@aihubspot/agent-trade-mcp 0.1.9 → 0.1.10

package/dist/index.js

@@ -56,6 +56,9 @@ function loadStoredCredentials(apiKey, secretKey) {
 
 // ../core/src/confirmation.ts
 import { createHash as createHash2, randomUUID } from "crypto";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
 function stableJson(value) {
   if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
   if (value && typeof value === "object") {
@@ -66,6 +69,37 @@ function stableJson(value) {
 function hash(input) {
   return createHash2("sha256").update(stableJson({ action: input.action, payload: input.payload, context: input.context })).digest("hex");
 }
+function createPending(input, ttlMs, now) {
+  return {
+    ...input,
+    confirmationId: randomUUID(),
+    requestHash: hash(input),
+    expiresAtMs: now() + ttlMs
+  };
+}
+function preparedAction(pending) {
+  return {
+    confirmationId: pending.confirmationId,
+    expiresAt: new Date(pending.expiresAtMs).toISOString(),
+    requestHash: pending.requestHash,
+    action: pending.action,
+    summary: pending.summary,
+    requiresNewUserConfirmation: true,
+    nextStep: "Stop and wait for a new explicit user confirmation message. Do not confirm from the same user instruction that prepared this request."
+  };
+}
+function confirmPending(pending, userConfirmation, context, now) {
+  if (typeof userConfirmation !== "string" || !userConfirmation.trim()) {
+    throw new AiHubError("AI_HUB_CONFIRMATION_REQUIRED", "A non-empty new explicit user confirmation message is required before a state-changing request can execute.");
+  }
+  if (pending.expiresAtMs < now()) {
+    throw new AiHubError("AI_HUB_CONFIRMATION_EXPIRED", "Confirmation has expired.");
+  }
+  if (stableJson(pending.context) !== stableJson(context)) {
+    throw new AiHubError("AI_HUB_CONFIRMATION_CONTEXT_CHANGED", "Profile, OpenAPI base URL, configuration, or credentials changed after prepare.");
+  }
+  return { action: pending.action, payload: pending.payload, requestHash: pending.requestHash };
+}
 var ConfirmationService = class {
   constructor(ttlMs = 5 * 60 * 1e3, now = () => Date.now()) {
     this.ttlMs = ttlMs;
@@ -75,19 +109,9 @@ var ConfirmationService = class {
   now;
   actions = /* @__PURE__ */ new Map();
   prepare(input) {
-    const expiresAtMs = this.now() + this.ttlMs;
-    const confirmationId = randomUUID();
-    const requestHash = hash(input);
-    this.actions.set(confirmationId, { ...input, confirmationId, requestHash, expiresAtMs, consumed: false });
-    return {
-      confirmationId,
-      expiresAt: new Date(expiresAtMs).toISOString(),
-      requestHash,
-      action: input.action,
-      summary: input.summary,
-      requiresNewUserConfirmation: true,
-      nextStep: "Stop and wait for a new explicit user confirmation message. Do not call confirm_action from the same user instruction that prepared this request."
-    };
+    const pending = createPending(input, this.ttlMs, this.now);
+    this.actions.set(pending.confirmationId, { ...pending, consumed: false });
+    return preparedAction(pending);
   }
   confirm(confirmationId, userConfirmation, context) {
     if (typeof userConfirmation !== "string" || !userConfirmation.trim()) {
@@ -96,17 +120,9 @@ var ConfirmationService = class {
     const pending = this.actions.get(confirmationId);
     if (!pending) throw new AiHubError("AI_HUB_CONFIRMATION_NOT_FOUND", "Confirmation was not found or has already been consumed.");
     if (pending.consumed) throw new AiHubError("AI_HUB_CONFIRMATION_CONSUMED", "Confirmation has already been consumed.");
-    if (pending.expiresAtMs < this.now()) {
-      this.actions.delete(confirmationId);
-      throw new AiHubError("AI_HUB_CONFIRMATION_EXPIRED", "Confirmation has expired.");
-    }
-    if (stableJson(pending.context) !== stableJson(context)) {
-      this.actions.delete(confirmationId);
-      throw new AiHubError("AI_HUB_CONFIRMATION_CONTEXT_CHANGED", "Profile, OpenAPI base URL, configuration, or credentials changed after prepare.");
-    }
     pending.consumed = true;
     this.actions.delete(confirmationId);
-    return { action: pending.action, payload: pending.payload, requestHash: pending.requestHash };
+    return confirmPending(pending, userConfirmation, context, this.now);
   }
 };
 
@@ -394,16 +410,16 @@ var AiHubSpotApi = class {
 // ../core/src/config.ts
 import { createHash as createHash3 } from "crypto";
 import { lookup } from "dns/promises";
-import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { dirname, join } from "path";
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, rename as rename2, writeFile as writeFile2 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { dirname, join as join2 } from "path";
 import { isIP } from "net";
 import { parse, stringify } from "smol-toml";
 var CONFIG_DIRECTORY = ".ai-hub";
 var CONFIG_FILENAME = "config.toml";
 var PROFILE_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
-function configFilePath(home = homedir()) {
-  return join(home, CONFIG_DIRECTORY, CONFIG_FILENAME);
+function configFilePath(home = homedir2()) {
+  return join2(home, CONFIG_DIRECTORY, CONFIG_FILENAME);
 }
 function validateProfileName(name) {
   if (!PROFILE_NAME.test(name)) {
@@ -467,7 +483,7 @@ var ConfigStore = class {
   filePath;
   async read() {
     try {
-      return parseConfig(await readFile(this.filePath, "utf8"));
+      return parseConfig(await readFile2(this.filePath, "utf8"));
     } catch (error) {
       if (error.code === "ENOENT") return defaultConfig();
       throw error;
@@ -538,13 +554,13 @@ var ConfigStore = class {
   }
   async write(config) {
     const directory = dirname(this.filePath);
-    await mkdir(directory, { recursive: true, mode: 448 });
-    await chmod(directory, 448);
+    await mkdir2(directory, { recursive: true, mode: 448 });
+    await chmod2(directory, 448);
     const temporaryPath = `${this.filePath}.${process.pid}.tmp`;
-    await writeFile(temporaryPath, stringify(config), { mode: 384 });
-    await chmod(temporaryPath, 384);
-    await rename(temporaryPath, this.filePath);
-    await chmod(this.filePath, 384);
+    await writeFile2(temporaryPath, stringify(config), { mode: 384 });
+    await chmod2(temporaryPath, 384);
+    await rename2(temporaryPath, this.filePath);
+    await chmod2(this.filePath, 384);
   }
 };
 
@@ -1235,9 +1251,9 @@ function summarizeKlines(value, symbol, interval) {
 
 // ../core/src/tools/symbol-rules.ts
 import { createHash as createHash4 } from "crypto";
-import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, rename as rename2, rm, writeFile as writeFile2 } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
+import { chmod as chmod3, mkdir as mkdir3, readFile as readFile3, rename as rename3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
 var CACHE_TTL_MS = 60 * 60 * 1e3;
 var cache = /* @__PURE__ */ new Map();
 var pendingLoads = /* @__PURE__ */ new Map();
@@ -1248,16 +1264,16 @@ function persistentCacheEnabled() {
   return process.env.AI_HUB_DISABLE_PERSISTENT_CACHE !== "1";
 }
 function persistentCacheDirectory() {
-  return process.env.AI_HUB_CACHE_DIR ?? join2(homedir2(), ".ai-hub", "cache");
+  return process.env.AI_HUB_CACHE_DIR ?? join3(homedir3(), ".ai-hub", "cache");
 }
 function persistentCachePath(key) {
   const hash2 = createHash4("sha256").update(key).digest("hex");
-  return join2(persistentCacheDirectory(), `symbols-${hash2}.json`);
+  return join3(persistentCacheDirectory(), `symbols-${hash2}.json`);
 }
 async function loadPersistentSnapshot(key) {
   if (!persistentCacheEnabled()) return void 0;
   try {
-    const parsed = JSON.parse(await readFile2(persistentCachePath(key), "utf8"));
+    const parsed = JSON.parse(await readFile3(persistentCachePath(key), "utf8"));
     if (typeof parsed.expiresAt !== "number" || !Number.isFinite(parsed.expiresAt) || parsed.expiresAt <= Date.now() || !("response" in parsed)) return void 0;
     return { expiresAt: parsed.expiresAt, response: parsed.response, rules: parseRules(parsed.response) };
   } catch {
@@ -1270,14 +1286,14 @@ async function persistSnapshot(key, entry) {
   const filePath = persistentCachePath(key);
   const temporaryPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
   try {
-    await mkdir2(directory, { recursive: true, mode: 448 });
-    await chmod2(directory, 448);
-    await writeFile2(temporaryPath, JSON.stringify({ expiresAt: entry.expiresAt, response: entry.response }), { mode: 384 });
-    await chmod2(temporaryPath, 384);
-    await rename2(temporaryPath, filePath);
-    await chmod2(filePath, 384);
+    await mkdir3(directory, { recursive: true, mode: 448 });
+    await chmod3(directory, 448);
+    await writeFile3(temporaryPath, JSON.stringify({ expiresAt: entry.expiresAt, response: entry.response }), { mode: 384 });
+    await chmod3(temporaryPath, 384);
+    await rename3(temporaryPath, filePath);
+    await chmod3(filePath, 384);
   } catch {
-    await rm(temporaryPath, { force: true }).catch(() => void 0);
+    await rm2(temporaryPath, { force: true }).catch(() => void 0);
   }
 }
 function normalizedSymbol2(symbol) {
@@ -2511,7 +2527,7 @@ var ToolRegistry = class {
     if (tool.operation !== "write" || !tool.writeSummary) throw new AiHubError("AI_HUB_TOOL_NOT_WRITE", `Tool "${name}" is not a confirmable write Tool.`);
     const validInput = tool.validate(input);
     const preflightInput = tool.preflight ? await tool.preflight(validInput, context) : validInput;
-    return confirmations.prepare({
+    return await confirmations.prepare({
       action: tool.name,
       payload: preflightInput,
       context: confirmationContext(context),
@@ -2811,7 +2827,7 @@ function createServer(profileName, readOnly) {
   const registry = createToolRegistry();
   const writeExecutor = new ToolWriteExecutor(registry);
   const server = new Server(
-    { name: "ai-hub-agent-trade", version: "0.1.9" },
+    { name: "ai-hub-agent-trade", version: "0.1.10" },
     {
       capabilities: { tools: {} },
       instructions: "Every successful read-tool response provides both JSON text and MCP structuredContent in the envelope { ok: true, data: ... }. All read-tool data is normalized: dataType=array means use data.items and data.count; dataType=object or scalar means use data.value; dataType=null means no value. Inspect data.dataType before formatting and never assume undocumented nested keys. For a generic trading-pair list, call market_get_symbol_overview first; it returns only counts and a small sample. For paged or quote-asset browsing, use market_list_symbols. Use market_search_symbols only when the user gave a keyword; query is required. Use market_get_symbol_info only for exact precision and minimum rules. Do not use a symbol search as a generic all-symbol list. The complete raw symbols payload is intentionally unavailable in MCP. For broad market questions, call market_get_ticker_summary, market_get_depth_summary, market_get_trades_summary, or market_get_klines_summary instead of fetching large raw payloads. Account types are fixed: 1=Spot, 2=Isolated Margin, 3=Cross Margin, 4=C2C, 5=Derivatives. Never call account type 2 Derivatives. For Spot to Derivatives, use account_prepare_transfer with fromAccount=EXCHANGE and toAccount=FUTURE. Use wallet_prepare_universal_transfer for margin or C2C; account type 2 requires its isolated-margin trading pair in symbol. Prepare/confirm tools return their documented action payload directly in data. For every state-changing action, call only a spot_prepare_* or margin_prepare_* tool first and show its exact summary to the user. Stop and wait for a new, explicit user confirmation message. Only then call confirm_action with that new message verbatim in userConfirmation. Never call prepare and confirm consecutively for one user instruction; never infer confirmation from prior intent, silence, or an Agent-generated message. For spot and margin orders, MARKET BUY always uses quoteAmount (the quote asset to spend); MARKET SELL uses baseQuantity (the base asset to sell). Never reinterpret a requested base quantity as quoteAmount."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aihubspot/agent-trade-mcp",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Local stdio MCP server for AI Hub spot trading tools",
   "license": "UNLICENSED",
   "repository": {