v0.1.10 — Global data layer + roll-up since 0.1.9

🌍 v0.1.10 — Global data layer + roll-up since 0.1.9

v0.1.10 is a roll-up release. The headline is the Global data layer: the market-data registry grows from 10 to 18 sources and gains 18 read-only data tools that reach past OHLCV into fundamentals and flow, all exposed over MCP. Around it ships everything accumulated since 0.1.9 — 10 broker SDK connectors, the Alpha Zoo alpha compare full stack, a provider-reliability overhaul, Research Autopilot Phase 1, an opt-in local data cache, and a community-driven security-hardening wave.

This release is available on PyPI, ClawHub, and GitHub Releases.

pip install -U vibe-trading-ai
# or
uv tool install --reinstall vibe-trading-ai

Highlights

🌍 Global data layer — 18 sources + 18 read-only data tools

The loader registry grows from 10 to 18 market-data sources:

• Free, no key — tushare, okx, yfinance, akshare, baostock, tencent, mootdx, ccxt, futu, local, plus four new direct-API additions: Eastmoney, Sina, Stooq, and a direct-HTTP Yahoo client.
• Optional key-gated US providers — Finnhub, Alpha Vantage, Tiingo, FMP; absent keys are skipped in the fallback chain, never crash it.

Fallback chains are re-ordered by IP-ban risk (lightweight, throttle-tolerant public endpoints lead; key-gated REST trails) behind a shared throttled HTTP gate (backtest/loaders/_http.py) with per-host rate buckets, jitter, and session reuse. On top sit 18 read-only data tools — fund flow, dragon-tiger board, northbound (Stock-Connect) flow, margin trading, block trades, shareholder count, lockup expiry, sector membership, research reports, news, SEC filings (EDGAR + XBRL), financial statements, options chains, institutional holdings, full-market screening, symbol search, FRED macro, and iwencai natural-language A-share search — across A-share / US / HK, all exposed over MCP. Three shared clients (eastmoney / yahoo / sec_edgar) back the loaders and tools, and a consolidated data-routing index plus per-source eastmoney / sec-edgar skills document the layer.

💱 10 broker SDK connectors — read + paper, mandate-gated live

Trading is connector-first: pick a profile, and paper/live is an attribute of the connector. This release brings the roster to 10 brokers — IBKR (local read-only TWS/Gateway) · Robinhood (Agentic MCP, OAuth) · Tiger · Longbridge · Alpaca · OKX · Binance · Futu · Dhan · Shoonya (India NSE/BSE + F&O). Direct-SDK connectors share a broker_sdk transport and each does read + paper-account order placement; live placement passes a single fail-closed bounded-autonomy gate (sdk_order_gate.py: mandate + kill switch + audit). Brokers with no runtime paper/live discriminator (Longbridge, Dhan, Shoonya) are structurally capped at paper + read-only — their place_order / cancel_order hard-refuse any non-paper config at the first line. Order-placing tools stay off MCP (agent + CLI only).

📊 Alpha compare across CLI / REST / Web / agent tool

vibe-trading alpha compare ranks any set of Alpha Zoo factors by IC / IR on your universe, sharing one compare_runner.compare_alphas core behind the CLI, a POST /alpha/compare REST route with SSE-streamed progress, the Alpha Zoo Web UI Compare view, and a read-only alpha_compare agent tool. A run_bench(only=…) subset filter benches only the compared factors instead of the whole zoo.

🔌 Provider-reliability overhaul

A provider capability layer gates reasoning capture/replay, Gemini thought signatures, Kimi user-agent, and OpenRouter reasoning bodies per provider. vibe-trading provider doctor prints a redacted diagnostic snapshot. Streaming failures now raise an explicit, redacted ProviderStreamError (carrying status_code + .retryable) with one retry for transients and fail-fast on 4xx; a throttled reasoning_delta SSE drives a "Reasoning…" liveness indicator in the Web UI. Also: an optional native DeepSeek adapter (VIBE_TRADING_DEEPSEEK_ADAPTER), read-only tool hard-timeouts (VIBE_TRADING_TOOL_TIMEOUT_SECONDS), and per-provider temperature handling (Kimi-k2 forced to 1.0, MiniMax clamped > 0).

🔬 Research Autopilot Phase 1

run_research_autopilot turns a hypothesis_id into a research goal (thesis as objective, backtest-relevant acceptance criteria, next-step hints), and generate_backtest_config auto-writes a backtest config.json from the hypothesis's universe and data sources — so the agent goes straight from idea → signal_engine.py → run.

🗃️ Opt-in local data cache + local loader

VIBE_TRADING_DATA_CACHE=1 caches settled bars to ~/.vibe-trading/cache (user home, never the repo); a staleness guard never caches a range ending today, and cached frames are byte-identical to live fetches. A new local loader reads OHLCV straight from your own CSV / Parquet / DuckDB files via ~/.vibe-trading/data-bridge/config.yaml, with normal fallback-chain support.

🛡️ Security & hardening wave

A community-driven hardening pass: API settings-write auth (#245), agent shell-tool opt-in (#243), loopback-host rebinding rejection (#242), explicit local-shutdown auth (#241), and identifier containment for mandate proposal-ids (#256), persistent-memory types (#257), and MCP swarm run-ids (#258). Plus responsive Stop mid-stream + SSE reconnect on returning to a running session (#229), multi-engine web_search fallback (#231), and Gemini thoughtSignature round-trip through OpenAI-compat tool calls (#176, #184).

🪪 Version reporting is now consistent

--version, the REST API (/docs + /api), the MCP server handshake, and the Web UI footer all derive from one source — the REST API had drifted to a wrong hardcoded 5.0.0. Packaging also now ships skill example scripts in the wheel, and the Docker image installs weasyprint's native libs so PDF reports render.

Install / upgrade

Channel	Command
PyPI	pip install -U vibe-trading-ai
uv tool	uv tool install --reinstall vibe-trading-ai
ClawHub (Claude Desktop / OpenClaw / MCP clients)	clawhub install vibe-trading or update the installed skill
Docker	docker compose pull && docker compose up -d

Remote API/Web deployments should set API_AUTH_KEY and explicit trusted CORS origins. Local CLI and localhost Web UI workflows remain low-friction.

By the numbers

• ~98 non-merge commits since v0.1.9
• 18 market-data sources with auto-detect + ban-risk-ordered fallback
• 66 agent tools (auto-discovered) · 54 MCP tools
• 79 bundled finance skills
• 29 swarm presets
• 10 broker connectors (read + paper, bounded-live for those with a structural paper/live guard)
• 7 backtest engines + composite cross-market engine + options portfolio
• 4167 backend tests passing (the weasyprint shadow-report PDF suite is green on CI; it segfaults only on macOS/conda without Pango)
• Clean-room verified: a fresh pip install of the 0.1.10 wheel imports all new loaders/tools, and the wheel + sdist ship the eastmoney / sec-edgar skills including UTF-8 Chinese reference filenames

🙌 Credits

Code contributors this cycle

• @warren618 / Haozhe Wu — the global data layer (8 sources + 18 read-only data tools, 3 shared clients), the 10 broker SDK connectors + bounded-autonomy order gate, the alpha-compare full stack, the provider-reliability overhaul, multi-engine web_search fallback, responsive Stop + SSE reconnect, multi-language READMEs, integration, release.
• @Hinotoi-agent — a security-hardening wave: explicit local-shutdown auth (#241), loopback-host rebinding rejection (#242), agent shell-tool opt-in (#243), settings-write auth (#245), mandate proposal-id containment (#256), persistent-memory type validation (#257), MCP swarm run-id containment (#258)
• @mvanhorn — the opt-in local data cache (#177), Gemini thoughtSignature round-trip over OpenAI-compat tool calls (#176), the custom data loader guide (#194), and the glm/zhipu provider alias + model-name inference (#247)
• @gyx09212214-prog — loader robustness for malformed crypto/RSSHub timeout env vars (#227, #240), requested yfinance end-date inclusion (#226), strict run-card JSON for non-finite metrics (#238), and ddgs retry-fallback coverage (#239)
• @BillDin — swarm agent status in the chat UI (#188), explicit preset-name handling (#189), the loader-backed market-data tool for swarm workers (#199), and preset-context continuations (#200)
• @Robin1987China — the Research Autopilot goal-hypothesis bridge (#260), the local CSV/Parquet/DuckDB data loader (#252), and an assistant-prefill fix + configurable Kimi User-Agent (#248)
• @LemonCANDY42 — the read-only runtime status dashboard (#210), persisted AgentLoop usage artifacts (#223), and opt-in Run Detail chart payloads (#225)
• @zwrong — the trace.jsonl overhaul with zero truncation + offload (#206) and session-id on exit + resume <session-id> (#218)
• @forge-builder — the AI contributor guide (#173) and the OpenClaw MCP research-only smoke-test docs (#165)
• @skloxo — Chinese (zh-CN) frontend localization (adopted from #217)
• @LeeCQiang — Chinese docstrings across all 452 Alpha Zoo factors (#180)
• @KaiLuettmann — GHCR pre-built image publishing on release (#187)
• @ngoanpv — Gemini thought_signature preservation through the AgentLoop dict path (#184)
• @ShahNewazKhan — Docker host-Ollama reachability via host.docker.internal (#196)
• @sambazhu — frontend sync of completed chat attempts (#236)
• @bhlt — baostock-native code format support (#230)
• @octo-patch — MiniMax M3 default model upgrade (#162)

Lab + community

• HKUDS (HKU Data Intelligence Lab) — research direction, infrastructure, and the broader Vibe-Trading platform this builds on.
• Everyone who filed issues, reviewed PRs, and stress-tested the framework this cycle.

Validation before publishing

• Tests: 4167 passed (pytest agent/tests/, weasyprint shadow-PDF suite covered on CI).
• Independent 4-agent adversarial audit of the release diff (packaging / version-derive / Docker / frontend) — all SHIP-OK.
• Wheel sanity: dist/vibe_trading_ai-0.1.10-py3-none-any.whl built and inspected — all 8 new loaders + 3 shared clients, all 18 new data tools, and the eastmoney / sec-edgar skills (incl. UTF-8 Chinese reference filenames + scripts) present; a fresh-venv pip install imports every new loader/tool from site-packages.
• Version consistency: package, REST API, MCP server, and Web UI all report 0.1.10.
• Frontend: tsc -b + npm run build clean.
• Multi-language READMEs: English / 中文 / 日本語 / 한국어 / العربية updated with the 0.1.10 news + contributor credits.

Full Changelog: v0.1.9...v0.1.10