@whyshu/ba 0.0.0-stage → 0.1.1

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Binance account panel",
+    "description": "Adds a left sidebar entry that opens a read-only panel with Binance spot assets, futures positions, and market board. The API key stays in the dsh host process."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "币安账户面板",
+    "description": "在左侧栏增加一个入口，点击后在主视图展示币安现货资产、合约持仓与行情看板（只读）。API Key 只保存在 dsh 宿主进程，不下发浏览器。"
+  }
+}

package/package.json

@@ -1,6 +1,53 @@
 {
   "name": "@whyshu/ba",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "DSH 左侧栏币安面板：主视图展示现货资产、合约持仓与行情看板（只读，API Key 仅宿主侧）",
+  "type": "module",
+  "license": "MIT",
+  "engines": {
+    "node": ">=24.2.0",
+    "dsh": ">=0.2.0-0 <0.3.0-0"
+  },
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "dsh-plugin",
+    "cordis",
+    "binance",
+    "spot",
+    "futures",
+    "portfolio"
+  ],
+  "exports": {
+    ".": "./src/index.js",
+    "./client": "./dist/client.js",
+    "./locale/*.json": "./locale/*.json",
+    "./icon": "./icon.svg"
+  },
+  "files": [
+    "src/",
+    "dist/",
+    "locale/",
+    "icon.svg",
+    "cordis.patch.yml",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "node --test test/*.test.mjs"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true
+    },
+    "plugin": {
+      "displayName": "币安账户面板"
+    }
+  }
+}

package/src/binance.mjs

@@ -0,0 +1,385 @@
+/**
+ * whyshu-ba · 币安只读数据层（宿主侧）
+ *
+ * 设计红线：
+ *  - API Key / Secret **只在宿主进程**读取与签名，永不回传浏览器；
+ *  - 只读：只调用 GET 行情/账户/持仓接口，不调用任何下单/划转/提现接口；
+ *  - 每次请求都重新读 `~/.dsh/argent/ba.env`，改 Key / 代理无需重启 dsh；
+ *  - 代理可配（默认读 BINANCE_PROXY，其次 HTTPS_PROXY），未配置时直连。
+ *
+ * 配置（~/.dsh/argent/ba.env，权限 600）：
+ *   BINANCE_API_KEY=...
+ *   BINANCE_API_SECRET=...
+ *   BINANCE_PROXY=http://127.0.0.1:7890      # 可选；本机直连 api.binance.com 不通时必须配
+ *   BINANCE_SYMBOLS=BTCUSDT,ETHUSDT,SOLUSDT  # 可选，行情看板自选币对
+ */
+import { createHmac } from 'node:crypto'
+import { existsSync, readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import http from 'node:http'
+import https from 'node:https'
+import tls from 'node:tls'
+
+export const SPOT_BASE = 'https://api.binance.com'
+export const FUTURES_BASE = 'https://fapi.binance.com'
+export const ENV_FILE = join(homedir(), '.dsh', 'argent', 'ba.env')
+export const DEFAULT_SYMBOLS = ['BTCUSDT', 'ETHUSDT', 'SOLUSDT', 'BNBUSDT']
+const TIMEOUT_MS = 12000
+const RECV_WINDOW = 5000
+
+/** 币安接口返回的业务错误（code/msg）；与网络错误分开，便于前端提示。 */
+export class BinanceError extends Error {
+  constructor(message, { status = 0, code = 0 } = {}) {
+    super(message)
+    this.name = 'BinanceError'
+    this.status = status
+    this.code = code
+  }
+}
+
+/** 极简 KEY=VALUE 解析（只支持注释、空行、单/双引号），不引依赖。 */
+export function parseEnvText(text) {
+  const out = {}
+  for (const raw of String(text || '').split(/\r?\n/)) {
+    const line = raw.trim()
+    if (!line || line.startsWith('#')) continue
+    const eq = line.indexOf('=')
+    if (eq <= 0) continue
+    const key = line.slice(0, eq).trim()
+    let value = line.slice(eq + 1).trim()
+    if (value.length >= 2) {
+      const q = value[0]
+      if ((q === '"' || q === "'") && value[value.length - 1] === q) value = value.slice(1, -1)
+    }
+    if (key) out[key] = value
+  }
+  return out
+}
+
+/** 读设置：进程环境变量优先，其次 env 文件。envFile 可传（测试用隔离路径）。 */
+export function loadSettings(envFile = ENV_FILE) {
+  let file = {}
+  try {
+    if (existsSync(envFile)) file = parseEnvText(readFileSync(envFile, 'utf8'))
+  } catch { /* 读不到就按未配置处理 */ }
+  const pick = (name) => {
+    const raw = process.env[name] !== undefined ? process.env[name] : file[name]
+    return typeof raw === 'string' && raw.trim() ? raw.trim() : ''
+  }
+  const symbols = pick('BINANCE_SYMBOLS')
+    .split(',')
+    .map((s) => s.trim().toUpperCase())
+    .filter((s) => /^[A-Z0-9]{5,20}$/.test(s))
+  const proxy = pick('BINANCE_PROXY')
+    || process.env.HTTPS_PROXY || process.env.https_proxy
+    || process.env.HTTP_PROXY || process.env.http_proxy
+    || ''
+  return {
+    apiKey: pick('BINANCE_API_KEY'),
+    apiSecret: pick('BINANCE_API_SECRET'),
+    proxy,
+    symbols: symbols.length ? symbols : DEFAULT_SYMBOLS,
+    envFile,
+  }
+}
+
+export function hasCredentials(settings) {
+  return Boolean(settings && settings.apiKey && settings.apiSecret)
+}
+
+/**
+ * 通过 HTTP 代理建立到目标主机的 CONNECT 隧道。
+ * @param {string} proxy 代理 URL（http://host:port）
+ * @param {URL} target 目标 URL
+ * @param {number} timeoutMs 超时
+ * @returns {Promise<import('node:net').Socket>} 已连通的裸 TCP socket
+ */
+function openTunnel(proxy, target, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    let proxyUrl
+    try { proxyUrl = new URL(proxy) } catch { reject(new Error('BINANCE_PROXY 不是合法 URL: ' + proxy)); return }
+    if (proxyUrl.protocol !== 'http:') { reject(new Error('只支持 http:// 代理，收到: ' + proxyUrl.protocol)); return }
+    const port = target.port || '443'
+    const host = target.hostname
+    const req = http.request({
+      host: proxyUrl.hostname,
+      port: proxyUrl.port || 80,
+      method: 'CONNECT',
+      path: host + ':' + port,
+      headers: { host: host + ':' + port },
+      agent: false,
+      timeout: timeoutMs,
+    })
+    const fail = (e) => { try { req.destroy(e) } catch { reject(e) } }
+    req.on('timeout', () => fail(new Error('代理连接超时: ' + proxyUrl.host)))
+    req.on('error', (e) => reject(new Error('代理连接失败 ' + proxyUrl.host + ': ' + e.message)))
+    req.on('connect', (res, socket) => {
+      if (res.statusCode !== 200) {
+        socket.destroy()
+        reject(new Error('代理 CONNECT 返回 ' + res.statusCode))
+        return
+      }
+      resolve(socket)
+    })
+    req.end()
+  })
+}
+
+/**
+ * GET 一个 JSON（带代理/超时）；HTTP 非 2xx 或币安 {code,msg} 抛 BinanceError。
+ * 超时是**整段硬超时**：DNS / CONNECT / TLS / 响应任一环节卡住都会按时失败。
+ * @param {string} url
+ * @param {{headers?: Record<string,string>, proxy?: string, timeoutMs?: number}} [opts]
+ */
+export async function requestJson(url, opts = {}) {
+  const target = new URL(url)
+  const timeoutMs = opts.timeoutMs || TIMEOUT_MS
+  const headers = { accept: 'application/json', 'user-agent': 'whyshu-ba/0.1 (dsh plugin)', ...(opts.headers || {}) }
+
+  let tunnel = null
+  let agent = null
+  let req = null
+  let timer = null
+  let settled = false
+
+  const cleanup = () => {
+    if (timer) { clearTimeout(timer); timer = null }
+    if (agent) { try { agent.destroy() } catch { /* noop */ } }
+    if (tunnel && tunnel.destroyed === false) { try { tunnel.destroy() } catch { /* noop */ } }
+    if (req && req.destroyed === false) { try { req.destroy() } catch { /* noop */ } }
+  }
+
+  return new Promise((resolve, reject) => {
+    const finish = (fn, value) => {
+      if (settled) return
+      settled = true
+      cleanup()
+      fn(value)
+    }
+    const fail = (e) => finish(reject, e instanceof BinanceError ? e : new Error((e && e.message) || String(e)))
+
+    timer = setTimeout(() => {
+      fail(new Error('请求超时（' + timeoutMs + 'ms）' + (opts.proxy ? '，代理 ' + opts.proxy : '')))
+    }, timeoutMs)
+
+    ;(async () => {
+      try {
+        if (opts.proxy) tunnel = await openTunnel(opts.proxy, target, timeoutMs)
+        if (settled) return
+        if (tunnel) {
+          // 走代理：自定义 Agent 把 CONNECT 后的裸 socket 包成 TLS。
+          agent = new https.Agent({ keepAlive: false, maxSockets: 1 })
+          agent.createConnection = (options) => tls.connect({ socket: tunnel, servername: options.host })
+        }
+        if (settled) return
+        req = https.request({
+          host: target.hostname,
+          port: target.port || 443,
+          path: target.pathname + target.search,
+          method: 'GET',
+          headers: { ...headers, host: target.hostname, connection: 'close' },
+          agent: agent || false,
+        }, (res) => {
+          const chunks = []
+          res.on('data', (c) => chunks.push(c))
+          res.on('end', () => {
+            const text = Buffer.concat(chunks).toString('utf8')
+            let body
+            try { body = text ? JSON.parse(text) : {} } catch { body = undefined }
+            if (res.statusCode >= 200 && res.statusCode < 300) {
+              finish(resolve, body)
+              return
+            }
+            const msg = body && (body.msg || body.message) ? String(body.msg || body.message) : text.slice(0, 200)
+            finish(reject, new BinanceError('HTTP ' + res.statusCode + ': ' + msg, { status: res.statusCode, code: body && typeof body.code === 'number' ? body.code : 0 }))
+          })
+          res.on('error', fail)
+        })
+        req.on('error', fail)
+        req.end()
+      } catch (e) {
+        fail(e)
+      }
+    })()
+  })
+}
+
+/**
+ * 批量 symbols 参数：币安**要求原样**的 JSON 数组（`["A","B"]`），
+ * 百分号编码会被 `Illegal characters found in parameter 'symbols'` 拒绝。
+ */
+function symbolsParam(symbols) {
+  return JSON.stringify([...new Set(symbols)])
+}
+
+/** 公开行情：24h ticker 批量查询（无需鉴权）；整批失败时逐个降级。 */
+export async function fetchTickers24h(symbols, settings) {
+  if (!symbols || !symbols.length) return []
+  const normalize = (r) => ({
+    symbol: String(r.symbol || ''),
+    lastPrice: Number(r.lastPrice || 0),
+    priceChangePercent: Number(r.priceChangePercent || 0),
+    highPrice: Number(r.highPrice || 0),
+    lowPrice: Number(r.lowPrice || 0),
+    quoteVolume: Number(r.quoteVolume || 0),
+  })
+  try {
+    const rows = await requestJson(SPOT_BASE + '/api/v3/ticker/24hr?symbols=' + symbolsParam(symbols), { proxy: settings.proxy })
+    if (!Array.isArray(rows)) throw new BinanceError('行情返回格式异常')
+    return rows.map(normalize)
+  } catch (batchError) {
+    // 自选里混了不存在的币对时整批会失败：逐个取，成功的留下。
+    const settled = await Promise.all(symbols.map(async (symbol) => {
+      try {
+        const one = await requestJson(SPOT_BASE + '/api/v3/ticker/24hr?symbol=' + encodeURIComponent(symbol), { proxy: settings.proxy })
+        return one && one.symbol ? normalize(one) : null
+      } catch { return null }
+    }))
+    const rows = settled.filter(Boolean)
+    if (!rows.length) throw batchError
+    return rows
+  }
+}
+
+/** 公开行情：批量现价（用于资产折 USDT）；整批失败时逐个降级。 */
+export async function fetchPrices(symbols, settings) {
+  if (!symbols || !symbols.length) return new Map()
+  try {
+    const rows = await requestJson(SPOT_BASE + '/api/v3/ticker/price?symbols=' + symbolsParam(symbols), { proxy: settings.proxy })
+    const map = new Map()
+    if (Array.isArray(rows)) for (const r of rows) map.set(String(r.symbol || ''), Number(r.price || 0))
+    return map
+  } catch {
+    // 某些资产没有 USDT 现货对（或已下线）会让整批失败：逐个取，失败的跳过。
+    const map = new Map()
+    await Promise.all([...new Set(symbols)].map(async (symbol) => {
+      try {
+        const one = await requestJson(SPOT_BASE + '/api/v3/ticker/price?symbol=' + encodeURIComponent(symbol), { proxy: settings.proxy })
+        if (one && one.price) map.set(String(one.symbol || symbol), Number(one.price))
+      } catch { /* 无对应交易对：该资产估值留空 */ }
+    }))
+    return map
+  }
+}
+
+/** 签名 GET（现货/合约共用）。 */
+async function signedGet(base, path, params, settings) {
+  const search = new URLSearchParams({
+    ...params,
+    recvWindow: String(RECV_WINDOW),
+    timestamp: String(Date.now()),
+  }).toString()
+  const signature = createHmac('sha256', settings.apiSecret).update(search).digest('hex')
+  return requestJson(base + path + '?' + search + '&signature=' + signature, {
+    proxy: settings.proxy,
+    headers: { 'X-MBX-APIKEY': settings.apiKey },
+  })
+}
+
+/** 现货账户：余额 + 现价折 USDT。 */
+export async function fetchSpot(settings) {
+  const account = await signedGet(SPOT_BASE, '/api/v3/account', {}, settings)
+  const balances = Array.isArray(account.balances) ? account.balances : []
+  const rows = balances
+    .map((b) => {
+      const free = Number(b.free || 0)
+      const locked = Number(b.locked || 0)
+      return { asset: String(b.asset || ''), free, locked, total: free + locked }
+    })
+    .filter((b) => b.asset && b.total > 0 && b.total > 1e-12)
+
+  const pairs = rows
+    .filter((b) => b.asset !== 'USDT')
+    .map((b) => b.asset + 'USDT')
+  let prices = new Map()
+  if (pairs.length) {
+    try { prices = await fetchPrices(pairs, settings) } catch { /* 无对应现货对的币种不估值 */ }
+  }
+  const valued = rows.map((b) => {
+    const priceUSDT = b.asset === 'USDT' ? 1 : (prices.get(b.asset + 'USDT') || 0)
+    return { ...b, priceUSDT, valueUSDT: priceUSDT ? b.total * priceUSDT : null }
+  }).sort((a, b) => (b.valueUSDT || 0) - (a.valueUSDT || 0))
+  const totalUSDT = valued.reduce((sum, b) => sum + (b.valueUSDT || 0), 0)
+  return {
+    totalUSDT,
+    canTrade: Boolean(account.canTrade),
+    accountType: String(account.accountType || ''),
+    rows: valued,
+  }
+}
+
+/** U 本位合约：账户余额 + 非零持仓。 */
+export async function fetchFutures(settings) {
+  const [account, positions] = await Promise.all([
+    signedGet(FUTURES_BASE, '/fapi/v2/account', {}, settings),
+    signedGet(FUTURES_BASE, '/fapi/v2/positionRisk', {}, settings),
+  ])
+  const rows = (Array.isArray(positions) ? positions : [])
+    .map((p) => {
+      const amt = Number(p.positionAmt || 0)
+      return {
+        symbol: String(p.symbol || ''),
+        side: amt > 0 ? 'LONG' : amt < 0 ? 'SHORT' : 'FLAT',
+        positionAmt: amt,
+        entryPrice: Number(p.entryPrice || 0),
+        markPrice: Number(p.markPrice || 0),
+        unrealizedProfit: Number(p.unRealizedProfit || p.unrealizedProfit || 0),
+        leverage: Number(p.leverage || 0),
+        liquidationPrice: Number(p.liquidationPrice || 0),
+        marginType: String(p.marginType || ''),
+      }
+    })
+    .filter((p) => p.symbol && p.positionAmt !== 0)
+  return {
+    totalWalletBalance: Number(account.totalWalletBalance || 0),
+    totalUnrealizedProfit: Number(account.totalUnrealizedProfit || 0),
+    totalMarginBalance: Number(account.totalMarginBalance || 0),
+    availableBalance: Number(account.availableBalance || 0),
+    positions: rows,
+  }
+}
+
+/**
+ * 面板总览：行情总是有（公开接口）；账户/持仓在配好 Key 后才有。
+ * 各段独立失败：一段报错不影响其他段。
+ * @param {ReturnType<typeof loadSettings>} [settingsIn]
+ */
+export async function fetchOverview(settingsIn) {
+  const settings = settingsIn || loadSettings()
+  const configured = hasCredentials(settings)
+  const errors = []
+  const mark = (section, e) => {
+    const message = e instanceof BinanceError ? e.message : String((e && e.message) || e)
+    errors.push({ section, message })
+  }
+
+  let tickers = []
+  try {
+    tickers = await fetchTickers24h(settings.symbols, settings)
+  } catch (e) {
+    mark('market', e)
+  }
+
+  let spot = null
+  let futures = null
+  if (configured) {
+    try { spot = await fetchSpot(settings) } catch (e) { mark('spot', e) }
+    try { futures = await fetchFutures(settings) } catch (e) { mark('futures', e) }
+  }
+
+  // 行情按自选顺序返回（币安接口不保证顺序）
+  const bySymbol = new Map(tickers.map((k) => [k.symbol, k]))
+  const ordered = settings.symbols.map((s) => bySymbol.get(s)).filter(Boolean)
+
+  return {
+    at: new Date().toISOString(),
+    configured,
+    proxy: Boolean(settings.proxy),
+    symbols: settings.symbols,
+    tickers: ordered.length ? ordered : tickers,
+    spot,
+    futures,
+    errors,
+  }
+}