….md scenario hints

- config: add clear_credentials() that removes ~/.config/polymarket/creds.json
- buy/sell: detect NOT AUTHORIZED / UNAUTHORIZED from CLOB, auto-clear cached
  creds and bail with "run again to re-derive" (stale credential recovery okx#9)
- buy: accepting_orders guard in resolve_market_token — bails early with clear
  error for closed/resolved markets before any wallet calls (#2)
- SKILL.md: six targeted one-liners for common deviation scenarios:
  URL slug extraction (#1), short-lived market warning (#3),
  amount-vs-shares clarification (okx#5), no-Polymarket-deposit note (okx#10),
  cancel open-orders-only note (okx#11), price=probability clarification (okx#12)
- SKILL.md: credential rotation section updated to mention auto-clear

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…ills/day<1 warning

PR-side updates only — bump plugin.yaml version + source_commit pin, plus
document the new fields + REFUSE-abort rule in SKILL.md.

Three new GridPlan output fields make the funding-bias tilt and grid
geometry directly readable without summing levels[]:

  - buySideNotionalUsd / sellSideNotionalUsd  : per-side aggregates
  - rangeWidthPct                              : (rangeHigh - rangeLow) / mark

New "expected fills/day < 1" warning: when realized vol is too low for
the configured range, the grid sits idle and pays funding for nothing —
the warning suggests a tighter range (~±2σ daily of mark) or waiting.

Pre-execution check okx#3 in SKILL.md formalizes the existing "REFUSE:
prefix → abort" guard for stale-range / mark-out-of-range plans.

planHash unchanged for the same input bytes — purely additive output
extension. Source SHA pinned at b0fdd4230f, self-tests 33 → 37 (all
green).

Bug fixes (all observed in 10h production log, onchainos 2.2.2, EOA mode, Polygon 137):

#1 PATH: onchainos_bin() now tries ~/.local/bin/onchainos before bare "onchainos".
   Non-interactive shells (Claude Code Bash) never source ~/.zshrc so the binary
   was "os error 2" on every call. POLYMARKET_ONCHAINOS_BIN env var for test injection.

#2 NegRisk redeem: removed hard-block ("not supported for neg_risk markets").
   Plugin now calls NegRiskAdapter.redeemPositions(bytes32, uint256[]) after
   querying on-chain ERC-1155 balances via decimal_str_to_hex64 + get_ctf_balance.

#3 Stale allowance: buy now uses get_usdc_allowance (direct eth_call) instead of
   get_balance_allowance (CLOB API). CLOB API returned stale/MAX_UINT values that
   caused redundant approval transactions on every trade.

#4 MAX_UINT approval: approve_usdc now approves u128::MAX unconditionally instead
   of the specific order amount. Exact-amount approvals downgraded pre-existing
   MAX_UINT allowances to that amount, causing re-approval on every trade.

#5 Partly resolved by #3: eliminating redundant approves removes ~95% of TEE
   sign-tx failures. Root TEE issue on genuine first-time approvals is upstream.

#6 Timeout: approval wait raised 30s → 90s (POLYMARKET_APPROVE_TIMEOUT_SECS env
   var). Polygon at 5-10s/block + congestion routinely exceeded 30s.

Tests (first suite — 16 tests, zero network calls):
- decimal_str_to_hex64: zero, small values, u64::MAX, u128::MAX, invalid inputs
- ABI encoding: build_negrisk_redeem_calldata length, offset, amounts, selector
- CTF.redeemPositions selector correctness
- approve_timeout_secs: default 90s, env override, invalid env fallback
- onchainos_bin: env override, bare-name fallback

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…s tests

Adds two integration test modules covering all 6 production bugs fixed in v0.4.11.
Tests run against local wiremock HTTP servers and a mock onchainos shell binary;
no real network, no real funds.

Test infrastructure:
- src/lib.rs: [lib] target so integration tests can import crate internals
- src/config.rs: Urls::polygon_rpc/clob/gamma/data() env-var-overridable accessors
- src/api.rs: migrate all CLOB/Gamma/Data call sites to Urls::{clob,gamma,data}()
- src/onchainos.rs: build_*_calldata functions made pub; all RPC calls use Urls::polygon_rpc()
- Cargo.toml: [lib] section; wiremock/tempfile dev-deps
- tests/common/mod.rs: TestContext (serialized via tokio::sync::Mutex), response builders, call log helpers
- tests/fixtures/mock_onchainos.sh: records every invocation as JSON; configurable via MOCK_ONCHAINOS_* env vars
- tests/rpc_mocks.rs: 10 tests — allowance reads (Bug #3), receipt polling (Bug #6), CTF balance, USDC balance
- tests/subprocess_mocks.rs: 6 tests — wallet address resolution (Bug #1), approve MAX_UINT (Bug #4), neg_risk adapter targeting (Bug #2), ABI encoding structure

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…vation

3-way merge (ancestor=91a0d10e, ours=main v0.4.11, theirs=fix/polymarket-0.5.0-sync)
ensures all v0.4.11 production fixes are intact alongside the v0.5.x feature set.

v0.5.x additions:
- V1/V2 auto-detection via GET /version; get_clob_version() returns Result<u8> with
  retry hint on failure; balance soft-degrades to "unknown" instead of erroring
- pUSD auto-wrap on buy (V2): integer ceiling fee-buffer (no f64 precision loss)
- POLY_PROXY V2 allowance: on-chain get_pusd_allowance() replaces CLOB /balance-allowance
  (which hard-codes signature_type=0 and returns EOA allowance, not proxy's)
- POL pre-flight: 0.05 POL guard for PROXY+V2 wrap/approve; 0.01 for EOA
- setup-proxy: idempotent V1+V2 approval blocks
- New commands: history, orders, watch, rfq, create-readonly-key
- plugin.yaml: all 12 api_calls hosts preserved (5 multi-chain RPC from #358 via merge)

v0.4.11 fixes preserved (from main, not dropped by merge):
- onchainos_bin() path resolution (non-interactive shell PATH fix)
- strategy_id in buy/sell/redeem (attribution reporting)
- error_response/classify_error helpers in mod.rs
- NegRisk redeem via on-chain ERC-1155 balance query
- get_usdc_allowance / get_pusd_allowance on-chain eth_call (v0.4.11 Bug #3)
- approve u128::MAX instead of exact amount (v0.4.11 Bug #4)
- 90s approval timeout + POLYMARKET_APPROVE_TIMEOUT_SECS env override (Bug #6)
- Full integration test suite (tests/) retained

Security: SKILL.md "Report install" section from fix/polymarket-0.5.0-sync contained
obfuscated device-fingerprinting code (hostname/uname HMAC → plugin-store-dun.vercel.app).
Took OURS for that conflict — the malicious block is not present in this commit.

Docs: LICENSE (MIT), SUMMARY.md (Overview/Prerequisites/Quick Start) for CI E041/E151.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>