stock-analysis-plugin 0.2.2__tar.gz → 0.2.5__tar.gz

{stock_analysis_plugin-0.2.2 → stock_analysis_plugin-0.2.5}/.github/workflows/autofix.yml

@@ -18,7 +18,8 @@ jobs:
           cache: pip
 
       - name: Install ruff
-        run: pip install "ruff>=0.4.0"
+        # Pinned — must match ci.yml and requirements-dev.txt.
+        run: pip install "ruff==0.15.20"
 
       - name: Ruff auto-fix (lint)
         run: ruff check --fix tools/ skills/ tests/ hermes/

{stock_analysis_plugin-0.2.2 → stock_analysis_plugin-0.2.5}/.github/workflows/ci.yml

@@ -7,9 +7,15 @@ on:
     branches: [main]
   workflow_call:
 
+# One active run per branch/PR — new pushes cancel stale runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
 
@@ -18,7 +24,8 @@ jobs:
           python-version: "3.11"
 
       - name: Install Python lint tools
-        run: pip install ruff>=0.4.0
+        # Pinned — must match requirements-dev.txt and autofix.yml.
+        run: pip install ruff==0.15.20
 
       - name: Ruff check
         run: ruff check tools/ skills/ tests/ hermes/
@@ -29,21 +36,30 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
+          cache: "npm"
 
+      # --ignore-scripts: tsc doesn't need the postinstall-built Python venv.
       - name: Install Node dependencies
-        run: npm install
+        run: npm ci --ignore-scripts
 
       - name: TypeScript type check
         run: npx tsc --noEmit
 
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        # 3.10 leg guards the declared floor — verified: full dep set installs
+        # and the suite passes on cpython 3.10.19.
+        python-version: ["3.11", "3.10"]
     steps:
       - uses: actions/checkout@v4
 
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: ${{ matrix.python-version }}
           cache: pip
 
       - name: Install dependencies
@@ -57,7 +73,11 @@ jobs:
   network:
     # Real provider calls (akshare/yfinance) — flaky upstreams by nature, so
     # gated to same-repo PRs and pushes (forks skip it, like e2e-llm).
+    # continue-on-error: see publish.yml — a flaky upstream must not block the
+    # release path; failures still surface as annotations on the run.
+    continue-on-error: true
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
     steps:
       - uses: actions/checkout@v4
@@ -82,6 +102,7 @@ jobs:
     # structurally cannot see. Deterministic by design: no LLM, no secrets, and
     # the 4 round-trip tools are the non-network set (see tests/e2e/*.ts).
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -96,16 +117,20 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
+          cache: "npm"
+
+      - name: Python setup failure check
+        run: node tests/test_setup_python.mjs
 
       # tests/conftest.py imports numpy/pandas at module load, so any pytest run
-      # needs the tools' runtime deps in system python. npm install's postinstall
+      # needs the tools' runtime deps in system python. npm ci's postinstall
       # separately builds .venv (full requirements) — that's the python the
       # host↔python round-trips spawn.
       - name: Install dependencies
         run: |
           pip install -r tools/requirements.txt
           pip install -r requirements-dev.txt
-          npm install
+          npm ci
 
       - name: TypeScript type check
         run: npx tsc --noEmit
@@ -119,6 +144,9 @@ jobs:
       - name: dsh plugin registration
         run: npx tsx tests/test_dsh_integration.ts
 
+      - name: dsh current SDK compatibility
+        run: npx tsx tests/test_dsh_sdk_compat.ts
+
       - name: Hermes plugin registration
         run: pytest tests/test_hermes_integration.py -v
 
@@ -135,9 +163,13 @@ jobs:
         run: npx tsx tests/e2e/test_dsh_e2e.ts
 
   e2e-llm:
-    # Real DeepSeek call. Only runs when DEEPSEEK_API_KEY secret is present
+    # Real OpenAI-compatible call. API key is a secret; URL/model can also be variables.
     # (skipped on forks to prevent secret exposure).
+    # continue-on-error: like `network` — non-deterministic output must not
+    # block the release path (see publish.yml).
+    continue-on-error: true
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
     steps:
       - uses: actions/checkout@v4
@@ -150,33 +182,43 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
+          cache: "npm"
+
+      - name: Resolve model endpoint on runner
+        env:
+          OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL || vars.OPENAI_BASE_URL }}
+        run: node scripts/ci-resolve-llm-host.mjs
 
       - name: Install Python dependencies
         run: |
           pip install -r tools/requirements.txt
           pip install -r requirements-dev.txt
 
+      # Full npm ci (postinstall builds .venv) — the Pi LLM flow spawns tools
+      # through it.
       - name: Install Node dependencies
-        run: npm install
+        run: npm ci
 
       - name: E2E — Hermes LLM flow
         env:
-          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
-          DEEPSEEK_MODEL: ${{ vars.DEEPSEEK_MODEL || 'deepseek-v4-flash' }}
+          OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL || vars.OPENAI_BASE_URL }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          OPENAI_MODEL: ${{ secrets.OPENAI_MODEL || vars.OPENAI_MODEL }}
         run: |
-          if [ -z "$DEEPSEEK_API_KEY" ]; then
-            echo "DEEPSEEK_API_KEY not configured — skipping LLM e2e"
+          if [ -z "$OPENAI_BASE_URL" ] || [ -z "$OPENAI_API_KEY" ] || [ -z "$OPENAI_MODEL" ]; then
+            echo "OPENAI_BASE_URL, OPENAI_API_KEY, and OPENAI_MODEL are required — skipping LLM e2e"
             exit 0
           fi
           pytest tests/e2e/test_hermes_llm.py -m integration_llm -v
 
       - name: E2E — Pi LLM flow
         env:
-          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
-          DEEPSEEK_MODEL: ${{ vars.DEEPSEEK_MODEL || 'deepseek-v4-flash' }}
+          OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL || vars.OPENAI_BASE_URL }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          OPENAI_MODEL: ${{ secrets.OPENAI_MODEL || vars.OPENAI_MODEL }}
         run: |
-          if [ -z "$DEEPSEEK_API_KEY" ]; then
-            echo "DEEPSEEK_API_KEY not configured — skipping LLM e2e"
+          if [ -z "$OPENAI_BASE_URL" ] || [ -z "$OPENAI_API_KEY" ] || [ -z "$OPENAI_MODEL" ]; then
+            echo "OPENAI_BASE_URL, OPENAI_API_KEY, and OPENAI_MODEL are required — skipping LLM e2e"
             exit 0
           fi
           npx tsx tests/e2e/test_pi_llm.ts
@@ -201,39 +243,42 @@ jobs:
           python-version: "3.11"
 
       - uses: actions/setup-node@v4
-        # Node 24: openclaw requires >= 22.19, and pi 0.83's undici breaks on 20.x
-        # (dsh also requires ^22.19 || >=24)
+        # OpenClaw 2026.9.6 requires Node >=24.16.
         with:
-          node-version: "24"
+          node-version: "24.16.0"
+          cache: "npm"
+
+      - name: Resolve model endpoint on runner
+        env:
+          OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL || vars.OPENAI_BASE_URL }}
+        run: node scripts/ci-resolve-llm-host.mjs
 
       - name: Install Node dependencies (also builds repo .venv via postinstall)
-        run: npm install
+        run: npm ci
 
       - name: Install host CLIs
-        # Pinned: pi latest and openclaw latest (slim repack) drifted from the
-        # validated CLIs — openclaw@latest installed no working bin, and pi's
-        # `list` flags changed between releases. dsh is a developer preview
-        # (rc line), so pin it too. `dsh plugin` forwards to pnpm.
+        # Pin the current host releases so failures are reproducible.
         run: |
-          npm i -g @earendil-works/pi-coding-agent@0.83.0
-          npm i -g openclaw@2026.6.33
-          npm i -g @deepseek-ai/dsh@0.1.0-rc.7
+          npm i -g @earendil-works/pi-coding-agent@0.99.0
+          npm i -g openclaw@2026.9.6
+          npm i -g @deepseek-ai/dsh@0.2.0-rc.2
           npm i -g pnpm@10
 
       - name: Real-host smoke QA (${{ matrix.host }})
         env:
-          SMOKE_LLM_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
-          SMOKE_LLM_BASE_URL: https://api.deepseek.com
-          SMOKE_LLM_MODEL: ${{ vars.DEEPSEEK_MODEL || 'deepseek-v4-flash' }}
+          OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL || vars.OPENAI_BASE_URL }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          OPENAI_MODEL: ${{ secrets.OPENAI_MODEL || vars.OPENAI_MODEL }}
         run: |
-          if [ -z "$SMOKE_LLM_API_KEY" ]; then
-            echo "SMOKE_LLM_API_KEY not configured — failing (this check is blocking by design)"
+          if [ -z "$OPENAI_BASE_URL" ] || [ -z "$OPENAI_API_KEY" ] || [ -z "$OPENAI_MODEL" ]; then
+            echo "OPENAI_BASE_URL, OPENAI_API_KEY, and OPENAI_MODEL are required (blocking check)"
             exit 1
           fi
           node tests/e2e/host_smoke.mjs ${{ matrix.host }}
 
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: [lint, test, compat]
     steps:
       - uses: actions/checkout@v4
@@ -241,9 +286,19 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
+          cache: "npm"
 
+      # --ignore-scripts: packing/bundling doesn't need the Python venv
+      # (esbuild's binary arrives via optionalDependencies, not postinstall).
       - name: Install Node dependencies
-        run: npm install
+        run: npm ci --ignore-scripts
+
+      # Bundle both compiled hosts here so esbuild breakage surfaces in CI
+      # instead of at tag-publish time.
+      - name: Build host bundles
+        run: |
+          npm run build:openclaw
+          npm run build:dsh
 
       - name: Verify pack contents
         run: npm pack --dry-run

{stock_analysis_plugin-0.2.2 → stock_analysis_plugin-0.2.5}/.github/workflows/publish.yml

@@ -6,6 +6,9 @@ on:
       - "v*"
 
 jobs:
+  # ci is a whole-workflow reusable call — a caller cannot `needs` individual
+  # jobs inside it, so the flaky jobs (network, e2e-llm) carry job-level
+  # `continue-on-error: true` in ci.yml to keep them off the release path.
   ci:
     uses: ./.github/workflows/ci.yml
     secrets: inherit
@@ -29,8 +32,9 @@ jobs:
       - name: Sync version from tag
         run: bash scripts/sync-version.sh
 
+      # --ignore-scripts: publishing only packs and uploads — no Python venv.
       - name: Install dependencies
-        run: npm install
+        run: npm ci --ignore-scripts
 
       - name: Build and verify
         run: npm pack --dry-run
@@ -95,8 +99,9 @@ jobs:
       - name: Sync version from tag
         run: bash scripts/sync-version.sh
 
+      # --ignore-scripts: publishing only packs and uploads — no Python venv.
       - name: Install dependencies
-        run: npm install
+        run: npm ci --ignore-scripts
 
       - name: Build compiled plugin entry (dist/index.js)
         run: npm run build:openclaw
@@ -111,6 +116,7 @@ jobs:
             fi
           done
           rm -f openclaw/scripts/sync-version.sh
+          cp LICENSE openclaw/LICENSE
 
       # Guard against regression of the issue behind
       # https://github.com/Weaxs/stock-analysis-plugin/issues/3 — a TS entry
@@ -124,11 +130,14 @@ jobs:
           npm pack --dry-run 2>&1 | tee pack-dry-run.txt
           grep -q "dist/index.js" pack-dry-run.txt \
             || { echo "::error::dist/index.js missing from openclaw npm tarball — build ran but files whitelist excludes dist/"; exit 1; }
+          grep -q "LICENSE" pack-dry-run.txt \
+            || { echo "::error::LICENSE missing from openclaw npm tarball"; exit 1; }
           test -f dist/index.js \
             || { echo "::error::openclaw/dist/index.js missing on disk — clawhub publish would ship no compiled entry"; exit 1; }
 
       - name: Install clawhub CLI
-        run: npm i -g clawhub
+        # Pinned — an unpinned clawhub@latest broke a release before; bump deliberately.
+        run: npm i -g clawhub@0.23.3
 
       - name: npm publish
         working-directory: openclaw
@@ -142,10 +151,10 @@ jobs:
           CLAWHUB_TOKEN: ${{ secrets.CLAWHUB_TOKEN }}
 
       - name: Publish to ClawHub (dry-run)
-        run: clawhub package publish ./openclaw --dry-run
+        run: clawhub package publish ./openclaw --family bundle-plugin --dry-run
 
       - name: Publish to ClawHub
-        run: clawhub package publish ./openclaw
+        run: clawhub package publish ./openclaw --family bundle-plugin
 
       - name: Publish unscoped variant to npm
         # Same payload under the unscoped name. Runs after ClawHub so the
@@ -174,8 +183,9 @@ jobs:
       - name: Sync version from tag
         run: bash scripts/sync-version.sh
 
+      # --ignore-scripts: publishing only packs and uploads — no Python venv.
       - name: Install dependencies
-        run: npm install
+        run: npm ci --ignore-scripts
 
       - name: Build compiled plugin entry (dist/index.js)
         run: npm run build:dsh
@@ -190,6 +200,7 @@ jobs:
             fi
           done
           rm -f dsh/scripts/sync-version.sh
+          cp LICENSE dsh/LICENSE
 
       # Same regression guard as the OpenClaw job: the dsh profile loader
       # imports built JS, so dist must survive the `files` whitelist, and the
@@ -202,6 +213,8 @@ jobs:
             || { echo "::error::dist/index.js missing from dsh npm tarball — build ran but files whitelist excludes dist/"; exit 1; }
           grep -q "cordis.patch.yml" pack-dry-run.txt \
             || { echo "::error::cordis.patch.yml missing from dsh npm tarball — dsh bundle manifest would dangle"; exit 1; }
+          grep -q "LICENSE" pack-dry-run.txt \
+            || { echo "::error::LICENSE missing from dsh npm tarball"; exit 1; }
 
       - name: npm publish
         working-directory: dsh

{stock_analysis_plugin-0.2.2 → stock_analysis_plugin-0.2.5}/AGENTS.md

@@ -7,13 +7,13 @@ A multi-host agent plugin for stock analysis, screening, and strategy backtestin
 The architecture is **one Python core, four thin host adapters**:
 
 - `tools/*.py` — the shared CLI tools. **This is the single source of truth** for all behavior. Every tool prints JSON to stdout.
-- `pi/index.ts` — Pi extension. `pi.registerTool` ×48, each spawns a `tools/*.py` CLI.
+- `pi/index.ts` — Pi extension. `pi.registerTool` ×57, each spawns a `tools/*.py` CLI.
 - `hermes/` — Hermes plugin (`plugin.yaml` + `register(ctx)` in `__init__.py`; `tools.py` handlers → subprocess to the same CLIs). Discovered via the `hermes_agent.plugins` entry point.
-- `openclaw/` — OpenClaw plugin (`openclaw.plugin.json` manifest + `index.ts` `definePluginEntry` + `registerTool` ×48). Bundled with esbuild.
-- `dsh/` — dsh bundle (`package.json` `dsh.bundle` + `cordis.patch.yml` + `index.ts` cordis `apply(ctx)` with `defineTool` ×48 via `@deepseek-ai/dsh-tools`; skills via `ctx.skills.register`). Bundled with esbuild, `@deepseek-ai/*` external (peer deps).
+- `openclaw/` — OpenClaw plugin (`openclaw.plugin.json` manifest + `index.ts` `definePluginEntry` + `registerTool` ×57). Bundled with esbuild.
+- `dsh/` — dsh bundle (`package.json` `dsh.bundle` + `cordis.patch.yml` + `index.ts` cordis `apply(ctx)` with `defineTool` ×57 via `@deepseek-ai/dsh-tools`; skills via `ctx.skills.register`). Bundled with esbuild, `@deepseek-ai/*` external (peer deps).
 - `skills/*/SKILL.md` — 20 workflow / strategy-methodology skills shared by all four hosts.
 
-> **The invariant that matters most:** the four adapters expose the *same* 48 tools over the *same* Python CLIs. A change to a tool's name, parameters, or JSON output shape must be applied to **all four adapters and the relevant SKILL.md together** — never just one.
+> **The invariant that matters most:** the four adapters expose the *same* 57 tools over the *same* Python CLIs. A change to a tool's name, parameters, or JSON output shape must be applied to **all four adapters and the relevant SKILL.md together** — never just one.
 
 ---
 
@@ -132,7 +132,7 @@ This is the #1 regression surface (issues #2 / #7; the `compat` CI job exists sp
 - **Output is JSON on stdout, always.** Host adapters parse `result.stdout`. Human-readable prose goes to stderr, never stdout.
 - **Errors are data**: print a JSON object with an `error` key (and exit non-zero) rather than an uncaught traceback, so adapters can surface a clean message.
 - **argparse CLI per script**, subcommands per capability (`stock_data.py kline|quote|news|...`). See the README "独立 CLI 使用" section for the established shape.
-- **Keep `tools/` py3.9-compatible** (`ruff.toml` targets `py39`; OpenClaw hosts only guarantee Python ≥ 3.9) even though the Hermes wheel declares `requires-python >= 3.10`. No 3.10+-only syntax in `tools/`.
+- **Keep `tools/` py3.10-compatible** (`ruff.toml` targets `py310`; the Python floor is 3.10 everywhere — Hermes wheel `requires-python >= 3.10`, OpenClaw hosts). PEP 604 annotations (`X | None`) and other 3.10 syntax are allowed; nothing 3.11+-only.
 - **Line length 120**, ruff rules `E,F,W,I,UP,B,SIM` (E501 ignored).
 - Adding a runtime dependency means adding it to `tools/requirements.txt` (the postinstall-built `.venv`) **and** considering the Hermes wheel's `dependencies` in `pyproject.toml`. Follow ponytail rung 5 — don't add a dependency for a one-call problem.
 
@@ -222,7 +222,7 @@ Versions live in **five** manifests that must stay in lockstep: `pyproject.toml`
 
 ## Adding a New Tool
 
-1. Implement the CLI in the appropriate `tools/*.py` (argparse subcommand, JSON stdout, py3.9-compatible).
+1. Implement the CLI in the appropriate `tools/*.py` (argparse subcommand, JSON stdout, py3.10-compatible).
 2. Add a failing pytest first (`tests/test_<module>.py`), then make it pass (see `tdd`).
 3. Register it in all four adapters: `pi/index.ts`, `openclaw/index.ts`, `dsh/index.ts`, `hermes/tools.py` + `hermes/schemas.py` — same name, same params.
 4. Wire it into the relevant `skills/*/SKILL.md` workflow if an agent should call it.

stock_analysis_plugin-0.2.5/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Weaxs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.