diff --git a/.dockerignore b/.dockerignore
index ff1bc3c7..9e39f26f 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -43,8 +43,11 @@ build/
 dist/
 
 # Project docs
+# NOTE: `*` never crosses `/` in Docker ignore matching, so `/*.md` (anchored)
+# excludes only ROOT-level markdown. Nested skill docs (agent/src/skills/**/*.md)
+# and agent/SKILL.md are intentionally NOT excluded — they ship in the image.
 CLAUDE.md
 CONTRIBUTING.md
-*.md
+/*.md
 !README.md
 !LICENSE
diff --git a/Dockerfile b/Dockerfile
index 202cc9b9..1caa50cb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,15 +16,27 @@ FROM python:3.11-slim AS runtime
 
 LABEL org.opencontainers.image.title="Vibe-Trading" \
     org.opencontainers.image.description="Natural-language finance research AI agent with backtesting" \
-    org.opencontainers.image.version="0.1.7" \
+    org.opencontainers.image.version="0.1.10" \
     org.opencontainers.image.source="https://github.com/HKUDS/Vibe-Trading" \
     org.opencontainers.image.licenses="MIT"
 
 WORKDIR /app
 
 # System deps
+#   build-essential — compile any wheels without prebuilt manylinux artifacts.
+#   The rest are weasyprint's runtime native libs (Pango/HarfBuzz/Fontconfig/
+#   Cairo/gdk-pixbuf) per its official Debian install list; without them the
+#   lazy `from weasyprint import HTML` in reporter.py fails and PDF rendering
+#   silently downgrades to HTML-only. fonts-dejavu-core gives non-blank PDFs.
 RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
+    libpango-1.0-0 \
+    libpangoft2-1.0-0 \
+    libharfbuzz0b \
+    libfontconfig1 \
+    libgdk-pixbuf-2.0-0 \
+    libcairo2 \
+    fonts-dejavu-core \
     && rm -rf /var/lib/apt/lists/*
 
 # Python deps (install before copying code for layer caching)
diff --git a/README.md b/README.md
index ce8044b5..cd777c4a 100644
--- a/README.md
+++ b/README.md
@@ -50,8 +50,8 @@
 
 ## 📰 News
 
-- **2026-06-19** 🌍 **Global data layer — 8 new sources + 18 read-only data tools**: The market-data loader registry grows from 10 to 18 sources — four free direct-API additions (**Eastmoney**, **Sina**, **Stooq**, and a direct-HTTP **Yahoo** client) plus four optional key-gated US providers (**Finnhub**, **Alpha Vantage**, **Tiingo**, **FMP**), with the fallback chains re-ordered by IP-ban risk. On top of them sit **18 new read-only data tools** reaching past OHLCV into fundamentals and flow — fund flow, dragon-tiger board, northbound (Stock-Connect) flow, margin trading, block trades, shareholder count, lockup expiry, sector membership, research reports, news, SEC filings (EDGAR + XBRL), financial statements, options chains, institutional holdings, full-market screening, and symbol search — across A-share / US / HK, all exposed over MCP. A consolidated `data-routing` index plus per-source `eastmoney` / `sec-edgar` skills document the layer, which was validated end-to-end with a live LLM-routing + data smoke pass.
-- **2026-06-18** 🔬 **Research Autopilot Phase 1 + a local Data Bridge loader, plus a Discord security notice**: Two new agent tools wire the **Hypothesis Registry → Research Goal → backtest** path end to end — `run_research_autopilot` turns a `hypothesis_id` into a research goal (thesis as objective, backtest-relevant acceptance criteria, next-step hints), and `generate_backtest_config` auto-writes a backtest `config.json` from the hypothesis's universe and data sources, so the agent can go straight from idea → `signal_engine.py` → run (**50 tools** now) ([#260](https://github.com/HKUDS/Vibe-Trading/pull/260), thanks @Robin1987China). A new **`local` data loader** reads OHLCV straight from your own **CSV / Parquet / DuckDB** files: map symbols to files in `~/.vibe-trading/data-bridge/config.yaml` and prefix a symbol with `local:` to route it to your data, with normal fallback-chain support ([#252](https://github.com/HKUDS/Vibe-Trading/pull/252), thanks @Robin1987China). A fast follow-up repaired runtime defects both shipped with — Autopilot never received the host `session_id` (every call errored), `generate_backtest_config` wrote under a run root `safe_run_dir` rejected, and the local loader silently emptied tz-aware inputs on a tz-naive timestamp comparison ([#266](https://github.com/HKUDS/Vibe-Trading/pull/266)). DeepSeek's `DSML`-wrapped tool calls now parse correctly ([#261](https://github.com/HKUDS/Vibe-Trading/issues/261)), the Robinhood OAuth handshake gets a longer init timeout with the MCP `initTimeout` key now documented ([#263](https://github.com/HKUDS/Vibe-Trading/pull/263)), and an identifier-containment hardening wave landed: persistent-memory type validation ([#257](https://github.com/HKUDS/Vibe-Trading/pull/257)), MCP swarm run-id containment ([#258](https://github.com/HKUDS/Vibe-Trading/pull/258)), and a strict `mp_[0-9a-f]{32}` mandate proposal-id format now enforced consistently across the relay, preview, and commit gate ([#256](https://github.com/HKUDS/Vibe-Trading/pull/256), [#264](https://github.com/HKUDS/Vibe-Trading/pull/264)). ⚠️ **Security notice:** the former community invite now resolves to a server we no longer control that runs a fake Collab.Land wallet-"verification" phishing scam — it has been removed from every README and the issue template, and the **only** official Discord is now the HKUDS community server ([discord.gg/6TdQnT5xcF](https://discord.gg/6TdQnT5xcF)). Vibe-Trading will never ask you to "verify" or connect a crypto wallet.
+- **2026-06-19** 🚀 **v0.1.10 — Global data layer**: market-data sources grow 10 → 18 (free **Eastmoney / Sina / Stooq / Yahoo** + key-gated **Finnhub / Alpha Vantage / Tiingo / FMP**, ban-risk fallback) plus **18 read-only data tools** (fund flow, dragon-tiger, northbound, margin, block trades, SEC EDGAR + XBRL, financials, options chains, full-market screening…) across A-share / US / HK, all over MCP. Also bundles everything since 0.1.9 — 10 broker connectors, `alpha compare`, the provider-reliability overhaul, and the opt-in data cache. `pip install -U vibe-trading-ai`
+- **2026-06-18** 🔬 **Research Autopilot Phase 1 + a local Data Bridge loader, + a Discord security notice**: new `run_research_autopilot` + `generate_backtest_config` wire **Hypothesis → Research Goal → backtest** end to end (now **50 tools**), and a **`local`** loader reads OHLCV straight from your own **CSV / Parquet / DuckDB** files ([#260](https://github.com/HKUDS/Vibe-Trading/pull/260), [#252](https://github.com/HKUDS/Vibe-Trading/pull/252), thanks @Robin1987China), alongside DeepSeek `DSML` tool-call parsing and an identifier-containment hardening wave. ⚠️ **Security:** the old community Discord invite now points to a server we don't control running a fake Collab.Land wallet-"verification" phishing scam — removed everywhere; the **only** official Discord is the HKUDS server ([discord.gg/6TdQnT5xcF](https://discord.gg/6TdQnT5xcF)), and we'll never ask you to connect a wallet.
 - **2026-06-17** 🧩 **Install compatibility + Opus/Kimi provider fixes**: Baseline `pip install vibe-trading-ai` no longer pulls the optional `pyharmonics` / `ta` dependency chain; harmonic detection now lives behind `vibe-trading-ai[harmonic]` while the bundled detector remains available ([#250](https://github.com/HKUDS/Vibe-Trading/pull/250), closes [#249](https://github.com/HKUDS/Vibe-Trading/issues/249)). The agent loop also avoids assistant-prefill handoff messages rejected by Opus 4.8+, and Kimi/Moonshot can override the client `User-Agent` with `MOONSHOT_USER_AGENT` ([#248](https://github.com/HKUDS/Vibe-Trading/pull/248), closes [#246](https://github.com/HKUDS/Vibe-Trading/issues/246) and [#204](https://github.com/HKUDS/Vibe-Trading/issues/204)); follow-up tests now directly cover background-result and auto-compact handoff paths ([#251](https://github.com/HKUDS/Vibe-Trading/pull/251)).
 <details>
 <summary>Earlier news</summary>
@@ -1186,21 +1186,25 @@ Want to contribute something bigger? Check the [Roadmap](#-roadmap) above and op
 
 Thanks to everyone who has contributed to Vibe-Trading!
 
-Recent v0.1.9 cycle contributors and credits:
+Recent v0.1.10 cycle contributors and credits:
 
-- @toanalien — session JSONL crash-hardening (#147), graceful agent-loop exit at the iteration budget (#148), pre-flight validation for LLM-generated signal engines (#149), and cross-browser Full Report links (#150)
-- @ai7eam-dev — cross-market correlation timestamp alignment (#158) and the session running-status indicator + swarm retry (#159 → #160)
-- @shadowinlife — remote MCP servers over SSE/HTTP (#125) and operator-configured external MCP tools in swarm workers (#142)
-- @DoubleSky123 — configurable SSE idle timeout (#157)
-- @ArthurXi — IME Enter submission handling in the Web composer (#146)
-- @omcdecor-cyber — swarm DAG gating when an upstream task fails (#145)
-- @Soli22de — strict alpha-bench mode with a mandatory random control (#143)
-- @ruok808 — proxy-env support in the CCXT loader (#126)
-- @faizack — remote Ollama base-URL normalization (#129)
-- @fightZy — agent session history loading fix (#136)
-- @lcwSeven — short universe names in the alpha list endpoint (#137)
-- @Teerapat-Vatpitak — resolved .env-source logging (#124)
-- @warren618 / Haozhe Wu — connector-first broker profiles, the Robinhood Agentic Trading channel, Research Goal runtime, swarm reconcile + retry_run, the agent/cli refactor, the mootdx loader, and release integration
+- @Hinotoi-agent — a security-hardening wave: local-shutdown auth (#241), loopback-host rebinding rejection (#242), agent shell-tool opt-in (#243), settings-write auth (#245), mandate proposal-id containment (#256), persistent-memory type validation (#257), and MCP swarm run-id containment (#258)
+- @mvanhorn — the opt-in local data cache (#177), Gemini thoughtSignature round-trip over OpenAI-compat tool calls (#176), the custom data loader guide (#194), and the glm/zhipu provider alias + model-name inference (#247)
+- @gyx09212214-prog — loader robustness for malformed crypto/RSSHub timeout env vars (#227, #240), requested yfinance end-date inclusion (#226), strict run-card JSON for non-finite metrics (#238), and ddgs retry-fallback coverage (#239)
+- @BillDin — swarm agent status in the chat UI (#188), explicit preset-name handling (#189), the loader-backed market-data tool for swarm workers (#199), and preset-context continuations (#200)
+- @Robin1987China — the Research Autopilot goal-hypothesis bridge (#260), the local CSV/Parquet/DuckDB data loader (#252), and an assistant-prefill fix + configurable Kimi User-Agent (#248)
+- @LemonCANDY42 — the read-only runtime status dashboard (#210), persisted AgentLoop usage artifacts (#223), and opt-in Run Detail chart payloads (#225)
+- @zwrong — the trace.jsonl overhaul with zero truncation + offload (#206) and session-id on exit + `resume <session-id>` (#218)
+- @forge-builder — the AI contributor guide (#173) and the OpenClaw MCP research-only smoke-test docs (#165)
+- @skloxo — Chinese (zh-CN) frontend localization (adopted from #217)
+- @LeeCQiang — Chinese docstrings across all 452 Alpha Zoo factors (#180)
+- @KaiLuettmann — GHCR pre-built image publishing on release (#187)
+- @ngoanpv — Gemini thought_signature preservation through the AgentLoop dict path (#184)
+- @ShahNewazKhan — Docker host-Ollama reachability via host.docker.internal (#196)
+- @sambazhu — frontend sync of completed chat attempts (#236)
+- @bhlt — baostock-native code format support (#230)
+- @octo-patch — MiniMax M3 default model upgrade (#162)
+- @warren618 / Haozhe Wu — the global data layer (8 sources + 18 read-only data tools), the 10 broker SDK connectors, the alpha-compare full stack, the provider-reliability overhaul, multi-engine web_search fallback, responsive Stop + SSE reconnect, and release integration
 
 <a href="https://github.com/HKUDS/Vibe-Trading/graphs/contributors">
   <img src="https://contrib.rocks/image?repo=HKUDS/Vibe-Trading" />
diff --git a/README_ar.md b/README_ar.md
index d3da16b6..35b160a1 100644
--- a/README_ar.md
+++ b/README_ar.md
@@ -50,8 +50,8 @@
 
 ## 📰 الأخبار
 
-- **2026-06-19** 🌍 **طبقة بيانات عالمية —— 8 مصادر جديدة + 18 أداة بيانات للقراءة فقط**: يكبر سجلّ محمّلات بيانات السوق من 10 مصادر إلى 18 —— أربع إضافات مجانية مباشرة عبر الـ API (**Eastmoney** و**Sina** و**Stooq** وعميل **Yahoo** مباشر عبر HTTP)، إضافةً إلى أربعة مزوّدين أمريكيين اختياريين محكومين بمفتاح (**Finnhub** و**Alpha Vantage** و**Tiingo** و**FMP**)، مع إعادة ترتيب سلاسل fallback حسب خطر حظر الـ IP. وفوقها تجلس **18 أداة بيانات جديدة للقراءة فقط** تتجاوز OHLCV إلى الأساسيات والتدفقات —— تدفق الأموال، ولوحة التنين والنمر، وتدفق الشمال (Stock-Connect)، والتداول بالهامش، والصفقات الكتلية، وعدد المساهمين، وانتهاء فترات الحظر، وعضوية القطاعات، وتقارير البحث، والأخبار، وملفّات SEC (EDGAR + XBRL)، والقوائم المالية، وسلاسل الخيارات، والحيازات المؤسسية، وفرز كامل السوق، والبحث عن الرموز —— عبر أسواق الأسهم الصينية / الأمريكية / هونغ كونغ، وكلّها مكشوفة عبر MCP. ويوثّق هذه الطبقة فهرس `data-routing` موحّد إضافةً إلى مهارتي `eastmoney` / `sec-edgar` لكل مصدر، وقد تم التحقق منها من طرف إلى طرف عبر تمرير حيّ لتوجيه LLM + اختبار بيانات سريع.
-- **2026-06-18** 🔬 **المرحلة الأولى من Research Autopilot + محمّل Data Bridge محلي، إضافةً إلى تنبيه أمني بشأن Discord**: تربط أداتان جديدتان للوكيل مسار **Hypothesis Registry → Research Goal → backtest** من طرف إلى طرف — تحوّل `run_research_autopilot` رقم `hypothesis_id` إلى research goal (الأطروحة كهدف، ومعايير قبول موجّهة للـ backtest، وتلميحات للخطوة التالية)، وتكتب `generate_backtest_config` ملف `config.json` للـ backtest تلقائياً من universe ومصادر بيانات الفرضية، فيستطيع الوكيل الانتقال مباشرةً من الفكرة → `signal_engine.py` → التشغيل (الآن **50 أداة**) ([#260](https://github.com/HKUDS/Vibe-Trading/pull/260)، شكراً @Robin1987China). ويقرأ **محمّل البيانات `local`** الجديد بيانات OHLCV مباشرةً من ملفاتك **CSV / Parquet / DuckDB**: اربط الرموز بالملفات في `~/.vibe-trading/data-bridge/config.yaml` وأضف بادئة `local:` للرمز ليُوجَّه إلى بياناتك المحلية، مع دعم سلسلة fallback المعتادة ([#252](https://github.com/HKUDS/Vibe-Trading/pull/252)، شكراً @Robin1987China). وأصلح تتبّع سريع عيوب وقت التشغيل التي رافقت كليهما — لم يكن Autopilot يتلقى `session_id` المضيف (تخفق كل استدعاء)، وكتبت `generate_backtest_config` ضمن جذر run يرفضه `safe_run_dir`، وأفرغ المحمّل المحلي بصمت مدخلات tz-aware عند مقارنة طابع زمني tz-naive ([#266](https://github.com/HKUDS/Vibe-Trading/pull/266)). وتُحلَّل الآن استدعاءات أدوات DeepSeek المغلّفة بـ `DSML` بشكل صحيح ([#261](https://github.com/HKUDS/Vibe-Trading/issues/261))، وحصلت مصافحة Robinhood OAuth على مهلة تهيئة أطول مع توثيق مفتاح إعداد MCP `initTimeout` ([#263](https://github.com/HKUDS/Vibe-Trading/pull/263))، ونزلت دفعة من تقوية احتواء المعرّفات: التحقق من نوع الذاكرة الدائمة ([#257](https://github.com/HKUDS/Vibe-Trading/pull/257))، واحتواء معرّفات تشغيل swarm في MCP ([#258](https://github.com/HKUDS/Vibe-Trading/pull/258))، وفرض صيغة صارمة `mp_[0-9a-f]{32}` لمعرّف mandate proposal-id باتساق عبر relay وpreview وبوابة commit ([#256](https://github.com/HKUDS/Vibe-Trading/pull/256)، [#264](https://github.com/HKUDS/Vibe-Trading/pull/264)). ⚠️ **تنبيه أمني**: دعوة المجتمع القديمة تشير الآن إلى خادم لم نعد نتحكم به ويُشغّل عملية تصيّد بانتحال "تحقّق" محفظة Collab.Land — أُزيلت من كل ملفات README ومن قالب المشكلات، وأصبح خادم HKUDS المجتمعي ([discord.gg/6TdQnT5xcF](https://discord.gg/6TdQnT5xcF)) هو Discord الرسمي **الوحيد**. لن يطلب منك Vibe-Trading أبداً "التحقّق" من محفظة عملات رقمية أو ربطها.
+- **2026-06-19** 🚀 **v0.1.10 — طبقة بيانات عالمية**: تنمو مصادر بيانات السوق من 10 إلى 18 (مجانية **Eastmoney / Sina / Stooq / Yahoo** + محكومة بمفتاح **Finnhub / Alpha Vantage / Tiingo / FMP**، مع fallback مرتّب حسب خطر حظر الـ IP)، إضافةً إلى **18 أداة بيانات للقراءة فقط** (تدفق الأموال، لوحة التنين والنمر، التدفق الشمالي، التداول بالهامش، الصفقات الكتلية، SEC EDGAR + XBRL، القوائم المالية، سلاسل الخيارات، فرز كامل السوق…) عبر الأسهم الصينية / الأمريكية / هونغ كونغ، وكلّها مكشوفة عبر MCP. تتضمّن هذه الإصدارة أيضًا كل تحديثات ما بعد 0.1.9 —— 10 موصّلات وسطاء، و`alpha compare`، وإصلاح موثوقية المزوّدين، وذاكرة تخزين بيانات اختيارية. `pip install -U vibe-trading-ai`
+- **2026-06-18** 🔬 **المرحلة الأولى من Research Autopilot + محمّل Data Bridge محلي، إضافةً إلى تنبيه أمني بشأن Discord**: تربط أداتا `run_research_autopilot` و`generate_backtest_config` الجديدتان مسار **Hypothesis → Research Goal → backtest** من طرف إلى طرف (الآن **50 أداة**)، ويقرأ محمّل **`local`** الجديد بيانات OHLCV مباشرةً من ملفاتك **CSV / Parquet / DuckDB** ([#260](https://github.com/HKUDS/Vibe-Trading/pull/260)، [#252](https://github.com/HKUDS/Vibe-Trading/pull/252)، شكراً @Robin1987China)، إضافةً إلى تحليل استدعاءات أدوات DeepSeek `DSML` ودفعة لتقوية احتواء المعرّفات. ⚠️ **تنبيه أمني**: دعوة المجتمع القديمة على Discord تشير الآن إلى خادم لا نتحكم به (تصيّد بانتحال "تحقّق" محفظة Collab.Land) — أُزيلت بالكامل، وخادم HKUDS ([discord.gg/6TdQnT5xcF](https://discord.gg/6TdQnT5xcF)) هو Discord الرسمي **الوحيد**. لن نطلب منك أبداً ربط محفظة.
 - **2026-06-17** 🧩 **توافق التثبيت + إصلاحات مزوّدي Opus/Kimi**: لم يعد التثبيت الأساسي `pip install vibe-trading-ai` يجلب سلسلة الاعتماد الاختيارية `pyharmonics` / `ta`؛ أصبح كشف الأنماط التوافقية خلف extra باسم `vibe-trading-ai[harmonic]` مع بقاء detector المضمّن متاحاً ([#250](https://github.com/HKUDS/Vibe-Trading/pull/250)، يغلق [#249](https://github.com/HKUDS/Vibe-Trading/issues/249)). ولم يعد Agent loop يرسل رسائل assistant-prefill handoff التي يرفضها Opus 4.8+، كما يمكن لـ Kimi/Moonshot تجاوز `User-Agent` عبر `MOONSHOT_USER_AGENT` ([#248](https://github.com/HKUDS/Vibe-Trading/pull/248)، يغلق [#246](https://github.com/HKUDS/Vibe-Trading/issues/246) و[#204](https://github.com/HKUDS/Vibe-Trading/issues/204))؛ وتغطي اختبارات المتابعة مساري background-result وauto-compact handoff مباشرة ([#251](https://github.com/HKUDS/Vibe-Trading/pull/251)).
 <details>
 <summary>أخبار سابقة</summary>
@@ -1002,21 +1002,25 @@ Vibe-Trading جزء من نظام وكلاء **[HKUDS](https://github.com/HKUDS)
 
 شكراً لكل من ساهم في Vibe-Trading!
 
-مساهمو واعتمادات دورة v0.1.9 الأخيرة:
+مساهمو واعتمادات دورة v0.1.10 الأخيرة:
 
-- @toanalien — تقوية session JSONL ضد الأعطال (#147)، وخروج لطيف من حلقة الوكيل عند نفاد ميزانية التكرارات (#148)، وتحقق مسبق من signal engines المولّدة بالـ LLM (#149)، وروابط Full Report عبر المتصفحات (#150)
-- @ai7eam-dev — محاذاة الطوابع الزمنية للارتباط عبر الأسواق (#158)، ومؤشر حالة تشغيل الجلسة + إعادة تشغيل swarm (#159 → #160)
-- @shadowinlife — خوادم MCP عن بُعد عبر SSE/HTTP (#125)، وأدوات MCP خارجية يضبطها المشغّل في عمّال swarm (#142)
-- @DoubleSky123 — مهلة خمول SSE قابلة للضبط (#157)
-- @ArthurXi — معالجة إرسال Enter في IME داخل محرّر الويب (#146)
-- @omcdecor-cyber — حجب المهام المتفرعة عند فشل المهمة الأعلى في swarm DAG (#145)
-- @Soli22de — وضع alpha-bench صارم بتحكم عشوائي إلزامي (#143)
-- @ruok808 — دعم متغيرات البيئة للوكيل في محمّل CCXT (#126)
-- @faizack — تطبيع عنوان Ollama البعيد الأساسي (#129)
-- @fightZy — إصلاح تحميل سجل جلسات الوكيل (#136)
-- @lcwSeven — قبول أسماء universe قصيرة في واجهة قائمة alpha (#137)
-- @Teerapat-Vatpitak — تسجيل مصدر .env بعد التحليل (#124)
-- @warren618 / Haozhe Wu — ملفات وسطاء تعتمد أولاً على connectors، وقناة Robinhood Agentic Trading، وزمن تشغيل Research Goal، وswarm reconcile + retry_run، وإعادة هيكلة agent/cli، ومحمّل mootdx، وتكامل الإصدار
+- @Hinotoi-agent — موجة تقوية أمنية: مصادقة الإيقاف المحلي (#241)، ورفض إعادة ربط مضيف الاسترجاع (#242)، وتفعيل صريح لأدوات shell للوكيل (#243)، ومصادقة كتابة الإعدادات (#245)، واحتواء mandate proposal-id (#256)، والتحقق من أنواع الذاكرة الدائمة (#257)، واحتواء MCP swarm run-id (#258)
+- @mvanhorn — ذاكرة تخزين بيانات محلية اختيارية (#177)، وذهاب وإياب Gemini thoughtSignature عبر استدعاءات أدوات متوافقة مع OpenAI (#176)، ودليل مصدر بيانات مخصّص (#194)، واسم بديل لمزوّد glm/zhipu + استنتاج اسم النموذج (#247)
+- @gyx09212214-prog — متانة المحمّل أمام متغيّرات بيئة مهلة crypto/RSSHub المشوّهة (#227، #240)، وتضمين تاريخ النهاية المطلوب في yfinance (#226)، وJSON صارم لمقاييس run-card غير المنتهية (#238)، وتغطية إعادة محاولة ddgs (#239)
+- @BillDin — عرض حالة وكيل swarm في واجهة الدردشة (#188)، ومعالجة أسماء preset الصريحة (#189)، وأداة بيانات السوق المعتمدة على المحمّل لعمّال swarm (#199)، واستمرارية سياق preset (#200)
+- @Robin1987China — جسر الفرضية-الهدف لـ Research Autopilot (#260)، ومحمّل بيانات CSV/Parquet/DuckDB المحلي (#252)، وإصلاح assistant-prefill + User-Agent قابل للضبط لـ Kimi (#248)
+- @LemonCANDY42 — لوحة حالة وقت التشغيل للقراءة فقط (#210)، وحفظ منتجات استخدام AgentLoop (#223)، وحمولات مخططات Run Detail الاختيارية (#225)
+- @zwrong — إعادة هيكلة trace.jsonl بلا اقتطاع + offload (#206)، وعرض session-id عند الخروج + `resume <session-id>` (#218)
+- @forge-builder — دليل المساهم بالذكاء الاصطناعي (#173)، ووثائق اختبار OpenClaw MCP للقراءة فقط (#165)
+- @skloxo — توطين الواجهة الأمامية بالصينية (zh-CN) (مُعتمد من #217)
+- @LeeCQiang — docstrings صينية عبر جميع عوامل Alpha Zoo الـ 452 (#180)
+- @KaiLuettmann — نشر صورة GHCR مُسبقة البناء عند الإصدار (#187)
+- @ngoanpv — الحفاظ على Gemini thought_signature عبر مسار dict في AgentLoop (#184)
+- @ShahNewazKhan — الوصول إلى Ollama المضيف عبر host.docker.internal (#196)
+- @sambazhu — مزامنة الواجهة الأمامية لمحاولات الدردشة المكتملة (#236)
+- @bhlt — دعم تنسيق رمز baostock الأصلي (#230)
+- @octo-patch — ترقية نموذج MiniMax M3 الافتراضي (#162)
+- @warren618 / Haozhe Wu — طبقة البيانات العالمية (8 مصادر + 18 أداة بيانات للقراءة فقط)، و10 موصّلات وسطاء SDK، وحزمة alpha compare الكاملة، وإصلاح موثوقية المزوّدين، وfallback متعدد المحركات لـ web_search، وStop تفاعلي + إعادة اتصال SSE، وتكامل الإصدار
 
 <a href="https://github.com/HKUDS/Vibe-Trading/graphs/contributors">
   <img src="https://contrib.rocks/image?repo=HKUDS/Vibe-Trading" />
diff --git a/README_ja.md b/README_ja.md
index 6dededc1..dd1f1897 100644
--- a/README_ja.md
+++ b/README_ja.md
@@ -50,8 +50,8 @@
 
 ## 📰 ニュース
 
-- **2026-06-19** 🌍 **グローバルデータレイヤー — 新規 8 データソース + 18 個の読み取り専用データツール**：市場データの loader レジストリが 10 から 18 ソースへ拡大しました——無料の直接 API 追加 4 件（**Eastmoney**、**Sina**、**Stooq**、そして直接 HTTP の **Yahoo** クライアント）に加え、任意のキー必須な米国プロバイダ 4 件（**Finnhub**、**Alpha Vantage**、**Tiingo**、**FMP**）で、fallback チェーンは IP-ban リスク順に並べ替えました。その上に **18 個の新しい読み取り専用データツール**が乗り、OHLCV を越えてファンダメンタルズやフローにまで到達します——資金フロー、龍虎榜、北向き（Stock-Connect）フロー、信用取引、大口取引（ブロックトレード）、株主数、ロックアップ解除、セクター構成、調査レポート、ニュース、SEC 提出書類（EDGAR + XBRL）、財務諸表、オプションチェーン、機関投資家の保有、全市場スクリーニング、シンボル検索を、A 株 / 米国 / 香港にまたがって、すべて MCP 経由で公開します。集約された `data-routing` インデックスとソース別の `eastmoney` / `sec-edgar` skill がこのレイヤーを文書化し、ライブ LLM ルーティング + データのスモークパスでエンドツーエンド検証済みです。
-- **2026-06-18** 🔬 **Research Autopilot 第1フェーズ + ローカル Data Bridge ローダー、加えて Discord セキュリティ通知**：2 つの新しい agent ツールが **Hypothesis Registry → Research Goal → backtest** の経路を端から端までつなぎます——`run_research_autopilot` は `hypothesis_id` を research goal に変換し（テーゼを目的に、backtest 向けの受け入れ基準、次のステップのヒント付き）、`generate_backtest_config` は hypothesis の universe とデータソースから backtest の `config.json` を自動生成するので、agent はアイデア → `signal_engine.py` → 実行まで一直線に進めます（現在 **50 ツール**）（[#260](https://github.com/HKUDS/Vibe-Trading/pull/260)、@Robin1987China さんに感謝）。新しい **`local` データローダー**は、自分の **CSV / Parquet / DuckDB** ファイルから直接 OHLCV を読み込みます：`~/.vibe-trading/data-bridge/config.yaml` でシンボルをファイルに対応付け、シンボルに `local:` を前置するとローカルデータへルーティングされ、通常の fallback チェーンにも対応します（[#252](https://github.com/HKUDS/Vibe-Trading/pull/252)、@Robin1987China さんに感謝）。直後の追従修正で、両者が抱えていた実行時の欠陥を修正しました——Autopilot はホストの `session_id` を受け取れず（毎回エラー）、`generate_backtest_config` は `safe_run_dir` が拒否する run ルートに書き込み、ローカルローダーは tz-naive なタイムスタンプ比較で tz-aware 入力を黙って空にしていました（[#266](https://github.com/HKUDS/Vibe-Trading/pull/266)）。DeepSeek の `DSML` でラップされた tool call が正しくパースされるようになり（[#261](https://github.com/HKUDS/Vibe-Trading/issues/261)）、Robinhood OAuth ハンドシェイクの初期化タイムアウトが延長され、MCP `initTimeout` 設定キーもドキュメント化されました（[#263](https://github.com/HKUDS/Vibe-Trading/pull/263)）。さらに識別子の封じ込め強化が一括で入りました：永続メモリの型バリデーション（[#257](https://github.com/HKUDS/Vibe-Trading/pull/257)）、MCP swarm run-id の封じ込め（[#258](https://github.com/HKUDS/Vibe-Trading/pull/258)）、そして relay・preview・commit ゲート間で一貫して強制される厳格な `mp_[0-9a-f]{32}` mandate proposal-id フォーマット（[#256](https://github.com/HKUDS/Vibe-Trading/pull/256)、[#264](https://github.com/HKUDS/Vibe-Trading/pull/264)）。⚠️ **セキュリティ通知**：以前のコミュニティ招待は、現在私たちが管理していないサーバーに解決され、偽の Collab.Land ウォレット「認証」フィッシング詐欺を実行しています——すべての README と issue テンプレートから削除され、**唯一**の公式 Discord は HKUDS コミュニティサーバー（[discord.gg/6TdQnT5xcF](https://discord.gg/6TdQnT5xcF)）になりました。Vibe-Trading が暗号ウォレットの「認証」や接続を求めることは決してありません。
+- **2026-06-19** 🚀 **v0.1.10 — グローバルデータレイヤー**：市場データソースが 10 → 18 に拡大（無料の **Eastmoney / Sina / Stooq / Yahoo** + キー必須の **Finnhub / Alpha Vantage / Tiingo / FMP**、IP-ban リスク順の fallback）。さらに **18 個の読み取り専用データツール**（資金フロー、龍虎榜、北向き、信用取引、大口取引、SEC EDGAR + XBRL、財務、オプションチェーン、全市場スクリーニング…）を A 株 / 米国 / 香港にまたがり、すべて MCP 経由で公開。本リリースは 0.1.9 以降の全更新も同梱——10 のブローカーコネクタ、`alpha compare`、プロバイダ信頼性の大規模改修、任意のデータキャッシュ。`pip install -U vibe-trading-ai`
+- **2026-06-18** 🔬 **Research Autopilot 第1フェーズ + ローカル Data Bridge ローダー、加えて Discord セキュリティ通知**：新しい `run_research_autopilot` + `generate_backtest_config` が **Hypothesis → Research Goal → backtest** を端から端までつなぎ（現在 **50 ツール**）、新しい **`local`** ローダーは自分の **CSV / Parquet / DuckDB** ファイルから直接 OHLCV を読み込みます（[#260](https://github.com/HKUDS/Vibe-Trading/pull/260)、[#252](https://github.com/HKUDS/Vibe-Trading/pull/252)、@Robin1987China さんに感謝）。さらに DeepSeek `DSML` ツール呼び出しの解析と識別子封じ込め強化も入りました。⚠️ **セキュリティ通知**：以前のコミュニティ Discord 招待は、現在管理していないサーバー（偽の Collab.Land ウォレット「認証」フィッシング）に解決されます——すべて削除済みで、**唯一**の公式 Discord は HKUDS サーバー（[discord.gg/6TdQnT5xcF](https://discord.gg/6TdQnT5xcF)）です。ウォレット接続を求めることは決してありません。
 - **2026-06-17** 🧩 **インストール互換性 + Opus/Kimi プロバイダ修正**：通常の `pip install vibe-trading-ai` では、任意機能の `pyharmonics` / `ta` 依存チェーンを引かなくなりました。harmonic detection は `vibe-trading-ai[harmonic]` extra の背後に移しつつ、同梱 fallback detector はそのまま使えます（[#250](https://github.com/HKUDS/Vibe-Trading/pull/250)、[#249](https://github.com/HKUDS/Vibe-Trading/issues/249) をクローズ）。Agent loop は Opus 4.8+ が拒否する assistant-prefill handoff message を送らなくなり、Kimi/Moonshot は `MOONSHOT_USER_AGENT` で client `User-Agent` を上書きできます（[#248](https://github.com/HKUDS/Vibe-Trading/pull/248)、[#246](https://github.com/HKUDS/Vibe-Trading/issues/246) と [#204](https://github.com/HKUDS/Vibe-Trading/issues/204) をクローズ）。follow-up tests は background-result と auto-compact の handoff 経路を直接カバーします（[#251](https://github.com/HKUDS/Vibe-Trading/pull/251)）。
 <details>
 <summary>過去のニュース</summary>
@@ -999,21 +999,25 @@ Contributions を歓迎します。ガイドラインは [CONTRIBUTING.md](CONTR
 
 Vibe-Trading に貢献してくださった皆さまに感謝します。
 
-最近の v0.1.9 cycle contributors and credits:
+最近の v0.1.10 cycle contributors and credits:
 
-- @toanalien — session JSONL crash-hardening (#147), graceful agent-loop exit at the iteration budget (#148), pre-flight validation for LLM-generated signal engines (#149), and cross-browser Full Report links (#150)
-- @ai7eam-dev — cross-market correlation timestamp alignment (#158) and the session running-status indicator + swarm retry (#159 → #160)
-- @shadowinlife — remote MCP servers over SSE/HTTP (#125) and operator-configured external MCP tools in swarm workers (#142)
-- @DoubleSky123 — configurable SSE idle timeout (#157)
-- @ArthurXi — IME Enter submission handling in the Web composer (#146)
-- @omcdecor-cyber — swarm DAG gating when an upstream task fails (#145)
-- @Soli22de — strict alpha-bench mode with a mandatory random control (#143)
-- @ruok808 — proxy-env support in the CCXT loader (#126)
-- @faizack — remote Ollama base-URL normalization (#129)
-- @fightZy — agent session history loading fix (#136)
-- @lcwSeven — short universe names in the alpha list endpoint (#137)
-- @Teerapat-Vatpitak — resolved .env-source logging (#124)
-- @warren618 / Haozhe Wu — connector-first broker profiles, the Robinhood Agentic Trading channel, Research Goal runtime, swarm reconcile + retry_run, the agent/cli refactor, the mootdx loader, and release integration
+- @Hinotoi-agent — a security-hardening wave: local-shutdown auth (#241), loopback-host rebinding rejection (#242), agent shell-tool opt-in (#243), settings-write auth (#245), mandate proposal-id containment (#256), persistent-memory type validation (#257), and MCP swarm run-id containment (#258)
+- @mvanhorn — the opt-in local data cache (#177), Gemini thoughtSignature round-trip over OpenAI-compat tool calls (#176), the custom data loader guide (#194), and the glm/zhipu provider alias + model-name inference (#247)
+- @gyx09212214-prog — loader robustness for malformed crypto/RSSHub timeout env vars (#227, #240), requested yfinance end-date inclusion (#226), strict run-card JSON for non-finite metrics (#238), and ddgs retry-fallback coverage (#239)
+- @BillDin — swarm agent status in the chat UI (#188), explicit preset-name handling (#189), the loader-backed market-data tool for swarm workers (#199), and preset-context continuations (#200)
+- @Robin1987China — the Research Autopilot goal-hypothesis bridge (#260), the local CSV/Parquet/DuckDB data loader (#252), and an assistant-prefill fix + configurable Kimi User-Agent (#248)
+- @LemonCANDY42 — the read-only runtime status dashboard (#210), persisted AgentLoop usage artifacts (#223), and opt-in Run Detail chart payloads (#225)
+- @zwrong — the trace.jsonl overhaul with zero truncation + offload (#206) and session-id on exit + `resume <session-id>` (#218)
+- @forge-builder — the AI contributor guide (#173) and the OpenClaw MCP research-only smoke-test docs (#165)
+- @skloxo — Chinese (zh-CN) frontend localization (adopted from #217)
+- @LeeCQiang — Chinese docstrings across all 452 Alpha Zoo factors (#180)
+- @KaiLuettmann — GHCR pre-built image publishing on release (#187)
+- @ngoanpv — Gemini thought_signature preservation through the AgentLoop dict path (#184)
+- @ShahNewazKhan — Docker host-Ollama reachability via host.docker.internal (#196)
+- @sambazhu — frontend sync of completed chat attempts (#236)
+- @bhlt — baostock-native code format support (#230)
+- @octo-patch — MiniMax M3 default model upgrade (#162)
+- @warren618 / Haozhe Wu — the global data layer (8 sources + 18 read-only data tools), the 10 broker SDK connectors, the alpha-compare full stack, the provider-reliability overhaul, multi-engine web_search fallback, responsive Stop + SSE reconnect, and release integration
 
 <a href="https://github.com/HKUDS/Vibe-Trading/graphs/contributors">
   <img src="https://contrib.rocks/image?repo=HKUDS/Vibe-Trading" />
diff --git a/README_ko.md b/README_ko.md
index 3fb08511..eb248f9a 100644
--- a/README_ko.md
+++ b/README_ko.md
@@ -50,8 +50,8 @@
 
 ## 📰 뉴스
 
-- **2026-06-19** 🌍 **글로벌 데이터 계층 — 새 소스 8종 + 읽기 전용 데이터 도구 18종**: 시장 데이터 로더 레지스트리가 10개에서 18개 소스로 늘었습니다 — 무료 다이렉트 API 소스 네 종(**Eastmoney**, **Sina**, **Stooq**, 그리고 다이렉트 HTTP **Yahoo** 클라이언트)에 더해 키 기반 옵션형 미국 프로바이더 네 종(**Finnhub**, **Alpha Vantage**, **Tiingo**, **FMP**)이 추가됐고, fallback 체인은 IP 차단 위험 순으로 재정렬됐습니다. 그 위에 OHLCV를 넘어 펀더멘털과 자금 흐름까지 닿는 **읽기 전용 데이터 도구 18종**을 얹었습니다 — 자금 흐름, 용호방(dragon-tiger board), 북향(Stock-Connect) 자금 흐름, 신용거래, 대종거래(block trades), 주주 수, 보호예수 만기, 섹터 구성, 리서치 리포트, 뉴스, SEC 공시(EDGAR + XBRL), 재무제표, 옵션 체인, 기관 보유, 전체 시장 스크리닝, 심볼 검색 — A주 / 미국 / 홍콩 전반에 걸쳐 모두 MCP로 노출됩니다. 통합 `data-routing` 인덱스와 소스별 `eastmoney` / `sec-edgar` 스킬이 이 계층을 문서화하며, 실제 LLM 라우팅 + 데이터 스모크 패스로 엔드투엔드 검증했습니다.
-- **2026-06-18** 🔬 **Research Autopilot 1단계 + 로컬 Data Bridge 로더, 그리고 Discord 보안 공지**: 두 개의 새 agent 도구가 **Hypothesis Registry → Research Goal → backtest** 경로를 끝까지 연결합니다 — `run_research_autopilot`은 `hypothesis_id`를 research goal로 바꾸고(주장을 목표로, backtest 지향 수용 기준, 다음 단계 힌트 포함), `generate_backtest_config`는 hypothesis의 universe와 데이터 소스로부터 backtest `config.json`을 자동 작성하므로, agent가 아이디어 → `signal_engine.py` → 실행까지 곧장 진행할 수 있습니다(이제 **50개 도구**)([#260](https://github.com/HKUDS/Vibe-Trading/pull/260), @Robin1987China 님 감사합니다). 새 **`local` 데이터 로더**는 사용자 본인의 **CSV / Parquet / DuckDB** 파일에서 직접 OHLCV를 읽습니다: `~/.vibe-trading/data-bridge/config.yaml`에서 심볼을 파일에 매핑하고 심볼에 `local:` 접두사를 붙이면 로컬 데이터로 라우팅되며, 일반 fallback 체인도 지원합니다([#252](https://github.com/HKUDS/Vibe-Trading/pull/252), @Robin1987China 님 감사합니다). 직후 후속 수정으로 둘이 함께 들어온 런타임 결함을 고쳤습니다 — Autopilot이 호스트 `session_id`를 받지 못했고(매 호출이 오류), `generate_backtest_config`가 `safe_run_dir`이 거부하는 run 루트에 기록했으며, 로컬 로더가 tz-naive 타임스탬프 비교에서 tz-aware 입력을 조용히 비웠습니다([#266](https://github.com/HKUDS/Vibe-Trading/pull/266)). DeepSeek의 `DSML`로 감싼 tool call이 이제 올바르게 파싱되고([#261](https://github.com/HKUDS/Vibe-Trading/issues/261)), Robinhood OAuth 핸드셰이크의 초기화 타임아웃이 늘어났으며 MCP `initTimeout` 설정 키도 문서화됐습니다([#263](https://github.com/HKUDS/Vibe-Trading/pull/263)). 또한 식별자 봉쇄 강화가 한 번에 들어왔습니다: 영속 메모리 타입 검증([#257](https://github.com/HKUDS/Vibe-Trading/pull/257)), MCP swarm run-id 봉쇄([#258](https://github.com/HKUDS/Vibe-Trading/pull/258)), 그리고 relay·preview·commit 게이트 전반에서 일관되게 강제되는 엄격한 `mp_[0-9a-f]{32}` mandate proposal-id 형식([#256](https://github.com/HKUDS/Vibe-Trading/pull/256), [#264](https://github.com/HKUDS/Vibe-Trading/pull/264)). ⚠️ **보안 공지**: 이전 커뮤니티 초대는 이제 우리가 더 이상 관리하지 않는 서버로 연결되며, 가짜 Collab.Land 지갑 "인증" 피싱 사기를 운영합니다 — 모든 README와 issue 템플릿에서 제거됐고, **유일한** 공식 Discord는 이제 HKUDS 커뮤니티 서버([discord.gg/6TdQnT5xcF](https://discord.gg/6TdQnT5xcF))입니다. Vibe-Trading은 절대 암호화폐 지갑을 "인증"하거나 연결하라고 요구하지 않습니다.
+- **2026-06-19** 🚀 **v0.1.10 — 글로벌 데이터 계층**: 시장 데이터 소스가 10 → 18개로 확대(무료 **Eastmoney / Sina / Stooq / Yahoo** + 키 기반 **Finnhub / Alpha Vantage / Tiingo / FMP**, IP 차단 위험 순 fallback). 여기에 **읽기 전용 데이터 도구 18종**(자금 흐름, 용호방, 북향, 신용거래, 대종거래, SEC EDGAR + XBRL, 재무, 옵션 체인, 전체 시장 스크리닝…)을 A주 / 미국 / 홍콩 전반에 걸쳐 모두 MCP로 노출. 이번 릴리스는 0.1.9 이후의 모든 업데이트도 함께 포함합니다 — 브로커 커넥터 10종, `alpha compare`, 프로바이더 신뢰성 대개편, 옵션형 데이터 캐시. `pip install -U vibe-trading-ai`
+- **2026-06-18** 🔬 **Research Autopilot 1단계 + 로컬 Data Bridge 로더, 그리고 Discord 보안 공지**: 새 `run_research_autopilot` + `generate_backtest_config`가 **Hypothesis → Research Goal → backtest**를 끝까지 연결하고(이제 **50개 도구**), 새 **`local`** 로더가 사용자 본인의 **CSV / Parquet / DuckDB** 파일에서 직접 OHLCV를 읽습니다([#260](https://github.com/HKUDS/Vibe-Trading/pull/260), [#252](https://github.com/HKUDS/Vibe-Trading/pull/252), @Robin1987China 님 감사합니다). 또한 DeepSeek `DSML` tool call 파싱과 식별자 봉쇄 강화가 들어왔습니다. ⚠️ **보안 공지**: 이전 커뮤니티 Discord 초대는 이제 우리가 관리하지 않는 서버(가짜 Collab.Land 지갑 "인증" 피싱)로 연결됩니다 — 모두 제거됐고, **유일한** 공식 Discord는 HKUDS 서버([discord.gg/6TdQnT5xcF](https://discord.gg/6TdQnT5xcF))입니다. 지갑 연결을 요구하는 일은 결코 없습니다.
 - **2026-06-17** 🧩 **설치 호환성 + Opus/Kimi 프로바이더 수정**: 기본 `pip install vibe-trading-ai`는 더 이상 선택 기능인 `pyharmonics` / `ta` 의존성 체인을 끌어오지 않습니다. harmonic detection은 `vibe-trading-ai[harmonic]` extra 뒤로 이동했고, 내장 fallback detector는 그대로 사용할 수 있습니다([#250](https://github.com/HKUDS/Vibe-Trading/pull/250), [#249](https://github.com/HKUDS/Vibe-Trading/issues/249) 종료). Agent loop는 Opus 4.8+가 거부하는 assistant-prefill handoff message를 보내지 않으며, Kimi/Moonshot은 `MOONSHOT_USER_AGENT`로 client `User-Agent`를 덮어쓸 수 있습니다([#248](https://github.com/HKUDS/Vibe-Trading/pull/248), [#246](https://github.com/HKUDS/Vibe-Trading/issues/246) 및 [#204](https://github.com/HKUDS/Vibe-Trading/issues/204) 종료). 후속 테스트는 background-result와 auto-compact handoff 경로를 직접 커버합니다([#251](https://github.com/HKUDS/Vibe-Trading/pull/251)).
 <details>
 <summary>이전 뉴스</summary>
@@ -1002,21 +1002,25 @@ Vibe-Trading은 **[HKUDS](https://github.com/HKUDS)** agent ecosystem의 일부
 
 Vibe-Trading에 기여해 주신 모든 분께 감사드립니다!
 
-최근 v0.1.9 cycle contributors and credits:
+최근 v0.1.10 cycle contributors and credits:
 
-- @toanalien — session JSONL crash-hardening (#147), graceful agent-loop exit at the iteration budget (#148), pre-flight validation for LLM-generated signal engines (#149), and cross-browser Full Report links (#150)
-- @ai7eam-dev — cross-market correlation timestamp alignment (#158) and the session running-status indicator + swarm retry (#159 → #160)
-- @shadowinlife — remote MCP servers over SSE/HTTP (#125) and operator-configured external MCP tools in swarm workers (#142)
-- @DoubleSky123 — configurable SSE idle timeout (#157)
-- @ArthurXi — IME Enter submission handling in the Web composer (#146)
-- @omcdecor-cyber — swarm DAG gating when an upstream task fails (#145)
-- @Soli22de — strict alpha-bench mode with a mandatory random control (#143)
-- @ruok808 — proxy-env support in the CCXT loader (#126)
-- @faizack — remote Ollama base-URL normalization (#129)
-- @fightZy — agent session history loading fix (#136)
-- @lcwSeven — short universe names in the alpha list endpoint (#137)
-- @Teerapat-Vatpitak — resolved .env-source logging (#124)
-- @warren618 / Haozhe Wu — connector-first broker profiles, the Robinhood Agentic Trading channel, Research Goal runtime, swarm reconcile + retry_run, the agent/cli refactor, the mootdx loader, and release integration
+- @Hinotoi-agent — a security-hardening wave: local-shutdown auth (#241), loopback-host rebinding rejection (#242), agent shell-tool opt-in (#243), settings-write auth (#245), mandate proposal-id containment (#256), persistent-memory type validation (#257), and MCP swarm run-id containment (#258)
+- @mvanhorn — the opt-in local data cache (#177), Gemini thoughtSignature round-trip over OpenAI-compat tool calls (#176), the custom data loader guide (#194), and the glm/zhipu provider alias + model-name inference (#247)
+- @gyx09212214-prog — loader robustness for malformed crypto/RSSHub timeout env vars (#227, #240), requested yfinance end-date inclusion (#226), strict run-card JSON for non-finite metrics (#238), and ddgs retry-fallback coverage (#239)
+- @BillDin — swarm agent status in the chat UI (#188), explicit preset-name handling (#189), the loader-backed market-data tool for swarm workers (#199), and preset-context continuations (#200)
+- @Robin1987China — the Research Autopilot goal-hypothesis bridge (#260), the local CSV/Parquet/DuckDB data loader (#252), and an assistant-prefill fix + configurable Kimi User-Agent (#248)
+- @LemonCANDY42 — the read-only runtime status dashboard (#210), persisted AgentLoop usage artifacts (#223), and opt-in Run Detail chart payloads (#225)
+- @zwrong — the trace.jsonl overhaul with zero truncation + offload (#206) and session-id on exit + `resume <session-id>` (#218)
+- @forge-builder — the AI contributor guide (#173) and the OpenClaw MCP research-only smoke-test docs (#165)
+- @skloxo — Chinese (zh-CN) frontend localization (adopted from #217)
+- @LeeCQiang — Chinese docstrings across all 452 Alpha Zoo factors (#180)
+- @KaiLuettmann — GHCR pre-built image publishing on release (#187)
+- @ngoanpv — Gemini thought_signature preservation through the AgentLoop dict path (#184)
+- @ShahNewazKhan — Docker host-Ollama reachability via host.docker.internal (#196)
+- @sambazhu — frontend sync of completed chat attempts (#236)
+- @bhlt — baostock-native code format support (#230)
+- @octo-patch — MiniMax M3 default model upgrade (#162)
+- @warren618 / Haozhe Wu — the global data layer (8 sources + 18 read-only data tools), the 10 broker SDK connectors, the alpha-compare full stack, the provider-reliability overhaul, multi-engine web_search fallback, responsive Stop + SSE reconnect, and release integration
 
 <a href="https://github.com/HKUDS/Vibe-Trading/graphs/contributors">
   <img src="https://contrib.rocks/image?repo=HKUDS/Vibe-Trading" />
diff --git a/README_zh.md b/README_zh.md
index 656e34be..229ceece 100644
--- a/README_zh.md
+++ b/README_zh.md
@@ -50,8 +50,8 @@
 
 ## 📰 News
 
-- **2026-06-19** 🌍 **全球数据层 — 8 个新数据源 + 18 个只读数据工具**：行情数据 loader 从 10 个增至 18 个——四个免费直连源（**东方财富**、**新浪**、**Stooq**、直连 HTTP 的 **Yahoo** 客户端）加四个可选 key 的美股源（**Finnhub**、**Alpha Vantage**、**Tiingo**、**FMP**），fallback 链按"被封 IP 风险"重新排序。在此之上是 **18 个新只读数据工具**，把能力从 OHLCV 拓展到基本面与资金面——资金流、龙虎榜、北向（陆股通）资金、融资融券、大宗交易、股东户数、限售解禁、板块归属、券商研报、新闻、SEC 文件（EDGAR + XBRL）、财务报表、期权链、机构持仓、全市场筛选、代码搜索——覆盖 A股 / 美股 / 港股，全部经 MCP 暴露。统一的 `data-routing` 路由索引与按源的 `eastmoney` / `sec-edgar` skill 将其文档化，并通过真实端到端的 LLM 路由 + 数据冒烟验证。
-- **2026-06-18** 🔬 **Research Autopilot 第一阶段 + 本地 Data Bridge 加载器，外加一则 Discord 安全提示**：两个新 agent 工具把**假设登记（Hypothesis Registry）→ 研究目标（Research Goal）→ 回测**这条链路打通——`run_research_autopilot` 把一个 `hypothesis_id` 变成一个研究目标（论点即目标、面向回测的验收标准、下一步提示），`generate_backtest_config` 则根据假设的标的池与数据源自动写出回测 `config.json`，让 agent 可以从想法 → `signal_engine.py` → 实跑一气呵成（现在 **50 个工具**）（[#260](https://github.com/HKUDS/Vibe-Trading/pull/260)，感谢 @Robin1987China）。新的 **`local` 数据加载器**直接从你自己的 **CSV / Parquet / DuckDB** 文件读取 OHLCV：在 `~/.vibe-trading/data-bridge/config.yaml` 里把 symbol 映射到文件，并给 symbol 加 `local:` 前缀即可路由到本地数据，照常支持 fallback 链（[#252](https://github.com/HKUDS/Vibe-Trading/pull/252)，感谢 @Robin1987China）。一个快速跟进修掉了二者各自带来的运行期缺陷——Autopilot 从未收到宿主 `session_id`（每次调用都报错），`generate_backtest_config` 写到了 `safe_run_dir` 拒绝的 run 根目录，本地加载器在 tz-naive 时间戳比较时静默清空了 tz-aware 输入（[#266](https://github.com/HKUDS/Vibe-Trading/pull/266)）。DeepSeek 的 `DSML` 包裹式工具调用现在能正确解析（[#261](https://github.com/HKUDS/Vibe-Trading/issues/261)），Robinhood OAuth 握手获得了更长的初始化超时，MCP `initTimeout` 配置项也已写进文档（[#263](https://github.com/HKUDS/Vibe-Trading/pull/263)），并落地了一波标识符收敛加固：持久记忆类型校验（[#257](https://github.com/HKUDS/Vibe-Trading/pull/257)）、MCP swarm run-id 收敛（[#258](https://github.com/HKUDS/Vibe-Trading/pull/258)）、以及在 relay、preview 与 commit 网关之间一致强制的严格 `mp_[0-9a-f]{32}` mandate proposal-id 格式（[#256](https://github.com/HKUDS/Vibe-Trading/pull/256)、[#264](https://github.com/HKUDS/Vibe-Trading/pull/264)）。⚠️ **安全提示**：旧的社区邀请链接现在指向一个我们已无法控制的服务器，里面跑着假冒 Collab.Land 的钱包"验证"钓鱼骗局——它已从所有 README 和 issue 模板中移除，**唯一**官方 Discord 现在是 HKUDS 社区服务器（[discord.gg/6TdQnT5xcF](https://discord.gg/6TdQnT5xcF)）。Vibe-Trading 绝不会要求你"验证"或连接加密钱包。
+- **2026-06-19** 🚀 **v0.1.10 — 全球数据层**：行情数据源从 10 个增至 18 个（免费直连 **东方财富 / 新浪 / Stooq / Yahoo** + 可选 key 的 **Finnhub / Alpha Vantage / Tiingo / FMP**，按封禁风险排序 fallback），外加 **18 个只读数据工具**（资金流、龙虎榜、北向、融资融券、大宗交易、SEC EDGAR + XBRL、财报、期权链、全市场筛选……）覆盖 A股 / 美股 / 港股，全部经 MCP 暴露。本版同时卷入 0.1.9 以来的全部更新——10 个券商连接器、`alpha compare`、provider 可靠性大修、可选数据缓存。`pip install -U vibe-trading-ai`
+- **2026-06-18** 🔬 **Research Autopilot 第一阶段 + 本地 Data Bridge 加载器，外加 Discord 安全提示**：新增 `run_research_autopilot` + `generate_backtest_config`，把**假设 → 研究目标 → 回测**打通（现 **50 个工具**），新 **`local`** 加载器直接从你的 **CSV / Parquet / DuckDB** 文件读 OHLCV（[#260](https://github.com/HKUDS/Vibe-Trading/pull/260)、[#252](https://github.com/HKUDS/Vibe-Trading/pull/252)，感谢 @Robin1987China），并修了 DeepSeek `DSML` 工具调用解析与一波标识符收敛加固。⚠️ **安全提示**：旧社区 Discord 邀请现指向一个我们已无法控制、跑着假冒 Collab.Land 钱包"验证"钓鱼的服务器——已全部移除；**唯一**官方 Discord 是 HKUDS 服务器（[discord.gg/6TdQnT5xcF](https://discord.gg/6TdQnT5xcF)），我们绝不会要求你连接钱包。
 - **2026-06-17** 🧩 **安装兼容 + Opus/Kimi provider 修复**：基础 `pip install vibe-trading-ai` 不再拉取可选的 `pyharmonics` / `ta` 依赖链；谐波形态识别现在放到 `vibe-trading-ai[harmonic]` extra 后面，同时保留内置 fallback 检测器（[#250](https://github.com/HKUDS/Vibe-Trading/pull/250)，关闭 [#249](https://github.com/HKUDS/Vibe-Trading/issues/249)）。Agent loop 也不再发送 Opus 4.8+ 会拒绝的 assistant-prefill handoff 消息，Kimi/Moonshot 可通过 `MOONSHOT_USER_AGENT` 覆盖客户端 `User-Agent`（[#248](https://github.com/HKUDS/Vibe-Trading/pull/248)，关闭 [#246](https://github.com/HKUDS/Vibe-Trading/issues/246) 和 [#204](https://github.com/HKUDS/Vibe-Trading/issues/204)）；后续测试已直接覆盖 background-result 与 auto-compact 两条 handoff 路径（[#251](https://github.com/HKUDS/Vibe-Trading/pull/251)）。
 <details>
 <summary>更早的更新</summary>
@@ -996,21 +996,25 @@ Vibe-Trading 是 **[HKUDS](https://github.com/HKUDS)** 智能体生态的一部
 
 感谢所有为 Vibe-Trading 做出贡献的人！
 
-近期 v0.1.9 周期贡献者与致谢：
+近期 v0.1.10 周期贡献者与致谢：
 
-- @toanalien — session JSONL 崩溃加固 (#147)、迭代预算用尽时优雅退出 (#148)、LLM 生成 signal engine 的预检校验 (#149)、跨浏览器 Full Report 链接 (#150)
-- @ai7eam-dev — 跨市场相关性时间戳对齐 (#158),以及会话运行状态指示器 + swarm 重试 (#159 → #160)
-- @shadowinlife — 通过 SSE/HTTP 的远程 MCP server (#125),以及 swarm worker 中 operator 配置的外部 MCP 工具 (#142)
-- @DoubleSky123 — 可配置 SSE idle timeout (#157)
-- @ArthurXi — Web composer 的 IME 回车提交处理 (#146)
-- @omcdecor-cyber — 上游任务失败时阻断下游的 swarm DAG (#145)
-- @Soli22de — 带强制随机对照的严格 alpha-bench (#143)
-- @ruok808 — CCXT loader 的 proxy 环境变量支持 (#126)
-- @faizack — 远程 Ollama base URL 规范化 (#129)
-- @fightZy — agent 会话历史加载修复 (#136)
-- @lcwSeven — alpha list 接口接受短 universe 名 (#137)
-- @Teerapat-Vatpitak — 解析后的 .env 来源日志 (#124)
-- @warren618 / Haozhe Wu — connector-first 券商 profile、Robinhood Agentic Trading 通道、Research Goal 运行时、swarm reconcile + retry_run、agent/cli 重构、mootdx loader、发布集成
+- @Hinotoi-agent — 一波安全加固：本地关停鉴权 (#241)、回环主机重绑定拒绝 (#242)、agent shell 工具显式开启 (#243)、设置写入鉴权 (#245)、mandate proposal-id 收敛 (#256)、持久记忆类型校验 (#257)、MCP swarm run-id 收敛 (#258)
+- @mvanhorn — 可选本地数据缓存 (#177)、Gemini thoughtSignature 经 OpenAI-compat 工具调用往返 (#176)、自定义数据源指南 (#194)、glm/zhipu provider 别名 + 模型名推断 (#247)
+- @gyx09212214-prog — loader 容忍畸形 crypto/RSSHub 超时环境变量 (#227、#240)、yfinance 包含请求的结束日期 (#226)、run-card 非有限指标的严格 JSON (#238)、ddgs 重试 fallback 覆盖 (#239)
+- @BillDin — 聊天界面显示 swarm agent 状态 (#188)、显式 preset 名处理 (#189)、swarm worker 的 loader 行情工具 (#199)、preset 上下文延续 (#200)
+- @Robin1987China — Research Autopilot 假设-目标桥 (#260)、本地 CSV/Parquet/DuckDB 数据加载器 (#252)、assistant-prefill 修复 + 可配置 Kimi User-Agent (#248)
+- @LemonCANDY42 — 只读运行时状态面板 (#210)、持久化 AgentLoop 用量产物 (#223)、可选 Run Detail 图表负载 (#225)
+- @zwrong — trace.jsonl 零截断 + offload 改造 (#206)、退出时显示 session-id + `resume <session-id>` (#218)
+- @forge-builder — AI 贡献者指南 (#173)、OpenClaw MCP 只读冒烟测试文档 (#165)
+- @skloxo — 中文 (zh-CN) 前端本地化（采纳自 #217）
+- @LeeCQiang — 全部 452 个 Alpha Zoo 因子的中文 docstring (#180)
+- @KaiLuettmann — 发布时发布 GHCR 预构建镜像 (#187)
+- @ngoanpv — 经 AgentLoop dict 路径保留 Gemini thought_signature (#184)
+- @ShahNewazKhan — 经 host.docker.internal 触达宿主 Ollama (#196)
+- @sambazhu — 前端同步已完成的聊天 attempts (#236)
+- @bhlt — baostock 原生代码格式支持 (#230)
+- @octo-patch — MiniMax M3 默认模型升级 (#162)
+- @warren618 / Haozhe Wu — 全球数据层（8 源 + 18 只读数据工具）、10 个券商 SDK 连接器、alpha compare 全栈、provider 可靠性大修、多引擎 web_search fallback、响应式 Stop + SSE 重连、发布集成
 
 <a href="https://github.com/HKUDS/Vibe-Trading/graphs/contributors">
   <img src="https://contrib.rocks/image?repo=HKUDS/Vibe-Trading" />
diff --git a/agent/SKILL.md b/agent/SKILL.md
index 3bea1661..449accb8 100644
--- a/agent/SKILL.md
+++ b/agent/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: vibe-trading
-version: 0.1.9
+version: 0.1.10
 description: Professional finance research toolkit — backtesting (7 engines + benchmark comparison panel), factor analysis, Alpha Zoo (452 pre-built alphas across qlib158/alpha101/gtja191/academic), options pricing, 79 finance skills, 29 multi-agent swarm teams, Trade Journal analyzer, and Shadow Account (extract → backtest → render) across 18 market-data sources (tushare, yfinance, okx, akshare, baostock, tencent, mootdx, ccxt, futu, local, eastmoney, sina, stooq, yahoo, plus optional-key finnhub/alphavantage/tiingo/fmp).
 dependencies:
   python: ">=3.11"
@@ -173,6 +173,7 @@ Use `load_skill(name)` to access full methodology docs with code templates.
 | `get_run_result` | Get final report and task summaries | None |
 | `list_runs` | List recent swarm runs with metadata | None |
 | `reap_stale_runs` | Finalize stale swarm runs | None |
+| `retry_run` | Re-run a failed/stale swarm run | LLM key |
 | `trading_connections` | List selectable connector profiles | None |
 | `trading_select_connection` | Select the default connector profile | None |
 | `trading_check` | Check connector readiness | Connector app/OAuth |
diff --git a/agent/api_server.py b/agent/api_server.py
index 25eb964e..f6d76620 100644
--- a/agent/api_server.py
+++ b/agent/api_server.py
@@ -29,6 +29,7 @@ from pydantic import BaseModel, Field
 from fastapi.middleware.cors import CORSMiddleware
 from rich.console import Console
 
+from cli._version import __version__ as APP_VERSION
 from src.goal.context import default_goal_criteria
 from src.ui_services import build_run_analysis, load_run_context
 
@@ -465,7 +466,7 @@ class LiveStatusResponse(BaseModel):
 app = FastAPI(
     title="Vibe-Trading API",
     description="Vibe-Trading API: natural-language finance research, backtesting, and swarm workflows",
-    version="5.0.0",
+    version=APP_VERSION,
     docs_url="/docs",
     redoc_url="/redoc"
 )
@@ -1732,7 +1733,7 @@ async def api_info():
     """Service metadata."""
     return {
         "service": "Vibe-Trading API",
-        "version": "5.0.0",
+        "version": APP_VERSION,
         "docs": "/docs",
         "health": "/health",
     }
diff --git a/agent/mcp_server.py b/agent/mcp_server.py
index 7cf40fb6..067f7c3d 100644
--- a/agent/mcp_server.py
+++ b/agent/mcp_server.py
@@ -54,6 +54,7 @@ if str(AGENT_DIR) not in sys.path:
     sys.path.insert(0, str(AGENT_DIR))
 
 from fastmcp import Context, FastMCP
+from cli._version import __version__ as APP_VERSION
 from src.market_data import (
     DEFAULT_MAX_ROWS,
     cap_rows,
@@ -62,7 +63,7 @@ from src.market_data import (
     get_loader,
 )
 
-mcp = FastMCP("Vibe-Trading")
+mcp = FastMCP("Vibe-Trading", version=APP_VERSION)
 
 logger = logging.getLogger(__name__)
 
diff --git a/agent/requirements.txt b/agent/requirements.txt
index 4302d3c7..ae2d81c6 100644
--- a/agent/requirements.txt
+++ b/agent/requirements.txt
@@ -47,7 +47,7 @@ python-multipart>=0.0.18
 sse-starlette>=1.6.0
 
 # MCP Server
-fastmcp>=2.0.0
+fastmcp>=2.14.0
 
 # Web Search
 ddgs>=6.0.0
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index baf34f60..ec9b2bad 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "vibe-trading-frontend",
-  "version": "0.1.7",
+  "version": "0.1.10",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "vibe-trading-frontend",
-      "version": "0.1.7",
+      "version": "0.1.10",
       "dependencies": {
         "clsx": "^2.1.0",
         "echarts": "^6.0.0",
diff --git a/frontend/package.json b/frontend/package.json
index f3b58d09..00e59596 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,7 +1,7 @@
 {
   "name": "vibe-trading-frontend",
   "private": true,
-  "version": "0.1.7",
+  "version": "0.1.10",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/frontend/src/components/layout/Layout.tsx b/frontend/src/components/layout/Layout.tsx
index 13c6adf3..8ab8c46c 100644
--- a/frontend/src/components/layout/Layout.tsx
+++ b/frontend/src/components/layout/Layout.tsx
@@ -9,7 +9,7 @@ import { useAgentStore } from "@/stores/agent";
 import { ConnectionBanner } from "@/components/layout/ConnectionBanner";
 
 // Bump on each release; one place keeps the footer in sync with package.json.
-const APP_VERSION = "v0.1.9";
+const APP_VERSION = "v0.1.10";
 
 export function Layout() {
   const { t, i18n: i18nHook } = useTranslation();
diff --git a/frontend/src/i18n/locales/en.json b/frontend/src/i18n/locales/en.json
index 9831f676..eb05358c 100644
--- a/frontend/src/i18n/locales/en.json
+++ b/frontend/src/i18n/locales/en.json
@@ -1,6 +1,6 @@
 {
   "app": {
-    "version": "v0.1.9"
+    "version": "v0.1.10"
   },
   "layout": {
     "home": "Home",
diff --git a/frontend/src/i18n/locales/zh-CN.json b/frontend/src/i18n/locales/zh-CN.json
index 06bc07e3..9d2a5847 100644
--- a/frontend/src/i18n/locales/zh-CN.json
+++ b/frontend/src/i18n/locales/zh-CN.json
@@ -1,6 +1,6 @@
 {
   "app": {
-    "version": "v0.1.9"
+    "version": "v0.1.10"
   },
   "layout": {
     "home": "首页",
diff --git a/pyproject.toml b/pyproject.toml
index 56406024..603ead9c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "vibe-trading-ai"
-version = "0.1.9"
+version = "0.1.10"
 description = "Natural-language finance research AI agent with backtesting"
 requires-python = ">=3.11"
 license = "MIT"
@@ -50,7 +50,7 @@ dependencies = [
     "pydantic>=2.0.0",
     "python-multipart>=0.0.18",
     "sse-starlette>=1.6.0",
-    "fastmcp>=2.0.0",
+    "fastmcp>=2.14.0",
     "ddgs>=6.0.0",
     "jinja2>=3.1.0",
     "matplotlib>=3.7.0",
@@ -81,6 +81,7 @@ include = ["src*", "backtest*", "cli*"]
     "skills/**/*.md",
     "skills/**/*.yaml",
     "skills/**/*.json",
+    "skills/**/*.py",
     "providers/*.json",
     "swarm/presets/*.yaml",
     "shadow_account/templates/*.j2",