@alphafox/cli 0.3.17 → 0.3.18

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -781,13 +781,18 @@ async function cmdApi(args, flags, env) {
781
781
  const profile = (0, profiles_1.resolveProfile)(flags.profile, env, {
782
782
  unsafeCustomEndpoint: flags.unsafeCustomEndpoint,
783
783
  });
784
- // Infer risk from catalog; uncataloged mutations are treated as high-risk.
785
- const catalogHit = (0, operations_1.findCatalogOperationByRoute)(method, (0, allowlist_1.normalizeApiPath)(path));
786
- const validated = (0, validate_body_1.validateCatalogWriteBody)({
787
- method,
788
- operationId: catalogHit?.operationId,
789
- body,
790
- });
784
+ // Infer risk from catalog; the documented direct admin route stays
785
+ // uncataloged and therefore uses the unknown/high-risk confirmation gate.
786
+ const normalizedPath = (0, allowlist_1.normalizeApiPath)(path);
787
+ const catalogHit = (0, operations_1.findCatalogOperationByRoute)(method, normalizedPath);
788
+ const directAdminWrite = method === "POST" && (0, allowlist_1.isDirectAdminAllowlistedPath)(normalizedPath);
789
+ const validated = directAdminWrite
790
+ ? { ok: true, body: body === undefined ? {} : body }
791
+ : (0, validate_body_1.validateCatalogWriteBody)({
792
+ method,
793
+ operationId: catalogHit?.operationId,
794
+ body,
795
+ });
791
796
  if (!validated.ok) {
792
797
  (0, envelope_1.writeError)(validated.error);
793
798
  }
@@ -1,153 +1,153 @@
1
1
  {
2
2
  "schemaVersion": 1,
3
3
  "packageName": "@alphafox/cli",
4
- "packageVersion": "0.3.17",
5
- "contractVersion": "2026-08-30",
6
- "bundleHash": "92e2d6ffb4f9ae03a5beaab0a22e1c0bfbc4a5876eefd405fb798a346362bb50",
4
+ "packageVersion": "0.3.18",
5
+ "contractVersion": "2026-08-31",
6
+ "bundleHash": "19730c49321abe676e32d1200bff86533131ed4aa2922fdaf73fbd4e45165faf",
7
7
  "skills": [
8
8
  {
9
9
  "name": "alphafox",
10
- "version": "0.3.17",
10
+ "version": "0.3.18",
11
11
  "files": [
12
12
  {
13
13
  "path": "SKILL.md",
14
- "sha256": "671429400afc45fb87e8da7f5fcd319d0cc19c73bd14f8f1db0180b32c63e3f3",
14
+ "sha256": "d7c507cd954fd5a5a206aadcf52d3ae1341197c300d60203f9ac9940aba9605a",
15
15
  "size": 7950
16
16
  }
17
17
  ],
18
- "hash": "df692612f39a04baced5cd891c21f2f70dbe762e1cbfd67dd8585e6cab21ab59"
18
+ "hash": "2225c66bbcadadc0c6cc2dda5681372289a8108ce91e0a5468f8c13f42c39781"
19
19
  },
20
20
  {
21
21
  "name": "alphafox-account",
22
- "version": "0.3.17",
22
+ "version": "0.3.18",
23
23
  "files": [
24
24
  {
25
25
  "path": "SKILL.md",
26
- "sha256": "9d7d231f15b92f85f5608f15fa19f58a98b65a96e0ce625075e331b5f2e3b663",
26
+ "sha256": "4118b32ae62329dde57de75ca1ca65a417f83c13261636977a352c8d1d378b5c",
27
27
  "size": 784
28
28
  }
29
29
  ],
30
- "hash": "5c2f5e252f77df972659bf086b196c3474b59cd21fb09e11680184e44b17b83a"
30
+ "hash": "d144efc2cc5883ddd11ec63fd67438472f20cb2b11da8ad005736f08e1b70c25"
31
31
  },
32
32
  {
33
33
  "name": "alphafox-admin",
34
- "version": "0.3.17",
34
+ "version": "0.3.18",
35
35
  "files": [
36
36
  {
37
37
  "path": "SKILL.md",
38
- "sha256": "27e8f0f2913d37eb18cf07ffdcb5d21033cf146c83817e4acd165458d596ecaf",
39
- "size": 788
38
+ "sha256": "1d5dab09efc36ddccead76ce4ca0a3ba734b977800c351ae2e71f9ca7c8709c6",
39
+ "size": 1930
40
40
  }
41
41
  ],
42
- "hash": "25c5ba82ca063ba87c23afaee6abf3b82db510253a04425944a1a4e0e1a46ab0"
42
+ "hash": "3a85d8a09b9ac2caa62b150191083348c0e1ddea353541227af261bdcf8af1c7"
43
43
  },
44
44
  {
45
45
  "name": "alphafox-auth",
46
- "version": "0.3.17",
46
+ "version": "0.3.18",
47
47
  "files": [
48
48
  {
49
49
  "path": "SKILL.md",
50
- "sha256": "60bd8003db5bef2e1cf4954e2bc8896c45411cdbba4699f813abb96447b03992",
50
+ "sha256": "4f35d76c147b151281bfcb9bb9bf601a521b7b35bd004c73e7a32a28b4b25802",
51
51
  "size": 2371
52
52
  }
53
53
  ],
54
- "hash": "a0ddbce0a08a0c2347d92be82c84ce674bf590397149452bfeb756a99fb21fa5"
54
+ "hash": "3685595477e95a2c84bcd380e6c6de9f8e9c006613be983ebd23b099e8da2910"
55
55
  },
56
56
  {
57
57
  "name": "alphafox-cache",
58
- "version": "0.3.17",
58
+ "version": "0.3.18",
59
59
  "files": [
60
60
  {
61
61
  "path": "SKILL.md",
62
- "sha256": "64214522c92da870279ff953477e44d81954bc1f44c18f754cfa469b318e110f",
62
+ "sha256": "9221dd3f1873080db447b7e2378fc6d8f12d70cc9a3720587a26fd853fa92cfb",
63
63
  "size": 1530
64
64
  }
65
65
  ],
66
- "hash": "24caf467bf85a9695edd327cd4426587ebd1a2f8c67efe18b6aa06e9b78ec82b"
66
+ "hash": "7356774b2d336cad0b4a50c4f36575da13f75bdcc8e1daca43416d72770d93b5"
67
67
  },
68
68
  {
69
69
  "name": "alphafox-engine-backtest",
70
- "version": "0.3.17",
70
+ "version": "0.3.18",
71
71
  "files": [
72
72
  {
73
73
  "path": "SKILL.md",
74
- "sha256": "af14757f39177ce97c5437d169ec30119859092fd051bc2c91a4ec17de13e4b5",
74
+ "sha256": "03dc3eb53d0c908c1612e2bcb400e36eb83485c5edf1a78c40138f5dad082812",
75
75
  "size": 9229
76
76
  }
77
77
  ],
78
- "hash": "391327609ec7ba5a15cd8891fa13a3347c307e5c67e8b0180ce37f18ea345610"
78
+ "hash": "76ad525091726105fe5136f9baaae5da2d428b12eb83ee48d473c314abde2930"
79
79
  },
80
80
  {
81
81
  "name": "alphafox-exchange",
82
- "version": "0.3.17",
82
+ "version": "0.3.18",
83
83
  "files": [
84
84
  {
85
85
  "path": "SKILL.md",
86
- "sha256": "b680b2efcc2ad02cd282d9e8ba60b8a373bf419023c5dd31ff0d7380a90a414b",
86
+ "sha256": "c128bd2e17e690829ff0ac31f6614b3bf5c7e28cdd0041458ec12dc658e3ad52",
87
87
  "size": 744
88
88
  }
89
89
  ],
90
- "hash": "6550f46d974b9c91851ce50f8fb6f90444f47c0c984bf08d02c69b0151b94e60"
90
+ "hash": "2a863c1f64e104d16db3aa56f85e27ff4dcb93f6a2ef3bdaa646f4f37559c6bf"
91
91
  },
92
92
  {
93
93
  "name": "alphafox-market",
94
- "version": "0.3.17",
94
+ "version": "0.3.18",
95
95
  "files": [
96
96
  {
97
97
  "path": "SKILL.md",
98
- "sha256": "3214e24046e215c083ee2e565fbbad5f98819992c4d36b9db7d43f600566330e",
98
+ "sha256": "646c4e0bedf21cab44403c7f39ec99e7ebd437773f1813fc5b65e969a5264fde",
99
99
  "size": 3079
100
100
  }
101
101
  ],
102
- "hash": "e08c33e70ce6095c0ac1752931eebbd7f8aa98e79b6bb47d9e03ae3d00f57b3b"
102
+ "hash": "081ed543a65a936a941845eff3db03e1485071d49f260a5e7fe77484b0784911"
103
103
  },
104
104
  {
105
105
  "name": "alphafox-notification",
106
- "version": "0.3.17",
106
+ "version": "0.3.18",
107
107
  "files": [
108
108
  {
109
109
  "path": "SKILL.md",
110
- "sha256": "b90429386af995970423cb9cc87238d66b06d12399cd6b9a9e5d8c121003d189",
110
+ "sha256": "2b4c37b6b629f8f526b72ff2079039de5a99e168381191345101c85921b05832",
111
111
  "size": 699
112
112
  }
113
113
  ],
114
- "hash": "831a3a2dfcc6fdc27e810b2c7e03092b090e19e615844b3af45602abb919d424"
114
+ "hash": "146cff2bd50aba4d69f07124d8c04acf5b7198b7e32cb9130442d629eedc77a5"
115
115
  },
116
116
  {
117
117
  "name": "alphafox-shared",
118
- "version": "0.3.17",
118
+ "version": "0.3.18",
119
119
  "files": [
120
120
  {
121
121
  "path": "SKILL.md",
122
- "sha256": "070829ab67522d0a5382d4789c0b85558f653a0d1e3850416064a4da55903f5c",
122
+ "sha256": "397cd48bed1fc583e421906e696104e26fbb56de34407dda7c1336e50c72cb41",
123
123
  "size": 6920
124
124
  }
125
125
  ],
126
- "hash": "34e0803a19fdb6c468a9a511bffedb73e48ec2fedf5edb8e046599f36026aa29"
126
+ "hash": "213e118edd8de0144972b3fee9cb3e3b6d915ee969cb6645f8a9d6bf07c6c904"
127
127
  },
128
128
  {
129
129
  "name": "alphafox-strategy",
130
- "version": "0.3.17",
130
+ "version": "0.3.18",
131
131
  "files": [
132
132
  {
133
133
  "path": "SKILL.md",
134
- "sha256": "eacd3ad5fb61880f0364f4caf79ac08c9ba7e919b9510d16644a45917262ede5",
134
+ "sha256": "2f7fcee652edaf36770501cb6d5854bfcd193c90f4af9d17de0c319b263bbb50",
135
135
  "size": 4862
136
136
  }
137
137
  ],
138
- "hash": "024bdcfab093873df90704532c481a5bf28388124a17f7c6021f094ed807b208"
138
+ "hash": "ad7f6dc8b1ebce16a4d52a8c7edf69f9a4bb21b7f22c58fcc7721b2ac16e51a8"
139
139
  },
140
140
  {
141
141
  "name": "alphafox-trading",
142
- "version": "0.3.17",
142
+ "version": "0.3.18",
143
143
  "files": [
144
144
  {
145
145
  "path": "SKILL.md",
146
- "sha256": "70a70aef7a82f34479225051dfb197692d249e6eb835430e069e1eb3629a5bf1",
147
- "size": 5203
146
+ "sha256": "48177ed0dbb65eb812ad18dd8667b107437f01dd79050186331da4ba000b59fa",
147
+ "size": 4493
148
148
  }
149
149
  ],
150
- "hash": "8f6019201801b0d07801f7e1cbab72d82666cdd3ecbcc7445d764948fbd5fac0"
150
+ "hash": "dde92790169c72b6e9ffe685af5d94b0d32b84d4dd2d27be0c2492e346a5eb90"
151
151
  }
152
152
  ]
153
153
  }
package/dist/version.d.ts CHANGED
@@ -1,4 +1,4 @@
1
1
  export declare const CLI_NAME = "alphafox";
2
2
  export declare const CLI_PACKAGE = "@alphafox/cli";
3
- export declare const CLI_VERSION = "0.3.17";
3
+ export declare const CLI_VERSION = "0.3.18";
4
4
  export { CATALOG_VERSION as CLI_CONTRACT_VERSION } from "./catalog/operations";
package/dist/version.js CHANGED
@@ -3,6 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
3
3
  exports.CLI_CONTRACT_VERSION = exports.CLI_VERSION = exports.CLI_PACKAGE = exports.CLI_NAME = void 0;
4
4
  exports.CLI_NAME = "alphafox";
5
5
  exports.CLI_PACKAGE = "@alphafox/cli";
6
- exports.CLI_VERSION = "0.3.17";
6
+ exports.CLI_VERSION = "0.3.18";
7
7
  var operations_1 = require("./catalog/operations");
8
8
  Object.defineProperty(exports, "CLI_CONTRACT_VERSION", { enumerable: true, get: function () { return operations_1.CATALOG_VERSION; } });
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@alphafox/cli",
3
- "version": "0.3.17",
3
+ "version": "0.3.18",
4
4
  "description": "AlphaFox CLI — Agent/Human entry for the public Application API.",
5
5
  "type": "commonjs",
6
6
  "bin": {
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: alphafox-account
3
3
  description: Account, wallet, and subscription read paths.
4
- version: 0.3.17
4
+ version: 0.3.18
5
5
  ---
6
6
 
7
7
  # Account / wallet
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: alphafox-admin
3
3
  description: Admin-only operations reusing Web role authorization.
4
- version: 0.3.17
4
+ version: 0.3.18
5
5
  ---
6
6
 
7
7
  # Admin
@@ -12,7 +12,30 @@ Requires admin role on the server. CLI confirmation does not grant privilege. No
12
12
  alphafox api GET /api/v1/admin/users --format json --no-input
13
13
  ```
14
14
 
15
- High-risk admin writes: `alphafox schema <operationId>` first, then `--dry-run` then `--yes`. Body fields must come from that schema; use `--config @file` for large objects. If the operator is not admin, expect `403` and stop.
15
+ High-risk cataloged admin writes: `alphafox schema <operationId>` first, then `--dry-run` then `--yes`. Body fields must come from that schema; use `--config @file` for large objects. If the operator is not admin, expect `403` and stop.
16
+
17
+ ## Passivbot paper acceptance
18
+
19
+ This Stage 1 endpoint is intentionally absent from the public Operation Registry and typed CLI catalog. The only allowed uncataloged admin path is the exact direct route below. Its JSON body is strict: `name`, `exchangeConnectorId`, and `config` are required; `configSchemaVersion` may only be `1`; `autoStart` is optional and defaults to `true`. Do not add server-owned fields.
20
+
21
+ Preview the exact raw request first. The unknown/high-risk gate must return `confirmation_required`; show the requested action and risk to the operator, wait for explicit confirmation, then rerun the same command with `--yes`.
22
+
23
+ ```bash
24
+ alphafox api POST /api/admin/passivbot-paper-acceptance-traders --config @./create-passivbot-paper.json --dry-run --format json --no-input
25
+ alphafox api POST /api/admin/passivbot-paper-acceptance-traders --config @./create-passivbot-paper.json --yes --format json --no-input
26
+ ```
27
+
28
+ The config file shape is:
29
+
30
+ ```json
31
+ {
32
+ "name": "Passivbot paper acceptance",
33
+ "exchangeConnectorId": "<internal-paper-connector-id>",
34
+ "configSchemaVersion": 1,
35
+ "config": {},
36
+ "autoStart": true
37
+ }
38
+ ```
16
39
 
17
40
  ## Recovery
18
41
 
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: alphafox
3
3
  description: AlphaFox CLI entry router. Use for any AlphaFox request — install, update, login, whoami, 回测, engine backtest, 清理回测缓存 / 历史数据, strategy definitions, create/list/start/stop a running strategy (trader), ticker/标的 resolve (美股 or crypto), market data, exchange connectors, wallet, subscriptions, notifications, or admin. After 回测 or 运行策略, include the dashboard URL from the domain skill. When the user asks 排行榜, include https://www.alphafox.app/zh/dashboard/leaderboard. After a successful install and login, present the 新人引导 in this file (Lite square 带单员 + classic strategies). If a CLI command prints `[alphafox] update available`, ask the user「检测到新的版本,是否需要我帮你升级?」and only then run `alphafox update --format json --no-input`. After a large backtest, if tape cache is large, ask「回测下载的历史数据比较大,要不要我帮你清理本地缓存?」then open `alphafox-cache`. Start here, then open the routed domain skill. Do not guess alphafox-engine-backtest vs alphafox-strategy vs alphafox-trading from memory.
4
- version: 0.3.17
4
+ version: 0.3.18
5
5
  ---
6
6
 
7
7
  # AlphaFox
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: alphafox-shared
3
3
  description: Shared AlphaFox CLI rules for Agents — auth, profiles, envelopes, risk gates, public operationIds, and dashboard links after 回测 / 运行策略 / 排行榜.
4
- version: 0.3.17
4
+ version: 0.3.18
5
5
  ---
6
6
 
7
7
  # AlphaFox shared Agent contract
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: alphafox-auth
3
3
  description: Login, status, logout, whoami, and environment isolation for AlphaFox CLI.
4
- version: 0.3.17
4
+ version: 0.3.18
5
5
  ---
6
6
 
7
7
  # Auth Skill
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: alphafox-cache
3
3
  description: Inspect and clean local Engine backtest caches (downloaded OHLCV tape and wasm runtime). Use when the user asks to 清理缓存, free disk, or after a large historical backtest.
4
- version: 0.3.17
4
+ version: 0.3.18
5
5
  ---
6
6
 
7
7
  # Cache
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: alphafox-engine-backtest
3
3
  description: Local Engine WASM backtest (alphafox engine-backtest run|sweep) vs catalog experiment CRUD. After a persisted run, include https://www.alphafox.app/zh/dashboard/traders/backtest/{experimentId}.
4
- version: 0.3.17
4
+ version: 0.3.18
5
5
  ---
6
6
 
7
7
  # Engine Backtest
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: alphafox-exchange
3
3
  description: Exchange connectors list and connection management via Public API.
4
- version: 0.3.17
4
+ version: 0.3.18
5
5
  ---
6
6
 
7
7
  # Exchange connectors
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: alphafox-market
3
3
  description: Market data and ticker resolution for US equity perps, RWAs, and crypto on the same perp catalog. Use when the user names 美股, NVDA, AAPL, BTC, or any 标的. Keep the operator's asset class via symbolMetadata — do not rewrite NVDA into a crypto coin.
4
- version: 0.3.17
4
+ version: 0.3.18
5
5
  ---
6
6
 
7
7
  # Market
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: alphafox-notification
3
3
  description: Notification channels and subscriptions.
4
- version: 0.3.17
4
+ version: 0.3.18
5
5
  ---
6
6
 
7
7
  # Notification
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: alphafox-strategy
3
3
  description: Strategy definitions — list types, read a definition's contract, and validate config. Creating a running strategy is creating a trader; use alphafox-trading for that. Local Engine backtest is alphafox-engine-backtest.
4
- version: 0.3.17
4
+ version: 0.3.18
5
5
  ---
6
6
 
7
7
  # Strategy definitions
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: alphafox-trading
3
3
  description: Running strategies (traders) — create, list, start, and stop. A trader is a live or paper strategy instance (grid, dca, copy, …), not a person. Default Engine create uses autoStart true (创建即开始). Use autoStart false only when the user asks to create without starting. After create or start, include https://www.alphafox.app/zh/dashboard/traders/{traderId}.
4
- version: 0.3.17
4
+ version: 0.3.18
5
5
  ---
6
6
 
7
7
  # Running strategies (traders)
@@ -19,7 +19,6 @@ Pick the create operation from the definition the operator asked for:
19
19
  | Engine definitions (grid, dca, …) | `trading.traders.create` |
20
20
  | Hyperliquid copy | `trading.hl_copy_traders.create` |
21
21
  | Rebate copy | `trading.rebate_copy_traders.create` |
22
- | Passivbot v8 paper acceptance | `trading.passivbot_paper_acceptance_traders.create` |
23
22
 
24
23
  Copy leads come from `trading.signal_sources.list` when the operator named one. Same trader lifecycle (list / start / stop) after create.
25
24
 
@@ -41,14 +40,6 @@ alphafox trading traders create --config @./create-trader.json --yes --format js
41
40
 
42
41
  `trading.traders.create` is `high-risk-write` and needs `--yes`. Copy creates follow whatever `risk` the schema reports — `--dry-run` first, then `--yes` when required.
43
42
 
44
- Passivbot v8 acceptance uses the dedicated operation below. It fixes the hidden definition server-side, accepts only an internal paper connector, and requires the authenticated user to hold an admin role.
45
-
46
- ```bash
47
- alphafox schema trading.passivbot_paper_acceptance_traders.create --format json --no-input
48
- alphafox trading passivbot_paper_acceptance_traders create --config @./create-passivbot-paper.json --dry-run --format json --no-input
49
- alphafox trading passivbot_paper_acceptance_traders create --config @./create-passivbot-paper.json --format json --no-input
50
- ```
51
-
52
43
  Default Engine create is **创建即开始**: set `autoStart` to `true` in the body. Omitting `autoStart` is not the same — the server treats a missing flag as do-not-start. Use `autoStart: false` only when the operator explicitly asks to create without starting (创建但不启动 / 暂时不开始 / 先创建不要跑). Do not create-then-`byId.start` as the default path.
53
44
 
54
45
  After a successful create (or a later start), include the trader dashboard URL from `alphafox-shared` (`https://www.alphafox.app/zh/dashboard/traders/{traderId}`).
@@ -89,7 +80,6 @@ alphafox trading traders byId stop --traderId <id> --body '{"closePositions":fal
89
80
  - `trading.traders.create`
90
81
  - `trading.hl_copy_traders.create`
91
82
  - `trading.rebate_copy_traders.create`
92
- - `trading.passivbot_paper_acceptance_traders.create`
93
83
  - `trading.signal_sources.list`
94
84
  - `trading.traders.byId.start`
95
85
  - `trading.traders.byId.stop`