The 3.11 leg's pytest step took 520s of a job that ended at exactly the
10-minute limit (run 36553260060); the next push (36f1698e, run
36556726032) was cancelled at 99% of the suite with no failing test. The
suite fills the budget, and runner speed varies by minutes between runs of
the same tree.
Each section carried its own copy of the header: Home's nav had no Home,
the docs' nav had no Docs, the research post had no star or theme button,
and the generated Alpha Library pages had no header at all. Only the docs
could switch language, and they guessed Chinese from the browser while
every other page stayed English.
- partials/ holds one head block, header and footer; sync_site_chrome.py
writes them into every page between markers and, with --check in CI,
also requires <body data-section> (the current section is highlighted by
CSS), the language attributes and a single ?v= token site-wide. The
Alpha Library generator inserts the same partials.
- site.js is the shared shell (theme, stars, language, footer traffic on
home only). English is the HTML; Chinese comes from locales/zh.json via
data-i18n hooks, and check_i18n.py fails on a key with no Chinese or a
Chinese string nothing uses. A URL that names a language (/docs/zh/,
the two articles) shows it and remembers it; everything else follows the
stored choice, English by default. theme-init.js keeps a page hidden until
its Chinese text is in, so it never flashes English.
- English tutorial and Chinese research post added. The Chinese tutorial
gets the corrections its translation surfaced: 462 alphas in five zoos,
AAPL.US, the mandate caps trades per day (it has no daily loss limit),
Shadow Account extracts up to five rules, the web UI needs Docker or a
checkout.
- Alpha Library: the zoo pages were never deployed — content/ is
gitignored and nothing built it, so every zoo link served the root
redirect. The deploy now exports the manifest and renders the pages (and
redeploys when agent/src/factors changes); the fifth zoo, fundamental, is
listed; generated pages allow same-origin scripts only.
- Phones keep the nav as a scrollable row instead of hiding it.
The docs still described 0.1.11: seven engines, six data sources, a
Quick start whose `vibe-trading serve` step opens no UI after a PyPI
install. Every count on the pages is now measured from the code (28
sources, 11 engines, 90 skills, 30 presets, 74 MCP tools, 18 brokers,
462 alphas), and five pages are new: Troubleshooting (no_progress,
"0 steps", cut figures, bare US tickers), Checked numbers, Alpha Zoo,
Brokers and live trading, Web UI and API.
Chinese pages are served at /docs/zh/<page>. The header toggle switches
language and remembers it; a first visit from a Chinese browser opens
the Chinese pages. The version selector offered 0.1.7-0.1.11 while
rendering one content set; it now lists only 0.1.16.
wiki/scripts/check_docs_parity.mjs (run in CI) fails when the two
languages differ in pages, sections, order, empty fields or internal
links. A #section in a docs URL now scrolls to it.
Landing page: "Seven engines" -> eleven, the uv tab no longer ends in
`serve`, and a 中文文档 button.
Bound BaoStock messages and serialize SDK sessions; verify Copilot credential
lookup expiry without changing the SDK's per-call credential resolution.
Run public-loader health checks in isolated, credential-free processes and a
separate dependency environment, with explicit failure reports and a weekly
workflow. Render broker capabilities per profile and document verification
requirements. Update September 28 News in all seven README languages.
Closes#1626Closes#1623Closes#1617Closes#1492
Each of the three was merged on evidence I could not reach myself. This
replaces that trust with a test that runs on every platform, on every CI run.
1. Windows lock (#1261). The no-sentinel fix was unverifiable on POSIX —
msvcrt is None, so the branch never executes and a regression would be
invisible to Linux and macOS CI. tests/test_windows_lock_no_sentinel.py
swaps the module-level fcntl/msvcrt handles for stubs and drives the
Windows branch anywhere, asserting behaviour (an empty file stays empty,
the first ledger append succeeds and verify_chain passes) rather than
'was locking() called'. Restoring the sentinel in all three lock sites
fails 3 of the 4 tests, including the first-append regression itself.
2. Dividend cash column (#1356). A dividend row has no quantity and no price,
so 'amount or qty * price' collapses to 0.0 when the export books the
payout under a cash-movement heading instead of the fill column. That is a
silent zero — the shape #1207 item 15 is about. Dividend rows now also try
发生金额 / 资金发生额 / 红利金额 / 实发金额 / 税后金额 and Futu's net-amount
columns, across all four parsers; anything still zero is counted into a new
dividend_rows_missing_cash profile field so the caller can SEE that the
journal was read but the money was not.
3. Docker action majors (#1359). The v4/v6/v7 bump had never executed in this
repository: docker-build.yml is workflow_dispatch only, total_runs=0. Every
input the workflow passes was checked against each new major's action.yml
at the pinned SHA (13 inputs, all present; the two setup actions take none).
A validate-build job now runs the SAME pins with push: false on any change
to the Dockerfile, this workflow, or pyproject, and the publish job is
gated to workflow_dispatch so the new triggers cannot publish an image.
That gate is one 'if:' line, so it is pinned too — removing it, flipping
validate-build to push: true, or unpinning an action each fail a test.
The file comment claiming these majors were 'a deliberate, separately testable
bump, not a drive-by change here' contradicted the file after #1359 and is
replaced by what is actually true now.
The frontend job on be623c1b spent 357 of its 407 seconds inside `npm ci`; the
build it exists to run (tsc + vite) took 13. The install itself was never the
problem — the audit request npm makes after installing was:
npm warn audit 503 Service Unavailable -
POST https://registry.npmjs.org/-/npm/v1/security/advisories/bulk
npm notice This endpoint is being retired. Use the bulk advisory endpoint instead.
npm retries that call before printing "added 380 packages in 6m". Measured
locally against the same lock file with the same warm cache:
npm ci 61s
npm ci --no-audit --no-fund 4s
NPM_CONFIG_AUDIT=false NPM_CONFIG_FUND=false npm ci 4s
This is the same slowdown that timed out `test / Python 3.11` on 8555a05a, so
splitting the frontend into its own job treated the symptom; this is the cause.
Turning the audit off costs no coverage:
- `npm ci` exits 0 no matter what the audit reports — verified by running it
against this tree, not assumed from the docs. It never gated anything.
- The endpoint currently returns no advisories at all, so the call is buying
zero information even when it does answer.
- Dependabot watches the same dependency tree and is the channel that actually
reports: the 7 open alerts on this repo (fast-uri, @xmldom/xmldom,
browserslist, postcss-selector-parser) all come from it, none from here.
Set as workflow-level env rather than flags on four separate `npm ci` lines, so
any npm invocation added later inherits it. It applies to CI only — a
developer's own `npm ci` still audits once npmjs.com recovers.
`test / Python 3.11` on 8555a05a reported `cancelled` with every step green
except the last: it hit `timeout-minutes: 10` partway through `npm ci`.
The backend was not the cause. Across the nine previous CI runs on main the
Frontend build step took 14-24s; on this run it took 87s on the 3.14 leg and was
still installing at 131s on the 3.11 leg when the budget ran out. What changed
was not the tree:
frontend/package-lock.json 7b43ba37 -> HEAD a7aafd3c -> a7aafd3c (identical)
setup-node cache key both runs node-cache-Linux-x64-npm-be942593
tsc -b --force, local pre-merge 12.3s post-merge 12.5s
Same lock file, same restored npm cache, same compile time, so `npm ci` was
doing identical work more slowly — a registry or runner effect, reproduced on a
re-run an hour later.
What made a slow install fatal is the budget. The frontend build and tests were
the tail of BOTH Python matrix legs, running the same npm ci + tsc + vite +
vitest twice per push against a tree with no Python in it, and the 3.11 leg was
already at 539s of its 600s ceiling on the last green run. Sixty seconds of
headroom is not enough to absorb anything.
Splitting the frontend into its own job removes the duplicated run, gives it its
own 10-minute budget, returns ~65s to each Python leg, and lets the two run in
parallel. The commands and the tree they run against are unchanged, so nothing
is tested less than before. No required status check names change either: main
currently has none configured.
Dropping the <3.14 cap in 0bb1d870 left 3.14 supported but unexercised: both
jobs pinned python-version 3.11. Claiming a version nothing runs is how the
cap went stale in the first place, so the test job now matrices over
["3.11", "3.14"] with fail-fast off.
Verified locally before adding the leg: CPython 3.14.4 with CI's own extras
([dev,openbb,stats]) is 10774 passed / 23 skipped / 0 failed.
Four issues in the new workflow and Dockerfile:
- Every action floated on a mutable major tag, and BuildKit was pinned to
moby/buildkit:master. This was the only workflow in the repo doing so; the
other four already pin full commit SHAs. All seven actions are now SHA-pinned
with a version comment, and the custom driver-opts block is dropped, which
also removes an unneeded network=host.
- id-token: write was granted with no OIDC consumer anywhere in the workflow —
no cosign, attestation, provenance, or OIDC login step. Dropped.
- The Dockerfile installed channel extras with 'pip install -e ".[extras]"'
after the --require-hashes lock install. lark-oapi, qrcode and
python-telegram-bot are in neither requirements-lock.txt nor its source, so
the build resolved them and their transitive deps unhashed from PyPI at build
time — six lines below a comment stating deps come from the hash-pinned lock.
They now come from requirements-channels-lock.txt (16 pins, all hashed,
generated under the same constraint as the main lock: 12 packages are shared
with it and none diverge in version). The project install is --no-deps, which
is safe because all 44 pyproject base deps are already in the main lock.
- The workflow_dispatch input was interpolated directly into the Summary step's
run: body. It now passes through env, and the tag is validated against the
Docker tag grammar before any registry work.
CI verifies the new lock too. The existing 'Verify hash-locked dependencies'
step only dry-ran requirements-lock.txt, so a second lock could have rotted
undetected until a release build failed; both are now dry-run separately, since
the Docker build installs them as two independent --require-hashes passes.
The summary also states that a new GHCR package is private until its visibility
is set once, so the pull command it prints is not read as working out of the box.
Twelve commits landed on main on 2026-08-06 (f8e888c7..8452a844) without a
single workflow run being created. The push webhooks reached GitHub - the
Cursor app opened a check suite on each head commit at push time - but no CI
run was enqueued, while pull_request runs on the same workflow kept working.
The repository side is clean: the workflow is active, unchanged since the
last green push run, has no path filters, no skip-ci token in any of the
twelve messages, no rulesets and no branch protection.
The same window shows GitHub-side queueing trouble independently: four runs
created between 08-05T15:37Z and 08-06T09:33Z all have run_started_at within
four seconds of 08-06T17:36:56Z, having sat queued for 8 to 26 hours against
a 10-minute job timeout.
Whatever the cause, `push` was the only trigger that could produce a verdict
on main, so losing it left no way to get one short of pushing an empty
commit. This adds the manual trigger.
The quantlib timeseries suite added on 2026-08-06 calls functions that
lazy-import statsmodels, but CI installs only ".[dev,openbb]", so all 56
statsmodels-dependent tests failed with the ImportError those functions
raise by design. Two-sided fix, following the openbb precedent already in
the workflow: CI now installs ".[dev,openbb,stats]" and fails loudly if
statsmodels or arch stops resolving, and the 41 statsmodels-dependent
tests (plus the tool-envelope test that reaches compute_half_life) carry
a skip guard so a base install reports skips instead of failures. The
missing-dependency error-path tests still run exactly where they should:
only in an environment without the extra.
Exposes the agent to OpenBB Workspace over the openbb-ai SDK, behind an
optional `openbb` extra.
Security repairs on top of the contribution:
- pro.openbb.co is no longer a default CORS origin. CORS is installed
globally with credentials and keyless loopback mode admits safe GETs by
peer address, so that default would have let scripts on the OpenBB
origin read /sessions and /runs. Extra origins are now an additive
opt-in (VIBE_TRADING_EXTRA_CORS_ORIGINS) declared in the typed config
layer; the loopback-only defaults are unchanged.
- POST /v1/query carries require_auth. It reaches the full agent registry,
which auto-registers the order tools, so an unauthenticated caller could
have driven actions inside an already-active mandate.
- The three unadvertised LLM routes (chat title, dashboard title, prompt
enhancement) are removed rather than authenticated: they were absent
from the manifest and duplicated the existing authenticated title path.
- Conversation identity no longer hashes the first message. Any two
conversations opening with the same text mapped onto one persistent
session, leaking history between them, and later requests' full history
was ignored. openbb-ai 2.1.0 exposes no conversation id, and the SDK
contract is stateless with full history per request, so each request now
runs an ephemeral session replaying the supplied history.
- The SDK is wired into the dev install and CI, with an explicit import
check. It previously landed only in agent/requirements.txt while CI
installs the extras, so every bridge test silently skipped and the
feature could look green while being uninstallable.
- Workspace context is now ingested under an 8k budget instead of ignored,
and widget-dashboard-search is advertised as false: widget groups carry
metadata only, and the value round-trip is not implemented, so the model
is told values are absent rather than left to invent them.
The contributor's requirements-lock.txt rewrite was dropped (stale
Python-3.12 regen with unrelated downgrades; the runtime targets 3.11).
Note for operators: a browser POST from a remote Workspace origin is still
refused by the pre-existing cross-site guard, independently of CORS and of
a valid token. Self-hosted same-origin Workspace and server-side callers
work; that boundary is pinned by a test.
React Router 7.12.0 through 8.2.x carry a high-severity RSC-mode CSRF bypass
(GHSA-qwww-vcr4-c8h2). We were on 7.18.1, inside that range. The advisory is not
reachable here — the app is a client-side SPA on createBrowserRouter with no
@react-router/server and no RSC entry point, and the frontend ships as static
Vite output — but 7.18.1 is the final 7.x release, no backport exists, and 8.3.0
is the only patched version, so staying put means staying on an EOL line with a
permanent open alert.
react-router-dom has no 8.x at all; the DOM exports moved into react-router
itself. So the dependency is swapped and every import rewritten. All ten APIs in
use here are unchanged in 8.3.0, and none of the data-layer surface that changed
most between majors is used.
react-router 8 requires Node >=22.22.0, which is the same wall that had jsdom 30
and @testing-library/jest-dom 7 sitting in the Dependabot ignore list. Node 20
reached EOL on 2026-04-30, so the toolchain moves to Node 22 across CI, the wiki
workflow, the Dockerfile and docker-compose. That unblocks all three at once:
jsdom and jest-dom are taken here too, and their ignores are removed rather than
left carrying a rationale that no longer holds.
Verified on the frontend suite: tsc -b and vite build clean, 310 tests across 35
files pass before and after the jsdom/jest-dom bumps.
Add task-scoped cancellation, reject broad Python process-name kills, expose timeout context, and cover the lifecycle on Windows 11 and Windows x64 with Python 3.14.
Signed-off-by: Haozhe Wu <haozhe_wu@connect.hku.hk>
Implements VT-001 through VT-010 from the 2026-07-10 external security
audit (Trivy/Semgrep/ZAP/Gitleaks/pip-audit against a real deployment):
- VT-001 (Critical): AST hardening in backtest/runner.py rejects
network/subprocess/eval/os.environ/unsafe-open calls reachable from
generated SignalEngine method bodies (previously only checked
top-level statements). Defense-in-depth: ephemeral per-run HOME,
RLIMIT_AS/NOFILE caps, best-effort UID-drop to a new vibe-sandbox
user (currently inert under Docker's cap model - see session doc;
accepted as documented residual gap, primary AST defense unaffected).
- VT-002: multi-stage Dockerfile split so build-essential never
reaches the runtime image.
- VT-003: SSE auth moved from a long-lived API key in the URL query
string to short-lived single-use tickets; access-log redaction for
any remaining query secrets.
- VT-004: agent/.env split-brain fixed (bind mount + atomic 0600
writes) between docker-compose and Web UI settings writes.
- VT-005: /correlation now requires auth + per-IP rate limit; generic
exceptions no longer leak raw text to clients.
- VT-006: CSP-Report-Only + security headers middleware; Google Fonts
replaced with self-hosted @fontsource packages.
- VT-007: docker-compose hardening (cap_drop ALL + minimal cap_add,
no-new-privileges, read_only rootfs, resource limits).
- VT-008: /health split into /live (liveness) and /ready (real
provider-config readiness check); /health kept as a compat alias.
- VT-009: base images pinned by digest, GitHub Actions pinned by
commit SHA, dependabot.yml added, hash-verified requirements-lock.txt
now actually wired into the Docker build via --require-hashes.
- VT-010: universe-panel pickle cache sidecar upgraded from an
unkeyed SHA-256 (forgeable by anyone with cache-dir write access)
to a keyed HMAC.
Implemented via a 5-parcel Workflow (file-disjoint, independent
adversarial verification per parcel, then a holistic final audit).
The final audit caught a real regression (CI env-var-gate violation)
and confirmed a dependency-pinning gap, both fixed and re-verified
here, including a latent transitive-dependency bug the fix surfaced
(smartmoneyconcepts<0.0.27 pulls an unbuildable zigzag package) - see
docs/sessions/2026-07-13_session_vt476_security_hardening.md (local,
gitignored) for full evidence trail.
Full suite: 5191 passed, 6 pre-existing/environmental failures
(unchanged from main). Docker build + hardened compose boot verified
end-to-end.
Reverts merge commits 0b867a7 (#405) and 474f5e4 (#416), and removes the
now-orphaned #406 artifact metadata store (src/reliability + tests, zero
references left outside its own tests).
Why: the stack wrapped the tool registry in every session path (even
governance mode=off) without exposing the registry surface AgentContext
reads, breaking all session-runtime chats within a day (#433, #431). It
also modified protected core files (src/agent/loop.py, src/session/
service.py), shipped 12 internal-convention docs/ files into the public
tree, and its enforcement layer already has reported bypass paths (#420).
Trading safety stays on the single mandate-gate design (#31, #144).
README news entries for 2026-07-07/07-06 updated accordingly.
Haozhe Wu