gloomberb 0.16.2 → 0.16.4

package/src/plugins/builtin/cloud/terminal-relay/prompts.tsx

@@ -0,0 +1,168 @@
+import { useCallback, useEffect, useRef } from "react";
+import { Box, Text, useUiHost } from "../../../../ui";
+import { Button } from "../../../../components/ui/button";
+import { DialogFrame } from "../../../../components/ui/frame";
+import { t, tf } from "../../../../i18n";
+import { RemoteUiScope } from "../../../../remote/semantic-tree";
+import { useThemeColors } from "../../../../theme/theme-context";
+import { type DialogApi, type PromptContext, useDialogKeyboard } from "../../../../ui/dialog";
+import { isPlainKey } from "../../../../utils/keyboard";
+import type { AssistantDecision } from "./grants";
+import { CONFIRM_WINDOW_MS, RELAY_PROMPT_SCOPE, type ApprovalAnswer, type ConfirmationAnswer, type RelayCaller, type RelayPrompts } from "./engine";
+import type { CallSummary } from "./summary";
+
+const WIDTH = 56;
+/** Keys typed just before a prompt appeared do not answer it. */
+const KEY_GRACE_MS = 600;
+
+/** A fixed width in the terminal; on the desktop and the web, up to it, so a phone fits. */
+function usePromptWidth(): { width: number | string; maxWidth?: number } {
+  return useUiHost().kind === "opentui" ? { width: WIDTH } : { width: "100%", maxWidth: WIDTH };
+}
+
+function useKeyGrace(graceMs: number): () => boolean {
+  const openedAt = useRef(Date.now());
+  return useCallback(() => Date.now() - openedAt.current >= graceMs, [graceMs]);
+}
+
+function useCloseOnAbort(signal: AbortSignal, close: () => void) {
+  useEffect(() => {
+    if (signal.aborted) {
+      close();
+      return;
+    }
+    signal.addEventListener("abort", close, { once: true });
+    return () => signal.removeEventListener("abort", close);
+  }, [close, signal]);
+}
+
+interface PromptProps {
+  caller: RelayCaller;
+  signal: AbortSignal;
+  /** How long after opening keys are ignored; tests pass 0. */
+  keyGraceMs?: number;
+}
+
+/** First time an assistant asks to drive this terminal. */
+export function AssistantApprovalDialog({
+  resolve,
+  caller,
+  signal,
+  keyGraceMs = KEY_GRACE_MS,
+}: PromptContext<AssistantDecision> & PromptProps) {
+  const colors = useThemeColors();
+  const size = usePromptWidth();
+  const keysReady = useKeyGrace(keyGraceMs);
+  const deny = useCallback(() => resolve("deny"), [resolve]);
+  useCloseOnAbort(signal, deny);
+  useDialogKeyboard((event) => {
+    event.stopPropagation();
+    event.preventDefault();
+    if (event.name === "escape" || isPlainKey(event, "n", "d")) {
+      deny();
+      return;
+    }
+    if (!keysReady()) return;
+    if (isPlainKey(event, "s")) resolve("session");
+    else if (isPlainKey(event, "a")) resolve("always");
+  }, { allowEditable: true });
+
+  return (
+    <RemoteUiScope scope={RELAY_PROMPT_SCOPE}>
+      <DialogFrame title={tf("{name} wants to control this terminal", { name: caller.name })} footer={t("S this session · A always · N or Esc deny")}>
+        <Box flexDirection="column" {...size}>
+          <Text fg={colors.text} wrapText>
+            {t("It connected through Gloom Cloud with Terminal control. It can read what is on screen, open and arrange panes and switch layouts.")}
+          </Text>
+          <Box height={1} />
+          <Text fg={colors.textDim} wrapText>
+            {t("Orders, transfers, messages and plugin actions still ask you each time. Revoke it any time in Account Management, Agents.")}
+          </Text>
+          <Box height={1} />
+          <Box flexDirection="row" flexWrap="wrap" gap={1}>
+            <Button label={t("Allow for this session")} variant="primary" onPress={() => resolve("session")} />
+            <Button label={t("Always allow")} variant="secondary" onPress={() => resolve("always")} />
+            <Button label={t("Deny")} variant="secondary" onPress={deny} />
+          </Box>
+        </Box>
+      </DialogFrame>
+    </RemoteUiScope>
+  );
+}
+
+/**
+ * Every call that can reach an outside service. There is no "always" here,
+ * and only `y` allows: `a` means "always" in the approval prompt.
+ */
+export function CallConfirmationDialog({
+  resolve,
+  caller,
+  summary,
+  signal,
+  keyGraceMs = KEY_GRACE_MS,
+}: PromptContext<ConfirmationAnswer> & PromptProps & { summary: CallSummary }) {
+  const colors = useThemeColors();
+  const size = usePromptWidth();
+  const keysReady = useKeyGrace(keyGraceMs);
+  const deny = useCallback(() => resolve("deny"), [resolve]);
+  useCloseOnAbort(signal, deny);
+  useDialogKeyboard((event) => {
+    event.stopPropagation();
+    event.preventDefault();
+    if (event.name === "escape" || isPlainKey(event, "n", "d")) {
+      deny();
+      return;
+    }
+    if (keysReady() && isPlainKey(event, "y")) resolve("allow");
+  }, { allowEditable: true });
+  const labelWidth = Math.max(0, ...summary.lines.map((line) => line.label.length)) + 2;
+
+  return (
+    <RemoteUiScope scope={RELAY_PROMPT_SCOPE}>
+      <DialogFrame
+        title={tf("{name} asks to run an action", { name: caller.name })}
+        footer={tf("Y allow · N or Esc deny · denied after {seconds} s", { seconds: Math.round(CONFIRM_WINDOW_MS / 1_000) })}
+      >
+        <Box flexDirection="column" {...size}>
+          <Text fg={colors.textBright} wrapText>{summary.title}</Text>
+          <Box height={1} />
+          {summary.lines.map((line, index) => (
+            <Box key={`${line.label}:${index}`} flexDirection="row">
+              <Box width={labelWidth} flexShrink={0}>
+                <Text fg={colors.textDim}>{line.label}</Text>
+              </Box>
+              <Text fg={colors.text} wrapText>{line.value}</Text>
+            </Box>
+          ))}
+          <Box height={1} />
+          <Box flexDirection="row" flexWrap="wrap" gap={1}>
+            <Button label={t("Allow")} variant="primary" onPress={() => resolve("allow")} />
+            <Button label={t("Deny")} variant="secondary" onPress={deny} />
+          </Box>
+        </Box>
+      </DialogFrame>
+    </RemoteUiScope>
+  );
+}
+
+/** The engine's prompts, drawn with the app's dialog host. */
+export function dialogRelayPrompts(dialog: DialogApi): RelayPrompts {
+  return {
+    async askApproval(caller, signal): Promise<ApprovalAnswer> {
+      const answer = await dialog.prompt<AssistantDecision>({
+        closeOnClickOutside: false,
+        closeOnEscape: true,
+        content: (context: PromptContext<AssistantDecision>) => <AssistantApprovalDialog {...context} caller={caller} signal={signal} />,
+      }).catch(() => undefined);
+      return answer ?? "deny";
+    },
+    async askConfirmation(caller, summary, signal): Promise<ConfirmationAnswer> {
+      const answer = await dialog.prompt<ConfirmationAnswer>({
+        closeOnClickOutside: false,
+        closeOnEscape: true,
+        content: (context: PromptContext<ConfirmationAnswer>) => <CallConfirmationDialog {...context} caller={caller} summary={summary} signal={signal} />,
+      }).catch(() => undefined);
+      return answer ?? "deny";
+    },
+  };
+}

package/src/plugins/builtin/cloud/terminal-relay/redact.ts

@@ -0,0 +1,73 @@
+/**
+ * Configuration holds broker passwords, API secrets and plugin tokens, and
+ * pane settings, pane state, layouts and the UI tree are free-form maps that
+ * can carry the same (a token a plugin keeps in its settings, a password
+ * typed into a form). Everything the relay sends back passes through here,
+ * with every such value replaced, so a prompt-injected assistant cannot copy
+ * a credential out of the terminal.
+ */
+const SECRET_KEY = /(pass(word|phrase)?|secret|token|api[-_]?key|private[-_]?key|credential|cookie)/i;
+/** Fields of a form field or input that hold what was typed. */
+const TYPED_VALUE_KEYS = ["value", "summary", "defaultValue", "initialValue"];
+export const REDACTED = "[redacted]";
+
+function isPasswordField(record: Record<string, unknown>): boolean {
+  return record.fieldType === "password" || record.inputType === "password" || record.type === "password";
+}
+
+function redactSecrets(value: unknown, depth = 0): unknown {
+  if (depth > 32 || value === null || typeof value !== "object") return value;
+  if (Array.isArray(value)) return value.map((entry) => redactSecrets(entry, depth + 1));
+  const record = value as Record<string, unknown>;
+  const password = isPasswordField(record);
+  const result: Record<string, unknown> = {};
+  for (const [key, entry] of Object.entries(record)) {
+    const filled = entry !== null && entry !== undefined && entry !== "" && typeof entry !== "boolean";
+    if (filled && (SECRET_KEY.test(key) || (password && TYPED_VALUE_KEYS.includes(key)))) {
+      result[key] = REDACTED;
+    } else {
+      result[key] = redactSecrets(entry, depth + 1);
+    }
+  }
+  return result;
+}
+
+/** Broker profile settings are stored as free-form maps; every value there is withheld. */
+function redactBrokerInstances(config: Record<string, unknown>): Record<string, unknown> {
+  const instances = config.brokerInstances;
+  if (!Array.isArray(instances)) return config;
+  return {
+    ...config,
+    brokerInstances: instances.map((instance) => {
+      if (!instance || typeof instance !== "object") return instance;
+      const record = instance as Record<string, unknown>;
+      const settings = record.config && typeof record.config === "object" && !Array.isArray(record.config)
+        ? Object.fromEntries(Object.keys(record.config as Record<string, unknown>).map((key) => [key, REDACTED]))
+        : record.config;
+      return { ...record, config: settings };
+    }),
+  };
+}
+
+/** A config object as a remote assistant may see it. */
+export function redactConfig(config: unknown): unknown {
+  const redacted = redactSecrets(config);
+  return redacted && typeof redacted === "object" && !Array.isArray(redacted)
+    ? redactBrokerInstances(redacted as Record<string, unknown>)
+    : redacted;
+}
+
+/** Resources that carry the whole configuration, before the general pass. */
+export function redactResource(resource: string, value: unknown): unknown {
+  if (resource === "app://config") return redactConfig(value);
+  if (resource === "app://snapshot" && value && typeof value === "object") {
+    const snapshot = value as Record<string, unknown>;
+    return { ...snapshot, config: redactConfig(snapshot.config) };
+  }
+  return value;
+}
+
+/** The last step before any answer leaves the app: every free-form map, at any depth. */
+export function redactRelayResult<T>(result: T): T {
+  return redactSecrets(result) as T;
+}

package/src/plugins/builtin/cloud/terminal-relay/summary.ts

@@ -0,0 +1,62 @@
+/**
+ * What the per-call confirmation says: the exact action in plain words, with
+ * the arguments that matter (plugin, operation, symbol, side, size), so the
+ * person can tell an order from a lookup before allowing it.
+ */
+export interface CallSummaryLine {
+  label: string;
+  value: string;
+}
+
+export interface CallSummary {
+  title: string;
+  lines: CallSummaryLine[];
+}
+
+const KEY_ARGUMENTS: Array<{ keys: string[]; label: string }> = [
+  { keys: ["symbol", "ticker", "instrument", "contract", "conid"], label: "Symbol" },
+  { keys: ["side", "action", "direction"], label: "Side" },
+  { keys: ["quantity", "qty", "size", "shares", "units", "contracts"], label: "Size" },
+  { keys: ["amount", "notional", "value", "cash"], label: "Amount" },
+  { keys: ["orderType", "type", "kind"], label: "Order type" },
+  { keys: ["price", "limitPrice", "limit", "stopPrice", "stop"], label: "Price" },
+  { keys: ["timeInForce", "tif"], label: "Time in force" },
+  { keys: ["account", "accountId", "portfolioId"], label: "Account" },
+  { keys: ["to", "recipient", "destination", "channelId", "email"], label: "To" },
+  { keys: ["message", "text", "content", "body"], label: "Message" },
+];
+
+const MAX_VALUE = 80;
+
+export function shortValue(value: unknown): string {
+  const text = typeof value === "string"
+    ? value
+    : value === undefined
+      ? ""
+      : JSON.stringify(value) ?? String(value);
+  const single = text.replace(/\s+/g, " ").trim();
+  return single.length > MAX_VALUE ? `${single.slice(0, MAX_VALUE - 1)}…` : single;
+}
+
+/** Lines for the order-like fields of a payload, then a count of the rest. */
+export function keyArgumentLines(payload: unknown): CallSummaryLine[] {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return payload === undefined || payload === null ? [] : [{ label: "Input", value: shortValue(payload) }];
+  }
+  const record = payload as Record<string, unknown>;
+  const used = new Set<string>();
+  const lines: CallSummaryLine[] = [];
+  for (const { keys, label } of KEY_ARGUMENTS) {
+    const key = keys.find((candidate) => record[candidate] !== undefined && record[candidate] !== null && record[candidate] !== "");
+    if (!key) continue;
+    used.add(key);
+    lines.push({ label, value: shortValue(record[key]) });
+  }
+  const rest = Object.keys(record).filter((key) => !used.has(key));
+  if (rest.length > 0 && rest.length <= 3) {
+    for (const key of rest) lines.push({ label: key, value: shortValue(record[key]) });
+  } else if (rest.length > 3) {
+    lines.push({ label: "Other fields", value: rest.join(", ") });
+  }
+  return lines;
+}

package/src/plugins/builtin/cloud/upgrade-dialog.tsx

@@ -21,6 +21,8 @@ import {
   monthsFreeYearly,
   trialDaysOf,
 } from "../account-management/model";
+import { useUpgradePersonalization } from "./upgrade-personalization";
+import { upgradeTickerList } from "./upgrade-tickers";
 
 const CONTENT_WIDTH = 64;
 /** Border plus padding the terminal dialog host draws around the content. */
@@ -113,6 +115,13 @@ export function proStepCopy(offer: UpgradeOffer | null): ProStepCopy {
   };
 }
 
+/** The Pro step's first feature; with tickers it names the account's own holdings. */
+export function proStepRealtimeTitle(tickers: readonly string[] | null): string {
+  return tickers?.length
+    ? tf("Real-time quotes for {tickers}", { tickers: upgradeTickerList(tickers) })
+    : t("Real-time market data");
+}
+
 /** Ranked like the onboarding Pro step: the data first, then what reads it. */
 const PRO_FEATURES: Array<{ label: string; value: string }> = [
   { label: "Real-time data", value: "Free runs 15 min behind on quotes, 12 h on news" },
@@ -121,6 +130,20 @@ const PRO_FEATURES: Array<{ label: string; value: string }> = [
   { label: "Flow and X", value: "Options flow, the X feed and sentiment" },
 ];
 
+/**
+ * The feature list, translated. With tickers (the `upgrade_personalized`
+ * arm) the real-time row names the account's own tickers; without
+ * them it is exactly the generic list.
+ */
+export function proFeatureRows(tickers: readonly string[] | null): Array<{ label: string; value: string }> {
+  return PRO_FEATURES.map((feature, index) => ({
+    label: feature.label,
+    value: index === 0 && tickers?.length
+      ? tf("{tickers} quotes, not 15 min behind", { tickers: upgradeTickerList(tickers) })
+      : t(feature.value),
+  }));
+}
+
 /** Pricing and this account's trial and billing state; never rejects, unknowns come back null. */
 export async function loadUpgradeOffer(): Promise<UpgradeOffer> {
   const [pricing, account] = await Promise.allSettled([
@@ -150,6 +173,7 @@ function UpgradeDialog({
   useAppLanguage();
   const [interval, setBillingInterval] = useState<CloudBillingInterval>(initialInterval);
   const [offer, setOffer] = useState<UpgradeOffer | null>(null);
+  const personalTickers = useUpgradePersonalization("upgrade-sheet", offer !== null && !offer.paymentFailed);
 
   useEffect(() => {
     let live = true;
@@ -204,11 +228,11 @@ function UpgradeDialog({
               shortcutScope={dialogId}
             />
             <Box height={1} />
-            {PRO_FEATURES.map((feature) => (
+            {proFeatureRows(personalTickers).map((feature) => (
               <KeyValueRow
                 key={feature.label}
                 label={feature.label}
-                value={t(feature.value)}
+                value={feature.value}
                 labelWidth={FEATURE_LABEL_WIDTH}
                 width={width}
                 emphasis={false}

package/src/plugins/builtin/cloud/upgrade-personalization.ts

@@ -0,0 +1,57 @@
+import { useEffect, useMemo, useReducer } from "react";
+import { apiClient } from "../../../api-client";
+import { usePlanAccess } from "../../../api-client/plan-access";
+import { exposeUpgradePersonalized, knownUpgradePersonalized } from "../../../api-client/research-activity";
+import { useOptionalAppSelector } from "../../../state/app/context";
+import { useAppVisible } from "../../../state/app/activity";
+import type { TickerFinancials } from "../../../types/financials";
+import type { TickerRecord, Watchlist } from "../../../types/ticker";
+import { selectUpgradeTickers } from "./upgrade-tickers";
+
+const NO_TICKERS = new Map<string, TickerRecord>();
+const NO_FINANCIALS = new Map<string, TickerFinancials>();
+const NO_WATCHLISTS: Watchlist[] = [];
+
+/** This device's top tickers for an upgrade surface; stable while the selection is. */
+function useUpgradeTickers(): readonly string[] {
+  const tickers = useOptionalAppSelector((state) => state.tickers, NO_TICKERS);
+  const financials = useOptionalAppSelector((state) => state.financials, NO_FINANCIALS);
+  const watchlists = useOptionalAppSelector((state) => state.config.watchlists, NO_WATCHLISTS);
+  const key = useMemo(
+    () => selectUpgradeTickers(tickers.values(), financials, watchlists).join(","),
+    [financials, tickers, watchlists],
+  );
+  return useMemo(() => (key ? key.split(",") : []), [key]);
+}
+
+/**
+ * The tickers to name on an upgrade surface, or null for the generic copy.
+ * Asks for the `upgrade_personalized` arm once the surface is `shown` to a
+ * signed-in free account with at least one usable ticker; everyone else, the
+ * control arm, and anyone the API leaves out keep the generic copy. Until the
+ * first answer of the session arrives the surface shows the generic copy.
+ */
+export function useUpgradePersonalization(placement: string, shown: boolean): readonly string[] | null {
+  const tickers = useUpgradeTickers();
+  const access = usePlanAccess();
+  const visible = useAppVisible();
+  const accountId = access.signedIn ? apiClient.getCurrentUser()?.id ?? null : null;
+  const eligible = shown && visible && !!accountId && !access.hasProAccess && tickers.length > 0;
+  const [, refresh] = useReducer((revision: number) => revision + 1, 0);
+
+  useEffect(() => {
+    if (!eligible || !accountId) return;
+    let live = true;
+    void exposeUpgradePersonalized(placement).then(() => {
+      if (live) refresh();
+    });
+    return () => {
+      live = false;
+    };
+  }, [accountId, eligible, placement]);
+
+  if (!eligible) return null;
+  // Recheck the current account and privacy flags even after an earlier answer.
+  const arm = knownUpgradePersonalized();
+  return arm === "personalized" ? tickers : null;
+}

package/src/plugins/builtin/cloud/upgrade-tickers.ts

@@ -0,0 +1,124 @@
+/**
+ * The tickers an upgrade surface may name for the `upgrade_personalized`
+ * experiment: the account's own holdings, or with none, the tickers it chose
+ * to watch, read from this device's portfolios and watchlists. They stay on
+ * the device; nothing here is sent anywhere.
+ */
+import { tf } from "../../../i18n";
+import type { TickerFinancials } from "../../../types/financials";
+import type { TickerRecord, Watchlist } from "../../../types/ticker";
+import { isUsListingExchange } from "../../../utils/exchanges";
+import { getPortfolioPositionValue } from "../kelly-sizer/portfolio";
+import { STARTER_SYMBOLS } from "./starter-symbols";
+
+const UPGRADE_TICKER_LIMIT = 3;
+/** One to five letters and an optional class letter: BRK.B, never BTC-USD, ES=F, ^GSPC, SHOP.TO or 7203. */
+const PLAIN_TICKER = /^[A-Z]{1,5}(?:\.[A-Z])?$/;
+/** Every candidate is a US listing, so values compare in dollars without a rate. */
+const DOLLARS = new Map([["USD", 1]]);
+/** Stocks and exchange-traded funds; not mutual funds, which have no intraday quote. */
+const LISTED_TYPES = new Set(["", "STK", "EQUITY", "COMMONSTOCK", "ADR", "DEPOSITARYRECEIPT", "ETF", "ETP", "CEF", "CLOSEDEND", "CLOSEDENDFUND"]);
+
+/** A stock or fund on a US listing exchange (not OTC), priced in dollars. */
+function isUsListedStockOrFund(ticker: TickerRecord): boolean {
+  const contract = ticker.metadata.broker_contracts?.[0];
+  const type = (contract?.secType ?? ticker.metadata.assetCategory ?? "").trim().toUpperCase().replace(/[\s_-]/g, "");
+  const currency = (contract?.currency ?? ticker.metadata.currency ?? "").trim().toUpperCase();
+  return LISTED_TYPES.has(type)
+    && (currency === "USD" || currency === "")
+    && [contract?.primaryExchange, contract?.exchange, ticker.metadata.exchange].some((exchange) => isUsListingExchange(exchange));
+}
+
+/**
+ * The symbol when it is a plain US stock or fund someone can get a real-time
+ * quote for: not cash, an option, a future, a crypto pair or a foreign listing.
+ */
+function plainSymbol(ticker: TickerRecord): string | null {
+  const symbol = ticker.metadata.ticker.trim().toUpperCase();
+  if (!PLAIN_TICKER.test(symbol) || !isUsListedStockOrFund(ticker)) return null;
+  // A contract multiplier means the holding is an option or a future on it.
+  if (ticker.metadata.positions.some((position) => (position.multiplier ?? 1) !== 1)) return null;
+  return symbol;
+}
+
+interface Holding {
+  /** The market value is known on this device: a quote it already has, or the broker's own value. */
+  priced: boolean;
+  value: number;
+}
+
+/**
+ * Gross market value of the shares held, valued like the portfolio pane from
+ * what the device already has; null when none are held. Without a quote or a
+ * broker value it falls back to what was paid, and says so with `priced`.
+ */
+function heldValue(ticker: TickerRecord, financials: TickerFinancials | undefined): Holding | null {
+  const held = ticker.metadata.positions.filter((position) => position.shares !== 0);
+  if (held.length === 0) return null;
+  const value = getPortfolioPositionValue({
+    ticker,
+    financials: financials ?? null,
+    portfolioId: null,
+    baseCurrency: "USD",
+    exchangeRates: DOLLARS,
+  });
+  if (Number.isFinite(value)) return { priced: true, value };
+  const cost = held.reduce((total, position) => total + Math.abs(position.shares * (position.avgCost ?? 0)), 0);
+  return { priced: false, value: Number.isFinite(cost) ? cost : 0 };
+}
+
+/**
+ * Up to three tickers, or none for the generic copy:
+ * - the biggest holdings across every portfolio, those with a known market
+ *   value first by that value, then any the device cannot value yet by cost;
+ * - with nothing held, the first watchlist tickers in list order (lists in
+ *   their order, each sorted by ticker as the pane shows it). Team lists and
+ *   the names the app seeds on first run are skipped: nobody here picked them.
+ */
+export function selectUpgradeTickers(
+  tickers: Iterable<TickerRecord>,
+  financials: ReadonlyMap<string, TickerFinancials>,
+  watchlists: readonly Watchlist[],
+): string[] {
+  const records = [...tickers];
+  const holdings = new Map<string, Holding>();
+  for (const ticker of records) {
+    const symbol = plainSymbol(ticker);
+    if (!symbol) continue;
+    const holding = heldValue(ticker, financials.get(ticker.metadata.ticker));
+    if (holding) holdings.set(symbol, holding);
+  }
+  if (holdings.size > 0) {
+    return [...holdings]
+      .sort(([leftSymbol, left], [rightSymbol, right]) => (
+        Number(right.priced) - Number(left.priced)
+        || right.value - left.value
+        || leftSymbol.localeCompare(rightSymbol)
+      ))
+      .slice(0, UPGRADE_TICKER_LIMIT)
+      .map(([symbol]) => symbol);
+  }
+
+  const picked: string[] = [];
+  for (const watchlist of watchlists) {
+    if (watchlist.teamId) continue;
+    const members = records
+      .filter((ticker) => ticker.metadata.watchlists.includes(watchlist.id))
+      .sort((left, right) => left.metadata.ticker.localeCompare(right.metadata.ticker));
+    for (const ticker of members) {
+      const symbol = plainSymbol(ticker);
+      if (!symbol || STARTER_SYMBOLS.has(symbol) || picked.includes(symbol)) continue;
+      picked.push(symbol);
+      if (picked.length === UPGRADE_TICKER_LIMIT) return picked;
+    }
+  }
+  return picked;
+}
+
+/** "NVDA", "NVDA and AAPL", "NVDA, AAPL and MSFT". */
+export function upgradeTickerList(tickers: readonly string[]): string {
+  const [first = "", second, third] = tickers;
+  if (third) return tf("{first}, {second} and {third}", { first, second: second!, third });
+  if (second) return tf("{first} and {second}", { first, second });
+  return first;
+}

package/src/plugins/builtin/comment-letters/client.ts

@@ -277,9 +277,7 @@ export type IssuerFilingsLoader = (ticker: string, force: boolean) => Promise<{
 
 export class CommentLettersClient {
   private async getJson(url: string, signal?: AbortSignal): Promise<unknown> {
-    const response = await lettersFetch.fetch(url, {
-      signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(FETCH_TIMEOUT_MS)]) : undefined,
-    });
+    const response = await lettersFetch.fetch(url, { signal });
     if (!response.ok) throw new Error(`SEC full-text search failed (${response.status})`);
     return response.json();
   }

package/src/plugins/builtin/company-attention/pane.tsx

@@ -33,7 +33,7 @@ const LABEL_COLUMNS = new Set(["chart"]);
 function Evidence({ row, width, height }: Size & { row: AttentionRow }) {
   const colors = useThemeColors();
   const desktop = !!useUiCapabilities().nativePaneChrome;
-  return <ScrollBox width={width} height={desktop ? undefined : height} flexGrow={1} flexBasis={0} contentOptions={{ paddingX: 1 }}>
+  return <ScrollBox scrollY width={width} height={desktop ? undefined : height} flexGrow={1} flexBasis={0} contentOptions={{ paddingX: 1 }}>
     {(row.details ?? Object.entries(row.values).map(([label, value]) => ({ label, value: String(value ?? "--") }))).map((entry) => <KeyValueRow key={entry.label} label={entry.label} value={entry.value} labelWidth={22} />)}
     {row.url ? <Box paddingY={1}><Text fg={colors.textMuted}>{row.url}</Text></Box> : null}
   </ScrollBox>;

package/src/plugins/builtin/company-kpis/client.ts

@@ -1,12 +1,15 @@
 import { apiClient } from "../../../api-client";
 import type { GuidancePayload, KpiEvidence, KpiGuidance, KpiObservation, KpiPeriod, KpiQueryOptions, KpisPayload } from "../../../api-client/company-kpis";
+import { listingAbroad, type IssuerListingParams, type ListingAbroad } from "../../../api-client/paths";
+import { parsePublicTickerKey } from "../../../utils/exchanges";
 import { createPluginCache } from "../../../data/plugin-cache";
 import { cachedCloudResource, loadCloudResource, unavailableOnServer } from "../shared/cloud-resource";
 
 export type CompanyDataset = KpisPayload | GuidancePayload;
 export type CompanyMode = "kpis" | "guidance";
 export const KPI_UNAVAILABLE = "Company disclosures are not available yet.";
-export const companyKpisCache = createPluginCache<CompanyDataset>({ kind: "company-kpis", source: "gloom-cloud", schemaVersion: 1,
+// Version 2: keys name a listing abroad by venue and company, not by the symbol alone.
+export const companyKpisCache = createPluginCache<CompanyDataset>({ kind: "company-kpis", source: "gloom-cloud", schemaVersion: 2,
   policy: { staleMs: 60 * 60_000, expireMs: 30 * 86_400_000 } });
 const finite = (value: unknown): value is number => typeof value === "number" && Number.isFinite(value);
 const text = (value: unknown): value is string => typeof value === "string";
@@ -75,18 +78,30 @@ export function validateCompanyData<T extends CompanyDataset>(data: T): T {
   return data;
 }
 type CompanyClient = Pick<typeof apiClient, "getCloudCompanyKpis" | "getCloudCompanyGuidance">;
-export async function fetchCompanyData(mode: CompanyMode, symbol: string, options: KpiQueryOptions = {}, client: CompanyClient = apiClient) {
+/** The server answers for the symbol it was asked about; for a listing abroad, its bare symbol or its venue key. */
+function answersFor(answered: string, symbol: string, abroad: ListingAbroad | null): boolean {
+  if (!abroad) return answered.toUpperCase() === symbol.trim().toUpperCase();
+  const parsed = parsePublicTickerKey(answered);
+  return parsed.symbol === abroad.symbol && (!parsed.exchange || parsed.exchange === abroad.exchange);
+}
+export async function fetchCompanyData(mode: CompanyMode, symbol: string, options: KpiQueryOptions = {}, client: CompanyClient = apiClient, listing: IssuerListingParams = {}) {
   try {
-    const data = validateCompanyData(await (mode === "kpis" ? client.getCloudCompanyKpis(symbol, options) : client.getCloudCompanyGuidance(symbol, options)));
-    if (("series" in data) !== (mode === "kpis") || data.symbol.toUpperCase() !== symbol.trim().toUpperCase()) throw new Error("Company disclosures do not match the requested company");
+    const data = validateCompanyData(await (mode === "kpis" ? client.getCloudCompanyKpis(symbol, options, listing) : client.getCloudCompanyGuidance(symbol, options, listing)));
+    if (("series" in data) !== (mode === "kpis") || !answersFor(data.symbol, symbol, listingAbroad(symbol, listing.exchange, listing.name))) throw new Error("Company disclosures do not match the requested company");
     return data;
   }
   catch (error) { throw unavailableOnServer(error, KPI_UNAVAILABLE, [404, 503]); }
 }
 export const companyQuery = (options: Record<string, unknown>): KpiQueryOptions => Object.fromEntries(["metric", "basis", "from", "to", "asOf"]
   .flatMap((key) => typeof options[key] === "string" && options[key] !== "all" ? [[key, options[key]]] : [])) as KpiQueryOptions;
+/** A listing abroad is its venue and company, so it never shares an entry with a US company of the same symbol. */
+function companyIdentity(symbol: string, listing: IssuerListingParams): string {
+  const abroad = listingAbroad(symbol, listing.exchange, listing.name);
+  return abroad ? JSON.stringify([abroad.symbol, abroad.exchange, abroad.name ?? null]) : symbol.toUpperCase();
+}
 // Partition paid history by both identity and entitlement, including screenshot snapshots.
-const cacheKey = (mode: CompanyMode, symbol: string, access: string) => `${mode}:${symbol.toUpperCase()}:${access}`;
-export const cachedCompanyData = (mode: CompanyMode, symbol: string, access: string) => cachedCloudResource(companyKpisCache, cacheKey(mode, symbol, access), validateCompanyData);
-export const loadCompanyData = (mode: CompanyMode, symbol: string, access: string, force = false) => loadCloudResource(companyKpisCache,
-  cacheKey(mode, symbol, access), () => fetchCompanyData(mode, symbol), { force, validate: validateCompanyData });
+const cacheKey = (mode: CompanyMode, symbol: string, access: string, listing: IssuerListingParams) => `${mode}:${companyIdentity(symbol, listing)}:${access}`;
+export const cachedCompanyData = (mode: CompanyMode, symbol: string, access: string, listing: IssuerListingParams = {}) =>
+  cachedCloudResource(companyKpisCache, cacheKey(mode, symbol, access, listing), validateCompanyData);
+export const loadCompanyData = (mode: CompanyMode, symbol: string, access: string, force = false, listing: IssuerListingParams = {}) => loadCloudResource(companyKpisCache,
+  cacheKey(mode, symbol, access, listing), () => fetchCompanyData(mode, symbol, {}, apiClient, listing), { force, validate: validateCompanyData });

package/src/plugins/builtin/company-kpis/headless.ts

@@ -1,4 +1,5 @@
 import type { HeadlessPaneDefinition } from "../../../types/plugin";
+import { resolveHeadlessIssuerListing } from "../shared/headless-market-data";
 import { companyQuery, fetchCompanyData, type CompanyMode } from "./client";
 
 export function companyHeadless(mode: CompanyMode): HeadlessPaneDefinition<"bundle"> {
@@ -19,7 +20,8 @@ export function companyHeadless(mode: CompanyMode): HeadlessPaneDefinition<"bund
     describe: (args) => `${mode === "kpis" ? "Company KPIs" : "Company guidance"} | ${args.symbols[0]}`,
     async load(args, ctx) {
       const options = companyQuery(args.options);
-      const data = await fetchCompanyData(mode, args.symbols[0]!, options, ctx.apiClient);
+      const symbol = args.symbols[0]!;
+      const data = await fetchCompanyData(mode, symbol, options, ctx.apiClient, await resolveHeadlessIssuerListing(ctx, symbol));
       return { complete: !data.truncated, errors: data.truncated ? [data.access === "preview" ? "Full disclosures and history require Gloom Pro" : "Response limit reached; narrow the metric or date range"] : [],
         sections: "series" in data ? [
           { title: "Latest KPIs", rows: data.series.map((series) => ({ ...series.latest })) },