📰 News

⚠️ Security warning: The X account VibeTrading_HKU, Virtuals project 101845, and token contract 0x640BDBF77b6447E8b7DB7894cED84BD1c40571f4 are not official Vibe-Trading assets. We have never launched or endorsed any token or memecoin. Do not buy, connect a wallet, or sign anything. Details.

  • 2026-08-17 🔒 The test suite stopped writing into your real config root — including the live audit ledger: Running the project's own suite appended fabricated order_rejected records to ~/.vibe-trading/live/audit.jsonl, an append-only, hash-chained ledger whose entire value is that its entries cannot be manufactured, and on Windows left a corrupted chain file behind. conftest.py had no config-root sandbox at all, so every module that baked Path.home() / ".vibe-trading" at import time resolved against the real home on any platform — Windows was worse only because Path.home() reads %USERPROFILE% there and ignores $HOME, leaving the isolation idiom the suite had been using inert. Home is now redirected before collection, the sandbox owns a single knob so per-test isolation still wins, and session end asserts the real ledgers are byte-identical instead of merely checking that the redirect was installed (#1118, closes #1116). Also: xirr and money_weighted_return raised ZeroDivisionError on horizons past ~51 years, where the discount factor underflows to zero — exactly the long, irregular streams XIRR exists for (#1119); and a backtest archived into an active run merged with the previous one's artifacts, so a single report could describe two different backtests while /runs/{id} listed the leftovers as its own (#1094). Thanks @lorenzozanee, @straun-repo, and @pengpengyi92!
  • 2026-08-16 🔧 Anthropic runs no longer die on recovery, and symbol search stops reporting empty results as healthy: Recovery paths appended mid-conversation system messages that the Anthropic API rejects, killing the run — recovery steering now travels as user messages with inline <system> tags (#1112, closes #1109). search_symbol returned zero candidates with both sources reporting ok for ticker+name queries, so identity never locked and every data tool refused; the Yahoo path now reports such queries skipped instead of a misleading ok (#1114, closes #1108). Also: LANGCHAIN_REASONING_EFFORT is now honored on the Anthropic branch through a model allowlist (#1115); the Tencent loader recovers from CERTIFICATE_VERIFY_FAILED via the certifi CA bundle (#1113); the revenue - cogs gross-profit fallback is no longer dead code (#1111); and swarm workers use the shared truncation helper, so sub-agents always see the cut notice (#1110). Thanks @lorenzozanee, @straun-repo, @x-lambda, @cgycorey, and @Shizoqua!
  • 2026-08-15 🛡️ Safer desktop updates, reliable Windows packaging, and factor research in Run Detail: The dormant updater boundary now retains owned-process evidence for cleanup retries, probes TCP listeners instead of HTTP health, reserves recovery journals atomically, binds Authenticode and hashes to the same staged bytes, and rechecks immediately before launch (#1101). Windows packaging now owns bounded, checksum-verified Electron downloads and extracts the pinned GTK asset as data through 7-Zip instead of executing its flaky legacy installer; native Windows CI covers exit codes, timeouts, runtime assembly, NSIS, and packaged startup (#1104, closes #1093). Run Detail gains IC series and statistics, quantile equity, and IC correlation with bounded artifact traversal and finite JSON payloads (#1099, closes #1100); universal hash locks are verified natively on Linux, macOS ARM64, and Windows (#1102, closes #1089). Thanks @QCYTSN and @shadowinlife!

  • 2026-08-09 🪟 Secure Windows packaging, Canada markets, ModelScope, and Alpha Zoo over MCP: Windows desktop packaging now assembles a checksum-pinned embedded Python 3.12 runtime and x64 NSIS review/signing paths, plus Electron safeStorage for an allowlisted credential set. The renderer can set or clear secrets but never read them; plaintext configuration migrates once; decrypted values reach only the owned backend; and both unsigned review and signed builds fail closed on the wrong signature state. No installer artifact was published from this PR (#1015). Canadian equities now work end to end: .TO/.V symbols are classified in CAD, route through Yahoo → yfinance → local fallback, execute under Canada-specific GlobalEquity rules, benchmark against XIC.TO, and refuse mixed-currency aggregation. Strict USD-M historical backtests can also opt into position_adjustment=rebalance while preserving collateral, funding, fees, realized P&L, liquidation behavior, and immutable fill evidence across increases and reductions (#1024, #1019, closes #952). ModelScope joins the built-in providers through its official OpenAI-compatible hosted-inference endpoint, with Qwen/Qwen3.5-27B as the default (#1011); the new vibe-trading update distinguishes wheel installs from editable/source checkouts, installs the exact release it checked, and verifies fresh metadata without downgrading (#1020); and alpha_zoo plus bounded alpha_bench now reach MCP (64 tools), with horizon/result/output-path limits and safe report creation (#979). Verified Python and frontend lock refreshes also update grouped dependencies, postcss, and akshare (#1021, #1023, #1026, #1027). Thanks @QCYTSN, @wiliao, @honginp, @yrk111222, @zwrong, and @cgycorey.

  • 2026-08-08 🧱 Desktop shell, eToro, atomic rebalancing, and a broad reliability pass: A source-first Electron host now owns the existing backend lifecycle — random loopback port, per-launch secret, five-locale startup recovery, and owned-process cleanup — while eToro joins with path-separated demo/real profiles; live risk-increasing actions remain mandate-gated and audited, and API capability surfaces are authenticated under enforced CSP (#923, #989, #961). Backtests gain opt-in atomic same-direction rebalancing with immutable fill evidence; Shadow splits mixed markets by settlement currency without invented FX aggregation and honors the configured runtime root; indicators use consecutive unsampled history; negative-equity drawdown and empty insolvent cross accounts are handled correctly (#951, #997, #1017, #1005, #958, #959). OpenAI Codex OAuth gets a separate synchronized credential store and one-shot 401 recovery; proxy opt-out covers sync and async clients; sandboxed runs retain their canonical root; scheduled research isolates malformed records and fixes interval-timezone validation; lowercase 4h requests return true four-hour bars (#1014, #995, #1012, #1003, #1004, #1013). QQ replies retain source message IDs, long model slugs remain readable, and the agent stops when evidence is sufficient (#1008, #1006, #1010). Thanks @QCYTSN, @Shizoqua, @ngoanpv, @hhj123123, @su322, @Robin1987China, @shadowinlife, @dineeshd, @honginp, @santhreal, @00EVA, @x-lambda, @ofeksh-tr.

  • 2026-08-07 🛡️ Fewer false refusals, a closed sandbox gap, QVeris on MCP: The grounding gate stops rejecting well-formed answers over numbers that were never prices — confidence scores, indicator readings, moving-average windows, year-less dates like 8/5, percentage ranges, and a trading plan's own trigger levels (close ≥ 6.45 is a condition, not a quote) — while a quote outside recorded OHLC evidence is still refused, and a price table dated 08-05 now matches its evidence instead of every cell coming back unavailable (#1001, #983). Sandbox: generated strategy code can no longer import the broker layer, nor reach socket/subprocess/os.system/ctypes through a renamed binding — both were accepted before, and src.quantlib still imports. QVeris discovery/inspect/execute join the MCP surface (62 tools), with the cost quote read from the marketplace instead of trusted from the caller (#976, closes #964, thanks @shadowinlife). Plus HK market-data fallback routing repaired with a new Tencent HK source, yfinance crypto routed to the crypto engine, memory entries written and recovered with their .md suffix, MCP list/dict arguments tolerating JSON-string clients, and Portfolio Studio artifacts surfaced in run detail (#1000, #970, #984, #993, #980, #982, #966, #973, thanks @he-yufeng, @ngoanpv, @sambazhu).

  • 2026-08-06 🧮 A tested finance-math layer + valuation engine + irregular cash flows + wired-in governance: src/quantlib replaces the formulas that lived as markdown inside skills with one tested implementation each — options, bonds, credit, econometrics, VaR/CVaR/EVT, attribution, event studies, multiple-testing control, purged cross-validation — 265 functions, reachable from the CLI, Web UI, REST API and MCP via the new read-only quantlib_call tool. A valuation engine (run_dcf / run_comps / three-statement) refuses to run on a missing input instead of silently defaulting it, and a new entity + cash-flow spine admits NAVs, capital calls, and coupons (XIRR/MOIC/DPI/TVPI and TWR/Modified Dietz via cashflow_performance; crypto L2 impact cost via orderbook_depth). Every run now writes a hash manifest, the audit ledger is hash-chained so tampering is detectable, and all 30 swarm presets were re-audited — a deliverable no granted tool can compute is now declared as such instead of invented.

  • 2026-08-05 🔭 Institutional holdings, ETF look-through, prediction markets, research papers: Four read-only data tools, all on free public sources — SEC 13F books with quarter-over-quarter position diffs; ETF constituents across markets (a CSI-300 tracker resolves to 342 positions covering 98.7% of net assets, not the quarterly top ten); event contracts as labelled implied probability; and arXiv/OpenAlex search that marks what a source does not state instead of inferring it. Plus five scheduled-research templates, six institutional commands (/comps /dcf /attrib /memo /earnings /screen), investor lenses as a standalone skill, and an agent core that traces every number back to the tool that produced it.

  • 2026-08-04 🔧 Correctness pass: fundamentals, A-share prices, oversized results: SEC reporting periods are now keyed on their (start, end) span — a 10-Q files the true quarter and the year-to-date frame under the same end date and fiscal period, so period="annual" had been returning a single quarter for AAPL FY2018–2020 (a 4.2× understatement) and every fiscal-Q4 slot in a quarterly series carried the full-year figure; get_fundamentals("AAPL.US") no longer answers ok:true with an all-null panel. Tushare A-share prices are now corporate-action adjusted in both the factor bench and backtests — a raw close-to-close return across an ex-date was off by up to 47 percentage points (300750.SZ, 2023-04-26) — and the CSI300 bench masks each date to its point-in-time index membership. Cross-market composite backtests refuse a mixed-currency code set instead of summing CNY, USD and KRW into one equity curve; option legs are marked at the volatility they were opened at, removing a fabricated day-zero P&L of up to +93% of premium; oversized tool results are paged by whole record with an explicit total instead of being cut mid-JSON; and calc_metrics reports tracking error and benchmark beta.

  • 2026-08-03 ⏰ Timezone-aware scheduled research + unblocked stock screening: Scheduled jobs now take an optional IANA timezone and evaluate cron on that zone's wall clock, so a cadence survives DST — a spring-forward gap is skipped and a fall-back ambiguous time runs once — while cron fields gain comma lists and ranges (1,3-5), jobs without a timezone keep UTC semantics, and the web UI gains a Scheduled page in all five locales where it previously had no scheduling surface at all (#954, closes #953, thanks @ngoanpv). A screening request no longer dead-ends: a many-candidate shortlist counts as an answer rather than a stalled resolution and retires once a candidate is locked, and price validation stops reading ticker digits, localized dates, share counts, and position costs as quoted prices — while still refusing any quote outside recorded OHLC evidence (closes #955). Agent memory also gets exact index-anchor matching and a respected result bound (#956, #957, thanks @santhreal).

  • 2026-08-02 🧠 Live model discovery, truthful runtime identity, and a verified dependency refresh: Settings now discovers configured-provider models on demand with stable warning codes and five-locale controls, while each reply records and reloads the immutable provider/model/reasoning identity that actually served it—cleared safely when sessions change (#924, thanks @QCYTSN). Nine hash-locked Python updates plus jsdom/postcss also landed with exact-version imports, 330 focused tests, the production build, 373 frontend tests, full main CI, and Dependency Graph green (#949, #948); the breaking MCP 2.0 bump remains unmerged pending a complete lock/runtime migration (#950).

  • 2026-08-01 🧮 Options strategy analytics + market sentiment + auditable USD-M research: A new options payoff workflow analytically calculates expiry P&L extrema, exact breakevens—including continuous zero-P&L intervals—engine-aligned entry commissions, and spot × IV scenarios through Agent and MCP (#946, rebuilt from #883, thanks @he-yufeng). The read-only sentiment tool scores arbitrary text locally and retrieves the crypto Fear & Greed Index without an API key (#939, thanks @Robin1987China). Strict USD-M backtests now persist ordered fill, funding, risk, and liquidation events plus a fidelity summary, while rejecting unsupported 100× intervals (#936, thanks @honginp). Reliability improvements also ensure symbol and venue resolution precedes market-data calls, final quoted prices are checked against recorded OHLC evidence, scheduled research retries transient failures, and nested MCP results serialize cleanly.

  • 2026-07-31 🔧 USD-M liquidation lifecycle + technical indicators + user-level state dirs: Opt-in perpetual_strict mode settles historical funding before fills and executes isolated/cross margin breaches as real liquidations (#903, thanks @honginp). A read-only technical_indicators tool computes RSI/MACD/Bollinger/SMA/EMA through the existing loaders (#921, refs #920, thanks @Robin1987China). Sessions, runs, swarm runs, and uploads now live under ~/.vibe-trading (relocatable via VIBE_TRADING_HOME) with a one-time automatic migration (#925, closes #904, thanks @MuggleJinx). Plus ten correctness fixes — Yahoo .SS classified as A-share, bare/prefix-style A-share codes, slash-delimited crypto pairs, nan/inf guards (#919, #926–#935, thanks @santhreal).

  • 2026-07-30 🎨 Rebuilt WebUI + Korea (KRX) market + an OpenBB Workspace bridge: The web UI lands its guided-minimalism overhaul — no first-frame flash, one durable activity object per turn with a live reasoning whisper and a reload-safe tool trail, LLM-written session titles, full five-locale parity. Korea equity (KRX: KOSPI/KOSDAQ) becomes the 9th backtest engine — execution-time ±30% band, long-only, 2026 0.20% transaction tax, optional pykrx loader (#693, thanks @JungHoonGhae) — plus an OpenBB Workspace bridge (#817, thanks @shugaoye) and a read-only Taiwan snapshot tool (#848, thanks @TSENGCHIENFENG). Correctness: daily price bands are judged at execution time, not from the decision bar's close; a session runs one attempt at a time (HTTP 409) and a user stop is its own terminal state (#676, thanks @tyj147454413-cmd). Plus durable traces (#662), secret-scrubbed tool results (#675), fail-closed tool arguments (#913/#911, thanks @santhreal), direct-OpenAI reasoning_effort (#755, thanks @1anter), and numeric guards across the risk x-ray / edge density / options engine (#909/#908/#907).

  • 2026-07-29 🔧 Gap-safe returns + liquidation risk modeling + a risk x-ray in every run: bar_returns no longer erases the real move across a trading halt longer than the forward-fill window — the resumption move was silently recorded as 0, understating volatility and inflating Sharpe — and an inf prior price can no longer read as a clean −100% (#895, thanks @darkknight4563). Annualisation now covers all 24 data sources at every interval, with a coverage test that fails CI when a loader lands without entries (#891, closes #884, thanks @Robin1987China). USD-M perpetual research gains deterministic isolated & cross margin liquidation evaluation (#889, thanks @honginp), and every portfolio backtest now emits risk x-ray artifacts (risk_xray.json/.md) with headline concentration/vol/drawdown metrics (#900, thanks @he-yufeng). The connector CLI now loads ~/.vibe-trading/.env, so env-sourced broker credentials resolve again (#902, closes #901, thanks @MuggleJinx). Plus indent-preserving channel message splits and skill-frontmatter parsing at EOF (#867/#861, thanks @santhreal).

  • 2026-07-28 🔧 Next-gen Claude models unblocked + sign-safe returns: Claude models that deprecate the temperature field (opus-4-7, opus-5, sonnet-5) now work — the adapter drops the field when the API rejects it, retries once, and remembers the model, so no per-release patch is needed (#890, closes #856, thanks @yagnikpipaliya). Non-interactive vibe-trading run now injects a host session id: research-goal tools previously failed on every call while the run still reported success (#885). Buy-and-hold returns are sign-safe — a near-zero prior close no longer explodes the compounded benchmark, and an exact-zero close no longer yields inf/nan (#872, thanks