* feat: 新增 STOCK_LIST 单条目解析契约（issue #2063 Phase 1）
新增 src/services/stock_list_parser.py 中的 parse_analysis_target() 单条目解析入口，
按 issue #2063 Phase 1 三段契约实现：
1. 前缀白名单指数：sh/sz 前缀且命中 IndexRegistry 的代码 → INDEX，
canonical_id 同步指数稳定 ID（sh000300→sh000300、sz399001→sz399001）；
2. 裸码默认个股：未带前缀的代码一律 STOCK，即使裸码与已知指数代码冲突
（000300、000016 等）也仅通过 matched_index 暴露冲突，不翻转 asset_type；
3. 前缀未命中降级为股票：sh/sz/bj/hk/us 前缀但 registry 未收录的代码 → STOCK，
不再产生 UNSUPPORTED，避免把 typo 或新代码误判为不可处理。
对外暴露 IndexRegistry、IndexEntry、AnalysisTarget、ParseStatus 以及
default_index_registry()（默认收录 sh000300、sh000016、sh000688、sz399001、
sz399006 五个核心指数），上层可注入自定义 registry 扩展白名单。
保留 split_stock_list() / serialize_stock_list() 两个 legacy helper 的签名与
行为不变，tests/test_stock_list_parser.py 在原有两个 legacy 测试的基础上新增
36 个测试覆盖三条契约、6 个 maintainer spec 样例（sh000300、sz399300、sh600519、
000300、000001、920xxx）及边界场景，全部通过。
* fix: 修复 stock_list_parser 三个 review blocker
修复 maintainer 在 PR #2094 (issue #2063 phase 1) review
中指出的三个解析正确性问题：
1. OR-COR-d24a4e9a — 美股 ticker 前缀冲突
_split_prefix 在切前缀时把 1-5 字母的裸美股 ticker 误判
为 (前缀, 剩余) 形式：SHOP -> (sh, OP)、HKD -> (hk, D)、
BJRI -> (bj, RI)、USM -> (us, M)、SHAK -> (sh, AK)、
USFD -> (us, FD)。修复：在切前缀扫描之前，整串为 1-5
ASCII 大写字母时直接短路返回 (None, token)，让它走裸码
分支的 US 路径。isupper() 是关键鉴别器——大写字母才符
合仓库 is_code_like 的 US ticker 形状 '^[A-Z]{1,5}$'，
混合大小写 (usAAPL) 与含数字码 (sh000300) 仍走前缀拆分
以保留 contract #3 的「prefix supplied → degrade to
stock」语义。
2. OR-COR-1b643ee6 — 裸 A 股 ETF 路由错误
_classify_bare_code 把 51/52/56/58/15/16/18 开头的 6 位
裸 ETF 码统一归到 'CN/STOCK'，_canonicalize_for_stock
随后合成出 'cn510300' / 'cn159915'，没有任何上游 fetcher
接受这种形式。修复：在 6 位分支增加与
data_provider/baostock_fetcher.py、data_provider/
yfinance_fetcher.py 以及 data_provider/base.py 中
ETF_PREFIXES 一致的前缀路由——51/52/56/58 -> SH，
15/16/18 -> SZ——canonical_id 直接生成 'sh510300' /
'sz159915'，可被 BaostockFetcher._convert_stock_code
原样接收（往返一致）。
3. OR-COR-403bd018 — 空 IndexRegistry 被静默覆盖
parse_analysis_target 用 'registry = registry or
default_index_registry()'，导致显式传入的 IndexRegistry([])
(空白名单配置) 被 falsy 短路替换为默认 registry，
sh000300 / sz399001 仍被 elevate 为 index，调用方配置
被破坏。修复：改为 'if registry is None: registry =
default_index_registry()' 显式 None 判断，空白名单被尊重
为合法的「不 whitelist 指数」配置——sh000300 在空 registry
下按 contract #3 degrade 为 stock；默认 registry 行为保持
不变 (sh000300 仍为 index)。
测试：新增 TestReviewBlockerRegressions 覆盖以上三条回归用
例 (USFD/SHAK/BJDX/SZKMY + 维持用例 SHOP/HKD/BJRI/USM/AAPL
/TSLA/BRK/A/Z；510300/159915/510050/520000/562000/588000/
159919/160000/164000/184000 + 与 BaostockFetcher 的往返一致
性；IndexRegistry([]) 下 sh000300/sz399001 degrade、默认
registry 下 sh000300 仍 elevate、自定义子集 registry 仅
匹配子集)。原 130 tests 保持全过，无回归。
属于 #2063 phase 1 收尾
* fix: make parse_analysis_target reuse normalize_code for lowercase/suffix inputs
PR #2094 (issue #2063 Phase 1) addressed three review blockers, but
maintainer flagged a fourth: lowercase/mixed-case/suffix inputs were
misrouted.
Before this commit:
- 'shop' / 'hkd' / 'aapl' (lowercase) was caught by the 2-char prefix
scan in _split_prefix and stripped to ('sh', 'op'), 'hk', 'd', etc.
- 'usAAPL' (mixed-case) flowed through to _classify_bare_code which
matched its alphanumeric pattern and routed to US.
- '600519.SH' / '00700.HK' / '7203.T' (suffix form) never had the suffix
stripped; '.'-containing tokens were discarded by the empty fallback
branch and the inner code was misclassified.
Fix: at the top of parse_analysis_target, call
stock_code_utils._normalize_code_and_exchange to uppercase, strip the
suffix and extract the exchange. The normalized form is then rewritten
via _EXCHANGE_NORMALIZER into the legacy sh600519/hk00700 prefix
canonical so _split_prefix stays the source of truth for the prefix →
contract flow. Special-case 000300.SH (index) is rebuilt into sh000300
so the index lookup still fires. Pure alphabetic suffix forms
(7203.T / 005930.KS / 2330.TW / 6505.TWO) short-circuit straight to
the Yahoo-style BASE.SUFFIX canonical.
Tests: new TestNormalizationReviewBlocker covers shop/hkd/aapl
uppercase, usBRK contract #3 degrade, USFD/USM bare-ticker
preservation (the isupper() short-circuit keeps them safe from prefix
scanning), all six CN/HK suffix forms, 000300.SH → sh000300 INDEX,
and all four JP/KR/TW alphabetic suffix forms. All 72 parser tests pass.
Refs: PR #2094 review blocker OR-COR-5f9691af.
* fix(#2063): 显式后缀 reject 不再静默改写为 sh<digits>
关闭 PR #2122 maintainer review 三个高置信度 correctness blocker：
- OR-COR-607f1395: 600519.BJ / 600000.HK / 1234567.SH 这类带显式
.SH/.SZ/.BJ/.HK 后缀、但与该交易所规则不匹配或位数非法的数字
代码，以前 parse_analysis_target 在 norm_code is None 分支里
无条件抽 raw 数字重建为 sh<digits>，把被规范化层明确拒绝的
输入静默变成上交所股票。修复：仅在 SH/SS alias 路径上、且
重建后的 sh<base> 在 IndexRegistry.find_by_prefixed_code 命中
时才重建（保留 000300.SH → sh000300 INDEX alias 语义）；其他
BJ/HK 不匹配或 SH 非识别 alias 一律返回 unsupported 并携带
可定位 reason。
- OR-COR-26596201: abc.SH 这种带显式交易所后缀、但主体本身不合法
的 token，以前 norm_code is None 后没在 reject 点终止，继续走
_split_prefix / _classify_bare_code，_classify_bare_code 对非
数字默认返回 US，导致 abc.SH 被静默改判为 US stock。修复：在
显式后缀 + base 非纯数字 + 无 registry alias 命中时直接
unsupported，终止后续分类。
- OR-COR-d6afd0d6: 1234567.SH / abc.SH 这类规范化层已经拒绝的
显式后缀输入以前仍会继续走后续分类，最终被当成有效股票而不是
unsupported。修复：同上，在 _split_explicit_exchange 命中且 raw
含 '.' 时强制走严格的 alias-lookup-or-reject 路径，阻断后续
_split_prefix / _classify_bare_code 误判。
非阻断建议同时处理：把 docs/CHANGELOG.md 中原放在 [3.28.0] 段的
STOCK_LIST 解析 [新功能] 条目移回 [Unreleased] 扁平列表，并新增
本轮 [修复] 条目描述显式后缀 reject 修复。
测试：新增 TestExplicitExchangeSuffixRejections 6 个用例覆盖
600519.BJ / 600000.HK / 1234567.SH / abc.SH 4 个 reject 路径，
以及 000300.SH / sh000300.SH 2 个 INDEX alias 仍命中的回归保
护。原 72 个 stock_list_parser 测试保持全过，无回归。
* fix(#2063): collapse 3 review blocker variants in parse_analysis_target
Round-2 review blocker closure for PR #2129 (issue #2063 Phase 1):
* OR-COR-d83a3580 — malformed mixed prefix+suffix tokens like
sh0x00300.SH no longer get reconstructed into a registered
index alias. The base_digits == base_after_prefix guard
requires raw to be a clean <prefix><6digits>.<suffix> shape;
any embedded hex-like garbage between the prefix and the digits
short-circuits to unsupported.
* OR-COR-b3e32200 — dotted-prefix tokens (SH.000999) now honour
contract #3 (prefix supplied → degrade to stock) instead of being
misrouted through strict-suffix reject. has_explicit_suffix
now requires both a literal . AND no dotted-prefix lead, so
SH.000999 falls through to _split_prefix and resolves as a
SH stock candidate (canonical sh.000999).
* OR-COR-e21e9de5 — foreign-exchange suffixes (.T / .KS / .KQ / .TW /
.TWO) whose base failed _valid_exchange_code are no longer
silently flipped to US stock by _classify_bare_code. A new
elif norm_exchange: branch returns unsupported with the
offending foreign suffix surfaced in exchange / reason.
Regression tests cover all 3 blocker categories alongside the
existing OR-COR-607f1395 family.
* fix(#2063): close OR-COR-6f4d6b12 + OR-COR-4b91e5a0 review blockers
OR-COR-6f4d6b12 (dotted-prefix invalid base silent acceptance):
parse_analysis_target previously let dotted-prefix inputs like
`SH.000999` / `BJ.600519` / `HK.600519` / `SS.000999` fall through
to `_split_prefix` after `_normalize_code_and_exchange` rejected the
base. The fall-through produced malformed canonical ids
(`sh.000999`, `bj.600519`, `hk.600519`), and for `SS.000999` —
since lowercase `ss` isn't a known exchange prefix — the bare-code
classifier silently flipped the token to `asset_type='stock',
exchange='US'`. Both outcomes mask user typos as round-trippable
canonical ids.
Fix: extend the explicit-suffix reject branch to also catch dotted-
prefix form (`<EXCHANGE>.base`) when `_split_explicit_exchange`
returned a token whose base failed `_valid_exchange_code`. The same
alias rebuild / reject logic now applies uniformly to strict-suffix
and dotted-prefix shapes.
OR-COR-4b91e5a0 (SZ index mixed prefix+suffix alias rejection):
`sz399001.SZ` and `sz399006.SZ` were rejected with "explicit exchange
suffix 'SZ' rejects base 'SZ399001'" despite the default registry
listing both as SZ indices. The alias rebuild whitelist was hardcoded
to {"SH", "SS"}, so the SZ mixed prefix+suffix path never got a
chance to rebuild into `sz399001` / `sz399006`.
Fix: extend the whitelist to {"SH", "SS", "SZ"}. The existing
`base_after_prefix` / `base_digits` / `clean_alias_shape` checks
already guard against malformed hex-like garbage (OR-COR-d83a3580)
and require the rebuilt base to actually hit the registry; SZ now
rebuilds symmetrically to SH/SS.
Test changes:
- `test_dotted_prefix_degrades_to_stock_per_contract3` is replaced
by `test_dotted_prefix_with_invalid_base_is_unsupported` covering
SH.000999 / BJ.600519 / HK.600519 / SS.000999. `SZ.000001` is
removed because SZ is now in the rebuild whitelist and resolves
through the index/alias path (it's a legitimate SZ stock alias).
- New `test_sz_mixed_prefix_suffix_resolves_through_index_alias`
covers sz399001.SZ / sz399006.SZ rebuilding into the canonical
SZ index ids with the right display_name.
Local: tests/test_stock_list_parser.py 91 passed; tests/test_stock_code_utils.py 96 passed; tests/test_agent_executor.py 63 passed.
* docs(changelog): 与代码行为对齐 PR #2129 dotted-prefix 描述
reviewer 指出当前 Unreleased 条目写着 SH.000999 按 contract #3 降级为该交易所股票候选，但 src/services/stock_list_parser.py 与 tests/test_stock_list_parser.py 已把 SH.000999 / BJ.600519 / HK.600519 / SS.000999 固定为 unsupported，白名单交易所的合法 dotted-prefix（如 sz399001.SZ / sz399006.SZ）才命中 INDEX。
同步修正文案：
- invalid base dotted-prefix 不被 strict-suffix 误拒、亦不静默降级为畸形 canonical stock，统一返回 unsupported
- 白名单交易所的合法 dotted-prefix（如 sz399001.SZ / sz399006.SZ）才命中 INDEX
非阻断修订，不改代码。
* fix(#2063): close PR #2129 review blocker OR-COR-9c3d2c44 (lowercase us bare ticker / lowercase explicit-prefix)
reviewer 在新 head ec7959aa 上发现新 blocker：parse_analysis_target()
在 norm_exchange == '' 的 elif 分支用 raw.startswith('us') 判定显式前缀，
但全小写 bare US ticker（如 usfd / usm）也命中这个分支并被错误剥前缀，
得到 canonical_id='FD' / 'M'，造成 USFD / USM 真实 ticker 被无声改写为
不同 symbol。
修复：
1. lowercase us 前缀分支仅在 raw 是 mixed case（既非全 lower 也非全 upper）
时才进入剥离分支。全小写 bare ticker 由 normalize 层处理为合规 uppercase
bare US ticker（^[A-Z]{1,5}$ 形态）。全大写裸 ticker 由 _split_prefix 短路。
2. _canonicalize_for_stock US 分支统一把 bare upper()，让 lowercase 显式前缀
形态（usaapl / usshop）也得到大写 canonical id，与 mixed-case 显式前缀
（usAAPL → AAPL）与 bare lowercase（aapl → AAPL）一致。
测试：
- tests/test_stock_list_parser.py 新增 4 个 regression case：
- usfd → USFD / usm → USM（blocker close）
- usaapl → AAPL / usshop → SHOP（non-blocking 修复）
完整本地测试：
- tests/test_stock_list_parser.py 95 passed
- tests/test_stock_code_utils.py 96 passed
- tests/test_stock_code_bse.py 17 passed
- tests/test_stock_index_loader.py 14 passed
- tests/test_agent_executor.py 63 passed
- 共 285 passed
文档：docs/CHANGELOG.md [Unreleased] 段追加新条目描述 OR-COR-9c3d2c44。
* fix(#2063): close PR #2129 review blocker OR-COR-2f0d1a7e (lowercase us-prefix split bifurcation) via Phase 1 contract unification
Phase 1 maintainer clarification (issue #2063, 2026-08-01): the "us"
exchange prefix is case-insensitive on the prefix itself, but the ticker
base following an "us" prefix must arrive in canonical uppercase US
symbol shape. Fully lowercase "us"-prefixed tokens are surfaced as
"unsupported" rather than silently rewritten — closes two prior blockers
under one consistent rule without a US ticker whitelist:
- OR-COR-9c3d2c44 (closed): "usfd" / "usm" were silently upper-cased to
bare "USFD" / "USM" (i.e. synthesised different US tickers like
US Foods / USM Holdings when the user may have meant something else).
- OR-COR-2f0d1a7e (new): "usibm" / "usamd" / "usge" / "usbk" were silently
length-dependent — 5-letter lowercase "us"-prefix inputs fell back
to bare treaty producing "USIBM" / "USAMD" / "USGE" / "USBK", while
longer lowercase "usmsft" / "usmeta" split cleanly to "MSFT" / "META".
After this commit:
| input | behaviour |
|-------|-----------|
| "usAAPL" / "usBRK" / "usFD" / "usM" (mixed case) | explicit "us" prefix, splits to "AAPL" / "BRK" / "FD" / "M" |
| "USAAPL" (all upper, >5) | explicit "us" prefix, splits to "AAPL" |
| "USFD" / "USM" (all upper, ≤5) | bare US ticker, preserved as "USFD" / "USM" |
| "usfd" / "usm" / "usibm" / "usamd" / "usge" / "usbk" / "usaapl" / "usshop" (all lower) | "unsupported" with diagnostic "must use uppercase ticker base" |
| "aapl" / "shop" (no "us" prefix) | bare lowercase ticker normalized to "AAPL" / "SHOP" (unchanged) |
Implementation:
- parse_analysis_target() early-return guard: when raw.isalpha() and
raw.startswith("us") and len(raw) > 2 and raw.islower(), surface as
ParseStatus.UNSUPPORTED with exchange="US" and a human-readable
unsupported_reason mentioning the canonical uppercase forms
("usAAPL" / "usBRK" / "USFD").
- Simplified the elif norm_code and norm_exchange == "": branch to
re-split only mixed-case "us"-prefix inputs (all-lowercase is already
short-circuited by the early guard; all-uppercase stays on the bare
ticker short-circuit in _split_prefix ≤5 letters or splits as
explicit prefix >5 letters).
- Updated parse_analysis_target() docstring to reflect the new
contract: exchange prefix is case-insensitive, but "us"-prefix base
must be uppercase US symbol shape, while bare codes may be either
case (the normalizer upper-cases them).
Tests:
- Renamed test_lowercase_us_ticker_regression →
test_lowercase_us_prefix_is_unsupported with 8 parametrized cases
("usfd" / "usm" / "usibm" / "usamd" / "usge" / "usbk" / "usaapl" /
"usshop"). All assert asset_type == UNSUPPORTED, exchange == "US",
normalized_prefix is None, and unsupported_reason mentioning
the uppercase base hint. 289 parser/code-utils/index-loader/agent
tests pass locally (the lone test_multi_agent.py::TestIntelAgent
PostProcess::test_repairs_json_and_caches_intel_context failure
reproduces on HEAD pre-patch and is unrelated — issue #2131
AlphaSift test pollution).
CHANGELOG:
- Replaced the OR-COR-9c3d2c44 close bullet with a single consolidated
entry that closes both OR-COR-9c3d2c44 and OR-COR-2f0d1a7e under one
contract rule from issue #2063.
* fix(#2063): close PR #2129 review blocker OR-COR-7b45f5c1 (mixed-case
us prefix with lowercase base) by extending guard to "case-insensitive
us prefix + base must be uppercase"
OpenReview Bot on PR #2129 head e642648c9d358ffde41c4e29750f55bf27745418
flagged a remaining correctness gap in the August 1, 2026 contract
implementation: the new early-return guard only rejected fully
lowercase "us"-prefixed tokens, so mixed-case prefixes with lowercase
bases such as "Usfd", "USibm", and "Usaapl" still slipped through and
were silently rewritten into different US tickers ("USFD", "USIBM")
or accepted as explicit prefixes with lowercase bases ("us"+"aapl")
instead of returning "unsupported" under the stated Phase 1 contract.
Root cause:
- parse_analysis_target() docstring (src/services/stock_list_parser.py:
451-456) and the new guard comments claim the "us" prefix is
case-insensitive AND the ticker base must be uppercase. The
implementation only fired the reject path when raw.startswith("us")
AND raw.islower() were both true (src/services/stock_list_parser.py:
522-527). Mixed-case prefixes like "Usfd" / "USibm" / "Usaapl" have
raw.islower()==False, so they bypassed the guard.
- The downstream elif branch (src/services/stock_list_parser.py:763-767)
used raw.startswith("us") (case-sensitive) for its recovery split,
so those mixed-case prefixes were re-canonicalised to bare "USFD" /
"USIBM" (when norm_code was non-empty and ≤5 letters fit the bare
treaty) or accepted as explicit "us" prefix with lowercase base
(when norm_code was None and the downstream _split_prefix split the
prefix from the lowercase base).
After this commit the contract is enforced uniformly:
| input | behaviour |
|-------|-----------|
| "usAAPL" / "UsAAPL" / "uSAAPL" / "usBRK" / "UsBRK" / "uSBRK" / "usFD" / "usM" (prefix any case + uppercase base) | explicit "us" prefix, splits to "AAPL" / "BRK" / "FD" / "M" |
| "USAAPL" (all upper, >5) | explicit "us" prefix, splits to "AAPL" |
| "USFD" / "USM" (all upper, ≤5) | bare US ticker, preserved as "USFD" / "USM" |
| "usfd" / "usm" / "usibm" / "usamd" / "usge" / "usbk" / "usaapl" / "usshop" (all-lowercase) | "unsupported" — closed OR-COR-9c3d2c44 + OR-COR-2f0d1a7e |
| "Usfd" / "USibm" / "Usaapl" / "uSfd" / "USaapl" (mixed-case prefix + lowercase base) | "unsupported" — closes OR-COR-7b45f5c1 |
| "aapl" / "shop" (no "us" prefix) | bare lowercase ticker normalised to "AAPL" / "SHOP" (unchanged) |
Implementation:
- Extended the early-return guard in parse_analysis_target() from
`raw.startswith("us") and raw.islower()` (only fully-lowercase
rejection) to `raw[:2].lower() == "us" and not raw[2:].isupper()`
(case-insensitive prefix + base must be entirely uppercase). Any
token whose base contains lowercase letters — whether the prefix is
all-lowercase, mixed-case, or all-uppercase — is now uniformly
rejected up-front as `ParseStatus.UNSUPPORTED` with `exchange="US"`
and a human-readable `unsupported_reason` mentioning the suggested
uppercase base form. This closes OR-COR-9c3d2c44, OR-COR-2f0d1a7e
AND OR-COR-7b45f5c1 under one consistent rule.
- Simplified the elif norm_code and norm_exchange == ""`: branch to
re-split only mixed/upper-case `us`-prefix inputs whose base is fully
uppercase. The condition now requires `raw[2:].isupper()` (base must
be uppercase — already enforced by the early-return guard for the
reject path, so this clause is a defensive confirmation) and
excludes the bare-US-ticker short circuit
`not (raw.isupper() and len(raw) <= 5)` so `USFD` / `USM` ≤5-letter
all-uppercase bare tickers continue to flow through `_split_prefix`
short-circuit rather than to the explicit-prefix split.
Tests:
- Extended `test_lowercase_us_prefix_is_unsupported` with 5 new
parametrized cases (Usfd / USibm / Usaapl / uSfd / USaapl) covering
the OR-COR-7b45f5c1 mixed-case prefix + lowercase base scenario.
All 13 cases assert `asset_type == UNSUPPORTED`,
`exchange == "US"`, `normalized_prefix is None`, `canonical_id == raw`
(verbatim passthrough), and `unsupported_reason` mentioning
"uppercase".
- 254 parser/code-utils/index-loader/yfinance/bse tests pass locally
(249 + 5 new OR-COR-7b45f5c1 cases).
CHANGELOG: updated the existing consolidated bullet to mention the
third closed blocker (OR-COR-7b45f5c1) and the explicit acceptance of
mixed-case prefix + uppercase base forms ("UsBRK" / "uSBRK" / "usFD")
now that the contract is enforced uniformly on the base case.
* fix(#2063): close PR #2129 review blocker OR-COR-us-prefix-nonalpha-guard-gap by extending us-prefix guard to all non-canonical bases
OpenReview Bot 在 PR #2129 head 49e3da6e 上重新复核后给出 1 个未关闭的高置信度 correctness blocker（OR-COR-us-prefix-nonalpha-guard-gap），同时关闭前轮的 4 个 blocker（OR-COR-9c3d2c44 / 2f0d1a7e / 7b45f5c1 三个 round-1/2 blocker 已关闭，本轮只闭合 OR-COR-us-prefix-nonalpha-guard-gap）。本 commit 闭环该剩余 blocker。
== OR-COR-us-prefix-nonalpha-guard-gap root cause ==
src/services/stock_list_parser.py:526-545 的 us-prefix reject guard 用 raw.isalpha() 作为前置条件：
if (
raw.isalpha() # ❌ 前置 isalpha 过滤
and len(raw) > 2
and raw[:2].lower() == "us"
and not raw[2:].isupper()
):
return AnalysisTarget(..., asset_type=UNSUPPORTED, ...)
这意味着含标点或数字的 us-prefix 输入走不到 reject 路径，被 silently rewrite 为不同的 stock：
- parse_analysis_target("usbrk.b") -> stock canonical="BRK.B" (lowecase base+标点)
- parse_analysis_target("usshop.us") -> stock canonical="SHOP.US" (lowercase base+标点)
- parse_analysis_target("us1") -> stock canonical="1" (lowercase prefix+数字 base)
reviewer 指出这些 us-prefixed 输入应被 surfacing 为 unsupported，以免 callers 收到误导性的 canonical stock id（特别是 canonical="1" 不是合法 US symbol shape）。
reviewer 同时给出非阻断建议：补 dotted/numeric us-prefixed inputs 回归测试覆盖。
== 修法 ==
把 guard 从「raw.isalpha() AND base 含 lowercase letter」改为「base 不匹配 canonical US ticker regex」：
_US_TICKER_SHAPE_RE = re.compile(r"^[A-Z]{1,5}(\.[A-Z]{1,2})?$")
if (
len(raw) > 2
and raw[:2].lower() == "us"
and _US_TICKER_SHAPE_RE.match(raw[2:]) is None # ❌ 改为 regex match
):
return AnalysisTarget(..., asset_type=UNSUPPORTED, ...)
新 _US_TICKER_SHAPE_RE 模块级常量与 data_provider/us_index_mapping.py:16-17 和 stock_code_utils._normalize_code_and_exchange 用的同一 regex 一致——canonical US symbol shape：1-5 个大写字母可选跟一个 . + 1-2 个大写字母（covers AAPL/BRK.B/SHOP.US/HKD/USFD 等）。
这个 guard 比 raw.isalpha() + lowercase-letter 检查更严格：
- usbrk.b：base "brk.b" 不 match regex（含 lowercase）→ unsupported ✓
- usshop.us：base "shop.us" 不 match → unsupported ✓
- us1：base "1" 不 match（不是 1-5 大写字母）→ unsupported ✓
- US1：base "1" 不 match → unsupported ✓（含数字的 US-prefix 也被 reject，与 reviewer 期望一致）
- usfd / usibm / Usaapl：base 含 lowercase → 不 match → unsupported ✓（保持原 reject）
- usAAPL / usBRK.B / usSHOP.US：base match → 不 reject → 走原 split-prefix 路径 ✓
- USFD / USBRK.B / AAPL / BRK.B：raw[:2].lower()=="us" false 或 base match → 不 reject → 走原路径 ✓
测试覆盖：
- tests/test_stock_list_parser.py::test_lowercase_us_prefix_is_unsupported parametrize list 加 7 个 new case：
* usbrk.b、usshop.us（lowercase base + punctuation）
* us1、us1a、us12a（lowercase base + digits）
* US1、US12345（all-uppercase but 含数字 invalid US shape）
- 所有 case 断言 asset_type==UNSUPPORTED、exchange=="US"、canonical_id==raw、unsupported_reason 含 "uppercase"
- docstring 与 parametrize 注释同步更新加 OR-COR-us-prefix-nonalpha-guard-gap 解释
== 验证 ==
本地：
- 111 个 stock_list_parser 测试全过（104 已有 + 7 新增 parametrize case）
- PYTHONPATH=src python3 -c "from services.stock_list_parser import parse_analysis_target; for s in [...]: ..." 26 个 case 手动验证全部预期通过
- python3 -m flake8 src/services/stock_list_parser.py tests/test_stock_list_parser.py 我的改动无新增 lint 错误（pre-existing F401 'json'/'Path'/'Optional'/'AnalysisTarget' 不在本 commit 范围）
- backend-gate local run 因 1.8G 内存机 OOM killed（pre-existing limitation，与 PR 2140 解决的 issue #2131 同源）留给 CI web-gate 跑
CI 状态留给 push 后看。
== 真实路径 ==
- PR #2129 review 在 head 49e3da6e 收到 OpenReview Bot OR-COR-us-prefix-nonalpha-guard-gap blocker
- 本 commit 在分支 fix/pr-2122-blockers-r3 上修复并 push
- CI 全绿后请 maintainer 在新 head 复审
* fix(#2063): close PR #2129 round-4 blocker OR-COR-bare-us-suffix-prefix-collision in _split_prefix
OpenReview Bot 在 head 04d86b11 上给出新的 blocker：合法的 bare .US 美股代码如 SHOP.US / HKD.US / BJRI.US / USFD.US 被 _split_prefix() 按 sh/hk/bj/us 前缀错误拆分。
root cause: _split_prefix() 1-5 字母 bare US ticker short-circuit 只覆盖纯字母形态 USFD/SHAK/AAPL；带 .US 后缀的 dotted form 走到已知前缀扫描，前两字符碰巧撞上 sh/hk/bj/us 就被错误拆分。
fix: 用同一 regex _US_TICKER_SHAPE_RE = /^[A-Z]{1,5}(\.[A-Z]{1,2})?$/ 同时覆盖 bare 和 dotted form 作为 short-circuit gate。
回归测试新增 6 个 parametrize case：SHOP.US / HKD.US / BJRI.US / USFD.US / AAPL.US / BRK.B。
本地 117 测试全过（含 6 个新 case），flask8 我的改动无新增 error。CI 交给 push 后看。
* fix(#2129 round-5): extend us-prefix recovery to dotted uppercase US base
OpenReview Bot round-5 review of PR #2129 flagged a remaining
correctness blocker (OR-COR-0e285b84): mixed-case us-prefixed
inputs with a dotted uppercase US base such as usBRK.B /
usABC.US were silently rewritten to bare dotted US tickers
(USBRK.B / USABC.US) after _normalize_code_and_exchange
upper-cased them. _split_prefix then short-circuited on
_US_TICKER_SHAPE_RE and swallowed the user-supplied us prefix,
producing a different canonical id — the same bug pattern that
round-4 already fixed for bare form USFD.US / SHOP.US.
Root cause: the us-prefix recovery branch at
src/services/stock_list_parser.py:~825 guarded its eligible form
with raw.isalpha() (only all-alpha inputs). A dotted base
(e.g. BRK.B) is not all-alpha, so it fell through to raw =
norm_code (USBRK.B) and was then consumed by _split_prefix'
s bare-dotted short-circuit.
Fix: replace the raw.isalpha() + raw[2:].isupper() gate with a
single _US_TICKER_SHAPE_RE.match(raw[2:]) gate (same shape the
upfront guard at lines 566-585 already accepts), while preserving
the bare all-uppercase short-circuit exclusion (not raw[:2].isupper())
so that genuine bare dotted US tickers like SHOP.US / HKD.US /
USFD.US still skip the recovery path and flow through
_split_prefix'
s short-circuit as before.
Add 4 regression test cases covering:
- usAAPL / usBRK — bare US base, explicit prefix preserved
- usBRK.B / usABC.US — dotted uppercase US base, the new
accepted path, normalized_prefix='us' and canonical id is the
bare dotted form (e.g. BRK.B), not the mistaken USBRK.B.
Validation:
python -m pytest tests/test_stock_list_parser.py
-> 121 passed (was 117, +4 new regression cases)
No other tests touched — diff is restricted to the parser
recovery branch and the new regression test suite.
Signed-off-by: xxiaoxiong <2482929840@qq.com>
---------
Signed-off-by: xxiaoxiong <2482929840@qq.com>
Co-authored-by: xxiaoxiong <xxiaoxiong@nicholasxiong.cn>
Co-authored-by: xxiaoxiong <xxiaoxiong@users.noreply.github.com>
* fix(#1970): 关闭认证强制要求当前管理员密码二次确认
后端 api/v1/endpoints/auth.py 的 auth_update_settings 在 disable 路径上即使携带有效 session cookie 也强制要求 current_admin_password，否则返回 400；密码错误统一返回 401，命中 rate limit 与 enable 路径一致返回 429。enable 与 initial setup 路径行为保持不变。
前端 AuthSettingsCard 在关闭认证场景下若 currentPassword 缺失，submit 按钮保持可点击（disabled 仅由 isDirty 决定），handleSubmit 校验后给出内联错误，避免用户面对一个长期 disabled 的按钮但不知所缺。新增 i18n key settings.authDisableRequiredCurrentPassword 中英文本，同步修订 authHelperTurnOff / authPasswordHintOff 文案以反映新契约，并避免 hint 文案与 inline error 文案完全重复导致测试 findByText 多匹配。
测试覆盖：
- tests/test_auth_api.py 新增 disable 路径在有/无 session、有/无 current_password、密码对错、rate limit 命中 6 种分支用例，全部通过。
- apps/dsa-web/__tests__/AuthSettingsCard.test.tsx 把原 'missing current password when session valid' 反向为 'blocks disabling when current password missing'，并补 'disables auth with current password provided'。本机 vitest run AuthSettingsCard.test.tsx 6/6 通过。
issue #1970
* test(#1970): 关闭认证回归补真实 ASGI 端到端用例并清理无效 mock
针对 PR #2050 review 反馈，补齐两条回归用例并修正既有用例的误导性 mock：
1. 删除 AuthApiTestCase 三个 valid-session 用例中对 verify_session 的 patch。
Disable 分支不会调用 verify_session（仅在 enable 分支的 TOCTOU 复检里用到），
旧 mock 既不生效也容易让读者误以为 disable 路径会做 session 校验。
2. 新增 AuthDisableViaRealASGITestCase 通过真实 ASGI / AuthMiddleware / auth
路由组合链路（create_app + httpx.ASGITransport，与 test_api_health.py 同路径）
验证 Issue #1970 修复：
- 真实 POST /api/v1/auth/login 拿到签名 cookie 后，仅带 session 不带
currentPassword 调 /api/v1/auth/settings 关闭认证 -> 400 current_required；
- 同上下文携带正确 currentPassword 关闭认证 -> 200，.env 翻转至
ADMIN_AUTH_ENABLED=false，响应头携带 Set-Cookie 轮换 session secret。
3. 同步 /api/v1/auth/settings OpenAPI description：明确「关闭认证时
currentPassword 必填、有效 session 不足够」这一新契约，与 endpoint
行为及 Issue #1970 上下文对齐。
测试：tests/test_auth_api.py 35/35 全过。
* test(auth): fix rate-limit trigger test — needs MAX+1 iterations to reach 429
Previously range(RATE_LIMIT_MAX_FAILURES) ran only 5 iterations, but
check_rate_limit returns False only when count >= MAX. This means the
5th request enters with count=4 (4 < 5), passes check_rate_limit,
runs verify_stored_password + record_login_failure, and returns 401.
Only a 6th request - entering with count=5 (5 >= 5) - is rejected
early by check_rate_limit and returns 429.
Fix the loop range to RATE_LIMIT_MAX_FAILURES + 1 and update the
assertion: the first MAX attempts return 401 (each recording a
failure), and the final attempt returns 429. Also normalise a
mixed Chinese/English docstring to English-only. 35 tests pass.
* test: tighten ASGI auth disable coverage
- Drop the middleware-is_auth_enabled patch now that the endpoint
disables auth by rotating the session secret in a single in-memory
transition. Subsequent middleware checks in the same client see the
disabled state via the auth module, so the patch was masking a
state-leak instead of testing the real path.
- Make the positive disable test assert cookie deletion semantics
(empty value + Max-Age=0/Expires-past + jar cleared) instead of just
a presence check on Set-Cookie. A leaked pre-disable cookie must not
remain usable after disable, and the previous assertion would still
pass if the endpoint rotated to a fresh session id.
* test(auth): strip surrounding quotes when asserting empty dsa_session value
Starlette's delete_cookie serializes the empty cookie value as
dsa_session=""; Max-Age=0; ... — i.e. with surrounding double quotes.
The previous assertion expected the raw value to equal '' and so
failed on CI (which uses Starlette's stock serializer); locally the
TestClient happened to round-trip the same way but the strip happened
to make the assertion spuriously true (or the assertion was correct
against an older Starlette). Strip surrounding double quotes before
comparison so the test matches the actual deletion-form emitted by
delete_cookie.
* docs(changelog): move #1970 entry to [Unreleased] + drop 5 stray 3.28.0 文档段 entries
OR-COR-3defa936 blocker fix: 上轮 commit (`5219a43b`) 把 6 条 bullet 错误地追加到了已发布的 `## [3.28.0] - 2026-07-26` -> `### 文档` 段落，而不是 `[Unreleased]`。其中：
- 1 条属于本 PR (#1970) — 应放进 [Unreleased]
- 5 条属于其他 PR / issue (#2026 / #1985 / #2051 / Windows mimetypes / TUSHARE_HTTP_URL 工作流映射)，且这些条目在 `3.28.0` 的 `### 新功能` / `### 改进` / `### 修复` 段已经发布过，再放进 `### 文档` 段属于重复 + 跨段误归类。
修复：
- 删除 `3.28.0 -> ### 文档` 段下的 6 条新增 bullet，恢复该段原本只剩「修复文档中的失效相对链接。」的 upstream/main 原貌；
- 在 `[Unreleased]` 段追加本 PR 的 #1970 单条扁平条目（与仓库约定一致：本 PR 自身只追加自身条目，不替其他 PR 处理）。
合并后 `docs/CHANGELOG.md` 的 `3.28.0 -> ### 文档` 段恢复 1 条原貌；`[Unreleased]` 段只新增 1 条本 PR 的条目，不再污染已发布版本历史。
* chore: trigger CI re-run after changelog fix (e01e0cf7 didn't fire pull_request event)
---------
Co-authored-by: xxiaoxiong <xxiaoxiong@users.noreply.github.com>
* fix: redact short credentials in CLI diagnostics
* fix(review-feedback-2111): Redact indented values under empty sensitive YAML fields and preserve
* fix: close structured diagnostic redaction gaps
* fix(review-feedback-2111): Treat comment-only YAML values as empty blocks and Redact indentless
* fix: redact YAML node property blocks
* fix: redact normalized proxy authorization fields
* fix: close multiline diagnostic redaction gaps
* fix: redact spaced credential labels
* fix(review-feedback-2111): Consume YAML blocks with node properties
* fix: include registered spaced credential labels
* fix: close remaining structured redaction gaps
* fix: redact shell words and explicit YAML mappings
* fix: redact single-quoted structured keys
* fix: redact shell append assignments
* fix: redact quoted YAML explicit keys
* fix(review-feedback-2111): add suffix text or drop segments from the env name, such as DeepSeek
* fix(review-feedback-2111): trimming the new docs/CHANGELOG
* fix(review-feedback-2111): update the PR description's verification counts/ranges to match the
* fix(review-feedback-2111): 评审结论 - 代码检查 ：当前整个 PR 仍有 1 个未关闭的高置信度代码 blocker。最新复核摘要：基于
* fix(review-feedback-2111): 补上 helper 级和 non-zero-exit preview 级回归用例，避免文档与运行时行为再次漂移
* fix(review-feedback-2111): add focused helper-level and non-zero-exit preview regressions for
* fix(review-feedback-2111): 评审结论 - 代码检查 ：当前整个 PR 仍有 1 个未关闭的高置信度代码 blocker。最新复核摘要：On the current
* fix(review-feedback-2111): update the PR description's reported current head from 27a013fbf to
* fix: redact sensitive env names embedded inside command substitutions across multi-segment diagnostics
- 覆盖 OPENAI_API_KEY=sk-12345 这种首段为非敏感赋值、值里又嵌敏感名的情况
- 当 $(...) 的前置赋值是敏感名时跳过尾扫避免双重改写，非敏感名仍需进入尾扫
- 新增测试覆盖多段 + 同函数敏感+非敏感赋值的复合诊断文本
- 使用 [A-Z][A-Z0-9_]* token 扫描找到 ALL 中的敏感 env 名引用
* fix(review-2111): redact export SENSITIVE=$(...) without dropping trailing fields
Round-3 review blocker closure for PR #2118 (issue #1784):
OR-COR-7c0a5d41 — the form
export SENSITIVE_ENV=$(printenv OTHER_SECRET) session_id=dup1 token_budget=1000
previously lost ``session_id=dup1`` (case 1) and ALL trailing fields
(case 2 with ``echo OPENAI_API_KEY=sk-12345``) because the second-pass
``$(...)`` scan re-added the same span that the first pass had already
replaced, and ``_replace_spans`` silently dropped the duplicated
region's width worth of trailing characters.
Two fixes:
1. Track first-pass sensitive-assignment replacement spans
(``first_pass_spans``) and skip any ``$(...)`` whose start lies
inside one of those spans. This is the principled guard against
the overlap regardless of where the leading assignment sits.
Previously the second-pass computed a "prior prefix" via three
independent regex branches (semicolon-separated / newline-
separated / head-of-string), each of which only matched bare
``NAME=`` — so ``export NAME=`` slipped through and the second
pass double-rewrote the same span.
2. Add ``(?:export[ \t]+)?`` to all three prior-prefix regexes so
that even if the first-pass span guard were ever evaded, the
leading ``export SENSITIVE=`` would still be recognised and the
second pass would skip the inner ``$(...)``.
Regression tests cover the two exact reproductions from the review
(``session_id=dup1 token_budget=1000`` and ``session_id=dup3``), plus
a non-``export`` control case to lock in the existing behaviour. Full
``tests/test_local_cli_backend.py`` passes 363/363; the ``tests/test_stock_*``
subset is unaffected (460 passed across the CLI + stock subset).
---------
Co-authored-by: zhulinsen <zhuls97@163.com>
Co-authored-by: xxiaoxiong <xxiaoxiong@nicholasxiong.cn>
* fix: surface event payload read/parse failures in ai_review (fixes#2070)
Issue #2070: .github/scripts/ai_review.py::_event_payload() previously
caught (OSError, ValueError) and silently returned {}, which collapsed
three distinct failure modes — missing event file, unreadable file, and
malformed JSON — into a single downstream symptom
('PR number is unavailable for GitHub API review'), making PR review
failures in workflow_dispatch / schedule runs impossible to triage.
Fix preserves the empty-payload degradation contract (so PR_NUMBER still
unblocks the chain when set explicitly), but splits the except clause
into three distinct branches that print a warning identifying the
failure mode by name (file-missing / OSError-derived / JSONDecodeError-
derived), the source path being GITHUB_EVENT_PATH, and the exception
class name. The warning never prints the payload content.
Tests in tests/test_ai_review_github_api.py add regression coverage for:
- missing event file -> {} + 'GITHUB_EVENT_PATH 指向的文件不存在'
- unreadable file (chmod 0o000) -> {} + '事件载荷读取失败' (skipped
on root runners where chmod is a no-op, but never raises)
- invalid JSON -> {} + '事件载荷 JSON 解析失败'
- valid JSON happy path -> payload + no warning (guards against the
warnings accidentally firing on success)
- PR_NUMBER unset + bad event payload -> RuntimeError surfaces with
the warning printed first so logs distinguish 'bad payload' vs
'no PR number'
10 tests pass (5 new + 5 existing) in 0.09s.
* fix: 回应 codex P2 review 反馈 (PR #2096)
1. UnicodeDecodeError 显式分支: open(..., encoding='utf-8') 在非合法 UTF-8
字节序列上抛 UnicodeDecodeError(是 ValueError 子类,旧 (OSError, ValueError)
接住了它,但拆成 OSError + JSONDecodeError 后该异常不再被覆盖,会让 review
终止而非降级). 新增 unicode 分支恢复降级行为,补 1 条独占回归测试.
2. CHANGELOG 收窄到本 PR 实际范围: 移除两条无关条目(parse_analysis_target 来自
PR #2094,YfinanceFetcher 港股裸码路由来自 PR #2097),它们不应进入本 PR 的
release notes.
* feat: support custom Tushare Pro endpoint via TUSHARE_HTTP_URL
Add TUSHARE_HTTP_URL so the Tushare data source can point at a self-hosted
or third-party compatible endpoint when the official api.tushare.pro is not
reachable. Defaults to the official host when unset, so behavior is
unchanged for existing users.
- data_provider/tushare_fetcher.py: add _resolve_tushare_http_url() helper
(strip + http(s):// schema validation) and forward the resolved URL into
_TushareHttpClient, with an info log when a custom endpoint is in use
- .env.example + .github/workflows/00-daily-analysis.yml: document and map
TUSHARE_HTTP_URL so the new option is wired into the daily job without
leaving a half-configured state
- tests: cover env parsing (empty/whitespace/http/https/missing schema),
fetcher fall-through to the official host, and end-to-end POST target
- docs/CHANGELOG.md: flat [Unreleased] entries
Fixes#1985
* refactor: drop unnecessary string-literal type hint in _build_api_client
TushareHttpClient is already defined above TushareFetcher in the module
scope, so a string-literal type hint is not needed for forward reference.
Restore the bare type to match the surrounding code style and reduce the
diff against main.
* docs(tushare): 补 TUSHARE_HTTP_URL 在 full-guide 中英版本的用途/默认行为/workflow 映射说明
按 PR #2048 review 反馈补齐：
- 表格内新增 TUSHARE_HTTP_URL 行（中英文版本同步），明确默认 https://api.tushare.pro 与 http(s):// 前缀要求
- 在 GitHub Actions 段落后补充 TUSHARE_HTTP_URL 的 vars/Secrets 优先级与每日 workflow 0映射说明，与现有非敏感配置（TICKFLOW_PRIORITY）一致
- 完整环境变量列表（中英文版本）补 TUSHARE_HTTP_URL 行，默认值列填 https://api.tushare.pro
- 与代码实现一致：00-daily-analysis.yml 已用 vars.TUSHARE_HTTP_URL || secrets.TUSHARE_HTTP_URL 映射
* docs(tushare): align TUSHARE_HTTP_URL default with runtime and clarify vars/secrets precedence
Per review feedback on PR #2048: the per-repo config contract must stay
consistent across runtime, .env.example, workflow priority, tests and
both zh/en guides. Two fixes applied as a single contract update:
1. Default endpoint alignment. data_provider/tushare_fetcher.py:100,
.env.example, and tests/test_tushare_fetcher_http_client.py all keep
the existing official endpoint http://api.tushare.pro, but the zh/en
full-guide rows had drifted to https://api.tushare.pro. Switching the
documented default to HTTPS would silently change the runtime contract
that the feat commit explicitly preserved. Revert both zh and en
guide rows to http://api.tushare.pro so docs match runtime, .env.example
and the test assertions.
2. vars/secrets precedence wording. The workflow uses
'vars.TUSHARE_HTTP_URL || secrets.TUSHARE_HTTP_URL', which means a
non-empty vars entry always wins and Secrets cannot override it. The
zh/en notes previously suggested 'Secrets as a tamper fallback' which
is incorrect under this precedence and can mislead users into thinking
Secrets has override power. Replace with explicit description of the
real semantics: vars wins when non-empty; Secrets is only selected
when the Variable is empty; for a tamper-resistant deployment put the
value only in Secrets and leave Variables empty.
Both zh and en guides are updated together; the same 6 contract surfaces
(runtime / .env.example / workflow priority / tests / zh guide / en guide)
now describe one consistent contract.
* docs(tushare): remove false Secret-as-tamper-guard claim, document real vars/secrets write-permission model
