release 4 (75796a8c89)

CHANGELOG.md

@@ -35,6 +35,11 @@ The Streamlit console is replaced by a web dashboard served by the same single p
 - **Fixed:** `tools/publish_release.py` read the current release over TLS without root certificates (python.org's macOS
   Python) and counted the failure as "no release", so it would have published release 1 again. It now uses certifi and
   stops on anything but a 404.
+- **Fixed, after it burned 0.06 ETH:** a test run could spend real money. While `.env` had `RH_LIVE_ENABLED=1` and the
+  real RH key, a vault test that expected signing to be off paid two test claims of 0.03 ETH from the live RH wallet to its
+  placeholder address `0x1111…1111` (transactions `0x063cbd4f…` and `0x5fd55d3d…`). Now `fly_trader/netguard.py` refuses
+  every Solana or EVM broadcast and every Kalshi order, cancel or transfer from a test run unless it goes to a local test
+  chain. Tests never load the operator's signing keys or live switches.
 - **Fixed:** a SIGTERM killed the worker threads mid-step: uvicorn re-raises the signal once the server stops. The
   console now stops them in the app's shutdown and waits for them to flush.
 

fly_trader/chain/rpc.py

@@ -137,11 +137,17 @@ class HttpSolanaRpc:
 
     # ---- generic ----
     def call(self, method: str, params: list | None = None):
+        if method == "sendTransaction":
+            from ..netguard import refuse_broadcast
+            refuse_broadcast(self._url, "a Solana transaction")       # never from a test run (fly_trader/netguard.py)
         payload = {"jsonrpc": "2.0", "id": self._next_id(), "method": method, "params": params or []}
         return self._post(payload, method, _request_summary(method, params))
 
     def batch(self, calls: list[tuple[str, list | None]]) -> list:
         """Send several calls in one HTTP request; results in call order. Raises on the first error."""
+        if any(m == "sendTransaction" for m, _ in calls):
+            from ..netguard import refuse_broadcast
+            refuse_broadcast(self._url, "a Solana transaction")       # never from a test run (fly_trader/netguard.py)
         if not calls:
             return []
         payload = [{"jsonrpc": "2.0", "id": self._next_id(), "method": m, "params": p or []} for m, p in calls]

fly_trader/kalshi/client.py

@@ -122,6 +122,9 @@ class KalshiRest:
 
     def request(self, method: str, path: str, params: dict | None = None, body: dict | None = None, timeout: float = 60.0) -> dict:
         """One paced, logged call. Raises ``KalshiApiError`` on HTTP >= 400 (429 is retried with backoff first)."""
+        if method.upper() != "GET":
+            from ..netguard import refuse_broadcast
+            refuse_broadcast(self.base, f"Kalshi {method} {path}")    # never from a test run (fly_trader/netguard.py)
         client = self._ensure()
         q = {k: v for k, v in (params or {}).items() if v is not None}
         url = self.base + path + (("?" + urlencode(q)) if q else "")

fly_trader/netguard.py

@@ -0,0 +1,35 @@
+"""No money moves from a test run: every place that broadcasts a transaction or changes a live account refuses while
+pytest runs, unless it talks to a local test chain (anvil, a fake on 127.0.0.1).
+
+Why it exists: on 2026-10-17 the test suite ran while the operator's .env had RH_LIVE_ENABLED=1 and the real RH bot key.
+A vault test expected Robinhood Chain signing to be off; it was on, so the claim processor built the real wallet
+(RhWallet(RhRpc())) and paid two test claims of 0.03 ETH to the test's placeholder address 0x1111…1111 on mainnet —
+0.06 ETH burned. The database already refuses production under pytest (db/connection.py); this does the same for chains
+and exchanges, at the lowest layer, so no configuration or code path above it can get around it.
+
+A test run is recognised by PYTEST_CURRENT_TEST (set by pytest for every test's setup, call and teardown) or
+FLY_TRADER_TESTING=1 (set by tests/conftest.py before anything is imported). Neither is ever set in production.
+"""
+from __future__ import annotations
+
+import os
+from urllib.parse import urlsplit
+
+LOOPBACK = {"127.0.0.1", "localhost", "::1"}
+
+
+class BroadcastUnderTest(RuntimeError):
+    """A test tried to move real money."""
+
+
+def under_test() -> bool:
+    return bool(os.environ.get("PYTEST_CURRENT_TEST")) or os.environ.get("FLY_TRADER_TESTING") == "1"
+
+
+def refuse_broadcast(url: str | None, what: str) -> None:
+    """Raise when a test is about to send ``what`` to a real network (anything but a loopback host)."""
+    if not under_test():
+        return
+    host = urlsplit(url or "").hostname or ""
+    if host not in LOOPBACK:
+        raise BroadcastUnderTest(f"refusing to send {what} to {host or 'an unknown host'} from a test run: tests never move real money")

fly_trader/rh/rpc.py

@@ -53,6 +53,9 @@ class RhRpc(EvmRpc):
     def _batch(self, calls: list[tuple[str, list]]) -> list[Any]:
         if not calls:
             return []
+        if any(m == "eth_sendRawTransaction" for m, _ in calls):
+            from ..netguard import refuse_broadcast
+            refuse_broadcast(self.url, "a transaction")             # never from a test run (fly_trader/netguard.py)
         with self._lock:
             base = self._id + 1; self._id += len(calls)
         body = [{"jsonrpc": "2.0", "id": base + i, "method": m, "params": p} for i, (m, p) in enumerate(calls)]