@alfe.ai/ctrader-mcp 0.3.5 → 0.3.7

package/dist/server.js

@@ -6,9 +6,9 @@ import { resolveConfig } from "@alfe.ai/config";
 import { AgentApiClient } from "@alfe.ai/agent-api-client";
 import { randomUUID } from "node:crypto";
 import * as tls from "node:tls";
+import protobuf from "protobufjs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
-import protobuf from "protobufjs";
 import { z } from "zod";
 //#region src/config.ts
 /**
@@ -41,6 +41,15 @@ var ConfigError = class extends Error {
 		this.name = "ConfigError";
 	}
 };
+const MAX_INT64 = 9223372036854775807n;
+function parseAccountId(raw) {
+	if (!/^[1-9][0-9]*$/.test(raw)) return null;
+	try {
+		return BigInt(raw) <= MAX_INT64 ? raw : null;
+	} catch {
+		return null;
+	}
+}
 /**
 * Resolve the TLS host from a live/demo hint.
 *
@@ -84,18 +93,22 @@ function buildRegistry(creds) {
 	const registry = /* @__PURE__ */ new Map();
 	for (const account of creds.accounts) {
 		const idRaw = account.ctidTraderAccountId.trim();
-		const accountId = Number(idRaw);
-		if (!idRaw || !Number.isInteger(accountId) || accountId <= 0) continue;
+		const accountId = parseAccountId(idRaw);
+		if (accountId == null) continue;
 		const accessToken = account.accessToken.trim();
 		if (!accessToken) continue;
 		const host = resolveHost(account.host);
-		registry.set(idRaw, {
+		const isLive = host === CTRADER_LIVE_HOST;
+		if (typeof account.isLive !== "boolean" || account.isLive !== isLive) throw new ConfigError(`cTrader account ${idRaw} has conflicting host/live metadata; refusing ambiguous real-money routing.`);
+		const canonicalId = accountId;
+		if (registry.has(canonicalId)) throw new ConfigError(`Duplicate cTrader account ${canonicalId} was returned; refusing ambiguous credential/host routing.`);
+		registry.set(canonicalId, {
 			clientId,
 			clientSecret,
 			accessToken,
 			accountId,
 			host,
-			isLive: account.isLive,
+			isLive,
 			...account.brokerName != null ? { brokerName: account.brokerName } : {},
 			...account.accountNumber != null ? { accountNumber: account.accountNumber } : {}
 		});
@@ -222,6 +235,36 @@ const RESPONSE_MESSAGE = {
 	[PayloadType.OA_ORDER_ERROR_EVENT]: "ctrader.ProtoOAOrderErrorEvent",
 	[PayloadType.OA_ERROR_RES]: "ctrader.ProtoOAErrorRes"
 };
+/**
+* The only successful correlated reply accepted for each request. cTrader can
+* also answer any request with one of the error payloads handled by the
+* client. Keeping the success contract explicit prevents an unrelated frame
+* that happens to reuse a clientMsgId from being reported as success.
+*/
+const EXPECTED_RESPONSE = {
+	[PayloadType.OA_APPLICATION_AUTH_REQ]: PayloadType.OA_APPLICATION_AUTH_RES,
+	[PayloadType.OA_ACCOUNT_AUTH_REQ]: PayloadType.OA_ACCOUNT_AUTH_RES,
+	[PayloadType.OA_GET_ACCOUNT_LIST_BY_ACCESS_TOKEN_REQ]: PayloadType.OA_GET_ACCOUNT_LIST_BY_ACCESS_TOKEN_RES,
+	[PayloadType.OA_TRADER_REQ]: PayloadType.OA_TRADER_RES,
+	[PayloadType.OA_RECONCILE_REQ]: PayloadType.OA_RECONCILE_RES,
+	[PayloadType.OA_SYMBOLS_LIST_REQ]: PayloadType.OA_SYMBOLS_LIST_RES,
+	[PayloadType.OA_SYMBOL_BY_ID_REQ]: PayloadType.OA_SYMBOL_BY_ID_RES,
+	[PayloadType.OA_GET_TRENDBARS_REQ]: PayloadType.OA_GET_TRENDBARS_RES,
+	[PayloadType.OA_SUBSCRIBE_SPOTS_REQ]: PayloadType.OA_SUBSCRIBE_SPOTS_RES,
+	[PayloadType.OA_UNSUBSCRIBE_SPOTS_REQ]: PayloadType.OA_UNSUBSCRIBE_SPOTS_RES,
+	[PayloadType.OA_SUBSCRIBE_DEPTH_QUOTES_REQ]: PayloadType.OA_SUBSCRIBE_DEPTH_QUOTES_RES,
+	[PayloadType.OA_UNSUBSCRIBE_DEPTH_QUOTES_REQ]: PayloadType.OA_UNSUBSCRIBE_DEPTH_QUOTES_RES,
+	[PayloadType.OA_DEAL_LIST_REQ]: PayloadType.OA_DEAL_LIST_RES,
+	[PayloadType.OA_GET_TICKDATA_REQ]: PayloadType.OA_GET_TICKDATA_RES,
+	[PayloadType.OA_EXPECTED_MARGIN_REQ]: PayloadType.OA_EXPECTED_MARGIN_RES,
+	[PayloadType.OA_CASH_FLOW_HISTORY_LIST_REQ]: PayloadType.OA_CASH_FLOW_HISTORY_LIST_RES,
+	[PayloadType.OA_GET_POSITION_UNREALIZED_PNL_REQ]: PayloadType.OA_GET_POSITION_UNREALIZED_PNL_RES,
+	[PayloadType.OA_NEW_ORDER_REQ]: PayloadType.OA_EXECUTION_EVENT,
+	[PayloadType.OA_AMEND_ORDER_REQ]: PayloadType.OA_EXECUTION_EVENT,
+	[PayloadType.OA_AMEND_POSITION_SLTP_REQ]: PayloadType.OA_EXECUTION_EVENT,
+	[PayloadType.OA_CLOSE_POSITION_REQ]: PayloadType.OA_EXECUTION_EVENT,
+	[PayloadType.OA_CANCEL_ORDER_REQ]: PayloadType.OA_EXECUTION_EVENT
+};
 //#endregion
 //#region src/proto.ts
 /**
@@ -270,6 +313,45 @@ function loadRoot(protoPath = resolveProtoPath()) {
 	cachedRoot ??= protobuf.loadSync(protoPath);
 	return cachedRoot;
 }
+/** Hard ceiling for one cTrader envelope and the parser's retained buffer. */
+const MAX_FRAME_LENGTH_BYTES = 16 * 1024 * 1024;
+const INT64_FIELD_TYPES = new Set([
+	"int64",
+	"uint64",
+	"sint64",
+	"fixed64",
+	"sfixed64"
+]);
+function normalizeFieldValue(field, value) {
+	if (field.repeated) {
+		if (!Array.isArray(value)) return value;
+		return value.map((entry) => normalizeSingularFieldValue(field, entry));
+	}
+	if (field.map) {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) return value;
+		return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, normalizeSingularFieldValue(field, entry)]));
+	}
+	return normalizeSingularFieldValue(field, value);
+}
+function normalizeSingularFieldValue(field, value) {
+	if (field.resolvedType instanceof protobuf.Type && typeof value === "object" && value !== null && !Array.isArray(value)) return normalizeInt64Strings(field.resolvedType, value);
+	if (INT64_FIELD_TYPES.has(field.type) && typeof value === "string") {
+		const unsigned = field.type === "uint64" || field.type === "fixed64";
+		return protobuf.util.LongBits.from(value).toLong(unsigned);
+	}
+	return value;
+}
+/**
+* Convert only protobuf int64 decimal strings to exact Long values before
+* validation. Unlike `fromObject`, this preserves missing required fields so
+* `verify` still rejects malformed payloads instead of filling defaults.
+*/
+function normalizeInt64Strings(type, payload) {
+	return Object.fromEntries(Object.entries(payload).map(([name, value]) => {
+		if (!Object.hasOwn(type.fields, name)) return [name, value];
+		return [name, normalizeFieldValue(type.fields[name], value)];
+	}));
+}
 /**
 * Encode an outbound request into a fully-framed buffer:
 * length prefix + ProtoMessage(payloadType, payload, clientMsgId).
@@ -278,9 +360,16 @@ function encodeRequest(root, payloadType, payload, clientMsgId) {
 	const messageName = REQUEST_MESSAGE[payloadType];
 	if (!messageName) throw new Error(`No request message registered for payloadType ${String(payloadType)}`);
 	const InnerType = root.lookupType(messageName);
-	const innerErr = InnerType.verify(payload);
+	let normalizedPayload;
+	try {
+		normalizedPayload = normalizeInt64Strings(InnerType, payload);
+	} catch (err) {
+		throw new Error(`Invalid ${messageName} payload: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const innerErr = InnerType.verify(normalizedPayload);
 	if (innerErr) throw new Error(`Invalid ${messageName} payload: ${innerErr}`);
-	const innerBytes = InnerType.encode(InnerType.create(payload)).finish();
+	const innerMessage = InnerType.create(normalizedPayload);
+	const innerBytes = InnerType.encode(innerMessage).finish();
 	const Envelope = root.lookupType("ctrader.ProtoMessage");
 	const envelopeBytes = Envelope.encode(Envelope.create({
 		payloadType,
@@ -306,11 +395,19 @@ function decodeEnvelope(root, envelopeBytes) {
 var FrameParser = class {
 	buffer = Buffer.alloc(0);
 	push(chunk) {
+		if (this.buffer.length + chunk.byteLength > 16777220) {
+			this.buffer = Buffer.alloc(0);
+			throw new Error(`cTrader frame buffer exceeds ${String(MAX_FRAME_LENGTH_BYTES)} bytes`);
+		}
 		this.buffer = Buffer.concat([this.buffer, chunk]);
 		const frames = [];
 		for (;;) {
 			if (this.buffer.length < 4) break;
 			const length = this.buffer.readUInt32BE(0);
+			if (length === 0 || length > 16777216) {
+				this.buffer = Buffer.alloc(0);
+				throw new Error(`Invalid cTrader frame length ${String(length)}`);
+			}
 			if (this.buffer.length < 4 + length) break;
 			frames.push(this.buffer.subarray(4, 4 + length));
 			this.buffer = this.buffer.subarray(4 + length);
@@ -374,9 +471,13 @@ function volumeToLots(volume, lotSize) {
 * are in the same centi-unit space. Returns an error string, or null if valid.
 */
 function validateVolume(volume, minVolume, maxVolume, stepVolume) {
+	if (!Number.isSafeInteger(volume) || volume <= 0) return `volume must be a positive safe integer, got ${String(volume)}`;
+	if (!Number.isSafeInteger(minVolume) || minVolume <= 0) return `symbol minimum volume is invalid: ${String(minVolume)}`;
+	if (!Number.isSafeInteger(maxVolume) || maxVolume < minVolume) return `symbol maximum volume is invalid: ${String(maxVolume)}`;
+	if (!Number.isSafeInteger(stepVolume) || stepVolume <= 0) return `symbol volume step is invalid: ${String(stepVolume)}`;
 	if (volume < minVolume) return `volume ${String(volume)} is below the symbol minimum ${String(minVolume)}`;
-	if (maxVolume > 0 && volume > maxVolume) return `volume ${String(volume)} exceeds the symbol maximum ${String(maxVolume)}`;
-	if (stepVolume > 0 && (volume - minVolume) % stepVolume !== 0) return `volume ${String(volume)} does not align to the symbol step ${String(stepVolume)} (offset from min ${String(minVolume)})`;
+	if (volume > maxVolume) return `volume ${String(volume)} exceeds the symbol maximum ${String(maxVolume)}`;
+	if ((volume - minVolume) % stepVolume !== 0) return `volume ${String(volume)} does not align to the symbol step ${String(stepVolume)} (offset from min ${String(minVolume)})`;
 	return null;
 }
 /** cTrader trendbar/spot integer prices are scaled by 10^5. */
@@ -490,25 +591,48 @@ var CTraderError = class extends Error {
 * execution events for other sessions, …).
 */
 const LISTENABLE_EVENTS = new Set([PayloadType.OA_DEPTH_EVENT, PayloadType.OA_SPOT_EVENT]);
-const HEARTBEAT_INTERVAL_MS = 1e4;
+/**
+* Halved from 10s so the read-idle watchdog can detect a wedged socket before
+* `REQUEST_TIMEOUT_MS` fires, while still tolerating two consecutive missed
+* echoes (see `READ_IDLE_TIMEOUT_MS`). cTrader expects a heartbeat at least
+* every 10s and drops an idle connection at ~30s, so 5s is well within
+* protocol expectations. Heartbeats are protocol keepalives, not part of the
+* historical-data payload class that gets rate limited.
+*/
+const HEARTBEAT_INTERVAL_MS = 5e3;
 const REQUEST_TIMEOUT_MS = 2e4;
 const RECONNECT_BASE_MS = 1e3;
 const RECONNECT_MAX_MS = 3e4;
+const MAX_PENDING_REQUESTS = 256;
 /**
-* Read-idle watchdog: cTrader echoes our 10s heartbeats and pushes its own
-* traffic, so a *healthy* socket is never silent for long. If NO inbound byte
-* arrives for this long we treat the socket as silently half-dead (a TCP
-* half-open with no FIN — the OS never fires `close`, so `handleDrop` never
-* runs and every request would otherwise time out at 20s indefinitely) and
-* force a reconnect. Set to 3× the heartbeat interval so a single dropped
-* heartbeat echo doesn't false-positive.
+* Read-idle watchdog: cTrader echoes our heartbeats and pushes its own traffic,
+* so a *healthy* socket is never silent for long. If NO inbound byte arrives
+* for this long we treat the socket as silently half-dead (a TCP half-open with
+* no FIN — the OS never fires `close`, so `handleDrop` never runs and every
+* request would otherwise time out indefinitely) and force a reconnect. Set to
+* 3× the heartbeat interval so two dropped heartbeat echoes don't false-positive.
 */
 const READ_IDLE_TIMEOUT_MS = 3 * HEARTBEAT_INTERVAL_MS;
 /** How often the watchdog checks the read-idle clock. */
-const WATCHDOG_INTERVAL_MS = HEARTBEAT_INTERVAL_MS;
+const WATCHDOG_INTERVAL_MS = HEARTBEAT_INTERVAL_MS / 2;
+/**
+* Detection must beat the request timeout, or the watchdog is useless to the
+* caller that trips it: a wedged socket surfaces an ambiguous `REQUEST_TIMEOUT`
+* (indistinguishable from a slow server) instead of the fast, honest,
+* retryable `CONNECTION_DROPPED` the reconnect path exists to produce.
+*
+* That was the shipped state — 30s idle + 10s poll = up to 40s to detect, vs a
+* 20s request timeout — so the 0.3.1 watchdog never spared the first caller.
+* Worst-case detection is READ_IDLE_TIMEOUT_MS + WATCHDOG_INTERVAL_MS.
+*/
+if (READ_IDLE_TIMEOUT_MS + WATCHDOG_INTERVAL_MS >= REQUEST_TIMEOUT_MS) throw new Error(`ctrader-mcp timing misconfigured: read-idle detection (${String(READ_IDLE_TIMEOUT_MS + WATCHDOG_INTERVAL_MS)}ms) must be faster than REQUEST_TIMEOUT_MS (${String(REQUEST_TIMEOUT_MS)}ms).`);
 function log$1(msg) {
 	process.stderr.write(`[ctrader-mcp] ${msg}\n`);
 }
+/** Convert a validated decimal account id to an exact protobuf int64 value. */
+function accountIdLong(accountId) {
+	return protobuf.util.LongBits.from(accountId).toLong(false);
+}
 /** Production TLS transport. */
 const tlsConnect = (host, port) => new Promise((resolve, reject) => {
 	const socket = tls.connect({
@@ -548,6 +672,7 @@ var HostSocket = class {
 	reconnectScheduled = false;
 	closing = false;
 	connectPromise = null;
+	reconnectPromise = null;
 	/** ctidTraderAccountId → accessToken used to account-auth it on this socket. */
 	authedAccounts = /* @__PURE__ */ new Map();
 	/** Serializes account-auth so concurrent tool calls don't double-auth. */
@@ -563,17 +688,44 @@ var HostSocket = class {
 	}
 	/** Connect the socket and run the app-auth handshake. Idempotent. */
 	async start() {
-		this.connectPromise ??= this.doStart();
-		return this.connectPromise;
+		if (this.closing) throw new CTraderError("CLIENT_CLOSED", "Client is shutting down");
+		if (this.conn) return;
+		if (this.reconnectPromise) return this.reconnectPromise;
+		if (this.connectPromise) return this.connectPromise;
+		const attempt = this.establishConnection();
+		this.connectPromise = attempt;
+		try {
+			await attempt;
+		} finally {
+			if (this.connectPromise === attempt) this.connectPromise = null;
+		}
 	}
-	async doStart() {
-		this.conn = await this.connectFn(this.host, CTRADER_PORT);
+	async establishConnection() {
+		const conn = await this.connectFn(this.host, CTRADER_PORT);
+		if (this.closing) {
+			conn.destroy();
+			throw new CTraderError("CLIENT_CLOSED", "Client closed while connecting");
+		}
+		this.parser = new FrameParser();
+		this.conn = conn;
 		this.lastInboundAt = Date.now();
-		this.wireConnection(this.conn);
-		await this.appAuth();
-		this.startHeartbeat();
-		this.startWatchdog();
-		log$1(`Connected + app-authenticated to ${this.host}`);
+		this.wireConnection(conn);
+		try {
+			await this.appAuth();
+			if (this.conn !== conn) throw new CTraderError("CONNECTION_DROPPED", "Socket dropped during application authentication");
+			this.startHeartbeat();
+			this.startWatchdog();
+			log$1(`Connected + app-authenticated to ${this.host}`);
+		} catch (err) {
+			if (this.conn === conn) {
+				this.conn = null;
+				this.parser = new FrameParser();
+				try {
+					conn.destroy();
+				} catch {}
+			}
+			throw err;
+		}
 	}
 	/**
 	* Ensure `accountId` is account-authed on this socket. Deduped: an account is
@@ -586,7 +738,7 @@ var HostSocket = class {
 		let inFlight = this.accountAuthPromises.get(accountId);
 		if (!inFlight) {
 			inFlight = this.request(PayloadType.OA_ACCOUNT_AUTH_REQ, {
-				ctidTraderAccountId: accountId,
+				ctidTraderAccountId: accountIdLong(accountId),
 				accessToken
 			}).then(() => {
 				this.authedAccounts.set(accountId, accessToken);
@@ -612,14 +764,24 @@ var HostSocket = class {
 	}
 	wireConnection(conn) {
 		conn.on("data", (chunk) => {
+			if (this.conn !== conn || this.closing) return;
 			this.lastInboundAt = Date.now();
-			for (const frame of this.parser.push(chunk)) this.dispatch(frame);
+			try {
+				for (const frame of this.parser.push(chunk)) this.dispatch(frame);
+			} catch (err) {
+				log$1(`Invalid frame stream (${this.host}): ${err instanceof Error ? err.message : String(err)}`);
+				this.handleDrop(conn);
+				try {
+					conn.destroy();
+				} catch {}
+			}
 		});
 		conn.on("error", (err) => {
+			if (this.conn !== conn || this.closing) return;
 			log$1(`Socket error (${this.host}): ${err.message}`);
 		});
 		conn.on("close", () => {
-			if (!this.closing) this.handleDrop();
+			if (!this.closing) this.handleDrop(conn);
 		});
 	}
 	async appAuth() {
@@ -680,18 +842,17 @@ var HostSocket = class {
 	*/
 	forceReconnect() {
 		const dead = this.conn;
-		this.conn = null;
+		if (!dead) return;
+		this.handleDrop(dead);
 		try {
-			dead?.destroy();
+			dead.destroy();
 		} catch {}
-		this.handleDrop();
 	}
-	handleDrop() {
-		if (!this.conn && this.heartbeatTimer === null && this.reconnectScheduled) return;
+	handleDrop(dropped) {
+		if (this.conn !== dropped) return;
 		log$1(`Socket dropped (${this.host}) — attempting reconnect`);
 		this.stopHeartbeat();
 		this.stopWatchdog();
-		this.reconnectScheduled = true;
 		this.conn = null;
 		this.parser = new FrameParser();
 		this.authedAccounts.clear();
@@ -700,27 +861,32 @@ var HostSocket = class {
 			req.reject(new CTraderError("CONNECTION_DROPPED", "Socket closed before a response arrived"));
 			this.pending.delete(id);
 		}
-		this.reconnect();
+		if (!this.reconnectScheduled && !this.closing) {
+			this.reconnectScheduled = true;
+			const attempt = this.reconnect();
+			this.reconnectPromise = attempt;
+			attempt.then(() => {
+				if (this.reconnectPromise === attempt) this.reconnectPromise = null;
+			}, () => {
+				if (this.reconnectPromise === attempt) this.reconnectPromise = null;
+			});
+		}
 	}
 	async reconnect() {
-		if (this.closing) return;
-		const delay = Math.min(RECONNECT_BASE_MS * 2 ** this.reconnectAttempts, RECONNECT_MAX_MS);
-		this.reconnectAttempts += 1;
-		await new Promise((r) => setTimeout(r, delay));
-		if (this.closing) return;
-		try {
-			this.conn = await this.connectFn(this.host, CTRADER_PORT);
-			this.lastInboundAt = Date.now();
-			this.wireConnection(this.conn);
-			await this.appAuth();
-			this.startHeartbeat();
-			this.startWatchdog();
-			this.reconnectAttempts = 0;
-			this.reconnectScheduled = false;
-			log$1(`Reconnected + re-app-authenticated (${this.host})`);
-		} catch (err) {
-			log$1(`Reconnect failed (${this.host}): ${err instanceof Error ? err.message : String(err)}`);
-			this.reconnect();
+		while (!this.closing) {
+			const delay = Math.min(RECONNECT_BASE_MS * 2 ** this.reconnectAttempts, RECONNECT_MAX_MS);
+			this.reconnectAttempts += 1;
+			await new Promise((r) => setTimeout(r, delay));
+			if (this.closing) return;
+			try {
+				await this.establishConnection();
+				this.reconnectAttempts = 0;
+				this.reconnectScheduled = false;
+				log$1(`Reconnected + re-app-authenticated (${this.host})`);
+				return;
+			} catch (err) {
+				log$1(`Reconnect failed (${this.host}): ${err instanceof Error ? err.message : String(err)}`);
+			}
 		}
 	}
 	dispatch(frame) {
@@ -754,6 +920,10 @@ var HostSocket = class {
 			waiter.reject(err);
 			return;
 		}
+		if (decoded.payloadType !== waiter.expectedPayloadType) {
+			waiter.reject(new CTraderError("UNEXPECTED_RESPONSE", `Request payloadType ${String(waiter.requestPayloadType)} expected ${String(waiter.expectedPayloadType)} but received ${String(decoded.payloadType)}`));
+			return;
+		}
 		waiter.resolve({
 			payloadType: decoded.payloadType,
 			message: decoded.message
@@ -783,6 +953,10 @@ var HostSocket = class {
 	*/
 	async request(payloadType, payload) {
 		if (!this.conn) throw new CTraderError("NOT_CONNECTED", `The cTrader socket to ${this.host} is not connected`);
+		if (this.pending.size >= MAX_PENDING_REQUESTS) throw new CTraderError("TOO_MANY_PENDING_REQUESTS", `The cTrader socket already has ${String(MAX_PENDING_REQUESTS)} requests awaiting replies`);
+		const expectedPayloadType = EXPECTED_RESPONSE[payloadType];
+		if (expectedPayloadType == null) throw new CTraderError("UNSUPPORTED_REQUEST", `No successful response contract is registered for payloadType ${String(payloadType)}`);
+		const conn = this.conn;
 		const clientMsgId = randomUUID();
 		const frame = encodeRequest(this.root, payloadType, payload, clientMsgId);
 		return new Promise((resolve, reject) => {
@@ -792,11 +966,29 @@ var HostSocket = class {
 			}, REQUEST_TIMEOUT_MS);
 			timer.unref();
 			this.pending.set(clientMsgId, {
+				requestPayloadType: payloadType,
+				expectedPayloadType,
 				resolve,
 				reject,
 				timer
 			});
-			this.conn?.write(frame);
+			if (this.conn !== conn) {
+				clearTimeout(timer);
+				this.pending.delete(clientMsgId);
+				reject(new CTraderError("CONNECTION_DROPPED", "Socket changed before the request was written"));
+				return;
+			}
+			try {
+				conn.write(frame);
+			} catch (err) {
+				clearTimeout(timer);
+				this.pending.delete(clientMsgId);
+				reject(new CTraderError("REQUEST_WRITE_FAILED", err instanceof Error ? err.message : "The socket rejected the request write"));
+				this.handleDrop(conn);
+				try {
+					conn.destroy();
+				} catch {}
+			}
 		});
 	}
 	/** Clean shutdown: stop heartbeat, fail waiters, destroy the socket. */
@@ -811,6 +1003,7 @@ var HostSocket = class {
 		}
 		this.conn?.destroy();
 		this.conn = null;
+		this.connectPromise = null;
 		this.authedAccounts.clear();
 		this.eventListeners.clear();
 	}
@@ -864,10 +1057,10 @@ var CTraderPool = class {
 	* Route a request to a specific account. Resolves the account → its host
 	* socket, ensures the socket is connected + app-authed and the account is
 	* account-authed, then sends the request. Every account-scoped request must
-	* go through here so it lands on the RIGHT host socket. The account's
-	* `ctidTraderAccountId` is NOT auto-injected into the payload — callers pass
-	* the full payload — but the request is guaranteed to run on the socket that
-	* serves this account's host.
+	* go through here so it lands on the RIGHT host socket. The routed registry
+	* entry is authoritative: its `ctidTraderAccountId` is injected after the
+	* caller payload, so host/auth selection and protobuf account identity can
+	* never diverge.
 	*
 	* Throws `CTraderError("UNKNOWN_ACCOUNT")` if the id isn't in the registry
 	* (fail closed — never fall back to another account).
@@ -877,7 +1070,10 @@ var CTraderPool = class {
 		if (!config) throw new CTraderError("UNKNOWN_ACCOUNT", `Account ${accountId} is not connected`);
 		const socket = this.socketFor(config);
 		await socket.authenticateAccount(config.accountId, config.accessToken);
-		return socket.request(payloadType, payload);
+		return socket.request(payloadType, {
+			...payload,
+			ctidTraderAccountId: accountIdLong(config.accountId)
+		});
 	}
 	/**
 	* Register an unsolicited-event listener on the socket that serves
@@ -988,13 +1184,32 @@ const EXECUTION_TYPE_NAME = {
 	11: "ORDER_PARTIAL_FILL",
 	12: "BONUS_DEPOSIT_WITHDRAW"
 };
-/** Execution types that mean the write did NOT succeed as intended. */
-const FAILED_EXECUTION_TYPES = new Set([
-	5,
-	6,
-	7,
-	8
+const PLACE_ORDER_SUCCESS_TYPES = new Set([
+	2,
+	3,
+	11
+]);
+const AMEND_SUCCESS_TYPES = new Set([4]);
+const CLOSE_SUCCESS_TYPES = new Set([3, 11]);
+const CANCEL_SUCCESS_TYPES = new Set([5]);
+const WRITE_TOOL_NAMES = new Set([
+	"place_order",
+	"modify_order",
+	"close_position",
+	"cancel_order"
 ]);
+const READ_ANNOTATIONS = {
+	readOnlyHint: true,
+	destructiveHint: false,
+	idempotentHint: true,
+	openWorldHint: true
+};
+const WRITE_ANNOTATIONS = {
+	readOnlyHint: false,
+	destructiveHint: true,
+	idempotentHint: false,
+	openWorldHint: true
+};
 const TRENDBAR_PERIOD = {
 	M1: 1,
 	M2: 2,
@@ -1037,7 +1252,7 @@ function num(v) {
 /** Serialize an account for a listing (both the registry and error payloads). */
 function describeAccount(config) {
 	return {
-		accountId: String(config.accountId),
+		accountId: config.accountId,
 		isLive: config.isLive,
 		host: config.host,
 		broker: config.brokerName ?? null,
@@ -1094,12 +1309,12 @@ function isToolError(v) {
 	return "content" in v;
 }
 /** Fetch a symbol's full detail (for lotSize / volume rules / digits). */
-async function getSymbolDetail(pool, accountId, numericAccountId, symbolId) {
+async function getSymbolDetail(pool, accountId, ctidTraderAccountId, symbolId) {
 	const symbols = (await pool.request(accountId, PayloadType.OA_SYMBOL_BY_ID_REQ, {
-		ctidTraderAccountId: numericAccountId,
+		ctidTraderAccountId,
 		symbolId: [symbolId]
 	})).message.symbol ?? [];
-	if (symbols.length === 0) throw new CTraderError("SYMBOL_NOT_FOUND", `No symbol with id ${String(symbolId)} on this account`);
+	if (symbols.length === 0) throw new CTraderError("SYMBOL_NOT_FOUND", `No symbol with id ${symbolId} on this account`);
 	return symbols[0];
 }
 /** Unref'd sleep so a pending collection window never keeps the process alive. */
@@ -1146,25 +1361,42 @@ const LIVE_SUBSCRIPTION = {
 		event: PayloadType.OA_SPOT_EVENT
 	}
 };
+const MAX_SIGNED_INT64 = 9223372036854775807n;
+function isCanonicalInt64(value) {
+	if (!/^[1-9][0-9]*$/.test(value)) return false;
+	try {
+		return BigInt(value) <= MAX_SIGNED_INT64;
+	} catch {
+		return false;
+	}
+}
+/**
+* cTrader identifiers are int64 values and are returned to tools as decimal
+* strings. Accept safe JSON numbers for compatibility, but never round an
+* unsafe number or exponent/decimal string through JavaScript Number.
+*/
+function int64IdField(description) {
+	return z.union([z.string(), z.number().int().positive()]).transform((value) => String(value)).refine(isCanonicalInt64, "Expected a canonical positive signed-int64 decimal string").describe(description);
+}
 /**
 * Subscribe → run `collect` while `handler` receives this symbol's events →
 * ALWAYS unsubscribe + unregister (finally). The unsubscribe is best-effort:
 * its failure is logged, never masks the result, and a truly leaked
 * subscription dies with the socket.
 */
-async function withLiveSubscription(pool, numericAccountId, symbolId, kind, handler, collect) {
-	const accountId = String(numericAccountId);
+async function withLiveSubscription(pool, ctidTraderAccountId, symbolId, kind, handler, collect) {
+	const accountId = ctidTraderAccountId;
 	const sub = LIVE_SUBSCRIPTION[kind];
-	return withLiveDataLock(`${accountId}:${String(symbolId)}:${kind}`, async () => {
+	return withLiveDataLock(`${accountId}:${symbolId}:${kind}`, async () => {
 		const unregister = pool.onAccountEvent(accountId, (event) => {
 			if (event.payloadType !== sub.event) return;
 			if (str(event.message.ctidTraderAccountId) !== accountId) return;
-			if (str(event.message.symbolId) !== String(symbolId)) return;
+			if (str(event.message.symbolId) !== symbolId) return;
 			handler(event.message);
 		});
 		try {
 			await pool.request(accountId, sub.subscribe, {
-				ctidTraderAccountId: numericAccountId,
+				ctidTraderAccountId,
 				symbolId: [symbolId]
 			});
 			return await collect();
@@ -1172,11 +1404,11 @@ async function withLiveSubscription(pool, numericAccountId, symbolId, kind, hand
 			unregister();
 			try {
 				await pool.request(accountId, sub.unsubscribe, {
-					ctidTraderAccountId: numericAccountId,
+					ctidTraderAccountId,
 					symbolId: [symbolId]
 				});
 			} catch (err) {
-				process.stderr.write(`[ctrader-mcp] Best-effort ${kind} unsubscribe failed for symbol ${String(symbolId)}: ${err instanceof Error ? err.message : String(err)}\n`);
+				process.stderr.write(`[ctrader-mcp] Best-effort ${kind} unsubscribe failed for symbol ${symbolId}: ${err instanceof Error ? err.message : String(err)}\n`);
 			}
 		}
 	});
@@ -1187,9 +1419,13 @@ async function withLiveSubscription(pool, numericAccountId, symbolId, kind, hand
 * required-when-multiple rule at runtime so the model gets a helpful listing
 * instead of a bare validation error.
 */
-const accountIdField = z.coerce.string().optional().describe("ctidTraderAccountId of the account to act on (from get_accounts). Optional when exactly one account is connected; REQUIRED when several are — this tool never defaults to an arbitrary account.");
+const accountIdField = int64IdField("ctidTraderAccountId of the account to act on (from get_accounts). Optional when exactly one account is connected; REQUIRED when several are — this tool never defaults to an arbitrary account.").optional();
 function registerTools(server, pool) {
-	const register = server.registerTool.bind(server);
+	const rawRegister = server.registerTool.bind(server);
+	const register = (name, definition, handler) => rawRegister(name, {
+		...definition,
+		annotations: WRITE_TOOL_NAMES.has(name) ? WRITE_ANNOTATIONS : READ_ANNOTATIONS
+	}, handler);
 	register("get_accounts", {
 		description: "List the cTrader trading accounts connected for this agent. Returns each account's ctidTraderAccountId, live/demo flag, host, broker, and number. Use an accountId here as the `accountId` argument on the other tools.",
 		inputSchema: {}
@@ -1207,10 +1443,10 @@ function registerTools(server, pool) {
 		const resolved = resolveAccount(pool, args.accountId);
 		if (isToolError(resolved)) return resolved;
 		try {
-			const trader = (await pool.request(String(resolved.accountId), PayloadType.OA_TRADER_REQ, { ctidTraderAccountId: resolved.accountId })).message.trader ?? {};
+			const trader = (await pool.request(resolved.accountId, PayloadType.OA_TRADER_REQ, { ctidTraderAccountId: resolved.accountId })).message.trader ?? {};
 			const moneyDigits = trader.moneyDigits != null ? num(trader.moneyDigits) : 2;
 			return ok({
-				ctidTraderAccountId: str(trader.ctidTraderAccountId) || String(resolved.accountId),
+				ctidTraderAccountId: str(trader.ctidTraderAccountId) || resolved.accountId,
 				balance: moneyToDecimal(num(trader.balance), moneyDigits),
 				balanceRaw: str(trader.balance) || "0",
 				moneyDigits,
@@ -1230,12 +1466,12 @@ function registerTools(server, pool) {
 		const resolved = resolveAccount(pool, args.accountId);
 		if (isToolError(resolved)) return resolved;
 		try {
-			const positions = (await pool.request(String(resolved.accountId), PayloadType.OA_RECONCILE_REQ, {
+			const positions = (await pool.request(resolved.accountId, PayloadType.OA_RECONCILE_REQ, {
 				ctidTraderAccountId: resolved.accountId,
 				returnProtectionOrders: true
 			})).message.position ?? [];
 			return ok({
-				accountId: String(resolved.accountId),
+				accountId: resolved.accountId,
 				positions: positions.map((p) => {
 					const td = p.tradeData ?? {};
 					return {
@@ -1261,13 +1497,13 @@ function registerTools(server, pool) {
 		const resolved = resolveAccount(pool, args.accountId);
 		if (isToolError(resolved)) return resolved;
 		try {
-			const orders = (await pool.request(String(resolved.accountId), PayloadType.OA_RECONCILE_REQ, {
+			const orders = (await pool.request(resolved.accountId, PayloadType.OA_RECONCILE_REQ, {
 				ctidTraderAccountId: resolved.accountId,
 				returnProtectionOrders: true
 			})).message.order ?? [];
 			const typeName = (v) => v === ORDER_TYPE.LIMIT ? "LIMIT" : v === ORDER_TYPE.STOP ? "STOP" : v === ORDER_TYPE.STOP_LIMIT ? "STOP_LIMIT" : v === ORDER_TYPE.MARKET ? "MARKET" : String(v);
 			return ok({
-				accountId: String(resolved.accountId),
+				accountId: resolved.accountId,
 				orders: orders.map((o) => {
 					const td = o.tradeData ?? {};
 					return {
@@ -1291,13 +1527,13 @@ function registerTools(server, pool) {
 		description: "List tradable symbols on a connected cTrader account (symbol lists are per-account). Optionally filter by a name substring (case-insensitive, e.g. \"EURUSD\"). Returns symbolId + name — use symbolId on order and market-data tools. Pass `accountId` when several accounts are connected.",
 		inputSchema: {
 			accountId: accountIdField,
-			nameFilter: z.string().optional().describe("Case-insensitive substring to filter symbol names, e.g. \"EUR\"")
+			nameFilter: z.string().max(100).optional().describe("Case-insensitive substring to filter symbol names, e.g. \"EUR\"")
 		}
 	}, async (args) => {
 		const resolved = resolveAccount(pool, args.accountId);
 		if (isToolError(resolved)) return resolved;
 		try {
-			let symbols = (await pool.request(String(resolved.accountId), PayloadType.OA_SYMBOLS_LIST_REQ, {
+			let symbols = (await pool.request(resolved.accountId, PayloadType.OA_SYMBOLS_LIST_REQ, {
 				ctidTraderAccountId: resolved.accountId,
 				includeArchivedSymbols: false
 			})).message.symbol ?? [];
@@ -1306,7 +1542,7 @@ function registerTools(server, pool) {
 				symbols = symbols.filter((s) => str(s.symbolName).toLowerCase().includes(needle));
 			}
 			return ok({
-				accountId: String(resolved.accountId),
+				accountId: resolved.accountId,
 				count: symbols.length,
 				symbols: symbols.map((s) => ({
 					symbolId: str(s.symbolId),
@@ -1323,7 +1559,7 @@ function registerTools(server, pool) {
 		description: "Get recent OHLC candles (trendbars) for a symbol on a connected cTrader account. Specify symbolId (from get_symbols), a period, and how many bars. Prices are returned as real decimal prices. Pass `accountId` when several accounts are connected.",
 		inputSchema: {
 			accountId: accountIdField,
-			symbolId: z.coerce.number().int().positive().describe("The symbol id from get_symbols"),
+			symbolId: int64IdField("The symbol id from get_symbols"),
 			period: z.enum(Object.keys(TRENDBAR_PERIOD)).default("H1").describe("Candle period: M1, M5, M15, M30, H1, H4, D1, W1, MN1, etc."),
 			count: z.coerce.number().int().min(1).max(1e3).default(50).describe("Number of most-recent bars to return (1-1000)")
 		}
@@ -1332,15 +1568,15 @@ function registerTools(server, pool) {
 		if (isToolError(resolved)) return resolved;
 		try {
 			const period = TRENDBAR_PERIOD[args.period];
-			const bars = (await pool.request(String(resolved.accountId), PayloadType.OA_GET_TRENDBARS_REQ, {
+			const bars = (await pool.request(resolved.accountId, PayloadType.OA_GET_TRENDBARS_REQ, {
 				ctidTraderAccountId: resolved.accountId,
 				symbolId: args.symbolId,
 				period,
 				count: args.count
 			})).message.trendbar ?? [];
 			return ok({
-				accountId: String(resolved.accountId),
-				symbolId: String(args.symbolId),
+				accountId: resolved.accountId,
+				symbolId: args.symbolId,
 				period: args.period,
 				bars: bars.map((b) => decodeTrendbar(b))
 			});
@@ -1352,19 +1588,19 @@ function registerTools(server, pool) {
 		description: "Get full trading details for one symbol on a connected cTrader account: price digits, pip position, lot size, min/max/step volume (in lots), swap rates, and short-selling availability. Pass `accountId` when several accounts are connected.",
 		inputSchema: {
 			accountId: accountIdField,
-			symbolId: z.coerce.number().int().positive().describe("Symbol id from get_symbols")
+			symbolId: int64IdField("Symbol id from get_symbols")
 		}
 	}, async (args) => {
 		const resolved = resolveAccount(pool, args.accountId);
 		if (isToolError(resolved)) return resolved;
-		const accountId = String(resolved.accountId);
+		const accountId = resolved.accountId;
 		try {
 			const symbol = await getSymbolDetail(pool, accountId, resolved.accountId, args.symbolId);
 			const lotSize = num(symbol.lotSize);
 			const toLots = (v) => lotSize > 0 ? volumeToLots(num(v), lotSize) : null;
 			return ok({
 				accountId,
-				symbolId: str(symbol.symbolId) || String(args.symbolId),
+				symbolId: str(symbol.symbolId) || args.symbolId,
 				digits: num(symbol.digits),
 				pipPosition: num(symbol.pipPosition),
 				lotSize,
@@ -1385,13 +1621,13 @@ function registerTools(server, pool) {
 		description: "Get the LIVE bid/ask for a symbol on a connected cTrader account via a brief spot subscription (ticks merge until both sides are seen, up to waitMs). Returns bid, ask, and spread as real decimal prices. Pass `accountId` when several accounts are connected.",
 		inputSchema: {
 			accountId: accountIdField,
-			symbolId: z.coerce.number().int().positive().describe("Symbol id from get_symbols"),
+			symbolId: int64IdField("Symbol id from get_symbols"),
 			waitMs: z.coerce.number().int().min(200).max(1e4).default(3e3).describe("Max milliseconds to wait for both bid and ask ticks (returns early once both are seen)")
 		}
 	}, async (args) => {
 		const resolved = resolveAccount(pool, args.accountId);
 		if (isToolError(resolved)) return resolved;
-		const accountId = String(resolved.accountId);
+		const accountId = resolved.accountId;
 		try {
 			const digits = num((await getSymbolDetail(pool, accountId, resolved.accountId, args.symbolId)).digits);
 			const quote = {
@@ -1409,10 +1645,10 @@ function registerTools(server, pool) {
 				if (message.ask != null) quote.ask = roundToDigits(priceToDecimal(num(message.ask)), digits);
 				if (quote.bid != null && quote.ask != null) signalBothSeen();
 			}, () => Promise.race([bothSeen, sleep(args.waitMs)]));
-			if (quote.bid == null && quote.ask == null) return fail(new CTraderError("NO_QUOTE_DATA", `No live ticks for symbol ${String(args.symbolId)} within ${String(args.waitMs)}ms — the market may be closed or the symbol not quoted on this account`));
+			if (quote.bid == null && quote.ask == null) return fail(new CTraderError("NO_QUOTE_DATA", `No live ticks for symbol ${args.symbolId} within ${String(args.waitMs)}ms — the market may be closed or the symbol not quoted on this account`));
 			return ok({
 				accountId,
-				symbolId: String(args.symbolId),
+				symbolId: args.symbolId,
 				digits,
 				bid: quote.bid,
 				ask: quote.ask,
@@ -1428,14 +1664,14 @@ function registerTools(server, pool) {
 		description: "Get the LIVE Level 2 order book (depth of market) for a symbol on a connected cTrader account. Subscribes briefly, assembles the bid/ask ladder (sizes aggregated per price level), then unsubscribes. Returns bids (descending) and asks (ascending) with sizes in base-asset units and lots, plus best bid/ask and spread. Not every broker/symbol publishes depth — a NO_DEPTH_DATA error means none arrived. Pass `accountId` when several accounts are connected.",
 		inputSchema: {
 			accountId: accountIdField,
-			symbolId: z.coerce.number().int().positive().describe("Symbol id from get_symbols"),
+			symbolId: int64IdField("Symbol id from get_symbols"),
 			levels: z.coerce.number().int().min(1).max(50).default(10).describe("Max price levels per side to return"),
 			collectMs: z.coerce.number().int().min(200).max(5e3).default(1e3).describe("How long to collect depth events before snapshotting (the full book arrives on subscribe; longer windows fold in more updates)")
 		}
 	}, async (args) => {
 		const resolved = resolveAccount(pool, args.accountId);
 		if (isToolError(resolved)) return resolved;
-		const accountId = String(resolved.accountId);
+		const accountId = resolved.accountId;
 		try {
 			const symbol = await getSymbolDetail(pool, accountId, resolved.accountId, args.symbolId);
 			const digits = num(symbol.digits);
@@ -1461,7 +1697,7 @@ function registerTools(server, pool) {
 				}
 				for (const deleted of message.deletedQuotes ?? []) book.delete(str(deleted));
 			}, () => sleep(args.collectMs));
-			if (eventsReceived === 0) return fail(new CTraderError("NO_DEPTH_DATA", `No depth events for symbol ${String(args.symbolId)} within ${String(args.collectMs)}ms — this broker/symbol may not publish Level 2 via the Open API, or the market is closed`));
+			if (eventsReceived === 0) return fail(new CTraderError("NO_DEPTH_DATA", `No depth events for symbol ${args.symbolId} within ${String(args.collectMs)}ms — this broker/symbol may not publish Level 2 via the Open API, or the market is closed`));
 			const ladder = (side) => {
 				const byPrice = /* @__PURE__ */ new Map();
 				for (const quote of book.values()) {
@@ -1482,7 +1718,7 @@ function registerTools(server, pool) {
 			const bestAsk = asks.at(0)?.price ?? null;
 			return ok({
 				accountId,
-				symbolId: String(args.symbolId),
+				symbolId: args.symbolId,
 				digits,
 				bestBid,
 				bestAsk,
@@ -1503,15 +1739,15 @@ function registerTools(server, pool) {
 		description: "Get historical tick-by-tick prices (BID or ASK side) for a symbol on a connected cTrader account. Defaults to the last 5 minutes — keep ranges short, tick volumes are large; `hasMore` signals truncation. Ticks are returned newest-first with real decimal prices.",
 		inputSchema: {
 			accountId: accountIdField,
-			symbolId: z.coerce.number().int().positive().describe("Symbol id from get_symbols"),
+			symbolId: int64IdField("Symbol id from get_symbols"),
 			type: z.enum(["BID", "ASK"]).default("BID").describe("Which side's ticks to fetch"),
-			from: z.string().optional().describe("ISO 8601 range start (default: 5 minutes before `to`)"),
-			to: z.string().optional().describe("ISO 8601 range end (default: now)")
+			from: z.string().max(100).optional().describe("ISO 8601 range start (default: 5 minutes before `to`)"),
+			to: z.string().max(100).optional().describe("ISO 8601 range end (default: now)")
 		}
 	}, async (args) => {
 		const resolved = resolveAccount(pool, args.accountId);
 		if (isToolError(resolved)) return resolved;
-		const accountId = String(resolved.accountId);
+		const accountId = resolved.accountId;
 		try {
 			const toMs = args.to != null ? parseTimestamp(args.to, "to") : Date.now();
 			const fromMs = args.from != null ? parseTimestamp(args.from, "from") : toMs - 5 * 6e4;
@@ -1526,7 +1762,7 @@ function registerTools(server, pool) {
 			const raw = res.message.tickData ?? [];
 			return ok({
 				accountId,
-				symbolId: String(args.symbolId),
+				symbolId: args.symbolId,
 				type: args.type,
 				count: raw.length,
 				hasMore: Boolean(res.message.hasMore),
@@ -1540,14 +1776,14 @@ function registerTools(server, pool) {
 		description: "Get executed deal (fill) history for a connected cTrader account: entry/exit fills with price, volume, commission, and — for closing deals — realized PnL. Defaults to the last 7 days; cTrader caps the from/to span (about a week per request).",
 		inputSchema: {
 			accountId: accountIdField,
-			from: z.string().optional().describe("ISO 8601 range start (default: 7 days before `to`)"),
-			to: z.string().optional().describe("ISO 8601 range end (default: now)"),
+			from: z.string().max(100).optional().describe("ISO 8601 range start (default: 7 days before `to`)"),
+			to: z.string().max(100).optional().describe("ISO 8601 range end (default: now)"),
 			maxRows: z.coerce.number().int().min(1).max(1e3).default(100).describe("Max deals to return")
 		}
 	}, async (args) => {
 		const resolved = resolveAccount(pool, args.accountId);
 		if (isToolError(resolved)) return resolved;
-		const accountId = String(resolved.accountId);
+		const accountId = resolved.accountId;
 		try {
 			const toMs = args.to != null ? parseTimestamp(args.to, "to") : Date.now();
 			const fromMs = args.from != null ? parseTimestamp(args.from, "from") : toMs - 7 * 864e5;
@@ -1599,7 +1835,7 @@ function registerTools(server, pool) {
 	}, async (args) => {
 		const resolved = resolveAccount(pool, args.accountId);
 		if (isToolError(resolved)) return resolved;
-		const accountId = String(resolved.accountId);
+		const accountId = resolved.accountId;
 		try {
 			const res = await pool.request(accountId, PayloadType.OA_GET_POSITION_UNREALIZED_PNL_REQ, { ctidTraderAccountId: resolved.accountId });
 			const moneyDigits = res.message.moneyDigits != null ? num(res.message.moneyDigits) : 2;
@@ -1620,16 +1856,16 @@ function registerTools(server, pool) {
 		description: "Get the margin that would be required to open BUY/SELL positions of given sizes (in lots) on a symbol, in the account's deposit currency. Useful before place_order to check affordability. Pass `accountId` when several accounts are connected.",
 		inputSchema: {
 			accountId: accountIdField,
-			symbolId: z.coerce.number().int().positive().describe("Symbol id from get_symbols"),
+			symbolId: int64IdField("Symbol id from get_symbols"),
 			volumesLots: z.array(z.coerce.number().positive()).min(1).max(10).describe("Position sizes in lots to quote margin for, e.g. [0.1, 0.5, 1]")
 		}
 	}, async (args) => {
 		const resolved = resolveAccount(pool, args.accountId);
 		if (isToolError(resolved)) return resolved;
-		const accountId = String(resolved.accountId);
+		const accountId = resolved.accountId;
 		try {
 			const lotSize = num((await getSymbolDetail(pool, accountId, resolved.accountId, args.symbolId)).lotSize);
-			if (lotSize <= 0) return fail(new CTraderError("SYMBOL_NO_LOTSIZE", `Symbol ${String(args.symbolId)} has no lotSize; cannot size the margin quote`));
+			if (lotSize <= 0) return fail(new CTraderError("SYMBOL_NO_LOTSIZE", `Symbol ${args.symbolId} has no lotSize; cannot size the margin quote`));
 			const res = await pool.request(accountId, PayloadType.OA_EXPECTED_MARGIN_REQ, {
 				ctidTraderAccountId: resolved.accountId,
 				symbolId: args.symbolId,
@@ -1639,7 +1875,7 @@ function registerTools(server, pool) {
 			const margins = res.message.margin ?? [];
 			return ok({
 				accountId,
-				symbolId: String(args.symbolId),
+				symbolId: args.symbolId,
 				margins: margins.map((m) => ({
 					volumeLots: volumeToLots(num(m.volume), lotSize),
 					buyMargin: moneyToDecimal(num(m.buyMargin), moneyDigits),
@@ -1654,13 +1890,13 @@ function registerTools(server, pool) {
 		description: "Get deposit/withdrawal history for a connected cTrader account over a date range (default: last 30 days). Amounts are real currency figures; positive delta = deposit, negative = withdrawal.",
 		inputSchema: {
 			accountId: accountIdField,
-			from: z.string().optional().describe("ISO 8601 range start (default: 30 days before `to`)"),
-			to: z.string().optional().describe("ISO 8601 range end (default: now)")
+			from: z.string().max(100).optional().describe("ISO 8601 range start (default: 30 days before `to`)"),
+			to: z.string().max(100).optional().describe("ISO 8601 range end (default: now)")
 		}
 	}, async (args) => {
 		const resolved = resolveAccount(pool, args.accountId);
 		if (isToolError(resolved)) return resolved;
-		const accountId = String(resolved.accountId);
+		const accountId = resolved.accountId;
 		try {
 			const toMs = args.to != null ? parseTimestamp(args.to, "to") : Date.now();
 			const fromMs = args.from != null ? parseTimestamp(args.from, "from") : toMs - 30 * 864e5;
@@ -1692,7 +1928,7 @@ function registerTools(server, pool) {
 		description: "Place a MARKET, LIMIT, STOP, or STOP_LIMIT order on a connected cTrader account. Volume is in LOTS and is converted to the symbol's protocol volume (validated against min/max/step). LIMIT requires limitPrice; STOP requires stopPrice; STOP_LIMIT requires stopPrice + slippageInPoints. SL/TP: pass ABSOLUTE prices via stopLoss/takeProfit, or price DISTANCES via stopLossDistance/takeProfitDistance (required for a trailing stop). timeInForce defaults to GOOD_TILL_CANCEL; GOOD_TILL_DATE requires expiresAt. Pass `accountId` when several accounts are connected. WARNING: on a live account this moves real money.",
 		inputSchema: {
 			accountId: accountIdField,
-			symbolId: z.coerce.number().int().positive().describe("Symbol id from get_symbols"),
+			symbolId: int64IdField("Symbol id from get_symbols"),
 			side: z.enum(["BUY", "SELL"]).describe("Trade side"),
 			orderType: z.enum([
 				"MARKET",
@@ -1715,17 +1951,19 @@ function registerTools(server, pool) {
 				"IMMEDIATE_OR_CANCEL",
 				"FILL_OR_KILL"
 			]).optional().describe("Order lifetime (default GOOD_TILL_CANCEL). GOOD_TILL_DATE requires expiresAt."),
-			expiresAt: z.string().optional().describe("ISO 8601 expiry — required with (and only valid with) timeInForce GOOD_TILL_DATE"),
-			label: z.string().optional().describe("Optional client label for the order")
+			expiresAt: z.string().max(100).optional().describe("ISO 8601 expiry — required with (and only valid with) timeInForce GOOD_TILL_DATE"),
+			label: z.string().max(50).optional().describe("Optional client label for the order (max 50 characters)")
 		}
 	}, async (args) => {
 		const resolved = resolveAccount(pool, args.accountId);
 		if (isToolError(resolved)) return resolved;
-		const accountId = String(resolved.accountId);
+		const accountId = resolved.accountId;
 		try {
 			if (args.orderType === "LIMIT" && args.limitPrice == null) return fail(new CTraderError("LIMIT_PRICE_REQUIRED", "LIMIT orders require limitPrice"));
 			if ((args.orderType === "STOP" || args.orderType === "STOP_LIMIT") && args.stopPrice == null) return fail(new CTraderError("STOP_PRICE_REQUIRED", `${args.orderType} orders require stopPrice`));
 			if (args.orderType === "STOP_LIMIT" && args.slippageInPoints == null) return fail(new CTraderError("SLIPPAGE_REQUIRED", "STOP_LIMIT orders require slippageInPoints"));
+			if (args.orderType === "STOP_LIMIT" && args.limitPrice != null) return fail(new CTraderError("PRICE_NOT_ALLOWED", "STOP_LIMIT orders use stopPrice + slippageInPoints, not limitPrice"));
+			if (args.orderType !== "STOP_LIMIT" && args.slippageInPoints != null) return fail(new CTraderError("SLIPPAGE_NOT_ALLOWED", "slippageInPoints is only valid for STOP_LIMIT orders"));
 			if (args.orderType === "MARKET" && (args.limitPrice != null || args.stopPrice != null)) return fail(new CTraderError("PRICE_NOT_ALLOWED", "MARKET orders take no limitPrice/stopPrice — use LIMIT or STOP"));
 			if (args.orderType === "LIMIT" && args.stopPrice != null) return fail(new CTraderError("PRICE_NOT_ALLOWED", "LIMIT orders take no stopPrice"));
 			if (args.orderType === "STOP" && args.limitPrice != null) return fail(new CTraderError("PRICE_NOT_ALLOWED", "STOP orders take no limitPrice"));
@@ -1737,9 +1975,18 @@ function registerTools(server, pool) {
 			}
 			if (args.timeInForce === "GOOD_TILL_DATE" && args.expiresAt == null) return fail(new CTraderError("EXPIRATION_REQUIRED", "timeInForce GOOD_TILL_DATE requires expiresAt"));
 			if (args.expiresAt != null && args.timeInForce !== "GOOD_TILL_DATE") return fail(new CTraderError("EXPIRATION_NOT_ALLOWED", "expiresAt is only valid with timeInForce GOOD_TILL_DATE"));
+			let expirationTimestamp;
+			if (args.expiresAt != null) {
+				expirationTimestamp = parseTimestamp(args.expiresAt, "expiresAt");
+				if (expirationTimestamp <= Date.now()) return fail(new CTraderError("EXPIRATION_IN_PAST", "expiresAt must be in the future"));
+			}
+			const relativeStopLoss = args.stopLossDistance != null ? Math.round(args.stopLossDistance * PRICE_SCALE) : void 0;
+			const relativeTakeProfit = args.takeProfitDistance != null ? Math.round(args.takeProfitDistance * PRICE_SCALE) : void 0;
+			if (relativeStopLoss != null && (!Number.isSafeInteger(relativeStopLoss) || relativeStopLoss <= 0)) return fail(new CTraderError("INVALID_STOP_LOSS_DISTANCE", "stopLossDistance is too small or too large for cTrader's relative-price units"));
+			if (relativeTakeProfit != null && (!Number.isSafeInteger(relativeTakeProfit) || relativeTakeProfit <= 0)) return fail(new CTraderError("INVALID_TAKE_PROFIT_DISTANCE", "takeProfitDistance is too small or too large for cTrader's relative-price units"));
 			const symbol = await getSymbolDetail(pool, accountId, resolved.accountId, args.symbolId);
 			const lotSize = num(symbol.lotSize);
-			if (lotSize <= 0) return fail(new CTraderError("SYMBOL_NO_LOTSIZE", `Symbol ${String(args.symbolId)} has no lotSize; cannot size the order`));
+			if (lotSize <= 0) return fail(new CTraderError("SYMBOL_NO_LOTSIZE", `Symbol ${args.symbolId} has no lotSize; cannot size the order`));
 			const volume = lotsToVolume(args.volumeLots, lotSize);
 			const volErr = validateVolume(volume, num(symbol.minVolume), num(symbol.maxVolume), num(symbol.stepVolume));
 			if (volErr) return fail(new CTraderError("INVALID_VOLUME", volErr));
@@ -1755,13 +2002,13 @@ function registerTools(server, pool) {
 			if (args.slippageInPoints != null) payload.slippageInPoints = args.slippageInPoints;
 			if (args.stopLoss != null) payload.stopLoss = args.stopLoss;
 			if (args.takeProfit != null) payload.takeProfit = args.takeProfit;
-			if (args.stopLossDistance != null) payload.relativeStopLoss = Math.round(args.stopLossDistance * PRICE_SCALE);
-			if (args.takeProfitDistance != null) payload.relativeTakeProfit = Math.round(args.takeProfitDistance * PRICE_SCALE);
+			if (relativeStopLoss != null) payload.relativeStopLoss = relativeStopLoss;
+			if (relativeTakeProfit != null) payload.relativeTakeProfit = relativeTakeProfit;
 			if (args.trailingStopLoss != null) payload.trailingStopLoss = args.trailingStopLoss;
 			if (args.timeInForce != null) payload.timeInForce = TIME_IN_FORCE[args.timeInForce];
-			if (args.expiresAt != null) payload.expirationTimestamp = parseTimestamp(args.expiresAt, "expiresAt");
+			if (expirationTimestamp != null) payload.expirationTimestamp = expirationTimestamp;
 			if (args.label != null) payload.label = args.label;
-			const { executionType, summary } = assertExecution(await pool.request(accountId, PayloadType.OA_NEW_ORDER_REQ, payload));
+			const { executionType, summary } = assertExecution(await pool.request(accountId, PayloadType.OA_NEW_ORDER_REQ, payload), PLACE_ORDER_SUCCESS_TYPES);
 			return ok({
 				accountId,
 				executionType,
@@ -1777,8 +2024,8 @@ function registerTools(server, pool) {
 		description: "Modify an existing order on a connected cTrader account. For a PENDING order (by orderId) you can change limitPrice/stopPrice/SL/TP. For an OPEN position's protection, pass positionId to set stopLoss/takeProfit. Provide exactly one of orderId or positionId. Pass `accountId` when several accounts are connected.",
 		inputSchema: {
 			accountId: accountIdField,
-			orderId: z.coerce.number().int().positive().optional().describe("Pending order id (from get_orders) to amend"),
-			positionId: z.coerce.number().int().positive().optional().describe("Open position id (from get_positions) to set SL/TP on"),
+			orderId: int64IdField("Pending order id (from get_orders) to amend").optional(),
+			positionId: int64IdField("Open position id (from get_positions) to set SL/TP on").optional(),
 			limitPrice: z.coerce.number().positive().optional().describe("New limit price (pending order only)"),
 			stopPrice: z.coerce.number().positive().optional().describe("New stop price (pending order only)"),
 			stopLoss: z.coerce.number().positive().optional().describe("New absolute stop-loss price"),
@@ -1787,21 +2034,23 @@ function registerTools(server, pool) {
 	}, async (args) => {
 		const resolved = resolveAccount(pool, args.accountId);
 		if (isToolError(resolved)) return resolved;
-		const accountId = String(resolved.accountId);
+		const accountId = resolved.accountId;
 		try {
 			if (args.orderId == null === (args.positionId == null)) return fail(new CTraderError("INVALID_TARGET", "Provide exactly one of orderId or positionId"));
+			if (args.limitPrice == null && args.stopPrice == null && args.stopLoss == null && args.takeProfit == null) return fail(new CTraderError("NO_CHANGES", "Provide at least one price or protection change"));
 			if (args.positionId != null) {
+				if (args.limitPrice != null || args.stopPrice != null) return fail(new CTraderError("PRICE_NOT_ALLOWED", "Position protection changes accept only stopLoss/takeProfit"));
 				const payload = {
 					ctidTraderAccountId: resolved.accountId,
 					positionId: args.positionId
 				};
 				if (args.stopLoss != null) payload.stopLoss = args.stopLoss;
 				if (args.takeProfit != null) payload.takeProfit = args.takeProfit;
-				const { executionType, summary } = assertExecution(await pool.request(accountId, PayloadType.OA_AMEND_POSITION_SLTP_REQ, payload));
+				const { executionType, summary } = assertExecution(await pool.request(accountId, PayloadType.OA_AMEND_POSITION_SLTP_REQ, payload), AMEND_SUCCESS_TYPES);
 				return ok({
 					accountId,
 					executionType,
-					positionId: String(args.positionId),
+					positionId: args.positionId,
 					execution: summary
 				});
 			}
@@ -1813,11 +2062,11 @@ function registerTools(server, pool) {
 			if (args.stopPrice != null) payload.stopPrice = args.stopPrice;
 			if (args.stopLoss != null) payload.stopLoss = args.stopLoss;
 			if (args.takeProfit != null) payload.takeProfit = args.takeProfit;
-			const { executionType, summary } = assertExecution(await pool.request(accountId, PayloadType.OA_AMEND_ORDER_REQ, payload));
+			const { executionType, summary } = assertExecution(await pool.request(accountId, PayloadType.OA_AMEND_ORDER_REQ, payload), AMEND_SUCCESS_TYPES);
 			return ok({
 				accountId,
 				executionType,
-				orderId: String(args.orderId),
+				orderId: args.orderId,
 				execution: summary
 			});
 		} catch (err) {
@@ -1828,36 +2077,41 @@ function registerTools(server, pool) {
 		description: "Close an open position (fully or partially) on a connected cTrader account. Pass the positionId from get_positions. volumeLots defaults to the full position size when omitted. Pass `accountId` when several accounts are connected.",
 		inputSchema: {
 			accountId: accountIdField,
-			positionId: z.coerce.number().int().positive().describe("Position id from get_positions"),
+			positionId: int64IdField("Position id from get_positions"),
 			volumeLots: z.coerce.number().positive().optional().describe("Lots to close; omit to close the whole position")
 		}
 	}, async (args) => {
 		const resolved = resolveAccount(pool, args.accountId);
 		if (isToolError(resolved)) return resolved;
-		const accountId = String(resolved.accountId);
+		const accountId = resolved.accountId;
 		try {
 			const pos = ((await pool.request(accountId, PayloadType.OA_RECONCILE_REQ, {
 				ctidTraderAccountId: resolved.accountId,
 				returnProtectionOrders: true
-			})).message.position ?? []).find((p) => str(p.positionId) === String(args.positionId));
-			if (!pos) return fail(new CTraderError("POSITION_NOT_FOUND", `No open position ${String(args.positionId)}`));
+			})).message.position ?? []).find((p) => str(p.positionId) === args.positionId);
+			if (!pos) return fail(new CTraderError("POSITION_NOT_FOUND", `No open position ${args.positionId}`));
 			const td = pos.tradeData ?? {};
 			const fullVolume = num(td.volume);
+			if (!Number.isSafeInteger(fullVolume) || fullVolume <= 0) return fail(new CTraderError("INVALID_POSITION_VOLUME", `Position ${args.positionId} has invalid broker volume ${String(fullVolume)}`));
 			let volume = fullVolume;
 			if (args.volumeLots != null) {
-				const symbol = await getSymbolDetail(pool, accountId, resolved.accountId, num(td.symbolId));
+				const positionSymbolId = str(td.symbolId);
+				if (!isCanonicalInt64(positionSymbolId)) return fail(new CTraderError("INVALID_POSITION_SYMBOL", `Position ${args.positionId} has an invalid symbol id`));
+				const symbol = await getSymbolDetail(pool, accountId, resolved.accountId, positionSymbolId);
 				volume = lotsToVolume(args.volumeLots, num(symbol.lotSize));
+				const volErr = validateVolume(volume, num(symbol.minVolume), num(symbol.maxVolume), num(symbol.stepVolume));
+				if (volErr) return fail(new CTraderError("INVALID_VOLUME", volErr));
 				if (volume > fullVolume) return fail(new CTraderError("VOLUME_EXCEEDS_POSITION", `Requested ${String(volume)} exceeds position volume ${String(fullVolume)}`));
 			}
 			const { executionType, summary } = assertExecution(await pool.request(accountId, PayloadType.OA_CLOSE_POSITION_REQ, {
 				ctidTraderAccountId: resolved.accountId,
 				positionId: args.positionId,
 				volume
-			}));
+			}), CLOSE_SUCCESS_TYPES);
 			return ok({
 				accountId,
 				executionType,
-				positionId: String(args.positionId),
+				positionId: args.positionId,
 				volume,
 				execution: summary
 			});
@@ -1869,21 +2123,21 @@ function registerTools(server, pool) {
 		description: "Cancel a pending (not-yet-filled) order on a connected cTrader account. Pass the orderId from get_orders. Pass `accountId` when several accounts are connected.",
 		inputSchema: {
 			accountId: accountIdField,
-			orderId: z.coerce.number().int().positive().describe("Pending order id from get_orders")
+			orderId: int64IdField("Pending order id from get_orders")
 		}
 	}, async (args) => {
 		const resolved = resolveAccount(pool, args.accountId);
 		if (isToolError(resolved)) return resolved;
-		const accountId = String(resolved.accountId);
+		const accountId = resolved.accountId;
 		try {
 			const { executionType, summary } = assertExecution(await pool.request(accountId, PayloadType.OA_CANCEL_ORDER_REQ, {
 				ctidTraderAccountId: resolved.accountId,
 				orderId: args.orderId
-			}), new Set([5]));
+			}), CANCEL_SUCCESS_TYPES);
 			return ok({
 				accountId,
 				executionType,
-				orderId: String(args.orderId),
+				orderId: args.orderId,
 				execution: summary
 			});
 		} catch (err) {
@@ -1907,17 +2161,16 @@ function summariseExecution(message) {
 /**
 * Turn a write-tool reply into a definite outcome. A cTrader order op is
 * expected to come back as a ProtoOAExecutionEvent (2126); anything else means
-* we can't confirm the write landed, and a rejection/cancel executionType means
-* it explicitly did NOT. In both cases we throw a CTraderError so the tool
-* result is an unambiguous error rather than a bare success — this is a money
-* path and must fail closed.
+* we can't confirm the write landed. Each operation passes an explicit
+* allowlist of execution types that prove its intended outcome; missing,
+* unknown, or merely unrelated execution events fail closed.
 */
-function assertExecution(res, extraOkTypes = /* @__PURE__ */ new Set()) {
+function assertExecution(res, allowedTypes) {
 	if (res.payloadType !== PayloadType.OA_EXECUTION_EVENT) throw new CTraderError("UNEXPECTED_EXECUTION_REPLY", `Expected an execution event (${String(PayloadType.OA_EXECUTION_EVENT)}) but got payloadType ${String(res.payloadType)}; cannot confirm the order`);
 	const summary = summariseExecution(res.message);
 	const code = res.message.executionType != null ? num(res.message.executionType) : null;
 	const executionType = typeof summary.executionType === "string" ? summary.executionType : "UNKNOWN";
-	if (code != null && FAILED_EXECUTION_TYPES.has(code) && !extraOkTypes.has(code)) throw new CTraderError(executionType, `cTrader returned a non-fill execution (${executionType})`, {
+	if (code == null || !allowedTypes.has(code)) throw new CTraderError(code == null ? "MISSING_EXECUTION_TYPE" : executionType, `cTrader returned an execution that does not confirm this operation (${executionType})`, {
 		orderId: str(summary.orderId) || void 0,
 		positionId: str(summary.positionId) || void 0
 	});
@@ -1955,6 +2208,7 @@ function assertExecution(res, extraOkTypes = /* @__PURE__ */ new Set()) {
 * account it names (see client.ts). No account is ever chosen implicitly when
 * several are connected — the tools require an explicit `accountId` in that case.
 */
+const packageVersion = createRequire(import.meta.url)("../package.json").version;
 function log(msg) {
 	process.stderr.write(`[ctrader-mcp] ${msg}\n`);
 }
@@ -1978,7 +2232,7 @@ async function main() {
 	const pool = new CTraderPool(registry);
 	const server = new McpServer({
 		name: "ctrader-mcp-server",
-		version: "0.0.1"
+		version: packageVersion
 	});
 	registerTools(server, pool);
 	const shutdown = () => {