@tradejs/app 3.1.29-beta.273 → 3.1.29-beta.276

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tradejs/app",
-  "version": "3.1.29-beta.273",
+  "version": "3.1.29-beta.276",
   "description": "Installable Next.js UI for the TradeJS TypeScript framework: dashboards, backtests, charts, and runtime data.",
   "keywords": [
     "tradejs",
@@ -59,11 +59,11 @@
     "@emotion/react": "^11.14.0",
     "@modelcontextprotocol/sdk": "^1.32.1",
     "@node-oauth/oauth2-server": "^5.3.0",
-    "@tradejs/core": "^3.1.29-beta.273",
-    "@tradejs/indicators": "^3.1.29-beta.273",
-    "@tradejs/infra": "^3.1.29-beta.273",
-    "@tradejs/node": "^3.1.29-beta.273",
-    "@tradejs/types": "^3.1.29-beta.273",
+    "@tradejs/core": "^3.1.29-beta.276",
+    "@tradejs/indicators": "^3.1.29-beta.276",
+    "@tradejs/infra": "^3.1.29-beta.276",
+    "@tradejs/node": "^3.1.29-beta.276",
+    "@tradejs/types": "^3.1.29-beta.276",
     "@types/bcryptjs": "2.4.6",
     "@types/lodash": "4.17.24",
     "@types/node": "24.13.3",

package/src/app/lib/mcp/artifacts.ts

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import { open, readdir, readFile, realpath, stat } from 'node:fs/promises';
 import path from 'node:path';
 import {
@@ -10,6 +11,7 @@ import {
   mcpId,
   mcpProjectRoot,
   readMcpDeployments,
+  redactMcpJobLog,
 } from '@tradejs/node/mcp';
 
 interface CatalogEntry {
@@ -107,6 +109,8 @@ export interface McpArtifactListOptions {
   kind?: CatalogEntry['kind'];
   offset?: number;
   limit?: number;
+  startTime?: number;
+  endTime?: number;
 }
 
 export const listMcpArtifacts = async (
@@ -123,6 +127,15 @@ export const listMcpArtifacts = async (
     limit > 100
   )
     throw new Error('Invalid artifact list pagination');
+  if (
+    (options.startTime !== undefined &&
+      !Number.isSafeInteger(options.startTime)) ||
+    (options.endTime !== undefined && !Number.isSafeInteger(options.endTime)) ||
+    (options.startTime !== undefined &&
+      options.endTime !== undefined &&
+      options.startTime >= options.endTime)
+  )
+    throw new Error('Invalid artifact window');
   const { deployments } = await readMcpDeployments(userName);
   const allowed = new Set(deployments.map((row) => row.id));
   const pending = [
@@ -151,6 +164,20 @@ export const listMcpArtifacts = async (
         )
           continue;
         if (options.kind && artifact.kind !== options.kind) continue;
+        const window = artifact.manifest.window as {
+          startTime: number;
+          endTime: number;
+        };
+        if (
+          options.startTime !== undefined &&
+          window.endTime <= options.startTime
+        )
+          continue;
+        if (
+          options.endTime !== undefined &&
+          window.startTime >= options.endTime
+        )
+          continue;
         await mcpStorage.put(storageKey(userName, artifact.id), artifact, 3600);
         items.push({
           id: artifact.id,
@@ -158,7 +185,10 @@ export const listMcpArtifacts = async (
           deploymentId: artifact.deploymentId,
           sha256: artifact.sha256,
           bytes: artifact.bytes,
-          window: artifact.manifest.window,
+          window,
+          artifactId: artifact.manifest.artifactId,
+          deploymentCompositionId: artifact.manifest.deploymentCompositionId,
+          runtimeEvidence: artifact.manifest.runtimeEvidence,
         });
       } catch {
         invalidBundles++;
@@ -173,7 +203,11 @@ export const listMcpArtifacts = async (
           });
       }
   }
-  items.sort((left, right) => left.id.localeCompare(right.id));
+  items.sort(
+    (left, right) =>
+      right.window.endTime - left.window.endTime ||
+      left.id.localeCompare(right.id),
+  );
   const page = items.slice(offset, offset + limit);
   const nextOffset =
     offset + page.length < items.length ? offset + page.length : null;
@@ -186,7 +220,12 @@ export const listMcpArtifacts = async (
     truncated: pending.length > 0 || nextOffset != null,
     scanTruncated: pending.length > 0,
     invalidOrInaccessibleBundles: invalidBundles,
-    note: 'Only verified, user-owned bundles available on this host are included.',
+    order: 'window.endTime_desc_id_asc',
+    coverage: {
+      retentionStartTime: null,
+      completeness: 'host_local_verified_bundles_only',
+    },
+    note: 'Only verified, user-owned bundles available on this host are included. Excluded bundle counts combine inaccessible and invalid data; reasons and paths are withheld to protect other users. Missing bundles do not prove no activity.',
   };
 };
 
@@ -205,28 +244,84 @@ export const resolveMcpArtifact = async (userName: string, id: string) => {
   return verified;
 };
 
+type ArtifactFile = 'payload' | 'manifest.json' | '.complete' | 'replay.log';
+
+const artifactFile = async (artifact: CatalogEntry, file: ArtifactFile) => {
+  const target =
+    file === 'payload'
+      ? artifact.payloadPath
+      : path.join(artifact.bundleDir, file);
+  if (
+    !['payload', 'manifest.json', '.complete', 'replay.log'].includes(file) ||
+    (file === 'replay.log' && artifact.kind !== 'runtime-feedback-replay')
+  )
+    throw new Error('Invalid artifact file');
+  const resolved = await checkPayload(target);
+  if (file === 'payload')
+    return {
+      path: resolved,
+      file,
+      bytes: artifact.bytes,
+      sha256: artifact.sha256,
+    };
+  const bytes = await readFile(resolved);
+  // Log files are original bundle bytes. Refuse export if credential redaction
+  // would be required; never silently change bytes advertised for verification.
+  if (
+    file === 'replay.log' &&
+    bytes
+      .toString('utf8')
+      .split('\n')
+      .some(
+        (line) =>
+          (line.length <= 1000 && redactMcpJobLog(line) !== line) ||
+          line.length > 1000,
+      )
+  )
+    throw new Error(
+      'Invalid artifact file: log requires redaction; use job_get_logs',
+    );
+  return {
+    path: resolved,
+    file,
+    bytes: bytes.length,
+    sha256: createHash('sha256').update(bytes).digest('hex'),
+  };
+};
+
 export const readMcpArtifactChunk = async (
   userName: string,
   id: string,
   offset: number,
   length: number,
+  file: ArtifactFile = 'payload',
 ) => {
+  if (
+    !Number.isSafeInteger(offset) ||
+    offset < 0 ||
+    !Number.isSafeInteger(length) ||
+    length < 1
+  )
+    throw new Error('Invalid artifact chunk range');
   const artifact = await resolveMcpArtifact(userName, id);
-  const handle = await open(await confinedPath(artifact.payloadPath), 'r');
+  const selected = await artifactFile(artifact, file);
+  if (offset > selected.bytes) throw new Error('Invalid artifact chunk offset');
+  const handle = await open(selected.path, 'r');
   try {
     const buffer = Buffer.alloc(
-      Math.min(length, Math.max(0, artifact.bytes - offset)),
+      Math.min(length, Math.max(0, selected.bytes - offset)),
     );
     const { bytesRead } = await handle.read(buffer, 0, buffer.length, offset);
     return {
       id,
       offset,
-      bytes: artifact.bytes,
-      sha256: artifact.sha256,
+      file,
+      bytes: selected.bytes,
+      sha256: selected.sha256,
       encoding: 'base64',
       data: buffer.subarray(0, bytesRead).toString('base64'),
       nextOffset:
-        offset + bytesRead < artifact.bytes ? offset + bytesRead : null,
+        offset + bytesRead < selected.bytes ? offset + bytesRead : null,
     };
   } finally {
     await handle.close();
@@ -236,10 +331,29 @@ export const readMcpArtifactChunk = async (
 export const readMcpDiagnosticReport = async (userName: string, id: string) => {
   const artifact = await resolveMcpArtifact(userName, id);
   const payload = JSON.parse(await readFile(artifact.payloadPath, 'utf8'));
+  const files = [];
+  for (const file of [
+    'payload',
+    'manifest.json',
+    '.complete',
+    ...(artifact.kind === 'runtime-feedback-replay' ? ['replay.log'] : []),
+  ] as ArtifactFile[]) {
+    try {
+      const { path: _path, ...descriptor } = await artifactFile(artifact, file);
+      files.push({ ...descriptor, available: true });
+    } catch {
+      files.push({
+        file,
+        available: false,
+        reason: 'file_unavailable_or_requires_redaction',
+      });
+    }
+  }
   // Large reports stay available through artifact_get with original checksums.
   return {
     id,
     manifest: artifact.manifest,
+    files,
     bytes: artifact.bytes,
     sha256: artifact.sha256,
     ...(artifact.bytes <= 96000

package/src/app/lib/mcp/server.ts

@@ -1,3 +1,4 @@
+import { readDeploymentVerification } from './verification';
 import { randomUUID } from 'node:crypto';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { z } from 'zod';
@@ -6,6 +7,7 @@ import {
   cancelMcpJob,
   enqueueMcpJob,
   mcpId,
+  McpCursorError,
   publicMcpJob,
   readAuthorizedMcpJob,
   readMcpBacktestPage,
@@ -82,6 +84,7 @@ const runtimePage = {
   endTime: timestamp,
   strategy: identifier.optional(),
   symbol: symbol.optional(),
+  limit: z.number().int().min(1).max(50).default(50),
 };
 
 export const createTradejsMcpServer = (principal: McpPrincipal) => {
@@ -165,6 +168,21 @@ export const createTradejsMcpServer = (principal: McpPrincipal) => {
             structuredContent: { data: result },
           };
         } catch (error) {
+          if (error instanceof McpCursorError) {
+            const data = {
+              code: error.code,
+              message: error.message,
+              recovery:
+                error.code === 'CURSOR_EXPIRED'
+                  ? 'Restart cursor=0 with the same window and filters; deduplicate record identities. Do not move startTime to the last record: storage order is not chronological.'
+                  : 'Restore the original user, account and filters or start a new traversal.',
+            };
+            return {
+              isError: true,
+              content: [{ type: 'text' as const, text: JSON.stringify(data) }],
+              structuredContent: { data },
+            };
+          }
           const message = error instanceof Error ? error.message : '';
           // Filesystem, connector and database errors may contain secrets or paths.
           const safe =
@@ -258,6 +276,27 @@ export const createTradejsMcpServer = (principal: McpPrincipal) => {
     {},
     async () => readMcpDeployments(principal.userName),
   );
+  tool(
+    'runtime_get_verification',
+    'Read the checksum-verified Deploy-owned package manifest, actual image digest, deployment verification and health observation. fresh=false means the collector is stale; heartbeat is not a replacement. No job or runtime mutation is performed.',
+    ['runtime:read'],
+    { deploymentId: identifier },
+    async (args) => {
+      const deployment = await requireMcpDeployment(
+        principal.userName,
+        args.deploymentId,
+      );
+      return readDeploymentVerification(
+        String(process.env.PROJECT_CWD || process.cwd()),
+        {
+          userName: principal.userName,
+          deploymentId: deployment.id,
+          accountId: deployment.accountId,
+          deploymentCompositionId: deployment.deploymentCompositionId,
+        },
+      );
+    },
+  );
   tool(
     'runtime_list_strategies',
     'Read effective strategies, configs and immutable revisions for a deployment bound to this user account.',
@@ -268,7 +307,7 @@ export const createTradejsMcpServer = (principal: McpPrincipal) => {
   for (const kind of ['signals', 'evaluations', 'orders'] as const) {
     tool(
       `runtime_list_${kind}`,
-      `Read a bounded storage page of ${kind}. Window is half-open [startTime,endTime), at most 7 days. Continue even after an empty page until cursor=0.`,
+      `Read a bounded storage page of ${kind}. Window is half-open [startTime,endTime), at most 7 days. Continue even after an empty page until cursor=0. Shared cursors last 24 hours; retry the identical request after transport errors. Storage order is not chronological; CURSOR_EXPIRED requires restarting the same window and deduplicating identities.`,
       ['runtime:read'],
       runtimePage,
       async (args) => {
@@ -401,6 +440,8 @@ export const createTradejsMcpServer = (principal: McpPrincipal) => {
       kind: z.enum(['runtime-evidence', 'runtime-feedback-replay']).optional(),
       offset: z.number().int().min(0).default(0),
       limit: z.number().int().min(1).max(100).default(20),
+      startTime: timestamp.optional(),
+      endTime: timestamp.optional(),
     },
     async (args) => listMcpArtifacts(principal.userName, args),
   );
@@ -414,12 +455,15 @@ export const createTradejsMcpServer = (principal: McpPrincipal) => {
   );
   tool(
     'artifact_get',
-    'Read an owned verified artifact in base64 chunks. Concatenate decoded bytes, verify total size and SHA-256 before local analysis. No filesystem path is accepted.',
+    'Read an owned verified artifact in base64 chunks. Concatenate decoded bytes, verify total size and SHA-256 before local analysis. Select a file listed by diagnostics_get_report (payload by default). Each file has its own size and SHA-256. No filesystem path is accepted.',
     ['diagnostics:read'],
     {
       artifactId,
       offset: z.number().int().min(0).default(0),
       length: z.number().int().min(1).max(48000).default(48000),
+      file: z
+        .enum(['payload', 'manifest.json', '.complete', 'replay.log'])
+        .default('payload'),
     },
     async (args) =>
       readMcpArtifactChunk(
@@ -427,6 +471,7 @@ export const createTradejsMcpServer = (principal: McpPrincipal) => {
         args.artifactId,
         args.offset,
         args.length,
+        args.file,
       ),
   );
   tool(

package/src/app/lib/mcp/verification.ts

@@ -0,0 +1,181 @@
+import { createHash } from 'node:crypto';
+import { readFile, realpath, stat } from 'node:fs/promises';
+import path from 'node:path';
+
+type Binding = {
+  userName: string;
+  deploymentId: string;
+  accountId: string;
+  deploymentCompositionId: string;
+};
+const hash = (bytes: Buffer) =>
+  createHash('sha256').update(bytes).digest('hex');
+
+export const parseDeploymentVerification = (
+  bytes: Buffer,
+  pointer: { sha256: string; bytes: number },
+  binding: Binding,
+  manifestBytes: Buffer,
+  imageDigest: string,
+  now = Date.now(),
+) => {
+  if (bytes.length !== pointer.bytes || hash(bytes) !== pointer.sha256)
+    throw Error('MCP verification checksum mismatch');
+  const report = JSON.parse(bytes.toString('utf8'));
+  if (
+    report.schemaVersion !== 1 ||
+    report.reportType !== 'runtime-deployment-verification' ||
+    Object.entries(binding).some(([key, value]) => report[key] !== value)
+  )
+    throw Error('MCP verification binding mismatch');
+  if (
+    typeof report.ok !== 'boolean' ||
+    typeof report.verification?.ok !== 'boolean' ||
+    !Array.isArray(report.verification?.strategies) ||
+    !report.verification.strategies.length ||
+    typeof report.health?.status !== 'string' ||
+    report.verification.strategies.some(
+      (strategy: {
+        strategyName?: string;
+        strategyRevision?: string;
+        controlState?: string;
+      }) =>
+        !strategy.strategyName ||
+        !/^sr1:[a-f0-9]+$/.test(strategy.strategyRevision ?? '') ||
+        !['active', 'entries_paused'].includes(strategy.controlState ?? ''),
+    ) ||
+    report.ok !== (report.verification.ok && report.health.status === 'healthy')
+  )
+    throw Error('MCP verification result invalid');
+  const manifest = JSON.parse(manifestBytes.toString('utf8'));
+  if (
+    !/^sha256:[a-f0-9]{64}$/.test(imageDigest) ||
+    report.projectSha !== manifest.projectSha ||
+    report.imageDigest !== imageDigest ||
+    report.runtimePackageManifest?.sha256 !== hash(manifestBytes) ||
+    report.runtimePackageManifest?.bytes !== manifestBytes.length ||
+    JSON.stringify(report.runtimePackageManifest.manifest) !==
+      JSON.stringify(manifest)
+  )
+    throw Error('MCP verification image or manifest mismatch');
+  if (
+    !Number.isSafeInteger(report.observedAt) ||
+    report.observedAt > now + 30000 ||
+    (report.deploymentVerifiedAt !== null &&
+      (!Number.isSafeInteger(report.deploymentVerifiedAt) ||
+        report.deploymentVerifiedAt > report.observedAt))
+  )
+    throw Error('MCP verification timestamp invalid');
+  return {
+    report,
+    payload: { encoding: 'base64', data: bytes.toString('base64') },
+    sha256: pointer.sha256,
+    bytes: pointer.bytes,
+    observedAt: now,
+    fresh: now - report.observedAt <= 10 * 60000,
+    source: 'deploy_owned_verification_bundle',
+  };
+};
+
+const readVerification = async (projectRoot: string, binding: Binding) => {
+  const manifestBytes = await readFile(
+    path.join(projectRoot, 'runtime-package-manifest.json'),
+  );
+  const manifest = JSON.parse(manifestBytes.toString('utf8'));
+  if (
+    !/^[a-f0-9]{40}$/.test(manifest.projectSha) ||
+    !/^[\w-]+$/.test(binding.userName) ||
+    !/^[\w-]+$/.test(binding.deploymentId) ||
+    !/^dc1:[a-f0-9]+$/.test(binding.deploymentCompositionId)
+  )
+    throw Error('MCP verification identity invalid');
+  const root = await realpath(
+    path.join(projectRoot, 'data', 'runtime-verification'),
+  );
+  const dir = path.join(
+    root,
+    binding.userName,
+    binding.deploymentId,
+    manifest.projectSha,
+    binding.deploymentCompositionId,
+  );
+  const confined = async (name: string) => {
+    const resolved = await realpath(path.join(dir, name));
+    if (!resolved.startsWith(root + path.sep))
+      throw Error('MCP verification outside data root');
+    return resolved;
+  };
+  const pointerBytes = await readFile(await confined('latest.json'));
+  if (pointerBytes.length > 1024)
+    throw Error('MCP verification pointer too large');
+  const pointer = JSON.parse(pointerBytes.toString('utf8'));
+  if (
+    !/^[a-f0-9]{64}\.json$/.test(pointer.file) ||
+    pointer.file !== `${pointer.sha256}.json` ||
+    !Number.isSafeInteger(pointer.bytes) ||
+    pointer.bytes < 1 ||
+    pointer.bytes > 48000
+  )
+    throw Error('MCP verification pointer invalid');
+  const payloadPath = await confined(pointer.file);
+  if ((await stat(payloadPath)).size !== pointer.bytes)
+    throw Error('MCP verification size mismatch');
+  const bytes = await readFile(payloadPath);
+  const result = parseDeploymentVerification(
+    bytes,
+    pointer,
+    binding,
+    manifestBytes,
+    String(process.env.TRADEJS_PROJECT_IMAGE_DIGEST ?? ''),
+  );
+  const attemptPath = path.join(
+    root,
+    binding.userName,
+    binding.deploymentId,
+    'latest-attempt.json',
+  );
+  try {
+    const resolved = await realpath(attemptPath);
+    if (
+      !resolved.startsWith(root + path.sep) ||
+      (await stat(resolved)).size > 2048
+    )
+      throw Error('MCP verification attempt invalid');
+    const attempt = JSON.parse(await readFile(resolved, 'utf8'));
+    if (
+      attempt.projectSha !== manifest.projectSha ||
+      attempt.imageDigest !== result.report.imageDigest ||
+      !Number.isSafeInteger(attempt.observedAt) ||
+      !['running', 'failed', 'succeeded'].includes(attempt.status)
+    )
+      throw Error('MCP verification attempt binding invalid');
+    return {
+      ...result,
+      fresh:
+        result.fresh &&
+        !(
+          attempt.status !== 'succeeded' &&
+          attempt.observedAt + 1000 >= result.report.observedAt
+        ),
+      collection: attempt,
+    };
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    return result;
+  }
+};
+
+export const readDeploymentVerification = async (
+  projectRoot: string,
+  binding: Binding,
+) => {
+  try {
+    return await readVerification(projectRoot, binding);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT')
+      throw new Error(
+        'MCP deployment verification is not published for the current image and composition',
+      );
+    throw error;
+  }
+};