Roger Ye
9c0712b493
Exposes the agent to OpenBB Workspace over the openbb-ai SDK, behind an optional `openbb` extra. Security repairs on top of the contribution: - pro.openbb.co is no longer a default CORS origin. CORS is installed globally with credentials and keyless loopback mode admits safe GETs by peer address, so that default would have let scripts on the OpenBB origin read /sessions and /runs. Extra origins are now an additive opt-in (VIBE_TRADING_EXTRA_CORS_ORIGINS) declared in the typed config layer; the loopback-only defaults are unchanged. - POST /v1/query carries require_auth. It reaches the full agent registry, which auto-registers the order tools, so an unauthenticated caller could have driven actions inside an already-active mandate. - The three unadvertised LLM routes (chat title, dashboard title, prompt enhancement) are removed rather than authenticated: they were absent from the manifest and duplicated the existing authenticated title path. - Conversation identity no longer hashes the first message. Any two conversations opening with the same text mapped onto one persistent session, leaking history between them, and later requests' full history was ignored. openbb-ai 2.1.0 exposes no conversation id, and the SDK contract is stateless with full history per request, so each request now runs an ephemeral session replaying the supplied history. - The SDK is wired into the dev install and CI, with an explicit import check. It previously landed only in agent/requirements.txt while CI installs the extras, so every bridge test silently skipped and the feature could look green while being uninstallable. - Workspace context is now ingested under an 8k budget instead of ignored, and widget-dashboard-search is advertised as false: widget groups carry metadata only, and the value round-trip is not implemented, so the model is told values are absent rather than left to invent them. The contributor's requirements-lock.txt rewrite was dropped (stale Python-3.12 regen with unrelated downgrades; the runtime targets 3.11). Note for operators: a browser POST from a remote Workspace origin is still refused by the pre-existing cross-site guard, independently of CORS and of a valid token. Self-hosted same-origin Workspace and server-side callers work; that boundary is pinned by a test.
117 lines
3.6 KiB
YAML
117 lines
3.6 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
|
with:
|
|
python-version: "3.11"
|
|
cache: pip
|
|
|
|
- name: Verify hash-locked dependencies
|
|
run: >-
|
|
pip install
|
|
--dry-run
|
|
--ignore-installed
|
|
--require-hashes
|
|
-r requirements-lock.txt
|
|
|
|
- name: Install dependencies
|
|
# `openbb` is included so agent/tests/test_openbb_bridge actually runs:
|
|
# those tests importorskip on openbb_ai, so without the extra the whole
|
|
# OpenBB Workspace bridge would report green while never being exercised.
|
|
run: pip install -e ".[dev,openbb]"
|
|
|
|
- name: Verify optional extras under test are importable
|
|
# Fails loudly if the openbb extra stops resolving, instead of letting
|
|
# the bridge suite silently degrade to skips.
|
|
run: python -c "import openbb_ai, importlib.metadata as m; print('openbb-ai', m.version('openbb-ai'))"
|
|
|
|
- name: Repository safety gates
|
|
run: bash tools/ci_grep_gates.sh
|
|
|
|
- name: Test environment variable gate
|
|
run: pytest tools/test_ci_env_var_gate.py -q
|
|
|
|
- name: Syntax check
|
|
run: |
|
|
cd agent
|
|
python -m compileall -q cli
|
|
python -m py_compile api_server.py
|
|
python -m py_compile mcp_server.py
|
|
python -m py_compile src/agent/loop.py
|
|
python -m py_compile src/tools/__init__.py
|
|
python -m py_compile backtest/runner.py
|
|
|
|
- name: Run tests
|
|
# test_e2e_harness_v2.py is gated by VIBE_TRADING_RUN_LIVE_E2E
|
|
# (real-LLM only); list --ignore here so CI's intent is explicit and
|
|
# the suite never silently switches state on env presence.
|
|
run: pytest --ignore=agent/tests/e2e_backtest --ignore=agent/tests/test_e2e_harness_v2.py --cov=agent --cov-report=term-missing --cov-report=xml --tb=short -q
|
|
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: "22"
|
|
cache: npm
|
|
cache-dependency-path: frontend/package-lock.json
|
|
|
|
- name: Frontend build
|
|
run: |
|
|
cd frontend
|
|
npm ci
|
|
npm run build
|
|
|
|
- name: Frontend tests
|
|
run: |
|
|
cd frontend
|
|
npx vitest run --reporter=verbose
|
|
|
|
windows-background:
|
|
name: ${{ matrix.name }} / Python 3.14 background lifecycle
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 10
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- name: Windows 11 ARM64
|
|
runner: windows-11-arm
|
|
architecture: arm64
|
|
- name: Windows Server 2025 x64
|
|
runner: windows-2025
|
|
architecture: x64
|
|
|
|
steps:
|
|
# actions/checkout v7.0.1
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
|
|
|
|
# actions/setup-python v7.0.0
|
|
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
|
|
with:
|
|
python-version: "3.14"
|
|
architecture: ${{ matrix.architecture }}
|
|
cache: pip
|
|
|
|
- name: Install focused test dependencies
|
|
run: python -m pip install pytest pydantic pyyaml python-dotenv
|
|
|
|
- name: Run Windows background safety regressions
|
|
env:
|
|
PYTHONPATH: agent
|
|
run: >-
|
|
python -m pytest
|
|
agent/tests/test_background_tools.py
|
|
agent/tests/test_bash_tool.py
|
|
-q
|