@reefclaw/openclaw-plugin 0.1.5 → 0.1.7

package/tools/audit-bracket-protection.js

@@ -17,6 +17,10 @@
 import { parseBracketCid } from '../live/bracket-id.js';
 import { normalizeBracketSymbol } from '../live/bracket-ledger.js';
 import { formatError, logger } from '../logger.js';
+import { HyperliquidLiveAdapter } from '../venues/hyperliquid/hl-live-adapter.js';
+import { isTerminalBracketState } from '../venues/hyperliquid/hl-bracket-coordinator.js';
+import { parseHlBracketCloid } from '../venues/hyperliquid/hl-cloid.js';
+import { isProtectiveHlOrder } from '../venues/hyperliquid/hl-brackets.js';
 const TAG = 'audit-bracket-protection';
 // Per-symbol verdict history for flicker detection. When audit verdicts
 // transition protected→unprotected→protected repeatedly inside a short
@@ -73,7 +77,12 @@ export async function auditBracketProtectionTool(_args, deps) {
                 positions: entries,
             };
         }
-        // Live mode.
+        // Live mode — venue dispatch (issue #209). The Binance-shaped path below
+        // reads algo-order fields HL doesn't have; on HL it produced permanent
+        // false "unprotected" verdicts (the spiral seed).
+        if (deps.adapter instanceof HyperliquidLiveAdapter) {
+            return auditHlLive(deps.adapter);
+        }
         const live = deps.adapter;
         const ledger = live.getBracketLedger?.() ?? null;
         const bracketsEnabled = ledger !== null;
@@ -525,3 +534,150 @@ function extractTriggerPrice(o) {
     }
     return undefined;
 }
+/**
+ * Hyperliquid live audit (issue #209). Same contracts as the Binance path:
+ * null ≠ empty ({error} on an unavailable read — the agent skips the cycle and
+ * MUST NOT act), and an EMPTY open-orders set against a non-terminal ledger row
+ * WITH cids is unverifiable, never "unprotected" (HL has no zero-weight per-leg
+ * resolver, so the honest floor is the whole-audit {error}). External trigger
+ * legs count as protection (`manual_order_protecting`) via the HL order shape
+ * (isTrigger/reduceOnly/orderType — T-7 fields), mirroring the Binance rule
+ * that a manually-placed stop must never be reported as naked.
+ */
+async function auditHlLive(adapter) {
+    const ledger = adapter.getHlBracketCoordinator().getLedger();
+    const positionsOrNull = await adapter.getPositionsOrNull();
+    if (positionsOrNull === null) {
+        return {
+            error: 'Exchange data unavailable (Hyperliquid fetch failed / rate-gated). Skipping audit ' +
+                'this cycle — bracket state on the exchange is unchanged. Retry on next heartbeat.',
+        };
+    }
+    const activePositions = positionsOrNull.filter(p => Math.abs(Number(p.contracts ?? 0)) > 0);
+    if (activePositions.length === 0) {
+        return {
+            ok: true,
+            mode: 'live',
+            brackets_enabled: true,
+            total_positions: 0,
+            protected_count: 0,
+            unprotected_count: 0,
+            positions: [],
+        };
+    }
+    const entries = [];
+    for (const p of activePositions) {
+        let symbolOrders;
+        try {
+            symbolOrders = await adapter.getOpenOrders(p.symbol);
+        }
+        catch (err) {
+            const m = formatError(err);
+            logger.warn(TAG, `HL audit skipped — open orders unavailable for ${p.symbol}: ${m}`);
+            return {
+                error: `Exchange data unavailable for ${p.symbol} (Hyperliquid open-orders fetch failed). ` +
+                    `Skipping audit this cycle — do NOT run attach_brackets or ` +
+                    `close_position(reason='bracket_integrity') on the basis of this call. Underlying: ${m}`,
+            };
+        }
+        const ledgerRow = ledger.getBySymbol(p.symbol) ?? null;
+        const rowNonTerminalWithCids = !!ledgerRow && !isTerminalBracketState(ledgerRow.state) && Boolean(ledgerRow.slCid || ledgerRow.tpCid);
+        if (symbolOrders.length === 0 && rowNonTerminalWithCids) {
+            // Untrusted-empty contradiction (the SOL/INJ lesson, HL edition): the
+            // ledger says legs are live but the successful fetch shows nothing.
+            // Empty is NOT positive disconfirmation — refuse honestly.
+            return {
+                error: `Cannot confirm bracket protection for ${p.symbol} — the exchange returned an empty ` +
+                    `open-orders set while the ledger row is ${ledgerRow.state} with stored cloids. ` +
+                    `Empty ≠ "brackets gone". Skipping audit this cycle; do NOT run attach_brackets or ` +
+                    `close_position(reason='bracket_integrity'). Retry next heartbeat.`,
+            };
+        }
+        let hasBracketStop = false;
+        let hasBracketTarget = false;
+        let hasManualStop = false;
+        let hasManualTarget = false;
+        let stopPrice;
+        let targetPrice;
+        for (const o of symbolOrders) {
+            const parsed = o.clientOrderId ? parseHlBracketCloid(o.clientOrderId) : null;
+            const triggerPrice = extractTriggerPrice(o);
+            const info = o.info ?? {};
+            if (parsed?.role === 'stop') {
+                hasBracketStop = true;
+                stopPrice = triggerPrice ?? stopPrice;
+            }
+            else if (parsed?.role === 'target') {
+                hasBracketTarget = true;
+                targetPrice = triggerPrice ?? targetPrice;
+            }
+            else if (isProtectiveHlOrder(info)) {
+                const t = String(info.orderType ?? o.type ?? '').toLowerCase();
+                if (t.includes('take profit') || t.includes('tp') || t.includes('take_profit')) {
+                    hasManualTarget = true;
+                    targetPrice = triggerPrice ?? targetPrice;
+                }
+                else {
+                    hasManualStop = true;
+                    stopPrice = triggerPrice ?? stopPrice;
+                }
+            }
+        }
+        const hasStop = hasBracketStop || hasManualStop;
+        const hasTarget = hasBracketTarget || hasManualTarget;
+        if (ledgerRow?.stopPrice !== undefined)
+            stopPrice = ledgerRow.stopPrice;
+        if (ledgerRow?.targetPrice !== undefined)
+            targetPrice = ledgerRow.targetPrice;
+        let reason;
+        if (hasStop || hasTarget) {
+            reason = hasBracketStop || hasBracketTarget ? 'bracket_active' : 'manual_order_protecting';
+        }
+        else if (ledgerRow &&
+            (ledgerRow.state === 'active' || ledgerRow.state === 'partial' || ledgerRow.state === 'attaching')) {
+            reason = 'stale_ledger_row';
+        }
+        else if (ledgerRow && isTerminalBracketState(ledgerRow.state)) {
+            reason = 'ledger_terminal_no_order';
+        }
+        else {
+            reason = 'no_protective_order';
+        }
+        // ★ T-2 under-coverage: a stop can exist AND still leave scaled-in size
+        // naked (fixed-size legs). Surface it in logs; the adapter's 60s
+        // truth-check sweep auto-resizes.
+        const contracts = Math.abs(Number(p.contracts ?? 0));
+        if (hasBracketStop && ledgerRow?.qty !== undefined && ledgerRow.qty + 1e-8 < contracts) {
+            logger.warn(TAG, `HL audit: ${p.symbol} stop leg sized ${ledgerRow.qty} vs position ${contracts} — ` +
+                'under-covered (T-2); the truth-check sweep will resize');
+        }
+        entries.push({
+            symbol: p.symbol,
+            side: p.side,
+            contracts: p.contracts,
+            entry_price: p.entryPrice,
+            mark_price: p.markPrice,
+            has_stop: hasStop,
+            has_target: hasTarget,
+            stop_price: stopPrice,
+            target_price: targetPrice,
+            ledger_state: ledgerRow?.state ?? 'no_ledger_row',
+            reason,
+            recommended_action: hasStop ? 'none' : 'attach_brackets',
+        });
+    }
+    const nowTs = Date.now();
+    for (const e of entries) {
+        recordVerdictAndCheckFlicker(normalizeBracketSymbol(e.symbol), e.has_stop, nowTs);
+    }
+    const unprotected = entries.filter(e => !e.has_stop).length;
+    return {
+        ok: true,
+        mode: 'live',
+        brackets_enabled: true,
+        total_positions: entries.length,
+        protected_count: entries.length - unprotected,
+        unprotected_count: unprotected,
+        positions: entries,
+    };
+}

package/tools/bracket-control.d.ts

@@ -0,0 +1,12 @@
+import type { IExchangeAdapter } from '../exchange-adapter.js';
+import type { BracketLedger } from '../live/bracket-ledger.js';
+export interface BracketControl {
+    venue: 'binance' | 'hyperliquid';
+    ledger: BracketLedger;
+    modifyStop(symbol: string, newStopPrice: number): Promise<void>;
+    modifyTarget(symbol: string, newTargetPrice: number): Promise<void>;
+}
+/** Resolve the venue's bracket-mutation surface, or null when brackets are
+ *  not enabled (Binance with brackets.mode=off; never null on HL live —
+ *  exchange-side legs are HL live's ONLY protection, so they are always on). */
+export declare function resolveBracketControl(adapter: IExchangeAdapter): BracketControl | null;

package/tools/bracket-control.js

@@ -0,0 +1,35 @@
+// Venue dispatch for the bracket-mutating tools (issue #209).
+//
+// modify_stop / modify_target need one seam: "give me the thing that can move
+// a leg, plus the ledger that knows the current geometry". On Binance that is
+// BracketManager (+ LiveAdapter's ledger); on Hyperliquid it is the
+// HlBracketCoordinator (which owns its own venue-distinct ledger). The tools
+// must never know which venue they are on beyond this resolver — the
+// hard-cast-to-LiveAdapter pattern is exactly what left the HL arm returning
+// "Bracket orders are not enabled" on every call (the #209 recovery gap).
+import { HyperliquidLiveAdapter } from '../venues/hyperliquid/hl-live-adapter.js';
+/** Resolve the venue's bracket-mutation surface, or null when brackets are
+ *  not enabled (Binance with brackets.mode=off; never null on HL live —
+ *  exchange-side legs are HL live's ONLY protection, so they are always on). */
+export function resolveBracketControl(adapter) {
+    if (adapter instanceof HyperliquidLiveAdapter) {
+        const coordinator = adapter.getHlBracketCoordinator();
+        return {
+            venue: 'hyperliquid',
+            ledger: coordinator.getLedger(),
+            modifyStop: (symbol, px) => coordinator.modifyStop(symbol, px),
+            modifyTarget: (symbol, px) => coordinator.modifyTarget(symbol, px),
+        };
+    }
+    const live = adapter;
+    const mgr = live.getBracketManager?.();
+    const ledger = live.getBracketLedger?.();
+    if (!mgr || !ledger)
+        return null;
+    return {
+        venue: 'binance',
+        ledger,
+        modifyStop: (symbol, px) => mgr.modifyStop(symbol, px),
+        modifyTarget: (symbol, px) => mgr.modifyTarget(symbol, px),
+    };
+}

package/tools/cancel-all-orders.d.ts

@@ -1,7 +1,9 @@
 import type { IExchangeAdapter } from '../exchange-adapter.js';
+import type { TradingOperationLock } from '../lifecycle/trading-operation-lock.js';
 import type { CcxtOrder } from '../types.js';
 export declare function cancelAllOrdersTool(args: {
     symbol?: string;
 }, deps: {
     adapter: IExchangeAdapter;
+    operationLock?: TradingOperationLock;
 }): Promise<CcxtOrder[]>;

package/tools/cancel-all-orders.js

@@ -1,5 +1,8 @@
 // Tool: cancel_all_orders — cancel all open orders (paper or live)
 // NO readiness gate — emergency control (kill switch), must always work.
 export async function cancelAllOrdersTool(args, deps) {
-    return deps.adapter.cancelAllOrders(args.symbol);
+    const cancel = () => deps.adapter.cancelAllOrders(args.symbol);
+    return deps.adapter.isLive && deps.operationLock
+        ? deps.operationLock.withAccountLock(`generic-cancel-all-orders-final:${args.symbol ?? 'all'}`, cancel)
+        : cancel();
 }

package/tools/cancel-order.d.ts

@@ -1,10 +1,14 @@
 import type { IExchangeAdapter } from '../exchange-adapter.js';
+import type { TradingOperationLock } from '../lifecycle/trading-operation-lock.js';
 import type { CcxtOrder } from '../types.js';
+import type { Wave9LiveSymbolOwnershipCheck } from '../wave9/live-symbol-ownership.js';
 export declare function cancelOrderTool(args: {
     id: string;
     symbol?: string;
 }, deps: {
     adapter: IExchangeAdapter;
+    operationLock?: TradingOperationLock;
+    checkWave9LiveSymbolOwnership?: Wave9LiveSymbolOwnershipCheck;
 }): Promise<CcxtOrder | {
     error: string;
 }>;

package/tools/cancel-order.js

@@ -1,12 +1,58 @@
-// Tool: cancel_order — cancel a single order (paper or live)
-// NO readiness gate — emergency control, must always work.
+// Tool: cancel_order — cancel a single order (paper or live).
+// There is no readiness gate, but LIVE cancellation cannot individually strip
+// candidate-bound Wave 9 protection. The emergency escape is an explicit
+// operator close, which reduces exposure instead of leaving it naked.
 import { formatError } from '../logger.js';
 export async function cancelOrderTool(args, deps) {
     if (!args.id) {
         return { error: 'Order ID is required.' };
     }
+    if (!deps.adapter.isLive) {
+        try {
+            return await deps.adapter.cancelOrder(args.id, args.symbol);
+        }
+        catch (err) {
+            return { error: formatError(err) };
+        }
+    }
+    if (deps.checkWave9LiveSymbolOwnership && !deps.operationLock) {
+        return {
+            error: 'Live cancel_order refused: the shared trading operation lock is required ' +
+                'while Wave 9 LIVE ownership checks are enabled.',
+        };
+    }
+    const cancelLive = async () => {
+        let symbol = args.symbol?.trim();
+        if (!symbol) {
+            const matches = (await deps.adapter.getOpenOrders())
+                .filter((order) => order.id === args.id);
+            if (matches.length !== 1 || !matches[0].symbol) {
+                throw new Error(`cancel_order refused: order ${args.id} could not be resolved to exactly one ` +
+                    `trusted open-order symbol (matches=${matches.length}).`);
+            }
+            symbol = matches[0].symbol;
+        }
+        if (deps.checkWave9LiveSymbolOwnership) {
+            let ownership;
+            try {
+                ownership = await deps.checkWave9LiveSymbolOwnership(symbol);
+            }
+            catch (err) {
+                throw new Error(`cancel_order refused at mutation boundary: Wave 9 LIVE ownership check failed ` +
+                    `for ${symbol} (${formatError(err)}).`);
+            }
+            if (ownership.status === 'owned' || ownership.status === 'ambiguous') {
+                throw new Error(`cancel_order refused at mutation boundary: ${symbol} has ` +
+                    `${ownership.status} Wave 9 LIVE ownership (${ownership.reason}). ` +
+                    'Use operator_command to close the position instead of stripping candidate-bound protection.');
+            }
+        }
+        return deps.adapter.cancelOrder(args.id, symbol);
+    };
     try {
-        return await deps.adapter.cancelOrder(args.id, args.symbol);
+        return deps.operationLock
+            ? await deps.operationLock.withAccountLock(`generic-cancel-order-final:${args.id}`, cancelLive)
+            : await cancelLive();
     }
     catch (err) {
         return { error: formatError(err) };

package/tools/close-position.d.ts

@@ -4,6 +4,11 @@ import type { CcxtOrder } from '../types.js';
 import { type ClosePositionArgs } from './assessment-validation.js';
 import { type AutoCaptureContext } from '../ingest/position-auto-capture.js';
 import { type ExitGateMode } from '../config/position-review-config.js';
+import type { TradingOperationLock } from '../lifecycle/trading-operation-lock.js';
+import type { Wave9LiveExecutionLedger } from '../wave9/live-execution-ledger.js';
+import type { Wave9LiveSymbolOwnershipCheck } from '../wave9/live-symbol-ownership.js';
+import { type Wave9LiveResidualProtectionResult } from '../wave9/live-residual-protection.js';
+import { type Wave9PaperAdmissionGuard } from '../wave9/paper-admission-guard.js';
 export declare function closePositionTool(args: ClosePositionArgs, deps: {
     binanceApi: PublicMarketDataApi;
     adapter: IExchangeAdapter;
@@ -11,6 +16,24 @@ export declare function closePositionTool(args: ClosePositionArgs, deps: {
     /** Override for tests — production reads from plugin-config.json on each
      *  call so the flag can be flipped without a restart. */
     exitGateMode?: ExitGateMode;
+    wave9AdmissionGuard?: Wave9PaperAdmissionGuard;
+    refreshPaperState?: () => void;
+    wave9TradingModeCheck?: () => string;
+    wave9VenueCheck?: () => string;
+    captureWave9PositionFingerprint?: (symbol: string) => Promise<{
+        fingerprint: string;
+        position: {
+            candidateId?: string;
+            missionId?: string;
+            setupType?: string;
+            side: 'long' | 'short';
+        };
+    }>;
+    wave9LiveLedger?: Wave9LiveExecutionLedger;
+    checkWave9LiveSymbolOwnership?: Wave9LiveSymbolOwnershipCheck;
+    reprotectWave9LiveResidual?: (adapter: IExchangeAdapter, ledger: Wave9LiveExecutionLedger, candidateId: string, symbol: string) => Promise<Wave9LiveResidualProtectionResult>;
+    operationLock?: TradingOperationLock;
+    operationLockHeld?: boolean;
 }): Promise<CcxtOrder | {
     error: string;
 }>;