toobit-trade-cli 1.0.7 → 1.0.8

package/dist/index.js

@@ -168,7 +168,7 @@ var TOOBIT_CODE_BEHAVIORS = {
   "-2014": { retry: false, suggestion: "Bad API key format." },
   "-2015": { retry: false, suggestion: "Invalid API key, IP, or permission." },
   "-2017": { retry: false, suggestion: "API key expired. Generate a new one." },
-  "-1130": { retry: false, suggestion: "Invalid symbol format. Futures endpoints require BTC-SWAP-USDT format; spot endpoints use BTCUSDT." },
+  "-1130": { retry: false, suggestion: "A parameter value is invalid. Check the error message for the specific parameter." },
   "-1107": { retry: false, suggestion: "API key is missing or malformed. Check X-BB-APIKEY header." }
 };
 function isDefined(value) {
@@ -305,10 +305,22 @@ var ToobitRestClient = class {
       if (codeStr === "-1003") {
         throw new RateLimitError(message, "Too many requests. Back off.", endpoint);
       }
+      let suggestion = behavior?.suggestion;
+      if (codeStr === "-1130" && responseMsg) {
+        if (/symbol/i.test(responseMsg)) {
+          const isFuturesPath = /futures|fundingRate|openInterest|markPrice|contract|longShort|insurance|riskLimit/i.test(config.path);
+          suggestion = isFuturesPath ? "Invalid symbol format. Futures endpoints require BTC-SWAP-USDT format; spot endpoints use BTCUSDT." : "Invalid symbol format. Spot endpoints require symbol format like BTCUSDT.";
+        } else {
+          const paramMatch = responseMsg.match(/paramter\s+'([^']+)'|parameter\s+'([^']+)'/i);
+          if (paramMatch) {
+            suggestion = `Parameter '${paramMatch[1] || paramMatch[2]}' has an invalid value. Check the allowed range and format.`;
+          }
+        }
+      }
       throw new ToobitApiError(message, {
         code: codeStr,
         endpoint,
-        suggestion: behavior?.suggestion
+        suggestion
       });
     }
     if (!response.ok) {
@@ -523,7 +535,7 @@ function registerAccountTools() {
           addressExt: { type: "string", description: "Memo/tag if required" },
           chainType: { type: "string" },
           withdrawQuantity: { type: "string" },
-          clientOrderId: { type: "string" }
+          clientOrderId: { type: "string", description: "Only [a-zA-Z0-9_\\-.]  allowed; other characters are stripped." }
         },
         required: ["tokenId", "address", "chainType", "withdrawQuantity"]
       },
@@ -537,7 +549,7 @@ function registerAccountTools() {
             addressExt: readString(args, "addressExt"),
             chainType: requireString(args, "chainType"),
             withdrawQuantity: requireString(args, "withdrawQuantity"),
-            clientOrderId: readString(args, "clientOrderId")
+            clientOrderId: readString(args, "clientOrderId")?.replace(/[^a-zA-Z0-9_\-\.]/g, "")
           }),
           privateRateLimit("account_withdraw", 5)
         );
@@ -651,8 +663,15 @@ function registerAuditTools() {
       handler: async (rawArgs) => {
         const args = asRecord(rawArgs);
         const dateStr = readString(args, "date") ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+        if (!/^\d{4}-\d{2}-\d{2}$/.test(dateStr)) {
+          throw new Error('Invalid date format. Must be YYYY-MM-DD (e.g. "2026-03-15").');
+        }
         const limit = readNumber(args, "limit") ?? 50;
-        const logPath = path.join(os.homedir(), ".toobit", "logs", `trade-${dateStr}.log`);
+        const logDir = path.join(os.homedir(), ".toobit", "logs");
+        const logPath = path.join(logDir, `trade-${dateStr}.log`);
+        if (!logPath.startsWith(logDir)) {
+          throw new Error("Invalid date value.");
+        }
         if (!fs.existsSync(logPath)) {
           return { endpoint: "local", requestTime: (/* @__PURE__ */ new Date()).toISOString(), data: [] };
         }
@@ -702,6 +721,10 @@ function registerFuturesTools() {
         if (orderType === "MARKET") {
           orderType = "LIMIT";
           priceType = "MARKET";
+        } else if (orderType === "LIMIT" && priceType === "MARKET") {
+          throw new Error(
+            'Conflicting parameters: orderType="LIMIT" with priceType="MARKET" would execute at market price, ignoring your limit price. Use orderType="MARKET" for market orders, or remove priceType for limit orders.'
+          );
         }
         const rawClientId = readString(args, "newClientOrderId");
         const clientId = rawClientId ? rawClientId.replace(/[^a-zA-Z0-9_\-\.]/g, "") : `mcp_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toobit-trade-cli",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "type": "module",
   "bin": {
     "toobit": "dist/index.js"