@alphafox/cli 0.3.21 → 0.3.23

package/docs/agents/issue-tracker.md

@@ -1,45 +1,9 @@
-# Issue tracker: GitHub
+# Issue tracker: shared Feishu Tasks
 
-Issues and specs for this repo live as GitHub issues. Use the `gh` CLI for all operations.
+Matt engineering issues, specs and tickets for this repo live in **AlphaFox-Issues**, not GitHub Issues. Prefix titles with `[alphafox-cli]`. GitHub hosts code and PRs; a PR URL may be linked from the task.
 
-## Conventions
+On task operations, read the infra `docs/agents/issue-tracker.md` for canonical GUIDs, sections, Type options and dependency conventions. Resolve `alphafox-infra` in the workspace described in this repo's AGENTS.md (or its explicitly selected task worktree). Read the installed `lark-task` Skill for current commands; do not maintain a second CLI recipe here. If the shared file is unavailable, discover the named existing list using the Skill and verify its identity before writing; do not create a replacement list.
 
-- **Create an issue**: `gh issue create --title "..." --body "..."`. Use a heredoc for multi-line bodies.
-- **Read an issue**: `gh issue view <number> --comments`, filtering comments by `jq` and also fetching labels.
-- **List issues**: `gh issue list --state open --json number,title,body,labels,comments --jq '[.[] | {number, title, body, labels: [.labels[].name], comments: [.comments[].body]}]'` with appropriate `--label` and `--state` filters.
-- **Comment on an issue**: `gh issue comment <number> --body "..."`
-- **Apply / remove labels**: `gh issue edit <number> --add-label "..."` / `--remove-label "..."`
-- **Close**: `gh issue close <number> --comment "..."`
+A linked task's acceptance is the specification. Without a linked task, use the explicit user request and record it in the PR; task creation is not a prerequisite for local work. Routine delivery comments stay within existing task authorization; new scope or tasklists need their own decision.
 
-Infer the repo from `git remote -v`; `gh` does this automatically when run inside a clone.
-
-## Pull requests as a triage surface
-
-**PRs as a request surface: no.** _(Set to `yes` if this repo treats external PRs as feature requests; `/triage` reads this flag.)_
-
-When set to `yes`, PRs run through the same labels and states as issues, using the `gh pr` equivalents:
-
-- **Read a PR**: `gh pr view <number> --comments` and `gh pr diff <number>` for the diff.
-- **List external PRs for triage**: `gh pr list --state open --json number,title,body,labels,author,authorAssociation,comments` then keep only `authorAssociation` of `CONTRIBUTOR`, `FIRST_TIME_CONTRIBUTOR`, or `NONE` (drop `OWNER`/`MEMBER`/`COLLABORATOR`).
-- **Comment / label / close**: `gh pr comment`, `gh pr edit --add-label`/`--remove-label`, `gh pr close`.
-
-GitHub shares one number space across issues and PRs, so a bare `#42` may be either: resolve with `gh pr view 42` and fall back to `gh issue view 42`.
-
-## When a skill says "publish to the issue tracker"
-
-Create a GitHub issue.
-
-## When a skill says "fetch the relevant ticket"
-
-Run `gh issue view <number> --comments`.
-
-## Wayfinding operations
-
-Used by `/wayfinder`. The **map** is a single issue with **child** issues as tickets.
-
-- **Map**: a single issue labelled `wayfinder:map`, holding the Notes / Decisions-so-far / Fog body. `gh issue create --label wayfinder:map`.
-- **Child ticket**: an issue linked to the map as a GitHub sub-issue (`gh api` on the sub-issues endpoint). Where sub-issues aren't enabled, add the child to a task list in the map body and put `Part of #<map>` at the top of the child body. Labels: `wayfinder:<type>` (`research`/`prototype`/`grilling`/`task`). Once claimed, the ticket is assigned to the driving dev.
-- **Blocking**: GitHub's **native issue dependencies**, the canonical, UI-visible representation. Add an edge with `gh api --method POST repos/<owner>/<repo>/issues/<child>/dependencies/blocked_by -F issue_id=<blocker-db-id>`, where `<blocker-db-id>` is the blocker's numeric **database id** (`gh api repos/<owner>/<repo>/issues/<n> --jq .id`, _not_ the `#number` or `node_id`). GitHub reports `issue_dependencies_summary.blocked_by` (open blockers only, the live gate). Where dependencies aren't available, fall back to a `Blocked by: #<n>, #<n>` line at the top of the child body. A ticket is unblocked when every blocker is closed.
-- **Frontier query**: list the map's open children (`gh issue list --state open`, scoped to the map's sub-issues / task list), drop any with an open blocker (`issue_dependencies_summary.blocked_by > 0`, or an open issue in the `Blocked by` line) or an assignee; first in map order wins.
-- **Claim**: `gh issue edit <n> --add-assignee @me`, the session's first write.
-- **Resolve**: `gh issue comment <n> --body "<answer>"`, then `gh issue close <n>`, then append a context pointer (gist + link) to the map's Decisions-so-far.
+**PRs as a request surface: no.** For a specifically requested PR triage, inspect it on GitHub and keep engineering task state in Feishu.

package/docs/agents/triage-labels.md

@@ -1,15 +1,3 @@
-# Triage Labels
+# Triage mapping
 
-The skills speak in terms of five canonical triage roles. This file maps those roles to the actual label strings used in this repo's issue tracker.
-
-| Label in mattpocock/skills | Label in our tracker | Meaning                                  |
-| -------------------------- | -------------------- | ---------------------------------------- |
-| `needs-triage`             | `needs-triage`       | Maintainer needs to evaluate this issue  |
-| `needs-info`               | `needs-info`         | Waiting on reporter for more information |
-| `ready-for-agent`          | `ready-for-agent`    | Fully specified, ready for an AFK agent  |
-| `ready-for-human`          | `ready-for-human`    | Requires human implementation            |
-| `wontfix`                  | `wontfix`            | Will not be actioned                     |
-
-When a skill mentions a role (e.g. "apply the AFK-ready triage label"), use the corresponding label string from this table.
-
-Edit the right-hand column to match whatever vocabulary you actually use.
+Read only when classifying a Matt engineering task. Canonical triage roles map to Feishu **sections**, not GitHub labels; categories map to the separate single-select **Type** field. The infra `docs/agents/issue-tracker.md` owns the mapping and GUIDs; resolve it through this repo's AGENTS.md. A section is not a completion status: complete/incomplete follows task acceptance. Do not rename sections or create Type options just to match a Skill's spelling.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alphafox/cli",
-  "version": "0.3.21",
+  "version": "0.3.23",
   "description": "AlphaFox CLI — Agent/Human entry for the public Application API.",
   "type": "commonjs",
   "bin": {

package/skills/account/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-account
 description: Account, wallet, and subscription read paths.
-version: 0.3.21
+version: 0.3.23
 ---
 
 # Account / wallet

package/skills/admin/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-admin
 description: Admin-only operations reusing Web role authorization.
-version: 0.3.21
+version: 0.3.23
 ---
 
 # Admin

package/skills/alphafox/SKILL.md

@@ -1,14 +1,14 @@
 ---
 name: alphafox
-description: AlphaFox CLI entry router. Use for any AlphaFox request — install, update, login, whoami, 回测, engine backtest, 清理回测缓存 / 历史数据, strategy definitions, create/list/start/stop a running strategy (trader), ticker/标的 resolve (美股 or crypto), market data, exchange connectors, wallet, subscriptions, notifications, or admin. After 回测 or 运行策略, include the dashboard URL from the domain skill. When the user asks 排行榜, include https://www.alphafox.app/zh/dashboard/leaderboard. After a successful install and login, present the 新人引导 in this file (Lite square 带单员 + classic strategies). If a CLI command prints `[alphafox] update available`, ask the user「检测到新的版本，是否需要我帮你升级？」and only then run `alphafox update --format json --no-input`. After a large backtest, if tape cache is large, ask「回测下载的历史数据比较大，要不要我帮你清理本地缓存？」then open `alphafox-cache`. Start here, then open the routed domain skill. Do not guess alphafox-engine-backtest vs alphafox-strategy vs alphafox-trading from memory.
-version: 0.3.21
+description: "Route AlphaFox product CLI requests: installation/auth, market data, strategy configuration, backtests, traders, connectors, accounts and notifications. Repository development or AGENTS/Skills maintenance uses repository instructions, not product CLI operations."
+version: 0.3.23
 ---
 
 # AlphaFox
 
 This skill only routes. After choosing a row, **read that skill's `SKILL.md` and follow it**. Do not improvise domain procedures from this file.
 
-Also read `alphafox-shared` before any CLI invocation (envelope, auth, risk, schema-first writes). Always `--format json --no-input`. Never `--token`.
+Read `alphafox-shared` before the first CLI invocation in this task; reuse it while unchanged (envelope, auth, risk, schema-first writes). Always `--format json --no-input`. Never `--token`.
 
 Human-mentioned tickers go through `alphafox-market` (`alphafox resolve-symbols`) **before** they enter config, backtest, or writes. Keep the operator's asset class (美股 → `equity_perp` on `binance_perp_usdt`).
 
@@ -31,7 +31,7 @@ A **trader** is a running strategy instance (paper or live), not a person. Creat
 | Notification channels | `alphafox-notification` |
 | Admin-only operations | `alphafox-admin` |
 
-If several rows apply, load **all** of them (typical: `alphafox-shared` + `alphafox-market` + one domain skill).
+Load only rows needed for the requested operation, reusing Skills already read in this task (typical: shared + market when resolving a ticker + the operation Skill).
 
 - “帮我配/建一个网格/DCA/跟单策略” → `alphafox-strategy` (pick definition, ask knobs, validate `{common, strategy}`) **and** `alphafox-market` (resolve tickers) **and** `alphafox-trading` (create the trader, default `autoStart: true`). Hidden copy variants still create through `alphafox-trading`. After create, include the trader URL from `alphafox-shared`.
 - “帮我回测这个配置” → `alphafox-strategy` (definition + config) **and** `alphafox-engine-backtest`. After a persisted run, include the backtest URL from `alphafox-shared`.
@@ -39,25 +39,7 @@ If several rows apply, load **all** of them (typical: `alphafox-shared` + `alpha
 
 ## Upgrade reminder
 
-The CLI may print this on **stderr** at most once every 24 hours:
-
-```text
-[alphafox] update available: 0.3.15 -> 0.3.16. After the user confirms, run: alphafox update --format json --no-input,
-```
-
-If you see that notice (or `updateAvailable: true` from `alphafox update --check`):
-
-1. Ask the user: **检测到新的版本，是否需要我帮你升级？**
-2. Wait for an explicit yes. Do not upgrade on your own.
-3. After they confirm:
-
-```bash
-alphafox update --format json --no-input
-```
-
-4. Tell the user to **restart the AI tool** so the new Skills load.
-
-Do not install Skills from GitHub. Details and dry-run / check commands live in `alphafox-shared`.
+An update notice does not interrupt the current task. Finish its deliverable first, then offer an upgrade if relevant. Use `alphafox-shared` for the co-versioned update procedure; an explicit update request already supplies intent. Do not independently install Skills from GitHub.
 
 ## After install
 
@@ -121,8 +103,4 @@ Ambiguous “帮我回测” → `alphafox-engine-backtest`, after resolving sym
 
 `engine-backtest run|sweep` downloads closed OHLCV into the local tape cache. After a long-range or 1m backtest (or whenever the operator mentions disk / 缓存), read `alphafox-cache` and run `alphafox cache status --format json --no-input`.
 
-If `data.tape.large` is true (tape ≥ `data.remindAfterBytes`):
-
-1. Ask the user: **回测下载的历史数据比较大，要不要我帮你清理本地缓存？**
-2. Wait for an explicit yes. Do not clean on your own.
-3. Follow `alphafox-cache` (`alphafox cache clean --dry-run`, then `--yes`).
+If `data.tape.large` is true, finish the backtest report first, then follow `alphafox-cache` for the optional cleanup offer. Reuse an explicit cleanup request; do not ask twice or clean an unrequested cache class.

package/skills/alphafox-shared/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-shared
 description: Shared AlphaFox CLI rules for Agents — auth, profiles, envelopes, risk gates, public operationIds, and dashboard links after 回测 / 运行策略 / 排行榜.
-version: 0.3.21
+version: 0.3.23
 ---
 
 # AlphaFox shared Agent contract
@@ -39,7 +39,7 @@ The CLI checks npm at most once every 24 hours and only prints a notice on
 
 **检测到新的版本，是否需要我帮你升级？**
 
-Wait for an explicit yes. Then keep CLI and Skills co-versioned:
+Finish the current task before offering an unrelated upgrade. An explicit upgrade request or approval in this task is sufficient; otherwise wait for it. Then keep CLI and Skills co-versioned:
 
 ```bash
 alphafox update --check --format json --no-input
@@ -82,7 +82,7 @@ Access tokens last ~10 minutes; the CLI refreshes them. After idle, run **one**
 
 Local browser: `alphafox auth login --browser --format json --no-input` (loopback 127.0.0.1). If the browser cannot open, copy `authorizeUrl` from the error; do not invent a Device Flow retry unless the operator is headless.
 
-Wrong environment / missing permission / missing `--yes`: stop. Do not retry with a different profile.
+Wrong environment or missing permission blocks that operation; keep the requested profile and report the needed correction. Missing `--yes` is a confirmation gate: show the exact action and reuse an existing explicit approval only if it covers these parameters, otherwise ask once. Continue independent reads/local work where useful; do not switch profiles to evade a gate.
 
 ## Commands
 
@@ -99,13 +99,13 @@ Forbidden: `/backend`, `/control-plane`, `/signal-center`, internal secrets, non
 
 ## Writes — schema first, never invent fields
 
-Before every write (`POST` / `PUT` / `PATCH` / `DELETE` with a body):
+Before composing a write body (`POST` / `PUT` / `PATCH` / `DELETE`), obtain its operation schema. In this task, reuse a schema for the same CLI/contract/catalog version, profile and operationId. Refresh on version/profile changes or schema-validation errors. “Read schema first” in domain Skills uses this same rule:
 
-1. Run `alphafox schema <operationId> --format json --no-input`.
+1. On first use or invalidation, run `alphafox schema <operationId> --format json --no-input`.
 2. Build the body **only** from `request.body` (property names, types, enums, required). Do not guess fields from memory, from another operationId, or from training data.
 3. Small object: typed command + `--body '<json>'`.
 4. Nested / large object: write a JSON file, then `--config @./payload.json`. Do not paste 20+ fields onto argv.
-5. `--dry-run` first when the risk is `write` or `high-risk-write`.
+5. Preview high-risk writes and new/changed mutation payloads with `--dry-run`. A previously verified low-risk payload shape does not require repeating discovery and dry-run on every batch item; per-request CLI validation still applies. Verify that the command actually supports dry-run.
 
 CLI validates `--body` / `--config` against the catalog **before** HTTP. `body_schema` / `body_schema_missing` (exit `64`) means the payload is wrong — re-read `schema`, do not add extra keys to “make it work”. `--body` and `--config` cannot be combined. `--body @file` is also a file (same as `--config @file`).
 

package/skills/auth/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-auth
 description: Login, status, logout, whoami, and environment isolation for AlphaFox CLI.
-version: 0.3.21
+version: 0.3.23
 ---
 
 # Auth Skill

package/skills/cache/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-cache
 description: Inspect and clean local Engine backtest caches (downloaded OHLCV tape and wasm runtime). Use when the user asks to 清理缓存, free disk, or after a large historical backtest.
-version: 0.3.21
+version: 0.3.23
 ---
 
 # Cache
@@ -18,11 +18,11 @@ alphafox cache status --format json --no-input
 
 Read `data.tape.bytes`, `data.tape.files`, `data.tape.large`, `data.remindAfterBytes`. `large` is true when tape bytes ≥ `remindAfterBytes` (512 MiB).
 
-If `data.tape.large` is true, ask the user:
+When cleanup was not requested and `data.tape.large` is true, first deliver the backtest result, then offer:
 
 **回测下载的历史数据比较大，要不要我帮你清理本地缓存？**
 
-Wait for an explicit yes. Do not clean on your own.
+An explicit request to clean this cache or approval of this offer authorizes the displayed scope; do not ask twice. A size notice alone does not authorize deletion. Extra runtime/all-cache deletion needs its own scope.
 
 ## Clean
 

package/skills/engine-backtest/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-engine-backtest
 description: Local Engine WASM backtest (alphafox engine-backtest run|sweep) vs catalog experiment CRUD. After a persisted run, include https://www.alphafox.app/zh/dashboard/traders/backtest/{experimentId}.
-version: 0.3.21
+version: 0.3.23
 ---
 
 # Engine Backtest
@@ -33,7 +33,7 @@ alphafox schema engine_backtest.experiments.byId.sweeps.create --format json --n
 
 The tape runner ships inside the CLI (plus `ccxt` for public-market pulls). The wasm / Node host is downloaded from the public Vercel Blob manifest (`engine-backtest/latest.json`) into `~/.cache/alphafox/engine-backtest/<hash>/` on first run.
 
-Before planning or running, follow the complete parameter review in `alphafox-strategy`, including when the operator already supplied `--config` or pasted a full command. Do not run the backtest until every applicable parameter, default status, short explanation, proposed value, and value source has been shown and the operator explicitly confirms the final proposal. User overrides win; unresolved required values stop the flow.
+For a requested backtest with supplied config, preserve and validate it against the definition; do not require the live-trader execution review. Use `alphafox-strategy` to resolve unknown fields or a requested guided configuration. Ask for unresolved required values or materially ambiguous choices. Respect the requested range, data-quality mode and persistence scope; a local-only request uses `--no-persist`. Live trader creation remains a separate requested and approved action.
 
 Local overrides, in order:
 
@@ -98,7 +98,7 @@ Owner isolation and 7-day expiry are enforced by the server. Applying a coordina
 2. `engine-backtest run` (reuse `--experiment` after the first create).
 3. Read `data.metrics` / `data.engineVersion` / `data.runId` / `data.experimentId` / `data.experimentUrl`. After the run, also read `data.coverageNotice` (`warning` = mid-range candle gaps; `notice` = start / other soft gaps). When an Experiment id exists, include the backtest dashboard URL from `alphafox-shared` (`https://www.alphafox.app/zh/dashboard/traders/backtest/{experimentId}`) in the reply — do not stop at metrics or the raw CLI `experimentUrl`.
 4. Adjust parameters and run again. Do not invent a token flag if persist returns 401 — `alphafox auth login`.
-5. After a long-range or 1m run, follow `alphafox-cache`: `alphafox cache status`. If `data.tape.large` is true, ask **回测下载的历史数据比较大，要不要我帮你清理本地缓存？** and wait for yes.
+5. After a long-range or 1m run, follow `alphafox-cache`: `alphafox cache status`. If `data.tape.large` is true, finish the result first, then follow `alphafox-cache` for the optional cleanup offer; reuse any explicit cleanup approval.
 
 ## Safety
 

package/skills/exchange/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-exchange
 description: Exchange connectors list and connection management via Public API.
-version: 0.3.21
+version: 0.3.23
 ---
 
 # Exchange connectors

package/skills/market/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-market
 description: Market data and ticker resolution for US equity perps, RWAs, and crypto on the same perp catalog. Use when the user names 美股, NVDA, AAPL, BTC, or any 标的. Keep the operator's asset class via symbolMetadata — do not rewrite NVDA into a crypto coin.
-version: 0.3.21
+version: 0.3.23
 ---
 
 # Market
@@ -28,7 +28,7 @@ Binance US stocks are **equity perps in the same** `binance_perp_usdt` catalog (
 
 ## Resolve tickers
 
-Whenever a human mentions a stock, coin, ticker, or contract — including typos — resolve it **before** putting a symbol into strategy config, backtest, trader settings, or any write.
+Resolve a human-mentioned ticker before using it in config, backtest or a write. Reuse an exact/confirmed result for the same exchange, asset class and catalog within this task; resolve again when any of those inputs changes or the result is rejected. Mere discussion of a ticker does not require a market API call.
 
 ```bash
 alphafox resolve-symbols BTC ETH --exchange binance --format json --no-input

package/skills/notification/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-notification
 description: Notification channels and subscriptions.
-version: 0.3.21
+version: 0.3.23
 ---
 
 # Notification

package/skills/strategy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-strategy
 description: Strategy definitions — list types, read a definition's contract, and validate config. Creating a running strategy is creating a trader; use alphafox-trading for that. Local Engine backtest is alphafox-engine-backtest.
-version: 0.3.21
+version: 0.3.23
 ---
 
 # Strategy definitions
@@ -38,7 +38,9 @@ Explain the type from those fields. Missing a layer → say unknown; do not fill
 
 ## Configure with the human
 
-The human confirms the complete parameter set. You write JSON only after that review.
+Use the complete review below when preparing an actual trader creation/start, or when the user asks for a guided parameter design. It protects execution decisions and is not a gate for inspecting a definition, validating a supplied config, or a requested local backtest. For those tasks, preserve supplied values, validate applicable fields, and ask only for unresolved required inputs or a material ambiguity. Report completion of the requested operation; do not implicitly create/start a trader.
+
+For the execution proposal, the human confirms the complete parameter set. Reuse that confirmation while the proposal and environment are unchanged. You may prepare and validate JSON to discover errors before the final execution approval.
 
 1. Confirm the definition from `byId.get` in the operator's language (what it is, what drives it, how positions change).
 2. Use the effective `configSchema` returned by `byId.get` as the sole parameter contract. It already composes the definition's `commonModules` with `strategyConfigSchema` and may contain definition-specific customization. Walk every applicable parameter, not only required fields or familiar knobs.
@@ -61,7 +63,7 @@ The human confirms the complete parameter set. You write JSON only after that re
    A user override always wins, even when it equals neither default. Preserve explicit `false`, `0`, empty arrays, and empty strings when the schema allows them; they are not missing values.
 
 6. When there are many parameters, present them in logical groups or numbered chunks so the review remains readable. After all groups are visible, ask the operator to reply **confirm all** / “全部确认”, or override paths/numbers. One overall confirmation is sufficient, but it must cover every displayed parameter. Apply overrides, show the affected rows again, and repeat until no required value is unresolved and the operator explicitly confirms the final proposal.
-7. An earlier request such as “创建策略”, “运行回测”, or a pasted command/config is input to the proposal, not confirmation of the review. Do not validate, create, or backtest until the complete parameter review is explicitly confirmed.
+7. A generic creation request is not approval of undisclosed execution settings. Obtain final approval before creating/starting a trader. Inspection, config validation and requested local backtests may proceed without this execution review; changing the approved execution parameters or environment requires renewed approval.
 8. Write `strategy-config.json` as the trader object:
 
 ```json
@@ -94,7 +96,7 @@ alphafox trading strategy_definitions byId validate_config --definitionId <id> -
 
 `body_schema` / `body_schema_missing` (exit `64`): re-read the operation schema. Server field-path errors: fix that path. Do not retry with a different envelope.
 
-After it validates: create with `alphafox-trading` (default `autoStart: true`), or backtest with `alphafox-engine-backtest`. Do not create or backtest from this skill. Dashboard URLs after those actions live in `alphafox-shared`.
+Validation-only work is complete with the result and any field errors. Continue to `alphafox-trading` or `alphafox-engine-backtest` only if the user requested that action; validation alone does not authorize creation/start or persisted work. Preserve the trading Skill’s execution approval. Dashboard URLs after requested actions live in `alphafox-shared`.
 
 ## operationIds
 

package/skills/trading/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-trading
 description: Running strategies (traders) — create, list, start, and stop. A trader is a live or paper strategy instance (grid, dca, copy, …), not a person. Default Engine create uses autoStart true (创建即开始). Use autoStart false only when the user asks to create without starting. After create or start, include https://www.alphafox.app/zh/dashboard/traders/{traderId}.
-version: 0.3.21
+version: 0.3.23
 ---
 
 # Running strategies (traders)
@@ -32,7 +32,7 @@ alphafox api GET /api/v1/trading/traders --format json --no-input
 
 Read `alphafox schema <operationId>` first. Body may only include documented `request.body` fields. Large / nested bodies use `--config @file`.
 
-Before composing or dry-running any create request, follow the complete parameter review in `alphafox-strategy`, including when the operator already supplied a config. Do not create a trader until every applicable parameter, default status, short explanation, proposed value, and value source has been shown and the operator explicitly confirms the final proposal. User overrides win; unresolved required values stop the flow.
+Before executing create, follow the complete execution-parameter review in `alphafox-strategy`, including supplied configs. JSON preparation, validation and dry-run may precede approval. Reuse the confirmed proposal while parameters and environment are unchanged; obtain approval for any changed execution settings. User overrides win; resolve required values before create. Do not create merely because validation succeeded.
 
 ```bash
 alphafox schema trading.traders.create --format json --no-input

package/vendor/backtest-runner/README.md

@@ -80,6 +80,8 @@ const scenario = assembleScenario({
 
 与 web `tape-loader.series.ts` 对齐：Binance 1500、OKX 100、Bybit / Bitget 1000、Hyperliquid 5000。Bitget 另受约 89 天请求跨度限制；Hyperliquid 分页带 `until` 窗口。
 
+长区间会拆成最多 8 个可独立下载的时间窗口；不同 `symbol × timeframe` 与同一序列的时间窗口共用一个全局 8 请求池，避免嵌套并发放大。相邻窗口保留一根重叠 K 线，合并时按时间去重；同时间戳内容不一致会抛出 `invalid_ohlcv`，不会静默选取其中一份。
+
 ## 数据质量
 
 - `basic`（默认）：硬失败（缺市场、空序列、非法 K 线、拉数失败）仍抛错；软缺口进入 `coverageIssues` 与 `coverageWarnings`。起始缺口（`prefix_gap`）较轻，中间缺口（`internal_gap`）较重。

package/vendor/backtest-runner/index.d.ts

@@ -316,7 +316,7 @@ export interface TapeProxyOptions {
 export interface TapeLoadOptions extends TapeProxyOptions {
   readonly cache?: FileTapeCache | false | "disable";
   readonly cacheDir?: string;
-  /** Independent series fetches; default 4, hard cap 8. Pagination stays serial. */
+  /** Shared series and time-window request budget; default and hard cap are 8. */
   readonly seriesConcurrency?: number;
   readonly nowMs?: number;
   readonly onProgress?: (progress: TapeLoadProgress) => void;
@@ -353,7 +353,7 @@ export interface TapeLoadResult {
   };
 }
 
-export const DEFAULT_TAPE_SERIES_CONCURRENCY: 4;
+export const DEFAULT_TAPE_SERIES_CONCURRENCY: 8;
 export const MAX_TAPE_SERIES_CONCURRENCY: 8;
 
 export function resolveTapeSeriesConcurrency(value?: number): number;
@@ -364,6 +364,12 @@ export function mapWithConcurrency<T, R>(
   worker: (item: T, index: number) => Promise<R>
 ): Promise<R[]>;
 
+export function limitTapeOhlcvConcurrency(
+  exchange: Pick<TapeRuntimeExchange, "fetchOHLCV">,
+  concurrency: number,
+  signal?: AbortSignal
+): Pick<TapeRuntimeExchange, "fetchOHLCV">;
+
 export function loadTape(
   request: TapeLoadRequest,
   options?: TapeLoadOptions

package/vendor/backtest-runner/index.mjs

@@ -55,10 +55,13 @@ export {
 export {
   DEFAULT_TAPE_SERIES_CONCURRENCY,
   MAX_TAPE_SERIES_CONCURRENCY,
-  loadTape,
+  limitTapeOhlcvConcurrency,
   mapWithConcurrency,
-  resolveTapeCache,
   resolveTapeSeriesConcurrency,
+} from "./lib/tape-loader-concurrency.mjs";
+export {
+  loadTape,
+  resolveTapeCache,
   effectiveTapeEndMs,
   inferFundingIntervals,
   classifyTapeSymbolsForPreflight,

package/vendor/backtest-runner/lib/series.mjs

@@ -12,19 +12,14 @@ import {
   ENGINE_BACKTEST_WARMUP_CANDLES,
   TIMEFRAME_MS,
 } from "./timeframes.mjs";
+import {
+  fetchClosedOhlcvRange,
+  isClosedCandle,
+} from "./tape-loader-range.mjs";
 
 const WARMUP_CANDLES = ENGINE_BACKTEST_WARMUP_CANDLES;
-const BITGET_OHLCV_MAX_REQUEST_SPAN_MS = 89 * 86_400_000;
-
-export { TIMEFRAME_MS };
 
-export function isClosedCandle(timestampMs, timeframe, toMs) {
-  const stepMs = TIMEFRAME_MS[timeframe];
-  if (!stepMs) {
-    throw new Error(`不支持的 timeframe：${timeframe}`);
-  }
-  return timestampMs + stepMs <= toMs;
-}
+export { fetchClosedOhlcvRange, isClosedCandle, TIMEFRAME_MS };
 
 export function ohlcvSeriesStartMs(fromMs, timeframe, market) {
   const stepMs = TIMEFRAME_MS[timeframe];
@@ -207,164 +202,3 @@ function concatMonotonicRows(head, tail) {
   const lastHeadTimestamp = head[head.length - 1][0];
   return [...head, ...tail.filter((row) => row[0] > lastHeadTimestamp)];
 }
-
-export async function fetchClosedOhlcvRange(request) {
-  const stepMs = TIMEFRAME_MS[request.timeframe];
-  if (!stepMs) {
-    throw new Error(`不支持的 timeframe：${request.timeframe}`);
-  }
-  const pageLimit = ohlcvPageLimitForTimeframe(
-    request.exchangeDefinition,
-    request.runtimeConfig,
-    request.timeframe
-  );
-  const rows = [];
-  const totalSpan = Math.max(1, request.toMs - request.sinceMs);
-  let cursor = request.sinceMs;
-  let emptyPrefixLowerMs = null;
-  let nonEmptyPrefixUpperMs = null;
-  let prefixResolved = false;
-
-  while (cursor < request.toMs) {
-    request.signal?.throwIfAborted();
-    const fetchSinceMs =
-      request.exchangeDefinition.ccxtId === "bitget"
-        ? Math.max(0, cursor - 1)
-        : cursor;
-    const requestParams = {
-      ...request.runtimeConfig.requestParams,
-    };
-    if (request.exchangeDefinition.ccxtId === "hyperliquid") {
-      requestParams.until = Math.min(
-        request.toMs,
-        fetchSinceMs + (pageLimit - 1) * stepMs
-      );
-    }
-    const page = await abortable(
-      request.exchange.fetchOHLCV(
-        request.symbol,
-        request.timeframe,
-        fetchSinceMs,
-        pageLimit,
-        requestParams
-      ),
-      request.signal
-    );
-    request.signal?.throwIfAborted();
-
-    if (!prefixResolved && rows.length === 0 && emptyPrefixLowerMs !== null) {
-      if (page.length === 0) {
-        emptyPrefixLowerMs = cursor;
-        if (cursor >= request.fromMs) break;
-      } else {
-        nonEmptyPrefixUpperMs = cursor;
-      }
-      const upperMs = nonEmptyPrefixUpperMs ?? request.fromMs;
-      if (
-        nonEmptyPrefixUpperMs !== null &&
-        upperMs - emptyPrefixLowerMs <= stepMs
-      ) {
-        cursor = upperMs;
-        prefixResolved = true;
-        continue;
-      }
-      cursor = midpointCursorMs(emptyPrefixLowerMs, upperMs, stepMs);
-      continue;
-    }
-
-    if (page.length === 0) {
-      if (!prefixResolved && rows.length === 0 && cursor < request.fromMs) {
-        emptyPrefixLowerMs = cursor;
-        cursor = midpointCursorMs(cursor, request.fromMs, stepMs);
-        continue;
-      }
-      break;
-    }
-    prefixResolved = true;
-
-    for (const raw of page) {
-      if (raw.length < 6) {
-        throw new TapeDataUnavailableError([
-          {
-            code: "invalid_ohlcv",
-            symbol: request.symbol,
-            timeframe: request.timeframe,
-          },
-        ]);
-      }
-      const timestamp = Number(raw[0]);
-      if (!Number.isFinite(timestamp)) {
-        throw new TapeDataUnavailableError([
-          {
-            code: "invalid_ohlcv",
-            symbol: request.symbol,
-            timeframe: request.timeframe,
-          },
-        ]);
-      }
-      if (!isClosedCandle(timestamp, request.timeframe, request.toMs)) {
-        continue;
-      }
-      if (rows.length > 0 && timestamp <= rows[rows.length - 1][0]) {
-        throw new TapeDataUnavailableError([
-          {
-            code: "non_monotonic",
-            symbol: request.symbol,
-            timeframe: request.timeframe,
-            expected: rows[rows.length - 1][0] + stepMs,
-            actual: timestamp,
-            timestamp,
-          },
-        ]);
-      }
-      rows.push([
-        timestamp,
-        Number(raw[1]),
-        Number(raw[2]),
-        Number(raw[3]),
-        Number(raw[4]),
-        Number(raw[5]),
-      ]);
-    }
-    const lastTimestamp = Number(page[page.length - 1][0]);
-    const nextCursor = lastTimestamp + stepMs;
-    if (nextCursor <= cursor) {
-      break;
-    }
-    cursor = nextCursor;
-    request.onFraction?.(Math.min(1, (cursor - request.sinceMs) / totalSpan));
-  }
-  if (rows.length === 0 && !request.allowEmpty) {
-    throw new TapeDataUnavailableError([
-      {
-        code: "ohlcv_missing",
-        symbol: request.symbol,
-        timeframe: request.timeframe,
-      },
-    ]);
-  }
-  return rows;
-}
-
-function ohlcvPageLimitForTimeframe(exchange, runtimeConfig, timeframe) {
-  if (exchange.ccxtId !== "bitget") {
-    return runtimeConfig.ohlcvPageLimit;
-  }
-  const stepMs = TIMEFRAME_MS[timeframe];
-  return Math.max(
-    1,
-    Math.min(
-      runtimeConfig.ohlcvPageLimit,
-      Math.floor(BITGET_OHLCV_MAX_REQUEST_SPAN_MS / stepMs)
-    )
-  );
-}
-
-function midpointCursorMs(lowerMs, upperMs, stepMs) {
-  if (upperMs - lowerMs <= stepMs) {
-    return upperMs;
-  }
-  const midpointMs = lowerMs + Math.floor((upperMs - lowerMs) / 2);
-  const alignedMs = Math.floor(midpointMs / stepMs) * stepMs;
-  return Math.min(upperMs, Math.max(lowerMs + 1, alignedMs));
-}