@alphafox/cli 0.3.22 → 0.3.24

package/dist/auth/refresh.js

@@ -257,10 +257,9 @@ async function fetchFollowingSameSiteRedirects(fetchImpl, startUrl, init, maxHop
         const nextUrl = new URL(location, url).toString();
         if (!sameAuthSite(originOf(url), originOf(nextUrl)))
             break;
-        if (response.status === 303 ||
-            ((response.status === 301 || response.status === 302) &&
-                method !== "GET" &&
-                method !== "HEAD")) {
+        // 303 is the only redirect that switches to GET. Apex→www is Cloudflare 301;
+        // converting POST to GET drops the OAuth body and the AS returns 405.
+        if (response.status === 303) {
             method = "GET";
             body = undefined;
         }

package/dist/engine-backtest/fetch-runtime.d.ts

@@ -1,5 +1,5 @@
 export declare const BACKTEST_RUNTIME_PROTOCOL = 1;
-export declare const DEFAULT_BACKTEST_WASM_MANIFEST_URL = "https://zwggllrrna54e2d6.public.blob.vercel-storage.com/engine-backtest/latest.json";
+export declare const DEFAULT_BACKTEST_WASM_MANIFEST_URL = "https://api.alphafox.app/control-plane/v1/backtest/runtime-manifest";
 export declare const BLOB_RUNTIME_FILES: {
     readonly wasm: "tradingfox-backtest.wasm";
     readonly wasmExec: "wasm_exec.js";
@@ -8,6 +8,8 @@ export declare const BLOB_RUNTIME_FILES: {
     readonly node: "node.mjs";
     readonly nodeWorker: "worker-node.mjs";
     readonly nodeWorkerPath: "worker-node-path.mjs";
+    readonly passivbotKernel: "passivbot_kernel.wasm";
+    readonly passivbotKernelModule: "passivbot-kernel.mjs";
 };
 export type BlobRuntimeFileKey = keyof typeof BLOB_RUNTIME_FILES;
 export interface EngineBacktestBlobManifest {
@@ -23,6 +25,8 @@ export interface EngineBacktestBlobManifest {
     readonly node: string;
     readonly nodeWorker: string;
     readonly nodeWorkerPath: string;
+    readonly passivbotKernel: string;
+    readonly passivbotKernelModule: string;
 }
 export interface FetchRuntimeHooks {
     readonly fetch?: typeof fetch;

package/dist/engine-backtest/fetch-runtime.js

@@ -5,15 +5,16 @@ exports.resolveBacktestWasmManifestUrl = resolveBacktestWasmManifestUrl;
 exports.resolveRuntimeCacheDir = resolveRuntimeCacheDir;
 exports.parseEngineBacktestBlobManifest = parseEngineBacktestBlobManifest;
 exports.ensureBlobRuntime = ensureBlobRuntime;
+const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const promises_1 = require("node:fs/promises");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
-const promises_2 = require("node:stream/promises");
 const node_stream_1 = require("node:stream");
+const promises_2 = require("node:stream/promises");
 const errors_1 = require("./errors");
 exports.BACKTEST_RUNTIME_PROTOCOL = 1;
-exports.DEFAULT_BACKTEST_WASM_MANIFEST_URL = "https://zwggllrrna54e2d6.public.blob.vercel-storage.com/engine-backtest/latest.json";
+exports.DEFAULT_BACKTEST_WASM_MANIFEST_URL = "https://api.alphafox.app/control-plane/v1/backtest/runtime-manifest";
 exports.BLOB_RUNTIME_FILES = {
     wasm: "tradingfox-backtest.wasm",
     wasmExec: "wasm_exec.js",
@@ -22,10 +23,31 @@ exports.BLOB_RUNTIME_FILES = {
     node: "node.mjs",
     nodeWorker: "worker-node.mjs",
     nodeWorkerPath: "worker-node-path.mjs",
+    passivbotKernel: "passivbot_kernel.wasm",
+    passivbotKernelModule: "passivbot-kernel.mjs",
 };
+const HASHED_BLOB_RUNTIME_FILES = [
+    exports.BLOB_RUNTIME_FILES.wasm,
+    exports.BLOB_RUNTIME_FILES.passivbotKernel,
+    exports.BLOB_RUNTIME_FILES.wasmExec,
+    exports.BLOB_RUNTIME_FILES.worker,
+    exports.BLOB_RUNTIME_FILES.passivbotKernelModule,
+    exports.BLOB_RUNTIME_FILES.client,
+    exports.BLOB_RUNTIME_FILES.node,
+    exports.BLOB_RUNTIME_FILES.nodeWorker,
+    exports.BLOB_RUNTIME_FILES.nodeWorkerPath,
+];
 function resolveBacktestWasmManifestUrl(env = process.env) {
-    return (env.ALPHAFOX_BACKTEST_WASM_MANIFEST_URL?.trim() ||
-        exports.DEFAULT_BACKTEST_WASM_MANIFEST_URL);
+    const override = env.ALPHAFOX_BACKTEST_WASM_MANIFEST_URL?.trim();
+    if (override)
+        return override;
+    if (env.ALPHAFOX_PROFILE === "staging") {
+        return "https://staging-api.alphafox.app/control-plane/v1/backtest/runtime-manifest";
+    }
+    if (env.ALPHAFOX_PROFILE === "local") {
+        throw new errors_1.EngineBacktestError({ type: "runtime", subtype: "runtime_manifest_unconfigured", message: "Local profile requires ALPHAFOX_BACKTEST_WASM_MANIFEST_URL or an explicit local Engine build." });
+    }
+    return exports.DEFAULT_BACKTEST_WASM_MANIFEST_URL;
 }
 function resolveRuntimeCacheDir(hash, env = process.env) {
     const override = env.ALPHAFOX_BACKTEST_RUNTIME_CACHE_DIR?.trim();
@@ -51,9 +73,19 @@ function parseEngineBacktestBlobManifest(value) {
             message: `Backtest runtime protocol is incompatible (got ${String(record.protocol)}, expected ${exports.BACKTEST_RUNTIME_PROTOCOL}).`,
         });
     }
+    const hash = readRequiredString(record.hash, "hash");
+    if (!/^[0-9a-f]{16}$/.test(hash)) {
+        throw new errors_1.EngineBacktestError({
+            type: "runtime",
+            subtype: "runtime_manifest_invalid",
+            message: "Backtest runtime manifest hash must be 16 lowercase hex characters.",
+        });
+    }
+    const passivbotKernel = readRequiredHttps(record.passivbotKernel, "passivbotKernel");
+    const passivbotKernelModule = readRequiredHttps(record.passivbotKernelModule, "passivbotKernelModule");
     return {
         version: readRequiredString(record.version, "version"),
-        hash: readRequiredString(record.hash, "hash"),
+        hash,
         protocol: exports.BACKTEST_RUNTIME_PROTOCOL,
         engineSha: readOptionalString(record.engineSha),
         packageVersion: readOptionalString(record.packageVersion),
@@ -64,6 +96,8 @@ function parseEngineBacktestBlobManifest(value) {
         node: readRequiredHttps(record.node, "node"),
         nodeWorker: readRequiredHttps(record.nodeWorker, "nodeWorker"),
         nodeWorkerPath: readRequiredHttps(record.nodeWorkerPath, "nodeWorkerPath"),
+        passivbotKernel,
+        passivbotKernelModule,
     };
 }
 async function ensureBlobRuntime(env = process.env, hooks) {
@@ -78,7 +112,7 @@ async function ensureBlobRuntime(env = process.env, hooks) {
             type: "runtime",
             subtype: "runtime_manifest_unavailable",
             message: `Cannot load backtest runtime manifest: ${error instanceof Error ? error.message : String(error)}`,
-            hint: "Check network access to Vercel Blob, or set ALPHAFOX_USE_LOCAL_BACKTEST=1 with a local Engine build.",
+            hint: "Check network access to the Engine runtime discovery API, or set ALPHAFOX_USE_LOCAL_BACKTEST=1 with a local Engine build.",
             details: { manifestUrl },
         });
     }
@@ -87,26 +121,72 @@ async function ensureBlobRuntime(env = process.env, hooks) {
             type: "runtime",
             subtype: "runtime_manifest_unavailable",
             message: `Backtest runtime manifest unavailable (HTTP ${response.status}).`,
-            hint: "Check network access to Vercel Blob, or set ALPHAFOX_USE_LOCAL_BACKTEST=1 with a local Engine build.",
+            hint: "Check network access to the Engine runtime discovery API, or set ALPHAFOX_USE_LOCAL_BACKTEST=1 with a local Engine build.",
             details: { manifestUrl, status: response.status },
         });
     }
     const manifest = parseEngineBacktestBlobManifest(await response.json());
     const directory = hooks?.cacheDir ?? resolveRuntimeCacheDir(manifest.hash, env);
-    await (0, promises_1.mkdir)(directory, { recursive: true });
-    for (const key of Object.keys(exports.BLOB_RUNTIME_FILES)) {
-        const fileName = exports.BLOB_RUNTIME_FILES[key];
-        const target = (0, node_path_1.join)(directory, fileName);
-        if (await fileExists(target)) {
-            continue;
+    if (await runtimeMatchesHash(directory, manifest.hash)) {
+        return {
+            manifest,
+            directory,
+            nodeEntry: (0, node_path_1.join)(directory, exports.BLOB_RUNTIME_FILES.node),
+        };
+    }
+    await (0, promises_1.mkdir)((0, node_path_1.dirname)(directory), { recursive: true });
+    let actualHash = "";
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        const staging = `${directory}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`;
+        await (0, promises_1.mkdir)(staging, { recursive: true });
+        try {
+            for (const key of Object.keys(exports.BLOB_RUNTIME_FILES)) {
+                await downloadFile(fetchImpl, manifest[key], (0, node_path_1.join)(staging, exports.BLOB_RUNTIME_FILES[key]));
+            }
+            if (!(await allRuntimeFilesExist(staging))) {
+                continue;
+            }
+            actualHash = await hashBlobRuntime(staging);
+            if (actualHash !== manifest.hash) {
+                continue;
+            }
+            await (0, promises_1.mkdir)(directory, { recursive: true });
+            for (const fileName of Object.values(exports.BLOB_RUNTIME_FILES)) {
+                await (0, promises_1.rename)((0, node_path_1.join)(staging, fileName), (0, node_path_1.join)(directory, fileName));
+            }
+            if (await runtimeMatchesHash(directory, manifest.hash)) {
+                return {
+                    manifest,
+                    directory,
+                    nodeEntry: (0, node_path_1.join)(directory, exports.BLOB_RUNTIME_FILES.node),
+                };
+            }
+        }
+        finally {
+            await (0, promises_1.rm)(staging, { force: true, recursive: true });
         }
-        await downloadFile(fetchImpl, manifest[key], target);
     }
-    return {
-        manifest,
-        directory,
-        nodeEntry: (0, node_path_1.join)(directory, exports.BLOB_RUNTIME_FILES.node),
-    };
+    throw new errors_1.EngineBacktestError({
+        type: "runtime",
+        subtype: "runtime_integrity_failed",
+        message: `Backtest runtime hash mismatch: expected ${manifest.hash}, received ${actualHash}.`,
+        hint: "Retry the download; no unverified runtime was cached.",
+        details: { expectedHash: manifest.hash, actualHash, directory },
+    });
+}
+async function runtimeMatchesHash(directory, expectedHash) {
+    if (!(await allRuntimeFilesExist(directory))) {
+        return false;
+    }
+    try {
+        return (await hashBlobRuntime(directory)) === expectedHash;
+    }
+    catch {
+        return false;
+    }
+}
+async function allRuntimeFilesExist(directory) {
+    return (await Promise.all(Object.values(exports.BLOB_RUNTIME_FILES).map((fileName) => fileExists((0, node_path_1.join)(directory, fileName))))).every(Boolean);
 }
 async function downloadFile(fetchImpl, url, target) {
     let response;
@@ -127,9 +207,23 @@ async function downloadFile(fetchImpl, url, target) {
             message: `Backtest runtime file unavailable (${url} HTTP ${response.status}).`,
         });
     }
-    const tmp = `${target}.tmp`;
-    await (0, promises_2.pipeline)(node_stream_1.Readable.fromWeb(response.body), (0, node_fs_1.createWriteStream)(tmp));
-    await (0, promises_1.rename)(tmp, target);
+    const tmp = `${target}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`;
+    try {
+        await (0, promises_2.pipeline)(node_stream_1.Readable.fromWeb(response.body), (0, node_fs_1.createWriteStream)(tmp));
+        await (0, promises_1.rename)(tmp, target);
+    }
+    finally {
+        await (0, promises_1.rm)(tmp, { force: true });
+    }
+}
+async function hashBlobRuntime(directory) {
+    const digest = (0, node_crypto_1.createHash)("sha256");
+    for (const fileName of HASHED_BLOB_RUNTIME_FILES) {
+        for await (const chunk of (0, node_fs_1.createReadStream)((0, node_path_1.join)(directory, fileName))) {
+            digest.update(chunk);
+        }
+    }
+    return digest.digest("hex").slice(0, 16);
 }
 async function fileExists(path) {
     try {

package/dist/engine-backtest/run-command.js

@@ -216,7 +216,7 @@ async function executeEngineBacktestRun(args, flags, env = process.env, deps = {
     }
     else {
         const [wasmLoaded, runnerLoaded] = await Promise.all([
-            (0, resolve_packages_1.loadBacktestWasm)(env, deps.resolveHooks),
+            (0, resolve_packages_1.loadBacktestWasm)({ ...env, ALPHAFOX_PROFILE: profile.name }, deps.resolveHooks),
             (0, resolve_packages_1.loadBacktestRunner)(env, deps.resolveHooks),
         ]);
         wasm = wasmLoaded.module;

package/dist/engine-backtest/sweep-command.js

@@ -82,7 +82,7 @@ async function executeEngineBacktestSweep(args, flags, env = process.env, deps =
         cwd: deps.cwd,
         readFile: deps.readFile,
     }), config, args.mode);
-    const { wasm, runner } = await loadRuntime(deps, env);
+    const { wasm, runner } = await loadRuntime(deps, { ...env, ALPHAFOX_PROFILE: profile.name });
     const clients = [];
     try {
         const client = wasm.createNodeBacktestClient({ verbose: args.verbose });

package/dist/http/client.js

@@ -146,9 +146,9 @@ async function fetchFollowingAuthRedirects(fetchImpl, startUrl, init, maxHops =
         if (!sameAuthSite(originOf(url), originOf(nextUrl))) {
             break;
         }
-        // 303 switches to GET without body; 301/302 historically do for non-GET.
-        if (response.status === 303 ||
-            ((response.status === 301 || response.status === 302) && method !== "GET" && method !== "HEAD")) {
+        // 303 is the only redirect that switches to GET. Apex→www is Cloudflare 301;
+        // converting POST to GET drops the OAuth body and the AS returns 405.
+        if (response.status === 303) {
             method = "GET";
             body = undefined;
         }

package/dist/skills-manifest.json

@@ -1,153 +1,153 @@
 {
   "schemaVersion": 1,
   "packageName": "@alphafox/cli",
-  "packageVersion": "0.3.22",
+  "packageVersion": "0.3.24",
   "contractVersion": "2026-08-31",
-  "bundleHash": "0ff8e818dd5a2f06d7d0df63d681bdf04163b9b09d8626da99c033a97aa8d438",
+  "bundleHash": "268fe5f1673a98d317f50887066cbdc4b9a2663ad3d8d4d1ef2264542c469d4b",
   "skills": [
     {
       "name": "alphafox",
-      "version": "0.3.22",
+      "version": "0.3.24",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "454ddd309258874eb35bf567cd9ac3f524ecd212cd0a76599b8ae96ca50b9658",
-          "size": 7950
+          "sha256": "580e26102a42d2871d1876832b542411f4aa6dd68dafa29c1a30e520c55b1e41",
+          "size": 6711
         }
       ],
-      "hash": "10dc9fcb503d2e09dda7284818fcebd1223d97fb3c8e95e7757ea6db86a239b2"
+      "hash": "5e62600962da6d22119d06a4bd3076780ea99aeb6ec3a64e9e6b278fc42f8c74"
     },
     {
       "name": "alphafox-account",
-      "version": "0.3.22",
+      "version": "0.3.24",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "ab83a22f7960d1b94d1f3874cd464c705c9eafb77b3b132ad3d2c092b343227b",
+          "sha256": "b6bb1b5c3d9f7a147981a22f036f7c15cfabfdab9159ed6185d83fb5565ff22a",
           "size": 784
         }
       ],
-      "hash": "b0de2c06865dd85be5655358e2fe20bd54dd2db29af73c225e43e3e5c4464649"
+      "hash": "17d7afff57d90861b1623ebadebed3a6ca7f6f45bcf81158df59c1ec2a84f8b1"
     },
     {
       "name": "alphafox-admin",
-      "version": "0.3.22",
+      "version": "0.3.24",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "a30aa7f40d67e32068f909481906a548da713f05dfb8562eebb05bc09d90bca7",
+          "sha256": "8de45c0ee0947c57afd17d719bdf5737e260d0beb535b23aab546b74b160e439",
           "size": 2078
         }
       ],
-      "hash": "e0aa20827c3299dc996c74ef27b7708bd32275e3a61362b07be367fc565e735a"
+      "hash": "28149c13321f3216fff2a6448c6004b666c4ec3b28142b4769cad2d012e8f65f"
     },
     {
       "name": "alphafox-auth",
-      "version": "0.3.22",
+      "version": "0.3.24",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "eab220c69f31de56f7bdfde7722723c2bc9a667539f62bc8faae7234642412be",
+          "sha256": "b6fef448fdc874516a3e8e9d63c0d37084a1b14141c02068fb9a4dd7a0f175f0",
           "size": 2371
         }
       ],
-      "hash": "02c24ece7d90d42afd81c249184925ec970602e0226deafd290ff1d7d2e2dfa9"
+      "hash": "0307804078457f61d6e759025e4fe7a9177263199c2a0655b2db0b1c3859ab8c"
     },
     {
       "name": "alphafox-cache",
-      "version": "0.3.22",
+      "version": "0.3.24",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "ebdf0007dfb04f2e2285b2e4cf738e6b70c46b40f67b22f2ec024be79e1ff895",
-          "size": 1530
+          "sha256": "1542a43cf58338c4ad8b238cb81e672fd06741c5c4d5574907685cec1465c29a",
+          "size": 1762
         }
       ],
-      "hash": "7ebf4b0457e8c61fdd28601dbd95ef3b36eb2d4935e1f38448273e329ae69013"
+      "hash": "38f55adfe15d90e1f700b01434e10315cd21a2eaf68aa81ef1cbaa6838239ae8"
     },
     {
       "name": "alphafox-engine-backtest",
-      "version": "0.3.22",
+      "version": "0.3.24",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "2a30ee16622c6a4cf1f9f40519be544d0f089a62eba4ffdd48d726f153760de3",
-          "size": 9792
+          "sha256": "63d100f1312b37905a1e0483102f0717f5a7ce4774b45c293e691cde951417e4",
+          "size": 9862
         }
       ],
-      "hash": "1aecca4608c0253089e69c1d58746984c2621ab5eccbb45c4e962a7530936663"
+      "hash": "5f76ddce28123600785ee2bfe4e512b92c191ff9b031f721ca42d32b7644c07f"
     },
     {
       "name": "alphafox-exchange",
-      "version": "0.3.22",
+      "version": "0.3.24",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "a065c2af77150a140838580053d688defaafa2c1093c565f9759b2e4f211e3cd",
+          "sha256": "82d13d7541314c13244dad557d11b28815e4dabc7a4982390d16cb4e6eae6180",
           "size": 744
         }
       ],
-      "hash": "0dd29f8547bdbcfe89789877b32e84f130e88c886cd07cab2785d515ff807a3c"
+      "hash": "cd917932104e318c8a65f0f16adea15e5c7af682bd37814a06de436cbc01fdbe"
     },
     {
       "name": "alphafox-market",
-      "version": "0.3.22",
+      "version": "0.3.24",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "ca9d73c21724cf2e9b2f4ab9128f5ca883c70530ee4dc7268ea05c3a9d226083",
-          "size": 3079
+          "sha256": "b6ff2ee7956b997f89baa8043bf30c3bf0581cae202a10639acfe5eb01e97513",
+          "size": 3208
         }
       ],
-      "hash": "e5582689e8c8ca0e2ffcb334ba454b12400e9591070c9728b31e39db42c276a0"
+      "hash": "67f726874447e1b697397bafaa2a42cc5bf271bcf5d0b981ce98acee77924f03"
     },
     {
       "name": "alphafox-notification",
-      "version": "0.3.22",
+      "version": "0.3.24",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "05485ee0d3bec411583f57ecb711555a5353d50fbf76ab92aaa45e2de4abdf20",
+          "sha256": "bae0d88305ee82867798d969fe39ea7420436b02cfb37dc4837d55143e2c4e83",
           "size": 699
         }
       ],
-      "hash": "a139b26ee840f4f6c3bf46e92809ef5db1af29b446e572b5254808a639f86f27"
+      "hash": "8a6e3af0edee2f3e30a5326333c7918c863da194ee6086a92ccc71d8fa057924"
     },
     {
       "name": "alphafox-shared",
-      "version": "0.3.22",
+      "version": "0.3.24",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "b7bbdf683b12975538c26e38a05dce89d0c0f1a19a5cc73569e2c709fbb5d04b",
-          "size": 6920
+          "sha256": "4fda905ccf93ae321e36de4bc41dd7508825c7073bbbd237fc5b82910094ff70",
+          "size": 7819
         }
       ],
-      "hash": "7c7750ba8bf2d2dbf51c8fb134ac958076773f9572f9082497925bb8b255de13"
+      "hash": "b610b7f938899ce1d6327bac9a4f5788e72bedb2a033ac77cadf8ea7d0a050b5"
     },
     {
       "name": "alphafox-strategy",
-      "version": "0.3.22",
+      "version": "0.3.24",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "01540ff5e1076eab22515991199be407263d942bc7608628c377b81eb0157cd7",
-          "size": 7185
+          "sha256": "b1caecced015cb227842153660744470a1092e823d2b355570c7e396ee3c9c5d",
+          "size": 8039
         }
       ],
-      "hash": "e2e0e0a6bae21e5f97ed6ba42d66e90cf51c76b6601cdad606630c3743441909"
+      "hash": "57df3973cfcae8accccb5d65f16efd1fa0cde6d670f03ee318077db1d57c4e03"
     },
     {
       "name": "alphafox-trading",
-      "version": "0.3.22",
+      "version": "0.3.24",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "4b862b2f01534e0fda2c6667bc39a972f2cd9692f8967a0496b941411b745967",
-          "size": 4921
+          "sha256": "ba28488c9a46ea5da006940603580a05811939d9a6abbc4f14be69d315c04b2a",
+          "size": 4920
         }
       ],
-      "hash": "d8c0388da25fd4964d6ca8d4668ec0a0778669e0fbc22e85952b7eca80869205"
+      "hash": "a7bb8403c0a9c7e42658e85770ec1451705d5bd7a4d5283847dab667b021e50e"
     }
   ]
 }

package/dist/version.d.ts

@@ -1,4 +1,4 @@
 export declare const CLI_NAME = "alphafox";
 export declare const CLI_PACKAGE = "@alphafox/cli";
-export declare const CLI_VERSION = "0.3.22";
+export declare const CLI_VERSION = "0.3.24";
 export { CATALOG_VERSION as CLI_CONTRACT_VERSION } from "./catalog/operations";

package/dist/version.js

@@ -3,6 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CLI_CONTRACT_VERSION = exports.CLI_VERSION = exports.CLI_PACKAGE = exports.CLI_NAME = void 0;
 exports.CLI_NAME = "alphafox";
 exports.CLI_PACKAGE = "@alphafox/cli";
-exports.CLI_VERSION = "0.3.22";
+exports.CLI_VERSION = "0.3.24";
 var operations_1 = require("./catalog/operations");
 Object.defineProperty(exports, "CLI_CONTRACT_VERSION", { enumerable: true, get: function () { return operations_1.CATALOG_VERSION; } });

package/docs/agents/domain.md

@@ -1,51 +1,5 @@
-# Domain Docs
+# Domain references
 
-How the engineering skills should consume this repo's domain documentation when exploring the codebase.
+For a task that changes domain terminology, behavior across contexts, or architecture, locate the relevant entry in root `CONTEXT-MAP.md` (if present), otherwise `CONTEXT.md`, and read only the relevant glossary sections and ADRs. Ordinary documentation, formatting and isolated mechanical edits do not require a domain-document tour.
 
-## Before exploring, read these
-
-- **`CONTEXT.md`** at the repo root, or
-- **`CONTEXT-MAP.md`** at the repo root if it exists — it points at one `CONTEXT.md` per context. Read each one relevant to the topic.
-- **`docs/adr/`** — read ADRs that touch the area you're about to work in. In multi-context repos, also check `src/<context>/docs/adr/` for context-scoped decisions.
-
-If any of these files don't exist, **proceed silently**. Don't flag their absence; don't suggest creating them upfront. The `/domain-modeling` skill (reached via `/grill-with-docs` and `/improve-codebase-architecture`) creates them lazily when terms or decisions actually get resolved.
-
-## File structure
-
-Single-context repo (most repos):
-
-```
-/
-├── CONTEXT.md
-├── docs/adr/
-│   ├── 0001-event-sourced-orders.md
-│   └── 0002-postgres-for-write-model.md
-└── src/
-```
-
-Multi-context repo (presence of `CONTEXT-MAP.md` at the root):
-
-```
-/
-├── CONTEXT-MAP.md
-├── docs/adr/                          ← system-wide decisions
-└── src/
-    ├── ordering/
-    │   ├── CONTEXT.md
-    │   └── docs/adr/                  ← context-specific decisions
-    └── billing/
-        ├── CONTEXT.md
-        └── docs/adr/
-```
-
-## Use the glossary's vocabulary
-
-When your output names a domain concept (in an issue title, a refactor proposal, a hypothesis, a test name), use the term as defined in `CONTEXT.md`. Don't drift to synonyms the glossary explicitly avoids.
-
-If the concept you need isn't in the glossary yet, that's a signal — either you're inventing language the project doesn't use (reconsider) or there's a real gap (note it for `/domain-modeling`).
-
-## Flag ADR conflicts
-
-If your output contradicts an existing ADR, surface it explicitly rather than silently overriding:
-
-> _Contradicts ADR-0007 (event-sourced orders) — but worth reopening because…_
+Use established terms and surface an actual conflict with an existing ADR before changing the decision. Missing files are not a setup blocker. Add glossary entries or ADRs only when the task resolves a durable ambiguity or decision, not for every edit. Reuse unchanged material within the task.

package/docs/agents/issue-tracker.md

@@ -1,45 +1,9 @@
-# Issue tracker: GitHub
+# Issue tracker: shared Feishu Tasks
 
-Issues and specs for this repo live as GitHub issues. Use the `gh` CLI for all operations.
+Matt engineering issues, specs and tickets for this repo live in **AlphaFox-Issues**, not GitHub Issues. Prefix titles with `[alphafox-cli]`. GitHub hosts code and PRs; a PR URL may be linked from the task.
 
-## Conventions
+On task operations, read the infra `docs/agents/issue-tracker.md` for canonical GUIDs, sections, Type options and dependency conventions. Resolve `alphafox-infra` in the workspace described in this repo's AGENTS.md (or its explicitly selected task worktree). Read the installed `lark-task` Skill for current commands; do not maintain a second CLI recipe here. If the shared file is unavailable, discover the named existing list using the Skill and verify its identity before writing; do not create a replacement list.
 
-- **Create an issue**: `gh issue create --title "..." --body "..."`. Use a heredoc for multi-line bodies.
-- **Read an issue**: `gh issue view <number> --comments`, filtering comments by `jq` and also fetching labels.
-- **List issues**: `gh issue list --state open --json number,title,body,labels,comments --jq '[.[] | {number, title, body, labels: [.labels[].name], comments: [.comments[].body]}]'` with appropriate `--label` and `--state` filters.
-- **Comment on an issue**: `gh issue comment <number> --body "..."`
-- **Apply / remove labels**: `gh issue edit <number> --add-label "..."` / `--remove-label "..."`
-- **Close**: `gh issue close <number> --comment "..."`
+A linked task's acceptance is the specification. Without a linked task, use the explicit user request and record it in the PR; task creation is not a prerequisite for local work. Routine delivery comments stay within existing task authorization; new scope or tasklists need their own decision.
 
-Infer the repo from `git remote -v`; `gh` does this automatically when run inside a clone.
-
-## Pull requests as a triage surface
-
-**PRs as a request surface: no.** _(Set to `yes` if this repo treats external PRs as feature requests; `/triage` reads this flag.)_
-
-When set to `yes`, PRs run through the same labels and states as issues, using the `gh pr` equivalents:
-
-- **Read a PR**: `gh pr view <number> --comments` and `gh pr diff <number>` for the diff.
-- **List external PRs for triage**: `gh pr list --state open --json number,title,body,labels,author,authorAssociation,comments` then keep only `authorAssociation` of `CONTRIBUTOR`, `FIRST_TIME_CONTRIBUTOR`, or `NONE` (drop `OWNER`/`MEMBER`/`COLLABORATOR`).
-- **Comment / label / close**: `gh pr comment`, `gh pr edit --add-label`/`--remove-label`, `gh pr close`.
-
-GitHub shares one number space across issues and PRs, so a bare `#42` may be either: resolve with `gh pr view 42` and fall back to `gh issue view 42`.
-
-## When a skill says "publish to the issue tracker"
-
-Create a GitHub issue.
-
-## When a skill says "fetch the relevant ticket"
-
-Run `gh issue view <number> --comments`.
-
-## Wayfinding operations
-
-Used by `/wayfinder`. The **map** is a single issue with **child** issues as tickets.
-
-- **Map**: a single issue labelled `wayfinder:map`, holding the Notes / Decisions-so-far / Fog body. `gh issue create --label wayfinder:map`.
-- **Child ticket**: an issue linked to the map as a GitHub sub-issue (`gh api` on the sub-issues endpoint). Where sub-issues aren't enabled, add the child to a task list in the map body and put `Part of #<map>` at the top of the child body. Labels: `wayfinder:<type>` (`research`/`prototype`/`grilling`/`task`). Once claimed, the ticket is assigned to the driving dev.
-- **Blocking**: GitHub's **native issue dependencies**, the canonical, UI-visible representation. Add an edge with `gh api --method POST repos/<owner>/<repo>/issues/<child>/dependencies/blocked_by -F issue_id=<blocker-db-id>`, where `<blocker-db-id>` is the blocker's numeric **database id** (`gh api repos/<owner>/<repo>/issues/<n> --jq .id`, _not_ the `#number` or `node_id`). GitHub reports `issue_dependencies_summary.blocked_by` (open blockers only, the live gate). Where dependencies aren't available, fall back to a `Blocked by: #<n>, #<n>` line at the top of the child body. A ticket is unblocked when every blocker is closed.
-- **Frontier query**: list the map's open children (`gh issue list --state open`, scoped to the map's sub-issues / task list), drop any with an open blocker (`issue_dependencies_summary.blocked_by > 0`, or an open issue in the `Blocked by` line) or an assignee; first in map order wins.
-- **Claim**: `gh issue edit <n> --add-assignee @me`, the session's first write.
-- **Resolve**: `gh issue comment <n> --body "<answer>"`, then `gh issue close <n>`, then append a context pointer (gist + link) to the map's Decisions-so-far.
+**PRs as a request surface: no.** For a specifically requested PR triage, inspect it on GitHub and keep engineering task state in Feishu.

package/docs/agents/triage-labels.md

@@ -1,15 +1,3 @@
-# Triage Labels
+# Triage mapping
 
-The skills speak in terms of five canonical triage roles. This file maps those roles to the actual label strings used in this repo's issue tracker.
-
-| Label in mattpocock/skills | Label in our tracker | Meaning                                  |
-| -------------------------- | -------------------- | ---------------------------------------- |
-| `needs-triage`             | `needs-triage`       | Maintainer needs to evaluate this issue  |
-| `needs-info`               | `needs-info`         | Waiting on reporter for more information |
-| `ready-for-agent`          | `ready-for-agent`    | Fully specified, ready for an AFK agent  |
-| `ready-for-human`          | `ready-for-human`    | Requires human implementation            |
-| `wontfix`                  | `wontfix`            | Will not be actioned                     |
-
-When a skill mentions a role (e.g. "apply the AFK-ready triage label"), use the corresponding label string from this table.
-
-Edit the right-hand column to match whatever vocabulary you actually use.
+Read only when classifying a Matt engineering task. Canonical triage roles map to Feishu **sections**, not GitHub labels; categories map to the separate single-select **Type** field. The infra `docs/agents/issue-tracker.md` owns the mapping and GUIDs; resolve it through this repo's AGENTS.md. A section is not a completion status: complete/incomplete follows task acceptance. Do not rename sections or create Type options just to match a Skill's spelling.

package/docs/gcs-runtime-migration.md

@@ -0,0 +1,7 @@
+# Runtime discovery migration
+
+New CLI releases discover the protocol-1 runtime through the environment's Engine API and download the same nine files from GCS / Cloud CDN. SHA256 runtime verification and the existing content cache remain enabled. `--profile staging` selects staging; production selects production. A local profile requires an explicit manifest URL or local runtime build.
+
+`ALPHAFOX_BACKTEST_WASM_MANIFEST_URL` remains an explicit override. Discovery errors are reported; no automatic switch to the old Blob URL occurs.
+
+Historical packages keep their original Blob endpoint and frozen compatible files. The support end date is not yet defined; do not delete them based on a short period of low traffic. Upgrade with `npm install -g @alphafox/cli` after the new release has been published. A PR is not an npm release.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alphafox/cli",
-  "version": "0.3.22",
+  "version": "0.3.24",
   "description": "AlphaFox CLI — Agent/Human entry for the public Application API.",
   "type": "commonjs",
   "bin": {

package/skills/account/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-account
 description: Account, wallet, and subscription read paths.
-version: 0.3.22
+version: 0.3.24
 ---
 
 # Account / wallet

package/skills/admin/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-admin
 description: Admin-only operations reusing Web role authorization.
-version: 0.3.22
+version: 0.3.24
 ---
 
 # Admin

package/skills/alphafox/SKILL.md

@@ -1,14 +1,14 @@
 ---
 name: alphafox
-description: AlphaFox CLI entry router. Use for any AlphaFox request — install, update, login, whoami, 回测, engine backtest, 清理回测缓存 / 历史数据, strategy definitions, create/list/start/stop a running strategy (trader), ticker/标的 resolve (美股 or crypto), market data, exchange connectors, wallet, subscriptions, notifications, or admin. After 回测 or 运行策略, include the dashboard URL from the domain skill. When the user asks 排行榜, include https://www.alphafox.app/zh/dashboard/leaderboard. After a successful install and login, present the 新人引导 in this file (Lite square 带单员 + classic strategies). If a CLI command prints `[alphafox] update available`, ask the user「检测到新的版本，是否需要我帮你升级？」and only then run `alphafox update --format json --no-input`. After a large backtest, if tape cache is large, ask「回测下载的历史数据比较大，要不要我帮你清理本地缓存？」then open `alphafox-cache`. Start here, then open the routed domain skill. Do not guess alphafox-engine-backtest vs alphafox-strategy vs alphafox-trading from memory.
-version: 0.3.22
+description: "Route AlphaFox product CLI requests: installation/auth, market data, strategy configuration, backtests, traders, connectors, accounts and notifications. Repository development or AGENTS/Skills maintenance uses repository instructions, not product CLI operations."
+version: 0.3.24
 ---
 
 # AlphaFox
 
 This skill only routes. After choosing a row, **read that skill's `SKILL.md` and follow it**. Do not improvise domain procedures from this file.
 
-Also read `alphafox-shared` before any CLI invocation (envelope, auth, risk, schema-first writes). Always `--format json --no-input`. Never `--token`.
+Read `alphafox-shared` before the first CLI invocation in this task; reuse it while unchanged (envelope, auth, risk, schema-first writes). Always `--format json --no-input`. Never `--token`.
 
 Human-mentioned tickers go through `alphafox-market` (`alphafox resolve-symbols`) **before** they enter config, backtest, or writes. Keep the operator's asset class (美股 → `equity_perp` on `binance_perp_usdt`).
 
@@ -31,7 +31,7 @@ A **trader** is a running strategy instance (paper or live), not a person. Creat
 | Notification channels | `alphafox-notification` |
 | Admin-only operations | `alphafox-admin` |
 
-If several rows apply, load **all** of them (typical: `alphafox-shared` + `alphafox-market` + one domain skill).
+Load only rows needed for the requested operation, reusing Skills already read in this task (typical: shared + market when resolving a ticker + the operation Skill).
 
 - “帮我配/建一个网格/DCA/跟单策略” → `alphafox-strategy` (pick definition, ask knobs, validate `{common, strategy}`) **and** `alphafox-market` (resolve tickers) **and** `alphafox-trading` (create the trader, default `autoStart: true`). Hidden copy variants still create through `alphafox-trading`. After create, include the trader URL from `alphafox-shared`.
 - “帮我回测这个配置” → `alphafox-strategy` (definition + config) **and** `alphafox-engine-backtest`. After a persisted run, include the backtest URL from `alphafox-shared`.
@@ -39,25 +39,7 @@ If several rows apply, load **all** of them (typical: `alphafox-shared` + `alpha
 
 ## Upgrade reminder
 
-The CLI may print this on **stderr** at most once every 24 hours:
-
-```text
-[alphafox] update available: 0.3.15 -> 0.3.16. After the user confirms, run: alphafox update --format json --no-input,
-```
-
-If you see that notice (or `updateAvailable: true` from `alphafox update --check`):
-
-1. Ask the user: **检测到新的版本，是否需要我帮你升级？**
-2. Wait for an explicit yes. Do not upgrade on your own.
-3. After they confirm:
-
-```bash
-alphafox update --format json --no-input
-```
-
-4. Tell the user to **restart the AI tool** so the new Skills load.
-
-Do not install Skills from GitHub. Details and dry-run / check commands live in `alphafox-shared`.
+An update notice does not interrupt the current task. Finish its deliverable first, then offer an upgrade if relevant. Use `alphafox-shared` for the co-versioned update procedure; an explicit update request already supplies intent. Do not independently install Skills from GitHub.
 
 ## After install
 
@@ -121,8 +103,4 @@ Ambiguous “帮我回测” → `alphafox-engine-backtest`, after resolving sym
 
 `engine-backtest run|sweep` downloads closed OHLCV into the local tape cache. After a long-range or 1m backtest (or whenever the operator mentions disk / 缓存), read `alphafox-cache` and run `alphafox cache status --format json --no-input`.
 
-If `data.tape.large` is true (tape ≥ `data.remindAfterBytes`):
-
-1. Ask the user: **回测下载的历史数据比较大，要不要我帮你清理本地缓存？**
-2. Wait for an explicit yes. Do not clean on your own.
-3. Follow `alphafox-cache` (`alphafox cache clean --dry-run`, then `--yes`).
+If `data.tape.large` is true, finish the backtest report first, then follow `alphafox-cache` for the optional cleanup offer. Reuse an explicit cleanup request; do not ask twice or clean an unrequested cache class.

package/skills/alphafox-shared/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-shared
 description: Shared AlphaFox CLI rules for Agents — auth, profiles, envelopes, risk gates, public operationIds, and dashboard links after 回测 / 运行策略 / 排行榜.
-version: 0.3.22
+version: 0.3.24
 ---
 
 # AlphaFox shared Agent contract
@@ -39,7 +39,7 @@ The CLI checks npm at most once every 24 hours and only prints a notice on
 
 **检测到新的版本，是否需要我帮你升级？**
 
-Wait for an explicit yes. Then keep CLI and Skills co-versioned:
+Finish the current task before offering an unrelated upgrade. An explicit upgrade request or approval in this task is sufficient; otherwise wait for it. Then keep CLI and Skills co-versioned:
 
 ```bash
 alphafox update --check --format json --no-input
@@ -82,7 +82,7 @@ Access tokens last ~10 minutes; the CLI refreshes them. After idle, run **one**
 
 Local browser: `alphafox auth login --browser --format json --no-input` (loopback 127.0.0.1). If the browser cannot open, copy `authorizeUrl` from the error; do not invent a Device Flow retry unless the operator is headless.
 
-Wrong environment / missing permission / missing `--yes`: stop. Do not retry with a different profile.
+Wrong environment or missing permission blocks that operation; keep the requested profile and report the needed correction. Missing `--yes` is a confirmation gate: show the exact action and reuse an existing explicit approval only if it covers these parameters, otherwise ask once. Continue independent reads/local work where useful; do not switch profiles to evade a gate.
 
 ## Commands
 
@@ -99,13 +99,13 @@ Forbidden: `/backend`, `/control-plane`, `/signal-center`, internal secrets, non
 
 ## Writes — schema first, never invent fields
 
-Before every write (`POST` / `PUT` / `PATCH` / `DELETE` with a body):
+Before composing a write body (`POST` / `PUT` / `PATCH` / `DELETE`), obtain its operation schema. In this task, reuse a schema for the same CLI/contract/catalog version, profile and operationId. Refresh on version/profile changes or schema-validation errors. “Read schema first” in domain Skills uses this same rule:
 
-1. Run `alphafox schema <operationId> --format json --no-input`.
+1. On first use or invalidation, run `alphafox schema <operationId> --format json --no-input`.
 2. Build the body **only** from `request.body` (property names, types, enums, required). Do not guess fields from memory, from another operationId, or from training data.
 3. Small object: typed command + `--body '<json>'`.
 4. Nested / large object: write a JSON file, then `--config @./payload.json`. Do not paste 20+ fields onto argv.
-5. `--dry-run` first when the risk is `write` or `high-risk-write`.
+5. Preview high-risk writes and new/changed mutation payloads with `--dry-run`. A previously verified low-risk payload shape does not require repeating discovery and dry-run on every batch item; per-request CLI validation still applies. Verify that the command actually supports dry-run.
 
 CLI validates `--body` / `--config` against the catalog **before** HTTP. `body_schema` / `body_schema_missing` (exit `64`) means the payload is wrong — re-read `schema`, do not add extra keys to “make it work”. `--body` and `--config` cannot be combined. `--body @file` is also a file (same as `--config @file`).
 

package/skills/auth/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-auth
 description: Login, status, logout, whoami, and environment isolation for AlphaFox CLI.
-version: 0.3.22
+version: 0.3.24
 ---
 
 # Auth Skill

package/skills/cache/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-cache
 description: Inspect and clean local Engine backtest caches (downloaded OHLCV tape and wasm runtime). Use when the user asks to 清理缓存, free disk, or after a large historical backtest.
-version: 0.3.22
+version: 0.3.24
 ---
 
 # Cache
@@ -18,11 +18,11 @@ alphafox cache status --format json --no-input
 
 Read `data.tape.bytes`, `data.tape.files`, `data.tape.large`, `data.remindAfterBytes`. `large` is true when tape bytes ≥ `remindAfterBytes` (512 MiB).
 
-If `data.tape.large` is true, ask the user:
+When cleanup was not requested and `data.tape.large` is true, first deliver the backtest result, then offer:
 
 **回测下载的历史数据比较大，要不要我帮你清理本地缓存？**
 
-Wait for an explicit yes. Do not clean on your own.
+An explicit request to clean this cache or approval of this offer authorizes the displayed scope; do not ask twice. A size notice alone does not authorize deletion. Extra runtime/all-cache deletion needs its own scope.
 
 ## Clean
 

package/skills/engine-backtest/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-engine-backtest
 description: Local Engine WASM backtest (alphafox engine-backtest run|sweep) vs catalog experiment CRUD. After a persisted run, include https://www.alphafox.app/zh/dashboard/traders/backtest/{experimentId}.
-version: 0.3.22
+version: 0.3.24
 ---
 
 # Engine Backtest
@@ -33,7 +33,7 @@ alphafox schema engine_backtest.experiments.byId.sweeps.create --format json --n
 
 The tape runner ships inside the CLI (plus `ccxt` for public-market pulls). The wasm / Node host is downloaded from the public Vercel Blob manifest (`engine-backtest/latest.json`) into `~/.cache/alphafox/engine-backtest/<hash>/` on first run.
 
-Before planning or running, follow the complete parameter review in `alphafox-strategy`, including when the operator already supplied `--config` or pasted a full command. Do not run the backtest until every applicable parameter, default status, short explanation, proposed value, and value source has been shown and the operator explicitly confirms the final proposal. User overrides win; unresolved required values stop the flow.
+For a requested backtest with supplied config, preserve and validate it against the definition; do not require the live-trader execution review. Use `alphafox-strategy` to resolve unknown fields or a requested guided configuration. Ask for unresolved required values or materially ambiguous choices. Respect the requested range, data-quality mode and persistence scope; a local-only request uses `--no-persist`. Live trader creation remains a separate requested and approved action.
 
 Local overrides, in order:
 
@@ -98,7 +98,7 @@ Owner isolation and 7-day expiry are enforced by the server. Applying a coordina
 2. `engine-backtest run` (reuse `--experiment` after the first create).
 3. Read `data.metrics` / `data.engineVersion` / `data.runId` / `data.experimentId` / `data.experimentUrl`. After the run, also read `data.coverageNotice` (`warning` = mid-range candle gaps; `notice` = start / other soft gaps). When an Experiment id exists, include the backtest dashboard URL from `alphafox-shared` (`https://www.alphafox.app/zh/dashboard/traders/backtest/{experimentId}`) in the reply — do not stop at metrics or the raw CLI `experimentUrl`.
 4. Adjust parameters and run again. Do not invent a token flag if persist returns 401 — `alphafox auth login`.
-5. After a long-range or 1m run, follow `alphafox-cache`: `alphafox cache status`. If `data.tape.large` is true, ask **回测下载的历史数据比较大，要不要我帮你清理本地缓存？** and wait for yes.
+5. After a long-range or 1m run, follow `alphafox-cache`: `alphafox cache status`. If `data.tape.large` is true, finish the result first, then follow `alphafox-cache` for the optional cleanup offer; reuse any explicit cleanup approval.
 
 ## Safety
 

package/skills/exchange/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-exchange
 description: Exchange connectors list and connection management via Public API.
-version: 0.3.22
+version: 0.3.24
 ---
 
 # Exchange connectors

package/skills/market/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-market
 description: Market data and ticker resolution for US equity perps, RWAs, and crypto on the same perp catalog. Use when the user names 美股, NVDA, AAPL, BTC, or any 标的. Keep the operator's asset class via symbolMetadata — do not rewrite NVDA into a crypto coin.
-version: 0.3.22
+version: 0.3.24
 ---
 
 # Market
@@ -28,7 +28,7 @@ Binance US stocks are **equity perps in the same** `binance_perp_usdt` catalog (
 
 ## Resolve tickers
 
-Whenever a human mentions a stock, coin, ticker, or contract — including typos — resolve it **before** putting a symbol into strategy config, backtest, trader settings, or any write.
+Resolve a human-mentioned ticker before using it in config, backtest or a write. Reuse an exact/confirmed result for the same exchange, asset class and catalog within this task; resolve again when any of those inputs changes or the result is rejected. Mere discussion of a ticker does not require a market API call.
 
 ```bash
 alphafox resolve-symbols BTC ETH --exchange binance --format json --no-input

package/skills/notification/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-notification
 description: Notification channels and subscriptions.
-version: 0.3.22
+version: 0.3.24
 ---
 
 # Notification

package/skills/strategy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-strategy
 description: Strategy definitions — list types, read a definition's contract, and validate config. Creating a running strategy is creating a trader; use alphafox-trading for that. Local Engine backtest is alphafox-engine-backtest.
-version: 0.3.22
+version: 0.3.24
 ---
 
 # Strategy definitions
@@ -38,7 +38,9 @@ Explain the type from those fields. Missing a layer → say unknown; do not fill
 
 ## Configure with the human
 
-The human confirms the complete parameter set. You write JSON only after that review.
+Use the complete review below when preparing an actual trader creation/start, or when the user asks for a guided parameter design. It protects execution decisions and is not a gate for inspecting a definition, validating a supplied config, or a requested local backtest. For those tasks, preserve supplied values, validate applicable fields, and ask only for unresolved required inputs or a material ambiguity. Report completion of the requested operation; do not implicitly create/start a trader.
+
+For the execution proposal, the human confirms the complete parameter set. Reuse that confirmation while the proposal and environment are unchanged. You may prepare and validate JSON to discover errors before the final execution approval.
 
 1. Confirm the definition from `byId.get` in the operator's language (what it is, what drives it, how positions change).
 2. Use the effective `configSchema` returned by `byId.get` as the sole parameter contract. It already composes the definition's `commonModules` with `strategyConfigSchema` and may contain definition-specific customization. Walk every applicable parameter, not only required fields or familiar knobs.
@@ -61,7 +63,7 @@ The human confirms the complete parameter set. You write JSON only after that re
    A user override always wins, even when it equals neither default. Preserve explicit `false`, `0`, empty arrays, and empty strings when the schema allows them; they are not missing values.
 
 6. When there are many parameters, present them in logical groups or numbered chunks so the review remains readable. After all groups are visible, ask the operator to reply **confirm all** / “全部确认”, or override paths/numbers. One overall confirmation is sufficient, but it must cover every displayed parameter. Apply overrides, show the affected rows again, and repeat until no required value is unresolved and the operator explicitly confirms the final proposal.
-7. An earlier request such as “创建策略”, “运行回测”, or a pasted command/config is input to the proposal, not confirmation of the review. Do not validate, create, or backtest until the complete parameter review is explicitly confirmed.
+7. A generic creation request is not approval of undisclosed execution settings. Obtain final approval before creating/starting a trader. Inspection, config validation and requested local backtests may proceed without this execution review; changing the approved execution parameters or environment requires renewed approval.
 8. Write `strategy-config.json` as the trader object:
 
 ```json
@@ -94,7 +96,7 @@ alphafox trading strategy_definitions byId validate_config --definitionId <id> -
 
 `body_schema` / `body_schema_missing` (exit `64`): re-read the operation schema. Server field-path errors: fix that path. Do not retry with a different envelope.
 
-After it validates: create with `alphafox-trading` (default `autoStart: true`), or backtest with `alphafox-engine-backtest`. Do not create or backtest from this skill. Dashboard URLs after those actions live in `alphafox-shared`.
+Validation-only work is complete with the result and any field errors. Continue to `alphafox-trading` or `alphafox-engine-backtest` only if the user requested that action; validation alone does not authorize creation/start or persisted work. Preserve the trading Skill’s execution approval. Dashboard URLs after requested actions live in `alphafox-shared`.
 
 ## operationIds
 

package/skills/trading/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-trading
 description: Running strategies (traders) — create, list, start, and stop. A trader is a live or paper strategy instance (grid, dca, copy, …), not a person. Default Engine create uses autoStart true (创建即开始). Use autoStart false only when the user asks to create without starting. After create or start, include https://www.alphafox.app/zh/dashboard/traders/{traderId}.
-version: 0.3.22
+version: 0.3.24
 ---
 
 # Running strategies (traders)
@@ -32,7 +32,7 @@ alphafox api GET /api/v1/trading/traders --format json --no-input
 
 Read `alphafox schema <operationId>` first. Body may only include documented `request.body` fields. Large / nested bodies use `--config @file`.
 
-Before composing or dry-running any create request, follow the complete parameter review in `alphafox-strategy`, including when the operator already supplied a config. Do not create a trader until every applicable parameter, default status, short explanation, proposed value, and value source has been shown and the operator explicitly confirms the final proposal. User overrides win; unresolved required values stop the flow.
+Before executing create, follow the complete execution-parameter review in `alphafox-strategy`, including supplied configs. JSON preparation, validation and dry-run may precede approval. Reuse the confirmed proposal while parameters and environment are unchanged; obtain approval for any changed execution settings. User overrides win; resolve required values before create. Do not create merely because validation succeeded.
 
 ```bash
 alphafox schema trading.traders.create --format json --no-input