[wJubran]

What and why

The terminal is meant for live analysis and trading on many markets, commodities above all, but it could only get prices from MetaTrader 5 (Windows only) or the simulator. This PR adds five data sources and a paper account that trades on any of them. Each source can be switched while the terminal runs.

Sources (Settings → DATA SOURCES: SETTINGS / TEST / USE; or python launcher.py --provider <type>)

Source	Markets	Needs	Orders go to
Yahoo Finance	Forex; metal, energy, grain, soft and livestock futures; indices, stocks, ETFs, crypto	Nothing (free, some markets delayed)	Paper account
Binance	Crypto, real time	Nothing	Paper account
OANDA	Forex, metals, energy, grains, index CFDs	Free practice account + API token	OANDA
Alpaca	US stocks/ETFs (incl. GLD, SLV, USO, UNG, CPER), crypto	Free account + API key	Paper account
CSV files	Anything exported from MT5, TradingView, NinjaTrader…	Files in a folder	Paper account

Backend

• providers/feed_base.py holds what the HTTP feeds share:

  • quote and bar caching;
  • bar-close events;
  • UTC or New York-close day boundaries;
  • coarser timeframes built by aggregation;
  • symbol mapping (UNIVERSE broker symbol → account symbols → built-in table → guess).

  Quote requests run outside the provider lock, so loading a chart never waits on them. Each feed is about 100–400 lines on top of it.

• providers/paper_provider.py is the simulator's paper engine running on another source's live bid/ask. SL/TP trigger on wicks from the quotes seen and the source's M1 bars, never on a price from before the order existed. RESET starts the account over.

• provider_routes.py adds the API:

  • GET /api/providers;
  • PATCH /api/providers/{id};
  • POST /api/providers/{id}/test (a throw-away instance and one quote);
  • POST /api/providers/activate (re-creates the providers, no restart);
  • POST /api/providers/{id}/reset.

• Secrets: tokens and passwords are never sent to the browser. They show as ••••••, and a PATCH that echoes the mask keeps the stored value.

  • Saved profiles no longer copy secrets, and GET /api/config masks them inside profiles too. Before this, it returned profile snapshots and the MT5 password unmasked.
  • Loading a profile keeps the secrets in use.

• Orders: the LIVE TRADING switch is now enforced by the server as well. POST /api/orders returns 403 while it is off, as the order ticket already did. Closing positions and editing SL/TP still work.

• Local analysis: the data source is part of every file's signature.

  • A switch starts a pass at once, and a pass in progress stops when the source changes.
  • Files built from another source are removed for tickers the new source doesn't carry, so a chart never shows cones made from other prices.

UI

• Settings → DATA SOURCES has a card per source and an "Orders go to" box with the paper account's settings and RESET.
• The header and footer name the active source (FEED ● YAHOO, ● BINANCE, ● CSV …).
• The PROVIDERS badge and the trading switch say "paper account (live prices)".

Docs

• Learning Center article Data sources: connect and configure, in English and Arabic.
• A Data sources section in README.md, README.ar.md and the main README's Arabic part. It covers step-by-step setup for each source, ticker-name mapping (including commodities), environment variables, the paper account and troubleshooting.
• CHANGELOG entries.

How it was tested

• python -m pytest passes in backend/: 187 tests on Python 3.13 and on 3.10, with 23 new data-source tests. The new tests cover:

  • every feed against its documented API format through httpx.MockTransport (OANDA orders, units and precision, rejects, closes, SL/TP edits; Binance pagination; the Alpaca quote fallback);
  • Yahoo with a fake yfinance;
  • CSV export formats and aggregation;
  • the paper account's fills and wick rule;
  • the switch API end to end;
  • secrets kept out of /api/config and profiles;
  • the live-trading gate;
  • the analysis rebuild after a switch.

  The tests make no network calls.

• UI changes: ran npm run build in frontend/ and committed the rebuilt frontend_build/. A second build was identical.

• Tried it with python launcher.py --sim in Chromium (Playwright):

  1. Opened Settings → DATA SOURCES.
  2. Switched to CSV files (XAUUSD and EURUSD files in MT5 and generic export formats).
  3. Checked that the header shows FEED ● CSV, orders go to the paper account, and the PROVIDERS badge reads "PAPER ACCOUNT ● LIVE PRICES".
  4. Checked that the cones and bands were rebuilt from the CSV bars within a minute, and the sim-built files of the other tickers were removed.
  5. Opened an XAUUSD D1 chart with monthly and quarterly cones on the CSV data. No page errors.

• Not done: Yahoo Finance, Binance, OANDA and Alpaca were not tried live, because this environment blocks those hosts. They are tested against recorded API formats only. MetaTrader 5 order handling was not tried on a demo account (no Windows here); its code path is unchanged apart from the new LIVE TRADING check.

Screenshots

Taken locally, not attached:

• Settings → DATA SOURCES on the simulator: source cards with TEST / USE, and the "Orders go to" box.
• After switching to CSV: the header and footer show CSV, and the paper account settings appear with SAVE & APPLY and RESET.
• XAUUSD D1 from CSV files with monthly and quarterly cones.

---

Generated by Claude Code