@chongqingliangyunzhijing/ssquant-cli 0.0.0-stage → 0.2.0

package/src/commands/mandate.js

@@ -0,0 +1,92 @@
+/**
+ * 交易授权边界。
+ *
+ * OAuth 登录后服务端会自动启用默认交易授权：全部合约、双向交易，
+ * 不要求用户填写白名单或额度。show 仅用于查看状态；create/revoke 保留为
+ * 兼容和紧急运维命令，正常安装和交易不需要用户执行。
+ */
+import readline from 'node:readline/promises';
+import { request } from '../http.js';
+import { emit, kv, num, pct, say, table } from '../output.js';
+
+export async function show() {
+  const { data } = await request('/mandate');
+  emit(data);
+  if (data.mode === 'automatic') {
+    say('  ✓ 安装流程已自动启用交易授权');
+    say('  范围：全部合约、双向交易；不设用户侧手数、日委托和持仓白名单');
+    say(`  失效时间：${data.expiresAt}`);
+    return;
+  }
+  if (!data.active && !data.expired && data.message) {
+    say(`  ✗ ${data.message}`);
+    if (data.suggestion) say(`  建议：${data.suggestion}`);
+    return;
+  }
+  kv([
+    ['状态', data.frozen ? `已冻结（${data.frozenReason}）`
+      : data.expired ? '已过期' : (data.active ? '✓ 生效中' : '未生效')],
+    ['合约白名单', (data.symbols || []).join(', ')],
+    ['方向', { long: '只做多', short: '只做空', both: '双向' }[data.direction] || data.direction],
+    ['单笔上限', `${data.maxVolumePerOrder} 手`],
+    ['日委托上限', `${data.maxOrdersPerDay} 笔（今日已用 ${data.usedOrdersToday}，剩 ${data.remainingOrdersToday ?? '-'}）`],
+    ['持仓上限', `${data.maxPosition} 手`],
+    ['保证金占用上限', data.maxMarginRatio ? pct(data.maxMarginRatio) : '不限'],
+    ['止损线', data.stopLossEquity ? `回撤 ${pct(data.stopLossEquity)} 冻结授权` : '未设'],
+    ['失效时间', data.expiresAt],
+  ]);
+}
+
+export async function create(opts) {
+  const symbols = String(opts.symbols || '').split(',').map((s) => s.trim()).filter(Boolean);
+  if (!symbols.length) {
+    const e = new Error('必须用 --symbols 指定允许交易的合约');
+    e.code = 'invalid_request';
+    e.suggestion = '例：--symbols rb2610,au2512。请使用SSQUANT 提供的实际可交易合约代码';
+    throw e;
+  }
+
+  const body = {
+    symbols,
+    direction: opts.direction || 'both',
+    maxVolumePerOrder: Number(opts.maxVolumePerOrder),
+    maxOrdersPerDay: Number(opts.maxOrdersPerDay),
+    maxPosition: Number(opts.maxPosition),
+    maxMarginRatio: opts.maxMarginRatio === undefined ? null : Number(opts.maxMarginRatio),
+    stopLossEquity: opts.stopLoss === undefined ? null : Number(opts.stopLoss),
+    expiresAt: opts.expires,
+  };
+
+  if (!opts.yes && process.stdin.isTTY) {
+    say('即将声明以下交易授权边界（Agent 将在此范围内自主下单）：');
+    kv([
+      ['合约白名单', symbols.join(', ')],
+      ['方向', body.direction],
+      ['单笔上限', `${body.maxVolumePerOrder} 手`],
+      ['日委托上限', `${body.maxOrdersPerDay} 笔`],
+      ['持仓上限', `${body.maxPosition} 手`],
+      ['保证金占用上限', body.maxMarginRatio ? pct(body.maxMarginRatio) : '不限'],
+      ['止损线', body.stopLossEquity ? pct(body.stopLossEquity) : '未设'],
+      ['失效时间', body.expiresAt],
+    ]);
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const ans = await rl.question('确认声明？(yes/N) ');
+    rl.close();
+    if (!/^y(es)?$/i.test(ans.trim())) {
+      say('已取消，授权未变更。');
+      return;
+    }
+  }
+
+  const { data } = await request('/mandate', { method: 'POST', body });
+  emit(data);
+  say('  ✓ 授权已生效');
+  kv([['合约白名单', (data.symbols || []).join(', ')],
+      ['失效时间', data.expiresAt]]);
+}
+
+export async function revoke() {
+  const { data } = await request('/mandate', { method: 'DELETE' });
+  emit(data);
+  say(`  ${data.revoked ? '✓' : 'ℹ'} ${data.message}`);
+}

package/src/commands/plan.js

@@ -0,0 +1,66 @@
+/** 冻结交易计划与操作状态。 */
+import { request } from '../http.js';
+import { emit, kv, say, table } from '../output.js';
+import { showQuote } from './account.js';
+
+function parseJson(text, label) {
+  try { return JSON.parse(text || '{}'); } catch {
+    const err = new Error(`${label} 必须是合法 JSON`); err.code = 'invalid_request'; throw err;
+  }
+}
+
+export async function create(opts) {
+  const parameters = parseJson(opts.parameters, '--parameters');
+  const { data } = await request('/futures/plans', {
+    method: 'POST', body: { operation: opts.operation, parameters },
+  });
+  emit(data);
+  kv([['计划号', data.planId], ['操作', data.operation], ['摘要', data.summary],
+    ['状态', data.status], ['有效期', data.expiresAt]]);
+  if (data.marketQuote) showQuote(data.marketQuote);
+  table(['合约/订单', '方向', '手数'], (data.legs || []).map((leg) => [
+    leg.contractCode || leg.orderId || '-', `${leg.side || ''}/${leg.offset || ''}`,
+    leg.volume ?? leg.quantity ?? '-',
+  ]));
+  if (data.status === 'prepared') say(data.tradeMode === 'direct'
+    ? '当前为直接交易模式，可用 plan execute 执行本计划。'
+    : '请展示本计划，用户明确确认后用 plan execute --yes 执行。');
+}
+
+export async function show(planId) {
+  const { data } = await request(`/futures/plans/${encodeURIComponent(planId)}`);
+  emit(data);
+  kv([['计划号', data.planId], ['操作', data.operation], ['摘要', data.summary],
+    ['状态', data.status], ['操作号', data.operationId || '-']]);
+}
+
+export async function execute(planId, opts) {
+  const { data } = await request(`/futures/plans/${encodeURIComponent(planId)}/execute`, {
+    method: 'POST', body: { confirmed: !!opts.yes, clientRequestId: opts.clientRequestId },
+  });
+  emit(data);
+  kv([['操作号', data.operationId], ['计划号', data.planId], ['状态', data.status],
+    ['下一步', data.nextAction?.code || 'none']]);
+}
+
+export async function operationShow(operationId) {
+  const { data } = await request(`/futures/operations/${encodeURIComponent(operationId)}`);
+  emit(data);
+  kv([['操作号', data.operationId], ['计划号', data.planId], ['操作', data.operation],
+    ['状态', data.status], ['下一步', data.nextAction?.code || 'none']]);
+}
+
+export async function operationWatch(operationId, opts) {
+  const interval = Number(opts.interval || 2);
+  if (interval < 1) {
+    const err = new Error('操作轮询间隔不能小于 1 秒'); err.code = 'invalid_request'; throw err;
+  }
+  const maxPolls = Number(opts.maxPolls || 10);
+  for (let i = 0; i < maxPolls; i += 1) {
+    const { data } = await request(`/futures/operations/${encodeURIComponent(operationId)}`);
+    emit(data);
+    kv([['操作号', data.operationId], ['状态', data.status], ['下一步', data.nextAction?.code || 'none']]);
+    if (!data || ['completed', 'partial', 'failed', 'expired', 'unknown'].includes(data.status)) return;
+    if (i + 1 < maxPolls) await new Promise((resolve) => setTimeout(resolve, interval * 1000));
+  }
+}

package/src/commands/sim.js

@@ -0,0 +1,45 @@
+import readline from 'node:readline/promises';
+import { randomUUID } from 'node:crypto';
+import { request } from '../http.js';
+import { emit, say, isJson } from '../output.js';
+import { persist } from '../auth.js';
+
+function show(data) { emit(data); say(JSON.stringify(data, null, 2)); }
+
+async function ask(message) {
+  if (!process.stdin.isTTY || isJson()) throw Error('非交互模式请提供金额和 --yes 确认参数');
+  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+  try { return (await rl.question(message)).trim(); } finally { rl.close(); }
+}
+export function amount(text) {
+  if (!/^\d{1,5}(?:\.\d{1,6})?$/.test(text)) throw Error('请输入 1 至 10000 万元，精确到人民币分');
+  const [whole, fraction = ''] = text.split('.');
+  const fen = BigInt(whole) * 1000000n + BigInt(fraction.padEnd(6, '0'));
+  if (fen < 1000000n || fen > 10000000000n) throw Error('初始资金须在 1 至 10000 万元之间');
+  return (fen / 100n).toString() + '.' + (fen % 100n).toString().padStart(2, '0');
+}
+export async function list() { show((await request('/sim/accounts')).data); }
+export async function create(opts) {
+  const value = opts.capitalWan ?? await ask('请输入初始资金（万元）：');
+  const yuan = amount(value);
+  if (!opts.yes && !/^y(es)?$/i.test(await ask(`初始资金 ${value} 万元（${yuan} 元），确认开户？[y/N] `))) return;
+  const key = opts.requestId || randomUUID();
+  try {
+    show((await request('/sim/accounts', { method:'POST', body:{ initialCapitalWan:value, clientRequestId:key } })).data);
+  } catch (error) {
+    error.suggestion = `若开户结果未知，请复用 --request-id ${key} 及原金额查询或重试。`;
+    throw error;
+  }
+}
+export async function use(id) {
+  const { data } = await request('/sim/accounts/' + encodeURIComponent(id) + '/select', { method:'POST' });
+  persist(data);
+  show({ accountId:id });
+}
+export async function remove(id, opts) {
+  if (!opts.yes && !/^y(es)?$/i.test(await ask(`确认删除 ${id} 并释放名额？柜台已有委托仍可能成交。[y/N] `))) return;
+  show((await request('/sim/accounts/' + encodeURIComponent(id), { method:'DELETE' })).data);
+}
+export async function status(id) { show((await request('/sim/operations/' + encodeURIComponent(id))).data); }
+export async function equity() { show((await request('/futures/equity')).data); }
+export async function settlement(opts) { show((await request('/futures/settlement' + (opts.date ? '?tradeDate=' + encodeURIComponent(opts.date) : ''))).data); }

package/src/commands/system.js

@@ -0,0 +1,25 @@
+import { loginBrowser } from '../auth.js';
+import { clearCredentials } from '../config.js';
+import { request, requestAnon } from '../http.js';
+import { emit, say } from '../output.js';
+
+export async function login() {
+  const info = await loginBrowser();
+  emit({ authenticated: true, accountId: info.accountId || null });
+  say('已登录 PandaAI。运行 ssquant account list 查看账户和名额。');
+}
+export function logout() {
+  clearCredentials();
+  emit({ authenticated: false });
+  say('已清除本机 SSQUANT 凭证。');
+}
+export async function whoami() {
+  const { data } = await request('/whoami');
+  emit(data);
+  say(JSON.stringify(data));
+}
+export async function doctor() {
+  const { data } = await requestAnon('/health', { method: 'GET' });
+  emit(data);
+  say('SSQUANT OpenAPI 已就绪。');
+}

package/src/commands/trade-mode.js

@@ -0,0 +1,31 @@
+import { request } from '../http.js';
+import { emit, isJson, say } from '../output.js';
+
+const path = '/settings/trade-mode';
+
+function display(data) {
+  emit(data);
+  say(data.mode === 'direct' ? '当前为直接交易模式。' : '当前为逐笔确认模式。');
+}
+
+export async function show() {
+  display((await request(path)).data);
+}
+
+export async function set(mode) {
+  if (!['confirm', 'direct'].includes(mode)) throw Error('模式必须为 confirm 或 direct');
+  display((await request(path, { method: 'PUT', body: { mode } })).data);
+}
+
+// 跳过提示不等同于用户确认，直接模式执行仍向服务端发送 confirmed=false。
+export async function needsPrompt(opts, mode) {
+  if (opts.yes) return false;
+  const current = mode ?? (await request(path)).data.mode;
+  if (current === 'direct') return false;
+  if (!process.stdin.isTTY || isJson()) {
+    const error = new Error('当前为逐笔确认模式，请在用户确认本次交易后使用 --yes');
+    error.code = 'confirmation_required';
+    throw error;
+  }
+  return true;
+}

package/src/commands/trade.js

@@ -0,0 +1,275 @@
+/**
+ * 下单 / 撤单 / 一键平仓。
+ *
+ * ★ 开仓允许传中文品种名/品种码，服务端会解析为当前主力实际合约；平仓仍必须传持仓实际合约。
+ *   ① 传 --price 自动按 GFD 限价单；不传价格自动按 IOC 市价单
+ *   ② 按用户当前的交易模式确认后执行或直接执行
+ */
+import readline from 'node:readline/promises';
+import { request } from '../http.js';
+import { emit, kv, num, say, table } from '../output.js';
+import { showQuote, showContractSpec } from './account.js';
+import { needsPrompt } from './trade-mode.js';
+
+export async function order(opts) {
+  const code = opts.symbol;
+
+  const hasPrice = opts.price !== undefined && opts.price !== null;
+  const orderType = hasPrice ? 'limit' : 'market';
+  if (opts.type && opts.type !== orderType) {
+    const err = new Error(hasPrice
+      ? '已指定 --price，订单自动按 GFD 限价单处理，不要再传 --type market'
+      : '未指定 --price，订单自动按 IOC 市价单处理，不要再传 --type limit');
+    err.code = 'invalid_request';
+    throw err;
+  }
+
+  const body = {
+    contractCode: code,
+    side: opts.direction,
+    offset: opts.offset,
+    orderType,
+    volume: Number(opts.volume),
+    dryRun: !!opts.dryRun,
+    confirmed: !!opts.yes,
+  };
+  if (opts.price !== undefined && opts.price !== null) body.price = Number(opts.price);
+  if (opts.clientOrderId) body.clientOrderId = opts.clientOrderId;
+
+  if (!opts.dryRun && await needsPrompt(opts)) {
+    const { data: preview } = await request('/futures/orders', {
+      method: 'POST', body: { ...body, dryRun: true },
+    });
+    showOrderPreview(preview);
+    if (preview.wouldSucceed !== true) {
+      say('预演未通过，未下单。');
+      return;
+    }
+    const actual = preview.detail?.contractCode;
+    if (!actual) {
+      const err = new Error('预演未返回实际合约，不能继续确认下单');
+      err.code = 'contract_resolution_unavailable'; throw err;
+    }
+    body.contractCode = actual;
+    const desc = `${actual} ${opts.direction === 'buy' ? '买' : '卖'}` +
+      `${opts.offset === 'open' ? '开' : '平'} ${opts.volume} 手 ` +
+      `${orderType === 'market' ? '市价 IOC' : `限价 ${opts.price} GFD`}`;
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const ans = await rl.question(`即将下单：${desc}\n确认？(yes/N) `);
+    rl.close();
+    if (!/^y(es)?$/i.test(ans.trim())) {
+      say('已取消，未下单。');
+      return;
+    }
+    body.confirmed = true;
+  }
+
+  const { data } = await request('/futures/orders', { method: 'POST', body });
+  emit(data);
+  if (data.marketQuote) showQuote(data.marketQuote);
+
+  if (body.dryRun) {
+    showOrderPreview(data);
+    return;
+  }
+
+  kv([
+    ['委托号', data.orderId || '-'],
+    ['操作号', data.operationId || data.requestId || '-'],
+    ['状态', data.statusText || data.status || '-'],
+    ['已成交', `${data.filledVolume ?? 0} / ${body.volume} 手`],
+    ['成交均价', num(data.avgPrice)],
+    ['幂等号', data.clientOrderId || '-'],
+  ]);
+  if (data.status === 'unknown') {
+    say('  ⚠ 回执超时，柜台可能已受理。**不要重复下单**，' +
+        `请用 ssquant orders --status active 或按幂等号 ${data.clientOrderId} 查证。`);
+  }
+  if (data.status === 'queued') {
+    say('  ⏳ 请求已排队，尚不代表柜台受理或成交。' +
+        `请用 ssquant operation show ${data.operationId || data.requestId} 查询；不要重复下单。`);
+  }
+  if (data.message) say(`  说明：${data.message}`);
+}
+
+export function showOrderPreview(data) {
+  say(data.wouldSucceed ? '  ✓ 预演通过（尚未下单）' : `  ✗ 预演不通过：${data.message || data.reason}`);
+  if (data.detail) {
+    kv(Object.entries(data.detail).filter(([, v]) => v === null || typeof v !== 'object')
+      .map(([k, v]) => [k, typeof v === 'number' ? num(v) : String(v)]));
+    if (data.detail.contract?.margin) showContractSpec(data.detail.contract);
+  }
+  if (data.suggestion) say(`  建议：${data.suggestion}`);
+}
+
+export async function cancel(orderId, opts) {
+  let confirmed = !!opts.yes;
+  if (await needsPrompt(opts)) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await rl.question(`确认撤销委托 ${orderId}？(yes/N) `);
+    rl.close();
+    if (!/^y(es)?$/i.test(answer.trim())) { say('已取消。'); return; }
+    confirmed = true;
+  }
+  const { data } = await request(`/futures/orders/${encodeURIComponent(orderId)}?confirmed=${confirmed}`,
+    { method: 'DELETE' });
+  emit(data);
+  kv([['委托号', data.orderId || orderId], ['状态', data.statusText || data.status || '-']]);
+}
+
+export async function cancelAll(opts) {
+  const body = { contractCode: opts.symbol, clientRequestId: opts.clientRequestId };
+  const preview = await request('/futures/orders/cancel-all', {
+    method: 'POST', body: { ...body, dryRun: true },
+  });
+  const plan = preview.data || {};
+  const rows = plan.orders || [];
+  if (opts.dryRun) {
+    emit(plan);
+    table(['委托号', '合约', '方向', '未成手数', '状态'], rows.map((o) => [
+      o.orderId, o.contractCode, `${o.sideText || o.side}${o.offsetText || o.offset}`,
+      o.unfilledQuantity ?? 0, o.statusText || o.status,
+    ]));
+    return;
+  }
+  if (!rows.length) { emit(plan); say('当前没有活动挂单。'); return; }
+  let confirmed = !!opts.yes;
+  if (await needsPrompt(opts)) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const ans = await rl.question(`即将撤销 ${rows.length} 笔挂单，确认？(yes/N) `);
+    rl.close();
+    if (!/^y(es)?$/i.test(ans.trim())) { say('已取消。'); return; }
+    confirmed = true;
+  }
+  const { data } = await request('/futures/orders/cancel-all', {
+    method: 'POST', body: { ...body, dryRun: false, confirmed },
+  });
+  emit(data);
+  table(['委托号', '结果'], (data.results || []).map((r) => [
+    r.orderId || r.order?.orderId || '-', r.ok ? (r.result?.statusText || '已受理') : `失败：${r.error?.message || '-'}`,
+  ]));
+}
+
+export async function closeAll(opts) {
+  const body = {
+    contractCode: opts.symbol,
+    dryRun: !!opts.dryRun,
+    clientRequestId: opts.clientRequestId,
+  };
+  const preview = await request('/futures/positions/close-all', {
+    method: 'POST', body: { ...body, dryRun: true },
+  });
+  const plan = preview.data || {};
+  if (opts.dryRun) {
+    emit(plan);
+    table(['合约', '方向', '手数'], (plan.legs || []).map((p) => [
+      p.contractCode, p.direction === 'long' ? '卖平' : '买平', p.volume]));
+    return;
+  }
+
+  if (plan.activeOrders?.length) {
+    emit(plan);
+    say('  当前存在活动委托，服务端拒绝真实清仓，请先撤单。');
+    return;
+  }
+  if (!plan.legs?.length) {
+    emit(plan);
+    say('  没有可平的持仓。');
+    return;
+  }
+  body.confirmed = !!opts.yes;
+  if (await needsPrompt(opts)) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    say('即将由服务端提交以下平仓腿：');
+    table(['合约', '方向', '手数'], plan.legs.map((p) => [
+      p.contractCode, p.direction === 'long' ? '卖平' : '买平', p.volume]));
+    const ans = await rl.question('确认全部市价平仓？(yes/N) ');
+    rl.close();
+    if (!/^y(es)?$/i.test(ans.trim())) {
+      say('已取消。');
+      return;
+    }
+    body.confirmed = true;
+  }
+  const { data } = await request('/futures/positions/close-all', {
+    method: 'POST', body,
+  });
+  emit(data);
+  table(['合约', '方向', '手数', '结果'], (data.legs || []).map((r) => [
+    r.contractCode, r.side === 'sell' ? '卖平' : '买平', r.volume,
+    r.ok ? (r.result?.statusText || r.result?.status || '已提交') : `失败：${r.error?.message || '-'}`,
+  ]));
+}
+
+async function frozenBatch(operation, parameters, opts) {
+  const { data: plan } = await request('/futures/plans', {
+    method: 'POST', body: { operation, parameters },
+  });
+  say(plan.summary || '');
+  table(['合约', '方向', '手数'], (plan.legs || []).map(leg =>
+    [leg.contractCode, `${leg.side}/${leg.offset}`, leg.volume]));
+  if (plan.status !== 'prepared') {
+    emit(plan);
+    if (plan.preview?.message) say(plan.preview.message);
+    if (plan.preview?.candidates?.length) table(['旧合约', '方向', '可平手数'],
+      plan.preview.candidates.map(item => [item.contractCode, item.direction, item.closable]));
+    say('预演未通过或需要补充参数，未发送真实订单。');
+    return;
+  }
+  let confirmed = !!opts.yes;
+  if (await needsPrompt(opts, plan.tradeMode)) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await rl.question(`确认执行以上冻结计划 ${plan.planId}？(yes/N) `);
+    rl.close();
+    if (!/^y(es)?$/i.test(answer.trim())) { say('已取消。'); return; }
+    confirmed = true;
+  }
+  const { data: operationResult } = await request(`/futures/plans/${encodeURIComponent(plan.planId)}/execute`, {
+    method: 'POST', body: { confirmed, clientRequestId: opts.clientRequestId },
+  });
+  const data = { status: operationResult.status, ...operationResult.result,
+    planId: plan.planId, operationId: operationResult.operationId };
+  emit(data);
+  if (data.message) say(data.message);
+  table(['阶段', '合约', '手数', '结果'], (data.legs || []).map(leg => [
+    leg.phase, leg.contractCode, leg.volume,
+    leg.ok ? (leg.result?.statusText || leg.result?.status || '成功') : `失败：${leg.error?.message || '-'}`,
+  ]));
+}
+
+export async function rollover(opts) {
+  const body = {
+    symbol: opts.symbol, volume: opts.volume === undefined ? undefined : Number(opts.volume),
+    direction: opts.direction, fromContract: opts.fromContract, clientRequestId: opts.clientRequestId,
+  };
+  if (!opts.dryRun) return frozenBatch('rollover', body, opts);
+  const { data: plan } = await request('/futures/positions/rollover', {
+    method: 'POST', body: { ...body, dryRun: true },
+  });
+  emit(plan);
+  if (plan.message) say(plan.message);
+  if (plan.candidates?.length) table(['旧合约', '方向', '可平手数'],
+    plan.candidates.map(item => [item.contractCode, item.direction, item.closable]));
+  table(['阶段', '合约', '方向', '手数', '预演'], (plan.legs || []).map(leg => [
+    leg.phase, leg.contractCode, leg.direction, leg.volume, leg.preview?.wouldSucceed ? '通过' : '失败',
+  ]));
+}
+
+export async function targetPosition(opts) {
+  let targets;
+  try { targets = JSON.parse(opts.targets); } catch (e) {
+    const err = new Error('--targets 必须是合法 JSON 数组'); err.code = 'invalid_request'; throw err;
+  }
+  if (!Array.isArray(targets) || !targets.length) {
+    const err = new Error('--targets 必须是非空 JSON 数组'); err.code = 'invalid_request'; throw err;
+  }
+  const body = { targets, clientRequestId: opts.clientRequestId };
+  if (!opts.dryRun) return frozenBatch('target_position', body, opts);
+  const preview = await request('/futures/positions/target', { method: 'POST', body: { ...body, dryRun: true } });
+  const plan = preview.data || {};
+  emit(plan);
+  table(['阶段', '合约', '方向', '手数', '预演'], (plan.legs || []).map((leg) => [
+    leg.phase, leg.contractCode, leg.direction, leg.volume,
+    leg.preview?.wouldSucceed === false ? `失败：${leg.preview?.message || leg.preview?.reason || '-'}` : '通过',
+  ]));
+}

package/src/config.js

@@ -0,0 +1,115 @@
+/**
+ * 配置与凭证存取。
+ *
+ * 凭证存 ~/.panda/credentials.json，权限 0600。
+ * ★ 只存本服务签发的 pt_ token，**从不存官网账号密码** ——
+ *   身份始终在浏览器里完成，CLI 全程不接触密码。
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+
+export const DEFAULT_BASE = 'https://www.pandaaiquant.com';
+export const API_PREFIX = '/ssquant/openapi/v1';
+
+/** 公开客户端 id：CLI 是公共客户端（无 client_secret），靠 PKCE 防截获 */
+export const DEFAULT_CLIENT_ID = 'ssquant-cli';
+
+export function homeDir() {
+  return process.env.SSQUANT_HOME || path.join(os.homedir(), '.ssquant');
+}
+
+export function credPath() {
+  return path.join(homeDir(), 'credentials.json');
+}
+
+export function credentialLockPath() {
+  return path.join(homeDir(), 'credentials.lock');
+}
+
+export function apiBase() {
+  const raw = process.env.SSQUANT_API_BASE || DEFAULT_BASE;
+  return raw.replace(/\/+$/, '');
+}
+
+export function apiUrl(p) {
+  const suffix = p.startsWith('/') ? p : `/${p}`;
+  return `${apiBase()}${API_PREFIX}${suffix}`;
+}
+
+export function clientId() {
+  return process.env.SSQUANT_CLIENT_ID || DEFAULT_CLIENT_ID;
+}
+
+export function loadCredentials() {
+  try {
+    const raw = fs.readFileSync(credPath(), 'utf8');
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+export function saveCredentials(data) {
+  const dir = homeDir();
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const file = credPath();
+  // 先写再改权限会有一瞬间是默认权限；用 mode 参数让它一出生就是 0600
+  const tmp = `${file}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
+  try {
+    fs.chmodSync(tmp, 0o600);
+  } catch {
+    // Windows 上 chmod 基本无效，忽略；该平台靠用户目录 ACL 保护
+  }
+  fs.renameSync(tmp, file);
+  try {
+    fs.chmodSync(file, 0o600);
+  } catch {
+    // Windows 上 chmod 基本无效，忽略；该平台靠用户目录 ACL 保护
+  }
+  return file;
+}
+
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/** 多进程刷新凭据时使用的跨平台独占文件锁。 */
+export async function withCredentialLock(fn, { timeoutMs = 35_000, staleMs = 120_000 } = {}) {
+  const dir = homeDir();
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const lock = credentialLockPath();
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    let fd;
+    try {
+      fd = fs.openSync(lock, 'wx', 0o600);
+    } catch (e) {
+      if (!e || e.code !== 'EEXIST') throw e;
+      try {
+        const age = Date.now() - fs.statSync(lock).mtimeMs;
+        if (age > staleMs) fs.unlinkSync(lock);
+      } catch { /* 锁可能刚被持有者释放 */ }
+      await delay(50);
+      continue;
+    }
+    try {
+      fs.writeFileSync(fd, `${process.pid}\n`, { encoding: 'utf8' });
+      return await fn();
+    } finally {
+      try { fs.closeSync(fd); } catch { /* noop */ }
+      try { fs.unlinkSync(lock); } catch { /* 锁已由超时清理时忽略 */ }
+    }
+  }
+  throw new Error('凭据正在由另一个进程刷新，请稍后重试');
+}
+
+export function clearCredentials() {
+  try {
+    fs.unlinkSync(credPath());
+    return true;
+  } catch {
+    return false;
+  }
+}