chore: bump to 0.1.5 + CVE floor

- pyproject.toml 0.1.4 -> 0.1.5; python-multipart >=0.0.18 (CVE floor)
- agent/requirements.txt: parity with pyproject (9 deps: openpyxl,
  python-docx, python-pptx, pypdfium2, Pillow, ddgs, jinja2, matplotlib,
  weasyprint) so Docker build no longer misses runtime deps
- agent/cli.py: _VERSION 0.1.0 -> 0.1.5 (banner)
- agent/SKILL.md: version 0.1.5; 22 MCP tools; 71 skills
- agent/mcp_server.py: expose analyze_trade_journal + 4 shadow-account
  tools; fix pattern_recognition -> pattern registry name
- frontend/package.json, package-lock.json, Layout.tsx sidebar: 0.1.0 -> 0.1.5
- .github/ISSUE_TEMPLATE/bug_report.yml: version placeholder 0.1.3 -> 0.1.5

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -67,7 +67,7 @@ body:
     attributes:
       label: Version
       description: "Run `pip show vibe-trading-ai` to check"
-      placeholder: "e.g., 0.1.3"
+      placeholder: "e.g., 0.1.5"
 
   - type: input
     id: environment

agent/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: vibe-trading
-version: 0.1.4
-description: Professional finance research toolkit — backtesting (7 engines), factor analysis, options pricing, 69 finance skills, and 29 multi-agent swarm teams across 5 data sources (tushare, yfinance, okx, akshare, ccxt).
+version: 0.1.5
+description: Professional finance research toolkit — backtesting (7 engines), factor analysis, options pricing, 71 finance skills, 29 multi-agent swarm teams, Trade Journal analyzer, and Shadow Account (extract → backtest → render) across 5 data sources (tushare, yfinance, okx, akshare, ccxt).
 dependencies:
   python: ">=3.11"
   pip:
@@ -11,7 +11,7 @@ env:
     description: "Tushare API token for China A-share data (optional — HK/US/crypto work without any key)"
     required: false
   - name: OPENAI_API_KEY
-    description: "OpenAI-compatible API key — only needed for run_swarm (multi-agent teams). All other 16 tools work without it."
+    description: "OpenAI-compatible API key — only needed for run_swarm (multi-agent teams). All other tools work without it."
     required: false
   - name: LANGCHAIN_MODEL_NAME
     description: "LLM model name for run_swarm (e.g. deepseek/deepseek-v3.2). Only needed if using run_swarm."
@@ -23,7 +23,7 @@ mcp:
 
 # Vibe-Trading
 
-Professional finance research toolkit with AI-powered backtesting (7 engines), multi-agent teams, and 69 specialized skills.
+Professional finance research toolkit with AI-powered backtesting (7 engines), multi-agent teams, 71 specialized skills, and the Shadow Account loop — extract your implicit trading rules from a journal, backtest them across A股/港股/美股/crypto, then see where they would have served you better.
 
 ## Setup
 
@@ -53,7 +53,7 @@ Add to your agent's MCP config:
 
 ### API Key Requirements
 
-**16 of 17 MCP tools work with zero API keys.** After `pip install`, backtesting, market data, factor analysis, options pricing, chart patterns, web search, and all 69 skills are ready to use for HK/US equities and crypto.
+**21 of 22 MCP tools work with zero API keys.** After `pip install`, backtesting, market data, factor analysis, options pricing, chart patterns, web search, document reading, trade journal analysis, shadow-account extraction/backtest/report, and all 71 skills are ready to use for HK/US equities and crypto.
 
 | Feature | Key needed | When |
 |---------|-----------|------|
@@ -63,6 +63,15 @@ Add to your agent's MCP config:
 
 ## What You Can Do
 
+### Shadow Account — flagship loop
+
+Feed a CSV broker export (同花顺 / 东财 / 富途 / generic), and the agent will:
+1. `analyze_trade_journal` — profile your behavior (holding period, win rate, disposition effect, chasing, overtrading, anchoring).
+2. `extract_shadow_strategy` — distill 3-5 if-then rules that describe your profitable roundtrips.
+3. `run_shadow_backtest` — backtest those rules across A/HK/US/crypto and compute delta-PnL vs your realized trades.
+4. `render_shadow_report` — produce an HTML/PDF report (8 sections + charts) with today's matching signals.
+5. `scan_shadow_signals` — list today's symbols that match your shadow's entry cadence (research only).
+
 ### Backtesting
 Create and run quantitative strategies across 7 engines (ChinaA, GlobalEquity, Crypto, ChinaFutures, GlobalFutures, Forex + options) with 5 data sources:
 - **HK/US equities** via yfinance (free, no API key)
@@ -89,23 +98,24 @@ Example workflow:
 
 Use `list_swarm_presets()` to see all teams, then `run_swarm()` to execute.
 
-### Finance Skills (68)
+### Finance Skills (71)
 Comprehensive knowledge base covering:
-- Technical analysis (candlestick, Elliott wave, Ichimoku, SMC)
-- Quantitative methods (factor research, ML strategy, pair trading)
+- Technical analysis (candlestick, Elliott wave, Ichimoku, SMC, harmonic, chanlun)
+- Quantitative methods (factor research, ML strategy, pair trading, multi-factor)
 - Risk management (VaR/CVaR, stress testing, hedging)
-- Options (Black-Scholes, Greeks, multi-leg strategies)
+- Options (Black-Scholes, Greeks, multi-leg strategies, payoff diagrams)
 - HK/US equities (SEC filings, earnings revisions, ETF flows, ADR/H-share arbitrage)
 - Crypto trading desk (funding rates, liquidation heatmaps, stablecoin flows, token unlocks, DeFi yields)
+- Behavioral finance, trade journal diagnostics, shadow account
 - Macro analysis, credit research, sector rotation, and more
 
 Use `load_skill(name)` to access full methodology docs with code templates.
 
-## Available MCP Tools (17)
+## Available MCP Tools (22)
 
 | Tool | Description | API Key |
 |------|-------------|---------|
-| `list_skills` | List all 69 finance skills | None |
+| `list_skills` | List all 71 finance skills | None |
 | `load_skill` | Load full skill documentation | None |
 | `backtest` | Run vectorized backtest engine | None* |
 | `factor_analysis` | IC/IR analysis + layered backtest | None* |
@@ -114,9 +124,14 @@ Use `load_skill(name)` to access full methodology docs with code templates.
 | `get_market_data` | Fetch OHLCV data across 5 sources (auto-detect + fallback) | None* |
 | `web_search` | Search the web via DuckDuckGo | None |
 | `read_url` | Fetch web page as Markdown | None |
-| `read_document` | Extract text from PDF (with OCR) | None |
+| `read_document` | Extract text from PDF/DOCX/XLSX/PPTX/images | None |
 | `write_file` | Write files (config, strategy code) | None |
 | `read_file` | Read file contents | None |
+| `analyze_trade_journal` | Parse broker CSV → profile + behavior diagnostics | None |
+| `extract_shadow_strategy` | Distill 3-5 if-then rules from profitable roundtrips | None |
+| `run_shadow_backtest` | Multi-market backtest + delta-PnL attribution | None* |
+| `render_shadow_report` | HTML/PDF shadow report (8 sections + charts) | None |
+| `scan_shadow_signals` | Today's symbols matching the shadow's cadence | None |
 | `list_swarm_presets` | List multi-agent team presets | None |
 | `run_swarm` | Execute a multi-agent research team | LLM key |
 | `get_swarm_status` | Poll swarm run status without blocking | None |
@@ -131,13 +146,16 @@ Use `load_skill(name)` to access full methodology docs with code templates.
 pip install vibe-trading-ai
 ```
 
-That's it — no API keys needed for HK/US/crypto markets. Start using `backtest`, `get_market_data`, `analyze_options`, `web_search`, and all 69 skills immediately.
+That's it — no API keys needed for HK/US/crypto markets. Start using `backtest`, `get_market_data`, `analyze_options`, `analyze_trade_journal`, `extract_shadow_strategy`, `web_search`, and all 71 skills immediately.
 
 ## Examples
 
 **Backtest a MACD strategy on Apple:**
 > Backtest AAPL with MACD crossover strategy (fast=12, slow=26, signal=9) for 2024
 
+**Analyze my trade journal and build a Shadow Account:**
+> Call analyze_trade_journal on ~/Downloads/tonghuashun.csv, then extract_shadow_strategy with min_support=3, then run_shadow_backtest for the last year, then render_shadow_report.
+
 **Run an investment committee review:**
 > Use run_swarm with investment_committee preset to evaluate NVDA. Variables: target=NVDA.US, market=US
 

agent/cli.py

@@ -51,7 +51,7 @@ EXIT_RUN_FAILED = 1
 EXIT_USAGE_ERROR = 2
 RICH_TAG_PATTERN = re.compile(r"\[/?[^\]]+\]")
 
-_VERSION = "0.1.0"
+_VERSION = "0.1.5"
 
 # Agent color assignments for swarm display
 _AGENT_STYLES = ["cyan", "magenta", "green", "yellow", "blue", "bright_red", "bright_cyan", "bright_magenta"]

agent/mcp_server.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Vibe-Trading MCP Server — expose 17 finance research tools to any MCP client.
+"""Vibe-Trading MCP Server — expose 22 finance research tools to any MCP client.
 
 Works with OpenClaw, Claude Desktop, Cursor, and any MCP-compatible client.
 Zero API key required for HK/US/crypto markets (yfinance, OKX, AKShare are free).
@@ -75,7 +75,7 @@ def _get_registry():
 def list_skills() -> str:
     """List all available finance skills with names and descriptions.
 
-    Returns a JSON array of {name, description} for all 68 skills.
+    Returns a JSON array of {name, description} for all 71 skills.
     Use load_skill(name) to get the full documentation for any skill.
     """
     loader = _get_skills_loader()
@@ -213,7 +213,7 @@ def pattern_recognition(run_dir: str) -> str:
         run_dir: Path to run directory containing artifacts/ohlcv_*.csv.
     """
     registry = _get_registry()
-    return registry.execute("pattern_recognition", {"run_dir": run_dir})
+    return registry.execute("pattern", {"run_dir": run_dir})
 
 
 # ---------------------------------------------------------------------------
@@ -537,6 +537,156 @@ def list_runs(limit: int = 20) -> str:
     return json.dumps(items, ensure_ascii=False, indent=2)
 
 
+# ---------------------------------------------------------------------------
+# Trade journal tool
+# ---------------------------------------------------------------------------
+
+@mcp.tool
+def analyze_trade_journal(
+    file_path: str,
+    analysis_type: str = "full",
+    filter_expr: str = "",
+) -> str:
+    """Analyze a user's trade journal (CSV/Excel broker export) and return
+    a trading profile plus behavior diagnostics.
+
+    Parses 同花顺 / 东方财富 / 富途 / generic formats (encoding auto-detected).
+    Output (JSON):
+      - profile: holding days, frequency, win rate, PnL ratio, top symbols,
+                 market distribution, hourly distribution
+      - behaviors: disposition effect, overtrading, chasing momentum,
+                   anchoring (each with severity + numeric evidence)
+
+    Args:
+        file_path: Absolute path to the uploaded CSV/Excel file.
+        analysis_type: "full" | "profile" | "behavior" | "strategy".
+        filter_expr: Optional filter (e.g. "2026-01 to 2026-03",
+                     "symbol=600519.SH", "market=china_a").
+    """
+    registry = _get_registry()
+    return registry.execute("analyze_trade_journal", {
+        "file_path": file_path,
+        "analysis_type": analysis_type,
+        "filter_expr": filter_expr,
+    })
+
+
+# ---------------------------------------------------------------------------
+# Shadow Account tools (4)
+# ---------------------------------------------------------------------------
+
+@mcp.tool
+def extract_shadow_strategy(
+    journal_path: str,
+    min_support: int = 3,
+    max_rules: int = 5,
+) -> str:
+    """Extract a Shadow Account profile (3-5 human-readable if-then rules)
+    from the user's profitable roundtrips in a trade journal.
+
+    Run `analyze_trade_journal` first if the journal hasn't been parsed.
+    Returns shadow_id + rules preview. Profile persists to
+    ~/.vibe-trading/shadow_accounts/.
+
+    Args:
+        journal_path: Path to the CSV/Excel broker export.
+        min_support: Minimum profitable roundtrips required to back one rule.
+        max_rules: Maximum rules to return (typically 3-5).
+    """
+    registry = _get_registry()
+    return registry.execute("extract_shadow_strategy", {
+        "journal_path": journal_path,
+        "min_support": min_support,
+        "max_rules": max_rules,
+    })
+
+
+@mcp.tool
+def run_shadow_backtest(
+    shadow_id: str,
+    window_start: str = "",
+    window_end: str = "",
+    markets: list[str] | None = None,
+    journal_path: str = "",
+) -> str:
+    """Run a multi-market backtest (A股/港股/美股/crypto) on a Shadow Account
+    profile and compute delta-PnL attribution vs the user's realized trades.
+
+    Requires `extract_shadow_strategy` to have run first.
+
+    Args:
+        shadow_id: ID returned by extract_shadow_strategy.
+        window_start: ISO date, default today-1y.
+        window_end: ISO date, default today.
+        markets: Subset of ["china_a", "hk", "us", "crypto"], default all four.
+        journal_path: Original journal path (enables attribution), optional.
+    """
+    registry = _get_registry()
+    params: dict[str, Any] = {"shadow_id": shadow_id}
+    if window_start:
+        params["window_start"] = window_start
+    if window_end:
+        params["window_end"] = window_end
+    if markets:
+        params["markets"] = markets
+    if journal_path:
+        params["journal_path"] = journal_path
+    return registry.execute("run_shadow_backtest", params)
+
+
+@mcp.tool
+def render_shadow_report(
+    shadow_id: str,
+    include_today_signals: bool = True,
+    window_start: str = "",
+    window_end: str = "",
+    journal_path: str = "",
+) -> str:
+    """Render the Shadow Account HTML/PDF report (8 sections + charts) for
+    a shadow_id. If no cached backtest, one is run automatically.
+
+    Args:
+        shadow_id: Shadow Account ID.
+        include_today_signals: Include today's market scan section.
+        window_start: Optional backtest window override.
+        window_end: Optional backtest window override.
+        journal_path: Original journal path (for attribution), optional.
+    """
+    registry = _get_registry()
+    params: dict[str, Any] = {
+        "shadow_id": shadow_id,
+        "include_today_signals": include_today_signals,
+    }
+    if window_start:
+        params["window_start"] = window_start
+    if window_end:
+        params["window_end"] = window_end
+    if journal_path:
+        params["journal_path"] = journal_path
+    return registry.execute("render_shadow_report", params)
+
+
+@mcp.tool
+def scan_shadow_signals(
+    shadow_id: str,
+    date: str = "",
+    per_market: int = 3,
+) -> str:
+    """List today's symbols that match the Shadow Account's entry cadence
+    (research use only — not a trade recommendation).
+
+    Args:
+        shadow_id: Shadow Account ID.
+        date: ISO YYYY-MM-DD target date, default today.
+        per_market: Max signals per market.
+    """
+    registry = _get_registry()
+    params: dict[str, Any] = {"shadow_id": shadow_id, "per_market": per_market}
+    if date:
+        params["date"] = date
+    return registry.execute("scan_shadow_signals", params)
+
+
 # ---------------------------------------------------------------------------
 # Entry point
 # ---------------------------------------------------------------------------

agent/requirements.txt

@@ -14,6 +14,13 @@ numpy>=1.24.0
 scipy>=1.10.0
 duckdb>=1.2.0
 
+# Document Readers (doc_reader_tool)
+openpyxl>=3.1.0
+python-docx>=1.1.0
+python-pptx>=0.6.23
+pypdfium2>=4.0.0
+Pillow>=10.0.0
+
 # ML Strategy
 scikit-learn>=1.3.0
 joblib>=1.3.0
@@ -33,8 +40,16 @@ ccxt>=4.0.0
 fastapi>=0.104.0
 uvicorn[standard]>=0.24.0
 pydantic>=2.0.0
-python-multipart>=0.0.6
+python-multipart>=0.0.18
 sse-starlette>=1.6.0
 
 # MCP Server
 fastmcp>=2.0.0
+
+# Web Search
+ddgs>=6.0.0
+
+# Shadow Account HTML/PDF Report
+jinja2>=3.1.0
+matplotlib>=3.7.0
+weasyprint>=60.0

frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "vibe-trading-frontend",
-  "version": "0.1.0",
+  "version": "0.1.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "vibe-trading-frontend",
-      "version": "0.1.0",
+      "version": "0.1.5",
       "dependencies": {
         "clsx": "^2.1.0",
         "echarts": "^6.0.0",

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "vibe-trading-frontend",
   "private": true,
-  "version": "0.1.0",
+  "version": "0.1.5",
   "type": "module",
   "scripts": {
     "dev": "vite",

frontend/src/components/layout/Layout.tsx

@@ -225,7 +225,7 @@ export function Layout() {
                   </button>
                 </div>
               </div>
-              <p className="text-xs text-muted-foreground/60">v0.1.0</p>
+              <p className="text-xs text-muted-foreground/60">v0.1.5</p>
             </>
           )}
         </div>

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "vibe-trading-ai"
-version = "0.1.4"
+version = "0.1.5"
 description = "Natural-language finance research AI agent with backtesting"
 requires-python = ">=3.11"
 license = "MIT"
@@ -46,7 +46,7 @@ dependencies = [
     "fastapi>=0.104.0",
     "uvicorn[standard]>=0.24.0",
     "pydantic>=2.0.0",
-    "python-multipart>=0.0.6",
+    "python-multipart>=0.0.18",
     "sse-starlette>=1.6.0",
     "fastmcp>=2.0.0",
     "ddgs>=6.0.0",