mirror of https://github.com/0xrsydn/idx-cli.git synced 2026-11-07 01:35:36 +00:00

0xrsydn ca4d3d09c2 feat(stockbit): one browser sign-in in idx-core for the CLI and MCP

`stockbit::signin` is now the single sign-in flow. `idx stockbit login`
waits on it in the foreground; the `stockbit_login` MCP tool runs it on a
thread and `stockbit_status` reports `sign_in.state`, so an agent knows when
to stop polling. Auto uses a browser unless the shell is over SSH or has no
display, and falls back to the local page only when the browser cannot start.

The browser way opens Stockbit's sign-in page in a profile only idx uses and
reads the session cookie over DevTools. What a real sign-in showed:

- The cookie is host-only on stockbit.com, so deleting by the assumed
  .stockbit.com removed nothing and left live tokens in the profile. It is
  now deleted by its own domain and path, with every other tab closed first,
  and read back to confirm.
- A signed-out page writes the cookie without tokens; it no longer counts.
- A profile belongs to one browser, so it records the executable that made it.
- On macOS the config directory depends on XDG_CONFIG_HOME, so a shell and an
  app started from the Dock disagreed; both default locations are now checked.
- A thread does not outlive main, so idx-mcp closes a waiting browser when
  stdin closes or on SIGTERM or Ctrl-C.

Progress goes to stderr, which keeps `-o json` to one document on stdout.

Google refused its own sign-in in this window on 2026-10-31, most likely over
the debugging flag; password sign-in works, and the docs and roadmap say so.

Claude-Session: https://claude.ai/code/session_01RqPPVaoFxLToGAXXBEoCtH

2026-10-31 23:58:21 +07:00

3.8 KiB

Raw Blame History

Roadmap

Open work only. Shipped behavior is described in README.md and docs/; history lives in git.

Stocks

market summary: market breadth and an index overview (index levels alone are already stocks intraday ^JKSE and --provider stockbit stocks quote IHSG)
market movers: top gainers, losers, and volume
market sectors: sector performance overview
screen query "<EXPR>": filter stocks by expression
screen presets / screen run <PRESET>: built-in screener presets (graduate screen out of stocks only if these grow into a richer workflow)
Multi-period financial statements (today financials is single-period)
Order book depth without a login: no free source exists (IDX sells delayed depth to vendors); stocks orderbook needs the user's Stockbit login.
Stockbit login follow-ups: intraday OHLCV from the session's 1d chart; observing the session API's open-market state name (assumed STATE_NAME_MARKET_OPEN; STATE_NAME_MARKET_CLOSED seen 2026-10-29); an opt-in daily refresh so a session outlives the refresh token's week, once it is known whether Stockbit caps a session's total life; and the sign-in response (/login/v6/*, read over DevTools' Fetch) as a second signal beside the credentialStorage cookie, should Stockbit rename or move it.
Google sign-in in idx's browser window: Google refused it on 2026-10-31, most likely over --remote-debugging-port. First confirm by trying Google in a plain window on a throwaway profile; if that works, sign in with no debugging flag and reopen the profile with it, on a blank page, to read the cookie.
Observe Stockbit's market_hour.status in the pre-open (08:45-09:00) and the closing auction (15:50-16:00) before --watch or alerts build on it; open, break and close are known, and the bid/offer gate hides the book for anything but open.
Bandarmology follow-ups: a daily series (per-session readings and the cumulative top-N net) and a price-move phase (quiet accumulation, markup), calibration of the top_concentration_v1 thresholds across more sessions, and a market-wide foreign flow screen from one IDX trading summary
News beyond MSN in news / get_company (docs/IDX_NEWS.md): Google News RSS per ticker, and IDX disclosures and exchange news through a maintainer-published feed

Workflow

watchlist: named symbol sets usable by other commands
alerts: price alerts with a daemon
CSV/TSV output
Additional providers (Alpha Vantage, Twelve Data); IDX's own site serves only stocks flow --source idx today

Agent integration

JSON Schema export for command output
Composite analyze command (quote, fundamentals, ownership, sentiment)

Known limits

stocks broker and stocks bandar show only IPOT's top 10 buyers and sellers, ranked by gross lots, with figures of a million and more rounded to one decimal.
stocks flow --source idx depends on IDX's Cloudflare passing a curl-impersonate profile (only curl_safari184 in October 2026) and on the network; the default IPOT source rounds to one decimal.
Stockbit's terms call its data delayed at least 10 minutes and for personal, non-commercial use (on 2026-10-23 the last trade was within a minute of the clock); its CDN refuses some user agents with a 403 (UPSTREAMBLOCKED). The public page's best bid/offer sizes are not shown yet; they are shares (equal to the session API's book on 2026-10-23).
Yahoo can return 429 from datacenter IPs; requests retry with backoff but can still fail.
stocks technical reports the SMA200 trend as unavailable when fewer than 200 daily candles are returned.
MSN's low-pe screen returns no priced stocks (PARSEERROR; still so on 2026-10-23, upstream; other filters work).
MSN history for IDX is price-only (1mo, 3mo, 1y); Yahoo stays the default OHLCV source.