v0.1.14 — a backtest you can read, and Intel Macs that can install

Rolls up 272 commits / 74 merged pull requests since 0.1.13.

Added

• Options Lab (#1096, closes #1095, thanks @shadowinlife) — a Web UI page
  with four surfaces: expiry payoff diagram, spot×IV scenario P&L matrix,
  portfolio Greeks cards, and a live US options chain. The math is not new: two
  read-only HTTP endpoints wrap the existing options_payoff /
  get_options_chain tools, so the page and the MCP surface compute from the
  same test-pinned src/quantlib/options.py. Research only — it places no
  orders.
• Factor Research tab in Run Detail (#1099, thanks @shadowinlife) — IC
  statistics cards, the daily IC series with its mean line, quantile-group
  equity curves, and an IC correlation heatmap, all rendered from the
  factor_analysis artifacts a run already writes. The new read-only
  GET /runs/{run_id}/factor endpoint scans the run's artifacts/ tree and
  computes the pairwise IC time-series correlation matrix, which existed
  nowhere before; a has_factor_artifacts flag gates the tab so runs without
  factor output do not show an empty panel.
• Positions tab in Run Detail (#1097, closes #1098, thanks @shadowinlife) —
  portfolio-book structure from the existing positions.csv: a per-symbol
  weight pie/treemap with a date slider, sector and asset-class net-exposure
  bars, and a weight-evolution stacked area. The pie is gross composition
  (absolute weights including shorts and cash) while the bars are net
  exposure per industry, so a long/short pair in one sector nets to zero on the
  bars while both legs stay visible on the pie. The two charts answer different
  questions on purpose.
• Tearsheet tab in Run Detail (#1091, closes #1090, thanks @shadowinlife) —
  monthly-returns heatmap (years × months with a full-year column), annual
  returns bar chart, top-5 drawdown table, and an equity curve annotated with
  the ranked drawdown zones. Everything is derived client-side from the
  equity.csv rows the run response already carries: no backend change, no new
  dependency, and month axis labels come from Intl.DateTimeFormat rather than
  per-locale month keys.
• Interactive backtest research dashboard (#1084, thanks @AndyLongest) — an
  optional report-style view for a completed backtest alongside the existing
  candlestick and trade-detail views: headline return/risk/trading KPIs,
  normalized equity versus benchmark, drawdown with rolling Sharpe, realized
  trade P&L, a trade ledger, and the complete metric table. CLI backtests get a
  quiet local report-server bootstrap so Full Report routes to the dashboard
  without a manual server step.
• Strategy Discovery (#978 Phase 1 and #1007 Phase 2, refs #969, thanks
  @shadowinlife) — a read-only facade answering "what strategies exist and what
  state are they in?" across the Alpha Zoo and the SDM strategy store, with
  per-(strategy, regime) evidence rows rather than scenario tags. Ships
  list_strategies / query_strategies / get_strategy_evidence as agent and
  MCP tools behind an evidence gate (minimum-trade, coverage and
  cost-breakeven thresholds, each with an explicit warning), plus a startup
  guard that drops the routing text when any advertised tool is not actually
  registered. Phase 2 adds the population path — refresh_strategy_evidence
  as an agent tool, an MCP wrapper and
  vibe-trading strategy-evidence refresh --manifest — with the
  backtest-diagnose Hard-Gate Checklist as the ingestion gate (stable
  hard-gate:* skip tokens) and atomic rebuilds. Freshness is computed at read
  time from the evidence-window age (fresh/aging/stale); stale rows fail
  closed out of default recommendations behind an include_stale opt-out, and
  sdm:* rows mirror the SDM lifecycle.
• Scheduled research now delivers itself. A finished briefing leaves the
  run through an outbox rather than waiting to be read: the outbox row is
  claimed under a lease before sending so a crash mid-delivery cannot double
  post, the send is wired to both the session and the channel runtimes, and the
  push happens on the terminal event. Delivery is configured and watched from
  Market Watch.
• Each monitor's latest verdict is persisted on its job (#1152, refs #943,
  thanks @he-yufeng) — the run's terminal briefing is parsed server-side into a
  structured last_verdict record and the /scheduled-runs list carries it
  inline, so the list renders a verdict without re-parsing free text per row or
  going N+1 on sessions. The five research playbooks grow a strictly additive
  ## Verdict tail — one - SYMBOL: STATE - reason line per tracked symbol,
  each playbook declaring its own state vocabulary. Parsing is deliberately
  strict: an ad-hoc prompt lands permanently at no_verdict_section and renders
  as nothing rather than a warning, a run that tracked nothing is a real "no
  calls" answer rather than an absence, and a malformed section degrades to
  contract_violation instead of showing a wrong verdict. The prior record is
  embedded one level deep at write time and no deeper.
• Futu connector — seven extended read-only endpoints (#1135, thanks
  @549236606-oss) closing the gap between what the SDK exposes and what the
  connector consumed: get_rehab (dividend/split/rights adjustment factors, so
  backtests stop reading dividend gaps as price moves), get_capital_flow
  (historical super/big/mid/small inflow buckets), get_capital_distribution
  (today's in-flow versus out-flow snapshot), get_history_deals (fill records
  for true cost-basis reconstruction, capped at the SDK's 360-day window),
  get_acc_cash_flow, get_financials (income/balance/cash-flow statements),
  and get_earnings_calendar with EPS and revenue consensus. Each routes
  through the same _quote_ctx / _trade_ctx / _assert_gateway envelope as
  the original five, so missing data, missing privileges and a missing OpenD all
  degrade to a clean fail-closed payload instead of an SDK stack trace. The
  futu-api SDK stays lazily loaded.
• Vietnam equities (HOSE) as a backtest market (#1033, thanks @ngoanpv).
  .VN matched no entry in _MARKET_PATTERNS, so _detect_market fell back to
  a_share and executed Vietnamese bars under China A-share rules — and asking
  for Yahoo explicitly did not help, because both Yahoo loaders gated on suffix
  and rejected .VN before building the request. .VN now resolves through the
  Yahoo loaders with a ["yahoo", "yfinance", "local"] fallback chain and runs
  on a dedicated VietnamEquityEngine.
• Offline USD-M account reconciliation (#1106, relates #1030, thanks
  @honginp) — immutable Binance USD-M account and position snapshot contracts
  that compare an exchange observation against the existing AccountState and
  RiskSnapshot without mutating either, reporting numeric, structural,
  missing-symbol and unexpected-symbol drift deterministically. Liquidation-engine
  validation is explicitly left unassessed rather than silently assumed. This is
  the Shadow 1 slice: contracts and fixture-only offline reconciliation.
• Novita AI as a built-in OpenAI-compatible provider (#1059, thanks
  @jax-novita) — registered in the provider registry with NOVITA_API_KEY /
  NOVITA_BASE_URL and wired through capabilities, CLI onboarding,
  .env.example and the README provider list, so it is selectable from the
  built-in list instead of hand-configured as a custom endpoint.
• GitHub Copilot as a provider through the official github-copilot-sdk
  (#990, supersedes #899, thanks @sykuang), with SDK-managed authentication from
  COPILOT_GITHUB_TOKEN, GH_TOKEN, GITHUB_TOKEN, stored Copilot CLI
  credentials or gh credentials, plus LangChain-compatible invoke, streaming,
  reasoning and tool-call handling and Settings/preflight integration. This
  implements the boundary #899 was closed on: no borrowed OAuth client ID and no
  editor-impersonation headers.
• tickerall hosted MetaTrader 5 data source (#968, closes #897, thanks
  @miguelangelo78) — a broker's MetaTrader 5 candle feed over the hosted
  TickerAll HTTP API, so forex and metals backtests run on any OS with no local,
  logged-in MetaTrader 5 terminal. Purely opt-in: is_available() is False
  unless TICKERALL_API_KEY and TICKERALL_ACCOUNT_ID are set, and the loader
  never joins an automatic chain.
• A drift tolerance band for rebalance mode — a rebalance that would move
  the book by less than the band is skipped rather than executed for a rounding
  difference.
• Spanish and German locales (#1087 thanks @daviddaco1, #1117 thanks
  @1psconstructor). Spanish ships a full key-for-key es.json plus
  README_es.md, making Spanish the sixth README; German ships de.json with
  the full UI key set. Both register in SUPPORTED_LANGUAGES and
  localeLoaders on the existing lazy-loading path, and the locale-parity and
  interpolation-variable tests cover them.
• Desktop update safety boundary (#1101, refs #1016, thanks @QCYTSN) — a
  strict PID-scoped backend/watchdog shutdown result for a future update
  handoff, dormant Windows candidate verification, interrupted-attempt recovery
  primitives, and a documented, tested rejection matrix for tampered, unsigned,
  invalid-signature, wrong-publisher and downgraded candidates. The signed
  0.3.0 → 0.3.1 run itself remains blocked on a signing identity; this is the
  part that could be made executable before a certificate exists, including the
  proof that desktop cleanup never kills unrelated Python processes.
• Docker images carry the Feishu and Telegram channel dependencies (#1088,
  thanks @birdxs), with a manually triggered workflow that builds and pushes to
  both GHCR and Docker Hub and syncs the project description to the Docker Hub
  page.
• Strict alpha t-stats in the bench JSON and HTML report (#1085, thanks
  @jay79-boop), so the strict-mode number is readable from the artifact inst...

v0.1.13 — The grounding repair, a finance-math layer, and institutional research

v0.1.13 — The grounding repair, a finance-math layer, and institutional research

pip install -U vibe-trading-ai

408 commits and 162 merged pull requests since v0.1.12 (2026-07-22) — the largest release to date, from 35 contributors. Full detail in CHANGELOG.md.

---

🛡 The headline is a fix, not a feature

The single most user-visible defect in the 0.1.12 line: a well-formed question would spend minutes on real tool calls and then refuse to answer, returning

当前无法安全确认标的身份或价格证据，因此没有生成交易结论。请确认候选证券代码和交易所后再继续。
(cannot safely confirm instrument identity or price evidence)

The identity/grounding gate was rejecting answers it already had the evidence for. Seven independent root causes, each now fixed and covered by two-sided guard tests (healthy samples must pass; bad samples must still be blocked) plus mutation tests:

#	Root cause	Effect
1	.SS and .SH treated as different instruments	Every Shanghai ticker was permanently ambiguous
2	A+H dual listings and bare HK codes collapsed to ambiguous	Dead end instead of a shortlist
3	Yahoo returns HTTP 400 for every CJK query; recorded as a source failure	Escalated to blocking invalidated instead of "not listed here"
4	A failed side query could demote an already-locked identity	Sticky aggregate status with no recovery
5	A hardcoded per-tool whitelist decided which bare tickers could match	11 of the 17 documented argument spellings were blocked (3/14 → 14/14 after the fix)
6	Source and currency had to be written in ASCII	Chinese answers rejected for writing 雅虎/腾讯, or 元 instead of 人民币
7	A thousands separator split the clause mid-number	¥1,309.22 compared as 1 against the observed range → false price conflict

Conceptual questions with no instrument at all, and comparison reports, no longer dead-end either.

A quote outside recorded OHLC evidence is still refused. The gate got more precise, not weaker — that is the point of the two-sided tests.

Verified end to end against a real LLM, real tools and real network: a 600519.SH query that previously took 6m14s and ended in the canned refusal now answers in 7–9s with zero rejections; 茅台 in 14s; a knowledge question in 14s.

This also closes the narrower cases from the 0.1.12 line — numbers that were never prices (confidence scores, indicator readings, moving-average windows, year-less dates like 8/5, percentage ranges, and a trading plan's own trigger levels, where close ≥ 6.45 is a condition rather than a quote) — and makes a many-candidate shortlist count as an answer rather than a stalled resolution (#1001, #983, #955).

---

🧮 src/quantlib — a tested finance-math layer

265 tested functions across 19 modules — every module the tool allowlists now exports. Skills now import these instead of carrying formulas inside markdown code blocks — if you find a pricing formula living in a SKILL.md, that is a bug, not a pattern.

Module	Coverage
options	Black-Scholes price + greeks, implied-volatility inversion
fixedincome	Bond math, Nelson-Siegel / Svensson curve fitting
credit	Altman Z-score, Merton / KMV distance-to-default
timeseries	Stationarity, cointegration, GARCH, bootstrap
risk · var_backtest	VaR / CVaR / EVT and their backtests
attribution	Brinson-Fachler decomposition
performance · fundmath	TWR / MWR / Modified Dietz; XIRR / MOIC / DPI / TVPI
factormodel · eventstudy	Factor regressions, event studies
multipletesting · crossvalidation	Deflated significance, purged CV
impact	Market-impact models

The read-only quantlib_call tool reaches all of it through one contract, so the finance math works on the CLI, the Web UI, the REST API and MCP — including deployments where bash is gated off. It is structurally not a shell — module allowlist, __all__-only dispatch, export_* refused. Econometrics needs the stats extra; those functions lazy-import and name the missing one.

---

💰 Valuation engine

A valuation engine that refuses to invent its own inputs. The one rule in contracts.py: a missing input makes a model NOT RUNNABLE and is never silently defaulted — every default in a valuation model is an opinion wearing a constant's clothes.

• run_dcf — FCFF bridge, WACC build, mid-year discounting, net-debt bridge, WACC×g sensitivity grid. Dual terminal value: each method is cross-checked against the other's implied multiple and implied g.
• run_comps — EV bridge, LTM + calendar-year calendarisation, multiple matrix. A peer with a non-positive denominator is excluded and reported, never averaged in as a negative multiple.
• threestatement — linked projection with a hard balance assertion, an explicit revolver plug, and an iterated interest↔debt circularity that must converge or raise.

Artifacts are input-hashed and versioned, with xlsx / pptx export.

---

🏛 Institutional research

Six slash commands — /comps /dcf /attrib /memo /earnings /screen — each carrying a step skeleton and an arithmetic-consistent worked example: the Brinson decomposition sums exactly to active return, and the earnings bridge sums exactly to the EPS delta.

Investor lenses become a standalone skill: named-investor reasoning frameworks as stackable analysis overlays, decoupled from the data layer. Each lens is an operating procedure — priority signals, disqualifying conditions, typical misuse — not a biography, and names no tool.

Five ready-to-schedule research playbooks (premarket brief, earnings-season tracker, portfolio checkup, A-share money flow, institutional-holdings diff), reachable three ways: auth-gated REST routes, a vibe-trading playbook CLI subcommand, and a /playbook slash command. Templates state their data needs in natural language rather than naming tools, so coverage can grow without editing them, and every one mandates naming a missing input instead of filling it from memory.

---

📊 Four new read-only data tools — all on free public sources

• get_institutional_holdings — SEC 13F-HR books in manager / ticker-holders / top-managers modes, with quarter-over-quarter position diffs for factor use. Cover-page totals carry value_units + basis, because pre-2023 filings report in thousands.
• etf_holdings — cross-market look-through. SEC N-PORT for US; for A-shares the semi-annual/annual reports carry the full book, not the quarterly top ten: 510300 returns 342 rows covering 98.66% of net assets versus 10 rows / 22.74%. coverage separates full_portfolio from top_n_disclosed, and every response stamps the report period — a full book is always the older disclosure.
• prediction_market — event-contract search / event / market / history, with prices converted to implied probability and the unit labelled, so downstream never reads 0.63 as dollars. Read-only by construction: no order path.
• research_papers — arXiv + OpenAlex search/read with source-anchored claim extraction. Anything not literally present in the source is left empty and marked not stated in source, and a paper's claimed performance is never presented as our backtest result.

---

🧾 Governance wired into every run

• A run manifest hashes the prompt, the skill contents, the tool registry and the package versions — so "what methodology produced that number?" is answerable a month later.
• The audit ledger chains each record to its predecessor's hash and fsyncs. Editing or deleting a record is detectable, and an edit that recomputes its own hash is still caught one record later via prev_hash_mismatch. Timestamps are always caller-supplied; no module here calls datetime.now().
• Trace redaction is sink-aware: content is released only in the tool-RESULT sink and stays redacted in the fail-closed ARGUMENTS sink used by tool-call arguments and the live audit ledger. env is never released. Result strings are pattern-scrubbed, since shell output arrives as a JSON envelope.
• All 30 swarm presets were re-audited — a deliverable no granted tool can compute is now declared as such instead of invented.

---

🧱 Platform

• Desktop shell — a source-first Electron host owning the backend lifecycle: random loopback port, per-launch secret, five-locale startup recovery, owned-process cleanup (#923). Windows packaging assembles a checksum-pinned embedded Python 3.12 runtime with x64 NSIS review/signing paths, plus Electron safeStorage for an allowlisted credential set — the renderer can set or clear secrets but never read them, plaintext config migrates once, and both unsigned-review and signed builds fail closed on the wrong signature state (#1015). No installer artifact was published from that PR.
• eToro joins as the 13th broker connector with path-separated demo/real profiles; demo keys structurally reach only /demo paths (#989).
• Korea (KRX: KOSPI/KOSDAQ) becomes the 9th backtest engine — execution-time ±30% band on the unified tick grid, structurally long-only, config-driven 2026 0.20% securities transaction tax (#693).
• Canadian equities end to end — .TO/.V classified in CAD, Yahoo → yfinance → local, Canada-specific GlobalEquity rules, XIC.TO benchmark, mixed-currency aggregation refused (#1024, #1019, #1037, closes #952).
• OpenBB Workspace bridge (#817) and a read-only Taiwan snapshot tool (#848).
• src/entities — a typed entity + irregular dated cash-flow substrate for NAVs, capital calls and coupons, deliberately parallel to the bar engines so a nav column can never reach one and get priced as a close. Surfaced by cashflow_performance.
• **`orderbook_depth...

v0.1.12 — Correlation regime timeline, three new providers, MetaTrader 5 + reliability wave

🌀 v0.1.12 — Correlation regime timeline, three new providers, MetaTrader 5 + a reliability wave

v0.1.12 rolls up nearly two weeks of work since 0.1.11 (2026-07-10) — the headlines: a correlation regime timeline that answers "when did the market fuse into one bloc, and are we in that state now?", three new LLM providers plus catalog-based endpoint resolution that makes every provider work with just a key, the MetaTrader 5 (Exness) broker connector (12 brokers), the Strategy Development Manager skill, Binance USD-M perpetuals with historical funding, and a broad reliability wave — strict-JSON/finite hardening, session/journal robustness, an 80× vectorization, and the native zai streaming fix.

This release is available on PyPI, ClawHub, and GitHub Releases.

pip install -U vibe-trading-ai
# or
uv tool install --reinstall vibe-trading-ai

Highlights

🌀 Correlation regime timeline

A new additive GET /correlation/regime endpoint and an opt-in "Regime timeline" strip on the Correlation tab (#756, closes #719, thanks @ebujinovch). It reuses the same price data /correlation already fetches: rolling pairwise correlations reduce to an edge-density scalar per bar (the fraction of asset pairs whose |ρ| clears a threshold), the series is causally smoothed (trailing window — never reads the future), and a two-threshold hysteresis state machine marks contiguous FUSED episodes, with a dead band that suppresses chatter. It shares /correlation's auth + rate-limit budget, floors the window so short timelines can't return empty, and is explicitly descriptive risk context, not a trading signal. Backed by the correlation-regime skill (#557).

🔌 Three new LLM providers + robust endpoint resolution

Native adapters for SiliconFlow (CN + Global, #565, thanks @UNHNQ), iFlytek Spark (#537, thanks @FenjuFu), and the native Anthropic Messages API (#695, thanks @jelech; pip install "vibe-trading-ai[anthropic]"), plus MiniMax regional endpoints (#731, thanks @octo-patch). Underneath, provider credentials are resolved through one centralized path (#563, thanks @shadowinlife), and two long-standing rough edges are fixed (#758): when no *_BASE_URL is set, the backend now falls back to each provider's canonical catalog endpoint (the same default Web Settings already used) instead of silently defaulting to api.openai.com — so a provider works with just a key — and an endpoint that streams zero chunks falls back to a non-streaming invoke rather than erroring, with an HTML-error-page hint when a base URL is misconfigured.

📈 MetaTrader 5 (Exness) connector + mt5 data source — 12 brokers

A first-class MetaTrader 5 broker connector (#481, thanks @StaniellG) — full read surface plus order placement against a locally running terminal, with a bidirectional identity guard (paper profile ⇔ demo trade_mode, login pinned, contest rejected) and connector-level max_order_volume / max_order_notional_usd caps on demo AND live. The live mandate gate gains forex/cfd instrument vocabulary and a lot-aware sizing hook so USD caps bind on lot-sized orders (0.1 lot EURUSD ≈ $10,800, never 0.1 × quote). The mt5 loader heads the forex fallback chain (broker-exact symbols with Exness suffix discovery, 1m–1D bars). Broker connectors: 11 → 12; market-data sources → 23.

🧬 Strategy Development Manager

sdm_register / sdm_status / sdm_decay_scan turn academic papers and broker research into registered factors and strategies (#457, closes #455, thanks @shadowinlife), backed by a persistent SQLite artifact store (UNIQUE(name, universe)) and automated IC/Sharpe decay monitoring driving an active → monitoring → decayed → disabled lifecycle. Ships with pluggable OCR for read_document (local RapidOCR by default; cloud Qwen-VL is explicit opt-in only, never auto-selected).

₿ Binance USD-M perpetuals

Explicit BTC-USDT-PERP routing with execution/mark price separation (fail-closed when the two aren't timestamp-synchronized) and historical funding settlements (#470/#716, thanks @honginp). Maintenance brackets are decoupled from the live authenticated fetch and supplied as a validated, content-hashed artifact instead (#757), so a plain -PERP backtest stays zero-credential — the regression where every perp fetch required a Binance API key is gone.

👁️ Pluggable OCR + LLM-vision extraction

read_document gains a pluggable OCR engine architecture with optional LLM-vision extraction and a configurable text-density threshold (#548, thanks @shadowinlife) — local by default, cloud engines opt-in only, never auto-selected.

🧰 Platform & safety

• Look-ahead-bias fix across all five portfolio optimizers (#487, thanks @YZY0108) — weights executed at a bar's open no longer include that bar's close-to-close return. Plus realized portfolio turnover metrics for every optimizer (#478, thanks @Robin1987China).
• Security hardening — all 10 findings from the 2026-07-10 external audit closed (#476): AST-hardened backtest sandbox, short-lived SSE auth tickets, hardened Compose, /correlation auth + rate limiting, security headers, hash-locked dependencies, and SHA-pinned Actions.
• 80× signal-alignment vectorization (#698, thanks @shadowinlife) and swarm MCP tool-discovery caching (#704) cut wall-clock on wide panels and multi-worker runs.
• Opt-in TAP mode for Alpaca (#377, thanks @0xZKnw), IBKR thread-local connection pool + snapshot quotes (#636, thanks @MikeCer), Robinhood account_number wiring (#726, thanks @nareshkps), the Requesty gateway provider (#474, thanks @Thibaultjaigu), and user swarm-presets discovery (#570, thanks @darkknight4563).
• Two new academic factors — Frazzini-Pedersen betting-against-beta (#480, thanks @YogeshModi24) and academic_corr_rewire (#705, thanks @ebujinovch): Alpha Zoo 460 → 462 across 5 families.

🛠️ Reliability & correctness wave

• Strict-JSON / finite-number hardening across the backtest + tools stack (thanks @santhreal) — risk ratios stay finite when equity crosses zero (#765) or annualizes an explosive path (#739/#740); scalar metrics (#766), factor IC std (#767), and pattern trend-slope (#764) emit strict RFC-8259 JSON (null, never NaN/Infinity); Black-Scholes helpers treat non-positive spot/strike as intrinsic (#744).
• Session / journal robustness — one corrupt session.json (#762) or schema-bad messages.jsonl line (#763) no longer aborts listing/reading; Excel float-stringified A-share codes (#770), unicode-dash PDF page ranges (#769), export KEY= dotenv lines (#768), and yahoo 1m bars (#761) all parse correctly.
• Broad reliability — cancellation is honored before the first AgentLoop iteration (#641, closes #638), a frontend insertBefore streaming DOM-race is fixed (#717, thanks @Marnie0415), the composite engine falls back for unknown symbols (#734), codex stream HTTP failures are classified for correct retry (#663), and #584 (thanks @xkam7ar) closes a batch of packaging/web/scheduler/swarm/CLI issues.

🙌 Contributor cycle

~90 correctness/reliability fixes and features from a wide contributor cohort — @santhreal (a 30-PR correctness sweep), @xkam7ar (reliability + QVeris hardening), @shadowinlife (SDM, OCR, vectorization), @ebujinovch (regime timeline), @honginp (Binance perps), @StaniellG (MetaTrader 5), and many more. Full per-person credits live in the README Contributors section and the CHANGELOG. Thanks also to @GabbaTauchi for the zai bug report (#758).

Install / upgrade

Channel	Command
PyPI	pip install -U vibe-trading-ai
uv tool	uv tool install --reinstall vibe-trading-ai
ClawHub (Claude Desktop / OpenClaw / MCP clients)	clawhub install vibe-trading or update the installed skill
Docker	docker compose pull && docker compose up -d

Remote API/Web deployments should set API_AUTH_KEY and explicit trusted CORS origins; local CLI and localhost Web UI workflows stay low-friction.

By the numbers

Numbers at 0.1.12: 8 backtest engines + options_portfolio · 462 alphas / 5 families · 88 skills · 30 swarm presets · 23 market-data sources · 12 broker connectors · 75 free-mode tools (78 with QVeris) · 54 MCP tools · 5 optimizers · 16 IM adapters.

Validation

Full backend suite 6,019 passed (only pre-existing env/network fails, confirmed against clean main); frontend build + 310 vitest green; wheel verified (vibe_trading_ai-0.1.12, contents spot-checked). Protected agent core (src/agent, src/session, src/providers) reviewed for every change.

Full changelog: CHANGELOG.md · Compare: v0.1.11...v0.1.12

v0.1.11 — India equity, fundamental factors, IM channels + roll-up

🇮🇳 v0.1.11 — India equity, fundamental factors, IM channels + roll-up since 0.1.10

v0.1.11 is a roll-up of three weeks of work. The headlines: Indian equity (NSE/BSE) becomes a first-class backtesting market, a PIT-safe fundamental factor layer brings the Alpha Zoo to 460 alphas across 5 families, the IM channel runtime delivers research through 16 message adapters, and scheduled research runs end to end. Around them ship an optional QVeris premium data track, the completed api_server modularization, centralized env config with a CI gate, a Trading 212 read-only connector (11 brokers), a turnover-aware portfolio optimizer (5 optimizers), an analyze_image vision tool, and a long tail of contributor fixes.

This release is available on PyPI, ClawHub, and GitHub Releases.

pip install -U vibe-trading-ai
# or
uv tool install --reinstall vibe-trading-ai

Highlights

🇮🇳 Indian equity (NSE/BSE) as a first-class market

A dedicated IndiaEquityEngine (#305, thanks @muku314115) models the market as it actually trades: T+1 delivery, no overnight shorts (opt-in intraday), configurable circuit bands, 1-share lots, and a config-driven STT / stamp-duty / exchange / SEBI / GST cost stack. .NS/.BO symbols route through yahoo → yfinance → india_broker → local, where india_broker is an opt-in read-only Shoonya/Dhan bar bridge, and 255 alpha101/qlib158 factors are opted into the new equity_in universe. Backtest engines: 7 → 8; market-data sources: 19 free + QVeris = 20.

💎 Fundamental factor layer, Phase 1 — PIT-safe SEC fundamentals

SEC company facts now flow into dense daily fund:* factor panels the same way price data does — filed-date anchoring (you only see what was public that day), a first-filed restatement policy, true-quarter (start, end) frame selection with Q4 synthesis so YTD/annual frames can't contaminate TTM, and rolling TTM aggregation. On top: a get_fundamentals tool and 4 quality/value factors in a new fundamental zoo family. With the 4 canonical academic alphas from earlier in the cycle (#277, thanks @Robin1987China — Jegadeesh reversal, George–Hwang 52-week high, Amihud illiquidity, Harvey–Siddique co-skewness), the Alpha Zoo grows 452 → 460 across 5 families.

💬 IM channel runtime — research delivery over 16 adapters

The same agent session runtime now attaches to 16 built-in message adapters — WebSocket, Telegram, Slack, Discord, Matrix, WhatsApp, Signal, QQ/NapCat, WeChat/WeCom, Feishu, DingTalk, email, MS Teams, MoChat — dependency-gated with install hints, configurable via AgentConfig.channels, and controllable from REST (/channels/*), CLI (vibe-trading channels ...), and Web Settings, in all 5 UI locales. This release also fixes the first-image papercut: inbound media now lands under ~/.vibe-trading/uploads/<channel>/, inside the agent's allowed file roots (#465, thanks @fei-moss), and NapCat private messages trigger pairing codes (#463).

⏰ Scheduled research, end to end

A default-off background executor (VIBE_TRADING_ENABLE_SCHEDULER) fires due interval/cron jobs through the session runtime (#278, thanks @mvanhorn), on top of a crash-safe atomic job store, auth-gated /scheduled-runs routes (tests in #452, thanks @Robin1987China), a Reports library, and post-backtest attribution. Combined with the Research Autopilot Phase 3 loop closure (#267, thanks @Robin1987China) — scaffold_signal_engine → link_autopilot_backtest — hypothesis → signal-engine → backtest → schedule now runs without a human in the middle.

💰 Optional QVeris premium data track

The 19 free sources stay the default. An explicit-only paid mode (Settings → QVeris or vibe-trading data mode paid) unlocks 63+ providers behind 3 key-gated tools (qveris_search / qveris_inspect / qveris_execute) with preview-by-default and a session budget gate. QVeris never enters auto-fallback: no key, no cost, no surprise.

🧰 Platform & safety

• api_server modularization completed — 1,103 → 371 lines (#424 closing #331, thanks @shadowinlife) after a cycle of route slices.
• Centralized env config — one Pydantic EnvConfig schema + an AST CI gate that rejects raw os.getenv outside the config layer (#440, thanks @shadowinlife).
• Trading 212 read-only connector (#321, thanks @mvanhorn) — 11 brokers. No runtime paper/live discriminator → place_order/cancel_order hard-refuse every order, paper included. Plus an opt-in PreTradeAdvisoryInterface that records advisory reviews without bypassing the mandate gate.
• Security: loopback CSRF protection (#293), SSRF-guard hardening for CGNAT/mesh ranges (#389), Pillow/langchain CVE floor bumps (#390), tightened dev defaults.
• Turnover-aware optimizer (#466, thanks @Robin1987China) — 5th optimizer: mean-variance utility with an L1 penalty on weight changes, so the portfolio trades only when improvement outweighs churn.
• analyze_image vision tool (#464, thanks @fei-moss) — semantic chart/screenshot reads through the session model (vision-capable model required). Tools: 72 free-mode / 75 with QVeris.
• Manifest count guards (#461, thanks @asahikiko) — packaged SKILL.md capability counts are now asserted against source in CI.

🙌 Contributor cycle

60 contributor-authored PRs merged since 0.1.10 (73 total). Full per-person credits live in the README Contributors section and the CHANGELOG — highlights: @shadowinlife (12 PRs incl. the api_server capstone), @Robin1987China (autopilot P3, academic alphas, shadow-account conditions, turnover optimizer), @muku314115 (India equity), @mvanhorn (scheduler, Trading 212), @fei-moss (vision tool + IM fixes), @sambazhu (value-investing toolkit), and many more.

Numbers at 0.1.11: 8 backtest engines · 460 alphas / 5 families · 86 skills · 30 swarm presets · 20 data sources · 72 free tools (75 paid) · 54 MCP tools · 11 broker connectors · 16 IM adapters · 5 optimizers.

v0.1.10 — Global data layer + roll-up since 0.1.9

🌍 v0.1.10 — Global data layer + roll-up since 0.1.9

v0.1.10 is a roll-up release. The headline is the Global data layer: the market-data registry grows from 10 to 18 sources and gains 18 read-only data tools that reach past OHLCV into fundamentals and flow, all exposed over MCP. Around it ships everything accumulated since 0.1.9 — 10 broker SDK connectors, the Alpha Zoo alpha compare full stack, a provider-reliability overhaul, Research Autopilot Phase 1, an opt-in local data cache, and a community-driven security-hardening wave.

This release is available on PyPI, ClawHub, and GitHub Releases.

pip install -U vibe-trading-ai
# or
uv tool install --reinstall vibe-trading-ai

Highlights

🌍 Global data layer — 18 sources + 18 read-only data tools

The loader registry grows from 10 to 18 market-data sources:

• Free, no key — tushare, okx, yfinance, akshare, baostock, tencent, mootdx, ccxt, futu, local, plus four new direct-API additions: Eastmoney, Sina, Stooq, and a direct-HTTP Yahoo client.
• Optional key-gated US providers — Finnhub, Alpha Vantage, Tiingo, FMP; absent keys are skipped in the fallback chain, never crash it.

Fallback chains are re-ordered by IP-ban risk (lightweight, throttle-tolerant public endpoints lead; key-gated REST trails) behind a shared throttled HTTP gate (backtest/loaders/_http.py) with per-host rate buckets, jitter, and session reuse. On top sit 18 read-only data tools — fund flow, dragon-tiger board, northbound (Stock-Connect) flow, margin trading, block trades, shareholder count, lockup expiry, sector membership, research reports, news, SEC filings (EDGAR + XBRL), financial statements, options chains, institutional holdings, full-market screening, symbol search, FRED macro, and iwencai natural-language A-share search — across A-share / US / HK, all exposed over MCP. Three shared clients (eastmoney / yahoo / sec_edgar) back the loaders and tools, and a consolidated data-routing index plus per-source eastmoney / sec-edgar skills document the layer.

💱 10 broker SDK connectors — read + paper, mandate-gated live

Trading is connector-first: pick a profile, and paper/live is an attribute of the connector. This release brings the roster to 10 brokers — IBKR (local read-only TWS/Gateway) · Robinhood (Agentic MCP, OAuth) · Tiger · Longbridge · Alpaca · OKX · Binance · Futu · Dhan · Shoonya (India NSE/BSE + F&O). Direct-SDK connectors share a broker_sdk transport and each does read + paper-account order placement; live placement passes a single fail-closed bounded-autonomy gate (sdk_order_gate.py: mandate + kill switch + audit). Brokers with no runtime paper/live discriminator (Longbridge, Dhan, Shoonya) are structurally capped at paper + read-only — their place_order / cancel_order hard-refuse any non-paper config at the first line. Order-placing tools stay off MCP (agent + CLI only).

📊 Alpha compare across CLI / REST / Web / agent tool

vibe-trading alpha compare ranks any set of Alpha Zoo factors by IC / IR on your universe, sharing one compare_runner.compare_alphas core behind the CLI, a POST /alpha/compare REST route with SSE-streamed progress, the Alpha Zoo Web UI Compare view, and a read-only alpha_compare agent tool. A run_bench(only=…) subset filter benches only the compared factors instead of the whole zoo.

🔌 Provider-reliability overhaul

A provider capability layer gates reasoning capture/replay, Gemini thought signatures, Kimi user-agent, and OpenRouter reasoning bodies per provider. vibe-trading provider doctor prints a redacted diagnostic snapshot. Streaming failures now raise an explicit, redacted ProviderStreamError (carrying status_code + .retryable) with one retry for transients and fail-fast on 4xx; a throttled reasoning_delta SSE drives a "Reasoning…" liveness indicator in the Web UI. Also: an optional native DeepSeek adapter (VIBE_TRADING_DEEPSEEK_ADAPTER), read-only tool hard-timeouts (VIBE_TRADING_TOOL_TIMEOUT_SECONDS), and per-provider temperature handling (Kimi-k2 forced to 1.0, MiniMax clamped > 0).

🔬 Research Autopilot Phase 1

run_research_autopilot turns a hypothesis_id into a research goal (thesis as objective, backtest-relevant acceptance criteria, next-step hints), and generate_backtest_config auto-writes a backtest config.json from the hypothesis's universe and data sources — so the agent goes straight from idea → signal_engine.py → run.

🗃️ Opt-in local data cache + local loader

VIBE_TRADING_DATA_CACHE=1 caches settled bars to ~/.vibe-trading/cache (user home, never the repo); a staleness guard never caches a range ending today, and cached frames are byte-identical to live fetches. A new local loader reads OHLCV straight from your own CSV / Parquet / DuckDB files via ~/.vibe-trading/data-bridge/config.yaml, with normal fallback-chain support.

🛡️ Security & hardening wave

A community-driven hardening pass: API settings-write auth (#245), agent shell-tool opt-in (#243), loopback-host rebinding rejection (#242), explicit local-shutdown auth (#241), and identifier containment for mandate proposal-ids (#256), persistent-memory types (#257), and MCP swarm run-ids (#258). Plus responsive Stop mid-stream + SSE reconnect on returning to a running session (#229), multi-engine web_search fallback (#231), and Gemini thoughtSignature round-trip through OpenAI-compat tool calls (#176, #184).

🪪 Version reporting is now consistent

--version, the REST API (/docs + /api), the MCP server handshake, and the Web UI footer all derive from one source — the REST API had drifted to a wrong hardcoded 5.0.0. Packaging also now ships skill example scripts in the wheel, and the Docker image installs weasyprint's native libs so PDF reports render.

Install / upgrade

Channel	Command
PyPI	pip install -U vibe-trading-ai
uv tool	uv tool install --reinstall vibe-trading-ai
ClawHub (Claude Desktop / OpenClaw / MCP clients)	clawhub install vibe-trading or update the installed skill
Docker	docker compose pull && docker compose up -d

Remote API/Web deployments should set API_AUTH_KEY and explicit trusted CORS origins. Local CLI and localhost Web UI workflows remain low-friction.

By the numbers

• ~98 non-merge commits since v0.1.9
• 18 market-data sources with auto-detect + ban-risk-ordered fallback
• 66 agent tools (auto-discovered) · 54 MCP tools
• 79 bundled finance skills
• 29 swarm presets
• 10 broker connectors (read + paper, bounded-live for those with a structural paper/live guard)
• 7 backtest engines + composite cross-market engine + options portfolio
• 4167 backend tests passing (the weasyprint shadow-report PDF suite is green on CI; it segfaults only on macOS/conda without Pango)
• Clean-room verified: a fresh pip install of the 0.1.10 wheel imports all new loaders/tools, and the wheel + sdist ship the eastmoney / sec-edgar skills including UTF-8 Chinese reference filenames

🙌 Credits

Code contributors this cycle

• @warren618 / Haozhe Wu — the global data layer (8 sources + 18 read-only data tools, 3 shared clients), the 10 broker SDK connectors + bounded-autonomy order gate, the alpha-compare full stack, the provider-reliability overhaul, multi-engine web_search fallback, responsive Stop + SSE reconnect, multi-language READMEs, integration, release.
• @Hinotoi-agent — a security-hardening wave: explicit local-shutdown auth (#241), loopback-host rebinding rejection (#242), agent shell-tool opt-in (#243), settings-write auth (#245), mandate proposal-id containment (#256), persistent-memory type validation (#257), MCP swarm run-id containment (#258)
• @mvanhorn — the opt-in local data cache (#177), Gemini thoughtSignature round-trip over OpenAI-compat tool calls (#176), the custom data loader guide (#194), and the glm/zhipu provider alias + model-name inference (#247)
• @gyx09212214-prog — loader robustness for malformed crypto/RSSHub timeout env vars (#227, #240), requested yfinance end-date inclusion (#226), strict run-card JSON for non-finite metrics (#238), and ddgs retry-fallback coverage (#239)
• @BillDin — swarm agent status in the chat UI (#188), explicit preset-name handling (#189), the loader-backed market-data tool for swarm workers (#199), and preset-context continuations (#200)
• @Robin1987China — the Research Autopilot goal-hypothesis bridge (#260), the local CSV/Parquet/DuckDB data loader (#252), and an assistant-prefill fix + configurable Kimi User-Agent (#248)
• @LemonCANDY42 — the read-only runtime status dashboard (#210), persisted AgentLoop usage artifacts (#223), and opt-in Run Detail chart payloads (#225)
• @zwrong — the trace.jsonl overhaul with zero truncation + offload (#206) and session-id on exit + resume <session-id> (#218)
• @forge-builder — the AI contributor guide (#173) and the OpenClaw MCP research-only smoke-test docs (#165)
• @skloxo — Chinese (zh-CN) frontend localization (adopted from #217)
• @LeeCQiang — Chinese docstrings across all 452 Alpha Zoo factors (#180)
• @KaiLuettmann — GHCR pre-built image publishing on release (#187)
• @ngoanpv — Gemini thought_signature preservation through the AgentLoop dict path (#184)
• @ShahNewazKhan — Docker host-Ollama reachability via host.docker.internal (#196)
• @sambazhu — frontend sync of completed chat attempts (#236)
• @bhlt — baostock-native code format support (#230)
• @octo-patch — MiniMax M3 default model upgrade (#162)

Lab + community

• HKUDS (HKU Data Intelligence Lab) — research direction, infrastructure, and the broader Vibe-Trading platform this builds on.
• Everyone who filed issues, revi...

v0.1.9 — Connectors + Research Goal + swarm retry/reconcile + robustness

pip install -U vibe-trading-ai · 36 MCP tools · 77 skills · 29 swarm presets

A roll-up release covering everything since 0.1.8.

Highlights

• Connector-first broker profiles (IBKR + Robinhood). Trading access starts from a selectable connector profile instead of separate broker/live entry points; vibe-trading connector list/use/check/account/positions/orders/quote/history and the MCP trading_* tools share the selected profile, with paper/live as an attribute of the connector. IBKR is usable immediately as a local read-only TWS / IB Gateway profile; the official IBKR remote MCP path is seeded as an OAuth mcp.read probe until stable read tool names ship. Robinhood Agentic Trading is a bounded connector behind OAuth, a committed mandate, an order guard, an audit ledger, and an instant halt switch.
• Research Goal runtime. Long-running, research-only goals with auditable checklist criteria, budgets, and a /goal CLI command, plus REST + MCP endpoints and a Web GoalDrawer.
• Swarm pass. Live reconcile + MCP keepalive (#132), operator-configured external MCP tools in workers (#142), DAG gating when an upstream task fails (#145), a strict alpha-bench random control (#143), and a new retry_run to relaunch failed/stale runs — 36 MCP tools now.
• CLI package refactor (agent/cli/) with a refreshed terminal UI, plus a mootdx no-token A-share loader and CCXT proxy-env support.

Fixes

• --version no longer drifts (#156) — derives from package metadata, falling back to pyproject.toml; no hardcoded constant left to forget on release.
• Robustness pass: pre-flight validation for LLM-generated signal engines (#149), graceful agent-loop exit at the iteration budget (#148), flush + fsync session writes that skip corrupted JSONL on read (#147), and IME Enter handling in the Web composer (#146).
• Session running-status indicator survives reconnect / reload / sidebar nav; cross-browser Full Report links (#150); configurable SSE idle timeout via VIBE_TRADING_SSE_TIMEOUT (#157); cross-market correlation timestamp alignment (#158).

Contributors

Thanks to this cycle's contributors:

• @toanalien — session JSONL hardening (#147), graceful loop exit (#148), signal-engine pre-flight validation (#149), cross-browser Full Report links (#150)
• @ai7eam-dev — cross-market correlation alignment (#158), session running indicator + swarm retry (#159 → #160)
• @shadowinlife — remote MCP over SSE/HTTP (#125), worker external MCP tools (#142)
• @DoubleSky123 — configurable SSE idle timeout (#157)
• @ArthurXi — IME Enter handling (#146)
• @omcdecor-cyber — swarm DAG gating on failed upstream (#145)
• @Soli22de — strict alpha-bench random control (#143)
• @ruok808 — CCXT proxy-env support (#126)
• @faizack — remote Ollama base-URL normalization (#129)
• @fightZy — agent session history loading fix (#136)
• @lcwSeven — short universe names in the alpha list endpoint (#137)
• @Teerapat-Vatpitak — resolved .env-source logging (#124)
• @warren618 / Haozhe Wu — connector profiles, Robinhood Agentic Trading channel, Research Goal runtime, swarm reconcile + retry_run, CLI refactor, mootdx loader, release integration

Full Changelog: v0.1.8...v0.1.9

v0.1.8 — Alpha Zoo v1 (452 alphas across 4 zoos)

🧬 v0.1.8 — Alpha Zoo v1 + research workflow polish

v0.1.8 is a major content release for Vibe-Trading. The headline is the Alpha Zoo: 452 pre-built quantitative alphas across four bundled libraries — qlib158, alpha101, gtja191, and academic — with a one-line CLI to bench any zoo on your universe, agent integration via two new tools, four new REST routes with SSE-streamed progress, and a browse/detail/bench Web UI at /alpha-zoo. The release also lands the long-running MCP client integration, a Trust Layer run card in the Web UI, the public wiki launch at vibetrading.wiki, the Hypothesis Registry MVP, and a substantial security + hardening pass driven by community PRs.

This release is available on PyPI, ClawHub, and GitHub Releases.

pip install -U vibe-trading-ai
# or
uv tool install --reinstall vibe-trading-ai

Highlights

🧬 Alpha Zoo — 452 pre-built quant alphas across 4 zoos

Cross-sectional formulaic alphas with metadata, lookahead-banned at the operator layer, registry-validated, and reachable from CLI, agent, REST API, and Web UI:

• qlib158 — 154 alphas. Apache-2.0 port of Microsoft Qlib's Alpha158 feature handler, with the upstream commit SHA pinned in every adapted module's header and the upstream NOTICE bundled.
• alpha101 — 101 alphas. Implementation of Kakushadze (2015) "101 Formulaic Alphas" (arXiv:1601.00991), written from the paper appendix. 19 industry-neutral alphas flag requires_sector=True and skip cleanly on universes without sector tags.
• gtja191 — 191 alphas. Implementation of Guotai Junan Securities' 2014 "191 Short-period Trading Alpha Factors" research report. Operator-mapping decisions (SMA / WMA / REGBETA / HIGHDAY interpretations) documented per alpha.
• academic — 6 factors. Fama-French 5 + Carhart momentum, shipped as honest price-based proxies (the canonical FF series need book-to-market / profitability / investment growth fundamentals we don't bundle). The nicknames carry a [PRICE PROXY] prefix; Kenneth French's data library is referenced for users who need the canonical monthly returns.

Each alpha carries a __alpha_meta__ dict (formula LaTeX, theme, universe, columns_required, warmup, decay horizon, notes) validated by a pydantic extra="forbid" schema.

🖥️ One-line CLI

vibe-trading alpha list --zoo gtja191 --theme momentum --limit 10
vibe-trading alpha show gtja191_171
vibe-trading alpha bench --zoo gtja191 --universe csi300 --period 2018-2025 --top 20
vibe-trading alpha compare --all
vibe-trading alpha export-manifest --out wiki/alpha-library/manifest.json

bench drives a Rich progress bar with live alpha-id + ETA banner, returns proper exit codes on failure, and silences scipy ConstantInputWarning noise. All five subcommands honour TTY hints and a --json mode for scripting.

🌐 Web UI at /alpha-zoo + 4 REST routes with SSE

Three views in the React Web UI: Browse (4 zoo cards, filter bar, paginated table), Detail (formula, metadata, source code), Bench (form → SSE-streamed progress → Alive/Reversed/Dead stat cards + Top-5-by-IR + Most-Reversed tables + by-theme bar chart). Auto-Vite route at /alpha-zoo, nav entry in the Layout.

GET  /alpha/list?zoo=&theme=&universe=&limit=
GET  /alpha/{alpha_id}
POST /alpha/bench               (body: {zoo, universe, period, top}) → 202 + job_id
GET  /alpha/bench/{job_id}/stream   (SSE: progress / result / done / error)

Background bench jobs run via asyncio.to_thread with a 2-concurrent-job semaphore (429 on saturation), in-memory state with 1-hour TTL, 15-second heartbeat comment frames to keep proxies from closing idle streams, and sanitised error messages so unexpected exceptions don't leak server-side paths.

🤖 Agent integration

Two new auto-discovered tools (AlphaZooTool, AlphaBenchTool) plus a panel-style ZooSignalEngine.from_zoo(...) factory in the multi-factor skill that composes one or more alphas into a long-short signal compatible with the existing backtest engines. The legacy per-symbol example_signal_engine.py is preserved for backward compatibility.

🛡️ Safety floor

Quality gates that fire on every PR and vibe-trading alpha bench run:

• AST purity gate (test_alpha_purity.py) — scans every zoo/**/*.py module, allows only pandas, numpy, scipy.*, src.factors.base, __future__, typing, math, dataclasses imports; bans os / sys / subprocess / socket / urllib / requests / httpx / pathlib / Path / open / eval / exec / compile / __import__ plus breakpoint / input / globals / locals / vars / __class__ / __subclasses__ / __mro__ / __globals__ / __builtins__, plus dunder-string getattr access (including BinOp-concatenated dunders).
• Lookahead sentinel test (test_lookahead.py) — 300-row synthetic panel; corrupt rows past the probe; assert factor at probe unchanged within 1e-9.
• pytest-socket integration — factors test suite runs network-disabled.
• CI grep gates (tools/ci_grep_gates.sh) — rejects yaml.load( without safe_load, the trademarked-name string in shipped artifacts, and any per-stock-code data leak in wiki/**/*.{json,csv,html}.

📡 MCP client integration (stdio v1)

The agent can now load tools from external MCP servers via ~/.vibe-trading/agent.json, opt-in per session via ALLOW_SESSION_MCP_SERVERS=1. Stdio transport only in v1; HTTP/SSE deferred. Tool-name collisions get a deterministic hash suffix; remote-tool failures normalise to error payloads instead of bubbling. Big thank-you to @shadowinlife (#83) for the end-to-end implementation and the security-conscious defaults.

🪪 Trust Layer run card in Web UI

The run detail page now renders run_card.json alongside metrics and artifacts, completing the UI half of the trust-layer work that landed earlier.

🧠 Hypothesis Registry (backend MVP)

create_hypothesis / update_hypothesis / link_backtest / search_hypotheses give research hypotheses a durable lifecycle, links to run cards, and invalidation notes. UI integration to follow.

🔬 Memory, swarm, and tooling hardening

A focused PR cycle from @Teerapat-Vatpitak strengthened the lower-level surfaces this release leans on:

• PersistentMemory.add() hardened against length overflow, empty / whitespace-only names, and C0/C1 control bytes (#112)
• Swarm error surfacing + output contract, Windows-safe store, path redaction (#119)
• MCP unresolved-symbol, finite options validation, row cap (#120)
• Bounded CCXT + OKX fetch with timeout / retry / budget (#121)
• read_url Jina dependency disclosure + cache opt-out (#122)
• API path-ID validation for run/session routes (#80, via @SJoon99)

Plus @hp083625 taught memory recall to treat underscores as token boundaries (#87) so mcp_wiring_test matches "mcp wiring", @voidborne-d kept the Vite dev proxy honoring VITE_API_URL and fixed CJK slug preservation (#82, #95), and @ykykj added the CLI startup preflight (#96).

🌐 Public wiki at vibetrading.wiki

The wiki ships its own Alpha Library renderer (wiki/scripts/build_alpha_library.py) that reads the manifest JSON and emits 452 per-alpha pages + 4 per-zoo overview pages, each with script-src 'none' CSP. The research-lab gains its first long-form post: "Which of the 191 GTJA alphas still work in 2026?" — aggregate IC, theme survival rates, and the top alphas that survive eight years of out-of-sample data on CSI 300 (2018-2025), with a survivorship-bias caveat.

Install / upgrade

Channel	Command
PyPI	pip install -U vibe-trading-ai
uv tool	uv tool install --reinstall vibe-trading-ai
ClawHub (Claude Desktop / OpenClaw / MCP clients)	clawhub install vibe-trading or update the installed skill
Docker	docker compose pull && docker compose up -d

Remote API/Web deployments should set API_AUTH_KEY and explicit trusted CORS origins. Local CLI and localhost Web UI workflows remain low-friction.

By the numbers

• 66 non-merge commits since v0.1.6's successor branch (since v0.1.7)
• 452 pre-built quant alphas across 4 zoos
• 75 bundled finance skills (+ the alpha-zoo skill folder)
• 31 default agent tools (was 29; +alpha_zoo_tool, +alpha_bench_tool)
• 29 swarm presets
• 6 data sources with auto-fallback: tushare, yfinance, okx, akshare, ccxt, futu
• 7 backtest engines + composite cross-market engine + options portfolio
• 22 MCP tools (alpha tools to be MCP-wrapped in 0.1.9)
• 969 tests passing + 1 documented skip (alpha101_096 NaN-cascade on synthetic panel)

🙌 Credits

This release stands on the shoulders of giants. Heavy emphasis because the Alpha Zoo borrows mathematical content from decades of public research.

Code contributors this cycle

• @warren618 / Haozhe Wu — Alpha Zoo framework + 4 zoos, CLI, Web UI, REST + SSE API, bench runner, safety floor, wiki + research-lab post, multi-language READMEs, integration, release.
• @shadowinlife — MCP client integration (stdio, v1) (#83)
• @Teerapat-Vatpitak — PersistentMemory.add() hardening (#112), swarm error surfacing + Windows-safe store + redaction (#119), MCP unresolved-symbol + options validation (#120), bounded CCXT + OKX fetch (#121), read_url Jina disclosure (#122)
• @SJoon99 — API path-ID validation hardening (#80)
• @hp083625 — memory recall underscore tokenization (#87)
• @voidborne-d — CJK slug preservation in memory (#95), Vite dev proxy VITE_API_URL (#82)
• @ykykj — CLI startup preflight (#96)
• @mrbob-git — Tushare statement-field filtering (#76, #77)
• @Teerapat-Vatpitak (also) — extend tokenizer + slug regex to Thai/Arabic/Hebrew/Cyrillic (#104)

Open-source software cited / bundled

• Microsoft Qlib team ([microsoft/qlib...

v0.1.7 — Security boundary hardening + research workflow polish

🛡️ v0.1.7 — Security boundary hardening + research workflow polish

v0.1.7 is a security-focused maintenance release for Vibe-Trading. It strengthens the default API, file, URL, generated-code, shell-tool, Docker, CLI/Web, and MCP/ClawHub boundaries while preserving the low-friction localhost workflow for normal CLI and Web UI users.

This release is available on PyPI, ClawHub, and GitHub Releases.

pip install -U vibe-trading-ai
# or
uv tool install --reinstall vibe-trading-ai

Highlights

🛡️ Security boundary hardening

The main goal of this release is to make Vibe-Trading safer by default without turning local research workflows into configuration work.

• API authentication and read protection: non-local API use is now much stricter by default, and sensitive run/session/swarm read paths are protected consistently.
• Upload and local-file boundaries: upload handling and local file-reading tools now use tighter path/type boundaries, with regression tests covering the previously risky paths.
• Document and URL readers: local document reads and outbound URL reads now enforce stronger safety checks.
• Shell-capable tools: shell execution tools are gated by entry point / explicit opt-in, reducing accidental exposure in Web/API/Docker/MCP deployments.
• Generated strategy loading: generated backtest and Shadow Account strategy code is validated before execution/import.
• Docker baseline: the runtime image now runs as a non-root vibe user, and Docker Compose defaults are localhost-first.
• Durability: the hardening is backed by regression tests across auth, upload, path safety, document reading, web reading, tool registry, backtest loading, and Shadow Account codegen.

Thanks to lemi9090 (S2W) for the coordinated security report and fast validation of the fix coverage before release.

⚙️ Web UI Settings

New Settings surfaces make provider/model, base URL, reasoning effort, and data-source credential state manageable from the Web UI, backed by local/auth-protected settings APIs and data-driven provider metadata. (#57)

🔥 Correlation heatmap

The new correlation dashboard/API computes rolling return correlations and renders an ECharts heatmap for portfolio and symbol analysis. Follow-up fixes aligned the frontend proxy and PR review blockers. (#64, #66)

🔐 OpenAI Codex OAuth provider

Vibe-Trading now supports the OpenAI Codex provider via ChatGPT OAuth login (vibe-trading provider login openai-codex), with Settings metadata and provider adapter tests. (#65)

🧭 A-share pre-ST filter skill

New ashare-pre-st-filter skill for A-share ST/*ST risk screening, with follow-up relevance filtering so securities-account list mentions do not inflate E2 penalty counts. (#63)

🖥️ Interactive CLI UX

Interactive mode now has a live bottom status bar for provider/model, session duration, last-run latency, and cumulative tool-call stats, plus prompt history navigation and cursor editing through prompt_toolkit. (#69)

🧩 Swarm preset inspection

vibe-trading --swarm-inspect <preset> and related plumbing make it easier to inspect swarm presets before running multi-agent workflows. (#73)

📈 Dividend analysis skill

Added the dividend-analysis bundled skill for income stocks, payout sustainability, dividend growth, shareholder yield, ex-dividend mechanics, and yield-trap checks.

🧰 Local dev workflow

Added a one-command local dev workflow through scripts/dev up|open|logs|stop, plus Codespaces support and frontend/backend dev ergonomics. This is intended to make clean local testing and demos much easier.

0.1.7 maintenance

• Release metadata: PyPI package, CLI banner, Web UI footer, Docker OCI labels, and ClawHub manifest are synced to 0.1.7.
• CLI: vibe-trading --version now reports the installed version.
• ClawHub: manifest now reflects 74 bundled finance skills and the current MCP command surface.
• Frontend build deps: raised vite, postcss, and related lockfile floors to audited patched versions.
• Docs: README news was refreshed across all language variants before this release, while older entries remain collapsed.
• Tests: focused security, CLI, registry, packaging, and frontend build checks passed before publishing.

Install / upgrade

Channel	Command
PyPI	pip install -U vibe-trading-ai
uv tool	uv tool install --reinstall vibe-trading-ai
ClawHub (Claude Desktop / OpenClaw / MCP clients)	clawhub install vibe-trading or update the installed skill
Docker	docker compose pull && docker compose up -d

Remote API/Web deployments should set API_AUTH_KEY and explicit trusted CORS origins. Local CLI and localhost Web UI workflows remain low-friction.

By the numbers

• 26 commits since v0.1.6
• 8 merged PRs
• 25 default agent tools, with 22 exposed through MCP
• 74 bundled finance skills (+ user-created skills)
• 29 swarm presets
• 6 data sources with auto-fallback: tushare, yfinance, okx, akshare, ccxt, futu
• 7 backtest engines + options portfolio
• 14 LLM providers

🙌 Contributors

Thanks to everyone who contributed code, docs, reports, review, and validation in this cycle:

• @GTC2080 / TaoMu — Web UI Settings and provider/data-source configuration APIs (#57)
• @BigNounce90 — validation CLI hardening for backtest run_dir input (#60)
• @shadowinlife — A-share pre-ST filter skill (#63)
• @MB-Ndhlovu — correlation heatmap dashboard and review fixes (#64, #66)
• @ykykj — OpenAI Codex OAuth provider option (#65)
• @RuifengFu — interactive CLI live status bar and prompt editing (#69)
• @SiMinus — swarm preset inspection command (#73)
• @warren618 / Haozhe Wu — security hardening, release integration, docs, Docker, packaging, and local dev workflow
• lemi9090 (S2W) — coordinated security research, validation, and disclosure support

Changelog

Full changes: v0.1.6...v0.1.7

Merged PRs since v0.1.6 (8)

• #73 feat: add swarm preset inspection command — @SiMinus
• #69 feat(cli): add live streaming status indicator and arrow-key navigation to interactive mode — @RuifengFu
• #66 Feat/correlation heatmap — @MB-Ndhlovu
• #65 feat: add OpenAI OAuth provider option — @ykykj
• #64 Feat/correlation heatmap — @MB-Ndhlovu
• #63 feat(skill): add ashare-pre-st-filter — A股 ST/*ST 风险预测框架 — @shadowinlife
• #60 fix: validate backtest run_dir CLI input — @BigNounce90
• #57 feat: add model and data source settings UI — @GTC2080

All commits since v0.1.6 (26)

• 488abd9 chore(release): prepare 0.1.7 — Haozhe Wu
• d5558eb chore: add local dev workflow — Haozhe Wu
• dfc5c14 feat: add swarm preset inspection command (#73) — SiMinus
• e07cdc9 Harden supplemental security boundaries — Haozhe Wu
• 2cf19b6 docs: collapse older readme news — Haozhe Wu
• 292b673 docs: refresh readme news for cli ux — Haozhe Wu
• bb67dc7 fix(tests): align CI path expectations — Haozhe Wu
• 64da282 Merge pull request #69 from RuifengFu/feat/cli-ux-improvements — Haozhe Wu
• bf084b3 Harden API and tool security defaults — Haozhe Wu
• 3d171dc feat(cli): add live status bar and arrow key navigation — RuifengFu
• f0c3eb6 docs: refresh readme news and roadmap — Haozhe Wu
• 9501baf feat(skills): add dividend analysis skill — Haozhe Wu
• 7452610 fix(frontend): proxy correlation endpoint — Haozhe Wu
• eb5eda8 Merge pull request #66 from MB-Ndhlovu/feat/correlation-heatmap — Haozhe Wu
• b95bb41 docs: sync multilingual news updates — Haozhe Wu
• 0b95d68 feat: add correlation heatmap dashboard (#64) — MB-Ndhlovu
• dea99ec feat: add OpenAI Codex OAuth provider option (#65) — ykj@hku
• 3c9577f fix correlation PR review blockers — Malibongwe Ndhlovu
• b22ca78 fix(skill): harden ashare penalty relevance filtering — Haozhe Wu
• 968b649 feat(skill): add ashare pre-ST filter — shadowinlife
• bbbef46 feat: cross-asset correlation heatmap dashboard — Malibongwe Ndhlovu
• 8520bfe fix(cli): remove broken rich.box import — Malibongwe Ndhlovu
• 7259b42 fix(cli): remove broken rich.box import — Malibongwe Ndhlovu
• 3ccfa10 docs: sync README updates for settings UI and validation CLI — Haozhe Wu
• 282c881 fix: validate backtest run_dir CLI input (#60) — BigNounce
• a015452 feat: add model and data source settings UI (#57) — TaoMu

Validation before publishing

• PyPI upload completed and vibe-trading-ai==0.1.7 was installed from PyPI in a clean venv.
• ClawHub vibe-trading@0.1.7 is published and marked latest.
• Docker image label and runtime user were verified (0.1.7, non-root vibe).
• Focused security and CLI/registry tests passed.
• Frontend production build passed.
• npm audit --audit-level=moderate returned 0 vulnerabilities.
• twine check passed for both wheel and sdist.

v0.1.6 — Swarm presets packaging fix

🚀 v0.1.6 — Critical packaging fix + community-driven features

If you installed vibe-trading-ai==0.1.5 via pip install or uv tool install, vibe-trading --swarm-presets returned No presets available and run_swarm was unusable. This release fixes that — please upgrade.

pip install -U vibe-trading-ai
# or
uv tool install --reinstall vibe-trading-ai

Highlights

🐛 Swarm presets packaging fix (#55)

Preset YAMLs were declared via [tool.setuptools.data-files] in pyproject.toml, which lands them under <install-prefix>/.data/data/config/swarm/ rather than at <site-packages>/config/swarm/ where the loader looked. Editable installs (pip install -e .) happened to work because the source-tree path resolved correctly, so the bug only surfaced in published wheels — every pip install vibe-trading-ai==0.1.5 was broken on this code path.

Resolution: 29 preset YAMLs moved into agent/src/swarm/presets/ so they ship as ordinary package-data. Loader now resolves via Path(__file__).parent / "presets" — identical under editable installs and built wheels. Pinned by a 6-test packaging regression suite so this can't silently regress again.

Bug reported by @qxj — screenshots made it a 5-minute root cause hunt.

📊 Benchmark comparison panel

Backtest output now ships a benchmark comparison panel (ticker / benchmark return / excess return / information ratio) with yfinance-backed resolution for SPY, CSI 300, and other major indices. Contributed by @MB-Ndhlovu (#48).

🛡️ /upload streaming + size limits

The /upload endpoint streams the request body in 1 MB chunks and aborts past MAX_UPLOAD_SIZE with partial-file cleanup. The 50 MB cap is now actually enforced under malicious / oversized clients. Pinned by 4 regression tests. Contributed by @genoshide (#53).

📈 Futu data loader (HK + A-share)

6th data source — Futu OpenAPI integration for Hong Kong and A-share equities, with broker-grade real-time quotes. Contributed by @hamza-mobeen (#47).

🔧 vnpy CtaTemplate export skill

72nd skill — vnpy-export generates ready-to-run CtaTemplate strategy code for the vnpy backtest framework. Contributed by @hamza-mobeen (#46).

0.1.6 maintenance

• Loader: AKShare loader correctly routes ETFs (510300.SH) and forex (USDCNH) to the right endpoints with hardened registry fallback
• Workspace: Relative run_dir normalized to active run dir — fixes empty/relative paths in tool calls (#43, @Mothilal-M)
• Security: Path containment enforced in safe_path + sandboxing for journal / shadow account tools
• Build: MANIFEST.in ships .env.example / tests / Docker files in sdist
• Frontend: Route-level lazy loading shrinks initial bundle 688 KB → 262 KB
• Docs: README usage examples (#45, @hamza-mobeen)
• SKILL manifest: synced to 22 MCP tools / 72 skills / 6 data sources / 29 swarm presets

Install / upgrade

Channel	Command
PyPI	pip install -U vibe-trading-ai
uv tool	uv tool install --reinstall vibe-trading-ai
ClawHub (Claude Desktop / OpenClaw)	clawhub install vibe-trading
Docker	docker compose pull && docker compose up -d

By the numbers

• 27 agent tools (22 exposed via MCP)
• 72 bundled skills (+ user-created via full CRUD)
• 6 data sources with auto-fallback: tushare, yfinance, okx, akshare, ccxt, futu (new)
• 29 swarm presets, 7 backtest engines + options portfolio
• 13 LLM providers

🙌 New contributors

Huge thanks to everyone who opened a PR in this cycle — all 4 are first-time contributions to Vibe-Trading:

• @hamza-mobeen — Futu data loader (#47), vnpy CtaTemplate export skill (#46), README usage examples (#45) — three first-time PRs in one cycle 👏
• @MB-Ndhlovu — backtest benchmark comparison panel (#48)
• @genoshide — /upload streaming + size limits (#53)
• @Mothilal-M — _normalize_tool_run_dir workspace fix (#43)

Issue reporters who kept the surface area honest: thanks to @qxj for the high-quality #55 reproduction and to @myrassel for the OAuth feature suggestion (#49) we are tracking for a future release.

Changelog

Full changes: v0.1.5...v0.1.6

Merged PRs since v0.1.5 (6)

• #53 fix: stream uploads while enforcing API size limit — @genoshide
• #48 feat(cli): add benchmark comparison to backtest output — @MB-Ndhlovu
• #47 feat: add Futu data loader for HK and A-share equities — @hamza-mobeen
• #46 feat: add vnpy export skill for CtaTemplate strategies — @hamza-mobeen
• #45 docs: add usage examples to README — @hamza-mobeen
• #43 feat(loop): add _normalize_tool_run_dir function and corresponding tests — @Mothilal-M

v0.1.5 — Shadow Account + Trade Journal Analyzer

Highlights

Two new hero loops on top of the research agent — extract your own strategy from your broker journal, then backtest the shadow of how you should have traded.

👥 Shadow Account (new)

Upload a broker journal → LLM extracts your rules → run the rulebook across markets → 8-section HTML/PDF report showing exactly how much P&L you leave on the table to discipline breakdowns (rule violations, early exits, missed entries, counterfactual trades). 4 new tools (extract_shadow_strategy, run_shadow_backtest, render_shadow_report, scan_shadow_signals) + 1 skill.

📊 Trade Journal Analyzer (new)

analyze_trade_journal ingests 同花顺 / 东方财富 / 富途 / generic CSV exports → full trading profile (holding days, win rate, PnL ratio, drawdown) + 4 behavior diagnostics (disposition effect, overtrading, chasing momentum, anchoring).

📄 Universal File Reader (new)

read_document dispatches PDF, Word, Excel, PowerPoint, images (OCR), and 40+ text formats behind one unified envelope. read_url via Jina for web.

🧠 Agent Harness v2

• Persistent cross-session memory (~/.vibe-trading/memory/)
• SQLite FTS5 session search
• Self-evolving skills — full CRUD (save / patch / delete / skill_file)
• 5-layer context compression
• Read/write tool batching
• 107 new tests

0.1.5 maintenance

• Security: python-multipart >= 0.0.18 (CVSS 7.5 CVE floor)
• MCP: 5 new tools exposed (trade journal + shadow account family), fixed pattern_recognition → pattern registry name mismatch (was returning 404)
• Docker parity: 9 runtime deps added to requirements.txt (openpyxl, python-docx, python-pptx, pypdfium2, Pillow, ddgs, jinja2, matplotlib, weasyprint) — Docker image was silently missing these
• CLI: banner version bumped to 0.1.5 (was stuck at 0.1.0)
• Frontend: sidebar + package.json version bumped to 0.1.5
• Tests: test_skills.py no longer leaks into ~/.vibe-trading/skills/user/
• SKILL manifest: synced to 22 MCP tools / 71 skills / 29 swarm presets

Install / upgrade

pip install -U vibe-trading-ai==0.1.5

Docker:

docker compose pull && docker compose up -d

By the numbers

• 32 tools (27 registry + 5 new)
• 22 MCP tools exposed
• 71 bundled skills (+ user-created)
• 7 backtest engines + options portfolio
• 13 LLM providers, 5 data sources with auto-fallback
• 29 swarm presets

🙌 New contributors

Huge thanks to everyone who opened a PR in this cycle — most of these are first-time contributions to Vibe-Trading:

• @Matheus083 — Docker Compose profile for frontend-only dev (#18)
• @trinhchien — Interactive vibe-trading init .env bootstrap (#19)
• @yule153604 — Chinese, Japanese, and Korean README translations (#21)
• @SoufianoDev — Arabic README translation + RTL layout (#24)
• @octo-patch — MiniMax provider config fix + temperature=0 clamp (#33)
• @jiakeboge — Z.ai coding platform provider (#35)

Issue reporters who kept the surface area honest: thanks to everyone who filed #32, #30, #22, #20, #34 — your reports are what shipped this release.

Changelog

Full changes: v0.1.4...v0.1.5

Merged PRs since v0.1.4 (6)

• #35 feat: support Z.ai coding platform — @jiakeboge
• #33 fix: update MiniMax provider config and fix temperature=0 API error — @octo-patch
• #24 docs: add Arabic README translation — @SoufianoDev
• #21 docs: add Chinese, Japanese and Korean README translations — @yule153604
• #19 feat(cli): add interactive init env bootstrap — @trinhchien
• #18 feat: add docker-compose profile for frontend-only dev — @Matheus083

All commits since v0.1.4 (29)

• 2ef5cab fix: harden backtest engine with data validation and error isolation
• 52c6f45 fix: add runtime fallback when primary data source returns empty
• fd6c3f4 docs: reorganize .env.example and add missing variables
• 71fff97 fix: inject current date and time into agent and swarm system prompts
• 7a9921f docs: add 2026-04-11 news to all README translations
• 7885600 feat: multi-platform indicator export (TradingView + TDX + MT5)
• 2adeed4 docs: add Arabic README translation and update language links
• e194144 Merge pull request #24 from SoufianoDev/main
• b17aeec fix: add ddgs to dependencies for web_search tool
• 668a610 docs: add CODE_OF_CONDUCT and SECURITY policy
• 26d2374 feat: cross-market composite backtest engine with shared capital pool
• cb93d7d fix: swarm template variable fallback and frontend timeout reset
• 7cf8f0e fix: backtest MCP tool Connection closed on stdio transport (#32)
• 2f41f37 docs: condense README news section and add 2026-04-14 entry
• 00f2708 fix: update MiniMax provider config and clamp temperature=0 to 0.01 (#33)
• eb969e7 feat: support Z.ai coding platform (#35)
• feef692 fix: update cli init test for Z.ai provider insertion
• 067a0f3 docs: add 2026-04-15 news for Z.ai and MiniMax PRs
• b64a399 feat: harness trading — persistent memory, session search, skill CRUD, 5-layer compression, tool batching
• a471668 docs: update all READMEs for harness trading release
• bca4049 docs: add recommended models section to all READMEs
• 1717ad1 feat: universal file reader — pdf/docx/xlsx/pptx/images/text
• 67fb90e feat: trade journal analyzer — profile + behavior diagnostics
• d626cba docs: add 2026-04-17 news entry; collapse older entries behind details
• 3b29677 feat: shadow account — extract/backtest/render/scan + HTML report + skill
• 148e8c1 feat(ux): surface shadow account + trade journal in CLI, web, README
• d5fbd2c chore: bump to 0.1.5 + CVE floor
• e90402f docs: update skill counts + v0.1.5 news
• 33ec7a9 test: isolate user_skills_dir in test_skills

Closed issues in this cycle

• #32 backtest MCP tool "Connection closed" on stdio transport
• #30 Swarm Agent mode cannot execute
• #22 System prompt missing current date awareness
• #20 SSL certificate verification errors
• #34 Feature request: Z.ai coding platform

Full contributor graph: https://github.com/HKUDS/Vibe-Trading/graphs/contributors