hvip-mcp-server 0.3.2 → 0.4.1

package/dist/index.js

@@ -27282,7 +27282,6 @@ function classifyRisk(toolNameOrDesc) {
   const readSpecials = [
     "agent_simulate_order",
     "okx_preflight_check",
-    "okx_agent_feedback",
     "agent_catalog",
     "agent_catalog_detail",
     "agent_hub_status",
@@ -27305,12 +27304,12 @@ function classifyRisk(toolNameOrDesc) {
     "codegraph_status",
     "codegraph_query",
     "agent_get_preference",
-    "agent_set_preference",
     "agent_simulate_transfer",
     "agent_read_only_trade",
     "okx_event_instruments"
   ];
   if (readSpecials.includes(toolName)) return "READ";
+  if (["okx_agent_feedback", "agent_set_preference"].includes(toolName)) return "WRITE";
   if (toolName.startsWith("xlayer_call")) return "WRITE";
   return "READ";
 }
@@ -28517,25 +28516,6 @@ function registerAccountTools(server, auth) {
       }
     }
   );
-  registerTool(
-    server,
-    "okx_get_order",
-    "READ",
-    "CAT:[\u8D26\u6237] | \u2192 \u8BF7\u5148\u8C03\u7528 agent_catalog",
-    {
-      instId: external_exports.string().describe("\u4EA7\u54C1ID"),
-      ordId: external_exports.string().describe("\u8BA2\u5355ID")
-    },
-    async ({ instId, ordId }) => {
-      if (!auth) return toError(AUTH_REQUIRED);
-      try {
-        const data = await privateApi.getOrder(auth, instId, ordId);
-        return toResult(data);
-      } catch (e) {
-        return toError(e);
-      }
-    }
-  );
   registerTool(
     server,
     "okx_get_orders_history",
@@ -34709,8 +34689,18 @@ function registerAgentUtils(server, auth) {
     },
     async ({ title, what, tools, pain, suggestion }) => {
       try {
-        const logDir = process.env.OKX_FEEDBACK_DIR || os.homedir();
+        const logDir = path.join(os.homedir(), ".hvip");
+        fs.mkdirSync(logDir, { recursive: true });
         const logFile = path.join(logDir, "hvip-mcp-feedback.log");
+        try {
+          const stat = fs.statSync(logFile);
+          if (stat.size > 10 * 1024 * 1024) {
+            const rotated = logFile + ".1";
+            if (fs.existsSync(rotated)) fs.unlinkSync(rotated);
+            fs.renameSync(logFile, rotated);
+          }
+        } catch {
+        }
         const entry = JSON.stringify({
           time: (/* @__PURE__ */ new Date()).toISOString(),
           title,
@@ -35185,11 +35175,615 @@ function registerAgentUtils(server, auth) {
       }
     }
   );
+  registerTool(
+    server,
+    "agent_market_sentiment",
+    "READ",
+    "CAT:[\u5E02\u573A\u626B\u63CF] | \u5E02\u573A\u60C5\u7EEA\u7EFC\u5408\u5206\u6790\uFF1A\u591A\u7A7A\u6BD4+PCR+\u8D44\u91D1\u8D39\u7387+\u5927\u6237\u60C5\u7EEA\u2192\u65B9\u5411\u8BC4\u5206\uFF0C\u6216\u626B\u63CF\u6781\u7AEF\u8D39\u7387\u5957\u5229\u673A\u4F1A",
+    {
+      mode: external_exports.enum(["sentiment", "funding"]).optional().default("sentiment").describe("sentiment=\u5E02\u573A\u60C5\u7EEA\u8BC4\u5206, funding=\u8D44\u91D1\u8D39\u7387\u5F02\u5E38\u626B\u63CF"),
+      instType: external_exports.enum(["SWAP", "FUTURES", "SPOT"]).optional().default("SWAP").describe("\u4EA7\u54C1\u7C7B\u578B"),
+      topN: external_exports.number().int().min(5).max(50).optional().default(10).describe("\u5206\u6790\u54C1\u79CD\u6570\u91CF"),
+      sampleCcy: external_exports.string().optional().describe("\u57FA\u51C6\u5E01\u79CD(BTC/ETH)\uFF0C\u4EC5 sentiment \u6A21\u5F0F"),
+      threshold: external_exports.number().optional().default(1e-3).describe("\u8D39\u7387\u5F02\u5E38\u9608\u503C\uFF0C\u4EC5 funding \u6A21\u5F0F")
+    },
+    async ({ mode, instType, topN, sampleCcy, threshold }) => {
+      try {
+        const type = instType || "SWAP";
+        const n = topN || 10;
+        const tickersAll = await publicApi.getTickers(type);
+        const tickers = (tickersAll || []).slice(0, n);
+        if (mode === "funding") {
+          const fetchers = {};
+          for (const t of tickers) fetchers[t.instId] = publicApi.getFundingRate(t.instId);
+          const { get: get2, errors: errors2 } = await fetchAllSettled(fetchers);
+          const results = tickers.map((t) => {
+            const fr = get2(t.instId)?.[0] || {};
+            const rate = parseFloat(fr.fundingRate || "0");
+            const annualized = rate * 365 * 3;
+            return {
+              instId: t.instId,
+              last: t.last,
+              fundingRate: fr.fundingRate || "N/A",
+              annualizedRate: `${(annualized * 100).toFixed(2)}%`,
+              nextFundingTime: fr.nextFundingTime || "N/A",
+              isExtreme: Math.abs(rate) > (threshold || 1e-3),
+              direction: rate > 0 ? "\u7A7A\u5934\u4ED8\u591A\u5934" : "\u591A\u5934\u4ED8\u7A7A\u5934",
+              arbitrageHint: rate > (threshold || 1e-3) ? `\u8D44\u91D1\u8D39\u7387\u6781\u9AD8(${(annualized * 100).toFixed(0)}%\u5E74\u5316)\uFF0C\u73B0\u8D27\u4E70\u5165+\u5408\u7EA6\u505A\u7A7A\u53EF\u5957\u5229` : rate < -(threshold || 1e-3) ? `\u8D44\u91D1\u8D39\u7387\u6781\u8D1F\uFF0C\u73B0\u8D27\u5356\u51FA+\u5408\u7EA6\u505A\u591A\u53EF\u5957\u5229` : null
+            };
+          }).sort((a, b) => Math.abs(parseFloat(b.fundingRate === "N/A" ? "0" : b.fundingRate)) - Math.abs(parseFloat(a.fundingRate === "N/A" ? "0" : a.fundingRate)));
+          const opportunities = results.filter((r) => r.isExtreme);
+          return toResult({
+            tsIso: (/* @__PURE__ */ new Date()).toISOString(),
+            mode,
+            scanned: results.length,
+            extremeCount: opportunities.length,
+            threshold: `${((threshold || 1e-3) * 365 * 3 * 100).toFixed(0)}% \u5E74\u5316`,
+            topOpportunities: opportunities.slice(0, 10),
+            allResults: results,
+            errors: errors2,
+            _summary: opportunities.length > 0 ? `\u53D1\u73B0 ${opportunities.length} \u4E2A\u5F02\u5E38\u8D39\u7387\uFF1A${opportunities.slice(0, 3).map((o) => `${o.instId}(${o.annualizedRate})`).join(", ")}\u3002` : `\u5DF2\u626B\u63CF ${results.length} \u4E2A\u54C1\u79CD\uFF0C\u65E0\u6781\u7AEF\u8D39\u7387\u3002`
+          });
+        }
+        const ccy = sampleCcy || "BTC";
+        const firstInstId = tickers[0]?.instId || "BTC-USDT-SWAP";
+        const { get, errors } = await fetchAllSettled({
+          lsRatio: publicApi.getLongShortRatio(ccy),
+          pcr: publicApi.getOptionPutCallRatio(ccy),
+          takerVol: publicApi.getTakerVolume(ccy, type),
+          oi: publicApi.getOpenInterest(type),
+          topLS: publicApi.getTopTraderLongShortRatio(firstInstId)
+        });
+        const lsData = get("lsRatio")?.[0] || {};
+        const pcrData = get("pcr")?.[0] || {};
+        const takerData = get("takerVol")?.[0] || {};
+        const oiData = get("oi");
+        const topLSData = get("topLS")?.[0] || {};
+        const frFetchers = {};
+        for (const t of tickers) frFetchers[t.instId] = publicApi.getFundingRate(t.instId);
+        const frResults = await fetchAllSettled(frFetchers);
+        const perCoin = tickers.map((t) => {
+          const frData = frResults.get(t.instId)?.[0] || {};
+          const rate = parseFloat(frData.fundingRate || "0");
+          const changePct = t.open24h && t.last ? (parseFloat(t.last) - parseFloat(t.open24h)) / parseFloat(t.open24h) * 100 : 0;
+          let score = 0;
+          const reasons = [];
+          if (rate > 5e-4) {
+            score -= 1;
+            reasons.push(`\u8D44\u91D1\u8D39\u7387\u6781\u9AD8\u2192\u504F\u7A7A`);
+          } else if (rate > 1e-4) {
+            score -= 0.5;
+            reasons.push(`\u8D39\u7387\u504F\u9AD8`);
+          } else if (rate < -5e-4) {
+            score += 1;
+            reasons.push(`\u8D39\u7387\u6781\u8D1F\u2192\u504F\u591A`);
+          }
+          if (changePct > 3) {
+            score += 1;
+            reasons.push(`24h\u6DA8${changePct.toFixed(1)}%`);
+          } else if (changePct < -3) {
+            score -= 1;
+            reasons.push(`24h\u8DCC${Math.abs(changePct).toFixed(1)}%`);
+          }
+          return {
+            instId: t.instId,
+            last: t.last,
+            change24h: `${changePct.toFixed(2)}%`,
+            fundingRate: frData.fundingRate || "N/A",
+            fundingRateAnnual: rate ? `${(rate * 365 * 3 * 100).toFixed(2)}%` : "N/A",
+            sentimentScore: score,
+            sentiment: score > 1 ? "\u{1F7E2} \u504F\u591A" : score < -1 ? "\u{1F534} \u504F\u7A7A" : "\u{1F7E1} \u4E2D\u6027",
+            reasons
+          };
+        });
+        let globalScore = 0;
+        const lsValue = parseFloat(lsData.longShortRatio || "1");
+        if (lsValue > 1.2) globalScore += 1;
+        else if (lsValue < 0.8) globalScore -= 1;
+        const pcrValue = parseFloat(pcrData.oiRatio || "1");
+        if (pcrValue > 0.8) globalScore -= 1;
+        else if (pcrValue < 0.5) globalScore += 1;
+        return toResult({
+          tsIso: (/* @__PURE__ */ new Date()).toISOString(),
+          mode,
+          globalSentiment: globalScore > 0 ? "\u{1F7E2} \u504F\u5411\u591A\u5934" : globalScore < 0 ? "\u{1F534} \u504F\u5411\u7A7A\u5934" : "\u{1F7E1} \u4E2D\u6027",
+          globalMetrics: {
+            longShortRatio: lsData.longShortRatio || "N/A",
+            putCallOiRatio: pcrData.oiRatio || "N/A",
+            takerBuyVol: takerData.buyVol || "N/A",
+            takerSellVol: takerData.sellVol || "N/A",
+            contractTopLS: topLSData.longShortRatio || "N/A",
+            openInterest: oiData.length > 0 ? oiData[0]?.oi : "N/A"
+          },
+          perCoin: perCoin.slice(0, n),
+          errors,
+          _summary: `${mode === "sentiment" ? "\u5E02\u573A\u60C5\u7EEA" : "\u8D39\u7387\u626B\u63CF"}\uFF1A${perCoin.filter((c) => c.sentimentScore > 1).length} \u4E2A\u504F\u591A\uFF0C${perCoin.filter((c) => c.sentimentScore < -1).length} \u4E2A\u504F\u7A7A\u3002`
+        });
+      } catch (e) {
+        return toError(e);
+      }
+    }
+  );
+  registerTool(
+    server,
+    "agent_asset_center",
+    "READ",
+    "CAT:[\u8D26\u6237\u8D44\u4EA7] | \u8D44\u4EA7\u6307\u6325\u4E2D\u5FC3\uFF1A\u8D44\u91D1\u5206\u5E03\u3001\u7406\u8D22\u6536\u76CA\u3001\u5B50\u8D26\u6237\u4E00\u89C8\uFF0C\u4E09\u5408\u4E00",
+    {
+      mode: external_exports.enum(["all", "funds", "earn", "subaccounts"]).optional().default("all").describe("all=\u5168\u666F, funds=\u8D44\u91D1\u5206\u5E03\u4E0E\u5212\u8F6C, earn=\u7406\u8D22\u6536\u76CA, subaccounts=\u5B50\u8D26\u6237"),
+      ccy: external_exports.string().optional().describe("\u5E01\u79CD\u8FC7\u6EE4\uFF0C\u4EC5 funds \u6A21\u5F0F"),
+      subMode: external_exports.enum(["list", "detail"]).optional().default("list").describe("\u5B50\u8D26\u6237\u6A21\u5F0F\uFF1Alist=\u5217\u8868, detail=\u542B\u4F59\u989D")
+    },
+    async ({ mode, ccy, subMode }) => {
+      if (!auth) return toError(AUTH_REQUIRED);
+      try {
+        const fetchers = {};
+        if (mode === "all" || mode === "funds") {
+          fetchers.funding = privateApi.getBalance_funding(auth, ccy);
+          fetchers.trading = privateApi.getBalance(auth, ccy);
+        }
+        if (mode === "all" || mode === "earn") {
+          fetchers.savings = privateApi.getSavingsBalance(auth);
+          fetchers.ethStaking = privateApi.getEthStakingBalance(auth);
+          fetchers.solStaking = privateApi.getSolStakingBalance(auth);
+          fetchers.stableRewards = privateApi.getStableRewardsProductInfo(auth);
+          fetchers.stakingOrders = privateApi.getStakingOrders(auth);
+        }
+        if (mode === "all" || mode === "subaccounts") {
+          fetchers.subList = privateApi.listSubAccounts(auth);
+        }
+        const { get, errors } = await fetchAllSettled(fetchers);
+        const result = { tsIso: (/* @__PURE__ */ new Date()).toISOString(), mode, errors };
+        if (mode === "all" || mode === "funds") {
+          const fundData = get("funding")?.[0] || {};
+          const tradeData = get("trading")?.[0] || {};
+          const fundDetails = fundData.details || fundData.detail || [];
+          const tradeDetails = tradeData.details || tradeData.detail || [];
+          const map = /* @__PURE__ */ new Map();
+          for (const d of fundDetails) map.set(d.ccy, { ccy: d.ccy, fundingAvail: d.availBal || d.cashBal || "0", tradingAvail: "0" });
+          for (const d of tradeDetails) {
+            const e = map.get(d.ccy);
+            if (e) e.tradingAvail = d.availBal || d.cashBal || "0";
+            else map.set(d.ccy, { ccy: d.ccy, fundingAvail: "0", tradingAvail: d.availBal || d.cashBal || "0" });
+          }
+          result.funds = {
+            fundingTotalEq: fundData.totalEq || "N/A",
+            tradingTotalEq: tradeData.totalEq || "N/A",
+            currencies: [...map.values()].filter((d) => parseFloat(d.fundingAvail) > 0 || parseFloat(d.tradingAvail) > 0)
+          };
+        }
+        if (mode === "all" || mode === "earn") {
+          const savings = get("savings");
+          const eth = get("ethStaking");
+          const sol = get("solStaking");
+          const earnProducts = [];
+          for (const arr of [savings, eth, sol]) {
+            if (Array.isArray(arr)) for (const s of arr) earnProducts.push({
+              ccy: s.ccy || "?",
+              product: s.productId || s.investType || "earn",
+              balance: s.amt || s.investAmt || "0",
+              apy: s.rate || s.apy || "N/A"
+            });
+          }
+          result.earn = {
+            savingsCount: Array.isArray(savings) ? savings.length : 0,
+            ethStakingCount: Array.isArray(eth) ? eth.length : 0,
+            solStakingCount: Array.isArray(sol) ? sol.length : 0,
+            stakingOrderCount: Array.isArray(get("stakingOrders")) ? get("stakingOrders").length : 0,
+            products: earnProducts
+          };
+        }
+        if (mode === "all" || mode === "subaccounts") {
+          const subList = get("subList") || [];
+          if (subMode === "detail" && subList.length > 0) {
+            const balFetchers = {};
+            for (const s of subList) balFetchers[s.subAcct] = privateApi.getSubAccountFundingBalance(auth, s.subAcct);
+            const balRes = await fetchAllSettled(balFetchers);
+            result.subaccounts = subList.map((s) => {
+              const bal = balRes.get(s.subAcct)?.[0] || {};
+              return { subAcct: s.subAcct, label: s.label, totalEq: bal.totalEq || "N/A" };
+            });
+          } else {
+            result.subaccounts = subList.map((s) => ({ subAcct: s.subAcct, label: s.label, enable: s.enable }));
+          }
+          result.subaccountCount = subList.length;
+        }
+        const parts = [];
+        if (result.funds) parts.push(`\u8D44\u91D1\u8D26\u6237${result.funds.currencies?.length || 0}\u4E2A\u5E01\u79CD`);
+        if (result.earn) parts.push(`\u7406\u8D22${result.earn.products?.length || 0}\u4E2A\u6301\u4ED3`);
+        if (result.subaccounts) parts.push(`${result.subaccountCount}\u4E2A\u5B50\u8D26\u6237`);
+        result._summary = "\u8D44\u4EA7\u5168\u666F\uFF1A" + parts.join("\uFF0C") + "\u3002";
+        return toResult(result);
+      } catch (e) {
+        return toError(e);
+      }
+    }
+  );
+  registerTool(
+    server,
+    "agent_strategy_center",
+    "READ",
+    "CAT:[\u7B56\u7565\u4EA4\u6613] | \u7B56\u7565\u4EA4\u6613\u4E2D\u5FC3\uFF1A\u6D3B\u8DC3\u7B56\u7565\u4EEA\u8868\u76D8 or \u7F51\u683C\u53C2\u6570\u667A\u80FD\u63A8\u8350",
+    {
+      mode: external_exports.enum(["dashboard", "grid_advice"]).default("dashboard").describe("dashboard=\u6240\u6709\u6D3B\u8DC3\u7B56\u7565\u4E00\u89C8, grid_advice=\u6CE2\u52A8\u7387\u5206\u6790+AI\u7F51\u683C\u63A8\u8350"),
+      instType: external_exports.enum(["SPOT", "SWAP", "FUTURES"]).optional().describe("\u4EA7\u54C1\u7C7B\u578B\u8FC7\u6EE4"),
+      instId: external_exports.string().optional().describe("\u4EA4\u6613\u54C1\u79CD(grid_advice\u6A21\u5F0F\u5FC5\u586B)\uFF0C\u5982 BTC-USDT"),
+      direction: external_exports.enum(["long", "short", "neutral"]).optional().default("neutral").describe("\u7F51\u683C\u65B9\u5411(grid_advice)")
+    },
+    async ({ mode, instType, instId, direction }) => {
+      if (!auth) return toError(AUTH_REQUIRED);
+      try {
+        if (mode === "grid_advice") {
+          if (!instId) return toError(new Error("grid_advice \u6A21\u5F0F\u9700\u8981 instId \u53C2\u6570"));
+          const { get: get2, errors: errors2 } = await fetchAllSettled({
+            aiParam: publicApi.getGridAiParam(instId, "grid"),
+            candles: publicApi.getCandles(instId, "1D", 30),
+            ticker: publicApi.getTicker(instId)
+          });
+          const aiParam = get2("aiParam")?.[0] || {};
+          const candles = get2("candles") || [];
+          const tickerData = get2("ticker")?.[0] || {};
+          const closes = candles.map((c) => parseFloat(c[4] || "0")).filter((n) => n > 0);
+          let volatility = 0;
+          if (closes.length >= 2) {
+            const returns = closes.slice(1).map((c, i) => (c - closes[i]) / closes[i]);
+            const mean = returns.reduce((a, b) => a + b, 0) / returns.length;
+            volatility = Math.sqrt(returns.reduce((a, r) => a + (r - mean) ** 2, 0) / returns.length) * Math.sqrt(365);
+          }
+          const lastPrice = parseFloat(tickerData.last || "0");
+          const high30 = closes.length > 0 ? Math.max(...closes) : lastPrice * 1.1;
+          const low30 = closes.length > 0 ? Math.min(...closes) : lastPrice * 0.9;
+          const gUpper = aiParam.upperPx || (high30 * 1.05).toFixed(2);
+          const gLower = aiParam.lowerPx || (low30 * 0.95).toFixed(2);
+          const gCount = aiParam.gridNum || Math.min(20, Math.floor((parseFloat(String(gUpper)) - parseFloat(String(gLower))) / (lastPrice * 0.01)) || 10);
+          return toResult({
+            tsIso: (/* @__PURE__ */ new Date()).toISOString(),
+            mode,
+            instId,
+            currentPrice: lastPrice,
+            volatility: `${(volatility * 100).toFixed(1)}%`,
+            range30d: { high: high30, low: low30 },
+            recommendation: { direction: direction || "neutral", upperPrice: gUpper, lowerPrice: gLower, gridCount: gCount },
+            errors: errors2,
+            _summary: `${instId} 30\u65E5\u5E74\u5316\u6CE2\u52A8\u7387 ${(volatility * 100).toFixed(1)}%\u3002AI\u63A8\u8350\u7F51\u683C [${gLower}, ${gUpper}]\uFF0C${gCount} \u6863\u3002`,
+            tip: "\u786E\u8BA4\u540E\u7528 okx_create_grid_order \u521B\u5EFA\u7F51\u683C\u3002"
+          });
+        }
+        const { get, errors } = await fetchAllSettled({
+          algoOrders: privateApi.getOrdersAlgoPending(auth, void 0, instType || void 0),
+          gridOrders: privateApi.getGridOrdersPending(auth),
+          recurringOrders: privateApi.getRecurringOrdersPending(auth),
+          signalBots: privateApi.getSignalBotsPending(auth, instType || void 0),
+          spreadOrders: privateApi.getSpreadOrdersPending(auth)
+        });
+        const counts = {
+          algo: Array.isArray(get("algoOrders")) ? get("algoOrders").length : 0,
+          grid: Array.isArray(get("gridOrders")) ? get("gridOrders").length : 0,
+          recurring: Array.isArray(get("recurringOrders")) ? get("recurringOrders").length : 0,
+          signal: Array.isArray(get("signalBots")) ? get("signalBots").length : 0,
+          spread: Array.isArray(get("spreadOrders")) ? get("spreadOrders").length : 0
+        };
+        const totalActive = Object.values(counts).reduce((a, b) => a + b, 0);
+        return toResult({
+          tsIso: (/* @__PURE__ */ new Date()).toISOString(),
+          mode,
+          totalActive,
+          breakdown: counts,
+          details: {
+            algoOrders: Array.isArray(get("algoOrders")) ? get("algoOrders").slice(0, 15).map((o) => ({ algoId: o.algoId, instId: o.instId, ordType: o.ordType, side: o.side, state: o.state })) : [],
+            gridOrders: Array.isArray(get("gridOrders")) ? get("gridOrders").slice(0, 10).map((o) => ({ algoId: o.algoId, instId: o.instId, state: o.state })) : [],
+            recurringOrders: Array.isArray(get("recurringOrders")) ? get("recurringOrders").slice(0, 10).map((o) => ({ algoId: o.algoId, instId: o.instId, period: o.period, state: o.state })) : [],
+            signalBots: Array.isArray(get("signalBots")) ? get("signalBots").slice(0, 10).map((o) => ({ signalId: o.signalId || o.algoId, instId: o.instId, state: o.state })) : [],
+            spreadOrders: Array.isArray(get("spreadOrders")) ? get("spreadOrders").slice(0, 10).map((o) => ({ algoId: o.algoId, sprdId: o.sprdId, state: o.state })) : []
+          },
+          errors,
+          _summary: totalActive > 0 ? `\u6D3B\u8DC3\u7B56\u7565 ${totalActive} \u4E2A\uFF1A\u6761\u4EF6\u59D4\u6258 ${counts.algo} / \u7F51\u683C ${counts.grid} / \u5B9A\u6295 ${counts.recurring} / \u4FE1\u53F7 ${counts.signal} / \u4EF7\u5DEE ${counts.spread}` : "\u5F53\u524D\u65E0\u6D3B\u8DC3\u7B56\u7565\u3002",
+          tip: "\u9700\u8981\u7F51\u683C\u5EFA\u8BAE\uFF1F\u7528 mode=grid_advice\u3002"
+        });
+      } catch (e) {
+        return toError(e);
+      }
+    }
+  );
+  registerTool(
+    server,
+    "agent_stop_loss_master",
+    "WRITE",
+    "CAT:[\u98CE\u9669\u98CE\u63A7] | \u5168\u5C40\u98CE\u63A7\uFF1A\u6279\u91CF\u8BBE\u6B62\u635F\u6761\u4EF6\u5355 / \u4E00\u952E\u5168\u90E8\u64A4\u5355 / \u67E5\u770B\u98CE\u63A7\u72B6\u6001",
+    {
+      instId: external_exports.string().optional().describe("\u6307\u5B9A\u54C1\u79CD\uFF0C\u4E0D\u586B\u5219\u5BF9\u6240\u6709\u6301\u4ED3\u64CD\u4F5C"),
+      stopLossPct: external_exports.string().optional().describe("\u6B62\u635F\u767E\u5206\u6BD4\uFF0C\u5982 '5' \u8868\u793A\u4E8F\u635F 5% \u6B62\u635F"),
+      mode: external_exports.enum(["preview", "set_stop_loss", "cancel_all"]).describe("preview=\u67E5\u770B\u98CE\u63A7\u72B6\u6001, set_stop_loss=\u8BBE\u6B62\u635F\u5355, cancel_all=\u5168\u90E8\u64A4\u5355")
+    },
+    async ({ instId, stopLossPct, mode }) => {
+      if (!auth) return toError(AUTH_REQUIRED);
+      try {
+        const positions = await privateApi.getPositions(auth);
+        const active = (positions || []).filter(
+          (p) => parseFloat(p.avgPx || "0") > 0 && parseFloat(p.pos || "0") !== "0"
+        );
+        const targets = instId ? active.filter((p) => p.instId === instId) : active;
+        if (targets.length === 0) {
+          return toResult({ tsIso: (/* @__PURE__ */ new Date()).toISOString(), mode, message: instId ? `${instId} \u65E0\u6D3B\u8DC3\u6301\u4ED3` : "\u65E0\u4EFB\u4F55\u6D3B\u8DC3\u6301\u4ED3" });
+        }
+        if (mode === "preview") {
+          const pct = parseFloat(stopLossPct || "5");
+          return toResult({
+            tsIso: (/* @__PURE__ */ new Date()).toISOString(),
+            mode,
+            positions: targets.map((p) => ({
+              instId: p.instId,
+              posSide: p.posSide,
+              pos: p.pos,
+              avgPx: p.avgPx,
+              markPx: p.markPx,
+              upl: p.upl,
+              uplRatio: p.uplRatio,
+              liqPx: p.liqPx,
+              lever: p.lever,
+              suggestedStopPx: p.avgPx ? p.posSide === "long" ? (parseFloat(p.avgPx) * (1 - pct / 100)).toFixed(2) : (parseFloat(p.avgPx) * (1 + pct / 100)).toFixed(2) : "N/A"
+            })),
+            _summary: `\u98CE\u63A7\u9884\u89C8\uFF1A${targets.length} \u4E2A\u6301\u4ED3\uFF0C\u5EFA\u8BAE\u6B62\u635F\u5E45\u5EA6 ${pct}%\u3002`
+          });
+        }
+        if (mode === "set_stop_loss") {
+          if (!stopLossPct) return toError(new Error("set_stop_loss \u6A21\u5F0F\u9700\u8981 stopLossPct \u53C2\u6570"));
+          const pct = parseFloat(stopLossPct);
+          if (isNaN(pct) || pct <= 0 || pct >= 50) return toError(new Error("stopLossPct \u5FC5\u987B\u5728 1-50 \u4E4B\u95F4"));
+          const actions = [];
+          for (const p of targets) {
+            const avgPx = parseFloat(p.avgPx);
+            const isLong = p.posSide === "long";
+            const stopPx = isLong ? (avgPx * (1 - pct / 100)).toFixed(2) : (avgPx * (1 + pct / 100)).toFixed(2);
+            try {
+              await privateApi.placeAlgoOrder(auth, {
+                instId: p.instId,
+                tdMode: "cross",
+                side: isLong ? "sell" : "buy",
+                ordType: "conditional",
+                sz: Math.abs(parseFloat(p.pos)).toString(),
+                tpTriggerPx: stopPx,
+                tpOrdPx: "-1"
+              });
+              actions.push({ instId: p.instId, posSide: p.posSide, stopPx, status: "placed" });
+            } catch (e) {
+              actions.push({ instId: p.instId, posSide: p.posSide, stopPx, status: "failed", error: e.message });
+            }
+          }
+          return toResult({
+            tsIso: (/* @__PURE__ */ new Date()).toISOString(),
+            mode,
+            actions,
+            _summary: `\u5DF2\u4E3A ${actions.filter((a) => a.status === "placed").length}/${actions.length} \u4E2A\u6301\u4ED3\u8BBE\u6B62\u635F\uFF08${stopLossPct}%\uFF09\u3002`
+          });
+        }
+        await privateApi.massCancel(auth, instId ? "SWAP" : "SWAP");
+        return toResult({ tsIso: (/* @__PURE__ */ new Date()).toISOString(), mode, cancelled: true, _summary: "\u5DF2\u5168\u90E8\u64A4\u5355\u3002" });
+      } catch (e) {
+        return toError(e);
+      }
+    }
+  );
+  registerTool(
+    server,
+    "agent_copy_trader_search",
+    "READ",
+    "CAT:[\u8DDF\u5355] | \u6309\u6536\u76CA\u7387/\u80DC\u7387/\u56DE\u64A4\u7B5B\u9009\u6700\u4F18\u5E26\u5355\u5458\uFF0C\u9644\u8DDF\u5355\u6307\u5F15",
+    {
+      instType: external_exports.enum(["SPOT", "SWAP"]).optional().default("SWAP"),
+      sortBy: external_exports.enum(["pnl", "winRate", "copyCount"]).optional().default("pnl"),
+      topN: external_exports.number().int().min(1).max(20).optional().default(10)
+    },
+    async ({ instType, sortBy, topN }) => {
+      try {
+        const type = instType || "SWAP";
+        const n = topN || 10;
+        const traders = await publicApi.getPublicLeadTraders(type);
+        if (!Array.isArray(traders) || traders.length === 0) {
+          return toResult({ tsIso: (/* @__PURE__ */ new Date()).toISOString(), traders: [], _summary: "\u5F53\u524D\u65E0\u53EF\u7528\u5E26\u5355\u5458\u3002" });
+        }
+        const batch = traders.slice(0, n);
+        const fetchers = {};
+        for (const t of batch) {
+          const code = t.uniqueCode || t.copyTraderId;
+          if (code) fetchers[code] = publicApi.getLeadTraderStats(code, type, "30");
+        }
+        const statsRes = await fetchAllSettled(fetchers);
+        const ranked = batch.map((t) => {
+          const code = t.uniqueCode || t.copyTraderId;
+          const stats = statsRes.get(code)?.[0] || {};
+          return {
+            name: t.nickName || t.name || code,
+            uniqueCode: code,
+            pnl: stats.pnl || "N/A",
+            winRate: stats.winRate || "N/A",
+            sharpeRatio: stats.sharpeRatio || "N/A",
+            copyCount: stats.copyCount || "0",
+            maxDrawdown: stats.maxDrawdown || t.maxDrawdown || "N/A"
+          };
+        });
+        if (sortBy === "pnl") ranked.sort((a, b) => parseFloat(b.pnl === "N/A" ? "0" : b.pnl) - parseFloat(a.pnl === "N/A" ? "0" : a.pnl));
+        else if (sortBy === "winRate") ranked.sort((a, b) => parseFloat(b.winRate === "N/A" ? "0" : b.winRate) - parseFloat(a.winRate === "N/A" ? "0" : a.winRate));
+        else ranked.sort((a, b) => parseInt(b.copyCount) - parseInt(a.copyCount));
+        return toResult({
+          tsIso: (/* @__PURE__ */ new Date()).toISOString(),
+          instType: type,
+          sortBy,
+          topTraders: ranked,
+          _summary: `Top ${ranked.length} \u5E26\u5355\u5458 (\u6309${sortBy === "pnl" ? "\u6536\u76CA" : sortBy === "winRate" ? "\u80DC\u7387" : "\u8DDF\u5355\u4EBA\u6570"}\u6392\u5E8F)\u3002`,
+          tip: "\u786E\u8BA4\u5E26\u5355\u5458\u540E\uFF0C\u4F7F\u7528 okx_first_copy_settings { uniqueCode } \u2192 okx_copy_trader \u5F00\u59CB\u8DDF\u5355\u3002"
+        });
+      } catch (e) {
+        return toError(e);
+      }
+    }
+  );
+  registerTool(
+    server,
+    "agent_option_scanner",
+    "READ",
+    "CAT:[\u5E02\u573A\u626B\u63CF] | \u671F\u6743\u5168\u666F\u626B\u63CF\uFF1A\u6982\u8981+OI\u5230\u671F/\u884C\u6743\u4EF7\u5206\u5E03+PCR+\u5927\u5B97\u4EA4\u6613\u91CF",
+    { uly: external_exports.string().describe("\u6807\u7684\uFF0C\u5982 BTC-USD\u3001ETH-USD\u3002\u5FC5\u586B") },
+    async ({ uly }) => {
+      try {
+        const { get, errors } = await fetchAllSettled({
+          summary: publicApi.getOptSummary(uly),
+          oiExpiry: publicApi.getOptionOiExpiry(uly),
+          pcr: publicApi.getOptionPutCallRatio(uly),
+          blockVol: publicApi.getOptionTakerBlockVolume(uly)
+        });
+        const summary = get("summary") || [];
+        const oiExpiry = get("oiExpiry") || [];
+        const pcrData = get("pcr")?.[0] || {};
+        const blockData = get("blockVol")?.[0] || {};
+        return toResult({
+          tsIso: (/* @__PURE__ */ new Date()).toISOString(),
+          underlying: uly,
+          summary: summary.slice(0, 20).map((s) => ({
+            instId: s.instId,
+            expTime: s.expTime,
+            strike: s.strike,
+            optionType: s.optType,
+            markPx: s.markPx,
+            delta: s.delta,
+            oi: s.oi,
+            vol24h: s.vol24h
+          })),
+          oiByExpiry: oiExpiry.map((e) => ({ expTime: e.expTime, callOi: e.callOi, putOi: e.putOi })),
+          putCallRatio: { oiRatio: pcrData.oiRatio || "N/A", volRatio: pcrData.volRatio || "N/A" },
+          blockTrades: blockData.callVol !== void 0 ? { callVol: blockData.callVol, putVol: blockData.putVol } : null,
+          errors,
+          _summary: `${uly} \u671F\u6743\u626B\u63CF\uFF1A${summary.length} \u4E2A\u5408\u7EA6\uFF0CPCR(\u6301\u4ED3) ${pcrData.oiRatio || "N/A"}\u3002`
+        });
+      } catch (e) {
+        return toError(e);
+      }
+    }
+  );
+  registerTool(
+    server,
+    "agent_prediction_arbitrage",
+    "READ",
+    "CAT:[\u9884\u6D4B\u5E02\u573A] | \u626B\u63CF\u9884\u6D4B\u5E02\u573A\u4E8B\u4EF6\uFF0C\u53D1\u73B0 YES+NO \u4EF7\u5DEE < 1.0 \u7684\u65E0\u98CE\u9669\u5957\u5229\u673A\u4F1A",
+    {},
+    async () => {
+      try {
+        const events = await publicApi.searchPredictionsEvents("");
+        const evtList = Array.isArray(events) ? events.slice(0, 10) : [];
+        const fetchers = {};
+        for (const evt of evtList) {
+          const id = evt.eventId || evt.event_id;
+          if (id) fetchers[`evt_${id}`] = publicApi.getPredictionsEvent(id);
+          const mktId = evt.marketId || evt.market_id;
+          if (mktId) fetchers[`mkt_${mktId}`] = publicApi.getPredictionsMarket(mktId);
+        }
+        const { get } = await fetchAllSettled(fetchers);
+        const opportunities = [];
+        for (const evt of evtList) {
+          const id = evt.eventId || evt.event_id;
+          const mktId = evt.marketId || evt.market_id;
+          const mktData = get(`mkt_${mktId}`);
+          const yesPrice = parseFloat(mktData?.yesPrice || evt.yesPrice || "0");
+          const noPrice = parseFloat(mktData?.noPrice || evt.noPrice || "0");
+          const total = yesPrice + noPrice;
+          if (total > 0 && total < 0.99) {
+            opportunities.push({
+              eventId: id,
+              title: evt.title || "?",
+              yesPrice: yesPrice.toFixed(4),
+              noPrice: noPrice.toFixed(4),
+              total: total.toFixed(4),
+              discount: ((1 - total) * 100).toFixed(2) + "%"
+            });
+          }
+        }
+        return toResult({
+          tsIso: (/* @__PURE__ */ new Date()).toISOString(),
+          eventsScanned: evtList.length,
+          opportunities,
+          _summary: opportunities.length > 0 ? `\u53D1\u73B0 ${opportunities.length} \u4E2A\u5957\u5229\u673A\u4F1A\uFF1A${opportunities.slice(0, 3).map((o) => `${o.title}(${o.discount})`).join(", ")}` : `\u5DF2\u626B\u63CF ${evtList.length} \u4E2A\u4E8B\u4EF6\uFF0C\u5F53\u524D\u65E0 YES+NO<1.0 \u7684\u5957\u5229\u673A\u4F1A\u3002`,
+          tip: "\u786E\u8BA4\u673A\u4F1A\u540E\u7528 okx_predictions_place_order \u6216 okx_event_place_order \u5206\u522B\u4E70\u5165 YES \u548C NO\u3002"
+        });
+      } catch (e) {
+        return toError(e);
+      }
+    }
+  );
+  registerTool(
+    server,
+    "agent_technical_report",
+    "READ",
+    "CAT:[\u6280\u672F\u6307\u6807] | \u591A\u5468\u671F(1H/4H/1D)\u6280\u672F\u6307\u6807\u7EFC\u5408\u8BA1\u7B97\uFF0C\u8F93\u51FA\u65B9\u5411\u5171\u8BC6\u4FE1\u53F7",
+    {
+      instId: external_exports.string().describe("\u4EA4\u6613\u54C1\u79CD\uFF0C\u5982 BTC-USDT\u3002\u5FC5\u586B"),
+      bars: external_exports.array(external_exports.enum(["1H", "4H", "1D", "1W"])).optional().default(["1H", "4H", "1D"]).describe("K\u7EBF\u5468\u671F")
+    },
+    async ({ instId, bars }) => {
+      try {
+        const periods = bars || ["1H", "4H", "1D"];
+        const fetchers = { ticker: publicApi.getTicker(instId) };
+        for (const bar of periods) fetchers[`c_${bar}`] = publicApi.getCandles(instId, bar, 100);
+        const { get, errors } = await fetchAllSettled(fetchers);
+        const tickerData = get("ticker")?.[0] || {};
+        const lastPrice = parseFloat(tickerData.last || "0");
+        const periodResults = [];
+        for (const bar of periods) {
+          const candles = get(`c_${bar}`) || [];
+          if (candles.length < 20) {
+            periodResults.push({ period: bar, status: "\u6570\u636E\u4E0D\u8DB3" });
+            continue;
+          }
+          const closes = candles.map((c) => parseFloat(c[4] || "0"));
+          const sma20 = closes.slice(-20).reduce((a, b) => a + b, 0) / 20;
+          const ema = (data, period) => {
+            const k = 2 / (period + 1);
+            let e = data[0];
+            for (let i = 1; i < data.length; i++) e = data[i] * k + e * (1 - k);
+            return e;
+          };
+          const macd = ema(closes, 12) - ema(closes, 26);
+          const rsiData = closes.slice(-15);
+          let gain = 0, loss = 0;
+          for (let i = 1; i < rsiData.length; i++) {
+            const d = rsiData[i] - rsiData[i - 1];
+            if (d > 0) gain += d;
+            else loss -= d;
+          }
+          const rsi = loss === 0 ? 100 : 100 - 100 / (1 + gain / 14 / (loss / 14));
+          const signals = [];
+          if (lastPrice > sma20) signals.push("\u4EF7\u683C>SMA20(\u504F\u591A)");
+          else signals.push("\u4EF7\u683C<SMA20(\u504F\u7A7A)");
+          if (macd > 0) signals.push("MACD>0(\u504F\u591A)");
+          else signals.push("MACD<0(\u504F\u7A7A)");
+          if (rsi > 70) signals.push("RSI\u8D85\u4E70(\u504F\u7A7A)");
+          else if (rsi < 30) signals.push("RSI\u8D85\u5356(\u504F\u591A)");
+          const bull = signals.filter((s) => s.includes("\u504F\u591A")).length;
+          const bear = signals.filter((s) => s.includes("\u504F\u7A7A")).length;
+          periodResults.push({ period: bar, lastPrice, sma20: sma20.toFixed(2), macd: macd.toFixed(6), rsi: rsi.toFixed(1), signals, direction: bull > bear ? "\u{1F7E2} \u504F\u591A" : bear > bull ? "\u{1F534} \u504F\u7A7A" : "\u{1F7E1} \u4E2D\u6027" });
+        }
+        const bullPeriods = periodResults.filter((p) => p.direction?.includes("\u504F\u591A")).map((p) => p.period);
+        const bearPeriods = periodResults.filter((p) => p.direction?.includes("\u504F\u7A7A")).map((p) => p.period);
+        const consensus = bullPeriods.length > bearPeriods.length ? `\u591A\u6570\u5468\u671F\u504F\u591A(${bullPeriods.join(",")})` : bearPeriods.length > bullPeriods.length ? `\u591A\u6570\u5468\u671F\u504F\u7A7A(${bearPeriods.join(",")})` : "\u591A\u7A7A\u5206\u6B67";
+        return toResult({
+          tsIso: (/* @__PURE__ */ new Date()).toISOString(),
+          instId,
+          currentPrice: lastPrice,
+          consensus,
+          periods: periodResults,
+          errors,
+          _summary: `${instId} \u591A\u5468\u671FTA\uFF1A${consensus}\u3002\u5F53\u524D\u4EF7 $${lastPrice}\u3002`,
+          disclaimer: "\u4EE5\u4E0A\u4E3AL1\u57FA\u7840\u6307\u6807\u8BA1\u7B97\uFF0C\u4E0D\u6784\u6210\u6295\u8D44\u5EFA\u8BAE\u3002\u8BE6\u7EC6\u591A\u6307\u6807\u5206\u6790\u53EF\u4F7F\u7528 okx_indicator_batch\u3002"
+        });
+      } catch (e) {
+        return toError(e);
+      }
+    }
+  );
   registerTool(
     server,
     "agent_get_preference",
     "READ",
-    'CAT:[\u7CFB\u7EDF] | ## \u529F\u80FD\uFF1A\u8BFB\u53D6 Agent \u6301\u4E45\u5316\u504F\u597D\uFF0C\u8DE8\u4F1A\u8BDD\u4FDD\u7559\n## \u573A\u666F\uFF1AAgent \u5728\u65B0\u4F1A\u8BDD\u4E2D\u6062\u590D\u7528\u6237\u504F\u597D\uFF08\u5982"\u53EA\u505A\u73B0\u8D27""\u9ED8\u8BA4\u4EA4\u6613\u5BF9BTC-USDT""\u98CE\u9669\u504F\u597D\u4F4E"\uFF09\n## \u5173\u952E\u8BCD\uFF1A\u504F\u597D, preference, \u8BB0\u5FC6, \u6301\u4E45\u5316, \u7528\u6237\u753B\u50CF\n## \u53C2\u6570\uFF1A\n##   - key: \u504F\u597D\u952E\u540D\u3002\u4E0D\u586B\u8FD4\u56DE\u5168\u90E8\u504F\u597D\n## \u9274\u6743\uFF1APUBLIC \u2014 \u672C\u5730\u8BFB\u53D6\n## \u98CE\u9669\uFF1AREAD \u2014 \u53EA\u8BFB\n## \u8FD4\u56DE\u91CF\uFF1A\u5FAE\u5C0F ~300B\n## \u5173\u8054\uFF1Aagent_set_preference \u8BBE\u7F6E\u504F\u597D \u2192 \u672C\u5DE5\u5177 \u2192 Agent \u6839\u636E\u504F\u597D\u8C03\u6574\u7B56\u7565',
+    "CAT:[\u7CFB\u7EDF] | \u8BFB\u53D6 Agent \u6301\u4E45\u5316\u504F\u597D\uFF0C\u8DE8\u4F1A\u8BDD\u4FDD\u7559",
     {
       key: external_exports.string().optional().describe("\u504F\u597D\u952E\u540D\uFF0C\u4E0D\u586B\u8FD4\u56DE\u5168\u90E8")
     },
@@ -35201,7 +35795,14 @@ function registerAgentUtils(server, auth) {
           if (fs.existsSync(prefPath)) {
             prefs = JSON.parse(fs.readFileSync(prefPath, "utf-8"));
           }
-        } catch {
+        } catch (e) {
+          const corrupted = prefPath + ".corrupted." + (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+          try {
+            fs.renameSync(prefPath, corrupted);
+          } catch {
+          }
+          process.stderr.write(`[hvip] \u26A0\uFE0F preferences.json \u635F\u574F\uFF0C\u5DF2\u5907\u4EFD\u4E3A ${corrupted}\uFF0C\u91CD\u7F6E\u4E3A\u7A7A
+`);
         }
         const result = key ? { key, value: prefs[key] ?? null, found: key in prefs } : { all: prefs, count: Object.keys(prefs).length };
         return toResult({
@@ -35233,7 +35834,14 @@ function registerAgentUtils(server, auth) {
           if (fs.existsSync(prefPath)) {
             prefs = JSON.parse(fs.readFileSync(prefPath, "utf-8"));
           }
-        } catch {
+        } catch (e) {
+          const corrupted = prefPath + ".corrupted." + (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+          try {
+            fs.renameSync(prefPath, corrupted);
+          } catch {
+          }
+          process.stderr.write(`[hvip] \u26A0\uFE0F preferences.json \u635F\u574F\uFF0C\u5DF2\u5907\u4EFD\u4E3A ${corrupted}\uFF0C\u91CD\u7F6E\u4E3A\u7A7A
+`);
         }
         prefs[key] = value;
         fs.writeFileSync(prefPath, JSON.stringify(prefs, null, 2), "utf-8");
@@ -36691,6 +37299,8 @@ var WsManager = class {
             }
           }
         } catch {
+          process.stderr.write(`[WS] \u26A0\uFE0F \u7578\u5F62 WS \u6D88\u606F: ${raw.toString().slice(0, 80)}
+`);
         }
       });
       ws.on("error", (err) => {
@@ -36956,6 +37566,8 @@ var AgentHub = class {
   version = "0.0.0";
   port = 0;
   db = null;
+  token = "";
+  // PSK 鉴权令牌
   // ── 持久化绑定 ──
   setDB(db) {
     this.db = db;
@@ -36974,8 +37586,9 @@ var AgentHub = class {
     }
   }
   // ── 启动 ──
-  start(port, host = "0.0.0.0", version2 = "0.0.0") {
+  start(port, host = "0.0.0.0", version2 = "0.0.0", token = "") {
     this.version = version2;
+    this.token = token;
     const startWss = (p) => {
       return new Promise((resolve2) => {
         const wss = new import_websocket_server.default({ port: p, host });
@@ -37023,7 +37636,16 @@ var AgentHub = class {
     if (!this.wss) return;
     this.ensureRoom("#lobby");
     this.ensureRoom("#review");
-    this.wss.on("connection", (ws) => {
+    this.wss.on("connection", (ws, req) => {
+      if (this.token) {
+        const urlParams = new URL(req.url || "/", "http://localhost").searchParams;
+        const provided = urlParams.get("token") || "";
+        if (provided !== this.token) {
+          ws.send(JSON.stringify({ type: "error", message: "\u672A\u6388\u6743 \u2014 \u8BF7\u5728 WS URL \u4E2D\u643A\u5E26 ?token=..." }));
+          ws.close();
+          return;
+        }
+      }
       let agentId = null;
       ws.on("message", (raw) => {
         try {
@@ -37037,7 +37659,9 @@ var AgentHub = class {
       ws.on("close", () => {
         if (agentId) this.handleDisconnect(agentId);
       });
-      ws.on("error", () => {
+      ws.on("error", (e) => {
+        process.stderr.write(`[AgentHub] WS \u9519\u8BEF: ${e.message}
+`);
       });
     });
     this.heartbeatTimer = setInterval(() => {
@@ -37220,7 +37844,7 @@ var AgentHub = class {
       message: `${agentId} \u5DF2\u5B8C\u6210 ${taskId}\uFF0C\u7B49\u5F85\u5BA1\u6838`
     });
   }
-  // ── 注册任务（不派发，仅登记） ──
+  // ── 注册任务（自动派发给空闲 Agent） ──
   registerTask(taskId, title) {
     if (!this.tasks.has(taskId)) {
       this.tasks.set(taskId, { status: "unassigned" });
@@ -37230,6 +37854,17 @@ var AgentHub = class {
       t.title = title;
     }
     console.log(`[AgentHub] \u4EFB\u52A1\u6CE8\u518C: ${taskId} "${title || taskId}"`);
+    this.broadcast({ type: "task:announced", taskId, title: title || taskId });
+    const idleAgents = [...this.agents.entries()].filter(([, a]) => a.status === "idle" && !a.agentId.startsWith("dashboard"));
+    if (idleAgents.length === 0) {
+      console.log(`[AgentHub] \u6CA1\u6709\u7A7A\u95F2 Agent\uFF0C\u4EFB\u52A1 ${taskId} \u7B49\u5F85\u624B\u52A8 spawn`);
+      return;
+    }
+    const match = idleAgents.find(([, a]) => a.capabilities.includes(taskId)) || idleAgents[0];
+    if (match) {
+      console.log(`[AgentHub] \u81EA\u52A8\u6D3E\u53D1 ${taskId} \u2192 ${match[1].name} (${match[0]})`);
+      this.dispatchTaskTo(taskId, match[0]);
+    }
   }
   // ── 派发任务 ──
   dispatchTaskTo(taskId, agentId) {
@@ -37423,8 +38058,8 @@ var AgentHub = class {
   }
 };
 var agentHub = new AgentHub();
-function startAgentHub(port, host = "0.0.0.0", version2 = "0.0.0") {
-  agentHub.start(port, host, version2);
+function startAgentHub(port, host = "0.0.0.0", version2 = "0.0.0", token = "") {
+  agentHub.start(port, host, version2, token);
 }
 
 // src/tools/agent-hub.ts
@@ -38098,16 +38733,29 @@ function registerAllTools(server, auth, readOnly) {
 }
 async function startHttp(server, version2, auth, readOnly, skipped) {
   const port = parseInt(process.env.PORT || "3000", 10);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    process.stderr.write(`[hvip] \u274C \u65E0\u6548\u7AEF\u53E3: ${process.env.PORT}\uFF0C\u4F7F\u7528\u9ED8\u8BA4 3000
+`);
+  }
   const host = process.env.HOST || "127.0.0.1";
+  const token = process.env.MCP_AUTH_TOKEN || "";
   const transport = new StreamableHTTPServerTransport({
     sessionIdGenerator: void 0
     // stateless
   });
   await server.connect(transport);
   const httpServer = (0, import_node_http.createServer)(async (req, res) => {
+    if (token && req.url !== "/health") {
+      const provided = req.headers["authorization"]?.replace(/^Bearer\s+/i, "") || "";
+      if (provided !== token) {
+        res.writeHead(401, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Unauthorized \u2014 \u8BF7\u5728 Authorization \u5934\u643A\u5E26\u6709\u6548 token" }));
+        return;
+      }
+    }
     res.setHeader("Access-Control-Allow-Origin", `http://${host}:${port}`);
     res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id, Authorization");
     if (req.method === "OPTIONS") {
       res.writeHead(204);
       res.end();
@@ -38214,12 +38862,13 @@ async function startStdio(server, version2, auth, readOnly, skipped, skipLog) {
 `);
   }
   const wsHost = process.env.WS_BIND_HOST || "127.0.0.1";
-  startAgentHub(parseInt(process.env.WS_AGENT_PORT || "9321"), wsHost, version2);
+  const wsToken = process.env.HUB_AUTH_TOKEN || "";
+  startAgentHub(parseInt(process.env.WS_AGENT_PORT || "9321"), wsHost, version2, wsToken);
   const transport = new StdioServerTransport();
   await server.connect(transport);
 }
 async function main() {
-  const VERSION = "0.3.1";
+  const VERSION = "0.3.2";
   const argv = process.argv.slice(2);
   if (argv.includes("--help") || argv.includes("-h")) printHelpAndExit(VERSION);
   if (argv.includes("--version") || argv.includes("-v")) {