What's New

New: built-in read-only MCP server for AI clients.

• Read-only MCP (Model Context Protocol) server — Claude Code, Cursor and other AI clients can read Schwab account data, positions, orders, quotes, option chains and rebalance suggestions over HTTP (Streamable HTTP at /mcp). There is no tool that places, changes or cancels an order, and calculate_rebalance only computes suggestions.
• Off by default — Mcp:Enabled is false; the endpoint is not mapped (404) and no token is generated unless the user enables it.
• Bearer-token authentication — a random 32-byte token is generated on first enable and stored at {dataRoot}/config/mcp-token.txt (owner-only on macOS/Linux); requests must present Authorization: Bearer <token>. Comparison is constant-time and the token is never logged.
• Origin / Host hardening — non-local Origin or Host headers are rejected (403) to block DNS rebinding and malicious web pages.
• 10 tools: get_account, get_balances, get_positions, get_orders, get_order, get_quote, get_quotes, get_price_history, get_option_chain, calculate_rebalance. Every tool and parameter has a runtime description for the AI client, and list results are size-capped.
• Release-build safe — MCP responses are built from named fields, not anonymous types, which Obfuscar would otherwise break (HTTP 500). MCP types are excluded from obfuscation so tool names stay readable. Verified against the obfuscated release build.
• Privacy note — everything a tool returns is sent to the AI service your client uses.

Fixes: fresh Linux installs now show "Secure" in the browser out of the box.

• Correct NSS trust flag (the root cause of "not secure"). The local CA was imported into the user's NSS database with the C,, trust flag, which does not mark a certificate as trusted for TLS. Chrome/Chromium therefore still showed https://127.0.0.1:8443 as "not secure" on first launch. The CA is now imported with the CT,CT,CT flag, so a new install is trusted for SSL immediately.
• PEM export for certutil. The CA is now converted to PEM before the NSS import, which keeps the stored NSS entry valid (this also works around builds whose quant-ca.cer is DER).

Makes the local-CA HTTPS trust step fully automatic on Linux — no commands to type.

• Automatic browser trust on Linux. The local CA is now imported directly into the current user's NSS certificate database (~/.pki/nssdb), which Chrome/Chromium read on Linux — no sudo required, since it is a per-user store. Previously this required manually running certutil commands copied from the startup log.
• Self-healing retry. If the one dependency this needs (certutil, from the libnss3-tools package) isn't installed yet, the app now retries automatic trust on every subsequent startup instead of only once at CA creation time — installing the package and restarting is enough, with no need to regenerate the certificate or reconfigure anything.
• Correct SSL trust flag + valid NSS entry. The CA is now imported into NSS with the CT,CT,CT (SSL-trusted) flag and fed as a PEM export. The previous C,, flag stored the CA in NSS without marking it as trusted for TLS, so Chrome still showed https://127.0.0.1:8443 as "not secure" on first launch; the new flag makes a fresh install show "Secure" out of the box.

Fixes the "not private" HTTPS warning and the update-check failure from v1.8.0.

• Local CA + CA-signed HTTPS certificate. Replaces the plain self-signed certificate with a local Certificate Authority that is trusted once (a one-time step per machine) and then signs the server certificate. If you later change Urls or the Schwab OAuth redirect URI to a different host, the server certificate is automatically re-issued and signed by the same, already-trusted CA — no second trust step required. If CA generation fails for any reason, the app falls back to the old plain self-signed certificate so HTTPS never blocks startup.
• HTTP to HTTPS redirect. The app now recognizes X-Forwarded-Proto from reverse proxies (nginx, Apache) and forces any plain HTTP request to redirect to HTTPS, fixing the case where the address bar kept showing http:// even when the app was configured for https://.
• Fixed: "The update check failed" on self-contained builds. Self-contained Release builds trim unused reflection metadata, which broke JSON parsing of the GitHub Releases API response and made the /update page always report a failed check. Update checking now works correctly in the published Setup.exe / AppImage builds.

One-click upgrade — update from inside the app; configuration and strategy data are never lost.

• In-app updater (Velopack). The app checks GitHub Releases on startup and every 24 hours. When a new version is available a banner appears at the top of the page. One click downloads, applies and restarts into the new version on Windows, macOS and Linux.
• /update page. Shows the installed version, the latest version, the release notes from this changelog and the download progress. Buttons: Check now, Download, Upgrade & Restart and Upgrade after market close.
• Dismissible banner. Dismissing a version hides it until a newer version appears; the dismissal is stored in your user settings, not in the program folder.
• Trading safety gate. An upgrade is refused while a rebalance is running, while orders are still working/pending/queued, or — with automatic mode enabled — during US market hours (09:30–16:00 ET on weekdays). Refusals explain the reason instead of silently doing nothing. Upgrade after market close retries the gate after 16:30 ET.
• Pre-upgrade snapshot. config/ and Data/ are copied to backups/{UTC}-{old version}/ before every upgrade; the five most recent snapshots are kept. Tokens and credentials are never copied. If the post-upgrade data migration fails, the latest snapshot is restored automatically.
• Post-upgrade feedback. After a restart into a new version the app opens the dashboard and shows Updated to vX.Y.Z.
• Degraded mode for zip installations. If the app was not installed through the Velopack installer, it only compares versions against the public release repository and offers the installer download. Nothing on your disk is replaced automatically; after one manual installer run, every later upgrade is a single click.
• Public release repository. Releases are published to a separate, public repository (memoryfraction/Quant.Infra.Net.Pro-Public) that holds nothing but release assets, so checking for an update and downloading the installer need no account at all. The source repository stays private. Its address is the Update:ReleaseRepoUrl setting, and all four consumers read it: the Velopack feed, the degraded-mode release check, the installer download link and the How to upgrade link.
• How to upgrade link. The update banner and the /update page link to the upgrade instructions published with the release repository.
• Version single source. This changelog is embedded into the app and drives the version history page; the git tag drives the build version. No more hand-copied version numbers.
• Upgrade anyway (when open orders cannot be verified). If the open-orders check cannot be completed at all (for example Schwab is not connected, or the authorization has expired), the /update page offers an Upgrade anyway (I have no open orders) button with a warning. The confirmation only bypasses the "orders could not be verified" refusal; it can never bypass a running rebalance, clearly in-flight orders, or the market-hours rule, and Upgrade after market close never uses this bypass.
• MVP scope. Windows is the fully supported one-click upgrade target; Linux ships an AppImage (packaged, not end-to-end verified in this cycle); macOS is not published in this cycle — its CI job runs only on a manual workflow_dispatch with the include_macos input set to true.

Program / data separation — configuration and strategy data now survive every upgrade.

This release is the prerequisite stage of the one-click upgrade plan. It does not yet add an in-application updater; it removes the root cause of "my settings disappeared after upgrading".

• User data moved out of the program folder. Configuration, strategy data, trigger settings, execution mode, logs and the HTTPS certificate now live under %APPDATA%\Quant.Infra.Net.Pro\ (~/.config/Quant.Infra.Net.Pro/ on macOS/Linux). Overwriting the program folder — by zip or by installer — can no longer destroy user data.
• Configuration layering. Shipped appsettings.json (read-only defaults) → config/appsettings.user.json (your overrides) → environment variables → User Secrets. New settings introduced by a release arrive automatically as defaults; your edited values stay yours.
• One-time automatic migration. On first launch the app moves License Key, Urls, RedirectUri, advanced overrides, the trigger configuration, the HTTPS certificate and the EULA acceptance record out of the old install folder. Idempotent: running it again changes nothing, and it never overwrites an existing file.
• Fixed trigger configuration bug. The rebalance trigger settings were written into the program folder but read from the user data folder, so saved trigger settings were never read back and were lost on upgrade. Read and write now use the same path.
• Manual / automatic execution mode is persisted. Previously it reset to Manual every time the Rebalance page was opened.
• SchemaVersion + migration pipeline. User data files carry a schema version and are upgraded by an ordered IUserDataMigration pipeline. Deserialization tolerates unknown fields, so installing an older version back remains possible.
• Export / import all settings (Settings page). Download a zip with your configuration and strategy data for machine migration or manual backup. Schwab credentials are excluded by default and require an explicit opt-in; authorization tokens are never exported.
• Data root override. The QUANT_INFRA_DATA_DIR environment variable overrides the user data root, which is required for Linux service accounts running as root or under systemd.
• Documentation corrected. The deployment guide claimed configuration files were preserved across an upgrade; that was not true before this release. README now documents where data lives.

Privacy mask for financial data: eye-toggle on Dashboard and Rebalance pages. Sensitive amounts and account numbers masked as **** by default.