[pyne-worker Isolate Profile]

Python Cloudflare Worker for PYNE Pine Script edge evaluation — /run, script registry, bar-close cron, R2 OHLCV, alert webhooks, trade-worker forwarding.

The pyne-worker is the Python edge host for PYNE — evaluate TradingView® Pine Script™ on Cloudflare Workers with the same evaluate contract as the Pro API. It is a tooling isolate outside the mesh INTERNAL_KEY_BINDING graph: callers authenticate with X-API-Key / Worker secret API_KEY.

Source: hoox-sh/pyne-worker · Product docs: hoox.sh/pyne/docs

This isolate vendors Python pynescript.runtime. It is not PyneTS (@hoox-sh/pynets, a TypeScript library). Product docs: pyne-worker. Live order mapping: PYNE live trading. AXIS may POST /run as a client; the PWA still does not place orders — AXIS and HOOX.

Bindings

BindingTypePurpose
TRADE_SERVICEServiceForward strategy trade events to trade-worker
OHLCV_DATAR2Kline / OHLCV storage and script registry

Cron: * * * * * (bar-close scheduler; only re-runs when R2 has a newer bar).

Secrets

SecretRequiredPurpose
API_KEYYes (production)HTTP auth for /run and management APIs (X-API-Key). Unset = open dev mode — do not ship that way.
INTERNAL_KEY_BINDINGYes (live trade forward)Mesh internal key sent as X-Internal-Auth-Key when forwarding strategy events to trade-worker via TRADE_SERVICE. Same secret family as the rest of the mesh (or a dedicated trade-execute key bound for that hop). Without it, live strategy → trade-worker calls are rejected by requireInternalAuth.
ALERT_WEBHOOK_URLNoDefault HTTPS destination for alert() / alertcondition() (public hosts only; private/loopback IPs rejected)
DEFAULT_EXCHANGENoDefault exchange id on forwarded WebhookPayloads when the strategy event does not specify one (e.g. binance, bybit, mexc)

Dashboard callers that use the public URL or binding should set PYNE_API_KEY to the same value as API_KEY.

hoox secrets set pyne-worker API_KEY
hoox secrets set pyne-worker INTERNAL_KEY_BINDING  # required for live TRADE_SERVICE forward
hoox secrets set pyne-worker ALERT_WEBHOOK_URL     # optional
hoox secrets set pyne-worker DEFAULT_EXCHANGE      # optional
hoox secrets set dashboard PYNE_API_KEY            # optional, match API_KEY

Security notes

  • Public / tooling routes: API_KEY via X-API-Key — constant-time key compare; rate limit 100 req / 60s per key (per isolate). Not mesh INTERNAL_KEY_BINDING on these routes.
  • Strategy forward → trade-worker: sends X-Internal-Auth-Key (from INTERNAL_KEY_BINDING / trade-execute key) on TRADE_SERVICE POST /webhook, plus an idempotency key for replay safety.
  • Payload caps: 5 MB body, 100 KB script, 100 K bars; /run wall timeout 30 s.
  • Alert webhooks: HTTPS + public host only (SSRF fail-closed).
  • R2 OHLCV keys: sanitized symbol / timeframe only — no path separators.

Endpoints

MethodPathAuthDescription
GET/healthNoHealth + feature flags
POST/runYesEvaluate Pine (mode interpret | compile | auto)
POST/ingestYesUpload OHLCV to R2
POST/GET/DELETE/scripts…YesDeployed script registry
GET/PUT/cron/jobsYesBar-close job config
POST/cron/runYesManual scheduler trigger
POST/feed/refreshYesPull klines into R2

Setup in HOOX

  1. Clone with submodules (or hoox clone pyne-worker / git submodule update --init workers/pyne-worker).
  2. Secrets: hoox secrets set pyne-worker API_KEY (and mesh key for live trade forward). Dashboard Setup wizard lists API_KEY under Integrations; set PYNE_API_KEY on the dashboard to the same value.
  3. Deploy (CLI-first): 
    hoox pyne deploy                 # sync-vendor + wrangler deploy
# or: hoox deploy worker pyne-worker
# manual: cd workers/pyne-worker && ./scripts/sync_vendor.sh && npx wrangler deploy
  4. Health: hoox pyne health (or hoox check health when the worker is enabled).

Deploy gotcha: Wrangler packages python_modules/pynescript, not an editable install. After updating PYNE, re-run ./scripts/sync_vendor.sh (or hoox pyne sync-vendor).

Related