dexterm-cli 0.2.0 → 0.2.2

package/dist/packages/agents/src/spectator.js

@@ -95,13 +95,18 @@ const finiteOr = (x, d = null) => (typeof x === 'number' && Number.isFinite(x) ?
 // eslint-disable-next-line no-control-regex
 const UNSAFE_RE = /[\u0000-\u001f\u007f-\u009f​-‏‪-‮⁦-⁩]/g;
 const shortStr = (x, max) => (typeof x === 'string' ? x.replace(UNSAFE_RE, '').slice(0, max) : '');
-const isMintish = (x) => typeof x === 'string' && /^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(x);
+const isFullMint = (x) => typeof x === 'string' && /^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(x);
+/** A mint as the redactor leaves it (maskAddress: head4…tail4). */
+const isMaskedMint = (x) => typeof x === 'string' && /^[1-9A-HJ-NP-Za-km-z]{4}…[1-9A-HJ-NP-Za-km-z]{4}$/.test(x);
 /**
  * task-1466: re-validate a detail read off the local channel (shape, types, lengths). The channel is our own
  * server's 0600 file and token-checked, but the viewer still treats it as data: anything malformed is dropped,
  * strings are stripped of control/bidi characters and capped, numbers must be finite. Returns null when empty.
  */
-export function sanitizeDetail(raw) {
+export function sanitizeDetail(raw, opts = {}) {
+    // task-1427: a detail read off the SHARED stream (or a saved file) is already redacted, so its mints are head…tail;
+    // `masked` accepts that shape (and only that shape) instead of a full mint. The local channel keeps the strict check.
+    const isMintish = (x) => (opts.masked ? isMaskedMint(x) : isFullMint(x));
     if (!raw || typeof raw !== 'object' || Array.isArray(raw))
         return null;
     const r = raw;
@@ -140,6 +145,27 @@ export function sanitizeDetail(raw) {
         out.caps = { perTradeUsd: cp.perTradeUsd, totalUsd: cp.totalUsd, maxPriceImpactPct: finiteOr(cp.maxPriceImpactPct) };
     if (typeof r.refusal === 'string' && r.refusal)
         out.refusal = shortStr(r.refusal, 40);
+    const h = r.holders;
+    const top10 = h ? finiteOr(h.top10Pct) : null;
+    if (h && top10 !== null && top10 >= 0 && top10 <= 100 && (h.basis === 'ex-pools' || h.basis === 'raw')) {
+        const count = finiteOr(h.count), ageSec = finiteOr(h.ageSec);
+        out.holders = { top10Pct: top10, count: count !== null && count >= 0 ? Math.round(count) : null, basis: h.basis, ageSec: ageSec !== null && ageSec >= 0 ? ageSec : null };
+    }
+    if (Array.isArray(r.liveFlags)) {
+        const LEVELS = ['up', 'down', 'info', 'warn'];
+        const sigs = r.liveFlags.slice(0, 8).flatMap((x) => {
+            const o = x;
+            if (!o || typeof o !== 'object')
+                return [];
+            const kind = shortStr(o.kind, 16), title = shortStr(o.title, 24), text = shortStr(o.text, 120);
+            const at = finiteOr(o.at), ageSec = finiteOr(o.ageSec);
+            if (!kind || !title || at === null || ageSec === null || ageSec < 0 || !LEVELS.includes(o.level))
+                return [];
+            return [{ kind, level: o.level, title, text, source: shortStr(o.source, 24) || '?', at, ageSec, stale: o.stale === true }];
+        });
+        if (sigs.length)
+            out.liveFlags = sigs;
+    }
     return Object.keys(out).length ? out : null;
 }
 // ---------------------------------------------------------------------------------------------------

package/dist/packages/agents/src/tiers.js

@@ -46,6 +46,9 @@ export const TOOL_TIERS = Object.freeze({
     // agents in task-1405 so a bring-your-own-agent gets the same code-stage analysis the built-in analyst does.
     analyze_token: 'observe',
     narrative_board: 'observe',
+    narratives_top: 'observe',
+    narrative_detail: 'observe',
+    narrative_of: 'observe',
     rug_backtest: 'observe',
     kb_lookup: 'observe',
     kb_search: 'observe',

package/dist/packages/agents/src/tools.js

@@ -35,6 +35,9 @@ const TOOLS_DEF = [
     { name: 'get_dev_history', tier: 'observe', description: 'Creator address and prior-launch forensics. Tier-1 fields need a key and are null on the keyless tier.', inputSchema: { type: 'object', properties: { mint: MINT }, required: ['mint'], additionalProperties: false } },
     { name: 'analyze_token', tier: 'observe', description: 'Deterministic token-dossier analysis pack: numeric features, named rule flags, a WATCH/SPECULATIVE/AVOID verdict, a p(rug) heuristic and data ages. No model, no token cost; a reasoning stage may only tighten the verdict, never loosen it.', inputSchema: { type: 'object', properties: { mint: MINT, symbol: SYMBOL, interval: { type: 'string', enum: ['1m', '5m', '15m', '1h', '4h', '1d'] } }, additionalProperties: false } },
     { name: 'narrative_board', tier: 'observe', description: 'The narrative board over recorded + trending tokens: per-narrative volume, new launches, runners and a "what is working" score. No model; returns a note when there is no recorded history yet.', inputSchema: { type: 'object', properties: { window: { type: 'string', enum: ['1h', '24h'] }, limit: { type: 'integer', minimum: 1, maximum: 50 }, summary: { type: 'boolean' } }, additionalProperties: false } },
+    { name: 'narratives_top', tier: 'observe', description: 'MEMES + NARRATIVES tracker: the hottest name/ticker-theme clusters of the last 26 h with lifecycle (spark/ignition/peak/fading/dead), copy-cat saturation, volume share and a traction score. Measured heat, not advice.', inputSchema: { type: 'object', properties: { limit: { type: 'integer', minimum: 1, maximum: 50 }, lifecycle: { type: 'string', enum: ['spark', 'ignition', 'peak', 'fading'] } }, additionalProperties: false } },
+    { name: 'narrative_detail', tier: 'observe', description: 'One narrative by id: per-window metrics, lifecycle rule and member coins in spawn order. Measured heat, not advice.', inputSchema: { type: 'object', properties: { id: { type: 'string' }, limit: { type: 'integer', minimum: 1, maximum: 100 } }, required: ['id'], additionalProperties: false } },
+    { name: 'narrative_of', tier: 'observe', description: 'Which narrative a coin belongs to: label, lifecycle, rank, spawn index, saturation. Measured heat, not advice.', inputSchema: { type: 'object', properties: { mint: { type: 'string' } }, required: ['mint'], additionalProperties: false } },
     { name: 'rug_backtest', tier: 'observe', description: 'Backtest the rug model or recorded pack verdicts against RECORDED outcomes: honest precision/recall, Brier, AUC and calibration. Leakage-free by construction; returns a note when there is not enough history. Read-only.', inputSchema: { type: 'object', properties: { kind: { type: 'string', enum: ['heuristic', 'pack_verdicts'] }, horizon_sec: { type: 'integer', enum: [3600, 7200, 21600, 86400, 259200] }, positive_labels: { type: 'array', items: { type: 'string', enum: ['rug', 'dead', 'fade', 'flat', 'runner'] }, maxItems: 5 } }, additionalProperties: false } },
     { name: 'kb_lookup', tier: 'observe', description: 'One knowledge-base entry by id (mechanics / patterns / glossary). KB never holds facts about a live token.', inputSchema: { type: 'object', properties: { id: { type: 'string', maxLength: 64 } }, required: ['id'], additionalProperties: false } },
     { name: 'kb_search', tier: 'observe', description: 'Search the knowledge base; returns ids, titles and an excerpt.', inputSchema: { type: 'object', properties: { query: { type: 'string', maxLength: 200 }, limit: { type: 'integer', minimum: 1, maximum: 10 } }, required: ['query'], additionalProperties: false } },

package/dist/packages/autotrade/src/backtest.js

@@ -19,6 +19,7 @@
 import { SKILL_MIN_N, wilson } from '../../packs/src/index.js';
 import { EntryRules } from "./engine.js";
 import { runAutotrade } from "./runner.js";
+import { rugproofTapeVet } from "./rugproof.js";
 import { validateStrategy, round } from "./strategy.js";
 export const DATA_LIMITS = [
     'Price path = recorder snapshots (~2-min cadence while listed, written on >= 5% moves or every 30 min), not candles or trades: intrabar spikes and dips are invisible, so stops and take-profits fill at the next recorded price.',
@@ -31,9 +32,12 @@ export const DATA_LIMITS = [
 ];
 /** A closed trade at or below this is counted as a rug (the challenge's rugAtPct). */
 export const RUG_PCT = -80;
-export async function backtest(strategy, tape, sessions = null) {
+export async function backtest(strategy, tape, sessions = null, opts = {}) {
+    // task-1748: a rug-proof strategy replays its tick gates + the pump.fun-mint proxy (the chain gates need live data).
+    const rp = strategy.entry.safety.rugproof;
+    const vet = opts.vet === null ? undefined : opts.vet ?? (rp ? rugproofTapeVet(rp) : undefined);
     // task-1645: a strategy in mode real backtests as its paper twin (a backtest never emits a trade-fire signal).
-    const run = await runAutotrade({ strategy: strategy.mode === 'real' ? { ...strategy, mode: 'paper' } : strategy, tape, sessions, pacing: { mode: 'lockstep' } });
+    const run = await runAutotrade({ strategy: strategy.mode === 'real' ? { ...strategy, mode: 'paper' } : strategy, tape, sessions, pacing: { mode: 'lockstep' }, ...(vet ? { vet } : {}) });
     return { report: report(strategy, tape, run), run };
 }
 export function report(s, tape, run) {

package/dist/packages/autotrade/src/chat/connector.js

@@ -8,8 +8,8 @@
 //            callback data come from engine state only.
 //
 // Transports: telegram (long poll from the user's machine, telegram.ts) and fake (in memory, fake.ts, every test).
-/** The closed command list (§8.4 tier 2). Anything else is `help`. */
-export const COMMANDS = ['status', 'positions', 'pause', 'resume', 'kill', 'stop', 'flatten', 'strategies', 'use', 'approvals', 'help', 'pair', 'start'];
+/** The closed command list (§8.4 tier 2; task-1426 adds the read-only check, top and signals). Anything else is `help`. */
+export const COMMANDS = ['status', 'positions', 'pause', 'resume', 'kill', 'stop', 'flatten', 'strategies', 'use', 'approvals', 'help', 'pair', 'start', 'check', 'top', 'signals'];
 /** "/Status@my_bot arg" → {command, args}; null when it is not a slash command. Unknown names map to help. */
 export function parseCommand(text) {
     const t = text.trim();
@@ -18,7 +18,8 @@ export function parseCommand(text) {
     const [head, ...rest] = t.split(/\s+/);
     const name = head.slice(1).split('@')[0].toLowerCase();
     const command = COMMANDS.includes(name) ? name : 'help';
-    // Args are short tokens only (a preset id, a pairing code, on/off): never prose.
-    const args = rest.slice(0, 3).map((a) => a.slice(0, 40));
+    // Args are short tokens only (a preset id, a pairing code, on/off, a count, a mint): never prose. 48 characters
+    // keeps a whole mint (44 at most) and leaves an over-long one too long to pass as one (task-1426).
+    const args = rest.slice(0, 3).map((a) => a.slice(0, 48));
     return { command, args };
 }

package/dist/packages/autotrade/src/chat/control.js

@@ -10,6 +10,8 @@
 //   /use <id>                               an equal-or-tighter validated strategy only, after a [Yes, switch] button;
 //                                           never changes paper/live; a looser one says "change it locally"
 //   /approvals on                           every entry waits for a tap (safer). `off` is local only
+//   /check <CA> · /top [N] · /signals [N]   read-only data (task-1426): not routed here at all; the hub sends them
+//                                           to the ReadOnlyRouter (readonly.ts), which never sees this port
 // Not from chat, ever: live mode, looser caps or strategies, approvals off, resuming after a kill or a panic.
 // The router only calls the ControlPort the host gives it; the port writes the same control file the CLI and the
 // Q screen write, so chat is a remote control for the same local engine and adds no path around its fences.
@@ -22,6 +24,7 @@ export const HELP_LINES = [
     '/flatten (sell everything, asks first)',
     '/use <strategy> (equal or tighter only, asks first)',
     '/approvals on (every entry waits for your tap)',
+    '/check <CA> · /top [N] · /signals [N] (read-only: data, not advice)',
     'Trades are approved only with buttons. I never ask for keys or seed phrases.',
 ];
 export const NEVER_RATE_LIMITED = ['kill', 'stop', 'pause', 'flatten'];

package/dist/packages/autotrade/src/chat/hub.js

@@ -6,15 +6,21 @@
 //   pairing (only while a local pairing window is open: `/pair <code>` from a private chat);
 //   the allowlist: an unknown sender gets NO reply and nothing happens (five in an hour raise a local alert:
 //     "possible token leak"); a paired sender needs the tier the command needs, in the chat it was paired in;
-//   rate limit: 10 commands a minute per sender, except /kill, /stop, /pause and /flatten (never limited);
+//   rate limit: 10 commands a minute per sender, except /kill, /stop, /pause and /flatten (never limited); a
+//     read-only data command that reaches the data sources also counts against READS_PER_MIN per chat (task-2146,
+//     readonly.ts): over it, the chat is told once a minute, then gets silence;
 //   commands → the ControlRouter; button callbacks → the ApprovalBroker (the only trade authority);
+//   the read-only data commands (/check /top /signals, task-1426) → the ReadOnlyRouter, built from the ReadOnlyPort
+//     alone: it never sees the ControlPort or the broker and answers with lines only (no confirm, no button);
 //   free text → the help text, never parsed.
 // Outbound: notify messages go to every chat paired with the notify tier; replies go to the asking chat only.
 import { allowed } from "./config.js";
 import { ControlRouter, HELP_LINES, NEVER_RATE_LIMITED } from "./control.js";
+import { READ_COMMANDS, ReadOnlyRouter } from "./readonly.js";
 export const COMMANDS_PER_MIN = 10;
 export const UNKNOWN_ALERT_PER_HOUR = 5;
-const READ_ONLY = ['status', 'positions', 'strategies', 'help', 'start'];
+const READ_ONLY = ['status', 'positions', 'strategies', 'help', 'start', ...READ_COMMANDS];
+const isReadCommand = (c) => READ_COMMANDS.includes(c);
 export class ChatHub {
     o;
     now;
@@ -23,12 +29,14 @@ export class ChatHub {
     unknownTimes = [];
     lastUnknownAlert = 0;
     router;
+    reads;
     pairing = null;
     inflight = new Set();
     constructor(o) {
         this.o = o;
         this.now = o.now ?? Date.now;
         this.router = o.port ? new ControlRouter(o.port) : null;
+        this.reads = o.reads ? new ReadOnlyRouter(o.reads, this.now) : null;
         o.connector.onCommand((c) => this.track(this.onCommand(c)));
         o.connector.onAction((a) => this.track(this.onAction(a)));
         o.connector.onText((t) => this.track(this.onText(t)));
@@ -41,6 +49,7 @@ export class ChatHub {
     async idle() { while (this.inflight.size)
         await Promise.allSettled([...this.inflight]); }
     setPort(port) { this.router = port ? new ControlRouter(port) : null; }
+    setReads(reads) { this.reads = reads ? new ReadOnlyRouter(reads, this.now) : null; }
     /** Open a local pairing window: `/pair <code>` from a private chat is checked against it. */
     openPairing(window, onResult) { this.pairing = { window, onResult }; }
     closePairing() { this.pairing = null; }
@@ -124,6 +133,10 @@ export class ChatHub {
             await this.reply(c.chatId, ['Too many commands: wait a minute. /kill and /pause always work.'], 'rate_limited');
             return;
         }
+        if (isReadCommand(c.command)) {
+            await this.onRead(c);
+            return;
+        }
         if (!this.router) {
             await this.reply(c.chatId, ['No runner is connected right now.'], 'no_runner');
             return;
@@ -139,6 +152,28 @@ export class ChatHub {
             await this.o.broker.confirm(cf.kind, { senderId: c.senderId, chatId: c.chatId }, cf.lines, cf.yes, cf.payload);
         }
     }
+    /** A read-only data command: lines from the ReadOnlyRouter, never a confirm or a ControlPort call. */
+    async onRead(c) {
+        if (!this.reads) {
+            await this.reply(c.chatId, ['Read-only data is not available here: use dexterm on your computer.'], 'no_reads');
+            return;
+        }
+        let lines;
+        try {
+            const r = await this.reads.handle(c);
+            lines = r.lines;
+            if (r.failed)
+                this.o.audit.add(this.now(), 'read_failed', { command: c.command, error: r.failed.slice(0, 160) });
+            if (r.limited)
+                this.o.audit.add(this.now(), 'rate_limited', { senderId: c.senderId, chatId: c.chatId, command: c.command, scope: 'reads', told: lines.length > 0 });
+        }
+        catch (e) {
+            this.o.audit.add(this.now(), 'hub_error', { command: c.command, error: e instanceof Error ? e.message.slice(0, 160) : String(e).slice(0, 160) });
+            lines = ['Could not read that right now (the data sources did not answer). Try again in a minute.'];
+        }
+        this.o.audit.add(this.now(), 'command_result', { updateId: c.updateId, command: c.command, lines: lines.length, confirms: 0 });
+        await this.reply(c.chatId, lines, `cmd_${c.command}`);
+    }
     async onAction(a) {
         if (this.dup(a.updateId)) {
             this.o.audit.add(this.now(), 'in_duplicate', { updateId: a.updateId });

package/dist/packages/autotrade/src/chat/index.js

@@ -1,7 +1,7 @@
 // dexterm autotrade chat (task-1527, AUTOTRADE-SPEC §8): notify, control and approve-to-trade through the user's own
 // bot. connector (the interface) · fake (tests) · telegram (long poll) · redact · format · config (connectors.json) ·
-// secrets (keychain / libsecret / 0600 file) · pairing · audit (hash chain) · notify · control · approvals · hub ·
-// service (what a runner host starts).
+// secrets (keychain / libsecret / 0600 file) · pairing · audit (hash chain) · notify · control · readonly (task-1426:
+// /check /top /signals) · approvals · hub · service (what a runner host starts).
 export * from "./connector.js";
 export * from "./fake.js";
 export * from "./telegram.js";
@@ -13,6 +13,7 @@ export * from "./pairing.js";
 export * from "./audit.js";
 export * from "./notify.js";
 export * from "./control.js";
+export * from "./readonly.js";
 export * from "./approvals.js";
 export * from "./hub.js";
 export * from "./service.js";