@alphafox/cli 0.3.21 → 0.3.23

package/dist/auth/refresh.js

@@ -257,10 +257,9 @@ async function fetchFollowingSameSiteRedirects(fetchImpl, startUrl, init, maxHop
         const nextUrl = new URL(location, url).toString();
         if (!sameAuthSite(originOf(url), originOf(nextUrl)))
             break;
-        if (response.status === 303 ||
-            ((response.status === 301 || response.status === 302) &&
-                method !== "GET" &&
-                method !== "HEAD")) {
+        // 303 is the only redirect that switches to GET. Apex→www is Cloudflare 301;
+        // converting POST to GET drops the OAuth body and the AS returns 405.
+        if (response.status === 303) {
             method = "GET";
             body = undefined;
         }

package/dist/commands/run.js

@@ -101,8 +101,8 @@ async function runCli(argv, env = process.env) {
                 "alphafox schema [operationId]",
                 "alphafox catalog",
                 "alphafox api METHOD PATH [--body JSON|--config @file]",
-                "alphafox engine-backtest run --experiment <uuid> --definition <id> --config @file --exchange <id> --range FROM..TO --initial-equity N",
-                "alphafox engine-backtest sweep --experiment <uuid> --definition <id> --config @file --axes @file --exchange <id> --range FROM..TO --initial-equity N --no-persist",
+                "alphafox engine-backtest run --experiment <uuid> --definition <id> --config @file --exchange <id> --range FROM..TO --initial-equity N [--verbose]",
+                "alphafox engine-backtest sweep --experiment <uuid> --definition <id> --config @file --axes @file --exchange <id> --range FROM..TO --initial-equity N --no-persist [--verbose]",
                 "alphafox cache status|clean [--tape|--runtime|--all]",
                 "alphafox resolve-symbols <query...> [--exchange binance] [--asset-class equity_perp]",
                 "alphafox <domain> <resource> <action> [flags]",

package/dist/engine-backtest/fetch-runtime.d.ts

@@ -8,6 +8,8 @@ export declare const BLOB_RUNTIME_FILES: {
     readonly node: "node.mjs";
     readonly nodeWorker: "worker-node.mjs";
     readonly nodeWorkerPath: "worker-node-path.mjs";
+    readonly passivbotKernel: "passivbot_kernel.wasm";
+    readonly passivbotKernelModule: "passivbot-kernel.mjs";
 };
 export type BlobRuntimeFileKey = keyof typeof BLOB_RUNTIME_FILES;
 export interface EngineBacktestBlobManifest {
@@ -23,6 +25,8 @@ export interface EngineBacktestBlobManifest {
     readonly node: string;
     readonly nodeWorker: string;
     readonly nodeWorkerPath: string;
+    readonly passivbotKernel: string;
+    readonly passivbotKernelModule: string;
 }
 export interface FetchRuntimeHooks {
     readonly fetch?: typeof fetch;

package/dist/engine-backtest/fetch-runtime.js

@@ -5,12 +5,13 @@ exports.resolveBacktestWasmManifestUrl = resolveBacktestWasmManifestUrl;
 exports.resolveRuntimeCacheDir = resolveRuntimeCacheDir;
 exports.parseEngineBacktestBlobManifest = parseEngineBacktestBlobManifest;
 exports.ensureBlobRuntime = ensureBlobRuntime;
+const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const promises_1 = require("node:fs/promises");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
-const promises_2 = require("node:stream/promises");
 const node_stream_1 = require("node:stream");
+const promises_2 = require("node:stream/promises");
 const errors_1 = require("./errors");
 exports.BACKTEST_RUNTIME_PROTOCOL = 1;
 exports.DEFAULT_BACKTEST_WASM_MANIFEST_URL = "https://zwggllrrna54e2d6.public.blob.vercel-storage.com/engine-backtest/latest.json";
@@ -22,7 +23,20 @@ exports.BLOB_RUNTIME_FILES = {
     node: "node.mjs",
     nodeWorker: "worker-node.mjs",
     nodeWorkerPath: "worker-node-path.mjs",
+    passivbotKernel: "passivbot_kernel.wasm",
+    passivbotKernelModule: "passivbot-kernel.mjs",
 };
+const HASHED_BLOB_RUNTIME_FILES = [
+    exports.BLOB_RUNTIME_FILES.wasm,
+    exports.BLOB_RUNTIME_FILES.passivbotKernel,
+    exports.BLOB_RUNTIME_FILES.wasmExec,
+    exports.BLOB_RUNTIME_FILES.worker,
+    exports.BLOB_RUNTIME_FILES.passivbotKernelModule,
+    exports.BLOB_RUNTIME_FILES.client,
+    exports.BLOB_RUNTIME_FILES.node,
+    exports.BLOB_RUNTIME_FILES.nodeWorker,
+    exports.BLOB_RUNTIME_FILES.nodeWorkerPath,
+];
 function resolveBacktestWasmManifestUrl(env = process.env) {
     return (env.ALPHAFOX_BACKTEST_WASM_MANIFEST_URL?.trim() ||
         exports.DEFAULT_BACKTEST_WASM_MANIFEST_URL);
@@ -51,9 +65,19 @@ function parseEngineBacktestBlobManifest(value) {
             message: `Backtest runtime protocol is incompatible (got ${String(record.protocol)}, expected ${exports.BACKTEST_RUNTIME_PROTOCOL}).`,
         });
     }
+    const hash = readRequiredString(record.hash, "hash");
+    if (!/^[0-9a-f]{16}$/.test(hash)) {
+        throw new errors_1.EngineBacktestError({
+            type: "runtime",
+            subtype: "runtime_manifest_invalid",
+            message: "Backtest runtime manifest hash must be 16 lowercase hex characters.",
+        });
+    }
+    const passivbotKernel = readRequiredHttps(record.passivbotKernel, "passivbotKernel");
+    const passivbotKernelModule = readRequiredHttps(record.passivbotKernelModule, "passivbotKernelModule");
     return {
         version: readRequiredString(record.version, "version"),
-        hash: readRequiredString(record.hash, "hash"),
+        hash,
         protocol: exports.BACKTEST_RUNTIME_PROTOCOL,
         engineSha: readOptionalString(record.engineSha),
         packageVersion: readOptionalString(record.packageVersion),
@@ -64,6 +88,8 @@ function parseEngineBacktestBlobManifest(value) {
         node: readRequiredHttps(record.node, "node"),
         nodeWorker: readRequiredHttps(record.nodeWorker, "nodeWorker"),
         nodeWorkerPath: readRequiredHttps(record.nodeWorkerPath, "nodeWorkerPath"),
+        passivbotKernel,
+        passivbotKernelModule,
     };
 }
 async function ensureBlobRuntime(env = process.env, hooks) {
@@ -93,20 +119,66 @@ async function ensureBlobRuntime(env = process.env, hooks) {
     }
     const manifest = parseEngineBacktestBlobManifest(await response.json());
     const directory = hooks?.cacheDir ?? resolveRuntimeCacheDir(manifest.hash, env);
-    await (0, promises_1.mkdir)(directory, { recursive: true });
-    for (const key of Object.keys(exports.BLOB_RUNTIME_FILES)) {
-        const fileName = exports.BLOB_RUNTIME_FILES[key];
-        const target = (0, node_path_1.join)(directory, fileName);
-        if (await fileExists(target)) {
-            continue;
+    if (await runtimeMatchesHash(directory, manifest.hash)) {
+        return {
+            manifest,
+            directory,
+            nodeEntry: (0, node_path_1.join)(directory, exports.BLOB_RUNTIME_FILES.node),
+        };
+    }
+    await (0, promises_1.mkdir)((0, node_path_1.dirname)(directory), { recursive: true });
+    let actualHash = "";
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        const staging = `${directory}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`;
+        await (0, promises_1.mkdir)(staging, { recursive: true });
+        try {
+            for (const key of Object.keys(exports.BLOB_RUNTIME_FILES)) {
+                await downloadFile(fetchImpl, manifest[key], (0, node_path_1.join)(staging, exports.BLOB_RUNTIME_FILES[key]));
+            }
+            if (!(await allRuntimeFilesExist(staging))) {
+                continue;
+            }
+            actualHash = await hashBlobRuntime(staging);
+            if (actualHash !== manifest.hash) {
+                continue;
+            }
+            await (0, promises_1.mkdir)(directory, { recursive: true });
+            for (const fileName of Object.values(exports.BLOB_RUNTIME_FILES)) {
+                await (0, promises_1.rename)((0, node_path_1.join)(staging, fileName), (0, node_path_1.join)(directory, fileName));
+            }
+            if (await runtimeMatchesHash(directory, manifest.hash)) {
+                return {
+                    manifest,
+                    directory,
+                    nodeEntry: (0, node_path_1.join)(directory, exports.BLOB_RUNTIME_FILES.node),
+                };
+            }
+        }
+        finally {
+            await (0, promises_1.rm)(staging, { force: true, recursive: true });
         }
-        await downloadFile(fetchImpl, manifest[key], target);
     }
-    return {
-        manifest,
-        directory,
-        nodeEntry: (0, node_path_1.join)(directory, exports.BLOB_RUNTIME_FILES.node),
-    };
+    throw new errors_1.EngineBacktestError({
+        type: "runtime",
+        subtype: "runtime_integrity_failed",
+        message: `Backtest runtime hash mismatch: expected ${manifest.hash}, received ${actualHash}.`,
+        hint: "Retry the download; no unverified runtime was cached.",
+        details: { expectedHash: manifest.hash, actualHash, directory },
+    });
+}
+async function runtimeMatchesHash(directory, expectedHash) {
+    if (!(await allRuntimeFilesExist(directory))) {
+        return false;
+    }
+    try {
+        return (await hashBlobRuntime(directory)) === expectedHash;
+    }
+    catch {
+        return false;
+    }
+}
+async function allRuntimeFilesExist(directory) {
+    return (await Promise.all(Object.values(exports.BLOB_RUNTIME_FILES).map((fileName) => fileExists((0, node_path_1.join)(directory, fileName))))).every(Boolean);
 }
 async function downloadFile(fetchImpl, url, target) {
     let response;
@@ -127,9 +199,23 @@ async function downloadFile(fetchImpl, url, target) {
             message: `Backtest runtime file unavailable (${url} HTTP ${response.status}).`,
         });
     }
-    const tmp = `${target}.tmp`;
-    await (0, promises_2.pipeline)(node_stream_1.Readable.fromWeb(response.body), (0, node_fs_1.createWriteStream)(tmp));
-    await (0, promises_1.rename)(tmp, target);
+    const tmp = `${target}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`;
+    try {
+        await (0, promises_2.pipeline)(node_stream_1.Readable.fromWeb(response.body), (0, node_fs_1.createWriteStream)(tmp));
+        await (0, promises_1.rename)(tmp, target);
+    }
+    finally {
+        await (0, promises_1.rm)(tmp, { force: true });
+    }
+}
+async function hashBlobRuntime(directory) {
+    const digest = (0, node_crypto_1.createHash)("sha256");
+    for (const fileName of HASHED_BLOB_RUNTIME_FILES) {
+        for await (const chunk of (0, node_fs_1.createReadStream)((0, node_path_1.join)(directory, fileName))) {
+            digest.update(chunk);
+        }
+    }
+    return digest.digest("hex").slice(0, 16);
 }
 async function fileExists(path) {
     try {

package/dist/engine-backtest/parse-args.js

@@ -16,11 +16,11 @@ const TIERS = new Set(["free", "pro", "pro_max"]);
 const DATA_QUALITY = new Set(["strict", "basic"]);
 const PRICE_PATHS = new Set(["ohlc_path_4", "close_only"]);
 exports.ENGINE_BACKTEST_RUN_USAGE = [
-    "alphafox engine-backtest run --experiment <uuid> --definition <id> --config @file.json --exchange <id> --range YYYY-MM-DD..YYYY-MM-DD --initial-equity N [--replay-timeframe 1m]",
+    "alphafox engine-backtest run --experiment <uuid> --definition <id> --config @file.json --exchange <id> --range YYYY-MM-DD..YYYY-MM-DD --initial-equity N [--replay-timeframe 1m] [--verbose]",
     "alphafox engine-backtest run --create-experiment --name <name> --definition <id> --config @file.json --exchange <id> --from YYYY-MM-DD --to YYYY-MM-DD --initial-equity N",
 ];
 exports.ENGINE_BACKTEST_SWEEP_USAGE = [
-    "alphafox engine-backtest sweep --experiment <uuid> --definition <id> --config @file.json --axes @axes.json --exchange <id> --range YYYY-MM-DD..YYYY-MM-DD --initial-equity N [--no-persist] [--mode neighborhood|range] [--search-mode standard|fast] [--concurrency N]",
+    "alphafox engine-backtest sweep --experiment <uuid> --definition <id> --config @file.json --axes @axes.json --exchange <id> --range YYYY-MM-DD..YYYY-MM-DD --initial-equity N [--no-persist] [--mode neighborhood|range] [--search-mode standard|fast] [--concurrency N] [--verbose]",
 ];
 const SWEEP_MODES = new Set(["neighborhood", "range"]);
 const SEARCH_MODES = new Set(["standard", "fast"]);
@@ -112,6 +112,7 @@ function parseEngineBacktestRunArgs(args) {
     let configSchemaVersion;
     let executionModelOverride;
     let persist = true;
+    let verbose = false;
     let help = false;
     let replayTimeframe = replay_timeframe_1.ENGINE_BACKTEST_DEFAULT_REPLAY_TIMEFRAME;
     for (let i = 0; i < args.length; i += 1) {
@@ -128,6 +129,10 @@ function parseEngineBacktestRunArgs(args) {
             persist = false;
             continue;
         }
+        if (a === "--verbose") {
+            verbose = true;
+            continue;
+        }
         if (!a.startsWith("--")) {
             usage(`Unexpected argument: ${a}`, "unexpected_arg");
         }
@@ -227,6 +232,7 @@ function parseEngineBacktestRunArgs(args) {
             tier,
             dataQualityMode,
             persist,
+            verbose,
             replayTimeframe,
         };
     }
@@ -284,6 +290,7 @@ function parseEngineBacktestRunArgs(args) {
         configSchemaVersion,
         executionModelOverride,
         persist,
+        verbose,
         replayTimeframe,
     };
 }
@@ -346,6 +353,7 @@ function parseEngineBacktestSweepArgs(args) {
             createExperiment: false,
             dataQualityMode: types_1.DEFAULT_DATA_QUALITY_MODE,
             persist: true,
+            verbose: false,
             replayTimeframe: replay_timeframe_1.ENGINE_BACKTEST_DEFAULT_REPLAY_TIMEFRAME,
             axesRaw,
             mode,

package/dist/engine-backtest/run-command.js

@@ -222,7 +222,9 @@ async function executeEngineBacktestRun(args, flags, env = process.env, deps = {
         wasm = wasmLoaded.module;
         runner = runnerLoaded.module;
     }
-    const client = wasm.createNodeBacktestClient();
+    const client = wasm.createNodeBacktestClient({
+        verbose: args.verbose,
+    });
     try {
         if (typeof client.init === "function") {
             await client.init();
@@ -449,6 +451,7 @@ function engineBacktestHelpData() {
             "runs.create is write (not high-risk-write); --yes is not required",
             "Do not pass --token; use alphafox auth login",
             "--replay-timeframe defaults to 1m (min 1m). Indicator series still download their native plan timeframes.",
+            "Raw Engine worker logs, including per-trade output, are hidden by default. Use --verbose to forward them.",
             "--data-quality defaults to basic: hard tape failures still stop, soft gaps finish the run and appear as coverageNotice (prefix_gap less severe, internal_gap more severe). Use --data-quality strict to fail on any gap.",
         ],
     };

package/dist/engine-backtest/sweep-command.js

@@ -85,7 +85,7 @@ async function executeEngineBacktestSweep(args, flags, env = process.env, deps =
     const { wasm, runner } = await loadRuntime(deps, env);
     const clients = [];
     try {
-        const client = wasm.createNodeBacktestClient();
+        const client = wasm.createNodeBacktestClient({ verbose: args.verbose });
         clients.push(client);
         if (typeof client.init === "function") {
             await client.init();
@@ -221,7 +221,7 @@ async function executeEngineBacktestSweep(args, flags, env = process.env, deps =
         }
         emitProgress("tape", 1);
         while (clients.length < concurrency) {
-            const extra = wasm.createNodeBacktestClient();
+            const extra = wasm.createNodeBacktestClient({ verbose: args.verbose });
             clients.push(extra);
             if (typeof extra.init === "function") {
                 await extra.init();

package/dist/engine-backtest/types.d.ts

@@ -50,6 +50,8 @@ export interface EngineBacktestRunArgs {
     readonly configSchemaVersion?: number;
     readonly executionModelOverride?: Partial<ExecutionModel>;
     readonly persist: boolean;
+    /** Forward raw Engine WASM worker stdout/stderr. Disabled by default. */
+    readonly verbose: boolean;
     /** Replay/download bar. Defaults to 1m; never finer. */
     readonly replayTimeframe: string;
 }
@@ -256,7 +258,9 @@ export interface BacktestClientLike {
     terminate(): void;
 }
 export interface BacktestWasmModule {
-    createNodeBacktestClient(options?: unknown): BacktestClientLike;
+    createNodeBacktestClient(options?: {
+        readonly verbose?: boolean;
+    }): BacktestClientLike;
 }
 export interface BacktestRunnerModule {
     loadTape(request: {

package/dist/http/client.js

@@ -146,9 +146,9 @@ async function fetchFollowingAuthRedirects(fetchImpl, startUrl, init, maxHops =
         if (!sameAuthSite(originOf(url), originOf(nextUrl))) {
             break;
         }
-        // 303 switches to GET without body; 301/302 historically do for non-GET.
-        if (response.status === 303 ||
-            ((response.status === 301 || response.status === 302) && method !== "GET" && method !== "HEAD")) {
+        // 303 is the only redirect that switches to GET. Apex→www is Cloudflare 301;
+        // converting POST to GET drops the OAuth body and the AS returns 405.
+        if (response.status === 303) {
             method = "GET";
             body = undefined;
         }

package/dist/skills-manifest.json

@@ -1,153 +1,153 @@
 {
   "schemaVersion": 1,
   "packageName": "@alphafox/cli",
-  "packageVersion": "0.3.21",
+  "packageVersion": "0.3.23",
   "contractVersion": "2026-08-31",
-  "bundleHash": "3b1e1c9968daa5b78e782cdb9a3e824b9fd69dfe20c90fd81fe457dd5b051f53",
+  "bundleHash": "cefb5f2b4c977a754941282a46780e64143978f21d4ad1db4da9fed993455094",
   "skills": [
     {
       "name": "alphafox",
-      "version": "0.3.21",
+      "version": "0.3.23",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "2152cddf61791a680d9a12e561afa858f70ae862fe938ffdda8c9224f186664e",
-          "size": 7950
+          "sha256": "ad970465cc7a8b6db68253cd6c6b375e824c32c197bd10cdd4735052a9dc54e6",
+          "size": 6711
         }
       ],
-      "hash": "1cebc25d526364cf90f859407485d7431fb04921e7b7f2102c3f2cc1c52ae1f6"
+      "hash": "57b1b2996a4cb8e22ee36ccacae56ff36bcd64ac7203e528ccbca4b898f39a07"
     },
     {
       "name": "alphafox-account",
-      "version": "0.3.21",
+      "version": "0.3.23",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "9897b6cdc67bc3b439d0ee8d20a73b1b195f434282f443cdd4b386da64926148",
+          "sha256": "23a35e3a3d6ac9e7da639b9383750f66e9de4dbbe049861da78f7912e9076512",
           "size": 784
         }
       ],
-      "hash": "c11aaaa4a6fff64003f2ed6f842eb2879da9de82d90bb86e7b95224b958621f0"
+      "hash": "9b604ef9fc3c097333cf55b5e5fadb4c0179ad15c0dc05b3f76805abb4179be3"
     },
     {
       "name": "alphafox-admin",
-      "version": "0.3.21",
+      "version": "0.3.23",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "bc94cab7004cb17c8b87c4af22d3dfe95bf51c4bdde3bd84cdaebbc056584322",
+          "sha256": "d53090a8e0ac05b5d8d753d52086389ed0ee0f9d405c3adfb120d06d3a17841e",
           "size": 2078
         }
       ],
-      "hash": "073a7e1cc246b0c77a376e279ba09d7e049639c8e63074415fcfe26198ee1903"
+      "hash": "f8c047c2c4f1a49c13d5fe92c1676108fe31bcfdb3eebfb49fbe7719586944bb"
     },
     {
       "name": "alphafox-auth",
-      "version": "0.3.21",
+      "version": "0.3.23",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "c576ef7a5ac20933def1bc334e3347b0951ad0692ff4b4ea92fe89a4052b5ee4",
+          "sha256": "a563b8c330fcee564b9dae3ab177b36e6612a5e6e28c0dcc2770ebe699f45181",
           "size": 2371
         }
       ],
-      "hash": "41c831e8be2311f3abf393a9a502b2bbe6f79a383dfa9ee125a6b6f70e38e2f4"
+      "hash": "f6e8ac98bca895fb0e5afb0f7f915645267404aa77cc85724475287866619d68"
     },
     {
       "name": "alphafox-cache",
-      "version": "0.3.21",
+      "version": "0.3.23",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "7b068ca3e06f221ea9306d441c56468852dfbb965e07f1675f1c423587520ca8",
-          "size": 1530
+          "sha256": "9858b145e37f91082af9f9ed07d7f89c63f51365de3e1d04925b4bf476fe11c9",
+          "size": 1762
         }
       ],
-      "hash": "8d97f1d8c423dbdabdf6aaf66e2d129d76319b0d4b803690cfe454239e237088"
+      "hash": "dd38538eb6a66500361406acba11818ef333c50c119735f8dc4e846d20aaee51"
     },
     {
       "name": "alphafox-engine-backtest",
-      "version": "0.3.21",
+      "version": "0.3.23",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "a957f0785e76a077b6d1f9f1fa80d43e4a1474ea65d7b2960677c42cdb6f66e2",
-          "size": 9792
+          "sha256": "feded42f5db1201ea13dca0fdcff0eb8a210024440b9e253f6b2b213065f45bb",
+          "size": 9862
         }
       ],
-      "hash": "a046f3ef1386b5649d4a019458a790adc978c5e9a69b03a58e64a262bf545f1b"
+      "hash": "9071605d37c982f7741fe533671fb10d97d17d0265db0712d8b784f4562334ad"
     },
     {
       "name": "alphafox-exchange",
-      "version": "0.3.21",
+      "version": "0.3.23",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "9d11b9c68da4d6948c00b1f2449e170a3ef387f07ccce36db1037d0871b0842a",
+          "sha256": "ed25e4487435552e7d2fb647a7c4ab0dcd96c11e65f6fd0076e841095497a412",
           "size": 744
         }
       ],
-      "hash": "53b02a31ef1891bbcbb513dae2af48e8978003f3c41585ebab62d940bd8bad07"
+      "hash": "9dcbabf7b94c11901b35f3cf9f2f980a718ce675534df44e406ef0fb4ace9082"
     },
     {
       "name": "alphafox-market",
-      "version": "0.3.21",
+      "version": "0.3.23",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "3131b98faddf4a85c87a2a4b0b7fb9c0b6c97159bf38dfc61a1c2a2367fc0020",
-          "size": 3079
+          "sha256": "3e5835e3d4d658b43265ecb2d062bf2440e8f76f112104b0e66d4ee4a4362738",
+          "size": 3208
         }
       ],
-      "hash": "df030475f2d0c4b53312bc1be8f1c3555062076074c0c207e3d8cd7a223d4f05"
+      "hash": "ff13c2cf880c6a7e0a8c20da2fffcdfc32f05737e1d860c3d76c3b1883a70d9d"
     },
     {
       "name": "alphafox-notification",
-      "version": "0.3.21",
+      "version": "0.3.23",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "163a697d7c107152dc0a20dcabd06f1d9eb5b9395289e940b228cf599e7e901e",
+          "sha256": "684c29d65ef408836fe6841d272ac9c3cbf725ee9763deb886fad2e1076c07a2",
           "size": 699
         }
       ],
-      "hash": "eab1329002b3e97d8a71800de23595a1df35cd0db3e7751382820df5244c9865"
+      "hash": "318099f64c6952496f21a7046723e4c5c9edfedb2f2687930cb5b80678ae22db"
     },
     {
       "name": "alphafox-shared",
-      "version": "0.3.21",
+      "version": "0.3.23",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "95c311b9b091d5c6c21928c499568bba7d78bbf48ffc78204f54560c828213b8",
-          "size": 6920
+          "sha256": "247c5f488e14c2ad1996d9a7167c69c593da31cb340f09bb1e52a572031db550",
+          "size": 7819
         }
       ],
-      "hash": "5b84d0c16f8d1e0b2b5caefa6a5683650450249615fe186d48e987d42eebd264"
+      "hash": "5834e09bc8fdd24240c35233f8b5035b362a9d289a7f0f7698aac7480d1ef429"
     },
     {
       "name": "alphafox-strategy",
-      "version": "0.3.21",
+      "version": "0.3.23",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "b61a5d3b32c0caaa29280676d0a38c32d895b13991056b8adbde584baeb751d2",
-          "size": 7185
+          "sha256": "cf1e0c364de027cdf63113848ae9eb2194e1efc8025c3224da3fd86cf6990adc",
+          "size": 8039
         }
       ],
-      "hash": "fa63c05d477ffb58e32c8c8e301189135d78e1a80bcb57cd7997a8533869f5f7"
+      "hash": "a17d382e02007479b66f2b879d38c7eaaa802738dc679e2e96bf42ed7d9eeb4b"
     },
     {
       "name": "alphafox-trading",
-      "version": "0.3.21",
+      "version": "0.3.23",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "2142e880981ec69bcc4e2605e1f7fd950b0b058ea70d47e7f67b5147c0e6313b",
-          "size": 4921
+          "sha256": "70b4ad0b01e29102024141337f28bda4fb6cdf38292cd5001411908830a8a747",
+          "size": 4920
         }
       ],
-      "hash": "cd4386cd59f54ca31eac44cc6fa17eb9b74d0be925f06087d083d9d2370481bd"
+      "hash": "b12154ddcc48a9b0248548f935bcae940b9d514b5c233f7c5e5590ef449ac329"
     }
   ]
 }

package/dist/version.d.ts

@@ -1,4 +1,4 @@
 export declare const CLI_NAME = "alphafox";
 export declare const CLI_PACKAGE = "@alphafox/cli";
-export declare const CLI_VERSION = "0.3.21";
+export declare const CLI_VERSION = "0.3.23";
 export { CATALOG_VERSION as CLI_CONTRACT_VERSION } from "./catalog/operations";

package/dist/version.js

@@ -3,6 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CLI_CONTRACT_VERSION = exports.CLI_VERSION = exports.CLI_PACKAGE = exports.CLI_NAME = void 0;
 exports.CLI_NAME = "alphafox";
 exports.CLI_PACKAGE = "@alphafox/cli";
-exports.CLI_VERSION = "0.3.21";
+exports.CLI_VERSION = "0.3.23";
 var operations_1 = require("./catalog/operations");
 Object.defineProperty(exports, "CLI_CONTRACT_VERSION", { enumerable: true, get: function () { return operations_1.CATALOG_VERSION; } });

package/docs/agents/domain.md

@@ -1,51 +1,5 @@
-# Domain Docs
+# Domain references
 
-How the engineering skills should consume this repo's domain documentation when exploring the codebase.
+For a task that changes domain terminology, behavior across contexts, or architecture, locate the relevant entry in root `CONTEXT-MAP.md` (if present), otherwise `CONTEXT.md`, and read only the relevant glossary sections and ADRs. Ordinary documentation, formatting and isolated mechanical edits do not require a domain-document tour.
 
-## Before exploring, read these
-
-- **`CONTEXT.md`** at the repo root, or
-- **`CONTEXT-MAP.md`** at the repo root if it exists — it points at one `CONTEXT.md` per context. Read each one relevant to the topic.
-- **`docs/adr/`** — read ADRs that touch the area you're about to work in. In multi-context repos, also check `src/<context>/docs/adr/` for context-scoped decisions.
-
-If any of these files don't exist, **proceed silently**. Don't flag their absence; don't suggest creating them upfront. The `/domain-modeling` skill (reached via `/grill-with-docs` and `/improve-codebase-architecture`) creates them lazily when terms or decisions actually get resolved.
-
-## File structure
-
-Single-context repo (most repos):
-
-```
-/
-├── CONTEXT.md
-├── docs/adr/
-│   ├── 0001-event-sourced-orders.md
-│   └── 0002-postgres-for-write-model.md
-└── src/
-```
-
-Multi-context repo (presence of `CONTEXT-MAP.md` at the root):
-
-```
-/
-├── CONTEXT-MAP.md
-├── docs/adr/                          ← system-wide decisions
-└── src/
-    ├── ordering/
-    │   ├── CONTEXT.md
-    │   └── docs/adr/                  ← context-specific decisions
-    └── billing/
-        ├── CONTEXT.md
-        └── docs/adr/
-```
-
-## Use the glossary's vocabulary
-
-When your output names a domain concept (in an issue title, a refactor proposal, a hypothesis, a test name), use the term as defined in `CONTEXT.md`. Don't drift to synonyms the glossary explicitly avoids.
-
-If the concept you need isn't in the glossary yet, that's a signal — either you're inventing language the project doesn't use (reconsider) or there's a real gap (note it for `/domain-modeling`).
-
-## Flag ADR conflicts
-
-If your output contradicts an existing ADR, surface it explicitly rather than silently overriding:
-
-> _Contradicts ADR-0007 (event-sourced orders) — but worth reopening because…_
+Use established terms and surface an actual conflict with an existing ADR before changing the decision. Missing files are not a setup blocker. Add glossary entries or ADRs only when the task resolves a durable ambiguity or decision, not for every edit. Reuse unchanged material within the task.