@finchagentic/mcp 4.1.0 → 4.2.0

package/dist/tools/rh-orders.js

@@ -56,6 +56,53 @@ function saveStore(s) {
 function genId(prefix) {
     return `${prefix}_${Date.now().toString(36)}${Math.floor(Math.random() * 1e6).toString(36)}`;
 }
+// ── Tick lock ──────────────────────────────────────────────────────────────
+// rh_orders_tick reads the store, awaits a real on-chain swap per due order
+// (a slow network round trip), and only writes the store back at the end.
+// Without a lock, two overlapping executing ticks (a slow RPC making one call
+// outlast the next scheduler firing, or a manual call racing the scheduler)
+// both read the SAME pre-update state, both see the same order as due, and
+// both broadcast a real swap - real funds spent twice for what the store
+// ends up recording as one buy. Preview ticks (execute:false) never write and
+// are harmless to run concurrently, so only executing ticks take the lock.
+const TICK_LOCK_FILE = path_1.default.join(ORDERS_DIR, "rh-orders.tick.lock");
+const LOCK_STALE_MS = 5 * 60 * 1000; // a tick this slow is presumed crashed, not just slow
+function acquireTickLock() {
+    try {
+        fs_1.default.mkdirSync(ORDERS_DIR, { recursive: true });
+    }
+    catch {
+        /* ignore */
+    }
+    try {
+        // Exclusive create - atomically fails if another tick already holds it.
+        fs_1.default.writeFileSync(TICK_LOCK_FILE, String(process.pid), { flag: "wx" });
+        return true;
+    }
+    catch {
+        try {
+            const stat = fs_1.default.statSync(TICK_LOCK_FILE);
+            if (Date.now() - stat.mtimeMs > LOCK_STALE_MS) {
+                // Prior holder almost certainly crashed without releasing - take over
+                // rather than deadlocking every future tick forever.
+                fs_1.default.writeFileSync(TICK_LOCK_FILE, String(process.pid));
+                return true;
+            }
+        }
+        catch {
+            /* lock vanished between the failed create and this stat - try again next tick */
+        }
+        return false;
+    }
+}
+function releaseTickLock() {
+    try {
+        fs_1.default.unlinkSync(TICK_LOCK_FILE);
+    }
+    catch {
+        /* already gone */
+    }
+}
 function killSwitchOn() {
     return process.env.RH_ORDERS_DISABLED === "1" || fs_1.default.existsSync(KILL_FILE);
 }
@@ -63,6 +110,18 @@ function posNum(v) {
     const n = Number(v);
     return isFinite(n) ? n : NaN;
 }
+// Same bound quoteRh() enforces in rh-mcp.ts (matching defi.ts's Base-swap
+// bound of .positive().max(50)) - reject an out-of-range slippagePct at order
+// creation time rather than letting it silently reach an unattended
+// rh_orders_tick execution weeks later.
+function badSlippagePct(v) {
+    if (v == null)
+        return null;
+    const n = posNum(v);
+    if (!(n > 0) || n > 50)
+        return `slippagePct must be greater than 0 and at most 50 (got ${v})`;
+    return null;
+}
 function fmtUsd(n) {
     if (n == null || !isFinite(n))
         return "?";
@@ -192,6 +251,9 @@ async function handleRhOrderTool(name, args) {
                 return textResult("intervalHours must be > 0", true);
             if (!(totalBuys > 0))
                 return textResult("totalBuys must be ≥ 1", true);
+            const slippageErr = badSlippagePct(a.slippagePct);
+            if (slippageErr)
+                return textResult(slippageErr, true);
             let resolved;
             try {
                 resolved = await (0, rh_mcp_js_1.resolveTokenSmart)(String(a.token));
@@ -257,6 +319,9 @@ async function handleRhOrderTool(name, args) {
             const sellPct = a.sellPct != null ? posNum(a.sellPct) : 100;
             if (!(sellPct > 0 && sellPct <= 100))
                 return textResult("sellPct must be 1..100", true);
+            const bracketSlippageErr = badSlippagePct(a.slippagePct);
+            if (bracketSlippageErr)
+                return textResult(bracketSlippageErr, true);
             let resolved;
             try {
                 resolved = await (0, rh_mcp_js_1.resolveTokenSmart)(String(a.token));
@@ -327,143 +392,156 @@ async function handleRhOrderTool(name, args) {
         case "rh_orders_tick": {
             const execute = a.execute === true;
             const blocked = execute && killSwitchOn();
-            const store = loadStore();
-            const active = store.orders.filter((o) => o.status === "active");
-            const now = Date.now();
-            const report = [
-                `## ⏱️ RH orders tick — ${execute ? (blocked ? "EXECUTE (BLOCKED by kill-switch → preview)" : "EXECUTE") : "PREVIEW"}`,
-                `${active.length} active order(s)`,
-                "",
-            ];
             const doExecute = execute && !blocked;
-            let acted = 0;
-            let wallet = null;
-            for (const o of active) {
-                try {
-                    // ---- DCA ----
-                    if (o.type === "dca" && o.dca) {
-                        const d = o.dca;
-                        if (d.completedBuys >= d.totalBuys) {
-                            o.status = "completed";
-                            continue;
-                        }
-                        if (now < d.nextRunAt) {
-                            report.push(`⏳ ${o.id} DCA ${o.token.symbol}: next buy at ${new Date(d.nextRunAt).toISOString()}`);
-                            continue;
-                        }
-                        const wouldSpend = Number(d.spentEth) + Number(d.amountEthPerBuy);
-                        if (wouldSpend > Number(d.maxSpendEth) + 1e-12) {
-                            o.status = "completed";
-                            report.push(`✅ ${o.id} DCA ${o.token.symbol}: maxSpend reached — completed`);
-                            continue;
-                        }
-                        acted++;
-                        if (!doExecute) {
-                            report.push(`🟡 ${o.id} DCA: would buy ${d.amountEthPerBuy} ETH → ${o.token.symbol} (${d.completedBuys + 1}/${d.totalBuys})`);
-                            continue;
-                        }
-                        const res = await (0, rh_mcp_js_1.handleRhMcpTool)("rh_mcp_swap", {
-                            fromToken: "ETH",
-                            toToken: o.token.address,
-                            amount: d.amountEthPerBuy,
-                            maxSlippagePct: o.slippagePct,
-                            confirm: true,
-                        });
-                        const txt = res?.content?.[0]?.text ?? "";
-                        if (res?.isError) {
-                            o.lastError = txt.slice(0, 140);
+            // Only an executing tick can double-spend; a preview never writes and
+            // is harmless to overlap, so only take the lock when it matters.
+            if (doExecute && !acquireTickLock()) {
+                return textResult("⏳ Another rh_orders_tick is already executing - refusing to run a second one " +
+                    "concurrently (this is what prevents a slow tick from double-firing the same order). " +
+                    "Try again shortly.", true);
+            }
+            try {
+                const store = loadStore();
+                const active = store.orders.filter((o) => o.status === "active");
+                const now = Date.now();
+                const report = [
+                    `## ⏱️ RH orders tick — ${execute ? (blocked ? "EXECUTE (BLOCKED by kill-switch → preview)" : "EXECUTE") : "PREVIEW"}`,
+                    `${active.length} active order(s)`,
+                    "",
+                ];
+                let acted = 0;
+                let wallet = null;
+                for (const o of active) {
+                    try {
+                        // ---- DCA ----
+                        if (o.type === "dca" && o.dca) {
+                            const d = o.dca;
+                            if (d.completedBuys >= d.totalBuys) {
+                                o.status = "completed";
+                                continue;
+                            }
+                            if (now < d.nextRunAt) {
+                                report.push(`⏳ ${o.id} DCA ${o.token.symbol}: next buy at ${new Date(d.nextRunAt).toISOString()}`);
+                                continue;
+                            }
+                            const wouldSpend = Number(d.spentEth) + Number(d.amountEthPerBuy);
+                            if (wouldSpend > Number(d.maxSpendEth) + 1e-12) {
+                                o.status = "completed";
+                                report.push(`✅ ${o.id} DCA ${o.token.symbol}: maxSpend reached — completed`);
+                                continue;
+                            }
+                            acted++;
+                            if (!doExecute) {
+                                report.push(`🟡 ${o.id} DCA: would buy ${d.amountEthPerBuy} ETH → ${o.token.symbol} (${d.completedBuys + 1}/${d.totalBuys})`);
+                                continue;
+                            }
+                            const res = await (0, rh_mcp_js_1.handleRhMcpTool)("rh_mcp_swap", {
+                                fromToken: "ETH",
+                                toToken: o.token.address,
+                                amount: d.amountEthPerBuy,
+                                maxSlippagePct: o.slippagePct,
+                                confirm: true,
+                            });
+                            const txt = res?.content?.[0]?.text ?? "";
+                            if (res?.isError) {
+                                o.lastError = txt.slice(0, 140);
+                                o.updatedAt = now;
+                                report.push(`🔴 ${o.id} DCA buy failed: ${o.lastError}`);
+                                continue;
+                            }
+                            const txHash = extractTxHash(txt) ?? "unknown";
+                            d.fills.push({ ts: now, txHash, amountEth: d.amountEthPerBuy });
+                            d.completedBuys += 1;
+                            d.spentEth = String(Number(d.spentEth) + Number(d.amountEthPerBuy));
+                            d.nextRunAt = now + d.intervalSec * 1000; // no burst catch-up
+                            o.lastError = undefined;
                             o.updatedAt = now;
-                            report.push(`🔴 ${o.id} DCA buy failed: ${o.lastError}`);
+                            if (d.completedBuys >= d.totalBuys)
+                                o.status = "completed";
+                            report.push(`🟢 ${o.id} DCA bought ${d.amountEthPerBuy} ETH → ${o.token.symbol} · ${d.completedBuys}/${d.totalBuys} · tx \`${txHash}\``);
                             continue;
                         }
-                        const txHash = extractTxHash(txt) ?? "unknown";
-                        d.fills.push({ ts: now, txHash, amountEth: d.amountEthPerBuy });
-                        d.completedBuys += 1;
-                        d.spentEth = String(Number(d.spentEth) + Number(d.amountEthPerBuy));
-                        d.nextRunAt = now + d.intervalSec * 1000; // no burst catch-up
-                        o.lastError = undefined;
-                        o.updatedAt = now;
-                        if (d.completedBuys >= d.totalBuys)
+                        // ---- Bracket (TP/SL) ----
+                        if (o.type === "bracket" && o.bracket) {
+                            const b = o.bracket;
+                            const price = await (0, rh_mcp_js_1.rhPriceUsd)(o.token.address);
+                            if (price == null) {
+                                report.push(`⚠️ ${o.id} TP/SL ${o.token.symbol}: no price available`);
+                                continue;
+                            }
+                            let trigger = null;
+                            if (b.tpPriceUsd != null && price >= b.tpPriceUsd)
+                                trigger = "tp";
+                            else if (b.slPriceUsd != null && price <= b.slPriceUsd)
+                                trigger = "sl";
+                            if (!trigger) {
+                                report.push(`⏳ ${o.id} TP/SL ${o.token.symbol}: ${fmtUsd(price)} (🎯${b.tpPriceUsd != null ? fmtUsd(b.tpPriceUsd) : "—"} / 🛑${b.slPriceUsd != null ? fmtUsd(b.slPriceUsd) : "—"})`);
+                                continue;
+                            }
+                            if (!wallet)
+                                wallet = await (0, wallet_js_1.getOrCreateWallet)();
+                            const balRaw = await (0, rh_mcp_js_1.rhErc20Balance)(o.token.address, wallet.address);
+                            if (balRaw <= 0n) {
+                                o.status = "completed";
+                                report.push(`✅ ${o.id} TP/SL ${o.token.symbol}: ${trigger.toUpperCase()} hit but 0 balance — completed`);
+                                continue;
+                            }
+                            const sellRaw = (balRaw * BigInt(Math.round(b.sellPct * 100))) / 10000n;
+                            const sellHuman = ethers_1.ethers.formatUnits(sellRaw, o.token.decimals);
+                            acted++;
+                            if (!doExecute) {
+                                report.push(`🟡 ${o.id} ${trigger.toUpperCase()} at ${fmtUsd(price)}: would sell ${b.sellPct}% (${sellHuman} ${o.token.symbol}) → ETH`);
+                                continue;
+                            }
+                            const res = await (0, rh_mcp_js_1.handleRhMcpTool)("rh_mcp_swap", {
+                                fromToken: o.token.address,
+                                toToken: "ETH",
+                                amount: sellHuman,
+                                maxSlippagePct: o.slippagePct,
+                                confirm: true,
+                            });
+                            const txt = res?.content?.[0]?.text ?? "";
+                            if (res?.isError) {
+                                o.lastError = txt.slice(0, 140);
+                                o.updatedAt = now;
+                                report.push(`🔴 ${o.id} ${trigger.toUpperCase()} sell failed: ${o.lastError}`);
+                                continue;
+                            }
+                            const txHash = extractTxHash(txt) ?? "unknown";
+                            b.fills.push({ ts: now, txHash, kind: trigger, priceUsd: price });
                             o.status = "completed";
-                        report.push(`🟢 ${o.id} DCA bought ${d.amountEthPerBuy} ETH → ${o.token.symbol} · ${d.completedBuys}/${d.totalBuys} · tx \`${txHash}\``);
-                        continue;
-                    }
-                    // ---- Bracket (TP/SL) ----
-                    if (o.type === "bracket" && o.bracket) {
-                        const b = o.bracket;
-                        const price = await (0, rh_mcp_js_1.rhPriceUsd)(o.token.address);
-                        if (price == null) {
-                            report.push(`⚠️ ${o.id} TP/SL ${o.token.symbol}: no price available`);
-                            continue;
-                        }
-                        let trigger = null;
-                        if (b.tpPriceUsd != null && price >= b.tpPriceUsd)
-                            trigger = "tp";
-                        else if (b.slPriceUsd != null && price <= b.slPriceUsd)
-                            trigger = "sl";
-                        if (!trigger) {
-                            report.push(`⏳ ${o.id} TP/SL ${o.token.symbol}: ${fmtUsd(price)} (🎯${b.tpPriceUsd != null ? fmtUsd(b.tpPriceUsd) : "—"} / 🛑${b.slPriceUsd != null ? fmtUsd(b.slPriceUsd) : "—"})`);
-                            continue;
-                        }
-                        if (!wallet)
-                            wallet = await (0, wallet_js_1.getOrCreateWallet)();
-                        const balRaw = await (0, rh_mcp_js_1.rhErc20Balance)(o.token.address, wallet.address);
-                        if (balRaw <= 0n) {
-                            o.status = "completed";
-                            report.push(`✅ ${o.id} TP/SL ${o.token.symbol}: ${trigger.toUpperCase()} hit but 0 balance — completed`);
-                            continue;
-                        }
-                        const sellRaw = (balRaw * BigInt(Math.round(b.sellPct * 100))) / 10000n;
-                        const sellHuman = ethers_1.ethers.formatUnits(sellRaw, o.token.decimals);
-                        acted++;
-                        if (!doExecute) {
-                            report.push(`🟡 ${o.id} ${trigger.toUpperCase()} at ${fmtUsd(price)}: would sell ${b.sellPct}% (${sellHuman} ${o.token.symbol}) → ETH`);
-                            continue;
-                        }
-                        const res = await (0, rh_mcp_js_1.handleRhMcpTool)("rh_mcp_swap", {
-                            fromToken: o.token.address,
-                            toToken: "ETH",
-                            amount: sellHuman,
-                            maxSlippagePct: o.slippagePct,
-                            confirm: true,
-                        });
-                        const txt = res?.content?.[0]?.text ?? "";
-                        if (res?.isError) {
-                            o.lastError = txt.slice(0, 140);
+                            o.lastError = undefined;
                             o.updatedAt = now;
-                            report.push(`🔴 ${o.id} ${trigger.toUpperCase()} sell failed: ${o.lastError}`);
+                            report.push(`🟢 ${o.id} ${trigger.toUpperCase()} sold ${sellHuman} ${o.token.symbol} → ETH at ${fmtUsd(price)} · tx \`${txHash}\``);
                             continue;
                         }
-                        const txHash = extractTxHash(txt) ?? "unknown";
-                        b.fills.push({ ts: now, txHash, kind: trigger, priceUsd: price });
-                        o.status = "completed";
-                        o.lastError = undefined;
+                    }
+                    catch (e) {
+                        // One bad order (e.g. wallet decrypt failure) must not abort the whole tick.
+                        o.lastError = String(e?.message ?? e).slice(0, 140);
                         o.updatedAt = now;
-                        report.push(`🟢 ${o.id} ${trigger.toUpperCase()} sold ${sellHuman} ${o.token.symbol} → ETH at ${fmtUsd(price)} · tx \`${txHash}\``);
-                        continue;
+                        report.push(`🔴 ${o.id}: tick error — ${o.lastError}`);
                     }
                 }
-                catch (e) {
-                    // One bad order (e.g. wallet decrypt failure) must not abort the whole tick.
-                    o.lastError = String(e?.message ?? e).slice(0, 140);
-                    o.updatedAt = now;
-                    report.push(`🔴 ${o.id}: tick error — ${o.lastError}`);
+                // Preview must be read-only: only persist state when actually executing.
+                if (doExecute)
+                    saveStore(store);
+                if (blocked) {
+                    report.push("", "🛑 Kill-switch active — no swaps broadcast. Remove ~/.finch/rh-orders.OFF or unset RH_ORDERS_DISABLED to enable.");
                 }
+                else if (acted === 0) {
+                    report.push("", "Nothing due or triggered this tick.");
+                }
+                else if (!doExecute) {
+                    report.push("", `${acted} action(s) pending. Re-run with \`execute:true\` (via scheduler) to broadcast.`);
+                }
+                report.push("", `_Explorer: ${rh_mcp_js_1.RH_EXPLORER}_`);
+                return textResult(report.join("\n"));
             }
-            // Preview must be read-only: only persist state when actually executing.
-            if (doExecute)
-                saveStore(store);
-            if (blocked) {
-                report.push("", "🛑 Kill-switch active — no swaps broadcast. Remove ~/.finch/rh-orders.OFF or unset RH_ORDERS_DISABLED to enable.");
-            }
-            else if (acted === 0) {
-                report.push("", "Nothing due or triggered this tick.");
-            }
-            else if (!doExecute) {
-                report.push("", `${acted} action(s) pending. Re-run with \`execute:true\` (via scheduler) to broadcast.`);
+            finally {
+                if (doExecute)
+                    releaseTickLock();
             }
-            report.push("", `_Explorer: ${rh_mcp_js_1.RH_EXPLORER}_`);
-            return textResult(report.join("\n"));
         }
         default:
             return null;

package/dist/tools/scanner.js

@@ -134,6 +134,18 @@ function buildScanResults(mode, scanned, scored) {
 // from the check_token handler so the text report and structuredContent can't
 // drift apart.
 function assessTokenSecurity(info) {
+    // GoPlusLabs returns HTTP 200 with an empty {} for a contract it has no
+    // record of (too new to be indexed yet, wrong address, etc.) - every field
+    // below defaults to "not risky" in that case, which previously produced a
+    // rugScore of 20 and a "SAFE" verdict for a token that was NEVER actually
+    // scanned. That's the exact class of token this tool exists to protect
+    // against (score_token/scan_market point brand-new tokens here first).
+    if (!info || Object.keys(info).length === 0) {
+        return {
+            verdict: "UNSCANNED", rugScore: -1, isHoneypot: false, isMintable: false,
+            isFreezeAuth: false, isOpenSource: false, lpLockedPct: 0, buyTax: 0, sellTax: 0, holderCount: null,
+        };
+    }
     const isHoneypot = info.is_honeypot === "1";
     const isMintable = info.is_mintable === "1";
     const isFreezeAuth = info.transfer_pausable === "1";
@@ -409,6 +421,24 @@ async function handleScannerTool(name, args) {
         const info = data.result?.[address.toLowerCase()] ?? data.result?.[address] ?? {};
         const sec = assessTokenSecurity(info);
         const { verdict, rugScore, isHoneypot, isMintable, isFreezeAuth, isOpenSource, lpLockedPct, buyTax, sellTax } = sec;
+        if (verdict === "UNSCANNED") {
+            return {
+                content: [{
+                        type: "text",
+                        text: [
+                            `## Token Security Check`,
+                            `\`${address}\``,
+                            ``,
+                            `**Verdict: ⚪ UNSCANNED** - GoPlusLabs has no record for this contract (too new to be indexed yet, or the address is wrong).`,
+                            ``,
+                            `This is NOT a clean bill of health - it means no security data exists to check at all. ` +
+                                `Brand-new tokens (exactly what \`scan_market\` surfaces) are the most likely to hit this. ` +
+                                `Treat as unverified: confirm the contract address is correct, wait and retry once the token is a few hours/days old, or skip it.`,
+                        ].join("\n"),
+                    }],
+                structuredContent: { address, ...sec },
+            };
+        }
         const icon = { DANGER: "🔴", CAUTION: "🟡", SAFE: "🟢" }[verdict];
         const lines = [
             `## Token Security Check`,