6 Commits

Author	SHA1	Message	Date
shinchan-zhai	7e77b92fd0	feat: Alpaca US stock trader integration (Tasks 8-11) ... - trader/alpaca/: Full Trader interface implementation for Alpaca - Paper/Live trading support (market orders, stop/limit) - GetBalance, GetPositions, GetMarketPrice via Alpaca API - Fractional share support (4 decimal places) - Commission-free trading - Agent trade routing: stock symbols (AAPL, TSLA) → Alpaca - isStockSymbol() heuristic to distinguish crypto vs stock - execute_trade tool updated for stock buy/sell semantics - get_market_price works for both crypto and stocks - TraderManager + API: Alpaca registered as exchange type - Factory case in auto_trader.go - Config mapping in trader_manager.go - Temp trader creation in handler_trader.go for balance query - Frontend: PositionsPanel distinguishes stock vs crypto - US flag emoji for stock positions - Dollar prefix for stock PnL/prices - 'Shares' label instead of 'Qty' for stocks - System prompts updated for stock trading capabilities	2026-03-25 01:05:54 +08:00
shinchan-zhai	82a35a8cae	security: sanitize internal error messages in API responses ... - handler_trader.go: remove loadErr.Error() from 500 responses (2 instances) - handler_ai_cost.go: replace err.Error() with generic message, add logging - Internal errors now logged server-side, not exposed to clients	2026-03-25 01:05:54 +08:00
shinchan-zhai	7c668cd7ef	security+reliability: remove public decrypt endpoint, add panic recovery for goroutines ... Security: - Remove /api/crypto/decrypt from public routes. The endpoint allowed anyone to decrypt ciphertext without authentication. Internal callers (exchange/model handlers) use the service directly and are behind auth. Reliability: - Add safe.Go / safe.GoNamed panic recovery wrapper (safe/go.go). Previously 31 goroutines had zero recover() calls — a single panic in any trader goroutine would crash the entire process. - Apply safe.GoNamed to all trader launch paths: - StartAll, RestoreRunning, LoadSingleTrader auto-start - API handler start/restart endpoints - Panics are now logged with full stack traces instead of crashing.	2026-03-25 01:05:54 +08:00
shinchan-zhai	b1500f9e9a	fix: prevent Agent from fabricating position/balance data ... - Add strict data truthfulness rules to system prompt (CN + EN) - Positions MUST come from get_positions tool only - Balance MUST come from get_balance tool only - Looking up a stock price != user owns it - Fix unused variable warnings in hyperliquid trader	2026-03-25 01:05:54 +08:00
tinkle-community	cb31782be4	refactor: split large files and clean up project structure ... - Rename experience/ to telemetry/ for clarity - Split 15+ large Go files (800-2200 lines) into focused modules: kernel/engine.go, backtest/runner.go, market/data.go, store/position.go, api/handler_trader.go, trader/auto_trader_grid.go, and 9 exchange traders - Split frontend monoliths: types.ts, api.ts, AITradersPage.tsx, BacktestPage.tsx into domain-specific modules with barrel re-exports - Remove stale files: screenshots, .yml.old, pyproject.toml - Remove unused scripts/ and cmd/ directories - Remove broken/outdated test files (network-dependent, stale expectations)	2026-03-12 12:53:57 +08:00
tinkle-community	8e294a5eed	refactor: restructure project directories for better modularity ... - Delete llm/ dead code (3 files, zero references) - Split mcp/ into sub-packages: mcp/provider/ (8 providers) and mcp/payment/ (4 payment clients) with registry pattern - Export Client internal fields and ClientHooks interface for sub-package access - Split api/server.go (3892 lines) into 8 domain-specific handler files - Split trader/auto_trader.go (2296 lines) into 5 focused files - Reorganize web/src/components/ flat files into auth/, charts/, trader/, common/, modals/, backtest/ subdirectories - Update all consumer imports to use registry-based provider creation	2026-03-11 23:58:13 +08:00