Covers both of today's sessions. The first one's work had not been announced
at all: the grounding masks for scores/windows/indicators and for year-less
dates, the HK fallback routing repair, and four contributor merges.
Keeps three entries visible and moves 2026-08-04 into the collapsed section,
per the convention the other four READMEs already follow.
The sandbox sentence states that both vectors were accepted before, which is
measured against the live scanner rather than asserted, and says src.quantlib
still imports so the line does not read as though the maths layer went with
them.
Brings in #976. qveris_search / qveris_inspect / qveris_execute join the
key-gated wrapper family beside get_macro_series and iwencai_search, so an
install without QVeris routing gets the tool's own envelope naming
QVERIS_API_KEY and the paid-mode switch rather than a generic "Tool not
found". Also splits that message in two: a missing key and a present key with
paid mode off are different problems with different fixes.
qveris_execute takes tool_id / parameters / search_id / session_id / model /
max_response_size, and deliberately NOT expected_cost or billing_rule. Those
two are the caller-supplied quote that used to short-circuit the marketplace
price lookup (fixed in b4e48039); that fix means an understating quote can no
longer buy a free pass, but the external MCP surface is an arbitrary client
rather than our own agent, so the arguments stay off it entirely. That is the
only substantive difference from #977, which is otherwise equivalent work.
Merged by hand rather than by rebase request because every conflict was in a
count that had moved underneath the PR: the tool surface is 62, not the 58 it
was written against, and the five READMEs had gained
get_institutional_holdings / etf_holdings / prediction_market /
research_papers - which a straight merge would have deleted from those lists,
along with the SWARM external-MCP section in the zh/ja/ko/ar READMEs.
The count assertion in the new MCP test now reads the claim out of
mcp_server's module docstring and compares it against the live surface. That
literal was written as 55, shipped as 58, and was 59 on arrival, so it was a
number nobody was going to maintain by hand; the test now pins that the
docstring and the surface agree, whatever they say.
Co-authored-by: shadowinlife <shadowinlife@gmail.com>
* fix(data): route market-data fallback by the symbol's market
get_market_data picked the fallback chain by source name alone, and
"yahoo" matched the us_equity chain first, so .HK symbols exhausted the
3-attempt budget on the US-only stooq/sina loaders and never reached
eastmoney/akshare — HK fetches failed outright where Yahoo is blocked
(#998).
- resolve the fallback chain from the symbol's market, keeping the old
first-match lookup for sources outside that market's chain
- group fetches by (source, market) so mixed-market requests each walk
their own chain
- hk_equity chain: akshare (Eastmoney-backed, never IP-banned) now
precedes the Yahoo-SDK family; tushare hk_daily joins after the free
sources (the tushare loader now declares hk_equity)
- default max_fallback_attempts 3 -> 5 so akshare is reachable within
the budget
Backtest auto routing already walked the full per-market chain and is
unchanged. tencent HK support is tracked in #999.
Signed-off-by: shadowinlife <shadowinlife@gmail.com>
* feat(data): tencent loader HK support, head of the hk_equity chain
Tencent's ifzq.gtimg.cn endpoint serves HK daily bars through the same
fqkline API as A-shares (hk00700 symbol form), and the source has no
observed IP ban — the most reliable mainland-reachable HK source (#999).
- map NNNNN.HK to hkNNNNN (zero-padded) and parse the shared fqkline
response; daily bars only, matching the loader's A-share contract
- declare hk_equity on the tencent loader
- lead the hk_equity chain with tencent and route .HK auto-detection
to it, consistent with the A-share routing
Signed-off-by: shadowinlife <shadowinlife@gmail.com>
---------
Signed-off-by: shadowinlife <shadowinlife@gmail.com>
Until now the five files documented different products. English was missing
the MetaTrader 5 connector entirely while its own tables advertised MT5; the
four translations were missing the Longbridge setup while their data-source
tables advertised longbridge; and the whole MCP-client half of the product —
how to point the built-in agent at your own MCP servers, the IBKR read-only
OAuth probe, the local TWS path, TAP credential isolation, the config
reference and the v1 limits — existed only in English, as did the SWARM
external-tool allowlist that explains why caller-supplied variables cannot
inject an MCP URL.
All five files now carry the same fifty-two headings at the same levels in the
same order.
The new English MT5 section is translated from the Chinese one, so it was
checked against the connector rather than trusted: the four profiles, the
per-call demo/live re-verification, the guards, lot sizing, the hedging-account
close path and the loader's config sharing all match the code. Two claims did
not survive that check and are corrected in every locale:
* the guards are per-order size limits, not position limits — nothing caps
accumulated exposure on a paper profile, and "position guards" invited the
opposite reading. Chinese had said 仓位护栏 since the section was written;
Japanese, Korean and Arabic had it right.
* `close_position` was offered as a way to close a hedge, but it has no
user-facing path: `service.py` dispatches only place and cancel, and the
agent surface is `trading_place_order` / `trading_cancel_order`. The
ticket-pinned `trading_cancel_order` route, which does work, is what remains.
Also backported the guard's fail-closed behaviour on an unpriceable notional
to the four translations, which had dropped it.
The slash-command table was the worst of it. It documented seven commands
the router does not resolve — `/skills`, `/list`, `/code`, `/trace`,
`/continue`, `/sessions`, `/settings` — which survive only in the legacy REPL
reached when prompt_toolkit fails to import, and it omitted twenty-one real
ones including the `/halt` kill switch. All five tables are now generated from
`SLASH_COMMANDS`: same twenty-seven commands, same order, descriptions taken
from the code.
Corrections, each checked against the code rather than against another
document:
* "18 read-only data tools" is 22, and the sentence listed only 17 labels,
missing `get_stock_profile` and `iwencai_search` on top of the four that
landed yesterday.
* The skill count was 88 in six places per file and the Analysis category row
said 22; the loader reports 89 and the frontmatter tally gives analysis 23.
* "Each connector does read + paper-account order placement" was wrong for
three of twelve. IBKR is read-only, Trading 212 refuses order placement
outright, and Robinhood has exactly one profile and it is live — which
matters most of the three, since a reader who believes Robinhood has a
paper mode places a real order while trying to rehearse.
* The API endpoint table was missing the three playbook routes the section
goes on to curl forty lines later.
New documentation for what shipped yesterday: the five scheduled-research
templates with their CLI, REST and `/playbook` entry points; a capability-table
row for the institutional data tools; `vibe-trading playbook` in the CLI
reference.
Locale parity, all pre-existing: two Korean capability rows and the Japanese
broker-connector block were still in English; `provider doctor` was documented
only in English; Japanese used 定時リサーチ against the file's own 定期リサーチ
everywhere else. The Chinese and Japanese renderings of `/memo`'s "variant
view" both said "a changing/variable perspective" rather than a view that
differs from consensus.
Three section-level gaps are deliberately left alone: "Using Longbridge
explicitly" (en/zh only), "MetaTrader 5" (missing from en), and the two
MCP-client sections (en only). They predate this work and come to roughly 340
lines of translation, which is not something to land unreviewed.
The entry ran 2,569 characters in English against roughly 1,250 for the two
below it, and worse in the translations. The convention is about three lines
per entry; this one narrated every design decision instead of saying what
shipped. It keeps the four tools, the one number worth quoting (342 positions
at 98.7% of net assets, against a quarterly top ten), and a single closing
clause for the templates, commands, lenses and agent core.
The institutional-holdings / ETF-look-through / prediction-market / research
entry was written on 2026-08-04 but merged and pushed on 2026-08-05. The news
section records when something became available to readers, so it takes the
landing date. This also separates it from the correctness-pass entry, which
really did ship on 08-04 and keeps its date.
Every README stated an MCP tool count in three places, and all three had
drifted: the prose said 54, the enumerated list said 55 in English and 54
elsewhere, and the repository tree already said 59. The real number is 59.
The four non-English lists were also missing `analyze_options_payoff`, which
landed on 2026-08-01, on top of the four data tools from yesterday. The skills
badge said 88 across all five files and has said so since `investor-lenses`
shipped.
The counts a reader uses to size up the project are exactly the ones nobody
notices going stale, so they now have a test. It reads the numbers back out of
all five READMEs and compares them with what the code ships — MCP tools by
name and by count, bundled skills, swarm presets, alphas, engines.
The checks anchor on structure rather than wording, since four of the five
files are translated: the tool list is the line with the most backticked
identifiers, the badges are the ones inside a <summary>, and the MCP paragraph
is the non-news line mentioning stdio. Two anchors that looked obvious are
wrong and are documented in the module: a 2026-04-14 news entry also mentions
stdio, and the loose "Plus 20+ specialist presets" badge wraps onto its own
line in English but not in the other four, which puts bare <sub> counting out
of step across locales.
Institutional holdings, ETF look-through, prediction markets and
research papers were reachable from the agent and the CLI but not from
MCP, so OpenClaw and Claude Desktop could not use them. MCP goes from
55 tools to 59.
Schemas are read off the tool classes rather than restated here, so the
MCP surface cannot drift from the agent surface as the tools change.
A regression test pins the order-placing tools as absent from MCP.
Covers the four new read-only data tools, the five research playbooks,
the six institutional commands, the investor lenses skill, and the
agent-core output principles plus progressive skill loading.
Each locale keeps three entries above the fold, so the 2026-08-02 row
moves into the folded section.
Covers the SEC period-span fix, A-share corporate-action adjustment,
point-in-time CSI300 membership, the mixed-currency composite guard, the
option-leg volatility fix, whole-record paging of oversized tool results,
and the new tracking-error and benchmark-beta metrics. 2026-08-01 moves into
the collapsed Earlier-news block so three entries stay visible.
A run_dir outside the sandbox was refused with only the name of an
environment variable, so the user had no way to see where the boundary
actually was. Under an MCP client it was a dead end in a second way: the
client spawns the server itself, so exporting the variable in a shell
never reaches it, and none of the READMEs documented an env block for the
MCP config.
Rejections from safe_run_dir, safe_run_id, and the import-root helper now
list the roots that are allowed and say where the variable belongs under
an MCP client. All five READMEs document the env block in the MCP Plugin
section, with VIBE_TRADING_ALLOWED_RUN_ROOTS as the worked example.
Closes#963
Evaluate cron schedules in typed IANA zones with documented DST gap/fold semantics, preserve legacy UTC and interval behavior, and add Scheduled Research Web/i18n/docs coverage.
Closes#953.
* fix: store session and run history under the user runtime root, not the code (#904)
Sessions, runs, swarm runs, and uploads were resolved relative to the
installed code, so a pip install wrote user history into site-packages
(lost on upgrade) and dev checkouts partitioned history per clone.
- src/config/paths.py: VIBE_TRADING_HOME env override for
get_runtime_root() (explicit config_path still wins), plus
get_sessions_dir / get_runs_dir / get_swarm_runs_dir / get_uploads_dir
as the single source of truth.
- Redirect every code-relative definition site: cli/_legacy.py,
src/agent/loop.py, src/api/helpers.py, src/api/uploads_routes.py,
src/swarm/store.py (swarm_runs_root), src/tools/swarm_tool.py, and
the TraceWriter.find_trace_dir defaults. .swarm/runs becomes
swarm/runs under the already-hidden runtime root.
- src/config/migrate.py: idempotent one-time move of legacy
<install>/{sessions,runs,.swarm/runs,uploads} into the runtime root,
wired into the CLI entry, api_server startup, and vibe-trading-mcp;
when both sides hold data the new location wins and the legacy dir is
left in place with a warning, never silently merged.
- path_utils: browser-upload handles (uploads/<name>) resolve to the
user-level uploads dir, and the file/write/run sandbox allow-lists
follow VIBE_TRADING_HOME.
- Welcome banner Workspace row now reports the runtime root, so the UI
shows which store is active.
Fixes#904.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: close the gaps a local multi-agent review of #925 found
- Redirect the eighth definition site the first pass missed:
src/api/swarm_routes.py built its SwarmStore from the code-relative
.swarm/runs, so API-started swarms still wrote into site-packages,
split from CLI/MCP history, and landed outside the run-root sandbox
allow-list (P03-A regression). It now shares swarm_runs_root().
- Rework migration to child-level merges: autopilot runs and channel
media already populate ~/.vibe-trading/{runs,uploads}, so the old
whole-directory "both non-empty -> skip" rule silently stranded all
legacy history for those users. Each session/run/upload entry now
moves individually via a .migrating-* staging name plus atomic
rename (interrupted moves are recovered, never surfaced half-copied),
only same-named entries are skipped, a directory containing
__init__.py is never touched (site-packages/runs may be someone
else's distribution), one failing directory no longer blocks the
rest, and the emptied legacy .swarm shell is removed.
- Route the sessions.db FTS index, the goal store default, and the CLI
banner probe through get_runtime_root() so VIBE_TRADING_HOME no
longer splits the index from the sessions it indexes.
- Reject UNC paths in VIBE_TRADING_HOME, matching the hardening on the
other root-widening env vars, and keep legacy agent/.swarm/runs in
the run-root allow-list like the other legacy roots.
- Correct the .env.example rationale (constants bind at process start,
before .env is read), scope the README claim to what actually
relocates, sync the zh/ja/ko/ar READMEs, and refresh stale docstrings.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
News entry across all five READMEs: the WebUI overhaul, LLM session
titles, Korea (KRX) equity, the OpenBB Workspace bridge, the Taiwan
snapshot tool, execution-time price bands, one-run-per-session, and the
trace/redaction/fail-closed batch. 07-27 rolls into <details>.
The body was stale the moment KRX landed, so it is corrected here too:
markets list gains India and Korea, free data sources 22 -> 23 with a
pykrx row and a Korea fallback chain, backtest engines 8 -> 9 with a
KoreaEquity row, VIBE_TW_STOCK_DB and VIBE_TRADING_EXTRA_CORS_ORIGINS
join the env table, the API table gains /sessions/{id}/cancel,
/sessions/{id}/title/auto, /correlation/regime and the OpenBB bridge
routes, and the project tree reads 8 engines / 24 sources.
React Router 8 requires Node >=22.22.0, so `npm install` now fails for anyone
still on Node 20 with an error that does not name the cause. Declare it in
package.json engines, and say it on the Quick Start line that tells people to
run it, in all five READMEs.
CMD has no `cp`, so `cp agent/.env.example agent/.env` fails there; add the
`copy` form and note that PowerShell's `cp` alias already works. Also add the
CMD activation line and the execution-policy hint that blocks Activate.ps1.
Reported by @brady-cec in discussion #29.
Add task-scoped cancellation, reject broad Python process-name kills, expose timeout context, and cover the lifecycle on Windows 11 and Windows x64 with Python 3.14.
Signed-off-by: Haozhe Wu <haozhe_wu@connect.hku.hk>
Add the v0.1.12 cycle cohort (28 contributors) and demote the v0.1.11 list
into a collapsible block, in en/ja/ko/zh/ar. en/ja/ko keep English
descriptions; zh/ar translated.
MCP stdio previously force-enabled bash/background_run with no opt-out and the
module-level default was fail-open. Default to fail-closed and gate every
transport behind explicit opt-in (--enable-shell-tools flag or
VIBE_TRADING_ENABLE_SHELL_TOOLS). Local CLI is unaffected (still opts in
explicitly). Also shrinks the network-reachable surface of the bash
OS-command-injection sink (GHSA-m768). Adds regression tests + doc alignment.
Add --transport http exposing the MCP Streamable HTTP transport (spec 2025-03-26+) as a single POST/GET /mcp endpoint, alongside the existing stdio and legacy SSE transports. The legacy sse transport is unchanged.
Modern clients (e.g. QwenPaw) negotiate by POSTing an InitializeRequest; the deprecated two-endpoint SSE transport rejects that POST on /sse with 405 Method Not Allowed. Streamable HTTP accepts POST on its single endpoint.
FastMCP 3.4.4 (already a dependency) provides the transport via mcp.run(transport=streamable-http). Adds a --host option scoped to the http transport (default 127.0.0.1).
Signed-off-by: HUANG Cheng <cheng@duck.com>
Covers issue #476 (all 10 audit findings), #377/#478/#480/#487/#479/#484.
Propagated to all 5 locale READMEs' News section (3 visible + moved
2026-07-10 into <details>, per convention).
Adds Frazzini-Pedersen (2014) "Betting Against Beta" to the academic zoo,
following the existing OHLCV-only proxy pattern: rolling 252-day per-stock
beta against an equal-weighted cross-sectional market return, cross-sectional
z-scored negative (so low-beta names rank highest, matching the long leg of
the original long-short construction). Proxy limitations vs. the original
(equal- vs value-weighted market, single window vs separate 1y-vol/5y-corr,
no explicit leverage) are disclosed in both the module docstring and
academic/LICENSE.md, matching the zoo's existing disclosure convention.
Verified locally: full purity + lookahead suites green (923 passed, 5
pre-existing skips), env-var CI gate passes, ruff clean.
One thing the PR's own test plan missed (it only ran the purity/lookahead
suites): SKILL.md has a manifest guard test
(test_alpha_zoo_counts_match_factor_modules) asserting the documented alpha
count matches the actual factor-module count. Adding a 461st alpha without
updating it fails that test. Folded in a fix bumping the count in SKILL.md
(460->461, academic 10->11) and propagated to all 5 locale READMEs' current-
state references (left the historical changelog entries describing past
counts untouched).
Co-authored-by: Yogesh Modi <YogeshModi24@users.noreply.github.com>
zh/ja/ko/ar gain the mt5 data-source table row, the forex/metals
fallback-chain bullet, the source-count bump (19 -> 20), and the full
translated MetaTrader 5 connector section. zh/ja/ko/ar lack the English
MCP Client Mode chapter, so the connector section anchors at the end of
the MCP Plugin section in all four (consistent placement). Also bumps
the QVeris paragraph built-in-source count to 20 in all 5 READMEs.
Signed-off-by: staniell <giostaniell12@gmail.com>
GitHub restricted the stargazers API on 2026-06-30 to repo admins/
collaborators only; api.star-history.com's SVG badge renders server-side
and can't authenticate as a collaborator on every embedding repo, so the
badge now fails with a server timeout instead of rendering (confirmed
live, no fix path per star-history.com's own postmortem).
cgycorey