feat(longbridge): complete 602315 bypass + CLI helper + stock_t脚本
新增: - references/cli-unicode-table-parsing.md - CLI 表格 ┃ vs │ Unicode 解析 - references/cron-wrapper-multi-token-pitfall.md - cron script 字段不支持空格 - references/generic-stock-query.md - 通用 stock_t.py 持仓查询 - references/longportapp-cn-endpoints.md - Python SDK 走 longportapp.cn vs CLI 走 longbridge.com - references/sdk-vs-cli-domain-routing.md - SDK/CLI 域名路由差异 - scripts/longbridge_cli_helper.py - SDK 兼容层, 内部走 CLI (绕 602315) - scripts/stock_t.py - 通用持仓查询脚本 (不限定股票) 修改: - longbridge-cli/SKILL.md + references/longbridge-602315-bypass.md - longbridge-python-sdk/SKILL.md: 增 cn endpoint 说明 - intraday-trading/SKILL.md 关键发现: 1. Python SDK 用 openapi.longportapp.cn (阿里云深圳), CLI 用 openapi.longbridge.com (AWS 香港) 2. 两个不同域名, 不同 endpoint, 都需 LONGBRIDGE_HTTP_URL=https://openapi.longbridge.com 强制覆盖 3. CLI 默认不读 HTTP_PROXY env, 必须用 proxychains4 OS 层拦截 4. 完整链路: LONGBRIDGE_HTTP_URL=.com + LONGBRIDGE_REGION=ap + proxychains4 + Clash 香港节点 5. Yahoo Finance 备用数据源 (CLI 拿不到 K线) 6. CLI 表格用 ┃ (header) 和 │ (data) 两种 Unicode 字符, parser 要兼容 订单实测: - RGTI.US 1股@15.40: 下单 1259694819492519936, 撤单成功 - 9988.HK 200股@112.70: Rejected (余额或限额) - 1810.HK 1200股@25.98: Rejected (同上) Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Claude
@@ -0,0 +1,103 @@
|
||||
# Python SDK Endpoint Confusion: `longportapp.cn` vs `longbridge.cn`
|
||||
|
||||
**Last verified 2026-07-09**: this reference is **partially correct on the diagnosis, wrong on the fix**.
|
||||
|
||||
## The trap (correct as written)
|
||||
|
||||
LongPort has **two parallel sets of endpoints** and the Python SDK uses a different one than the CLI:
|
||||
|
||||
| Tool | Endpoints used | Default geo-block host |
|
||||
|------|---------------|------------------------|
|
||||
| `longbridge` CLI | `openapi.longbridge.com` / `openapi.longbridge.cn` | Aliyun Shenzhen (`47.106.x.x`, `120.77.x.x`) |
|
||||
| `longport` Python SDK | `openapi.longportapp.cn` + `openapi-quote.longportapp.cn` + `openapi-trade.longportapp.cn` | Aliyun Shenzhen + Shanghai (`139.196.x.x`) |
|
||||
|
||||
Both endpoint families resolve to **CN-hosted** IPs by default. Both return `602315` from a CN egress IP.
|
||||
|
||||
## Why `LONGBRIDGE_REGION=ap` doesn't fully fix Python SDK (correct as written)
|
||||
|
||||
Confirmed 2026-07-09: setting `os.environ['LONGBRIDGE_REGION'] = 'ap'` in the script and tracing the proxychains traffic shows requests still hit `openapi.longportapp.cn`. The Python wheel appears to either ignore the env var, hardcode the domain, or have a bug where the override doesn't propagate. CLI honors it; SDK does not.
|
||||
|
||||
## The "hosts rewrite" fix from earlier sessions — **DOES NOT WORK**
|
||||
|
||||
Earlier versions of this reference and the `longbridge_hosts_fix2.sh` script recommended adding AWS HK IPs (`18.166.191.191`, `18.163.160.163`) as hosts overrides for the three `longportapp.cn` domains. **This was tested on 2026-07-09 and fails**:
|
||||
|
||||
```bash
|
||||
proxychains4 -f ~/.proxychains/proxychains.conf \
|
||||
curl -s --max-time 10 -o /dev/null -w "%{http_code}\n" https://18.166.191.191/
|
||||
# Returns: 000 (OpenSSL SSL_connect: SSL_ERROR_SYSCALL)
|
||||
```
|
||||
|
||||
The TCP connection opens but TLS handshake fails. The same result was reproduced with every Clash node tested:
|
||||
- `🇭🇰 [Lv2] 香港 01/02/03` — all fail AWS HK TLS
|
||||
- `🇺🇸 [Lv2] 美国 01/02/03` — all fail AWS HK TLS
|
||||
- `🇨🇳 [Lv2] 台湾 01/02/03` — all fail AWS HK TLS
|
||||
|
||||
**AWS is blocking egress from these proxy ASNs.** Even with the hosts override, the TLS handshake to `18.166.191.191:443` fails, so the Python SDK's API call still errors with `client error (Connect)`. The 602.315 error then surfaces from the gateway as a fallback when the SDK gives up on the `*.com` path and tries `*.cn` directly.
|
||||
|
||||
**The hosts changes were reverted.** `/etc/hosts` is back to default (only `localhost` / `openclaw-Virtual-Machine` entries). `longbridge.cn` rewrite was kept since CLI orders still need it, but it is not the bypass it's described as.
|
||||
|
||||
## What actually works (as of 2026-07-09)
|
||||
|
||||
| Path | Recipe | Status |
|
||||
|---|---|---|
|
||||
| Manual CLI order | `LONGBRIDGE_REGION=ap LONGBRIDGE_TRADE_ENABLED=true proxychains4 -f ~/.proxychains/proxychains.conf ~/.local/bin/longbridge --profile lb_real <order>` | ✅ Works (order `1259547163696824320`) |
|
||||
| Cron-driven Python SDK order | Same three pieces + `os.environ['LONGBRIDGE_REGION']='ap'` in script + bash wrapper for proxychains4 | ❌ Still 602315 (verified 2026-07-09) |
|
||||
| Phone app | LongPort app on phone with HK network egress | ✅ Confirmed by user |
|
||||
| Auto via WireGuard | Not viable (Ubuntu shutdown unreliable, user banned) | ❌ |
|
||||
|
||||
## How to detect this trap is biting you (correct detection)
|
||||
|
||||
Run any cron-scheduled Python script that touches longport, then `tail -10 ~/.hermes/cron/output/<job_id>/<latest>.md`:
|
||||
|
||||
```bash
|
||||
ls -t ~/.hermes/cron/output/<job_id>/ | head -1 | xargs -I {} tail -10 ~/.hermes/cron/output/<job_id>/{}
|
||||
```
|
||||
|
||||
Look for:
|
||||
|
||||
```
|
||||
[proxychains] Strict chain ... 127.0.0.1:7890 ... openapi.longportapp.cn:443 ... OK
|
||||
❌ OpenApiException: ... 602315 ... Mainland China regulatory requirements
|
||||
```
|
||||
|
||||
→ `longportapp.cn` route → 602315. Currently the only mitigation that works for this is to **disable auto-execution in the script** and have it push the signal to QQ for manual confirmation.
|
||||
|
||||
If proxychains logs show `openapi.longportapp.com:443 ... OK` (HTTP 200, not SSL fail), the hosts rewrite is working but you're still likely to get 602315 because the server-side geo-check is based on the source IP, not the domain.
|
||||
|
||||
## Diagnostic one-liner
|
||||
|
||||
```bash
|
||||
proxychains4 -f ~/.proxychains/proxychains.conf \
|
||||
python3 -c "
|
||||
import os; os.environ['LONGBRIDGE_REGION']='ap'
|
||||
for k in ['LONGPORT_APP_KEY','LONGPORT_APP_SECRET','LONGPORT_ACCESS_TOKEN']:
|
||||
os.environ[k] = next(l for l in open('/home/openclaw/.bashrc').read().splitlines() if l.startswith(f'export {k}')).split('=',1)[1].strip()
|
||||
from longport import openapi
|
||||
try:
|
||||
print(openapi.QuoteContext(config=openapi.Config.from_env()).quote(['RGTI.US'])[0].last_done)
|
||||
except Exception as e:
|
||||
print(f'ERR: {e}')
|
||||
"
|
||||
```
|
||||
|
||||
If this returns `ERR: ... 602315 ...` or `ERR: ... client error (Connect)`, the bypass is not working — fall back to phone app or manual CLI order.
|
||||
|
||||
## What to recommend to the user when this fails
|
||||
|
||||
1. **Manual CLI order** (three-piece recipe) — works today.
|
||||
2. **Phone LongPort app** with HK proxy — works today.
|
||||
3. **Disable auto-execution in cron scripts** and have them push signals to QQ with "please place this manually" instructions. This is the current recommended default.
|
||||
4. **Do not propose WG** (banned).
|
||||
5. **Do not propose more hosts rewrites** — the AWS IP path is not reachable from the available proxy nodes.
|
||||
|
||||
## Why this stays in skills rather than just memory
|
||||
|
||||
- The trap is non-obvious and re-bites future agents if not in a skill.
|
||||
- The fix requires understanding the server-side IP check (which memory snapshots won't capture cleanly).
|
||||
- The "what works" answer changes as proxy nodes and AWS policies change; this file should be re-verified when the network setup changes.
|
||||
|
||||
## History
|
||||
|
||||
- 2026-07-08: hosts rewrite to `18.166.191.191` suggested as the fix.
|
||||
- 2026-07-09: tested, failed (SSL handshake to AWS HK IP fails from every Clash node). Hosts changes reverted (cn domain left in place for CLI, but `longportapp.cn` rewrite removed).
|
||||
- 2026-07-09: confirmed CLI recipe works (order `1259547163696824320`); confirmed Python SDK recipe does not work in cron path. This reference updated to reflect the corrected state.
|
||||
@@ -0,0 +1,76 @@
|
||||
---
|
||||
note: 2026-07-09 session - SDK vs CLI domain routing difference
|
||||
---
|
||||
|
||||
# SDK vs CLI: 域名路由差异(关键!)
|
||||
|
||||
**问题**: Python SDK 和 CLI 走**不同的 endpoint 域名**:
|
||||
- **CLI** 走 `openapi.longbridge.com` (AWS HK/全球,海外域)
|
||||
- **Python SDK** 走 `openapi.longportapp.cn` (Aliyun 深圳/上海,国内域)
|
||||
|
||||
**影响**: 602315 mainland CN geo-block 触发条件:
|
||||
- 通过 CLI 走 .com 海外域 → ✅ 不触发 602315 (走 AWS 海外 IP)
|
||||
- 通过 SDK 走 .cn 国内域 → ❌ 触发 602315 (无论出口 IP 是哪)
|
||||
|
||||
**这就是为什么**:
|
||||
- 单次 CLI 下单能成功(RGTI 15股@15.50, 订单 `1259547163696824320`)
|
||||
- 同样条件下 Python SDK 调 `submit_order` 仍 602315
|
||||
|
||||
# is_cn() 探测机制
|
||||
|
||||
SDK 内置 `is_cn()` 函数判断走 `.cn` 还是 `.com`:
|
||||
1. 优先读 `LONGBRIDGE_REGION` / `LONGPORT_REGION` 环境变量
|
||||
- 设成 `CN` → 走 .cn (国内)
|
||||
- 设成 `ap` / `us` / 任何非 CN → 走 .com (海外)
|
||||
2. 没设环境变量 → HTTP 探测 `https://geotest.lbkrs.com`
|
||||
- 返回 200 → 判定 CN → 走 .cn
|
||||
- 超时/非 200 → 判定非 CN → 走 .com
|
||||
|
||||
**问题**:
|
||||
- 即使设 `LONGBRIDGE_REGION=ap`,SDK 仍然走 `openapi.longportapp.cn` (不知道原因,可能 SDK 没实现完整)
|
||||
- geotest.lbkrs.com 解析到国内 IP,即使设了 env var,探测可能仍命中
|
||||
|
||||
# LONGBRIDGE_HTTP_URL 环境变量
|
||||
|
||||
CLI 读 `LONGBRIDGE_HTTP_URL` 环境变量(SDK 似乎不读)强制覆盖:
|
||||
```bash
|
||||
export LONGBRIDGE_HTTP_URL=https://openapi.longbridge.com
|
||||
```
|
||||
|
||||
实测用这个走 CLI 下单 RGTI 1股@15.40 → 成功 (订单 `1259694819492519936`)。
|
||||
|
||||
# 实际工作流(2026-07-09 验证)
|
||||
|
||||
**能用的下单路径**:
|
||||
```bash
|
||||
LONGBRIDGE_HTTP_URL=https://openapi.longbridge.com \
|
||||
LONGBRIDGE_REGION=ap \
|
||||
LONGBRIDGE_TRADE_ENABLED=true \
|
||||
proxychains4 -f ~/.proxychains/proxychains.conf \
|
||||
~/.local/bin/longbridge --profile lb_real buy <SYMBOL> --qty N --price P -y
|
||||
```
|
||||
|
||||
**不能用的**:
|
||||
- Python SDK `trade_ctx.submit_order()` (任何方式) → 持续 602315
|
||||
- WireGuard (用户禁用,关不全卡死网络)
|
||||
|
||||
# hosts 改 .cn → .com 已弃用
|
||||
|
||||
曾尝试用 `/etc/hosts` 把 `openapi.longportapp.cn` / `openapi.longbridge.cn` 指向 AWS 海外 IP (`18.166.191.191`),**导致**:
|
||||
- AWS 香港 IP 从 Clash 出口 SSL 握手失败 (`SSL_ERROR_SYSCALL`)
|
||||
- 即使换 HK/台湾/美国 节点全部 connect 失败
|
||||
- 而且污染了系统 hosts,需要 SSH 跑 `longbridge_hosts_restore.sh` 回退
|
||||
|
||||
**不再推荐改 hosts**——只设 env var,让 CLI 走真 DNS 解析的 .com 域。
|
||||
|
||||
# auto_execution 现状
|
||||
|
||||
- ✅ CLI 单次手动下单:可行
|
||||
- ❌ cron 跑 Python SDK 自动下单:不可行
|
||||
- ⏸ 监控 cron (`us_intraday_monitor_cron.sh` / `hk_intraday_monitor_cron.sh`):已改为只读监控 + QQ 推送,等用户触发手动下单
|
||||
|
||||
# 相关 references
|
||||
|
||||
- `references/longbridge-602315-bypass.md` - 完整诊断
|
||||
- `references/clash-node-switching.md` - Clash API 切节点
|
||||
- `references/cron-wrapper-multi-token-pitfall.md` - cron wrapper 模式
|
||||
Reference in New Issue
Block a user