@alphafox/cli 0.3.7 → 0.3.8

package/dist/auth/refresh.d.ts

@@ -8,6 +8,8 @@ import type { ProfileConfig } from "../config/profiles";
 import { type StoredTokens } from "../keychain/store";
 /** Refresh when access token expires within this window. */
 export declare const ACCESS_TOKEN_REFRESH_SKEW_MS = 60000;
+/** Drop a stale inter-process refresh lock after this long. */
+export declare const REFRESH_LOCK_STALE_MS = 30000;
 export type RefreshOutcome = {
     readonly status: "refreshed";
     readonly tokens: StoredTokens;
@@ -40,5 +42,6 @@ export declare function refreshStoredTokensOrNull(profile: ProfileConfig, env?:
     readonly now?: number;
     readonly force?: boolean;
 }): Promise<StoredTokens | null>;
+export declare function refreshLockFilePath(profile: string, env?: NodeJS.ProcessEnv): string;
 /** Test helper: clear in-flight map between cases. */
 export declare function clearRefreshInflightForTests(): void;

package/dist/auth/refresh.js

@@ -6,15 +6,21 @@
  * Outcomes are explicit: callers must not treat a failed refresh as a healthy session.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ACCESS_TOKEN_REFRESH_SKEW_MS = void 0;
+exports.REFRESH_LOCK_STALE_MS = exports.ACCESS_TOKEN_REFRESH_SKEW_MS = void 0;
 exports.accessTokenNeedsRefresh = accessTokenNeedsRefresh;
 exports.refreshStoredTokens = refreshStoredTokens;
 exports.refreshStoredTokensOrNull = refreshStoredTokensOrNull;
+exports.refreshLockFilePath = refreshLockFilePath;
 exports.clearRefreshInflightForTests = clearRefreshInflightForTests;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
 const version_1 = require("../version");
 const store_1 = require("../keychain/store");
 /** Refresh when access token expires within this window. */
 exports.ACCESS_TOKEN_REFRESH_SKEW_MS = 60_000;
+/** Drop a stale inter-process refresh lock after this long. */
+exports.REFRESH_LOCK_STALE_MS = 30_000;
 /** In-flight refresh promises so concurrent API calls share one rotation. */
 const inflightByProfile = new Map();
 function accessTokenNeedsRefresh(tokens, now = Date.now()) {
@@ -36,20 +42,38 @@ async function refreshStoredTokens(profile, env = process.env, fetchImpl = fetch
             tokens: null,
         };
     }
-    if (!options.force &&
-        !accessTokenNeedsRefresh(existing, options.now ?? Date.now())) {
+    const now = options.now ?? Date.now();
+    if (!options.force && !accessTokenNeedsRefresh(existing, now)) {
         return { status: "unchanged", tokens: existing };
     }
-    const key = profile.name;
-    const pending = inflightByProfile.get(key);
-    if (pending) {
-        return pending;
-    }
-    const work = performRefresh(profile, existing, env, fetchImpl).finally(() => {
-        inflightByProfile.delete(key);
+    return withRefreshLock(profile.name, env, async () => {
+        const latest = (0, store_1.loadTokens)(profile.name, env) ?? existing;
+        if (!latest?.refreshToken?.trim()) {
+            return {
+                status: "no_session",
+                reason: "no_refresh_token",
+                tokens: null,
+            };
+        }
+        const someoneElseRefreshed = latest.refreshToken !== existing.refreshToken ||
+            latest.expiresAt > existing.expiresAt;
+        if (someoneElseRefreshed && !accessTokenNeedsRefresh(latest, now)) {
+            return { status: "unchanged", tokens: latest };
+        }
+        if (!options.force && !accessTokenNeedsRefresh(latest, now)) {
+            return { status: "unchanged", tokens: latest };
+        }
+        const key = profile.name;
+        const pending = inflightByProfile.get(key);
+        if (pending) {
+            return pending;
+        }
+        const work = performRefresh(profile, latest, env, fetchImpl).finally(() => {
+            inflightByProfile.delete(key);
+        });
+        inflightByProfile.set(key, work);
+        return work;
     });
-    inflightByProfile.set(key, work);
-    return work;
 }
 /**
  * Convenience for callers that only need tokens on successful refresh/unchanged.
@@ -62,6 +86,68 @@ async function refreshStoredTokensOrNull(profile, env = process.env, fetchImpl =
     }
     return null;
 }
+function refreshLockFilePath(profile, env = process.env) {
+    const base = env.ALPHAFOX_KEYCHAIN_DIR?.trim() ||
+        (0, node_path_1.join)((0, node_os_1.homedir)(), ".config", "alphafox", "keychain");
+    return (0, node_path_1.join)(base, `${profile}.refresh.lock`);
+}
+async function withRefreshLock(profile, env, work) {
+    const path = refreshLockFilePath(profile, env);
+    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(path), { recursive: true });
+    const started = Date.now();
+    while (true) {
+        try {
+            const fd = (0, node_fs_1.openSync)(path, node_fs_1.constants.O_CREAT | node_fs_1.constants.O_EXCL | node_fs_1.constants.O_WRONLY);
+            try {
+                (0, node_fs_1.writeFileSync)(fd, `${process.pid}\n${Date.now()}\n`);
+            }
+            finally {
+                (0, node_fs_1.closeSync)(fd);
+            }
+            try {
+                return await work();
+            }
+            finally {
+                try {
+                    (0, node_fs_1.unlinkSync)(path);
+                }
+                catch {
+                    // another process stole a stale lock
+                }
+            }
+        }
+        catch (err) {
+            const code = err.code;
+            if (code !== "EEXIST") {
+                throw err;
+            }
+            try {
+                if (Date.now() - (0, node_fs_1.statSync)(path).mtimeMs > exports.REFRESH_LOCK_STALE_MS) {
+                    (0, node_fs_1.unlinkSync)(path);
+                    continue;
+                }
+            }
+            catch {
+                // lock disappeared; retry acquire
+            }
+            if (Date.now() - started > exports.REFRESH_LOCK_STALE_MS + 5_000) {
+                try {
+                    (0, node_fs_1.unlinkSync)(path);
+                }
+                catch {
+                    // raced
+                }
+                continue;
+            }
+            await sleep(50);
+        }
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
 async function performRefresh(profile, existing, env, fetchImpl) {
     const origin = profile.apiBaseUrl.replace(/\/$/, "").replace(/\/api\/v1$/, "");
     const url = `${origin}/api/auth/oauth/token`;

package/dist/commands/run.js

@@ -9,6 +9,7 @@ const allowlist_1 = require("../catalog/allowlist");
 const profiles_1 = require("../config/profiles");
 const envelope_1 = require("../envelope");
 const browser_login_1 = require("../auth/browser-login");
+const refresh_1 = require("../auth/refresh");
 const client_1 = require("../http/client");
 const store_1 = require("../keychain/store");
 const confirmation_1 = require("../safety/confirmation");
@@ -351,15 +352,30 @@ async function cmdAuth(args, flags, env) {
     });
     if (sub === "status") {
         const verify = args.includes("--verify");
-        const tokens = (0, store_1.loadTokens)(profile.name, env);
+        let tokens = (0, store_1.loadTokens)(profile.name, env);
         if (!tokens) {
             (0, envelope_1.writeSuccess)({
                 authenticated: false,
+                session: "none",
                 profile: profile.name,
                 verified: false,
+                refresh: "no_session",
+                accessTokenExpired: null,
+                hasRefreshToken: false,
             }, { format: flags.format, jq: flags.jq });
             return 0;
         }
+        let refresh = "skipped";
+        if ((0, refresh_1.accessTokenNeedsRefresh)(tokens)) {
+            const outcome = await (0, refresh_1.refreshStoredTokens)(profile, env);
+            refresh = outcome.status;
+            if (outcome.status === "refreshed" || outcome.status === "unchanged") {
+                tokens = outcome.tokens;
+            }
+            else {
+                tokens = (0, store_1.loadTokens)(profile.name, env) ?? tokens;
+            }
+        }
         let verified = null;
         let whoami = null;
         if (verify) {
@@ -370,9 +386,18 @@ async function cmdAuth(args, flags, env) {
             }, env);
             verified = res.status >= 200 && res.status < 300;
             whoami = verified ? res.json : { status: res.status, body: res.json };
+            tokens = (0, store_1.loadTokens)(profile.name, env) ?? tokens;
         }
+        const accessTokenExpired = tokens.expiresAt <= Date.now();
+        const hasRefreshToken = Boolean(tokens.refreshToken?.trim());
+        const session = !accessTokenExpired
+            ? "active"
+            : refresh === "failed"
+                ? "refresh_failed"
+                : "expired";
         (0, envelope_1.writeSuccess)({
-            authenticated: true,
+            authenticated: session === "active",
+            session,
             profile: profile.name,
             environment: tokens.environment,
             issuer: tokens.issuer,
@@ -381,6 +406,9 @@ async function cmdAuth(args, flags, env) {
             scopes: tokens.scopes,
             accessTokenFingerprint: (0, store_1.tokenFingerprint)(tokens.accessToken),
             expiresAt: tokens.expiresAt,
+            accessTokenExpired,
+            hasRefreshToken,
+            refresh,
             verified,
             whoami,
         }, { format: flags.format, jq: flags.jq });

package/dist/skills-manifest.json

@@ -1,141 +1,141 @@
 {
   "schemaVersion": 1,
   "packageName": "@alphafox/cli",
-  "packageVersion": "0.3.7",
+  "packageVersion": "0.3.8",
   "contractVersion": "2026-08-13",
-  "bundleHash": "e12e1922538778707e60e931a247ecebb3e028cefeba295f4ca299d8d82d661b",
+  "bundleHash": "cd05f4eb6f9e1a7c9188ac5770196698c6f2c9ff6aaebfbfbaba3581ef08d226",
   "skills": [
     {
       "name": "alphafox",
-      "version": "0.3.7",
+      "version": "0.3.8",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "2cd53898008075e68afd8ce955b63cf61f2971ef28f6c13c41853b1c5de967c8",
+          "sha256": "e8eadf96f36f6aa124b36d15a912465e839389e5228dbf9dfd9ad2f1ec86f65a",
           "size": 3553
         }
       ],
-      "hash": "d687ecf8cc366e26dcb535bf31a30faceb037f021c818fa24997d144a22d3c20"
+      "hash": "fb41a55fcd363231cb69e30e4c0fe7b1ad2e17b12e2bb90cfda7d6e9ccd2f02c"
     },
     {
       "name": "alphafox-account",
-      "version": "0.3.7",
+      "version": "0.3.8",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "fc5675dc44494227679994b761ca2e014d36acc207c68e3fb6d833912a7644ee",
+          "sha256": "9925573bf644b998ea683df7a20276a835d33cb83b0548ee0d1c43429ad99582",
           "size": 783
         }
       ],
-      "hash": "bc1352e9d352f313f69f5257ba351137778c3ee1d8714d2d80fc39c0824c5cec"
+      "hash": "934bcd76d1bea875324673ffcc3d1c52e3f4065f776c4958ffc230cf911bac21"
     },
     {
       "name": "alphafox-admin",
-      "version": "0.3.7",
+      "version": "0.3.8",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "6594e6cbfd319a41ae3abf9bf4f8239bb42bc25e6eec295999fe39cd694b2b8b",
+          "sha256": "e9ae0b433cead54e9c284f0ea8859dd9e96123f842788938319404b96bc085e7",
           "size": 787
         }
       ],
-      "hash": "d6c5573444a020f376d51a73d44f39da9de8ea20bfd160f838b0de01bbb5e798"
+      "hash": "1346e798f18582c16cfbb887667272406f170e775d3027131d3d88e1f1a656e3"
     },
     {
       "name": "alphafox-auth",
-      "version": "0.3.7",
+      "version": "0.3.8",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "b7b2694cbcf6e784d89943950435cb34454309cfbe07e383cc028a435dfec77d",
-          "size": 1919
+          "sha256": "8ec9f081d9a1d40606ac7c18cba5dae9f1b6144ddc0079005b16af54be8f2f46",
+          "size": 2370
         }
       ],
-      "hash": "aa7e2a39058660c4c803ed6e1bed94da0559aa943998336d6f0c83d8930a1d9d"
+      "hash": "854910a6792aa6d0a8b9cd796afb41753a34cef79df95c5b50de432f03a4e67a"
     },
     {
       "name": "alphafox-engine-backtest",
-      "version": "0.3.7",
+      "version": "0.3.8",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "e09e938c9dd90d0be156b2d8bd83ba854c4d1a190a1b4aa575ca67db70184ebc",
+          "sha256": "e5f37b8541c510a27f84cbf9eea7524efe0b8f9c60c4faf17521b6cac298f92b",
           "size": 7584
         }
       ],
-      "hash": "91de2131ffde0b9fef16221d5589a8c430ae48ddfc4f2dc781d510b9d4c90532"
+      "hash": "efb614f145763f514c33d02e112657bd42868cc746f13dbcb3cceaa0ecb770e4"
     },
     {
       "name": "alphafox-exchange",
-      "version": "0.3.7",
+      "version": "0.3.8",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "53cba327c5507266b4dca7193fad67ba33c0c7bb745be41fd194425b9ef5928e",
+          "sha256": "118141754916741f4f8b449cf307a89cdfa11f234302726ba4d6b58e396327b5",
           "size": 743
         }
       ],
-      "hash": "910f451fc7939926cfbeee27ee72f2aae86fcdd78f343e9f02c30df105ac6480"
+      "hash": "3933f12a2d8c55db465d4a11cf1f7d40f90fff81b3931f398e2fe3bcaf064d62"
     },
     {
       "name": "alphafox-market",
-      "version": "0.3.7",
+      "version": "0.3.8",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "6589628478dc9c98c20479a2ffdded4014ce71b9c488dd386a606fef25a37d26",
+          "sha256": "0e77dcc697fe60f742e1075986685db5018d9d659a4d8f44f9cc343117c1c74b",
           "size": 3078
         }
       ],
-      "hash": "84d243b7c53c519cba34c8c487ba23eae60bde8440c4dcfff06e20efd63c07fa"
+      "hash": "710c45c6124583d3fa9c9584f67bbc665bad35c9e6d1294c7416f493b8a6b184"
     },
     {
       "name": "alphafox-notification",
-      "version": "0.3.7",
+      "version": "0.3.8",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "8b985ff7f33696eb11427147cd021d32654f525eea54f8098f368e8750a59381",
+          "sha256": "712aa6a4de8090bb7ee57373d35dd95c62bad7a24e443747afa4f11fb6e79b68",
           "size": 698
         }
       ],
-      "hash": "1f316dc3fe251699b3f90102cbc16cb4fbd3a3c5c07b923297c075fe2e73a4b3"
+      "hash": "5f2feef0e17912a593bafae0961f983e3f781d12800e4808c136004897321ab2"
     },
     {
       "name": "alphafox-shared",
-      "version": "0.3.7",
+      "version": "0.3.8",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "3aac1ab46a759a2c6748516936f886ec028e680bff7deb3ff1abc51af99ed18a",
-          "size": 5163
+          "sha256": "c6bab01f9c8369f9c2a29eebf7b46462887f14d3bec7ad00e2a159d395346508",
+          "size": 5385
         }
       ],
-      "hash": "72a7255ab23ff7c1adf41b1ff2e22834d1b58ee9e2ccea990c64f9277bf8b0a3"
+      "hash": "2b78fe080877af19b659964a8c965720e5ab731dd157ced10d2ee598b8c574a0"
     },
     {
       "name": "alphafox-strategy",
-      "version": "0.3.7",
+      "version": "0.3.8",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "1ef2a00dd1c74922a3d0248041813609fc58701e7857bb069cbed511b0c46168",
+          "sha256": "03f1d1c6d048d7b0a23d725c6585d1d019445579be9779dc93095ebafb3fcf5a",
           "size": 1826
         }
       ],
-      "hash": "44c2bf74ff053977f3a8631115ebf868af7cff33856e0c6a4fe55080049c1ae1"
+      "hash": "ebf375c6eeaf13c971a3090d05beda7037f253325ee2236c35b26ad540922827"
     },
     {
       "name": "alphafox-trading",
-      "version": "0.3.7",
+      "version": "0.3.8",
       "files": [
         {
           "path": "SKILL.md",
-          "sha256": "db065fcc272e66d091cfe7469317d7911946f96094f475f64d34d201c392424c",
+          "sha256": "4b597f23ff6c8ce384e8fd56fab73c6128d373741285bac6df0b061e7ee50242",
           "size": 3122
         }
       ],
-      "hash": "af36dc51e47ca91cb4a2f5ca78e03e17f003ee47b5354cef42947f401fbe48c0"
+      "hash": "d7e818482ec3ba9aeab50af72e72f990288f0e2e6714e1227cba441db05fa75a"
     }
   ]
 }

package/dist/version.d.ts

@@ -1,4 +1,4 @@
 export declare const CLI_NAME = "alphafox";
 export declare const CLI_PACKAGE = "@alphafox/cli";
-export declare const CLI_VERSION = "0.3.7";
+export declare const CLI_VERSION = "0.3.8";
 export { CATALOG_VERSION as CLI_CONTRACT_VERSION } from "./catalog/operations";

package/dist/version.js

@@ -3,6 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CLI_CONTRACT_VERSION = exports.CLI_VERSION = exports.CLI_PACKAGE = exports.CLI_NAME = void 0;
 exports.CLI_NAME = "alphafox";
 exports.CLI_PACKAGE = "@alphafox/cli";
-exports.CLI_VERSION = "0.3.7";
+exports.CLI_VERSION = "0.3.8";
 var operations_1 = require("./catalog/operations");
 Object.defineProperty(exports, "CLI_CONTRACT_VERSION", { enumerable: true, get: function () { return operations_1.CATALOG_VERSION; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alphafox/cli",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "AlphaFox CLI — Agent/Human entry for the public Application API.",
   "type": "commonjs",
   "bin": {

package/skills/account/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-account
 description: Account, wallet, and subscription read paths.
-version: 0.3.7
+version: 0.3.8
 ---
 
 # Account / wallet

package/skills/admin/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-admin
 description: Admin-only operations reusing Web role authorization.
-version: 0.3.7
+version: 0.3.8
 ---
 
 # Admin

package/skills/alphafox/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox
 description: AlphaFox CLI entry router. Use for any AlphaFox request — install, update, login, whoami, 回测, engine backtest, strategy definitions, create/list/start/stop a running strategy (trader), ticker/标的 resolve (美股 or crypto), market data, exchange connectors, wallet, subscriptions, notifications, or admin. If a CLI command prints `[alphafox] update available`, ask the user「检测到新的版本，是否需要我帮你升级？」and only then run `alphafox update --format json --no-input`. Start here, then open the routed domain skill. Do not guess alphafox-engine-backtest vs alphafox-strategy vs alphafox-trading from memory.
-version: 0.3.7
+version: 0.3.8
 ---
 
 # AlphaFox
@@ -36,7 +36,7 @@ If several rows apply, load **all** of them (typical: `alphafox-shared` + `alpha
 The CLI may print this on **stderr** at most once every 24 hours:
 
 ```text
-[alphafox] update available: 0.3.6 -> 0.3.7. After the user confirms, run: alphafox update --format json --no-input,
+[alphafox] update available: 0.3.7 -> 0.3.8. After the user confirms, run: alphafox update --format json --no-input,
 ```
 
 If you see that notice (or `updateAvailable: true` from `alphafox update --check`):

package/skills/alphafox-shared/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-shared
 description: Shared AlphaFox CLI rules for Agents — auth, profiles, envelopes, risk gates, and public operationIds only.
-version: 0.3.7
+version: 0.3.8
 ---
 
 # AlphaFox shared Agent contract
@@ -67,9 +67,10 @@ alphafox auth login --no-wait --format json --no-input
 # show verification_uri / user_code to the human, then:
 alphafox auth login --device-code <device_code> --format json --no-input
 alphafox auth status --verify --format json --no-input
-alphafox whoami --format json --no-input
 ```
 
+Access tokens last ~10 minutes; the CLI refreshes them. After idle, run **one** `auth status --verify` — not `whoami` in parallel. `session: active` means logged in. A past `expiresAt` is not logout. Re-login only when `session` is `none` or `refresh_failed`.
+
 Local browser: `alphafox auth login --browser --format json --no-input` (loopback 127.0.0.1). If the browser cannot open, copy `authorizeUrl` from the error; do not invent a Device Flow retry unless the operator is headless.
 
 Wrong environment / missing permission / missing `--yes`: stop. Do not retry with a different profile.

package/skills/auth/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-auth
 description: Login, status, logout, whoami, and environment isolation for AlphaFox CLI.
-version: 0.3.7
+version: 0.3.8
 ---
 
 # Auth Skill
@@ -19,23 +19,26 @@ Always `--format json --no-input`. Never `--token`.
 1. `alphafox auth login --no-wait --format json --no-input`
 2. Present `verification_uri` / `user_code` to the human.
 3. After approval: `alphafox auth login --device-code <device_code> --format json --no-input`
-4. `alphafox whoami --format json --no-input` / `alphafox auth status --verify --format json --no-input`
+4. `alphafox auth status --verify --format json --no-input` (do not also run `whoami` in parallel)
 
 ### Browser loopback (human, local machine)
 
 1. `alphafox auth login --browser --format json --no-input`
 2. CLI binds `127.0.0.1` and opens the system browser. Do not copy codes or verifiers.
-3. After the localhost callback, `alphafox whoami` / `alphafox auth status --verify`
+3. After the localhost callback, `alphafox auth status --verify --format json --no-input`
 4. If the browser cannot open, the error includes a copyable `authorizeUrl`. Do not retry as Device Flow unless the human is headless.
 
 ### Status / logout
 
-- `alphafox auth status --verify --format json --no-input`
+- `alphafox auth status --verify --format json --no-input` is enough. Do **not** also run `whoami` in parallel — concurrent refresh can kill the session.
+- Access tokens last ~10 minutes. The CLI refreshes them automatically. A past `expiresAt` is **not** logout.
+- Logged in: `session` is `active` (or `authenticated: true` after status). Re-login only when `session` is `none` or `refresh_failed`.
 - `alphafox auth logout --format json --no-input` (server revoke + local keychain clear). If `remoteRevoke` is `failed`, local tokens are still cleared but exit is non-zero — do not claim a full logout.
 
 ### Recovery
 
-- `401` / `expired_token`: re-run Device Flow or browser login. Do not reuse a token from another profile.
+- `session: refresh_failed` / refresh grant `invalid_grant`: re-run Device Flow or browser login. Do not reuse a token from another profile.
+- Do not treat a short idle or an expired access token as a missing login.
 - Cross-env: production tokens are rejected on staging/local. Switch `--profile` only with explicit operator intent.
 
 ## Safety

package/skills/engine-backtest/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-engine-backtest
 description: Local Engine WASM backtest (alphafox engine-backtest run|sweep) vs catalog experiment CRUD.
-version: 0.3.7
+version: 0.3.8
 ---
 
 # Engine Backtest

package/skills/exchange/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-exchange
 description: Exchange connectors list and connection management via Public API.
-version: 0.3.7
+version: 0.3.8
 ---
 
 # Exchange connectors

package/skills/market/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-market
 description: Market data and ticker resolution for US equity perps, RWAs, and crypto on the same perp catalog. Use when the user names 美股, NVDA, AAPL, BTC, or any 标的. Keep the operator's asset class via symbolMetadata — do not rewrite NVDA into a crypto coin.
-version: 0.3.7
+version: 0.3.8
 ---
 
 # Market

package/skills/notification/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-notification
 description: Notification channels and subscriptions.
-version: 0.3.7
+version: 0.3.8
 ---
 
 # Notification

package/skills/strategy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-strategy
 description: Strategy definitions — list types (grid, dca, copy, …) and validate config. Creating a running strategy is creating a trader; use alphafox-trading for that.
-version: 0.3.7
+version: 0.3.8
 ---
 
 # Strategy definitions

package/skills/trading/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: alphafox-trading
 description: Running strategies (traders) — create, list, start, and stop. A trader is a live or paper strategy instance (grid, dca, copy, …), not a person.
-version: 0.3.7
+version: 0.3.8
 ---
 
 # Running strategies (traders)