4 Commits

Author	SHA1	Message	Date
shinchan-zhai	3c698e3fc5	perf: reuse shared HTTP client in Hyperliquid trader ... Previously each direct API call (orders, sync, account) created a new http.Client, preventing TCP/TLS connection reuse. Now all calls share a single client on the HyperliquidTrader struct (30s timeout).	2026-03-23 10:56:54 +08:00
shinchan-zhai	982ee668c9	security: add safe.ReadAllLimited — bound all HTTP response body reads to 10MB ... - Created safe/io.go with ReadAllLimited helper (default 10MB limit) - Replaced 62 unbounded io.ReadAll(resp.Body) calls across 32 files - Covers all exchange traders (Hyperliquid, Bybit, Binance, OKX, Aster, KuCoin, Gate, Bitget, Lighter, Indodax), providers (CoinAnk, Alpaca, TwelveData), MCP client/x402, market data, wallet, telegram, kernel - Prevents OOM from malicious/buggy exchange API responses - Previously fixed: brain.go, sentinel.go already had manual LimitReader	2026-03-23 10:55:03 +08:00
shinchan-zhai	f37c63f9bb	fix: prevent Agent from fabricating position/balance data ... - Add strict data truthfulness rules to system prompt (CN + EN) - Positions MUST come from get_positions tool only - Balance MUST come from get_balance tool only - Looking up a stock price != user owns it - Fix unused variable warnings in hyperliquid trader	2026-03-23 09:25:58 +08:00
tinkle-community	cb31782be4	refactor: split large files and clean up project structure ... - Rename experience/ to telemetry/ for clarity - Split 15+ large Go files (800-2200 lines) into focused modules: kernel/engine.go, backtest/runner.go, market/data.go, store/position.go, api/handler_trader.go, trader/auto_trader_grid.go, and 9 exchange traders - Split frontend monoliths: types.ts, api.ts, AITradersPage.tsx, BacktestPage.tsx into domain-specific modules with barrel re-exports - Remove stale files: screenshots, .yml.old, pyproject.toml - Remove unused scripts/ and cmd/ directories - Remove broken/outdated test files (network-dependent, stale expectations)	2026-03-12 12:53:57 +08:00