Version 2.0.2.0 Released
Date: 14th August 2026
Brokers and Options Release: adds HDFC Securities InvestRight as a new broker and rebuilds the AliceBlue streaming stack; brings live Greeks to the Option Chain with a Price/Greeks view mode; repairs Strategy Builder valuation, contract resolution and payoff charting end to end; hardens the MCP surface with tool annotations, structured errors and a trust envelope; and stops 23 unregistered React routes from pushing logged-out users toward an automatic IP ban
This release spans 58 commits since 2.0.1.9. The broker layer took the largest share: HDFC Securities InvestRight joins as an independent plugin, AliceBlue was rebuilt across streaming, history, symbology and rate limiting in a fifteen-commit sweep, Samco migrated to Trade API v3.2, Tradejini was realigned to the refreshed CubePlus v2 docs, and Delta Exchange moved its market data to the public WebSocket endpoint. On the options side, the Option Chain now computes and streams Greeks on the client for every leg on every tick, and Strategy Builder was taken through a full valuation and contract-safety repair followed by a run of payoff-chart and forward-curve corrections.
A single class of defect — a derivative row whose name column holds the contract description instead of the underlying root — was settled once on the shared master-contract path rather than in each of 35-plus broker plugins, which fixes options orders, expiry lists and the underlying dropdown for every broker at once.
Highlights
- HDFC Securities InvestRight broker integration (
3a57fcdbb, #1784) — a new plugin against developer.hdfcsec.com, independent of the existing HDFC Sky one, covering authentication, funds, master contract, orders, quotes, depth, WebSocket streaming and the option tools. The master contract needed real work: the source exposes only NSE/BSE/MCX, so NFO/BFO/CDS are derived frominstrument_segmentand indices are recovered from a reserved token band; 987 of 2,164 blank BSE cash names are recovered from the matching NSE listing; and a ranking rule onsecurity_idresolves the 722 rows where bonds and NCDs collide with the issuer's equity, verified against all 208 F&O underlyings. Orders address an instrument by exchange plus segment plus security id, and derivative orders additionally resolve the underlying's own security id from the master contract./fetch-ltpreturns only LTP and previous close, so OHLC, volume, depth and OI come from a short-lived protobuf WebSocket snapshot. Two documented gaps: InvestRight publishes no candle API, soget_historyraises rather than returning an empty frame that a backtest would read as "no trades"; and margin calculation is omitted while its leg schema is unconfirmed. - AliceBlue: streaming, history and symbology rebuilt (
2243ca622,b557b0de4,8cc65c690,e47c5fdb2,c030945f8,5e53c2811,0b25e7ad0,904a2c13b,d0790ed37,abcbc8f36,74bed7ec4,9295f4c0e,1b36fdf16,7f5029aca,d0e4d5a80) — the order-update feed was dead and reconnecting every 60 seconds indefinitely becausecreateWsTokenwas called on a host that serves the SPA'sindex.htmlinstead of a 404, soraise_for_status()passed andjson()failed on<!DOCTYPE html>; it now uses the same host the order socket does, and five consecutive failures disconnect rather than log-storm for the life of the worker. The market-data socket had two independent owners reconnecting it —_connection_loopandon_close— each tearing down what the other had just established, with an attempt counter that reset to zero every time so the cap was never reached;_connection_loopnow owns reconnection alone. The socket is also kept alive for a full session and reused across calls instead of being rebuilt per request. Alongside: the documented 1800 requests / 15 minutes is enforced, the symbol-lock registry is bounded and quotes pruned on unsubscribe, master-contract tokens are stored as integers rather than float strings, BSE historical data is no longer hard-blocked, daily history uses a day boundary at midnight IST rather than a naive wall-clock time, every index maps to OpenAlgo symbology with index history routed via the::indexexchange suffix, and EC error codes expand into readable messages. - Samco: Trade API v3.2 migration (
6681fee17, #1783) — migrated to v3.2 with market data, orders and streaming fixes, including a stalled streaming worker that is now always replaced on reconnect. Previously a worker wedged inws.send()on a dead socket blocked its own replacement, and because the thread reference survived, every later reconnect re-joined the corpse — three consecutive reconnects left zero flusher threads and a subscribe afterwards emitted no frames at all, leaving the quote feed silently dead for the life of the process. - Tradejini: realigned to CubePlus v2 (
9b91bf468, #1787) — the integration was brought back in step with the refreshed API documentation. - Delta Exchange: market data on the public WebSocket endpoint (
0cbbbe3f2, #1790) — the crypto option chain rendered blank bid/ask below its 20th strike and zero LTP/OI on every row. The legacyl2_orderbookchannel silently caps a connection at 20 symbols and is scheduled for removal, so the adapter now runs two connections: public for market data, the existing authenticated one for orders, positions and margins. Every mode also subscribes toticker, sinceob_l2carries no traded price, OI or OHLC and its zeroes were overwriting the REST-polled values. Subscriptions are coalesced behind a 0.5s flush — a 41-strike chain in depth mode costs 42 frames instead of 82, and LTP and Quote modes collapse to a single frame. The empty expiry dropdown is fixed too:SymToken.nameheld the product description, so requires a master contract re-download. - Definedge: a full trading day lost at each history chunk boundary (
0cbbbe3f2, #1790) — long history requests are fetched in chunks, and each boundary dropped a day. - Option Chain: live Greeks and a Price/Greeks view mode (
402f77361,e1b3e46b1,ab2a6e537) — the chain advertised live Greeks and rendered none. Greeks now ride the existing tick stream rather than a separate fetch, so a full 80-leg chain recomputes in well under a millisecond with no extra network traffic and no additional broker calls.lib/optionGreeks.tsimplements Black-76 with a Hart normal CDF and a Newton implied-volatility solver that falls back to bisection where vega is too small for Newton to be reliable; 101 tests pin the output to the Rust library to roughly 10 significant figures across ATM/ITM/OTM, 4 hours to 180 days, at NFO, BFO, MCX and CDS price scales. The forward comes from the ATM legs via put-call parity rather than spot, so the futures premium is not baked into every delta as bias, and IV is solved from the mid when the book is two-sided so a stale last trade does not make illiquid strikes jump. A Price/Greeks toggle (shortcut G) selects between two column presets from the same 27-column pool, each keeping its own visibility and ordering. Server-side,POST /api/v1/optionchainacceptswith_greeksandinterest_rate, solving the whole ladder through the vectorized Black-76 batch functions, and the response carriesexpiry_tsandserver_tsso a client need not trust its own clock. Greeks that are not computable render as a dash rather than a zero a trader would read as real. - Strategy Builder: valuation, contract safety and live Greeks (
c1644369f, #1786) — a nineteen-step repair: scenario valuation aligned with Black-76 and aggregate horizons corrected; legs resolved to exact listed contracts, with manual and edited contracts validated and their live metadata refreshed; a canonical live market reference consolidated so freshness is bound to the WebSocket session and stale margin responses are invalidated; closed legs excluded from execution with execution state preserved across a refresh; and tick prices rounded exactly, with overflowed ticks rejected. - Strategy Builder: payoff and forward-curve corrections (
e0321748b,5684ebbef,a28a7bec3,e9faa12ad,68321c4e6,52eb5a67e,cd2299461,e891d14a3) — one carry curve per strategy with futures converging too, the forward carried into the tail slopes for calendars and converging to spot at expiry, no breakeven reported at an underlying of zero, a flat-zero payoff span treated as one breakeven pair, the x-axis no longer collapsing to zero, a zoomed payoff chart staying zoomed, and template preview icons that read as payoffs. - Derivative underlying normalized once, for every broker (
e6efc1dc3,852439446) — for a FUT/CE/PE row,nameis meant to hold the underlying root, and the Options Order lot size, the scalping terminal's MCX/CDS chain,get_distinct_expiries,fno_search_symbols_dband the options tools' underlying dropdown all depend on it. Brokers disagree — Fyers ships the contract description in every column that could carry one, so options orders failed outright, the MCX/CDS chain found no futures to price the ATM from, and the dropdown was offered 76,981 descriptions in place of roughly 190 underlyings. Rather than correcting it in 35-plus plugins and leaving the next broker to repeat it, the root is now derived on the single path every broker's download already runs through, using the same extractor that builds the dropdown, so the value offered and the value resolved agree. - MCP: tool annotations, structured errors and a trust envelope (
74b53ae39) — all 49 tools register through an@openalgo_tooldecorator emittingreadOnlyHint,destructiveHint,idempotentHint,openWorldHintand a title on both stdio and HTTP, so a client can tell a quote lookup from a square-off before prompting for approval. Three inconsistent error shapes across 53 sites collapse into one structured payload — a prose "Error placing order: ..." string was indistinguishable from a successful response that happens to mention an error. Because OpenAlgo orders carry no client-supplied idempotency key, a timed-out write reportsretry_safe=falseand names the tool to verify with rather than inviting a retry that could duplicate a live order. Responses are wrapped in a trust envelope with two risk tiers, andOPENALGO_MCP_TOOLSETS/OPENALGO_MCP_READ_ONLYnarrow the tool surface on both transports, closing the gap where OAuth scopes protected HTTP while stdio exposed everything. 47 new tests cover scope drift in both directions, envelope shape, error classification and documentation drift. - Unregistered React routes fed the automatic IP ban (
066dcd07d) — the 404 handler falls through to the SPA, so a client-side path with no Flask rule still renders, but it also callsError404Tracker.track_404for any visitor without a session, and those counts drive an automatic IP ban. A logged-out bookmark or a refresh after session expiry therefore pushed a real user toward a ban on 23 paths. Rules were added for the remaining/toolspages, both backtester result pages, the WebSocket order stream page, the Python guide and schedule pages, Flow shortcuts, admin diagnostics and remote MCP, WhatsApp, Health, Master Contract and the Historify chart pages./apikeyis deliberately left unregistered, sinceapi_key_bpserves both JSON and HTML from that path and a React rule would shadow it. - Charting terminal: HalfTrend indicator (
d51a5c609) —openalgo-charts1.0.29 adds HalfTrend as the 20th built-in indicator with the marker hook it needs. Nothing in the terminal changed: the indicator layer is registry-driven, so it appears in the Indicators menu with a generated settings form and its Buy/Sell label plates render from the library's own marker layer. Two upstream fixes ride along — pane legends no longer print bare booleans in the parameter summary, andINDICATOR_PLOT_STYLESis genuinely exported. - Charting terminal: screenshots (
6a96ccd36,b7af01e4b) — the readout is included in the capture and the order buttons are kept out of it. - Flow (
852439446,cad9c7437) — option lot size is resolved without trustingSymToken.name, and open strategy legs sort ahead of flat ones. - PnL Tracker (
3452028bc) — PnL and drawdown split into 3:1 panes. - Greeks: parsed option expiry kept naive (
f1329e23d) — a mixed naive/aware comparison in the expiry parse. - Docs (
6ec270971, #1764, #1788) — WebSocket client connection limits clarified in the API documentation.
Dependencies
openalgo-charts: upgraded to 1.0.29 (HalfTrend indicator, frontend only)
No Python dependencies changed in this release.
Upgrading
git pull on main is the canonical path — frontend/dist is tracked there and rebuilt by CI, so no Node.js is needed on the server. Delta Exchange users must re-download the master contract for option expiries to resolve.