@alphafox/cli 0.1.0

package/dist/safety/confirmation.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertHighRiskConfirmation = assertHighRiskConfirmation;
+/**
+ * High-risk writes require explicit --yes (or equivalent confirmation token).
+ * Server still enforces scopes/roles; this is CLI UX only.
+ */
+function assertHighRiskConfirmation(input) {
+    if (input.risk !== "high-risk-write") {
+        return { allowed: true };
+    }
+    if (input.dryRun) {
+        return { allowed: true };
+    }
+    if (input.yes) {
+        return { allowed: true };
+    }
+    return {
+        allowed: false,
+        error: {
+            type: "confirmation",
+            subtype: "confirmation_required",
+            message: `${input.action} requires confirmation`,
+            hint: "add --yes to confirm",
+            risk: "high-risk-write",
+            action: input.action,
+        },
+    };
+}

package/dist/version.d.ts

@@ -0,0 +1,4 @@
+export declare const CLI_NAME = "alphafox";
+export declare const CLI_PACKAGE = "@alphafox/cli";
+export declare const CLI_VERSION = "0.1.0";
+export declare const CLI_CONTRACT_VERSION = "2026-08-11";

package/dist/version.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLI_CONTRACT_VERSION = exports.CLI_VERSION = exports.CLI_PACKAGE = exports.CLI_NAME = void 0;
+exports.CLI_NAME = "alphafox";
+exports.CLI_PACKAGE = "@alphafox/cli";
+exports.CLI_VERSION = "0.1.0";
+exports.CLI_CONTRACT_VERSION = "2026-08-11";

package/docs/e2e-staging.md

@@ -0,0 +1,24 @@
+# Staging E2E checklist (t101364 / t101369)
+
+## Scenarios
+
+1. Install CLI → `version` / `doctor`
+2. Device Flow split (`--no-wait` + `--device-code`)
+3. `whoami` / `auth status --verify`
+4. Readonly: strategy definitions, connectors, traders
+5. Write: create chat with idempotency
+6. Backtest create → watch stream → cancel
+7. High-risk without `--yes` → exit 10
+8. Logout / revoke
+9. Cross-env token rejection (prod token on staging)
+
+## Evidence policy
+
+If staging domain/secrets are unavailable in the runner, capture provisioning failure to evidence logs and rely on:
+
+- local unit/integration tests of envelope, allowlist, token model, confirmation
+- structural presence of deploy workflow + runbooks
+
+**Never fabricate staging success.**
+
+Parent Feishu task stays `todo` until human acceptance of staging evidence.

package/docs/release-supply-chain.md

@@ -0,0 +1,49 @@
+# Release: npm, Skills, supply chain (t101375)
+
+## Package
+
+| Field | Value |
+|-------|--------|
+| Name | `@alphafoxai/cli` |
+| Binary | `alphafox` |
+| Visibility | public npm (org `@alphafoxai`) |
+| Node | LTS ≥ 20 |
+| OS | macOS, Linux, Windows |
+
+## Publish rules
+
+- Publish **only** from CI on protected tags (`v*`)
+- Prefer npm **trusted publishing / OIDC provenance** — no long-lived npm tokens
+- 2FA required for org owners
+- Package contents: `dist/`, `skills/`, README, docs — **no** secrets, fixtures, private endpoints, or `.env`
+
+## Skills distribution
+
+- Co-versioned inside the npm package under `skills/`
+- Compatibility: Skills major aligns with CLI major; `contractVersion` must match API or CLI fails closed
+
+## Support matrix
+
+| Platform | Install | Keychain |
+|----------|---------|----------|
+| macOS | npm global / npx | Keychain Access |
+| Linux | npm global / npx | Secret Service or file fallback 0600 |
+| Windows | npm global / npx | Credential Manager (file fallback until implemented) |
+
+## Channels
+
+- `latest` — stable
+- `next` — prerelease
+- Deprecation window: ≥ 30 days for breaking contract changes
+
+## Rollback
+
+```bash
+npm install -g @alphafoxai/cli@<previous>
+alphafox version
+alphafox doctor
+```
+
+## SBOM / audit
+
+CI should generate SBOM (e.g. `cyclonedx` / `npm sbom`) and fail on critical vulns in runtime deps.

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@alphafox/cli",
+  "version": "0.1.0",
+  "description": "Alphafox CLI \u2014 Agent/Human entry for the public Application API.",
+  "type": "commonjs",
+  "bin": {
+    "alphafox": "bin/alphafox.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "bin",
+    "dist",
+    "skills",
+    "README.md",
+    "docs",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && node scripts/postbuild.cjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "npm run build && node scripts/build-mvp-web-bundle.mjs && tsc -p tsconfig.test.json && node --test dist-test/**/*.test.js",
+    "test:mvp": "node scripts/build-mvp-web-bundle.mjs && tsc -p tsconfig.test.json && node --test dist-test/tests/mvp-oauth-web-handlers.test.js",
+    "alphafox": "node dist/cli.js",
+    "prepublishOnly": "npm run build"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alphafoxai/alphafox-cli.git"
+  },
+  "bugs": {
+    "url": "https://github.com/alphafoxai/alphafox-cli/issues"
+  },
+  "homepage": "https://github.com/alphafoxai/alphafox-cli#readme",
+  "keywords": [
+    "alphafox",
+    "cli",
+    "trading",
+    "agent",
+    "oauth",
+    "device-flow"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "license": "MIT",
+  "packageManager": "pnpm@10.33.0",
+  "dependencies": {
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/node": "^24.9.1",
+    "tsx": "^4.23.12",
+    "typescript": "^6.0.2"
+  }
+}

package/skills/account/SKILL.md

@@ -0,0 +1,21 @@
+---
+name: alphafox-account
+description: Account, wallet, and subscription read paths.
+version: 0.1.0
+---
+
+# Account / wallet
+
+```bash
+alphafox api GET /api/v1/wallet
+alphafox api GET /api/v1/account/exchange-uids
+alphafox api GET /api/v1/subscriptions/me
+alphafox api GET /api/v1/managed-wallets
+```
+
+## operationIds
+
+- `wallet.get`
+- `account.exchange_uids.list`
+- `subscriptions.me.get`
+- `managed_wallets.list`

package/skills/admin/SKILL.md

@@ -0,0 +1,19 @@
+---
+name: alphafox-admin
+description: Admin-only operations reusing Web role authorization.
+version: 0.1.0
+---
+
+# Admin
+
+Requires admin role on the server. CLI confirmation does not grant privilege.
+
+```bash
+alphafox api GET /api/v1/admin/users
+```
+
+High-risk admin writes: `--dry-run` then `--yes`. Not available to automation (v1 deferred).
+
+## operationIds
+
+- `admin.users.list`

package/skills/alphafox-shared/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: alphafox-shared
+description: Shared Alphafox CLI rules for Agents — auth, profiles, envelopes, risk gates, and public operationIds only.
+version: 0.1.0
+---
+
+# Alphafox shared Agent contract
+
+## Install / identity
+
+```bash
+npx @alphafoxai/cli version
+npx @alphafoxai/cli doctor
+```
+
+- Default profile: `production`. Use `--profile staging|local` explicitly.
+- Tokens: OS keychain only. Never pass `--token`. Never read tokens from config JSON.
+- Automation tokens are **not supported in v1** (interactive Device Flow / PKCE only).
+
+## Output
+
+Always use:
+
+```bash
+alphafox … --format json --no-input
+```
+
+Parse the JSON envelope: `ok === true` for success. Errors land on **stderr** with `ok: false` and may include HTTP `status` + `requestId`.
+
+## Auth
+
+```bash
+alphafox auth login --no-wait
+# show verification_uri to the user, then:
+alphafox auth login --device-code <device_code>
+alphafox auth status --verify
+alphafox whoami
+```
+
+## Commands
+
+1. Prefer typed catalog: `alphafox schema <operationId>` then invoke domain commands.
+2. Raw escape hatch only for allowlisted facade:
+
+```bash
+alphafox api GET /api/v1/me
+```
+
+Forbidden: `/backend`, `/control-plane`, `/signal-center`, internal secrets, non-`/api/v1` product routes.
+
+## Risk
+
+- `high-risk-write` requires `--yes` (exit code `10` if missing).
+- Prefer `--dry-run` first for trader start/stop, withdrawals, admin writes.
+- Never auto-retry unknown write outcomes.
+
+## Public operationIds only
+
+Skills must reference registry `operationId`s (see `alphafox schema` / `alphafox catalog`). Do not hardcode internal service URLs.

package/skills/auth/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: alphafox-auth
+description: Login, status, logout, whoami, and environment isolation for Alphafox CLI.
+version: 0.1.0
+---
+
+# Auth Skill
+
+## When to use
+
+User needs to sign in, verify session, switch profile, or revoke tokens.
+
+## Workflows
+
+### Device Flow (headless / Agent)
+
+1. `alphafox auth login --no-wait --format json`
+2. Present `verification_uri` / `user_code` to the human.
+3. After approval: `alphafox auth login --device-code <device_code>`
+4. `alphafox whoami` / `alphafox auth status --verify`
+
+### Status / logout
+
+- `alphafox auth status --verify`
+- `alphafox auth logout` (server revoke + local keychain clear)
+
+## Safety
+
+- Fail closed on cross-environment tokens (prod token never hits staging).
+- Do not copy refresh tokens into CI (automation deferred — ADR 0004).
+
+## operationIds
+
+- `me.whoami`
+- Auth AS endpoints under `/api/auth/oauth/*` (not catalog product ops)

package/skills/exchange/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: alphafox-exchange
+description: Exchange connectors list and connection management via Public API.
+version: 0.1.0
+---
+
+# Exchange connectors
+
+```bash
+alphafox api GET /api/v1/exchange-connectors
+```
+
+Writes that create/disable connectors may be `high-risk-write` — use `--dry-run` / `--yes`.
+
+## operationIds
+
+- `exchange_connectors.list`

package/skills/market/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: alphafox-market
+description: Market data and spread-radar readonly queries.
+version: 0.1.0
+---
+
+# Market
+
+```bash
+alphafox api GET /api/v1/market/symbols
+alphafox api GET /api/v1/spread-radar/pairs
+```
+
+Prefer readonly scopes. No mock success if upstream fails.

package/skills/notification/SKILL.md

@@ -0,0 +1,16 @@
+---
+name: alphafox-notification
+description: Notification channels and subscriptions.
+version: 0.1.0
+---
+
+# Notification
+
+```bash
+alphafox api GET /api/v1/notification/channels
+alphafox api GET /api/v1/notification/subscriptions
+```
+
+## operationIds
+
+- `notification.channels.list`

package/skills/strategy/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: alphafox-strategy
+description: Strategy definitions, chats, and backtests via public operationIds.
+version: 0.1.0
+---
+
+# Strategy / Chat / Backtest
+
+## Read
+
+```bash
+alphafox schema trading.strategy_definitions.list
+alphafox api GET /api/v1/trading/strategy-definitions
+```
+
+## Write (ordinary)
+
+```bash
+alphafox api POST /api/v1/chats --body '{"strategyGenerationMode":"simple"}'
+```
+
+Requires auth. Sends `Idempotency-Key` when available.
+
+## Long-running backtest
+
+```bash
+alphafox api POST /api/v1/backtests --body '{...}'
+alphafox api GET /api/v1/backtests/{backtestId}
+alphafox api GET /api/v1/backtests/{backtestId}/stream
+alphafox api POST /api/v1/backtests/{backtestId}/cancel --body '{}'
+```
+
+## operationIds
+
+- `trading.strategy_definitions.list`
+- `chats.create`
+- `backtests.create` / `backtests.byId.get` / `backtests.byId.stream` / `backtests.byId.cancel`

package/skills/trading/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: alphafox-trading
+description: Traders list and high-risk start/stop with confirmation gates.
+version: 0.1.0
+---
+
+# Trading
+
+## Read
+
+```bash
+alphafox api GET /api/v1/trading/traders
+```
+
+## High-risk write
+
+```bash
+alphafox api POST /api/v1/trading/traders/{traderId}/start --body '{}' --dry-run
+alphafox api POST /api/v1/trading/traders/{traderId}/start --body '{}' --yes
+```
+
+Without `--yes`, CLI exits `10` with `confirmation_required`.
+
+## operationIds
+
+- `trading.traders.list`
+- `trading.traders.byId.start`
+- `trading.traders.byId.stop`