React Router 8 requires Node >=22.22.0, so `npm install` now fails for anyone
still on Node 20 with an error that does not name the cause. Declare it in
package.json engines, and say it on the Quick Start line that tells people to
run it, in all five READMEs.
CMD has no `cp`, so `cp agent/.env.example agent/.env` fails there; add the
`copy` form and note that PowerShell's `cp` alias already works. Also add the
CMD activation line and the execution-policy hint that blocks Activate.ps1.
Reported by @brady-cec in discussion #29.
Add task-scoped cancellation, reject broad Python process-name kills, expose timeout context, and cover the lifecycle on Windows 11 and Windows x64 with Python 3.14.
Signed-off-by: Haozhe Wu <haozhe_wu@connect.hku.hk>
The header nav links to #-contributing, but the 'Contributing' heading
has no leading emoji, so GitHub renders its anchor as #contributing (no
leading hyphen). Clicking 'Contributing' in the nav therefore does not
scroll to the section. README_ja.md already uses the correct #contributing
target; align README.md and README_zh.md with it.
Signed-off-by: dvir arad <dvirarad@gmail.com>
Add the v0.1.12 cycle cohort (28 contributors) and demote the v0.1.11 list
into a collapsible block, in en/ja/ko/zh/ar. en/ja/ko keep English
descriptions; zh/ar translated.
IM /pairing ran with no authorization, so any allow-listed chat participant could
take over pairing across channels (+ Signal group members bypassed the sender
check, + code/sender_id leak). Add a config-driven operators allowlist (global +
per-channel, fail-closed when empty); gate every /pairing on operator identity in
runtime; scope store list/approve/revoke by channel; require per-sender auth for
control-plane slash-commands in Signal groups (ordinary /new /reset unchanged).
README documents the operator requirement.
MCP stdio previously force-enabled bash/background_run with no opt-out and the
module-level default was fail-open. Default to fail-closed and gate every
transport behind explicit opt-in (--enable-shell-tools flag or
VIBE_TRADING_ENABLE_SHELL_TOOLS). Local CLI is unaffected (still opts in
explicitly). Also shrinks the network-reachable surface of the bash
OS-command-injection sink (GHSA-m768). Adds regression tests + doc alignment.
#567 added feitu, a client SDK for the contributor-operated FTShare data
service. Reverting it: a 3-week-old, author-affiliated backend whose free tier
is at the operator's discretion is not a neutral public data source, and the
A/HK fallback chains already carry ample free coverage (tencent, mootdx,
eastmoney, baostock, akshare, yahoo, futu). Removed the loader, its test,
registry entries, fallback-chain slots, and doc/source-count references
(sources 22->21, free 20->19).
Preset YAMLs dropped into ~/.vibe-trading/swarm/presets/ are now discovered
alongside the bundled roster, mirroring the user-skills pattern
(src/agent/skills.py): the user directory is searched first, same-name files
override bundled presets, and user files survive pip install -U (previously
the only way to add a preset was copying into site-packages, which upgrades
wipe).
- load_preset()/resolve_preset_path(): user dir first, then bundled; the
not-found error names both locations.
- list_presets(): union with user-wins-by-stem override; entries gain a
source: "user"|"bundled" field (additive — CLI/MCP/API consumers read
keys individually or serialize the whole dict).
- Preset names are validated to a single path segment before any filesystem
lookup (rejects separators and '..'); the bundled lookup had the same
latent exposure, so validation covers both paths.
- run_swarm(preset_name=...): an explicitly named user preset now resolves;
keyword auto-routing intentionally stays limited to the curated table, so
a user preset is reachable only by naming it.
- Packaging regression suite extended (6 new tests: discovery, override,
absent-dir no-op, traversal rejection, error message, tool gating); the
roster-count test now filters to bundled entries so a developer's own user
presets cannot make it flap.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Ali Emadi <ali@gatekeeperai.com>
- Add credentials.py: unified credential resolution for data and trading
- Add test_longbridge_credentials.py: coverage for credential resolution
- Remove longbridge from requirements.txt (optional extra only)
- Update requirements-lock.txt
- Update .env.example with Longbridge credential hints
Wire iFlytek Spark's OpenAI-compatible HTTP endpoint
(https://spark-api-open.xf-yun.com/v1, Bearer APIPassword) through the
provider registry, capabilities, legacy CLI onboarding, .env.example, and
the README provider list, with "iflytek" accepted as an alias. Spark rides
the generic OpenAI-compatible path with no special capability flags; the
default model is 4.0Ultra, which supports function calling.
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
Add --transport http exposing the MCP Streamable HTTP transport (spec 2025-03-26+) as a single POST/GET /mcp endpoint, alongside the existing stdio and legacy SSE transports. The legacy sse transport is unchanged.
Modern clients (e.g. QwenPaw) negotiate by POSTing an InitializeRequest; the deprecated two-endpoint SSE transport rejects that POST on /sse with 405 Method Not Allowed. Streamable HTTP accepts POST on its single endpoint.
FastMCP 3.4.4 (already a dependency) provides the transport via mcp.run(transport=streamable-http). Adds a --host option scoped to the http transport (default 127.0.0.1).
Signed-off-by: HUANG Cheng <cheng@duck.com>
Covers issue #476 (all 10 audit findings), #377/#478/#480/#487/#479/#484.
Propagated to all 5 locale READMEs' News section (3 visible + moved
2026-07-10 into <details>, per convention).
Adds Frazzini-Pedersen (2014) "Betting Against Beta" to the academic zoo,
following the existing OHLCV-only proxy pattern: rolling 252-day per-stock
beta against an equal-weighted cross-sectional market return, cross-sectional
z-scored negative (so low-beta names rank highest, matching the long leg of
the original long-short construction). Proxy limitations vs. the original
(equal- vs value-weighted market, single window vs separate 1y-vol/5y-corr,
no explicit leverage) are disclosed in both the module docstring and
academic/LICENSE.md, matching the zoo's existing disclosure convention.
Verified locally: full purity + lookahead suites green (923 passed, 5
pre-existing skips), env-var CI gate passes, ruff clean.
One thing the PR's own test plan missed (it only ran the purity/lookahead
suites): SKILL.md has a manifest guard test
(test_alpha_zoo_counts_match_factor_modules) asserting the documented alpha
count matches the actual factor-module count. Adding a 461st alpha without
updating it fails that test. Folded in a fix bumping the count in SKILL.md
(460->461, academic 10->11) and propagated to all 5 locale READMEs' current-
state references (left the historical changelog entries describing past
counts untouched).
Co-authored-by: Yogesh Modi <YogeshModi24@users.noreply.github.com>
Opt-in TAP (Tool Authorization Protocol) mode for Alpaca: when TAP_PROXY_URL +
TAP_AGENT_KEY are configured, all broker egress (reads, order placement,
cancel) routes through a self-hosted TAP proxy instead of the direct SDK, so
the agent process never holds the raw Alpaca key — only a policy-scoped TAP
agent key. Writes block on human approval; the direct-SDK path is unchanged
when TAP isn't configured.
Reviewed: self-hosted deployment (holonym-foundation/tap-oss) resolves the
custody question; the TAP write path sits strictly downstream of the existing
mandate gate; with TAP env vars unset the direct path is byte-for-byte
unchanged; SSRF guard on the poll URL confirmed. 60/60 tests green
(agent/tests/test_tap_forward.py + test_alpaca_tap_routing.py).
Maintainer fix folded in before merge: tools/ci_env_var_gate.py (#440) landed
after this branch was cut and flagged TAP's raw os.environ reads — annotated
with the established `# noqa: env-gate` escape hatch (module is deliberately
independent of EnvConfig so it keeps working outside the app's normal
startup/config bootstrap).
Co-authored-by: 0xZKnw <0xZKnw@users.noreply.github.com>
GitHub restricted the stargazers API on 2026-06-30 to repo admins/
collaborators only; api.star-history.com's SVG badge renders server-side
and can't authenticate as a collaborator on every embedding repo, so the
badge now fails with a server timeout instead of rendering (confirmed
live, no fix path per star-history.com's own postmortem).
Post-release cross-audit findings: the 5th Alpha Zoo family never reached the
frontend (AlphaZoo card grid missing fundamental, academic still 6, '4 zoos'
i18n strings x5 locales), factors/__init__ docstring, or the asset-allocation
skill ('4 optimizers'). Wiki: 29->30 presets, docs version selector bumped to
0.1.11 (labels only; content is unversioned). README x5: locale parity for the
07-04 UTC news entry, india_broker in the loaders tree comment (20 sources),
ja/ko contributor headings translated.
Version bump + release paperwork: detailed CHANGELOG for 0.1.11 (plus the
missing 0.1.10 backfill), README news + counts across all 5 locales
(30 presets / 460 alphas across 5 families / 19 free sources + india_broker
row and India fallback chain / roadmap), v0.1.11 contributor cycle credits,
SKILL.md version, and the opt-in scheduler flag documented in .env.example.
Reverts merge commits 0b867a7 (#405) and 474f5e4 (#416), and removes the
now-orphaned #406 artifact metadata store (src/reliability + tests, zero
references left outside its own tests).
Why: the stack wrapped the tool registry in every session path (even
governance mode=off) without exposing the registry surface AgentContext
reads, breaking all session-runtime chats within a day (#433, #431). It
also modified protected core files (src/agent/loop.py, src/session/
service.py), shipped 12 internal-convention docs/ files into the public
tree, and its enforcement layer already has reported bypass paths (#420).
Trading safety stays on the single mandate-gate design (#31, #144).
README news entries for 2026-07-07/07-06 updated accordingly.
Haozhe Wu