aria-code 4.1.3__tar.gz → 4.1.7__tar.gz

{aria_code-4.1.3 → aria_code-4.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aria-code
-Version: 4.1.3
+Version: 4.1.7
 Summary: AI-powered financial terminal — local LLM + multi-source market data
 License: BUSL-1.1
 Project-URL: Homepage, https://github.com/artherahq/aria-code
@@ -31,10 +31,11 @@ Requires-Dist: PyJWT>=2.8.0
 Requires-Dist: aiofiles>=23.2.0
 Requires-Dist: websockets>=12.0
 Requires-Dist: apscheduler>=3.10.0
+Requires-Dist: ddgs>=9.0
 Requires-Dist: numpy>=1.26.0
 Requires-Dist: pandas>=2.2.0
 Requires-Dist: scipy>=1.13.0
-Requires-Dist: pandas_ta>=0.3.14b
+Requires-Dist: pandas_ta>=0.4.67b0; python_version >= "3.12"
 Requires-Dist: yfinance>=0.2.55
 Provides-Extra: cn
 Requires-Dist: akshare>=1.14.68; extra == "cn"
@@ -51,6 +52,8 @@ Requires-Dist: python-docx>=1.1.2; extra == "files"
 Requires-Dist: openpyxl>=3.1.5; extra == "files"
 Requires-Dist: beautifulsoup4>=4.12.3; extra == "files"
 Requires-Dist: Pillow>=10.4.0; extra == "files"
+Provides-Extra: video
+Requires-Dist: opencv-python>=4.8.0; extra == "video"
 Provides-Extra: ibkr
 Requires-Dist: ib_insync>=0.9.86; extra == "ibkr"
 Provides-Extra: futu
@@ -114,6 +117,7 @@ Requires-Dist: ddgs>=9.0; extra == "all"
 Requires-Dist: playwright>=1.44.0; extra == "all"
 Requires-Dist: mss>=9.0.1; extra == "all"
 Requires-Dist: pyautogui>=0.9.54; extra == "all"
+Requires-Dist: opencv-python>=4.8.0; extra == "all"
 Requires-Dist: understat>=0.1.0; extra == "all"
 Requires-Dist: ib_insync>=0.9.86; extra == "all"
 Requires-Dist: futu-api>=9.1.5108; extra == "all"
@@ -139,6 +143,8 @@ Dynamic: license-file
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@artheras/aria-code"><img src="https://img.shields.io/npm/v/@artheras/aria-code?style=for-the-badge&logo=npm&color=cb3837&label=npm" alt="npm"/></a>
+  <a href="https://pypi.org/project/aria-code/"><img src="https://img.shields.io/pypi/v/aria-code?style=for-the-badge&logo=pypi&logoColor=white&label=PyPI&color=3775A9" alt="PyPI"/></a>
+  <a href="https://github.com/artherahq/aria-code/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/artherahq/aria-code/ci.yml?branch=main&style=for-the-badge&logo=githubactions&logoColor=white&label=CI" alt="CI"/></a>
   <img src="https://img.shields.io/badge/Python-3.10+-3776AB?style=for-the-badge&logo=python&logoColor=white" alt="python"/>
   <img src="https://img.shields.io/badge/Ollama-Local_LLM-black?style=for-the-badge&logo=llama&logoColor=white" alt="ollama"/>
   <img src="https://img.shields.io/badge/Providers-19+_Cloud-f59e0b?style=for-the-badge" alt="providers"/>
@@ -176,7 +182,7 @@ Aria Code is a **terminal-first AI financial agent** — think of it as Claude C
 ```
 $ aria-code
 
-  ▣ Aria Code  v4.0  local-first agent
+  ▣ Aria Code  v4.1  local-first agent
   model      qwen2.5-coder:7b  local
   workspace  ~/my-portfolio
   mode       workspace-write · network on · local-only
@@ -214,6 +220,8 @@ $ aria-code
 | **MCP tools** | 5 new quantitative MCP tools in the tool registry |
 | **83 commands** | Consolidated from ~150 — removed all LLM-replaceable commands; natural language handles the rest |
 | **LLM routing fix** | Model now knows it can call real-time data tools instead of saying "I don't have live data" |
+| **Unified agent loop** | CLI, SDK and self-host backend now run the *same* tested runtime (`runtime.run_turn`) — consistent provider routing, cloud→local fallback and tool execution on every surface |
+| **One-command install** | `pip install aria-code` (PyPI) or `npm install -g @artheras/aria-code` — verified clean on Python 3.10 / 3.11 / 3.12 |
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 
@@ -223,7 +231,7 @@ See [CHANGELOG.md](CHANGELOG.md) for the full history.
 |---------|-------------|
 | ⌨️ **Keyboard shortcuts** | `Shift+Tab` cycle modes · `Alt+T` thinking · `Alt+P` model picker · `Ctrl+O` transcript · `Ctrl+T` tasks |
 | `!` **Shell mode** | Type `! git status` to run shell commands, output auto-added to AI context |
-| `@` **File autocomplete** | Type `@src/` to get instant file path completion anywhere in input |
+| `@` **Typed context references** | Attach files, folders, assets, portfolios, strategies, datasets, runs, or reports without executing an action |
 | `/btw` **Side questions** | Ask quick questions without polluting conversation history |
 | 🌍 **Auto language** | UI and responses auto-detect Chinese/English from OS locale on first run |
 | 🤖 **19+ cloud providers** | Google Gemini · xAI Grok · Mistral · Cohere · Perplexity · Baidu ERNIE · ByteDance · MiniMax · StepFun · 01.AI + all originals |
@@ -295,7 +303,7 @@ mindmap
 | 🔍 **Quant research** | `/backtest` `/signal` `/kelly` `/factor` `/portfolio` `/screen` `/corr` `/ptbt` |
 | 🤖 **19+ cloud providers** | All major international + Chinese LLM APIs supported |
 | 🔌 **MCP protocol** | Connect any [Model Context Protocol](https://modelcontextprotocol.io) server |
-| ⌨️ **Rich keyboard UX** | Vim mode · `!` shell · `@` files · `Shift+Tab` modes · transcript viewer |
+| ⌨️ **Rich keyboard UX** | Vim mode · `!` shell · typed `@` context · `Shift+Tab` modes · transcript viewer |
 | 💬 **Feishu / Telegram** | Ask Aria from any chat app, anytime |
 | 📱 **iOS push alerts** | Real-time price alerts via APNs |
 | 🌍 **Auto bilingual** | OS language auto-detected on first run; output follows user's input language |
@@ -474,9 +482,26 @@ Aria Code has a full keyboard shortcut system powered by `prompt_toolkit`:
 |--------|------|---------|
 | `/` | Slash command with fuzzy autocomplete | `/backtest momentum SPY` |
 | `!` | Shell mode — runs command, adds output to context | `! git diff HEAD~1` |
-| `@` | File path autocomplete | `@src/components/` |
+| `@` | Read-only typed context reference | `@file:src/app.py` · `@asset:AAPL` |
 | `"""` | Multi-line input mode (end with `"""`) | For pasting code blocks |
 
+`/` and `@` are intentionally different: `/` selects an action; `@` selects
+context for that action or for a natural-language request. They can be combined:
+
+```text
+/risk @portfolio:core
+/backtest @strategy:momentum-v2 @asset:AAPL --period 3y
+Review @folder:apps/cli against @report:last-audit
+```
+
+Available reference types: `@file:`, `@folder:`, `@asset:`, `@portfolio:`,
+`@strategy:`, `@dataset:`, `@run:`, and `@report:`. A plain `@path` remains a
+file reference for compatibility; unknown references fail locally instead of
+being guessed by the model. References contain pointers only: Aria reads them
+on demand through audited tools such as `read_file`, `list_files`,
+`analyze_file`, and `get_market_data`; source content is never silently
+expanded into the prompt.
+
 ### Bottom Toolbar (always visible)
 
 ```
@@ -761,6 +786,54 @@ Analyze NVDA momentum      → Full AI analysis
 
 ---
 
+## 📡 TradingView Alerts
+
+Pipe TradingView alerts into Aria: the daemon receives the webhook, verifies
+it, and runs a tool-less AI analysis through the shared runtime gateway, then
+pushes the result to your notify channels (Telegram / Feishu).
+
+### Setup
+
+```env
+ARIA_WEBHOOK_SECRET=your-strong-passphrase   # REQUIRED for non-local use
+ARIA_WEBHOOK_HOST=127.0.0.1                  # bind address (default local-only)
+ARIA_WEBHOOK_PORT=8765
+ARIA_DAEMON_MODEL=qwen2.5:7b                 # model for alert analysis
+```
+
+```bash
+python3 aria_daemon.py start
+# endpoint: POST http://127.0.0.1:8765/api/v1/webhook/tradingview
+```
+
+### TradingView alert message (Webhook URL → your public endpoint)
+
+```json
+{
+  "symbol": "{{ticker}}",
+  "action": "{{strategy.order.action}}",
+  "price": "{{close}}",
+  "message": "MA cross on {{interval}}",
+  "passphrase": "your-strong-passphrase"
+}
+```
+
+### Security model
+
+- **Passphrase (fail-closed):** with `ARIA_WEBHOOK_SECRET` set, alerts without
+  a matching `passphrase` are rejected (constant-time compare). TradingView
+  cannot send custom headers, so the body passphrase is the documented way.
+- **Open-mode guard:** with *no* secret and *no* `WEBHOOK_TOKEN` configured,
+  only loopback clients may submit — a non-local request gets `403` with a
+  fix-it message instead of silently accepting injected buy/sell alerts.
+- **HMAC option:** a fronting relay that can sign requests may send
+  `sha256=<hex>` of the raw body; HMAC verification never runs in open mode.
+- **Analysis, not trading:** the alert turn runs with an empty tool set and a
+  prompt that forbids order placement. Order *previews* (when a broker is
+  configured) still require explicit confirmation via the preview flow.
+
+---
+
 ## 🏗️ Architecture
 
 ```
@@ -791,7 +864,7 @@ Analyze NVDA momentum      → Full AI analysis
 
 ```
 aria-code/
-├── aria_cli.py               # Main CLI + REPL (keyboard shortcuts, ! shell, @files)
+├── aria_cli.py               # Main CLI + REPL (keyboard shortcuts, ! shell, @ context)
 ├── aria_daemon.py            # Background daemon + scheduler
 ├── market_data_client.py     # Unified market data (Finnhub primary for US)
 ├── setup_wizard.py           # Bilingual setup wizard (19 providers)
@@ -807,7 +880,7 @@ aria-code/
 │
 ├── ui/
 │   ├── banner.py             # Bilingual banner (i18n aware)
-│   └── completer.py          # Fuzzy autocomplete: / commands · @ files · ! history
+│   └── completer.py          # Fuzzy autocomplete: / commands · @ context · ! history
 │
 ├── providers/llm/            # LLM adapters (19+ cloud endpoints)
 ├── agents/financial/         # Fundamental / Technical / Macro / Risk / Synthesis

{aria_code-4.1.3 → aria_code-4.1.7}/README.md

@@ -12,6 +12,8 @@
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@artheras/aria-code"><img src="https://img.shields.io/npm/v/@artheras/aria-code?style=for-the-badge&logo=npm&color=cb3837&label=npm" alt="npm"/></a>
+  <a href="https://pypi.org/project/aria-code/"><img src="https://img.shields.io/pypi/v/aria-code?style=for-the-badge&logo=pypi&logoColor=white&label=PyPI&color=3775A9" alt="PyPI"/></a>
+  <a href="https://github.com/artherahq/aria-code/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/artherahq/aria-code/ci.yml?branch=main&style=for-the-badge&logo=githubactions&logoColor=white&label=CI" alt="CI"/></a>
   <img src="https://img.shields.io/badge/Python-3.10+-3776AB?style=for-the-badge&logo=python&logoColor=white" alt="python"/>
   <img src="https://img.shields.io/badge/Ollama-Local_LLM-black?style=for-the-badge&logo=llama&logoColor=white" alt="ollama"/>
   <img src="https://img.shields.io/badge/Providers-19+_Cloud-f59e0b?style=for-the-badge" alt="providers"/>
@@ -49,7 +51,7 @@ Aria Code is a **terminal-first AI financial agent** — think of it as Claude C
 ```
 $ aria-code
 
-  ▣ Aria Code  v4.0  local-first agent
+  ▣ Aria Code  v4.1  local-first agent
   model      qwen2.5-coder:7b  local
   workspace  ~/my-portfolio
   mode       workspace-write · network on · local-only
@@ -87,6 +89,8 @@ $ aria-code
 | **MCP tools** | 5 new quantitative MCP tools in the tool registry |
 | **83 commands** | Consolidated from ~150 — removed all LLM-replaceable commands; natural language handles the rest |
 | **LLM routing fix** | Model now knows it can call real-time data tools instead of saying "I don't have live data" |
+| **Unified agent loop** | CLI, SDK and self-host backend now run the *same* tested runtime (`runtime.run_turn`) — consistent provider routing, cloud→local fallback and tool execution on every surface |
+| **One-command install** | `pip install aria-code` (PyPI) or `npm install -g @artheras/aria-code` — verified clean on Python 3.10 / 3.11 / 3.12 |
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 
@@ -96,7 +100,7 @@ See [CHANGELOG.md](CHANGELOG.md) for the full history.
 |---------|-------------|
 | ⌨️ **Keyboard shortcuts** | `Shift+Tab` cycle modes · `Alt+T` thinking · `Alt+P` model picker · `Ctrl+O` transcript · `Ctrl+T` tasks |
 | `!` **Shell mode** | Type `! git status` to run shell commands, output auto-added to AI context |
-| `@` **File autocomplete** | Type `@src/` to get instant file path completion anywhere in input |
+| `@` **Typed context references** | Attach files, folders, assets, portfolios, strategies, datasets, runs, or reports without executing an action |
 | `/btw` **Side questions** | Ask quick questions without polluting conversation history |
 | 🌍 **Auto language** | UI and responses auto-detect Chinese/English from OS locale on first run |
 | 🤖 **19+ cloud providers** | Google Gemini · xAI Grok · Mistral · Cohere · Perplexity · Baidu ERNIE · ByteDance · MiniMax · StepFun · 01.AI + all originals |
@@ -168,7 +172,7 @@ mindmap
 | 🔍 **Quant research** | `/backtest` `/signal` `/kelly` `/factor` `/portfolio` `/screen` `/corr` `/ptbt` |
 | 🤖 **19+ cloud providers** | All major international + Chinese LLM APIs supported |
 | 🔌 **MCP protocol** | Connect any [Model Context Protocol](https://modelcontextprotocol.io) server |
-| ⌨️ **Rich keyboard UX** | Vim mode · `!` shell · `@` files · `Shift+Tab` modes · transcript viewer |
+| ⌨️ **Rich keyboard UX** | Vim mode · `!` shell · typed `@` context · `Shift+Tab` modes · transcript viewer |
 | 💬 **Feishu / Telegram** | Ask Aria from any chat app, anytime |
 | 📱 **iOS push alerts** | Real-time price alerts via APNs |
 | 🌍 **Auto bilingual** | OS language auto-detected on first run; output follows user's input language |
@@ -347,9 +351,26 @@ Aria Code has a full keyboard shortcut system powered by `prompt_toolkit`:
 |--------|------|---------|
 | `/` | Slash command with fuzzy autocomplete | `/backtest momentum SPY` |
 | `!` | Shell mode — runs command, adds output to context | `! git diff HEAD~1` |
-| `@` | File path autocomplete | `@src/components/` |
+| `@` | Read-only typed context reference | `@file:src/app.py` · `@asset:AAPL` |
 | `"""` | Multi-line input mode (end with `"""`) | For pasting code blocks |
 
+`/` and `@` are intentionally different: `/` selects an action; `@` selects
+context for that action or for a natural-language request. They can be combined:
+
+```text
+/risk @portfolio:core
+/backtest @strategy:momentum-v2 @asset:AAPL --period 3y
+Review @folder:apps/cli against @report:last-audit
+```
+
+Available reference types: `@file:`, `@folder:`, `@asset:`, `@portfolio:`,
+`@strategy:`, `@dataset:`, `@run:`, and `@report:`. A plain `@path` remains a
+file reference for compatibility; unknown references fail locally instead of
+being guessed by the model. References contain pointers only: Aria reads them
+on demand through audited tools such as `read_file`, `list_files`,
+`analyze_file`, and `get_market_data`; source content is never silently
+expanded into the prompt.
+
 ### Bottom Toolbar (always visible)
 
 ```
@@ -634,6 +655,54 @@ Analyze NVDA momentum      → Full AI analysis
 
 ---
 
+## 📡 TradingView Alerts
+
+Pipe TradingView alerts into Aria: the daemon receives the webhook, verifies
+it, and runs a tool-less AI analysis through the shared runtime gateway, then
+pushes the result to your notify channels (Telegram / Feishu).
+
+### Setup
+
+```env
+ARIA_WEBHOOK_SECRET=your-strong-passphrase   # REQUIRED for non-local use
+ARIA_WEBHOOK_HOST=127.0.0.1                  # bind address (default local-only)
+ARIA_WEBHOOK_PORT=8765
+ARIA_DAEMON_MODEL=qwen2.5:7b                 # model for alert analysis
+```
+
+```bash
+python3 aria_daemon.py start
+# endpoint: POST http://127.0.0.1:8765/api/v1/webhook/tradingview
+```
+
+### TradingView alert message (Webhook URL → your public endpoint)
+
+```json
+{
+  "symbol": "{{ticker}}",
+  "action": "{{strategy.order.action}}",
+  "price": "{{close}}",
+  "message": "MA cross on {{interval}}",
+  "passphrase": "your-strong-passphrase"
+}
+```
+
+### Security model
+
+- **Passphrase (fail-closed):** with `ARIA_WEBHOOK_SECRET` set, alerts without
+  a matching `passphrase` are rejected (constant-time compare). TradingView
+  cannot send custom headers, so the body passphrase is the documented way.
+- **Open-mode guard:** with *no* secret and *no* `WEBHOOK_TOKEN` configured,
+  only loopback clients may submit — a non-local request gets `403` with a
+  fix-it message instead of silently accepting injected buy/sell alerts.
+- **HMAC option:** a fronting relay that can sign requests may send
+  `sha256=<hex>` of the raw body; HMAC verification never runs in open mode.
+- **Analysis, not trading:** the alert turn runs with an empty tool set and a
+  prompt that forbids order placement. Order *previews* (when a broker is
+  configured) still require explicit confirmation via the preview flow.
+
+---
+
 ## 🏗️ Architecture
 
 ```
@@ -664,7 +733,7 @@ Analyze NVDA momentum      → Full AI analysis
 
 ```
 aria-code/
-├── aria_cli.py               # Main CLI + REPL (keyboard shortcuts, ! shell, @files)
+├── aria_cli.py               # Main CLI + REPL (keyboard shortcuts, ! shell, @ context)
 ├── aria_daemon.py            # Background daemon + scheduler
 ├── market_data_client.py     # Unified market data (Finnhub primary for US)
 ├── setup_wizard.py           # Bilingual setup wizard (19 providers)
@@ -680,7 +749,7 @@ aria-code/
 │
 ├── ui/
 │   ├── banner.py             # Bilingual banner (i18n aware)
-│   └── completer.py          # Fuzzy autocomplete: / commands · @ files · ! history
+│   └── completer.py          # Fuzzy autocomplete: / commands · @ context · ! history
 │
 ├── providers/llm/            # LLM adapters (19+ cloud endpoints)
 ├── agents/financial/         # Fundamental / Technical / Macro / Risk / Synthesis

aria_code-4.1.7/apps/channels/__init__.py

@@ -0,0 +1,17 @@
+"""Aria channels — external entrypoints as structured-task producers."""
+
+from .registry import (
+    CHANNEL_TASK_SCHEMA,
+    ChannelSpec,
+    channel_map,
+    default_channels,
+    enabled_channels,
+)
+
+__all__ = [
+    "CHANNEL_TASK_SCHEMA",
+    "ChannelSpec",
+    "channel_map",
+    "default_channels",
+    "enabled_channels",
+]

aria_code-4.1.7/apps/channels/intake.py

@@ -0,0 +1,92 @@
+"""Channel intake policy + gateway submission (the daemon-facing half).
+
+Completes the channels contract loop: the daemon's webhook endpoint hands
+verified channel tasks to ``runtime.run_turn`` instead of poking CLI
+internals, and refuses unauthenticated ("open mode") intake from anywhere
+but localhost.
+
+Two pieces, both dependency-light so the daemon can import them without
+dragging in aria_cli:
+
+  • should_refuse_open_intake() — pure policy: when neither an intake token
+    nor ARIA_WEBHOOK_SECRET is configured, only loopback clients may submit.
+  • analyze_alert_via_gateway() — submits a task prompt through the shared
+    runtime gateway with an EMPTY tool set: channel-triggered turns get
+    model analysis but can never execute tools from the daemon context.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Callable, Dict, Optional
+
+_LOOPBACK_HOSTS = {"127.0.0.1", "::1", "localhost"}
+
+
+def should_refuse_open_intake(
+    client_host: Optional[str],
+    *,
+    token_configured: bool,
+    secret_configured: bool,
+) -> bool:
+    """True when an unauthenticated intake must be rejected.
+
+    With any credential configured (endpoint token or webhook passphrase),
+    authentication handles trust and remote clients are fine. With neither
+    configured the endpoint is running "open", which is only acceptable from
+    the loopback interface — an open endpoint reachable off-host would let
+    anyone on the network inject buy/sell alerts.
+    """
+    if token_configured or secret_configured:
+        return False
+    host = str(client_host or "").strip().lower()
+    if host.startswith("[") and host.endswith("]"):  # bracketed IPv6
+        host = host[1:-1]
+    return host not in _LOOPBACK_HOSTS
+
+
+async def analyze_alert_via_gateway(
+    prompt: str,
+    config: Dict[str, Any],
+    *,
+    run_turn_fn: Optional[Callable] = None,
+    max_rounds: int = 4,
+) -> str:
+    """Run one tool-less analysis turn for a channel task; returns the text.
+
+    ``run_turn_fn`` is injectable for tests; the default builds the same
+    provider selection the CLI uses (chat_routing via runtime_bridge) and
+    drives ``runtime.gateway.run_turn``. Raises on failure — the caller
+    decides its own fallback (the daemon keeps its legacy quick summary).
+    """
+    if run_turn_fn is None:
+        # stream_ollama borrows 47 bare names from aria_cli's module globals
+        # (verified by AST audit) and only works after aria_cli's import-time
+        # rebinding. Until that module is untangled, any out-of-CLI consumer
+        # of the default Ollama path must import aria_cli first — a one-time
+        # ~1s cost the long-lived daemon amortizes.
+        import aria_cli  # noqa: F401  (side effect: binds stream_ollama globals)
+        from apps.cli.providers.runtime_bridge import build_tool_executor, make_provider_fn
+        from runtime.gateway import run_turn as run_turn_fn_impl
+
+        provider_fn = make_provider_fn(
+            model=str(config.get("model", "qwen2.5:7b")),
+            config=config,
+            api_url=config.get("api_url"),
+            ollama_url=str(config.get("ollama_url", "http://localhost:11434")),
+            tool_schemas=[],
+        )
+        executor = build_tool_executor({}, config)
+
+        async def run_turn_fn(prompt_, history_, **kw):
+            return await run_turn_fn_impl(
+                prompt_, history_,
+                provider_fn=provider_fn, tool_executor=executor,
+                tool_schemas=[], max_rounds=max_rounds,
+            )
+
+    result = await run_turn_fn(prompt, [])
+    text = (getattr(result, "text", "") or "").strip()
+    error = getattr(result, "error", None)
+    if error or not text:
+        raise RuntimeError(f"gateway turn failed: {error or 'empty response'}")
+    return text

aria_code-4.1.7/apps/channels/registry.py

@@ -0,0 +1,95 @@
+"""Channel registry — the declared inventory of external entrypoints.
+
+First slice of the channels layer (contract: "Channels submit structured
+tasks to gateway/runtime and never call CLI internals directly"). The
+registry is pure data + config resolution: it names each channel, its
+direction, the config/env that enables it, and which capability it maps to,
+so the daemon and doctor can reason about channels uniformly instead of each
+integration hard-coding its own discovery.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any, Dict, List, Mapping, Tuple
+
+CHANNEL_TASK_SCHEMA = "aria.channel_task.v1"
+
+
+@dataclass(frozen=True)
+class ChannelSpec:
+    name: str
+    direction: str              # "inbound" | "outbound" | "both"
+    description: str
+    capabilities: Tuple[str, ...] = ()
+    # Any of these config keys (or env vars) being truthy enables the channel.
+    config_keys: Tuple[str, ...] = ()
+    env_keys: Tuple[str, ...] = ()
+
+    def enabled(self, config: Mapping[str, Any], env: Mapping[str, str]) -> bool:
+        for key in self.config_keys:
+            if config.get(key):
+                return True
+        for key in self.env_keys:
+            if str(env.get(key, "") or "").strip():
+                return True
+        return False
+
+
+def default_channels() -> List[ChannelSpec]:
+    return [
+        ChannelSpec(
+            name="tradingview",
+            direction="inbound",
+            description="TradingView alert webhooks → structured alert tasks",
+            capabilities=("alerts.ingest", "orders.preview"),
+            config_keys=("tradingview_webhook",),
+            env_keys=("ARIA_WEBHOOK_SECRET",),
+        ),
+        ChannelSpec(
+            name="webhook_jobs",
+            direction="inbound",
+            description="Generic daemon webhook job queue (/webhook/trigger)",
+            capabilities=("tasks.enqueue",),
+            env_keys=("WEBHOOK_TOKEN",),
+        ),
+        ChannelSpec(
+            name="telegram",
+            direction="both",
+            description="Telegram bot push + command intake via the daemon",
+            capabilities=("notify.push", "chat.intake"),
+            config_keys=("telegram_bot_token",),
+            env_keys=("TELEGRAM_BOT_TOKEN",),
+        ),
+        ChannelSpec(
+            name="feishu",
+            direction="outbound",
+            description="Feishu webhook card push",
+            capabilities=("notify.push",),
+            config_keys=("feishu_webhook",),
+            env_keys=("FEISHU_WEBHOOK_URL",),
+        ),
+        ChannelSpec(
+            name="macos_notify",
+            direction="outbound",
+            description="Local macOS notification center",
+            capabilities=("notify.push",),
+            config_keys=("macos_notifications",),
+        ),
+        ChannelSpec(
+            name="email",
+            direction="outbound",
+            description="SMTP email push",
+            capabilities=("notify.push",),
+            config_keys=("email_smtp_host",),
+            env_keys=("ARIA_SMTP_HOST",),
+        ),
+    ]
+
+
+def channel_map() -> Dict[str, ChannelSpec]:
+    return {spec.name: spec for spec in default_channels()}
+
+
+def enabled_channels(config: Mapping[str, Any], env: Mapping[str, str]) -> List[ChannelSpec]:
+    return [spec for spec in default_channels() if spec.enabled(config, env)]

aria_code-4.1.7/apps/channels/tradingview.py

@@ -0,0 +1,94 @@
+"""TradingView alert → structured channel task (aria.channel_task.v1).
+
+The channels contract requires external entrypoints to submit *structured
+tasks* to the gateway instead of poking CLI internals. This adapter turns a
+raw TradingView webhook payload into that task shape, reusing the hardened
+primitives that already live in apps/cli/tradingview_bridge.py (field-tolerant
+parsing, passphrase + HMAC verification, dedup keys).
+
+Verification posture mirrors the bridge's documented semantics: with
+ARIA_WEBHOOK_SECRET unset verification is open (localhost-only assumption),
+but the task carries explicit ``verified`` / ``open_mode`` flags so a
+downstream gate (daemon, SafetyService) can refuse open-mode tasks in
+non-local deployments.
+"""
+
+from __future__ import annotations
+
+import time
+from typing import Any, Callable, Dict, Optional
+
+from apps.cli.tradingview_bridge import (
+    _alert_dedup_key as alert_dedup_key,
+    _expected_webhook_secret,
+    parse_tradingview_alert,
+    verify_webhook_hmac,
+    verify_webhook_secret,
+)
+from apps.channels.registry import CHANNEL_TASK_SCHEMA
+
+
+def alert_to_task(
+    payload: Dict[str, Any] | str,
+    *,
+    raw_body: Optional[bytes | str] = None,
+    signature: Optional[str] = None,
+    clock: Callable[[], float] = time.time,
+) -> Dict[str, Any]:
+    """Normalize + authenticate one webhook delivery.
+
+    Returns ``{"success": True, "task": {...}}`` or
+    ``{"success": False, "error": ...}`` (tool-result convention).
+    """
+    alert = parse_tradingview_alert(payload)
+    raw = alert.get("raw") or {}
+
+    secret_configured = bool(_expected_webhook_secret())
+    if signature is not None:
+        # A fronting signer supplied an HMAC — it must verify (never open).
+        if not verify_webhook_hmac(raw_body if raw_body is not None else "", signature):
+            return {"success": False, "error": "tradingview alert rejected: HMAC signature mismatch"}
+        verified = True
+    else:
+        if not verify_webhook_secret(raw):
+            return {"success": False, "error": "tradingview alert rejected: passphrase missing or wrong"}
+        verified = secret_configured  # open mode when no secret is configured
+
+    if not alert.get("symbol"):
+        return {"success": False, "error": "tradingview alert rejected: no symbol in payload"}
+
+    task = {
+        "schema": CHANNEL_TASK_SCHEMA,
+        "channel": "tradingview",
+        "kind": "alert",
+        "received_at": clock(),
+        "verified": verified,
+        "open_mode": not secret_configured and signature is None,
+        "dedup_key": alert_dedup_key(alert),
+        "symbol": alert["symbol"],
+        "action": alert["action"],
+        "price": alert.get("price"),
+        "time": alert.get("time"),
+        "message": alert.get("message") or "",
+        "prompt": task_prompt(alert),
+    }
+    return {"success": True, "task": task}
+
+
+def task_prompt(alert: Dict[str, Any]) -> str:
+    """Render the gateway-facing natural-language task for this alert.
+
+    The daemon submits this prompt to runtime's ``run_turn`` — the agent then
+    analyses the alert with its normal tools; nothing here places orders.
+    """
+    symbol = alert.get("symbol", "")
+    action = alert.get("action", "ALERT")
+    price = alert.get("price")
+    at = f" at {price}" if price not in (None, "") else ""
+    msg = str(alert.get("message") or "").strip()
+    tail = f' Alert message: "{msg}".' if msg else ""
+    return (
+        f"TradingView alert received: {action} signal for {symbol}{at}.{tail} "
+        f"Assess the signal against current market data and the portfolio, and "
+        f"summarize whether it warrants action. Do not place any orders."
+    )

{aria_code-4.1.3 → aria_code-4.1.7}/apps/cli/bootstrap.py

@@ -70,6 +70,8 @@ def default_config() -> dict:
         ),
         "local_url": "http://localhost:8000",
         "ollama_url": os.getenv("OLLAMA_URL", "http://localhost:11434"),
+        "local_provider": os.getenv("ARIA_LLM_PROVIDER", "ollama"),
+        "provider_fallback": "configured",
         "model": "qwen2.5-coder:1.5b",
         "thinking_mode": "auto",
         "watchlist": ["AAPL", "MSFT", "GOOGL", "TSLA", "NVDA"],