@vtxmacro/cli 2026.10.2 → 2026.10.3

package/bin/vtx-mcp.js

@@ -142,10 +142,10 @@ var VtxAgentClient = class _VtxAgentClient {
       body: payload
     });
   }
-  pollBrowserLogin(loginCode) {
+  pollBrowserLogin(loginCode, verifier) {
     return this.request("/auth/agent-tokens/login/poll", {
       method: "POST",
-      body: { login_code: loginCode }
+      body: { login_code: loginCode, verifier }
     });
   }
   revokeToken(tokenId, reason = "cli_revoked") {

package/bin/vtx-service-bootstrap.js

@@ -16,7 +16,7 @@ import { fileURLToPath } from "node:url";
 // agent-cli-release.json
 var agent_cli_release_default = {
   package_name: "@vtxmacro/cli",
-  package_version: "2026.10.2",
+  package_version: "2026.10.3",
   codex_package_name: "@openai/codex",
   codex_version: "0.155.0",
   copilot_sdk_package_name: "@github/copilot-sdk",

package/bin/vtx.js

@@ -77,7 +77,7 @@ var init_agent_cli_release = __esm({
   "agent-cli-release.json"() {
     agent_cli_release_default = {
       package_name: "@vtxmacro/cli",
-      package_version: "2026.10.2",
+      package_version: "2026.10.3",
       codex_package_name: "@openai/codex",
       codex_version: "0.155.0",
       copilot_sdk_package_name: "@github/copilot-sdk",
@@ -48455,10 +48455,10 @@ var init_client = __esm({
           body: payload
         });
       }
-      pollBrowserLogin(loginCode) {
+      pollBrowserLogin(loginCode, verifier) {
         return this.request("/auth/agent-tokens/login/poll", {
           method: "POST",
-          body: { login_code: loginCode }
+          body: { login_code: loginCode, verifier }
         });
       }
       revokeToken(tokenId, reason = "cli_revoked") {
@@ -56604,8 +56604,8 @@ var init_units = __esm({
 });
 
 // node_modules/ethers/lib.esm/utils/uuid.js
-function uuidV4(randomBytes11) {
-  const bytes3 = getBytes(randomBytes11, "randomBytes");
+function uuidV4(randomBytes12) {
+  const bytes3 = getBytes(randomBytes12, "randomBytes");
   bytes3[6] = bytes3[6] & 15 | 64;
   bytes3[8] = bytes3[8] & 63 | 128;
   const value = hexlify(bytes3);
@@ -60023,7 +60023,7 @@ function weierstrass(curveDef) {
   function prepSig(msgHash, privateKey, opts = defaultSigOpts) {
     if (["recovered", "canonical"].some((k) => k in opts))
       throw new Error("sign() legacy options not supported");
-    const { hash: hash4, randomBytes: randomBytes11 } = CURVE;
+    const { hash: hash4, randomBytes: randomBytes12 } = CURVE;
     let { lowS, prehash, extraEntropy: ent } = opts;
     if (lowS == null)
       lowS = true;
@@ -60034,7 +60034,7 @@ function weierstrass(curveDef) {
     const d = normPrivateKeyToScalar(privateKey);
     const seedArgs = [int2octets(d), int2octets(h1int)];
     if (ent != null) {
-      const e = ent === true ? randomBytes11(Fp2.BYTES) : ent;
+      const e = ent === true ? randomBytes12(Fp2.BYTES) : ent;
       seedArgs.push(ensureBytes("extraEntropy", e));
     }
     const seed = concatBytes2(...seedArgs);
@@ -77479,7 +77479,7 @@ var require_websocket = __commonJS({
     var http2 = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes11, createHash: createHash14 } = __require("crypto");
+    var { randomBytes: randomBytes12, createHash: createHash15 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -78017,7 +78017,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes11(16).toString("base64");
+      const key = randomBytes12(16).toString("base64");
       const request = isSecure ? https2.request : http2.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -78147,7 +78147,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest2 = createHash14("sha1").update(key + GUID).digest("base64");
+        const digest2 = createHash15("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest2) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -78525,7 +78525,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http2 = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash14 } = __require("crypto");
+    var { createHash: createHash15 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -78832,7 +78832,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest2 = createHash14("sha1").update(key + GUID).digest("base64");
+        const digest2 = createHash15("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -89406,7 +89406,9 @@ var init_runtime_execution = __esm({
             execution_metadata: {
               trigger_price: leg.triggerPrice,
               reason_code: reasonCode,
-              terminal_order_status: evidence.orderStatus
+              terminal_order_status: evidence.orderStatus,
+              protected_size: leg.size,
+              position_tpsl: leg.positionTpsl === true || evidence.isPositionTpsl === true
             }
           };
         }
@@ -95222,7 +95224,7 @@ var vtx_exports = {};
 __export(vtx_exports, {
   runVtxCli: () => runVtxCli
 });
-import { randomUUID as randomUUID16 } from "node:crypto";
+import { createHash as createHash14, randomBytes as randomBytes11, randomUUID as randomUUID16 } from "node:crypto";
 import { spawn as spawn12 } from "node:child_process";
 function render2(value, json2) {
   if (json2) {
@@ -95476,21 +95478,25 @@ async function runBrowserLogin(args, config2, json2) {
     apiUrl: config2.apiUrl,
     activeProfileId: config2.activeProfileId
   });
-  const started = await client.startBrowserLogin({ display_name: displayName, scopes });
+  const verifier = randomBytes11(32).toString("base64url");
+  const verifierHash = createHash14("sha256").update(verifier).digest("hex");
+  const started = await client.startBrowserLogin({ display_name: displayName, scopes, verifier_hash: verifierHash });
   if (!noOpen) {
     try {
       openBrowser(started.verification_uri_complete);
     } catch {
     }
   }
-  const intro = json2 ? "" : `Open this URL to approve VTX CLI access:
+  process.stderr.write(
+    `Open this URL to approve VTX CLI access:
 ${started.verification_uri_complete}
 
 Waiting for approval...
-`;
+`
+  );
   const deadline = Date.now() + timeoutSeconds * 1e3;
   while (Date.now() < deadline) {
-    const polled = await client.pollBrowserLogin(started.login_code);
+    const polled = await client.pollBrowserLogin(started.login_code, verifier);
     if (polled.status === "approved") {
       const token = String(polled.token || "").trim();
       if (!token) {
@@ -95499,7 +95505,7 @@ Waiting for approval...
       await writeStoredAgentAuth(config2.tokenPath, { token });
       return {
         exitCode: 0,
-        stdout: `${intro}${render2({ status: "logged_in", token_metadata: polled.token_metadata ?? null }, json2)}`,
+        stdout: render2({ status: "logged_in", token_metadata: polled.token_metadata ?? null }, json2),
         stderr: ""
       };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtxmacro/cli",
-  "version": "2026.10.2",
+  "version": "2026.10.3",
   "description": "VTX Macro CLI, MCP server, and durable external inference host.",
   "type": "module",
   "license": "UNLICENSED",