- Change debug=True to debug=False by default
- Add FLASK_DEBUG environment variable for development
- Show warning when debug mode is enabled
- Prevents arbitrary code execution via Werkzeug debugger
- Fixes GitHub Security Alert #2 (py/flask-debug)
Production deployments are now secure by default.
For development: export FLASK_DEBUG=1
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
_safe_resolve():
- Add explicit security docstring with 6 validation steps
- Add inline comments for each security check
- Makes CodeQL recognize existing security measures
get_job_options():
- Validate base_path is within current working directory
- Use .resolve() and .relative_to() for path validation
- Reject paths outside project directory
- Show user-friendly error message via Streamlit
Fixes GitHub Security Alert #3 (py/path-injection)
Path traversal attacks via user-provided paths are now prevented.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Validate base_path is within current working directory
- Use .resolve() and .relative_to() for path validation
- Reject paths outside project directory
- Show user-friendly error message via Streamlit
- Add security docstring explaining the fix
- Fixes GitHub Security Alert #4 (py/path-injection)
Path traversal attacks via base_path parameter are now prevented.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Validate job_folder is within base_path directory
- Use .resolve() and .relative_to() for path validation
- Catch ValueError and RuntimeError for invalid paths
- Show user-friendly error message instead of crashing
- Fixes GitHub Security Alert #5 (py/path-injection)
Path traversal attacks via job_folder parameter are now prevented.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Mask API endpoint to prevent full URL exposure
- Change '✓' to '✓ Key set' for clearer status
- Add security comment explaining the fix
- Fixes GitHub Security Alert #7 (py/clear-text-logging-sensitive-data)
API keys are no longer logged, only their presence is indicated.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Replace hardcoded API_KEY with os.getenv('TEST_API_KEY')
- Replace hardcoded HF_TOKEN with os.getenv('TEST_HF_TOKEN')
- Replace hardcoded API_BASE with os.getenv('TEST_API_BASE')
- Replace hardcoded MODEL with os.getenv('TEST_MODEL')
- Add test credentials patterns to .gitignore
- Fixes GitHub Security Alert #8 (py/clear-text-storage-sensitive-data)
Sensitive data is now loaded from environment variables instead of clear text.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Translated all comments from German to English
- Changed 'Verfügbare Spalten' to 'Available columns'
- Changed 'Markt-Kontext' to 'Market Context'
- Changed 'Lookback Referenz' to 'Lookback Reference'
- Changed '% ARR zu schlagen' to '% ARR to beat'
- Changed '% maximaler Drawdown' to '% maximum drawdown'
All configuration values remain unchanged.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Marked all v1.0.0 release items as completed
- Moved naming conventions to Low Priority (post-v1.0.0)
- Added future release roadmap (v1.1.0, v1.2.0, v1.3.0)
- Documented status and priority for open items
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Created changelog/ directory for version-specific changelogs
- Added changelog/v1.0.0.md with comprehensive release notes
- Updated CHANGELOG.md to reference changelog/v1.0.0.md
- Updated TEMP_RELEASE.txt with correct link to v1.0.0.md
- Cleaner structure for future releases (changelog/v1.1.0.md, etc.)
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Created ATTRIBUTION.md explaining MIT License requirements
- Added attribution requirements to README.md
- Clarifies what users must do when using this code:
* Keep MIT License text
* Keep copyright notice
* Provide attribution to original project
- Includes examples of good and bad attribution
- Explains legal basis and consequences of violations
- Adds License badge to README header
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Removed .coveragerc (test coverage config)
- Removed pytest.ini (pytest config)
- These should be in test/ directory or not needed
- Keeps root directory clean for release
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Updated QWEN.md with English-only comment policy
- Translated all German comments in:
* eurusd_regime.py
* eurusd_llm.py
* eurusd_reflection.py
* eurusd_memory.py
* eurusd_macro.py
* eurusd_debate.py
* predix_dashboard.py
- All comments, docstrings, and print statements now in English
- Ensures consistency with commit messages and documentation
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Removed 'Inspiriert von' comments from all source files
- Added comprehensive Acknowledgments section to README.md
- Credits to:
* Microsoft RD-Agent (MIT) - R&D framework foundation
* TradingAgents (Apache 2.0) - Multi-agent patterns
* ai-hedge-fund - Macro analysis and risk management concepts
- Clarified that all code is originally written and implemented independently
- Ensures license compliance (MIT, Apache 2.0 compatible)
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Added acknowledgment section crediting Microsoft RD-Agent
- Link to original project: https://github.com/microsoft/RD-Agent
- Clarifies that Predix extends RD-Agent with forex-specific features
- Added step-by-step rebase instructions
- Listed all German commits that need translation
- Provided English translations for each
- Added force push warnings and team coordination notes
- Added .qwen/ directory to .gitignore
- Removed .qwen/agents/ from Git index (was tracked despite .gitignore)
- These files are generated by Qwen Code and should not be committed
Change: Instead of truncating texts, now using intelligent chunking:
1. Content ≤ 20,000 characters: Single embedding (complete)
2. Content > 20,000 characters: Split into 20k chunks
- Each chunk gets its own embedding
- All embeddings are averaged
- No information loss!
Benefits:
- No more text truncation
- Full information preserved
- Stays under 8192 token limit (nomic-embed-text)
- Average embedding represents entire text
Affected files:
- rdagent/components/knowledge_management/vector_base.py
Problem: Knowledge Graph versucht zu lange Texte zu embedden
- nomic-embed-text Limit: 8192 Token
- Fehler: 'the input length exceeds the context length'
- System crasht nach 10 Retries
Lösung:
1. Content für Embeddings auf 15.000 Zeichen kürzen (~4000 Token)
2. Trunk-Größe auf max 4000 begrenzt
3. Hinweis '[truncated for embedding]' bei Kürzung
Betroffene Dateien:
- rdagent/components/knowledge_management/vector_base.py
Jetzt sollte fin_quant ohne Embedding-Fehler durchlaufen.
Add automatic dashboard launch options for trading loop:
1. CLI integration (rdagent/app/cli.py)
- --with-dashboard/-d flag for web dashboard
- --cli-dashboard/-c flag for terminal UI
- --dashboard-port for custom port configuration
- Automatic background process spawning
2. Dashboard auto-start
- Web dashboard launches in background thread
- CLI dashboard opens in separate terminal window
- Graceful startup with 2-second delay
3. Process management
- Dashboard runs as daemon thread
- Automatic cleanup on main process exit
- Error handling for dashboard startup failures
4. Documentation
- Updated help text with examples
- Usage instructions in README
- Dashboard URLs displayed on startup
Usage examples:
rdagent fin_quant -d # Web dashboard
rdagent fin_quant -c # CLI dashboard
rdagent fin_quant -d -c # Both dashboards
rdagent fin_quant -d --port 5001 # Custom port
Neue Module für fortgeschrittenes Trading:
1. Bull vs Bear vs Neutral Debatte (eurusd_debate.py)
- Multi-Perspektiven-Analyse für bessere Entscheidungen
- Bull Agent: Argumentiert für LONG
- Bear Agent: Argumentiert für SHORT
- Neutral Agent: Argumentiert für WAIT
- Research Manager: Bewertet Debatte und trifft finale Entscheidung
- Decision-Logik: LONG wenn Bull > 70% und > Bear + 20
2. EURUSD Macro Agent (eurusd_macro.py)
- Stanley Druckenmiller Stil für Makro-Trading
- Analysiert Zinsdifferential (Fed vs EZB)
- Wirtschaftswachstum (BIP, PMI, NFP)
- Momentum (DXY Trend)
- Sentiment (Risk-On/Off, COT Report)
- Asymmetrische Risk-Reward-Analyse
- Bei hoher Conviction + asymmetrischer Chance: große Position
3. Reflection System (eurusd_reflection.py)
- Lernt aus vergangenen Trades kontinuierlich
- Analysiert was richtig/falsch lief
- Extrahiert Lessons Learned
- Speichert im BM25 Memory für ähnliche Situationen
- Aggregierte Insights für letzte N Trades
4. Korrelations-Adjustierung (in eurusd_risk.py erweitert)
- Berechnet Korrelation mit anderen Forex-Positionen
- GBPUSD: +0.75, USDCHF: -0.70, DXY: -0.85
- Hohe Korrelation → Risk reduzieren (0.7x)
- Negative Korrelation → natürlicher Hedge (1.1x)
Alle Module getestet und funktionsfähig.
Trading Prediction Technology