v0.1.10

## 🌍 v0.1.10 — Global data layer + roll-up since 0.1.9

`v0.1.10` is a roll-up release. The headline is the **Global data layer**: the market-data registry grows from 10 to 18 sources and gains **18 read-only data tools** that reach past OHLCV into fundamentals and flow, all exposed over MCP. Around it ships everything accumulated since 0.1.9 — **10 broker SDK connectors**, the **Alpha Zoo `alpha compare`** full stack, a **provider-reliability overhaul**, **Research Autopilot Phase 1**, an **opt-in local data cache**, and a community-driven **security-hardening wave**.

This release is available on **PyPI**, **ClawHub**, and GitHub Releases.

```bash
pip install -U vibe-trading-ai
# or
uv tool install --reinstall vibe-trading-ai
```

## Highlights

### 🌍 Global data layer — 18 sources + 18 read-only data tools

The loader registry grows from 10 to **18 market-data sources**:

- **Free, no key** — `tushare`, `okx`, `yfinance`, `akshare`, `baostock`, `tencent`, `mootdx`, `ccxt`, `futu`, `local`, plus four new direct-API additions: **Eastmoney**, **Sina**, **Stooq**, and a direct-HTTP **Yahoo** client.
- **Optional key-gated US providers** — **Finnhub**, **Alpha Vantage**, **Tiingo**, **FMP**; absent keys are skipped in the fallback chain, never crash it.

Fallback chains are re-ordered by **IP-ban risk** (lightweight, throttle-tolerant public endpoints lead; key-gated REST trails) behind a shared throttled HTTP gate (`backtest/loaders/_http.py`) with per-host rate buckets, jitter, and session reuse. On top sit **18 read-only data tools** — fund flow, dragon-tiger board, northbound (Stock-Connect) flow, margin trading, block trades, shareholder count, lockup expiry, sector membership, research reports, news, SEC filings (EDGAR + XBRL), financial statements, options chains, institutional holdings, full-market screening, symbol search, FRED macro, and `iwencai` natural-language A-share search — across **A-share / US / HK**, all exposed over MCP. Three shared clients (`eastmoney` / `yahoo` / `sec_edgar`) back the loaders and tools, and a consolidated `data-routing` index plus per-source `eastmoney` / `sec-edgar` skills document the layer.

### 💱 10 broker SDK connectors — read + paper, mandate-gated live

Trading is **connector-first**: pick a profile, and paper/live is an attribute of the connector. This release brings the roster to **10 brokers** — IBKR (local read-only TWS/Gateway) · Robinhood (Agentic MCP, OAuth) · Tiger · Longbridge · Alpaca · OKX · Binance · Futu · **Dhan** · **Shoonya** (India NSE/BSE + F&O). Direct-SDK connectors share a `broker_sdk` transport and each does read + paper-account order placement; live placement passes a single fail-closed bounded-autonomy gate (`sdk_order_gate.py`: mandate + kill switch + audit). Brokers with **no runtime paper/live discriminator** (Longbridge, Dhan, Shoonya) are structurally capped at **paper + read-only** — their `place_order` / `cancel_order` hard-refuse any non-paper config at the first line. Order-placing tools stay off MCP (agent + CLI only).

### 📊 Alpha compare across CLI / REST / Web / agent tool

`vibe-trading alpha compare` ranks any set of Alpha Zoo factors by IC / IR on your universe, sharing one `compare_runner.compare_alphas` core behind the CLI, a `POST /alpha/compare` REST route with SSE-streamed progress, the Alpha Zoo Web UI Compare view, and a read-only `alpha_compare` agent tool. A `run_bench(only=…)` subset filter benches only the compared factors instead of the whole zoo.

### 🔌 Provider-reliability overhaul

A provider **capability layer** gates reasoning capture/replay, Gemini thought signatures, Kimi user-agent, and OpenRouter reasoning bodies per provider. `vibe-trading provider doctor` prints a redacted diagnostic snapshot. Streaming failures now raise an explicit, redacted `ProviderStreamError` (carrying `status_code` + `.retryable`) with one retry for transients and fail-fast on 4xx; a throttled `reasoning_delta` SSE drives a "Reasoning…" liveness indicator in the Web UI. Also: an optional native DeepSeek adapter (`VIBE_TRADING_DEEPSEEK_ADAPTER`), read-only tool hard-timeouts (`VIBE_TRADING_TOOL_TIMEOUT_SECONDS`), and per-provider temperature handling (Kimi-k2 forced to 1.0, MiniMax clamped > 0).

### 🔬 Research Autopilot Phase 1

`run_research_autopilot` turns a `hypothesis_id` into a research goal (thesis as objective, backtest-relevant acceptance criteria, next-step hints), and `generate_backtest_config` auto-writes a backtest `config.json` from the hypothesis's universe and data sources — so the agent goes straight from idea → `signal_engine.py` → run.

### 🗃️ Opt-in local data cache + `local` loader

`VIBE_TRADING_DATA_CACHE=1` caches **settled** bars to `~/.vibe-trading/cache` (user home, **never** the repo); a staleness guard never caches a range ending today, and cached frames are byte-identical to live fetches. A new **`local`** loader reads OHLCV straight from your own **CSV / Parquet / DuckDB** files via `~/.vibe-trading/data-bridge/config.yaml`, with normal fallback-chain support.

### 🛡️ Security & hardening wave

A community-driven hardening pass: API settings-write auth (#245), agent shell-tool opt-in (#243), loopback-host rebinding rejection (#242), explicit local-shutdown auth (#241), and identifier containment for mandate proposal-ids (#256), persistent-memory types (#257), and MCP swarm run-ids (#258). Plus responsive Stop mid-stream + SSE reconnect on returning to a running session (#229), multi-engine `web_search` fallback (#231), and Gemini `thoughtSignature` round-trip through OpenAI-compat tool calls (#176, #184).

### 🪪 Version reporting is now consistent

`--version`, the REST API (`/docs` + `/api`), the MCP server handshake, and the Web UI footer all derive from one source — the REST API had drifted to a wrong hardcoded `5.0.0`. Packaging also now ships skill example scripts in the wheel, and the Docker image installs weasyprint's native libs so PDF reports render.

## Install / upgrade

| Channel | Command |
|---|---|
| **PyPI** | `pip install -U vibe-trading-ai` |
| **uv tool** | `uv tool install --reinstall vibe-trading-ai` |
| **ClawHub** (Claude Desktop / OpenClaw / MCP clients) | `clawhub install vibe-trading` or update the installed skill |
| **Docker** | `docker compose pull && docker compose up -d` |

Remote API/Web deployments should set `API_AUTH_KEY` and explicit trusted CORS origins. Local CLI and localhost Web UI workflows remain low-friction.

## By the numbers

- ~98 non-merge commits since `v0.1.9`
- **18 market-data sources** with auto-detect + ban-risk-ordered fallback
- **66 agent tools** (auto-discovered) · **54 MCP tools**
- **79 bundled finance skills**
- 29 swarm presets
- **10 broker connectors** (read + paper, bounded-live for those with a structural paper/live guard)
- 7 backtest engines + composite cross-market engine + options portfolio
- **4167 backend tests passing** (the weasyprint shadow-report PDF suite is green on CI; it segfaults only on macOS/conda without Pango)
- Clean-room verified: a fresh `pip install` of the `0.1.10` wheel imports all new loaders/tools, and the wheel + sdist ship the `eastmoney` / `sec-edgar` skills including UTF-8 Chinese reference filenames

## 🙌 Credits

### Code contributors this cycle

- **@warren618** / Haozhe Wu — the global data layer (8 sources + 18 read-only data tools, 3 shared clients), the 10 broker SDK connectors + bounded-autonomy order gate, the alpha-compare full stack, the provider-reliability overhaul, multi-engine `web_search` fallback, responsive Stop + SSE reconnect, multi-language READMEs, integration, release.
- **@Hinotoi-agent** — a security-hardening wave: explicit local-shutdown auth (#241), loopback-host rebinding rejection (#242), agent shell-tool opt-in (#243), settings-write auth (#245), mandate proposal-id containment (#256), persistent-memory type validation (#257), MCP swarm run-id containment (#258)
- **@mvanhorn** — the opt-in local data cache (#177), Gemini `thoughtSignature` round-trip over OpenAI-compat tool calls (#176), the custom data loader guide (#194), and the glm/zhipu provider alias + model-name inference (#247)
- **@gyx09212214-prog** — loader robustness for malformed crypto/RSSHub timeout env vars (#227, #240), requested yfinance end-date inclusion (#226), strict run-card JSON for non-finite metrics (#238), and ddgs retry-fallback coverage (#239)
- **@BillDin** — swarm agent status in the chat UI (#188), explicit preset-name handling (#189), the loader-backed market-data tool for swarm workers (#199), and preset-context continuations (#200)
- **@Robin1987China** — the Research Autopilot goal-hypothesis bridge (#260), the local CSV/Parquet/DuckDB data loader (#252), and an assistant-prefill fix + configurable Kimi User-Agent (#248)
- **@LemonCANDY42** — the read-only runtime status dashboard (#210), persisted AgentLoop usage artifacts (#223), and opt-in Run Detail chart payloads (#225)
- **@zwrong** — the `trace.jsonl` overhaul with zero truncation + offload (#206) and session-id on exit + `resume <session-id>` (#218)
- **@forge-builder** — the AI contributor guide (#173) and the OpenClaw MCP research-only smoke-test docs (#165)
- **@skloxo** — Chinese (zh-CN) frontend localization (adopted from #217)
- **@LeeCQiang** — Chinese docstrings across all 452 Alpha Zoo factors (#180)
- **@KaiLuettmann** — GHCR pre-built image publishing on release (#187)
- **@ngoanpv** — Gemini `thought_signature` preservation through the AgentLoop dict path (#184)
- **@ShahNewazKhan** — Docker host-Ollama reachability via `host.docker.internal` (#196)
- **@sambazhu** — frontend sync of completed chat attempts (#236)
- **@bhlt** — baostock-native code format support (#230)
- **@octo-patch** — MiniMax M3 default model upgrade (#162)

### Lab + community

- **HKUDS** (HKU Data Intelligence Lab) — research direction, infrastructure, and the broader Vibe-Trading platform this builds on.
- Everyone who filed issues, reviewed PRs, and stress-tested the framework this cycle.

## Validation before publishing

- **Tests**: `4167 passed` (`pytest agent/tests/`, weasyprint shadow-PDF suite covered on CI).
- **Independent 4-agent adversarial audit** of the release diff (packaging / version-derive / Docker / frontend) — all SHIP-OK.
- **Wheel sanity**: `dist/vibe_trading_ai-0.1.10-py3-none-any.whl` built and inspected — all 8 new loaders + 3 shared clients, all 18 new data tools, and the `eastmoney` / `sec-edgar` skills (incl. UTF-8 Chinese reference filenames + scripts) present; a fresh-venv `pip install` imports every new loader/tool from site-packages.
- **Version consistency**: package, REST API, MCP server, and Web UI all report `0.1.10`.
- **Frontend**: `tsc -b` + `npm run build` clean.
- **Multi-language READMEs**: English / 中文 / 日本語 / 한국어 / العربية updated with the 0.1.10 news + contributor credits.

**Full Changelog**: https://github.com/HKUDS/Vibe-Trading/compare/v0.1.9...v0.1.10