aria-code 0.165.0__tar.gz → 0.166.0__tar.gz

{aria_code-0.165.0/src/aria_code.egg-info → aria_code-0.166.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aria-code
-Version: 0.165.0
+Version: 0.166.0
 Summary: Open-source AI agent for coding, financial analysis and logistics operations: numbers you can check, client data kept apart, actions a person approves
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/artheras/aria-code
@@ -36,24 +36,30 @@ Requires-Dist: aiofiles>=23.2.0
 Requires-Dist: websockets>=12.0
 Requires-Dist: apscheduler>=3.10.0
 Requires-Dist: ddgs>=9.0
-Requires-Dist: numpy>=1.26.0
-Requires-Dist: pandas>=2.2.0
-Requires-Dist: scipy>=1.13.0
-Requires-Dist: pandas_ta>=0.4.67b0; python_version >= "3.12"
-Requires-Dist: yfinance>=0.2.55
 Requires-Dist: pyobjc-framework-WebKit>=10.0; sys_platform == "darwin"
 Requires-Dist: markdown>=3.6
+Provides-Extra: finance
+Requires-Dist: numpy>=1.26.0; extra == "finance"
+Requires-Dist: pandas>=2.2.0; extra == "finance"
+Requires-Dist: scipy>=1.13.0; extra == "finance"
+Requires-Dist: pandas_ta>=0.4.67b0; python_version >= "3.12" and extra == "finance"
+Requires-Dist: yfinance>=0.2.55; extra == "finance"
 Provides-Extra: cn
 Requires-Dist: akshare>=1.14.68; extra == "cn"
+Requires-Dist: pandas>=2.2.0; extra == "cn"
 Provides-Extra: crypto
 Requires-Dist: ccxt>=4.4.0; extra == "crypto"
+Requires-Dist: pandas>=2.2.0; extra == "crypto"
 Provides-Extra: charts
 Requires-Dist: mplfinance>=0.12.10b0; extra == "charts"
+Requires-Dist: pandas>=2.2.0; extra == "charts"
 Provides-Extra: google
 Requires-Dist: google-genai>=1.0.0; extra == "google"
 Provides-Extra: data
 Requires-Dist: duckdb>=0.10.3; extra == "data"
+Requires-Dist: pandas>=2.2.0; extra == "data"
 Provides-Extra: files
+Requires-Dist: pandas>=2.2.0; extra == "files"
 Requires-Dist: pdfplumber>=0.11.0; extra == "files"
 Requires-Dist: pypdf>=4.3.0; extra == "files"
 Requires-Dist: python-docx>=1.1.2; extra == "files"
@@ -87,6 +93,7 @@ Requires-Dist: longbridge>=1.0.22; extra == "brokers"
 Requires-Dist: alpaca-py>=0.35.0; extra == "brokers"
 Provides-Extra: backtest
 Requires-Dist: vectorbt>=0.26.2; extra == "backtest"
+Requires-Dist: yfinance>=0.2.55; extra == "backtest"
 Provides-Extra: image-gen
 Requires-Dist: torch>=2.2.0; extra == "image-gen"
 Requires-Dist: diffusers>=0.30.0; extra == "image-gen"
@@ -99,11 +106,19 @@ Requires-Dist: playwright>=1.44.0; extra == "browser"
 Provides-Extra: desktop
 Requires-Dist: mss>=9.0.1; extra == "desktop"
 Requires-Dist: pyautogui>=0.9.54; extra == "desktop"
+Requires-Dist: pillow>=10.0; extra == "desktop"
+Requires-Dist: pyperclip>=1.9; extra == "desktop"
 Provides-Extra: sports
 Requires-Dist: understat>=0.1.0; extra == "sports"
+Requires-Dist: numpy>=1.26.0; extra == "sports"
 Provides-Extra: lsp
 Requires-Dist: python-lsp-server[all]>=1.10.0; extra == "lsp"
 Provides-Extra: dev
+Requires-Dist: numpy>=1.26.0; extra == "dev"
+Requires-Dist: pandas>=2.2.0; extra == "dev"
+Requires-Dist: scipy>=1.13.0; extra == "dev"
+Requires-Dist: pandas_ta>=0.4.67b0; python_version >= "3.12" and extra == "dev"
+Requires-Dist: yfinance>=0.2.55; extra == "dev"
 Requires-Dist: pytest>=8.2.0; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23.7; extra == "dev"
 Requires-Dist: pytest-timeout>=2.3.0; extra == "dev"
@@ -112,7 +127,16 @@ Requires-Dist: mypy>=1.10.0; extra == "dev"
 Requires-Dist: fastapi>=0.110.0; extra == "dev"
 Requires-Dist: uvicorn>=0.29.0; extra == "dev"
 Requires-Dist: python-multipart>=0.0.9; extra == "dev"
+Provides-Extra: service
+Requires-Dist: fastapi>=0.110.0; extra == "service"
+Requires-Dist: uvicorn>=0.29.0; extra == "service"
+Requires-Dist: python-multipart>=0.0.9; extra == "service"
 Provides-Extra: full
+Requires-Dist: numpy>=1.26.0; extra == "full"
+Requires-Dist: pandas>=2.2.0; extra == "full"
+Requires-Dist: scipy>=1.13.0; extra == "full"
+Requires-Dist: pandas_ta>=0.4.67b0; python_version >= "3.12" and extra == "full"
+Requires-Dist: yfinance>=0.2.55; extra == "full"
 Requires-Dist: google-genai>=1.0.0; extra == "full"
 Requires-Dist: akshare>=1.14.68; extra == "full"
 Requires-Dist: ccxt>=4.4.0; extra == "full"
@@ -127,6 +151,11 @@ Requires-Dist: beautifulsoup4>=4.12.3; extra == "full"
 Requires-Dist: Pillow>=10.4.0; extra == "full"
 Requires-Dist: ddgs>=9.0; extra == "full"
 Provides-Extra: all
+Requires-Dist: numpy>=1.26.0; extra == "all"
+Requires-Dist: pandas>=2.2.0; extra == "all"
+Requires-Dist: scipy>=1.13.0; extra == "all"
+Requires-Dist: pandas_ta>=0.4.67b0; python_version >= "3.12" and extra == "all"
+Requires-Dist: yfinance>=0.2.55; extra == "all"
 Requires-Dist: google-genai>=1.0.0; extra == "all"
 Requires-Dist: akshare>=1.14.68; extra == "all"
 Requires-Dist: ccxt>=4.4.0; extra == "all"
@@ -172,7 +201,7 @@ Numbers you can check, client data kept apart, actions a person approves.</p>
 <p align="center">
   <a href="https://www.npmjs.com/package/@artheras/aria-code"><img src="https://img.shields.io/npm/v/@artheras/aria-code/latest?style=flat-square&logo=npm&label=npm" alt="npm version"></a>
   <!-- Release automation pins PyPI: the default endpoint still selects legacy 4.x. -->
-  <a href="https://pypi.org/project/aria-code/0.165.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.165.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
+  <a href="https://pypi.org/project/aria-code/0.166.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.166.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
   <a href="https://github.com/artheras/aria-code/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/artheras/aria-code/ci.yml?branch=main&style=flat-square&logo=githubactions&label=CI" alt="CI status"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-64748b?style=flat-square" alt="Apache License 2.0"></a>
 </p>
@@ -225,6 +254,8 @@ The installer downloads the binary for your OS from the latest [GitHub release](
 
 Alternative package-manager installs: `npm install -g @artheras/aria-code` (requires npm) or `python3 -m pip install --upgrade "aria-code<4"` (requires Python 3.10+; the `<4` skips an older 4.x numbering that PyPI still lists). For development from source, see [CONTRIBUTING.md](CONTRIBUTING.md).
 
+The pip base install supports coding and chat without the financial data stack. Add it with `python3 -m pip install "aria-code[finance]<4"`; `full`, `all`, and `dev` retain finance dependencies. Native/npm releases retain their bundled financial tools. See [optional finance installation](docs/optional-finance.md).
+
 ### Updates
 
 Aria checks for a newer stable version in the background at startup, at most once per day. Cached notices appear immediately; network checks never delay the prompt. It checks GitHub Releases, or scoped npm for npm installs. Pip updates pin the GitHub version and verify that version is available on PyPI, avoiding the older 4.x numbering still listed as PyPI's latest. Source checkouts receive Git update instructions.
@@ -295,3 +326,5 @@ For the current command-line flags, run `aria-code --help`. For help inside the
 Contributions are welcome; see [CONTRIBUTING.md](CONTRIBUTING.md). Aria Code is open source under the [Apache License, Version 2.0](LICENSE).
 
 Releases 4.2.0 through 4.4.5 were published under the Business Source License 1.1 and remain available under those terms; releases up to and including 4.1.2 were MIT. A license grant cannot be withdrawn from someone who already has it, so each version keeps the license it shipped with — see [NOTICE](NOTICE).
+
+Shared financial tools can also run independently through the [Financial Service MCP integration](docs/financial-service.md), with a reusable Finance workflow in [Aria Plugins](https://github.com/artheras/aria-plugins). Legacy financial commands remain available.

{aria_code-0.165.0 → aria_code-0.166.0}/README.md

@@ -15,7 +15,7 @@ Numbers you can check, client data kept apart, actions a person approves.</p>
 <p align="center">
   <a href="https://www.npmjs.com/package/@artheras/aria-code"><img src="https://img.shields.io/npm/v/@artheras/aria-code/latest?style=flat-square&logo=npm&label=npm" alt="npm version"></a>
   <!-- Release automation pins PyPI: the default endpoint still selects legacy 4.x. -->
-  <a href="https://pypi.org/project/aria-code/0.165.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.165.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
+  <a href="https://pypi.org/project/aria-code/0.166.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.166.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
   <a href="https://github.com/artheras/aria-code/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/artheras/aria-code/ci.yml?branch=main&style=flat-square&logo=githubactions&label=CI" alt="CI status"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-64748b?style=flat-square" alt="Apache License 2.0"></a>
 </p>
@@ -68,6 +68,8 @@ The installer downloads the binary for your OS from the latest [GitHub release](
 
 Alternative package-manager installs: `npm install -g @artheras/aria-code` (requires npm) or `python3 -m pip install --upgrade "aria-code<4"` (requires Python 3.10+; the `<4` skips an older 4.x numbering that PyPI still lists). For development from source, see [CONTRIBUTING.md](CONTRIBUTING.md).
 
+The pip base install supports coding and chat without the financial data stack. Add it with `python3 -m pip install "aria-code[finance]<4"`; `full`, `all`, and `dev` retain finance dependencies. Native/npm releases retain their bundled financial tools. See [optional finance installation](docs/optional-finance.md).
+
 ### Updates
 
 Aria checks for a newer stable version in the background at startup, at most once per day. Cached notices appear immediately; network checks never delay the prompt. It checks GitHub Releases, or scoped npm for npm installs. Pip updates pin the GitHub version and verify that version is available on PyPI, avoiding the older 4.x numbering still listed as PyPI's latest. Source checkouts receive Git update instructions.
@@ -138,3 +140,5 @@ For the current command-line flags, run `aria-code --help`. For help inside the
 Contributions are welcome; see [CONTRIBUTING.md](CONTRIBUTING.md). Aria Code is open source under the [Apache License, Version 2.0](LICENSE).
 
 Releases 4.2.0 through 4.4.5 were published under the Business Source License 1.1 and remain available under those terms; releases up to and including 4.1.2 were MIT. A license grant cannot be withdrawn from someone who already has it, so each version keeps the license it shipped with — see [NOTICE](NOTICE).
+
+Shared financial tools can also run independently through the [Financial Service MCP integration](docs/financial-service.md), with a reusable Finance workflow in [Aria Plugins](https://github.com/artheras/aria-plugins). Legacy financial commands remain available.

{aria_code-0.165.0 → aria_code-0.166.0}/pyproject.toml

@@ -4,11 +4,11 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aria-code"
-version = "0.165.0"
+version = "0.166.0"
 description = "Open-source AI agent for coding, financial analysis and logistics operations: numbers you can check, client data kept apart, actions a person approves"
 readme = "README.md"
 license = { text = "Apache-2.0" }
-# Upper bound is real, not defensive: the core dep pandas_ta pulls numba, and
+# Upper bound is real, not defensive: the finance/full extras include pandas_ta, which pulls numba, and
 # numba hard-refuses to build on 3.14 ("only versions >=3.10,<3.14 are
 # supported"). Without this bound pip happily starts the install on 3.14 and
 # fails deep in the dependency tree on a numba source build — an error that
@@ -66,12 +66,6 @@ dependencies = [
     "websockets>=12.0",
     "apscheduler>=3.10.0",
     "ddgs>=9.0",            # keyless web_search fallback — tiny, kept in core so search works even on a slim/degraded install
-    # Quant core (used across indicators, risk, formatting)
-    "numpy>=1.26.0",
-    "pandas>=2.2.0",
-    "scipy>=1.13.0",
-    "pandas_ta>=0.4.67b0; python_version >= '3.12'",  # PyPI removed 0.3.x; 0.4.x is 3.12-only. Optional — code has graceful fallback (find_spec/try-except).
-    "yfinance>=0.2.55",
     # macOS native PDF engine for /report --pdf (WKWebView.createPDF; no browser
     # required). Non-darwin platforms use headless Chrome / weasyprint instead.
     "pyobjc-framework-WebKit>=10.0; sys_platform == 'darwin'",
@@ -81,19 +75,29 @@ dependencies = [
 
 [project.optional-dependencies]
 
+# Optional financial data and numerical tools; coding/chat do not require them.
+finance = [
+    "numpy>=1.26.0",
+    "pandas>=2.2.0",
+    "scipy>=1.13.0",
+    "pandas_ta>=0.4.67b0; python_version >= '3.12'",
+    "yfinance>=0.2.55",
+]
+
 # ── Data sources (heavy / region-specific) ────────────────────────────────────
-cn = ["akshare>=1.14.68"]          # China A-share / HK market data (large dep tree)
-crypto = ["ccxt>=4.4.0"]           # crypto exchanges (large dep tree)
+cn = ["akshare>=1.14.68", "pandas>=2.2.0"]          # China A-share / HK market data (large dep tree)
+crypto = ["ccxt>=4.4.0", "pandas>=2.2.0"]           # crypto exchanges (large dep tree)
 
 # ── Feature add-ons ────────────────────────────────────────────────────────────
-charts = ["mplfinance>=0.12.10b0"]    # candlestick charts in /report /chart
+charts = ["mplfinance>=0.12.10b0", "pandas>=2.2.0"]    # candlestick charts in /report /chart
 
 # Gemini / Vertex AI. Now a core dependency (see the top of `dependencies`);
 # the extra is kept so `pip install 'aria-code[google]'` in existing scripts
 # and docs keeps working.
 google = ["google-genai>=1.0.0"]
-data = ["duckdb>=0.10.3"]          # in-process SQL: /data sql "SELECT …"
+data = ["duckdb>=0.10.3", "pandas>=2.2.0"]          # in-process SQL: /data sql "SELECT …"
 files = [                          # /file load + /file analyze document parsing
+    "pandas>=2.2.0",                 # CSV/Excel analysis also needs dataframes
     "pdfplumber>=0.11.0",
     "pypdf>=4.3.0",
     "python-docx>=1.1.2",
@@ -128,7 +132,7 @@ brokers = [
 ]
 
 # ── Enhanced backtesting ───────────────────────────────────────────────────────
-backtest = ["vectorbt>=0.26.2"]
+backtest = ["vectorbt>=0.26.2", "yfinance>=0.2.55"]
 
 # ── Local, self-hosted image generation (no API key, no per-call cost) ─────────
 image_gen = [
@@ -141,14 +145,20 @@ image_gen = [
 # ── Web search / browser / desktop automation ──────────────────────────────────
 web = ["ddgs>=9.0"]                                # zero-config web_search fallback
 browser = ["playwright>=1.44.0"]                   # headless browser (/browser)
-desktop = ["mss>=9.0.1", "pyautogui>=0.9.54"]      # screen capture + GUI automation
-sports = ["understat>=0.1.0"]                       # football xG data
+desktop = ["mss>=9.0.1", "pyautogui>=0.9.54", "pillow>=10.0", "pyperclip>=1.9"]      # screen capture + GUI automation
+sports = ["understat>=0.1.0", "numpy>=1.26.0"]                       # football xG data
 
 # ── Language-server diagnostics (/lsp, lsp_autocheck) ──────────────────────────
 lsp = ["python-lsp-server[all]>=1.10.0"]
 
 # ── Developer tools ────────────────────────────────────────────────────────────
 dev = [
+    # Existing developer suites include finance/quant regression fixtures.
+    "numpy>=1.26.0",
+    "pandas>=2.2.0",
+    "scipy>=1.13.0",
+    "pandas_ta>=0.4.67b0; python_version >= '3.12'",
+    "yfinance>=0.2.55",
     "pytest>=8.2.0",
     "pytest-asyncio>=0.23.7",
     # test.yml's pytest job installs the suite through this extra and passes
@@ -165,10 +175,23 @@ dev = [
     "python-multipart>=0.0.9",
 ]
 
+# ── Project-review HTTP service (Dockerfile.review installs ".[service]") ─────
+# Kept in step with the fastapi/uvicorn/python-multipart pins in `dev` above.
+service = [
+    "fastapi>=0.110.0",
+    "uvicorn>=0.29.0",
+    "python-multipart>=0.0.9",
+]
+
 # ── Full feature set (what the bootstrap installers install by default) ────────
 # Everything a normal user wants — all data sources + files + charts + SQL —
 # but no brokers / dev / backtest extras.
 full = [
+    "numpy>=1.26.0",
+    "pandas>=2.2.0",
+    "scipy>=1.13.0",
+    "pandas_ta>=0.4.67b0; python_version >= '3.12'",
+    "yfinance>=0.2.55",
     "google-genai>=1.0.0",
     "akshare>=1.14.68",
     "ccxt>=4.4.0",
@@ -186,6 +209,11 @@ full = [
 
 # ── Everything (full + brokers + backtest + automation + dev) ─────────────────
 all = [
+    "numpy>=1.26.0",
+    "pandas>=2.2.0",
+    "scipy>=1.13.0",
+    "pandas_ta>=0.4.67b0; python_version >= '3.12'",
+    "yfinance>=0.2.55",
     "google-genai>=1.0.0",
     "akshare>=1.14.68",
     "ccxt>=4.4.0",
@@ -218,6 +246,7 @@ all = [
 aria-code = "aria_code.apps.cli.main:main"
 aria = "aria_code.apps.cli.main:main"
 aria-code-mcp = "aria_code.aria_mcp_server:main"
+aria-computer-use = "aria_code.computer_use_server:main"
 
 [project.urls]
 Homepage = "https://github.com/artheras/aria-code"
@@ -370,3 +399,4 @@ python_files = ["test_*.py"]
 filterwarnings = [
     "ignore:datetime\\.datetime\\.utcfromtimestamp\\(\\) is deprecated:DeprecationWarning:google\\.protobuf\\.internal\\.well_known_types",
 ]
+

{aria_code-0.165.0 → aria_code-0.166.0}/src/aria_code/_version.py

@@ -3,7 +3,7 @@
 __version__ used to live in aria_cli.py, which meant anything wanting the
 version string had to import the whole interactive CLI — prompt_toolkit,
 bootstrap hooks, the tool registry, all of it. The three consumers each worked
-around that differently: crash_report and a diagnostics accessor imported
+around that differently: a crash reporter (since removed) and a diagnostics accessor imported
 aria_cli anyway, and the MCP server went to importlib.metadata instead, with a
 comment explaining that pulling in aria_cli was too heavy for a binary whose
 job is speaking JSON-RPC over stdio.
@@ -17,4 +17,4 @@ from __future__ import annotations
 
 __all__ = ["__version__"]
 
-__version__ = "0.165.0"
+__version__ = "0.166.0"

{aria_code-0.165.0 → aria_code-0.166.0}/src/aria_code/apps/cli/commands/core_cmds.py

@@ -1662,6 +1662,24 @@ class CoreCommandsMixin:
         sub = args.strip().lower()
         reg = self.terminal._mcp_registry
 
+        if sub == "finance" or sub.startswith("finance "):
+            import shlex
+            from pathlib import Path
+            from aria_code.packages.aria_mcp.config import install_financial_service_config
+            try:
+                parts = shlex.split(args.strip(), posix=True)
+                if len(parts) != 3 or parts[:2] != ["finance", "install"]:
+                    self.context.console.print(
+                        'Install financial-service in its own environment, then run: '
+                        '/mcp finance install "/absolute/path/to/service-venv/bin/python"')
+                    return
+                target = install_financial_service_config(Path(MCP_CONFIG_PATH), Path(parts[2]))
+                self.context.console.print(
+                    f"Financial MCP configured at {target}. Networking is off. Run /mcp reload to connect.")
+            except (OSError, ValueError) as exc:
+                self.context.console.print(f"Financial MCP configuration was not changed: {exc}")
+            return
+
         _parts = sub.split()
         if _parts and _parts[0] in ("reload", "restart") and len(_parts) > 1:
             # Per-server reload: restart one subprocess + reset its circuit,

{aria_code-0.165.0 → aria_code-0.166.0}/src/aria_code/apps/cli/commands/ui_cmds.py

@@ -203,8 +203,7 @@ class UiCommandsMixin:
                 result = _tool_browser_screenshot({"url": url})
             if result.get("success"):
                 d = result["data"]
-                from computer_use_tools import pop_pending_vision_image
-                b64 = pop_pending_vision_image()
+                b64 = result.get("_vision_image")
                 if b64:
                     self.terminal._pending_image = {
                         "type": "image_url",
@@ -254,7 +253,7 @@ class UiCommandsMixin:
                 "Install: pip install mss pillow",
             )
             return
-        from computer_use_tools import _tool_computer_screenshot, pop_pending_vision_image
+        from computer_use_tools import _tool_computer_screenshot
 
         monitor = int(args.strip()) if args.strip().isdigit() else 1
         if self.context.has_rich:
@@ -265,7 +264,7 @@ class UiCommandsMixin:
 
         if result.get("success"):
             d = result["data"]
-            b64 = pop_pending_vision_image()
+            b64 = result.get("_vision_image")
             if b64:
                 self.terminal._pending_image = {
                     "type": "image_url",
@@ -399,3 +398,4 @@ class UiCommandsMixin:
             print(f"  Messages: {conv_len}  Tokens: ~{est_tokens:,}/{max_ctx:,} ({ctx_pct}%)")
             print(f"  Auto compact: {'on' if auto_compact else 'off'}  threshold={int(auto_compact_threshold * 100)}%  runs={auto_compact_count}")
             print(f"  Session: {self.terminal.session_id}")
+

{aria_code-0.165.0 → aria_code-0.166.0}/src/aria_code/apps/cli/providers/runtime_bridge.py

@@ -137,6 +137,7 @@ def build_acceptance_gate(executor, config: Optional[dict] = None, message: str
         max_attempts=int(cfg.get("acceptance_max_attempts", 2) or 2),
         commands=_declared_acceptance_commands(cfg, message),
         baseline=_build_baseline(executor, cfg, timeout),
+        revision_inputs=cfg.get("acceptance_revision_inputs") or (),
     )
 
 
@@ -582,3 +583,4 @@ async def run_subagent_turn(prompt: str, task: Any, *, local_tools, tool_schemas
             (not getattr(final, "success", False) or (getattr(final, "acceptance", None) or {}).get("verified") is False))):
         raise RuntimeError("The delegated runtime did not complete with accepted execution")
     return str(getattr(result, "text", "") or "")
+

{aria_code-0.165.0 → aria_code-0.166.0}/src/aria_code/aria_daemon.py

@@ -6,7 +6,9 @@ Responsibilities:
   1. Price alert watchdog  — checks SQLite alerts every 30 s
   2. APScheduler cron jobs — morning brief, market scan, custom schedules
   3. Telegram bot          — bidirectional command channel
-  4. Webhook job executor  — processes jobs queued by FastAPI /webhook/trigger
+  4. Webhook job executor  — runs pending jobs from the local webhook_jobs table
+     TradingView endpoint   — POST /api/v1/webhook/tradingview (alias
+                              /api/v1/tradingview/webhook) queues alerts
   5. APNs push delivery    — fires on alert trigger or scheduled job completion
 
 Start manually:   python3 aria_daemon.py [--debug]
@@ -21,9 +23,16 @@ Config via env vars (or ~/.aria/.env):
   APNS_BUNDLE_ID            — App bundle ID (default: com.arthera.app)
   APNS_SANDBOX              — "true" for sandbox / TestFlight (default: true)
   APNS_AUTH_KEY_P8          — .p8 key content, or place file at ~/.aria/apns.p8
-  WEBHOOK_TOKEN             — Static token for /api/v1/webhook/trigger
+  WEBHOOK_TOKEN             — Token for /api/v1/webhook/tradingview, sent in the
+                              X-Aria-Token, X-TradingView-Secret or
+                              Authorization: Bearer header (never the query
+                              string). TRADINGVIEW_WEBHOOK_SECRET takes precedence.
+  ARIA_WEBHOOK_SECRET       — Passphrase TradingView puts in the alert body
+                              (TradingView cannot send headers)
   ARIA_WEBHOOK_HOST         — Daemon webhook host (default: 127.0.0.1)
-  ARIA_WEBHOOK_PORT         — Daemon webhook port (default: 8765)
+  ARIA_WEBHOOK_PORT         — Daemon webhook port (default: 8765 — the same
+                              default as the relay server; set this when both
+                              run on one machine)
   (the FastAPI backend URL is the `api_url` config key, not an env var —
    set it with `/config set api_url=...`)
   ARIA_CODE_DIR             — Path to aria-code directory
@@ -31,6 +40,7 @@ Config via env vars (or ~/.aria/.env):
 from __future__ import annotations
 
 import asyncio
+import hmac
 import logging
 import os
 import signal
@@ -952,14 +962,16 @@ async def _webhook_http_server() -> None:
     def _authorized(request) -> bool:
         if not token:
             return True
+        # Headers only: a token in the query string ends up in proxy and
+        # access logs and in browser history. TradingView, which cannot set
+        # headers, authenticates with the body passphrase (ARIA_WEBHOOK_SECRET).
         supplied = (
             request.headers.get("X-Aria-Token")
             or request.headers.get("X-TradingView-Secret")
             or request.headers.get("Authorization", "").removeprefix("Bearer ").strip()
-            or request.query.get("token")
-            or request.query.get("secret")
+            or ""
         )
-        return supplied == token
+        return hmac.compare_digest(supplied.encode("utf-8"), token.encode("utf-8"))
 
     async def _handle_tradingview(request):
         # Open-mode guard (channels contract): with neither an endpoint token
@@ -967,19 +979,24 @@ async def _webhook_http_server() -> None:
         # an open endpoint reachable off-host would accept injected alerts.
         try:
             from apps.channels.intake import should_refuse_open_intake
-            secret_configured = bool(os.environ.get("ARIA_WEBHOOK_SECRET", "").strip())
-            if should_refuse_open_intake(
-                getattr(request, "remote", None),
-                token_configured=bool(token),
-                secret_configured=secret_configured,
-            ):
-                return web.json_response(
-                    {"success": False,
-                     "error": "open-mode intake refused for non-local client; set ARIA_WEBHOOK_SECRET or WEBHOOK_TOKEN"},
-                    status=403,
-                )
         except ImportError:
-            pass
+            # Without the guard we cannot tell whether this client may use an
+            # open endpoint, so it may not: fail closed rather than skip it.
+            logger.error("open-intake guard unavailable; refusing TradingView webhook")
+            return web.json_response(
+                {"success": False, "error": "webhook intake guard unavailable"}, status=503,
+            )
+        secret_configured = bool(os.environ.get("ARIA_WEBHOOK_SECRET", "").strip())
+        if should_refuse_open_intake(
+            getattr(request, "remote", None),
+            token_configured=bool(token),
+            secret_configured=secret_configured,
+        ):
+            return web.json_response(
+                {"success": False,
+                 "error": "open-mode intake refused for non-local client; set ARIA_WEBHOOK_SECRET or WEBHOOK_TOKEN"},
+                status=403,
+            )
         if not _authorized(request):
             return web.json_response({"success": False, "error": "unauthorized"}, status=401)
         text = await request.text()
@@ -1008,7 +1025,15 @@ async def _webhook_http_server() -> None:
     runner = web.AppRunner(app)
     await runner.setup()
     site = web.TCPSite(runner, host, port)
-    await site.start()
+    try:
+        await site.start()
+    except OSError as exc:
+        logger.error(
+            "TradingView webhook could not listen on %s:%d (%s). The relay server "
+            "also defaults to 8765; set ARIA_WEBHOOK_PORT to another port.", host, port, exc,
+        )
+        await runner.cleanup()
+        return
     logger.info("TradingView webhook listening on http://%s:%d/api/v1/webhook/tradingview", host, port)
     try:
         while True:

{aria_code-0.165.0 → aria_code-0.166.0}/src/aria_code/aria_feishu_bot.py

@@ -998,7 +998,7 @@ async def _analyze_file(file_bytes: bytes, filename: str) -> str:
 def verify_feishu_request(headers: Dict[str, str], body: bytes, payload: Dict[str, Any]) -> tuple[bool, str]:
     """(trusted, reason) for an event received directly from Feishu.
 
-    The same two checks the relay applies (aria_relay_server._verify_feishu_request),
+    The same two checks the relay applies (go/relay: relay.verify; formerly the Python relay's _verify_feishu_request),
     kept separate because the relay ships without this module's dependencies:
       - Encrypt Key: X-Lark-Signature = sha256(timestamp + nonce + key + body)
       - Verification Token: the token field in the event body

{aria_code-0.165.0 → aria_code-0.166.0}/src/aria_code/clients/market_data_client.py

@@ -36,8 +36,17 @@ from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Any, Dict, List, Optional
 
-import numpy as np
-import pandas as pd
+try:
+    import numpy as np
+    import pandas as pd
+except ModuleNotFoundError as exc:
+    if (exc.name or "").split(".")[0] in {"numpy", "pandas"}:
+        raise ModuleNotFoundError(
+            "Local market tools require the optional finance extra. "
+            "Install with: pip install 'aria-code[finance]<4'",
+            name=exc.name,
+        ) from None
+    raise
 import requests
 from aria_code.packages.aria_core.paths import aria_home