HKUDS/Vibe-Trading
"Vibe-Trading: Your Personal Trading Agent". Contribute to HKUDS/Vibe-Trading development by creating an account on GitHub.
14.6k stars · 2.7k forks · 89 watchers · Python Topics: python, trading, mcp, multi-agent, fintech, quantitative-finance, algorithmic-trading, backtesting, ai-agent, llm
README
English | 中文 | 日本語 | 한국어 | العربية
Vibe-Trading: Your Personal Trading Agent
One Command to Empower Your Agent with Comprehensive Trading Capabilities
Website · Docs · News · Features · Shadow Account · Demo · Quick Start · Examples · API / MCP · Roadmap · Contributing
📰 News
2026-06-28 🧰 Cross-platform setup/dev + runtime and file-tool hardening: vibe-trading setup and vibe-trading dev now handle Windows TypeScript builds, launch the backend from the right cwd, use the Vite 5899 port, and shut child processes down cleanly (#292, thanks @digger-yu). Runtime status polling now degrades instead of crashing (#322); MCP OAuth cache keys are sanitized (#313); OpenAI defaults and Robinhood agent.json validation were tightened (#319, #320, thanks @mvanhorn); and file tools got isolated read/write roots plus broader sandbox tests (#299, thanks @skloxo). 2026-06-27 🧯 Content-filter resilience + Shadow Account feature contract cleanup: event-driven and swarm runs now skip individual LLM content-moderation hits, warn in run cards when filter rates are high, and recognize Gemini safety finish reasons instead of aborting an entire analysis (#308, closes #307, thanks @shadowinlife). Shadow Account extraction/codegen now share one PRICE_FEATURES contract and keep four-decimal return bounds, preventing rule/codegen drift and precision loss on prior_5d_return (#316, thanks @Robin1987China). 2026-06-26 🎯 Shadow Account conditional entry + tushare ETF/index/HK routing: extracted Shadow Account rules now carry RSI / prior-return bounds, so the generated SignalEngine enters on real conditions (RSI in range, prior-return in range) instead of blindly replaying the holding cadence (#314, follows #302, thanks @Robin1987China). The tushare loader also routes ETF/LOF → fund_daily(), indices → index_daily(), and HK equities → hk_daily() instead of always calling daily() (which silently returns empty for non-stocks), with per-symbol empty-result + partial-fetch warnings (#315, closes #310, thanks @shadowinlife).
Earlier news
2026-06-25 🧪 Strict validation JSON + calmer agent context: standalone backtest validation now normalizes nested NaN / Infinity values before writing artifacts/validation.json or CLI stdout, so strict JSON parsers no longer choke on validation payloads (#306, thanks @gyx09212214-prog). The agent prompt also derives the current data-source count from the loader registry, and _microcompact() now waits for real token pressure instead of clearing older tool results during short runs (#296, closes #282, thanks @MarkfuGod).
2026-06-24 🎯 Shadow Account price context + reactive Chinese UI + LAN auth fix: Shadow Account rule extraction now sees PIT-safe entry context — entry_rsi14 and prior_5d_return fetched through the loader registry as of buy_dt, with graceful offline/no-data degradation (#302, follows #295, thanks @Robin1987China). The main Web UI panels now use reactive English / zh-CN translations across charts, chat, Alpha Library, Correlation, and Run Detail (#301, thanks @skloxo). Remote same-origin Web UI deployments with API_AUTH_KEY can post and upload again after the CSRF hardening, while mismatched cross-site origins remain blocked (#304, thanks @Hinotoi-agent).
2026-06-23 🛡️ Local API CSRF hardening: a malicious web page can no longer drive unsafe cross-site requests (POST/PUT/DELETE) against the loopback API — CORS blocks reading the response but not the side effect, so loopback dev-mode trust now applies the existing cross-site guard to unsafe methods before honoring it. Safe methods and local CLI / non-browser uploads are unaffected (#293, thanks @Hinotoi-agent).
2026-06-22 🔧 Live-authorize OAuth fix + Alpha Zoo headline fix: connector authorize now holds the OAuth handshake open through a multi-minute broker sign-in (tunable via VIBE_LIVE_AUTHORIZE_TIMEOUT_SECONDS) and no longer spawns a competing callback server on retry, so the token actually persists (#281, closes #259, thanks @Robin1987China). The Alpha Zoo page no longer prints its alpha count twice (#287, closes #286, thanks @digger-yu). Scheduled research also picked up end-to-end usage docs (#288).
2026-06-21 ⏰ Scheduled-research executor + Reports library + post-backtest attribution: scheduled research now runs end to end — a default-off background executor (VIBE_TRADING_ENABLE_SCHEDULER) fires due interval/cron jobs through the session runtime (#278, thanks @mvanhorn, closing #254). A new /reports Run Library page lists, searches, and filters report-worthy runs with links into Run Detail + Compare (#224, thanks @LemonCANDY42). And after every backtest the agent now runs layered attribution — trade-level winners/losers, beta regression, market-regime analysis, and a Monte Carlo permutation test, gated by data availability and routing (#280, thanks @shadowinlife).
2026-06-20 🔬 Research Autopilot loop closes (Phase 3) + loader OHLC integrity guard + 4 academic alphas: Research Autopilot now runs hypothesis → signal-engine → backtest end to end — scaffold_signal_engine writes a contract-correct engine and link_autopilot_backtest feeds run metrics back to the hypothesis (68 tools) (#267). A structural OHLC sanity check drops dirty bars (high < low, non-positive prices, bad bracketing) centrally at the loader boundary, guarding every data source (#274, thanks @Shizoqua). And the academic alpha family grows 6 → 10 — Jegadeesh reversal, George-Hwang 52-week-high, Amihud illiquidity, Harvey-Siddique skew (456 factors) (#277, thanks @Robin1987China).
2026-06-19 🚀 v0.1.10 — Global data layer: market-data sources grow 10 → 18 (free Eastmoney / Sina / Stooq / Yahoo + key-gated Finnhub / Alpha Vantage / Tiingo / FMP, ban-risk fallback) plus 18 read-only data tools (fund flow, dragon-tiger, northbound, margin, block trades, SEC EDGAR + XBRL, financials, options chains, full-market screening…) across A-share / US / HK, all over MCP. Also bundles everything since 0.1.9 — 10 broker connectors, alpha compare, the provider-reliability overhaul, and the opt-in data cache. pip install -U vibe-trading-ai
2026-06-18 🔬 Research Autopilot Phase 1 + a local Data Bridge loader, + a Discord security notice: new run_research_autopilot + generate_backtest_config wire Hypothesis → Research Goal → backtest end to end (now 50 tools), and a local loader reads OHLCV straight from your own CSV / Parquet / DuckDB files (#260, #252, thanks @Robin1987China), alongside DeepSeek DSML tool-call parsing and an identifier-containment hardening wave. ⚠️ Security: the old community Discord invite now points to a server we don't control running a fake Collab.Land wallet-"verification" phishing scam — removed everywhere; the only official Discord is the HKUDS server (discord.gg/6TdQnT5xcF), and we'll never ask you to connect a wallet.
2026-06-17 🧩 Install compatibility + Opus/Kimi provider fixes: Baseline pip install vibe-trading-ai no longer pulls the optional pyharmonics / ta dependency chain; harmonic detection now lives behind vibe-trading-ai[harmonic] while the bundled detector remains available (#250, closes #249). The agent loop also avoids assistant-prefill handoff messages rejected by Opus 4.8+, and Kimi/Moonshot can override the client User-Agent with MOONSHOT_USER_AGENT (#248, closes #246 and #204); follow-up tests now directly cover background-result and auto-compact handoff paths (#251).
2026-06-16 🛡️ Security/API hardening + GLM/Zhipu alias: Settings writes require auth when configured (#245); API shell-capable tools require explicit VIBE_TRADING_ENABLE_SHELL_TOOLS=1 opt-in (#243); local shutdown requires auth when an API key is configured (#241); and untrusted loopback-looking hosts are rejected instead of treated as local (#242). Runtime edges also got cleaned up: Web chat syncs completed attempts (#236), run cards emit strict JSON for non-finite metrics (#238), malformed RSSHUB_TIMEOUT_S / RSSHUB_FETCH_BUDGET_S falls back safely (#240), and ddgs retry fallback is regression-covered (#239). GLM/Zhipu is now a first-class provider alias with model-name inference (#247, closes #237).
2026-06-15 🧭 Web-search resilience + Web UI run-continuity fixes: web_search no longer fails when a single engine is rate-limited — it now queries several free, no-key engines in order (DuckDuckGo, Google, Bing, Brave, Mojeek, Yahoo) with retry/backoff, treats "no results" as an empty answer rather than an error, and returns an actionable message instead of a bare ❌ when every engine is throttled (override the engine list with VIBE_TRADING_SEARCH_BACKENDS) (#232, closes #231, thanks @Ethan-sun01). In the Web UI, switching pages during a run no longer freezes it — the chat re-subscribes to the live stream and replays missed progress on return (#234) — and the Stop button now takes effect mid-stream and between tools instead of only at iteration boundaries (#235), closing both halves of #229 (thanks @kalkinj). The baostock loader also accepts native sh.601398 / sz.000001 codes alongside tushare-style 601398.SH (#230, thanks @bhlt).
2026-06-14 📊 Per-run token usage + progressive Run Detail charts: Every agent run now persists provider-reported token usage as a run-scoped llm_usage.json — provider/model, aggregate totals, and per-iteration counts — surfaced additively on /runs/{id}, so a finished run's token cost stays auditable after the live stream is gone (provider-reported only; no prompt/content capture, no price estimation) (#223, thanks @LemonCANDY42). The Run Detail page no longer loads every symbol's candlesticks up front: the default /runs/{id} response is unchanged, but the UI now renders the run summary first and loads each symbol's chart on demand through opt-in ?chart_payload=summary / ?chart_symbol= modes, with per-symbol loading state and a load-all-with-progress control (#225, thanks @LemonCANDY42). Two loader fixes close the cycle: yfinance's exclusive end boundary no longer drops the final requested trading day — the download now passes end + 1 day while cache keys keep the original range (#226, thanks @gyx09212214-prog) — and a malformed CCXT_TIMEOUT_MS / OKX_TIMEOUT_S value now warns and falls back to its default instead of raising at import and blocking startup (#227, thanks @gyx09212214-prog).
2026-06-13 ↩️ Resume a past session by ID from the CLI: The interactive CLI now prints the session-id on exit, with a copy-paste vibe-trading resume <session-id> hint — so locating the trace for a finished run no longer means guessing which folder under agent/sessions/ is newest by timestamp. The new vibe-trading resume <session-id> subcommand reopens that exact session and replays its recent turns into the loop; an unknown id fails fast instead of silently starting a blank session (#218, thanks @zwrong).
2026-06-12 🩺 Provider reliability overhaul — DeepSeek hangs, Kimi access, streaming liveness: A cluster of provider reports — DeepSeek runs stuck on "Agent is working…" (#208, thanks @XYWOX), reached max iterations masking empty model responses (#203, thanks @mojianliang), the UI never recovering after a stall (#195, thanks @mafia23), and Kimi rejecting the client (#204, thanks @liao497) — shared one root: every OpenAI-compatible provider ran through a single shim that applied DeepSeek/Kimi/Gemini quirks globally and silently swallowed stream failures. Provider-specific behavior now lives in an explicit capability layer — reasoning capture/replay, Gemini thought signatures, the Kimi User-Agent, OpenRouter's reasoning body are each gated to their own provider instead of cross-contaminating. Reasoning-only streams show a live "Reasoning…" indicator instead of dead air; a stream failure raises a contextual provider_stream_error with one automatic retry for transient resets (deterministic 4xx fail fast) instead of silently falling back to a slow non-streaming call; an empty model response is reported as empty_model_response instead of "max iterations"; SSE heartbeats no longer break reconnect replay; and a stuck read-only tool times out instead of hiding behind heartbeats forever. A new vibe-trading provider doctor prints a redacted provider/model/package/proxy snapshot for one-command triage of environment-side hangs. DeepSeek users can opt into the official native adapter with pip install "vibe-trading-ai[deepseek]", and kimi-k2.x's temperature=1 requirement is applied automatically — the Kimi path is verified end-to-end against the live API (tool calls + strict multi-turn reasoning replay on kimi-k2.6).
2026-06-11 🐝 Swarm workers now pull market data through the loader layer: An investment-committee run on NVDA exposed a chain of gaps — workers wrote ad-hoc yfinance scripts, trusted a malformed latest bar (volume present, OHLC empty), leaked NaN into non-strict JSON, and a context-free continuation prompt re-routed to the wrong preset (#198, thanks @BillDin for an exceptional diagnosis plus both fixes). Swarm workers now get a local get_market_data tool backed by the same normalized loader registry as MCP — strict JSON, non-finite floats serialize as null — wired into every market-data preset (21 workers across 13 presets) with a prompt policy that steers OHLCV work tool-first (#199); run_swarm takes an explicit preset_name and refuses ambiguous continuation fragments instead of silently falling back to equity_research_team (#200). Grounding got smarter too: a bare US ticker like NVDA in a swarm prompt is promoted to NVDA.US (stopword-guarded), so workers start from authoritative pre-fetched prices. The tool joins the main agent registry as well — 48 tools now. Also: your Docker data now survives updates — persistent memory, the session search index, user-created skills, shadow accounts and broker config live in named volumes, so docker compose up --build no longer wipes them (#197, thanks @FlyerJ).
2026-06-10 🐳 Docker reaches a host-side Ollama out of the box: Inside the container localhost is the container itself, so the shipped OLLAMA_BASE_URL=http://localhost:11434 failed the LLM preflight for every Dockerized Ollama setup. docker-compose.yml now defaults to http://host.docker.internal:11434 (export OLLAMA_BASE_URL to point elsewhere) and adds the host-gateway extra_hosts mapping so the same file works on Linux as well as Docker Desktop (#196, thanks @ShahNewazKhan).
2026-06-09 🔑 Clearer error when the Web UI is opened from another machine: Reaching the chat from a non-loopback client (another machine, a VM host, a phone on your LAN) without API_AUTH_KEY set returned 403 on every sensitive endpoint — sending a message, listing sessions, live status — but the chat only showed a generic "Failed to send message, please retry." The send path now surfaces the real reason — "Remote API access requires an API key. Add it in Settings, or run the backend on localhost for local-only use." — and the README's web-UI setup spells out the localhost-vs-LAN rule plus the three fixes (browse via localhost on the same machine; set API_AUTH_KEY and enter it once in Settings; or VIBE_TRADING_TRUST_DOCKER_LOOPBACK=1 for Docker Desktop's host gateway) (#191, thanks @mafia23).
2026-06-08 🔧 Gemini 3.x multi-turn tool-calling fix: This completes the Gemini 3.x thinking-model fix. The 6/05 round-trip (#176) only covered in-memory history, but the real agent loop replays history as OpenAI-format dicts where LangChain dropped the per-tool-call thought_signature before the request was built — so multi-turn tool calling still 400'd with missing thought_signature. It is now re-attached at the single _convert_input chokepoint both invoke and stream pass through (parallel calls, where only the first of N is signed, included) (#184, thanks @ngoanpv).
2026-06-07 🐝 Live swarm status in the chat timeline: When the agent launches a multi-agent swarm (investment committee, quant desk, risk committee, …), the chat now renders an inline status card that streams each worker's state — waiting / running / done / failed / blocked / retrying — in real time, the same per-agent visibility the standalone swarm dashboard already had. Runtime events are bridged into the session SSE stream without changing the existing /swarm/runs API, and a finished card rehydrates from the final run_swarm result on reconnect or history replay (#188, thanks @BillDin). Preset routing also got sharper: an explicitly named preset (e.g. investment_committee, with or without underscores) now wins over keyword scoring, and the bare IV derivatives keyword no longer false-matches inside ordinary words like "given" (#189, thanks @BillDin).
2026-06-06 ⚖️ Alpha compare — head-to-head across CLI, Web UI, REST & agent: A new alpha compare benches a hand-picked shortlist of Alpha Zoo alphas against each other on a universe and period, then ranks them by IC mean/std, IR, IC-positive ratio or sample count — each with its gap to the leader. Unlike a full-zoo bench it evaluates only the alphas you name (a new run_bench(only=…) subset filter), so comparing three alphas no longer scores all 191 in their zoo. One shared core powers every surface: vibe-trading alpha compare <id1> <id2> … --sort ir (CLI), a Compare view in the Alpha Zoo Web UI (tick alphas in the catalogue → one-click compare with a streamed ranking table), POST /alpha/compare + SSE (REST), and a read-only alpha_compare agent tool (47 tools now).
2026-06-05 🇮🇳 Dhan + Shoonya connectors (India) — 10 brokers total: The connector-first trading layer adds Dhan and Shoonya for the Indian market (NSE/BSE equities + F&O), bringing the roster to ten brokers. Both are paper + read-only — like Longbridge, their APIs expose no runtime paper/live discriminator, so their place_order / cancel_order hard-refuse any non-paper config at the first line (the rule: a broker with no structural paper/live guard is capped at paper + read-only) (#181, closes #174). This cycle also fixes Gemini 2.5 / 3.x thinking models: their per-tool-call thoughtSignature now round-trips through the OpenAI-compatible path, so multi-turn function calling no longer fails with INVALID_ARGUMENT (#176, closes #170, thanks @mvanhorn & @jliu6789). Chinese docstrings landed on all 452 Alpha Zoo factors (#180, thanks @LeeCQiang), and a frontend test suite (197 vitest tests) plus backend auth / path-traversal / CORS security tests joined CI (#175, thanks @sambazhu).
2026-06-04 🗃️ Opt-in local data cache for all 7 data sources: A new VIBE_TRADING_DATA_CACHE switch lets every backtest loader — tushare, okx, ccxt, akshare, mootdx, yfinance, futu — cache settled historical bars under ~/.vibe-trading/cache (user home, never the repo), so repeated and long-horizon / cross-market backtests skip the network and avoid provider rate limits. Off by default. Batch and connection loaders (yfinance, futu) skip the bulk download / FutuOpenD connection entirely on a full cache hit, a staleness guard never caches a range ending today (its last bar is still forming), and cached frames round-trip byte-identical to freshly fetched ones (#177, thanks @mvanhorn). A new contributor guide for AI / automation-assisted PRs also landed, mapping safe local checks and high-risk broker/MCP/credential surfaces (#173).
2026-06-03 🧹 Community triage + trace correlation: Tool-call trace entries now carry the originating call_id, so a tool_result can be matched back to its tool_call when replaying a run trace — arg previews stay truncated to keep trace files small (#168, thanks @zwrong). Source comments no longer point at an internal-only docs path that external contributors couldn't find (#166, thanks @jaleelpersonal). Also clarified that the langchain-community resolver warning on install is a harmless leftover-package notice, not a failure (#167), and scoped Gemini 2.5/3.0 thoughtSignature round-tripping for function calls as a help wanted task with a full fix plan (#170, thanks @jliu6789).
2026-06-02 🔌 Six new broker connectors