@alfe.ai/ctrader-mcp 0.1.0 → 0.2.1

package/dist/server.js

@@ -16,14 +16,18 @@ import { z } from "zod";
 *
 * Like the other Alfe MCP servers, this one self-fetches its credentials at
 * startup via `@alfe.ai/agent-api-client`. The primary path is the
-* multi-account accessor `getCTraderAccounts()`: a single cTrader OAuth grant
-* covers ALL of the user's trading accounts on one shared `accessToken`, with
-* the SST-global app credentials (`clientId`/`clientSecret`) hoisted to the top
-* level. Only the `ctidTraderAccountId` and the protobuf socket `host` (live vs
-* demo) differ per account. We build an account *registry* from that set here
-* — one entry per account, grouped by host so a distinct socket serves each
-* distinct host (live vs demo). The cTrader Open API app-auth handshake needs
-* the raw client id/secret + access token on the box, which is why the connect
+* multi-account accessor `getCTraderAccounts()`, which aggregates trading
+* accounts across ALL of the agent's cTrader OAuth grants (multiple distinct
+* logins). Each account carries ITS OWN grant's `accessToken`; the SST-global
+* app credentials (`clientId`/`clientSecret`) are identical across grants and
+* hoisted to the top level. Only the `ctidTraderAccountId` and the protobuf
+* socket `host` (live vs demo) differ within a grant. We build an account
+* *registry* from that set here — one entry per account, each stamped with its
+* own token, grouped by host so a distinct socket serves each distinct host
+* (live vs demo). App-auth uses the global `clientId`/`clientSecret`, so one
+* live/demo socket serves accounts from multiple grants, each account-authed
+* with its own token. The cTrader Open API app-auth handshake needs the raw
+* client id/secret + access token on the box, which is why the connect
 * endpoint returns the full set rather than brokering each socket request.
 */
 /** cTrader Open API TLS endpoints. Port is always 5035. */
@@ -58,29 +62,32 @@ function resolveHost(raw) {
 *
 * Throws `ConfigError` (→ MCP startup failure, fail closed) when:
 *  - `accounts` is empty (no cTrader Connection — there is nothing to trade);
-*  - the shared app credentials (`clientId`/`clientSecret`/`accessToken`) are
-*    missing (every account needs them to authenticate);
+*  - the shared app credentials (`clientId`/`clientSecret`) are missing (every
+*    account needs them to app-authenticate);
 *  - after validating each account, no valid account remains.
 *
-* Individual accounts with an unparseable `ctidTraderAccountId` are skipped
-* (logged by the caller), but if that leaves the registry empty we fail closed
-* rather than start a server that can trade on nothing.
+* Each account carries its OWN grant's `accessToken` (accounts are aggregated
+* across multiple cTrader OAuth grants). Individual accounts with an
+* unparseable `ctidTraderAccountId` OR a missing `accessToken` are skipped
+* (the caller warns on the input-vs-registry-size count diff — see server.ts)
+* rather than poisoning the whole registry, but if that leaves the registry
+* empty we fail closed rather than start a server that can trade on nothing.
 */
 function buildRegistry(creds) {
 	const clientId = creds.clientId.trim();
 	const clientSecret = creds.clientSecret.trim();
-	const accessToken = creds.accessToken.trim();
 	if (creds.accounts.length === 0) throw new ConfigError("No cTrader trading accounts are authorized for this agent. Connect a cTrader account (OAuth) for this agent, then retry.");
 	const missing = [];
 	if (!clientId) missing.push("clientId");
 	if (!clientSecret) missing.push("clientSecret");
-	if (!accessToken) missing.push("accessToken");
 	if (missing.length > 0) throw new ConfigError(`The cTrader connection is missing shared credential field(s): ${missing.join(", ")}. Connect a cTrader account (OAuth) for this agent, then retry.`);
 	const registry = /* @__PURE__ */ new Map();
 	for (const account of creds.accounts) {
 		const idRaw = account.ctidTraderAccountId.trim();
 		const accountId = Number(idRaw);
 		if (!idRaw || !Number.isInteger(accountId) || accountId <= 0) continue;
+		const accessToken = account.accessToken.trim();
+		if (!accessToken) continue;
 		const host = resolveHost(account.host);
 		registry.set(idRaw, {
 			clientId,
@@ -93,7 +100,7 @@ function buildRegistry(creds) {
 			...account.accountNumber != null ? { accountNumber: account.accountNumber } : {}
 		});
 	}
-	if (registry.size === 0) throw new ConfigError("Every cTrader account returned had an unusable ctidTraderAccountId; cannot build a trading registry. Re-connect the cTrader account (OAuth).");
+	if (registry.size === 0) throw new ConfigError("Every cTrader account returned had an unusable ctidTraderAccountId or was missing its access token; cannot build a trading registry. Re-connect the cTrader account (OAuth).");
 	return registry;
 }
 //#endregion
@@ -371,9 +378,12 @@ function decodeTrendbar(bar) {
 * 10-second heartbeat, reconnect-on-drop, and cTrader-error mapping.
 *
 * ── Multi-account model ──
-* A single cTrader OAuth grant covers ALL of the user's trading accounts on one
-* shared access token; only the `ctidTraderAccountId` and the socket `host`
-* (live vs demo) differ per account. But one TLS socket dials exactly ONE host.
+* Within a SINGLE cTrader OAuth grant one shared access token covers all of that
+* login's accounts; ACROSS grants the tokens differ, so each account carries its
+* OWN grant token (`authedAccounts` memoizes account-auth per accountId, keyed by
+* that token — a changed token re-auths, so mixed-grant tokens on one host socket
+* work with zero extra code). Only the `ctidTraderAccountId` and the socket `host`
+* (live vs demo) drive routing. But one TLS socket dials exactly ONE host.
 * So the topology is:
 *
 *   CTraderPool  ── owns the account registry, one HostSocket per DISTINCT host
@@ -1258,17 +1268,20 @@ function assertExecution(res, extraOkTypes = /* @__PURE__ */ new Set()) {
 * Architecture:
 *   Agent runtime ←(stdio/MCP)→ this server ←(protobuf/TLS 5035)→ cTrader Open API
 *
-* ── Multi-account ──
+* ── Multi-account, multi-grant ──
 * Credentials are self-fetched at startup (the atlassian/google pattern):
 * `resolveConfig()` yields the agent's `{ apiKey, apiUrl }`, and
-* `AgentApiClient.getCTraderAccounts()` returns the full set of authorized
-* trading accounts on one OAuth grant — one shared `accessToken` +
-* SST-global `clientId`/`clientSecret`, with a per-account `ctidTraderAccountId`
-* and `host` (live vs demo). We build an account registry and drive a
-* `CTraderPool` that opens one authenticated socket per distinct host and
-* routes each tool call to the account it names (see client.ts). No account is
-* ever chosen implicitly when several are connected — the tools require an
-* explicit `accountId` in that case.
+* `AgentApiClient.getCTraderAccounts()` aggregates the authorized trading
+* accounts across ALL of the agent's cTrader OAuth grants (multiple distinct
+* logins). Each account carries ITS OWN grant's `accessToken`; only the global
+* app credentials (`clientId`/`clientSecret`) are shared across every grant and
+* hoisted to the top level. A per-account `ctidTraderAccountId` and `host`
+* (live vs demo) drive routing. We build an account registry and drive a
+* `CTraderPool` that opens one authenticated socket per distinct host — each
+* account is account-authed on that socket with its OWN token, so one live/demo
+* socket serves accounts from multiple grants — and routes each tool call to the
+* account it names (see client.ts). No account is ever chosen implicitly when
+* several are connected — the tools require an explicit `accountId` in that case.
 */
 function log(msg) {
 	process.stderr.write(`[ctrader-mcp] ${msg}\n`);
@@ -1281,7 +1294,10 @@ async function main() {
 	});
 	let registry;
 	try {
-		registry = buildRegistry(await apiClient.getCTraderAccounts());
+		const creds = await apiClient.getCTraderAccounts();
+		registry = buildRegistry(creds);
+		const dropped = creds.accounts.length - registry.size;
+		if (dropped > 0) log(`Warning: ${String(dropped)} of ${String(creds.accounts.length)} cTrader account(s) were skipped (unparseable ctidTraderAccountId or missing access token); ${String(registry.size)} usable.`);
 	} catch (err) {
 		if (err instanceof ConfigError) log(`No usable cTrader connection: ${err.message}`);
 		else log(`Failed to resolve cTrader accounts: ${err instanceof Error ? err.message : String(err)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/ctrader-mcp",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "cTrader MCP server — full trading (place/modify/close orders + read) over the cTrader Open API (protobuf/TLS)",
   "type": "module",
   "main": "./dist/server.js",
@@ -21,7 +21,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "protobufjs": "^8.7.0",
     "zod": "^4.0.5",
-    "@alfe.ai/agent-api-client": "0.10.0",
+    "@alfe.ai/agent-api-client": "0.11.0",
     "@alfe.ai/config": "0.3.0"
   },
   "license": "UNLICENSED",

package/proto/ctrader.proto

@@ -119,11 +119,16 @@ message ProtoOACtidTraderAccount {
   optional string brokerTitleShort    = 6;
 }
 
+// Canonical: permissionScope=3 (an enum upstream; we don't read it, kept as a
+// scalar), ctidTraderAccount=4. This response is declared for completeness but
+// is NOT on the live path — accounts come from AgentApiClient.getCTraderAccounts(),
+// not this socket call. Field numbers corrected to match canonical anyway so a
+// future decode of this message reads the account list at the right field.
 message ProtoOAGetAccountListByAccessTokenRes {
   optional uint32 payloadType                       = 1;
   required string accessToken                       = 2;
-  repeated ProtoOACtidTraderAccount ctidTraderAccount = 3;
-  optional bool   permissionScope                   = 4;
+  optional uint32 permissionScope                   = 3;
+  repeated ProtoOACtidTraderAccount ctidTraderAccount = 4;
 }
 
 // ── Trader (balance / account details) ──────────────────────────────────
@@ -194,30 +199,33 @@ message ProtoOAPosition {
   optional bool             trailingStopLoss = 16;
 }
 
+// NOTE: canonical ProtoOAOrder has NO field 5 — it jumps orderStatus=4 → expirationTimestamp=6.
+// Field numbers below are transcribed verbatim from Spotware's ProtoOAOrder
+// (relativeStopLoss/relativeTakeProfit are int64, not double, upstream).
 message ProtoOAOrder {
   required int64            orderId       = 1;
   required ProtoOATradeData tradeData     = 2;
   required ProtoOAOrderType orderType     = 3;
   required uint32           orderStatus   = 4;
-  optional int64            expirationTimestamp = 5;
-  optional double           executionPrice = 6;
-  optional int64            executedVolume = 7;
-  optional int64            utcLastUpdateTimestamp = 8;
-  optional double           baseSlippagePrice = 9;
-  optional int64            slippageInPoints = 10;
-  optional bool             closingOrder  = 11;
-  optional double           limitPrice    = 12;
-  optional double           stopPrice     = 13;
-  optional double           stopLoss      = 14;
-  optional double           takeProfit    = 15;
-  optional string           clientOrderId = 16;
-  optional uint32           timeInForce   = 17;
-  optional int64            positionId    = 18;
-  optional double           relativeStopLoss = 19;
-  optional double           relativeTakeProfit = 20;
-  optional bool             isStopOut     = 21;
-  optional bool             trailingStopLoss = 22;
-  optional uint32           stopTriggerMethod = 23;
+  optional int64            expirationTimestamp = 6;
+  optional double           executionPrice = 7;
+  optional int64            executedVolume = 8;
+  optional int64            utcLastUpdateTimestamp = 9;
+  optional double           baseSlippagePrice = 10;
+  optional int64            slippageInPoints = 11;
+  optional bool             closingOrder  = 12;
+  optional double           limitPrice    = 13;
+  optional double           stopPrice     = 14;
+  optional double           stopLoss      = 15;
+  optional double           takeProfit    = 16;
+  optional string           clientOrderId = 17;
+  optional uint32           timeInForce   = 18;
+  optional int64            positionId    = 19;
+  optional int64            relativeStopLoss = 20;
+  optional int64            relativeTakeProfit = 21;
+  optional bool             isStopOut     = 22;
+  optional bool             trailingStopLoss = 23;
+  optional uint32           stopTriggerMethod = 24;
 }
 
 message ProtoOAReconcileReq {
@@ -278,7 +286,10 @@ message ProtoOASymbol {
   optional int64  minVolume          = 10;
   optional int64  stepVolume         = 11;
   optional int64  maxExposure        = 12;
-  optional int64  lotSize            = 21;
+  // lotSize is canonical field 30 (NOT 21 — field 21 is the deprecated
+  // minCommission). Reading it at 21 yields 0 for XAUUSD → SYMBOL_NO_LOTSIZE
+  // and mis-sizes volume for any symbol where field 21 is non-zero.
+  optional int64  lotSize            = 30;
 }
 
 message ProtoOASymbolByIdReq {
@@ -421,14 +432,18 @@ message ProtoOACancelOrderReq {
   required int64  orderId             = 3;
 }
 
+// errorCode is canonical field 9 and isServerEvent field 10 (fields 6/7/8 are
+// deal / bonusDepositWithdraw / depositWithdraw upstream, which we don't decode).
+// An order-op rejection can ride here with errorCode set, so the field number
+// is on the money path — reading errorCode at 8 misses the reject entirely.
 message ProtoOAExecutionEvent {
   optional uint32          payloadType         = 1;
   required int64           ctidTraderAccountId = 2;
   required uint32          executionType       = 3;
   optional ProtoOAPosition position            = 4;
   optional ProtoOAOrder    order               = 5;
-  optional string          errorCode           = 8;
-  optional bool            isServerEvent       = 9;
+  optional string          errorCode           = 9;
+  optional bool            isServerEvent       = 10;
 }
 
 // ── Order-error event (payloadType 2132) ────────────────────────────────
@@ -437,11 +452,15 @@ message ProtoOAExecutionEvent {
 // hours, insufficient margin, etc.). Field numbers/types transcribed from
 // Spotware's ProtoOAOrderErrorEvent (OpenApiMessages.proto). This is a REJECT
 // on a money path — it MUST map to a CTraderError, never resolve as success.
+// Canonical field numbers are NOT sequential: errorCode=2, orderId=3,
+// ctidTraderAccountId=5, positionId=6, description=7. Getting these wrong
+// means the reject decodes to an empty errorCode and fails to map to a
+// CTraderError — reintroducing the 2132 phantom-success bug.
 message ProtoOAOrderErrorEvent {
   optional uint32 payloadType         = 1;
-  required int64  ctidTraderAccountId = 2;
-  required string errorCode           = 3;
-  optional int64  orderId             = 4;
-  optional int64  positionId          = 5;
-  optional string description         = 6;
+  required string errorCode           = 2;
+  optional int64  orderId             = 3;
+  required int64  ctidTraderAccountId = 5;
+  optional int64  positionId          = 6;
+  optional string description         = 7;
 }