dexterm-cli 0.2.1 → 0.2.2

package/dist/packages/autotrade/src/chat/connector.js

@@ -8,8 +8,8 @@
 //            callback data come from engine state only.
 //
 // Transports: telegram (long poll from the user's machine, telegram.ts) and fake (in memory, fake.ts, every test).
-/** The closed command list (§8.4 tier 2). Anything else is `help`. */
-export const COMMANDS = ['status', 'positions', 'pause', 'resume', 'kill', 'stop', 'flatten', 'strategies', 'use', 'approvals', 'help', 'pair', 'start'];
+/** The closed command list (§8.4 tier 2; task-1426 adds the read-only check, top and signals). Anything else is `help`. */
+export const COMMANDS = ['status', 'positions', 'pause', 'resume', 'kill', 'stop', 'flatten', 'strategies', 'use', 'approvals', 'help', 'pair', 'start', 'check', 'top', 'signals'];
 /** "/Status@my_bot arg" → {command, args}; null when it is not a slash command. Unknown names map to help. */
 export function parseCommand(text) {
     const t = text.trim();
@@ -18,7 +18,8 @@ export function parseCommand(text) {
     const [head, ...rest] = t.split(/\s+/);
     const name = head.slice(1).split('@')[0].toLowerCase();
     const command = COMMANDS.includes(name) ? name : 'help';
-    // Args are short tokens only (a preset id, a pairing code, on/off): never prose.
-    const args = rest.slice(0, 3).map((a) => a.slice(0, 40));
+    // Args are short tokens only (a preset id, a pairing code, on/off, a count, a mint): never prose. 48 characters
+    // keeps a whole mint (44 at most) and leaves an over-long one too long to pass as one (task-1426).
+    const args = rest.slice(0, 3).map((a) => a.slice(0, 48));
     return { command, args };
 }

package/dist/packages/autotrade/src/chat/control.js

@@ -10,6 +10,8 @@
 //   /use <id>                               an equal-or-tighter validated strategy only, after a [Yes, switch] button;
 //                                           never changes paper/live; a looser one says "change it locally"
 //   /approvals on                           every entry waits for a tap (safer). `off` is local only
+//   /check <CA> · /top [N] · /signals [N]   read-only data (task-1426): not routed here at all; the hub sends them
+//                                           to the ReadOnlyRouter (readonly.ts), which never sees this port
 // Not from chat, ever: live mode, looser caps or strategies, approvals off, resuming after a kill or a panic.
 // The router only calls the ControlPort the host gives it; the port writes the same control file the CLI and the
 // Q screen write, so chat is a remote control for the same local engine and adds no path around its fences.
@@ -22,6 +24,7 @@ export const HELP_LINES = [
     '/flatten (sell everything, asks first)',
     '/use <strategy> (equal or tighter only, asks first)',
     '/approvals on (every entry waits for your tap)',
+    '/check <CA> · /top [N] · /signals [N] (read-only: data, not advice)',
     'Trades are approved only with buttons. I never ask for keys or seed phrases.',
 ];
 export const NEVER_RATE_LIMITED = ['kill', 'stop', 'pause', 'flatten'];

package/dist/packages/autotrade/src/chat/hub.js

@@ -6,15 +6,21 @@
 //   pairing (only while a local pairing window is open: `/pair <code>` from a private chat);
 //   the allowlist: an unknown sender gets NO reply and nothing happens (five in an hour raise a local alert:
 //     "possible token leak"); a paired sender needs the tier the command needs, in the chat it was paired in;
-//   rate limit: 10 commands a minute per sender, except /kill, /stop, /pause and /flatten (never limited);
+//   rate limit: 10 commands a minute per sender, except /kill, /stop, /pause and /flatten (never limited); a
+//     read-only data command that reaches the data sources also counts against READS_PER_MIN per chat (task-2146,
+//     readonly.ts): over it, the chat is told once a minute, then gets silence;
 //   commands → the ControlRouter; button callbacks → the ApprovalBroker (the only trade authority);
+//   the read-only data commands (/check /top /signals, task-1426) → the ReadOnlyRouter, built from the ReadOnlyPort
+//     alone: it never sees the ControlPort or the broker and answers with lines only (no confirm, no button);
 //   free text → the help text, never parsed.
 // Outbound: notify messages go to every chat paired with the notify tier; replies go to the asking chat only.
 import { allowed } from "./config.js";
 import { ControlRouter, HELP_LINES, NEVER_RATE_LIMITED } from "./control.js";
+import { READ_COMMANDS, ReadOnlyRouter } from "./readonly.js";
 export const COMMANDS_PER_MIN = 10;
 export const UNKNOWN_ALERT_PER_HOUR = 5;
-const READ_ONLY = ['status', 'positions', 'strategies', 'help', 'start'];
+const READ_ONLY = ['status', 'positions', 'strategies', 'help', 'start', ...READ_COMMANDS];
+const isReadCommand = (c) => READ_COMMANDS.includes(c);
 export class ChatHub {
     o;
     now;
@@ -23,12 +29,14 @@ export class ChatHub {
     unknownTimes = [];
     lastUnknownAlert = 0;
     router;
+    reads;
     pairing = null;
     inflight = new Set();
     constructor(o) {
         this.o = o;
         this.now = o.now ?? Date.now;
         this.router = o.port ? new ControlRouter(o.port) : null;
+        this.reads = o.reads ? new ReadOnlyRouter(o.reads, this.now) : null;
         o.connector.onCommand((c) => this.track(this.onCommand(c)));
         o.connector.onAction((a) => this.track(this.onAction(a)));
         o.connector.onText((t) => this.track(this.onText(t)));
@@ -41,6 +49,7 @@ export class ChatHub {
     async idle() { while (this.inflight.size)
         await Promise.allSettled([...this.inflight]); }
     setPort(port) { this.router = port ? new ControlRouter(port) : null; }
+    setReads(reads) { this.reads = reads ? new ReadOnlyRouter(reads, this.now) : null; }
     /** Open a local pairing window: `/pair <code>` from a private chat is checked against it. */
     openPairing(window, onResult) { this.pairing = { window, onResult }; }
     closePairing() { this.pairing = null; }
@@ -124,6 +133,10 @@ export class ChatHub {
             await this.reply(c.chatId, ['Too many commands: wait a minute. /kill and /pause always work.'], 'rate_limited');
             return;
         }
+        if (isReadCommand(c.command)) {
+            await this.onRead(c);
+            return;
+        }
         if (!this.router) {
             await this.reply(c.chatId, ['No runner is connected right now.'], 'no_runner');
             return;
@@ -139,6 +152,28 @@ export class ChatHub {
             await this.o.broker.confirm(cf.kind, { senderId: c.senderId, chatId: c.chatId }, cf.lines, cf.yes, cf.payload);
         }
     }
+    /** A read-only data command: lines from the ReadOnlyRouter, never a confirm or a ControlPort call. */
+    async onRead(c) {
+        if (!this.reads) {
+            await this.reply(c.chatId, ['Read-only data is not available here: use dexterm on your computer.'], 'no_reads');
+            return;
+        }
+        let lines;
+        try {
+            const r = await this.reads.handle(c);
+            lines = r.lines;
+            if (r.failed)
+                this.o.audit.add(this.now(), 'read_failed', { command: c.command, error: r.failed.slice(0, 160) });
+            if (r.limited)
+                this.o.audit.add(this.now(), 'rate_limited', { senderId: c.senderId, chatId: c.chatId, command: c.command, scope: 'reads', told: lines.length > 0 });
+        }
+        catch (e) {
+            this.o.audit.add(this.now(), 'hub_error', { command: c.command, error: e instanceof Error ? e.message.slice(0, 160) : String(e).slice(0, 160) });
+            lines = ['Could not read that right now (the data sources did not answer). Try again in a minute.'];
+        }
+        this.o.audit.add(this.now(), 'command_result', { updateId: c.updateId, command: c.command, lines: lines.length, confirms: 0 });
+        await this.reply(c.chatId, lines, `cmd_${c.command}`);
+    }
     async onAction(a) {
         if (this.dup(a.updateId)) {
             this.o.audit.add(this.now(), 'in_duplicate', { updateId: a.updateId });

package/dist/packages/autotrade/src/chat/index.js

@@ -1,7 +1,7 @@
 // dexterm autotrade chat (task-1527, AUTOTRADE-SPEC §8): notify, control and approve-to-trade through the user's own
 // bot. connector (the interface) · fake (tests) · telegram (long poll) · redact · format · config (connectors.json) ·
-// secrets (keychain / libsecret / 0600 file) · pairing · audit (hash chain) · notify · control · approvals · hub ·
-// service (what a runner host starts).
+// secrets (keychain / libsecret / 0600 file) · pairing · audit (hash chain) · notify · control · readonly (task-1426:
+// /check /top /signals) · approvals · hub · service (what a runner host starts).
 export * from "./connector.js";
 export * from "./fake.js";
 export * from "./telegram.js";
@@ -13,6 +13,7 @@ export * from "./pairing.js";
 export * from "./audit.js";
 export * from "./notify.js";
 export * from "./control.js";
+export * from "./readonly.js";
 export * from "./approvals.js";
 export * from "./hub.js";
 export * from "./service.js";