* feat(issue-1172): dsa-后续开发规划：配置、通知告警、复盘红绿灯、bot-交互与-agent-增
* fix: address review feedback for MiniMax preset and agent timeout test
- Update MiniMax preset to official OpenAI-compatible base URL (api.minimaxi.com/v1)
and current model examples (MiniMax-M2.7), with official source links in
.env.example and docs/llm-providers.md.
- Add provenance + LiteLLM compatibility notes and rollback guidance in
docs/llm-providers.md.
- Fix flaky test_llm_call_receives_remaining_timeout_budget by patching
src.agent.runner.time.time so the remaining timeout budget is deterministic.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(review-feedback-1175): address latest review comments
* Update LLM provider defaults
* Fix agent model fallback test
* fix: update report title from 'A股智能分析报告' to '股票智能分析报告'
* feat: add support for Hong Kong market in market review and analysis features
* fix: update daily_analysis workflow name and adjust region check in market analyzer
* fix: enhance market region handling in run_market_review and compute_effective_region functions
* test: add Hong Kong market support in MarketReviewLocalizationTestCase
* fix: update market review region handling to include Hong Kong support in documentation and logic
* fix: update daily_analysis workflow name to Chinese and adjust Hong Kong index symbols in yfinance_fetcher
* fix: refactor market review execution to use run_market_review for improved handling
* fix: implement trading day filtering in MarketCommand to skip reviews on market holidays
* fix: update changelog and README to reflect market command enhancements and support for multiple regions
* fix: update YfinanceFetcher to include HK index symbol mappings for improved data retrieval
Co-authored-by: Jonty <jonty.wang@hk.com.sg>
Co-authored-by: mumu <42829555+ZhuLinsen@users.noreply.github.com>
- Docker release workflow now pushes to both GHCR and Docker Hub (gated on DOCKERHUB_TOKEN and DOCKERHUB_USERNAME secrets), and builds linux/amd64 + linux/arm64.
- Manual publish workflow renamed, gains concurrency guard, input validation, pre-publish smoke, and a safer default tag (v1.0.0 instead of latest).
- Windows desktop backend log lines are decoded as streaming UTF-8 with a GBK fallback when replacement chars appear; PYTHONIOENCODING=utf-8 and python -X utf8 are injected to match.
- Docs: publish official image registries, direct docker run usage, and .env/volume mapping guidance; EN compose example synced with the real docker/docker-compose.yml layout.
- CHANGELOG updated under [Unreleased] in flat format.
* fix: inject REPORT_LANGUAGE into workflow and add current_price to status API (#1013, #983)
* fix: preserve status API snapshot change pct fallbacks
* fix: keep status change pct scoped to intraday data
* fix: wrap optional pipeline services in try/except for graceful degradation
SearchService and SocialSentimentService init failures previously crashed
the entire StockAnalysisPipeline constructor, preventing any analysis from
running even when search/sentiment is non-essential.
Changes:
- Wrap SearchService init in try/except, fallback to None on failure
- Wrap SocialSentimentService init in try/except, fallback to None on failure
- Add null-safety guards at all 5 downstream call sites
- Upgrade progress callback log from debug to warning for better visibility
* fix(auth): use rightmost X-Forwarded-For entry to prevent rate-limit bypass (CWE-345)
When TRUST_X_FORWARDED_FOR=true, get_client_ip() previously took the
leftmost (index [0]) entry from the X-Forwarded-For header. An attacker
can inject arbitrary leftmost values to rotate rate-limit buckets and
bypass brute-force protection on the login endpoint.
Change to [-1] (rightmost entry) which is the IP appended by the trusted
reverse proxy and cannot be controlled by the attacker.
* fix: address review feedback — add CHANGELOG entry, update deployment docs for XFF trust scope
* fix: move CHANGELOG entry from [3.10.1] to [Unreleased] section
* fix: align .env.example TRUST_X_FORWARDED_FOR comment with single-proxy security semantics
---------
Co-authored-by: mumu <42829555+ZhuLinsen@users.noreply.github.com>
* feat: add Slack as a first-class notification channel
* fix: guard Slack image delivery with _should_use_image_for_channel()
* fix: require SLACK_CHANNEL_ID in workflow config check
* docs: add Slack channel entry to CHANGELOG and fix README_CHT nav link
* fix: use Slack new file upload API for image delivery
* fix: update Slack image test for new upload API, add slack to md2img example
* fix: send raw bytes to Slack upload URL and unify bot/webhook precedence
* docs: unify Slack Bot > Webhook precedence across all docs
* docs: add Slack config entries and setup guide to full-guide (zh/en)
Add SLACK_BOT_TOKEN, SLACK_CHANNEL_ID, SLACK_WEBHOOK_URL rows to both
config tables (GitHub Actions + local run) and a dedicated Slack setup
section with Bot-first precedence, mirroring the existing Discord
section structure. Applied to both full-guide.md and full-guide_EN.md.
* feat: register Slack config fields in config_registry for Web settings
Add SLACK_BOT_TOKEN, SLACK_CHANNEL_ID, SLACK_WEBHOOK_URL to
_FIELD_DEFINITIONS (display_order 36-38, between Discord and Pushover)
so /api/v1/system/config/schema and the Web settings page can expose
them. Add SLACK to _infer_category() notification prefix list.
New test file test_config_registry.py (6 cases) verifies field
registration, sensitivity flags, display ordering, and schema response
inclusion — prevents future channels from shipping without UI exposure.
* fix: use password control for SLACK_WEBHOOK_URL to prevent plaintext leak
SLACK_WEBHOOK_URL was marked is_sensitive=True but ui_control was text,
inconsistent with DISCORD_WEBHOOK_URL and other sensitive Webhook fields.
The Web settings page would display the URL in plaintext.
Also added a registry-wide regression test: any is_sensitive field must
use ui_control=password, preventing future channels from repeating this.
* feat: add configurable report language
* Fix review follow-ups for history and fallback localization
* fix: prefer .env report language at startup
* fix: address report language review feedback
* fix: address latest report language review feedback
* docs: add Ollama local model configuration guide (Fixes#690)
- Add Example 4 and channel mode example in LLM_CONFIG_GUIDE
- Add OLLAMA_API_BASE to .env.example and full-guide
- Add Ollama entry to litellm_config.example.yaml
- Add Q12b to FAQ (CN/EN)
- Add troubleshooting row for Ollama 404 / api/generate/api/show
- Update CHANGELOG
Made-with: Cursor
* docs: sync README with Ollama config per AGENTS.md (address review)
- Add Ollama to AI models list in README.md
- Add OLLAMA_API_BASE to Secrets table with link to config guide
- Add pitfall note: do not use OPENAI_BASE_URL for Ollama
- Sync docs/README_EN.md with same changes
- Update CHANGELOG to mention README sync
Made-with: Cursor
* docs: add OLLAMA_API_BASE to full-guide env table and note (address review)
* docs: remove duplicate OLLAMA_API_BASE entries in full-guide (address review)
* fix#692: decouple agent and analysis primary model selection
* fix#692: preserve yaml alias for agent primary model
* docs #692: sync agent primary model in EN/CHT readmes
* Improve analysis API async contracts and startup helpers
* Fix rebased analysis API contract regressions
* fix: align frontend report type union with full responses
- Replace hardcoded 'false' with vars.ENABLE_CHIP_DISTRIBUTION || secrets.ENABLE_CHIP_DISTRIBUTION || 'false'
- Add ENABLE_CHIP_DISTRIBUTION to README and full-guide config tables
- Document that Actions defaults to false; users can set Variable to true for chip data
Made-with: Cursor
Co-authored-by: mumu <42829555+ZhuLinsen@users.noreply.github.com>
