mirror of
https://github.com/0xrsydn/idx-cli.git
synced 2026-11-07 09:45:36 +00:00
0xrsydn
ca4d3d09c2
`stockbit::signin` is now the single sign-in flow. `idx stockbit login` waits on it in the foreground; the `stockbit_login` MCP tool runs it on a thread and `stockbit_status` reports `sign_in.state`, so an agent knows when to stop polling. Auto uses a browser unless the shell is over SSH or has no display, and falls back to the local page only when the browser cannot start. The browser way opens Stockbit's sign-in page in a profile only idx uses and reads the session cookie over DevTools. What a real sign-in showed: - The cookie is host-only on stockbit.com, so deleting by the assumed .stockbit.com removed nothing and left live tokens in the profile. It is now deleted by its own domain and path, with every other tab closed first, and read back to confirm. - A signed-out page writes the cookie without tokens; it no longer counts. - A profile belongs to one browser, so it records the executable that made it. - On macOS the config directory depends on XDG_CONFIG_HOME, so a shell and an app started from the Dock disagreed; both default locations are now checked. - A thread does not outlive main, so idx-mcp closes a waiting browser when stdin closes or on SIGTERM or Ctrl-C. Progress goes to stderr, which keeps `-o json` to one document on stdout. Google refused its own sign-in in this window on 2026-10-31, most likely over the debugging flag; password sign-in works, and the docs and roadmap say so. Claude-Session: https://claude.ai/code/session_01RqPPVaoFxLToGAXXBEoCtH
71 lines
3.8 KiB
Markdown
71 lines
3.8 KiB
Markdown
# Roadmap
|
|
|
|
Open work only. Shipped behavior is described in `README.md` and `docs/`;
|
|
history lives in git.
|
|
|
|
## Stocks
|
|
- `market summary`: market breadth and an index overview (index levels alone
|
|
are already `stocks intraday ^JKSE` and `--provider stockbit stocks quote IHSG`)
|
|
- `market movers`: top gainers, losers, and volume
|
|
- `market sectors`: sector performance overview
|
|
- `screen query "<EXPR>"`: filter stocks by expression
|
|
- `screen presets` / `screen run <PRESET>`: built-in screener presets
|
|
(graduate `screen` out of `stocks` only if these grow into a richer workflow)
|
|
- Multi-period financial statements (today `financials` is single-period)
|
|
- Order book depth without a login: no free source exists (IDX sells delayed
|
|
depth to vendors); `stocks orderbook` needs the user's Stockbit login.
|
|
- Stockbit login follow-ups: intraday OHLCV from the session's `1d` chart;
|
|
observing the session API's open-market state name (assumed
|
|
`STATE_NAME_MARKET_OPEN`; `STATE_NAME_MARKET_CLOSED` seen 2026-10-29); an
|
|
opt-in daily refresh so a session outlives the refresh token's week, once
|
|
it is known whether Stockbit caps a session's total life; and the sign-in
|
|
response (`/login/v6/*`, read over DevTools' `Fetch`) as a second signal
|
|
beside the `credentialStorage` cookie, should Stockbit rename or move it.
|
|
- Google sign-in in idx's browser window: Google refused it on 2026-10-31,
|
|
most likely over `--remote-debugging-port`. First confirm by trying Google
|
|
in a plain window on a throwaway profile; if that works, sign in with no
|
|
debugging flag and reopen the profile with it, on a blank page, to read the
|
|
cookie.
|
|
- Observe Stockbit's `market_hour.status` in the pre-open (08:45-09:00) and
|
|
the closing auction (15:50-16:00) before `--watch` or alerts build on it;
|
|
`open`, `break` and `close` are known, and the bid/offer gate hides the book
|
|
for anything but `open`.
|
|
- Bandarmology follow-ups: a daily series (per-session readings and the
|
|
cumulative top-N net) and a price-move phase (quiet accumulation, markup),
|
|
calibration of the `top_concentration_v1` thresholds across more sessions,
|
|
and a market-wide foreign flow screen from one IDX trading summary
|
|
- News beyond MSN in `news` / `get_company` (`docs/IDX_NEWS.md`): Google News
|
|
RSS per ticker, and IDX disclosures and exchange news through a
|
|
maintainer-published feed
|
|
|
|
## Workflow
|
|
- `watchlist`: named symbol sets usable by other commands
|
|
- `alerts`: price alerts with a daemon
|
|
- CSV/TSV output
|
|
- Additional providers (Alpha Vantage, Twelve Data); IDX's own site serves
|
|
only `stocks flow --source idx` today
|
|
|
|
## Agent integration
|
|
- JSON Schema export for command output
|
|
- Composite `analyze` command (quote, fundamentals, ownership, sentiment)
|
|
|
|
## Known limits
|
|
- `stocks broker` and `stocks bandar` show only IPOT's top 10 buyers and
|
|
sellers, ranked by gross lots, with figures of a million and more rounded
|
|
to one decimal.
|
|
- `stocks flow --source idx` depends on IDX's Cloudflare passing a
|
|
curl-impersonate profile (only `curl_safari184` in October 2026) and on the
|
|
network; the default IPOT source rounds to one decimal.
|
|
- Stockbit's terms call its data delayed at least 10 minutes and for
|
|
personal, non-commercial use (on 2026-10-23 the last trade was within a
|
|
minute of the clock); its CDN refuses some user agents with a 403
|
|
(`UPSTREAMBLOCKED`). The public page's best bid/offer sizes are not shown
|
|
yet; they are shares (equal to the session API's book on 2026-10-23).
|
|
- Yahoo can return `429` from datacenter IPs; requests retry with backoff but
|
|
can still fail.
|
|
- `stocks technical` reports the SMA200 trend as unavailable when fewer than
|
|
200 daily candles are returned.
|
|
- MSN's `low-pe` screen returns no priced stocks (`PARSEERROR`; still so on
|
|
2026-10-23, upstream; other filters work).
|
|
- MSN history for IDX is price-only (`1mo`, `3mo`, `1y`); Yahoo stays the
|
|
default OHLCV source.
|