# Handover — Trading Web Redesign + Cross-Workspace Audit

**Last updated**: 2026-05-04
**Last session**: Claude Code, single contributor
**Repos touched**: `learning_ai_invt_trdg` (this repo), `learning_ai_common_plat` (sibling)

---

## TL;DR

This repo had a recent web-dashboard redesign (commits `f62c3b1`, `938ed86`)
that wired up live Alpaca + FMP data, a strategy builder (visual + code),
and a screener. A subsequent audit (`4a09d4b`) catalogued 52 issues across
7 buckets; commits `ddbffb6` and `255bb07` cleared the **5 critical broken
integrations** and the **stray-lockfile mess**. Buckets B–G remain open and
documented in `docs/AUDIT_REDESIGN.md`.

---

## What's working right now

| Path                              | Status                                                                |
| --------------------------------- | --------------------------------------------------------------------- |
| `web/` build                      | ✅ `npm --prefix web run build` → 1.08 MB bundle, no errors            |
| `web/` typecheck                  | ✅ `npm --prefix web run typecheck` → 0 errors                         |
| `web/` tests                      | ⚠️  151 / 155 pass — 4 pre-existing failures (see audit F7, F8)        |
| `backend/` typecheck              | ✅ `npx tsc --noEmit -p backend/tsconfig.json` → 0 errors              |
| `/api/chart/bars` (equity+crypto) | ✅ Routes equities to v2/stocks, crypto (`BTC/USD`) to v1beta3/crypto  |
| `/api/news` + `RightPanel`        | ✅ Auth header now sent (was 401-ing every render before commit `ddbffb6`) |
| `/api/backtest/run` from CodeStrategyEditor | ✅ Correct endpoint + payload shape after `ddbffb6`              |
| `/api/profiles` from VisualRuleBuilder      | ✅ Uses canonical `createTradeProfile()` shape                  |
| Strategy builder (`/research` → Visual Builder, Code Editor) | ✅ UIs land; persistence verified by typecheck only — no e2e |
| Screener (`/screener`)            | ✅ Live FMP, sortable, click-to-load                                   |
| Live market indices in Header     | ✅ SPY/DIA/QQQ poll every 60s                                          |

---

## Critical context for the next dev

### 1. Lockfile situation (READ THIS FIRST)

`web/package.json` declares `react-router-dom`, `@monaco-editor/react`,
`@dnd-kit/{core,sortable,utilities}` but the **root `pnpm-lock.yaml`
doesn't reflect them yet**. The previous session installed those via
`npm install` inside `web/` as a workaround for a Vite vendor-resolve
issue, which left stray `web/package-lock.json` etc. — those are now
git-ignored (commit `255bb07`).

**Action required before CI green**: regenerate the root lockfile from a
consistent package source, then commit the result. For a sibling
`learning_ai_common_plat` checkout on this host, run:

```bash
pnpm run install:common-plat -- --no-frozen-lockfile
git add pnpm-lock.yaml
git commit -m "chore(E2): regen root lockfile with new web deps"
git push
```

If you need the registry path instead, run
`BYTELYST_PACKAGE_SOURCE=gitea pnpm install -r --no-frozen-lockfile` with
`GITEA_NPM_TOKEN` exported.

This is **item E2** in `docs/AUDIT_REDESIGN.md`. CI will fail until it lands.

### 2. Pre-existing test failures (NOT my regressions)

Four tests fail on `npm --prefix web test`. All pre-date this redesign:

- `useTabFeatureFlags.dom.test.tsx` (3 failures): module-level cache leaks
  between tests — test 2 caches `marketplace: false`, tests 3–5 expect the
  default `true`. Fix: `vi.resetModules()` in `beforeEach` or expose a
  cache-reset helper from the hook.
- `EntryForm.dom.test.tsx > alerts error when trade execution fails`:
  pre-existing intermittent — test waits for `alertMock` but the component
  no longer calls `alert()` synchronously after the trade-API change.

These are tracked as audit items F7 and F8.

### 3. The audit doc is the source of truth

`docs/AUDIT_REDESIGN.md` has the full issue list (52 items, 7 buckets).
Each row has a status box (⬜ open / 🟦 in PR / ✅ fixed) and a slot for
the fix-commit hash. **Update it as you close items** — the format is:

| #   | Issue | Severity | Status | Fix commit |
| --- | ----- | -------- | ------ | ---------- |

Keep commits scoped (one bucket or one item per commit) and reference the
ID in the subject — e.g. `fix(B1): wire RSI/MACD/BB indicator overlays`.
That's the convention we used for the 5 already-closed items.

---

## Suggested next steps (in priority order)

1. **E2** — regenerate root lockfile (1 command, 1 commit). Unblocks CI.
2. **B1** — Build the RSI/MACD/Bollinger indicator overlays under
   `StockChart` in `web/src/views/HomeView.tsx`. The plan called for them
   and the `IndicatorPanel` component was never built. Pure client-side
   compute from existing OHLCV bars; no new endpoints needed.
3. **B2 + B3** — Wire the Watchlist (★) and notifications (🔔) buttons in
   `TickerHeader`, and pull the company name from `fetchResearchProfile`
   instead of using the symbol as a placeholder.
4. **C1** — *Sandboxing for code strategies*. `CodeStrategyEditor` POSTs
   user-authored JS to `/api/backtest/run` with `strategyConfig.type ==
   'code'`. Backend currently has no handler for that type — first step
   is to either (a) add a sandboxed `vm2` / `isolated-vm` runner, or
   (b) reject `type: 'code'` with 400 and document the escape hatch.
5. **C2** — Add an in-memory FMP response cache (key by URL, 30-min TTL).
   Free tier is 250 req/day; one Home view = 3 reqs.
6. **F6** — Tests for the 7 new backend endpoints. Easy wins.
7. **G1–G4** — Mobile parity. Mobile app (`mobile/`) has none of the new
   features (news, research, screener). Decide scope first — code
   editor probably shouldn't ship to mobile.

Buckets D (UX polish) and W (lint warnings) are nice-to-haves.

---

## Repo state checklist

```bash
# Verify clean state before starting
cd /Users/saravana/BytelystAI/trading/learning_ai_invt_trdg
git status                       # should show only nomgap WIP if any
git log --oneline -10            # last commit should be 4a09d4b or later
ls -la .claude/ 2>&1 | head -1   # gitignored — won't show in status

# Run the verification gates
npm --prefix web run typecheck   # → 0 errors
npm --prefix web run build       # → ✓ built
npm --prefix web test            # → 151 pass / 4 known fails
npx tsc --noEmit -p backend/tsconfig.json  # → 0 errors
```

---

## Branches & backups

- **`main`** — current work
- **`backup/main-20260504-061739`** — snapshot of `main` taken before the
  audit-fix commits. Roll back with
  `git reset --hard backup/main-20260504-061739` if anything goes wrong.

Sibling repo `learning_ai_common_plat` also has a backup branch
`backup/main-20260504-062733` taken from its `origin/main` HEAD `46a16f0`.

---

## Vendored `@bytelyst/*` packages

`web/` consumes 9 vendored packages from `vendor/bytelyst/`. These are
read-only copies of the platform packages (sourced from
`learning_ai_common_plat`). Don't edit them here — fix upstream and
re-vendor.

The Vite alias config (`web/vite.config.ts`) has a `bytelystAlias()`
helper that prefers `web/node_modules/@bytelyst/*` and falls back to
`vendor/bytelyst/*`. If you add new platform deps to `web/package.json`,
they'll resolve from `web/node_modules` (the npm-installed copy) — not
the vendored one. That's intentional but worth knowing if you debug
weird "two copies of React" errors.

---

## Contact / context

Original redesign plan lived at
`/Users/saravana/.claude/plans/i-want-to-build-woolly-adleman.md` (local
file, not in repo). It described the 6-phase build (UI shell → live
data → strategy builder → screener → mobile). Phases 1–6 web-side are
landed; mobile (phase 7 implicitly) is the remaining greenfield.
