+  useEffect(() => {
+    if (activeTab === 'models') {
+      Promise.all([api.getModelConfigs(), api.getSupportedModels()])
+        .then(([configs, supported]) => {
+          setConfiguredModels(configs)
+          setSupportedModels(supported)
+        })
+        .catch(() => toast.error('Failed to load AI models'))
+    }
+    if (activeTab === 'exchanges') {
+      api.getExchangeConfigs()
+        .then(setExchanges)
+        .catch(() => toast.error('Failed to load exchanges'))
+    }
+  }, [activeTab])
+
+  const handleChangePassword = async (e: React.FormEvent) => {
+    e.preventDefault()
+    if (newPassword.length < 8) {
+      toast.error('Password must be at least 8 characters')
+      return
+    }
+    setChangingPassword(true)
+    try {
+      const res = await fetch('/api/user/password', {
+        method: 'PUT',
+        headers: {
+          'Content-Type': 'application/json',
+          Authorization: `Bearer ${localStorage.getItem('token') || ''}`,
+        },
+        body: JSON.stringify({ new_password: newPassword }),
+      })
+      if (!res.ok) {
+        const data = await res.json().catch(() => ({}))
+        throw new Error(data.error || 'Failed to update password')
+      }
+      toast.success('Password updated successfully')
+      setNewPassword('')
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to update password')
+    } finally {
+      setChangingPassword(false)
+    }
+  }
+
+  const handleSaveModel = async (
+    modelId: string,
+    apiKey: string,
+    customApiUrl?: string,
+    customModelName?: string
+  ) => {
+    try {
+      const existingModel = configuredModels.find((m) => m.id === modelId)
+      const modelTemplate = supportedModels.find((m) => m.id === modelId)
+      const modelToUpdate = existingModel || modelTemplate
+      if (!modelToUpdate) { toast.error('Model not found'); return }
+
+      let updatedModels: AIModel[]
+      if (existingModel) {
+        updatedModels = configuredModels.map((m) =>
+          m.id === modelId
+            ? { ...m, apiKey, customApiUrl: customApiUrl || '', customModelName: customModelName || '', enabled: true }
+            : m
+        )
+      } else {
+        updatedModels = [...configuredModels, {
+          ...modelToUpdate,
+          apiKey,
+          customApiUrl: customApiUrl || '',
+          customModelName: customModelName || '',
+          enabled: true,
+        }]
+      }
+
+      const request = {
+        models: Object.fromEntries(
+          updatedModels.map((m) => [m.provider, {
+            enabled: m.enabled,
+            api_key: m.apiKey || '',
+            custom_api_url: m.customApiUrl || '',
+            custom_model_name: m.customModelName || '',
+          }])
+        ),
+      }
+      await toast.promise(api.updateModelConfigs(request), {
+        loading: 'Saving model config...',
+        success: 'Model config saved',
+        error: 'Failed to save model config',
+      })
+      const refreshed = await api.getModelConfigs()
+      setConfiguredModels(refreshed)
+      setShowModelModal(false)
+      setEditingModel(null)
+    } catch {
+      toast.error('Failed to save model config')
+    }
+  }
+
+  const handleDeleteModel = async (modelId: string) => {
+    try {
+      const updatedModels = configuredModels.map((m) =>
+        m.id === modelId ? { ...m, apiKey: '', customApiUrl: '', customModelName: '', enabled: false } : m
+      )
+      const request = {
+        models: Object.fromEntries(
+          updatedModels.map((m) => [m.provider, {
+            enabled: m.enabled,
+            api_key: m.apiKey || '',
+            custom_api_url: m.customApiUrl || '',
+            custom_model_name: m.customModelName || '',
+          }])
+        ),
+      }
+      await api.updateModelConfigs(request)
+      const refreshed = await api.getModelConfigs()
+      setConfiguredModels(refreshed)
+      setShowModelModal(false)
+      setEditingModel(null)
+      toast.success('Model config removed')
+    } catch {
+      toast.error('Failed to remove model config')
+    }
+  }
+
+  const handleSaveExchange = async (
+    exchangeId: string | null,
+    exchangeType: string,
+    accountName: string,
+    apiKey: string,
+    secretKey?: string,
+    passphrase?: string,
+    testnet?: boolean,
+    hyperliquidWalletAddr?: string,
+    asterUser?: string,
+    asterSigner?: string,
+    asterPrivateKey?: string,
+    lighterWalletAddr?: string,
+    lighterPrivateKey?: string,
+    lighterApiKeyPrivateKey?: string,
+    lighterApiKeyIndex?: number
+  ) => {
+    try {
+      if (exchangeId) {
+        const request = {
+          exchanges: {
+            [exchangeId]: {
+              enabled: true,
+              api_key: apiKey || '',
+              secret_key: secretKey || '',
+              passphrase: passphrase || '',
+              testnet: testnet || false,
+              hyperliquid_wallet_addr: hyperliquidWalletAddr || '',
+              aster_user: asterUser || '',
+              aster_signer: asterSigner || '',
+              aster_private_key: asterPrivateKey || '',
+              lighter_wallet_addr: lighterWalletAddr || '',
+              lighter_private_key: lighterPrivateKey || '',
+              lighter_api_key_private_key: lighterApiKeyPrivateKey || '',
+              lighter_api_key_index: lighterApiKeyIndex || 0,
+            },
+          },
+        }
+        await toast.promise(api.updateExchangeConfigsEncrypted(request), {
+          loading: 'Updating exchange config...',
+          success: 'Exchange config updated',
+          error: 'Failed to update exchange config',
+        })
+      } else {
+        const createRequest = {
+          exchange_type: exchangeType,
+          account_name: accountName,
+          enabled: true,
+          api_key: apiKey || '',
+          secret_key: secretKey || '',
+          passphrase: passphrase || '',
+          testnet: testnet || false,
+          hyperliquid_wallet_addr: hyperliquidWalletAddr || '',
+          aster_user: asterUser || '',
+          aster_signer: asterSigner || '',
+          aster_private_key: asterPrivateKey || '',
+          lighter_wallet_addr: lighterWalletAddr || '',
+          lighter_private_key: lighterPrivateKey || '',
+          lighter_api_key_private_key: lighterApiKeyPrivateKey || '',
+          lighter_api_key_index: lighterApiKeyIndex || 0,
+        }
+        await toast.promise(api.createExchangeEncrypted(createRequest), {
+          loading: 'Creating exchange account...',
+          success: 'Exchange account created',
+          error: 'Failed to create exchange account',
+        })
+      }
+      const refreshed = await api.getExchangeConfigs()
+      setExchanges(refreshed)
+      setShowExchangeModal(false)
+      setEditingExchange(null)
+    } catch {
+      toast.error('Failed to save exchange config')
+    }
+  }
+
+  const handleDeleteExchange = async (exchangeId: string) => {
+    try {
+      await toast.promise(api.deleteExchange(exchangeId), {
+        loading: 'Deleting exchange account...',
+        success: 'Exchange account deleted',
+        error: 'Failed to delete exchange account',
+      })
+      const refreshed = await api.getExchangeConfigs()
+      setExchanges(refreshed)
+      setShowExchangeModal(false)
+      setEditingExchange(null)
+    } catch {
+      toast.error('Failed to delete exchange account')
+    }
+  }
+
+  const tabs: { key: Tab; label: string; icon: React.ReactNode }[] = [
+    { key: 'account', label: 'Account', icon: <User size={16} /> },
+    { key: 'models', label: 'AI Models', icon: <Cpu size={16} /> },
+    { key: 'exchanges', label: 'Exchanges', icon: <Building2 size={16} /> },
+    { key: 'telegram', label: 'Telegram', icon: <MessageCircle size={16} /> },
+  ]
+
+  return (
+    <div className="min-h-screen pt-20 pb-12 px-4" style={{ background: '#0B0E11' }}>
+      <div className="max-w-2xl mx-auto">
+        <h1 className="text-xl font-bold text-white mb-6">Settings</h1>
+
+        {/* Tabs */}
+        <div className="flex gap-1 mb-6 bg-zinc-900/60 border border-zinc-800 rounded-xl p-1">
+          {tabs.map((tab) => (
+            <button
+              key={tab.key}
+              onClick={() => setActiveTab(tab.key)}
+              className={`flex-1 flex items-center justify-center gap-2 px-3 py-2 rounded-lg text-sm font-medium transition-all
+                ${activeTab === tab.key
+                  ? 'bg-nofx-gold text-black'
+                  : 'text-zinc-400 hover:text-white'
+                }`}
+            >
+              {tab.icon}
+              <span className="hidden sm:inline">{tab.label}</span>
+            </button>
+          ))}
+        </div>
+
+        {/* Tab Content */}
+        <div className="bg-zinc-900/60 backdrop-blur-xl border border-zinc-800/80 rounded-2xl p-6">
+
+          {/* Account Tab */}
+          {activeTab === 'account' && (
+            <div className="space-y-6">
+              <div>
+                <p className="text-xs text-zinc-500 mb-1">Email</p>
+                <p className="text-sm text-white font-medium">{user?.email}</p>
+              </div>
+
+              <div className="border-t border-zinc-800 pt-6">
+                <h3 className="text-sm font-semibold text-white mb-4">Change Password</h3>
+                <form onSubmit={handleChangePassword} className="space-y-4">
+                  <div>
+                    <label className="block text-xs font-medium text-zinc-400 mb-2">New Password</label>
+                    <div className="relative">
+                      <input
+                        type={showPassword ? 'text' : 'password'}
+                        value={newPassword}
+                        onChange={(e) => setNewPassword(e.target.value)}
+                        className="w-full bg-zinc-950/80 border border-zinc-700/80 rounded-xl px-4 py-3 pr-11 text-sm text-white placeholder-zinc-600 focus:outline-none focus:border-nofx-gold/60 focus:ring-1 focus:ring-nofx-gold/30 transition-all"
+                        placeholder="At least 8 characters"
+                        required
+                      />
+                      <button
+                        type="button"
+                        onClick={() => setShowPassword(!showPassword)}
+                        className="absolute right-3.5 top-1/2 -translate-y-1/2 text-zinc-500 hover:text-zinc-300 transition-colors"
+                      >
+                        {showPassword ? <EyeOff size={16} /> : <Eye size={16} />}
+                      </button>
+                    </div>
+                  </div>
+                  <button
+                    type="submit"
+                    disabled={changingPassword || newPassword.length < 8}
+                    className="w-full bg-nofx-gold hover:bg-yellow-400 active:scale-[0.98] text-black font-semibold py-3 rounded-xl text-sm transition-all disabled:opacity-50 disabled:cursor-not-allowed"
+                  >
+                    {changingPassword ? 'Updating...' : 'Update Password'}
+                  </button>
+                </form>
+              </div>
+            </div>
+          )}
+
+          {/* AI Models Tab */}
+          {activeTab === 'models' && (
+            <div className="space-y-4">
+              <div className="flex items-center justify-between">
+                <p className="text-sm text-zinc-400">
+                  {configuredModels.length} model{configuredModels.length !== 1 ? 's' : ''} configured
+                </p>
+                <button
+                  onClick={() => { setEditingModel(null); setShowModelModal(true) }}
+                  className="flex items-center gap-1.5 text-xs font-medium bg-nofx-gold/10 hover:bg-nofx-gold/20 text-nofx-gold px-3 py-1.5 rounded-lg transition-colors"
+                >
+                  <Plus size={14} />
+                  Add Model
+                </button>
+              </div>
+
+              {configuredModels.length === 0 ? (
+                <div className="text-center py-8 text-zinc-600 text-sm">
+                  No AI models configured yet
+                </div>
+              ) : (
+                <div className="space-y-2">
+                  {configuredModels.map((model) => (
+                    <button
+                      key={model.id}
+                      onClick={() => { setEditingModel(model.id); setShowModelModal(true) }}
+                      className="w-full flex items-center justify-between px-4 py-3 rounded-xl bg-zinc-800/50 hover:bg-zinc-800 border border-zinc-700/50 transition-colors group"
+                    >
+                      <div className="flex items-center gap-3">
+                        <div className="w-8 h-8 rounded-lg bg-zinc-700 flex items-center justify-center">
+                          <Cpu size={14} className="text-zinc-300" />
+                        </div>
+                        <div className="text-left">
+                          <p className="text-sm font-medium text-white">{model.name}</p>
+                          <p className="text-xs text-zinc-500">{model.provider}</p>
+                        </div>
+                      </div>
+                      <div className="flex items-center gap-2">
+                        <span className={`text-xs px-2 py-0.5 rounded-full ${model.enabled ? 'bg-emerald-500/10 text-emerald-400' : 'bg-zinc-700 text-zinc-500'}`}>
+                          {model.enabled ? 'Active' : 'Inactive'}
+                        </span>
+                        <Pencil size={14} className="text-zinc-600 group-hover:text-zinc-400 transition-colors" />
+                      </div>
+                    </button>
+                  ))}
+                </div>
+              )}
+            </div>
+          )}
+
+          {/* Exchanges Tab */}
+          {activeTab === 'exchanges' && (
+            <div className="space-y-4">
+              <div className="flex items-center justify-between">
+                <p className="text-sm text-zinc-400">
+                  {exchanges.length} account{exchanges.length !== 1 ? 's' : ''} connected
+                </p>
+                <button
+                  onClick={() => { setEditingExchange(null); setShowExchangeModal(true) }}
+                  className="flex items-center gap-1.5 text-xs font-medium bg-nofx-gold/10 hover:bg-nofx-gold/20 text-nofx-gold px-3 py-1.5 rounded-lg transition-colors"
+                >
+                  <Plus size={14} />
+                  Add Exchange
+                </button>
+              </div>
+
+              {exchanges.length === 0 ? (
+                <div className="text-center py-8 text-zinc-600 text-sm">
+                  No exchange accounts connected yet
+                </div>
+              ) : (
+                <div className="space-y-2">
+                  {exchanges.map((exchange) => (
+                    <button
+                      key={exchange.id}
+                      onClick={() => { setEditingExchange(exchange.id); setShowExchangeModal(true) }}
+                      className="w-full flex items-center justify-between px-4 py-3 rounded-xl bg-zinc-800/50 hover:bg-zinc-800 border border-zinc-700/50 transition-colors group"
+                    >
+                      <div className="flex items-center gap-3">
+                        <div className="w-8 h-8 rounded-lg bg-zinc-700 flex items-center justify-center">
+                          <Building2 size={14} className="text-zinc-300" />
+                        </div>
+                        <div className="text-left">
+                          <p className="text-sm font-medium text-white">{exchange.account_name || exchange.name}</p>
+                          <p className="text-xs text-zinc-500 capitalize">{exchange.exchange_type || exchange.type}</p>
+                        </div>
+                      </div>
+                      <ChevronRight size={14} className="text-zinc-600 group-hover:text-zinc-400 transition-colors" />
+                    </button>
+                  ))}
+                </div>
+              )}
+            </div>
+          )}
+
+          {/* Telegram Tab */}
+          {activeTab === 'telegram' && (
+            <div className="space-y-4">
+              <p className="text-sm text-zinc-400">
+                Connect a Telegram bot to receive trading notifications and interact with your traders.
+              </p>
+              <button
+                onClick={() => setShowTelegramModal(true)}
+                className="w-full flex items-center justify-between px-4 py-3 rounded-xl bg-zinc-800/50 hover:bg-zinc-800 border border-zinc-700/50 transition-colors group"
+              >
+                <div className="flex items-center gap-3">
+                  <div className="w-8 h-8 rounded-lg bg-[#0088cc]/20 flex items-center justify-center">
+                    <MessageCircle size={14} className="text-[#0088cc]" />
+                  </div>
+                  <span className="text-sm font-medium text-white">Configure Telegram Bot</span>
+                </div>
+                <ChevronRight size={14} className="text-zinc-600 group-hover:text-zinc-400 transition-colors" />
+              </button>
+            </div>
+          )}
+        </div>
+      </div>
+
+      {/* AI Model Modal */}
+      {showModelModal && (
+        <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/70 backdrop-blur-sm px-4">
+          <ModelConfigModal
+            allModels={supportedModels}
+            configuredModels={configuredModels}
+            editingModelId={editingModel}
+            onSave={handleSaveModel}
+            onDelete={handleDeleteModel}
+            onClose={() => { setShowModelModal(false); setEditingModel(null) }}
+            language={language}
+          />
+        </div>
+      )}
+
+      {/* Exchange Modal */}
+      {showExchangeModal && (
+        <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/70 backdrop-blur-sm px-4">
+          <ExchangeConfigModal
+            allExchanges={exchanges}
+            editingExchangeId={editingExchange}
+            onSave={handleSaveExchange}
+            onDelete={handleDeleteExchange}
+            onClose={() => { setShowExchangeModal(false); setEditingExchange(null) }}
+            language={language}
+          />
+        </div>
+      )}
+
+      {/* Telegram Modal */}
+      {showTelegramModal && (
+        <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/70 backdrop-blur-sm px-4">
+          <TelegramConfigModal
+            onClose={() => setShowTelegramModal(false)}
+            language={language}
+          />
+        </div>
+      )}
+    </div>
+  )
+}

web/src/pages/StrategyMarketPage.tsx

@@ -158,6 +158,32 @@ export function StrategyMarketPage() {
       shareYours: 'UPLOAD_STRATEGY',
       makePublic: 'PUBLISH',
       loading: 'INITIALIZING...'
+    },
+    id: {
+      title: 'PASAR STRATEGI',
+      subtitle: 'DATABASE STRATEGI GLOBAL',
+      description: 'Temukan, analisis, dan kloning algoritma trading berperforma tinggi',
+      search: 'CARI PARAMETER...',
+      all: 'SEMUA PROTOKOL',
+      popular: 'TREN',
+      recent: 'TERBARU',
+      myStrategies: 'PERPUSTAKAAN SAYA',
+      noStrategies: 'TIDAK ADA SINYAL',
+      noStrategiesDesc: 'Tidak ada sinyal strategis terdeteksi pada frekuensi ini',
+      author: 'OPERATOR',
+      createdAt: 'TIMESTAMP',
+      viewConfig: 'DEKRIPSI CONFIG',
+      hideConfig: 'ENKRIPSI',
+      copyConfig: 'KLON CONFIG',
+      copied: 'DISALIN',
+      configHidden: 'TERENKRIPSI',
+      configHiddenDesc: 'Parameter konfigurasi terenkripsi',
+      indicators: 'INDIKATOR',
+      maxPositions: 'BATAS_POS',
+      maxLeverage: 'LEV_MAKS',
+      shareYours: 'UNGGAH_STRATEGI',
+      makePublic: 'PUBLIKASI',
+      loading: 'MENGINISIALISASI...'
     }
   }
 

web/src/types.ts

@@ -116,6 +116,13 @@ export interface AIModel {
   customModelName?: string
 }
 
+export interface TelegramConfig {
+  token_masked: string    // Masked token like "123456:ABC***XYZ"
+  is_bound: boolean       // Whether a user has sent /start
+  bound_chat_id?: number  // The bound chat ID (if any)
+  model_id?: string       // AI model selected for Telegram replies
+}
+
 export interface Exchange {
   id: string                     // UUID (empty for supported exchange templates)
   exchange_type: string          // "binance", "bybit", "okx", "hyperliquid", "aster", "lighter"