From 3383fdd983c0506a828a412d035eaaca35719a8f Mon Sep 17 00:00:00 2001
From: Ciphercat <78522797+0xrsydn@users.noreply.github.com>
Date: Fri, 6 Mar 2026 07:49:57 +0000
Subject: [PATCH] =?UTF-8?q?docs:=20update=20TODO.md=20=E2=80=94=20crumb=20?=
 =?UTF-8?q?auth=20resolved,=20fix=20flake.nix=20package=20rename?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 TODO.md   | 5 +++--
 flake.nix | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/TODO.md b/TODO.md
index 3dcc3d6..3acaac7 100644
--- a/TODO.md
+++ b/TODO.md
@@ -34,7 +34,6 @@
 - [x] 41 tests passing (22 unit + 19 integration)
 
 ## 🚧 Next Up
-- [ ] Fix Yahoo crumb auth for quoteSummary (fetch crumb from consent.yahoo.com, pass as cookie/param) — unblocks live fundamental commands
 
 ## 📋 Backlog (per SPEC.md)
 - [ ] `market summary` — IHSG index, market breadth
@@ -51,4 +50,6 @@
 ## 🐛 Known Issues
 - [ ] Yahoo Finance returns 429 from datacenter IPs occasionally
 - [ ] SMA200 trend shows "Insufficient data" if Yahoo returns < 200 candles
-- [ ] Yahoo quoteSummary returns 401 from datacenter IPs — needs crumb/cookie auth (fundamental/growth/valuation/risk/compare commands affected)
+- [x] Yahoo quoteSummary crumb auth — fixed via curl-impersonate-chrome (curl_chrome131)
+  - fc.yahoo.com → A3 cookie + query1 getcrumb → crumb, both sent to quoteSummary
+  - Requires nixpkgs#curl-impersonate-chrome in PATH (added to flake.nix + clan-private)
diff --git a/flake.nix b/flake.nix
index 93a15b3..a16ae5a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -28,7 +28,7 @@
             cargo-watch
             cargo-nextest
             prek
-            curl-impersonate-chrome  # required for Yahoo Finance auth (--impersonate chrome)
+            curl-impersonate  # required for Yahoo Finance auth (curl_chrome* binaries for TLS fingerprinting)
           ];
 
           env = {