freeman
2165475dd0
fix(security): throttle password login after repeated failures
...
The access-token endpoint accepted unlimited password attempts; the
only existing rate limiters are single-instance helpers for outbound
site requests. Add app/application/security/throttle.py, an in-memory
LoginThrottle keyed by (client address, normalized username) that locks
for 30s after five consecutive failures and doubles the lockout up to
15 minutes. The endpoint answers 429 with Retry-After while locked,
counts only real credential failures (an MFA challenge after a correct
password does not count), and clears the record on success.
X-Forwarded-For is deliberately not trusted because there is no
trusted-proxy setting; behind the bundled nginx all requests share one
address, so the key degrades to per-username throttling, which is the
dimension brute-force protection needs. Sync the dependency snapshot
and architecture metrics for the new module.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-09 12:01:04 +08:00
jxxghp
35d5cac84f
fix(subscribe): validate TMDB conversion and sync architecture facts
2026-10-08 21:22:17 +08:00
jxxghp
70811b551e
feat(music): optionally simplify written lyrics
2026-10-08 18:40:16 +08:00
jxxghp
6758633e01
docs(architecture): sync metrics for Milkie adapter
2026-10-08 17:56:07 +08:00
jxxghp
32d37fa8b4
feat(music): preserve per-task CUE recognition policy
2026-10-08 08:51:01 +08:00
ChantXu64
e5e2558585
feat(search): 订阅补全逐页搜索、断点续搜与资源页手动分页 ( #6907 )
2026-10-07 14:40:55 +08:00
jxxghp
6c9ebd01f3
fix(agent): close owned LLM clients with their lifecycle
...
Refs #6901
2026-10-07 09:18:40 +08:00
jxxghp
fb652c74f4
fix(music): 支持关闭 CUE 识别整理分轨音频
2026-10-05 17:15:14 +08:00
jxxghp
fa5fa33db1
fix(lyrics): normalize LRCLIB music metadata
2026-10-05 13:10:10 +08:00
LIN student
3bdf09dc6f
fix(site): 非超级管理员读取订阅站点和域名详情时不返回认证字段
...
/site/rss 与 /site/domain/{site_url} 只依赖 verify_token，直接返回完整的
Site 模型，其中包含 cookie、apikey、token、rss。同模块的 /site/agent 已经
对非超级管理员剔除这些字段，/site/ 列表也要求 manage 权限，两个接口与之
不一致。
前端订阅编辑和工作流「获取种子」动作只用到站点的 id、name、is_active，
因此非超级管理员改为复用 _project_agent_site(include_secrets=False) 投影，
超级管理员保持原有完整字段。
read_rss_sites 的返回标注由 List[dict] 改为实际的 Site 或投影字典，site.py
的 mypy 债务减少 2（return-value、type-arg 各 1），已固化低水位并同步文档
指标。
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-04 19:01:22 +08:00
jxxghp
c8869d4b89
fix(api): classify notification image transport route
2026-10-04 16:33:11 +08:00
jxxghp
03a285a2a6
fix(wechat): proxy douban notification images
2026-10-04 16:19:58 +08:00
jxxghp
3f206171e7
fix(feishu): apply image referer and proxy policy
...
Refs #6879
2026-10-04 12:23:08 +08:00
jxxghp
823423b2c9
fix(download): refresh expired signed torrent links
...
Refs #6878
2026-10-04 10:27:28 +08:00
jxxghp
fcf12a1e2f
docs(architecture): sync music normalization dependency count
2026-10-04 09:04:09 +08:00
Cat
2a31b51687
fix(transfer): 整理规划的业务拒绝不再按系统错误告警 ( #6868 )
2026-10-03 23:03:15 +08:00
jxxghp
afa6a42a55
docs(architecture): sync mypy debt metric
2026-10-03 09:03:56 +08:00
jxxghp
118e2ef933
fix(notification): align scoped recipient routing
2026-10-03 01:00:21 +08:00
jxxghp
b33053e10f
Merge remote-tracking branch 'origin/v3' into codex/optimize-pr-6849
...
# Conflicts:
# docs/architecture-overview.md
# docs/refactor/optimization-checklist.md
# tests/fixtures/architecture/dependency-baseline.json
2026-10-02 22:06:27 +08:00
jxxghp
da932158bb
docs: sync system version query type debt metrics
2026-10-02 14:11:26 +08:00
jxxghp
bdbc801e83
fix(agent): steer active channel conversations into new replies
2026-10-02 09:12:21 +08:00
jxxghp
6d6dc1991b
docs(architecture): refresh dependency metrics
2026-10-01 17:51:19 +08:00
jxxghp
c7e6f02e3e
chore(architecture): sync egress policy metrics
2026-10-01 17:38:41 +08:00
ranzhigg
fb8f283123
docs(architecture): sync transfer queue baseline
2026-10-01 13:00:46 +08:00
jxxghp
5741d3c56d
docs(architecture): sync mypy debt metric
2026-10-01 12:52:44 +08:00
ranzhigg
0c9d8c9208
Merge upstream v3 into transfer queue PR
2026-10-01 12:51:06 +08:00
ranzhigg
56cf6fefe0
perf(transfer): bound queue snapshots for batch imports
2026-10-01 12:45:31 +08:00
jxxghp
a5da60f3fb
docs(architecture): sync mypy debt metric
2026-10-01 09:49:42 +08:00
jxxghp
c9c9a477d9
fix(music): improve PT title parsing and benchmark recognition
2026-09-30 20:50:50 +08:00
InfinityPacer
4be0795d59
docs(architecture): sync mypy debt metric
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-30 20:46:20 +08:00
jxxghp
f803e6cc5c
feat(agent): add persistent Python read-only orchestration
2026-09-30 20:16:53 +08:00
jxxghp
fcd4cd1725
feat(agent): align execution guardrails with Hermes
2026-09-30 18:51:03 +08:00
InfinityPacer
8f9754b5f8
feat(api): serve API docs behind a runtime toggle, closed by default
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-30 18:03:37 +08:00
jxxghp
864ac1892e
feat(agent): align background learning with Hermes
2026-09-30 17:45:39 +08:00
jxxghp
47d51c3630
feat(agent): align history recall with Hermes SQLite FTS5
2026-09-30 16:28:39 +08:00
jxxghp
0678a17364
fix(music): reject conflicting recording and album identities
2026-09-30 16:18:09 +08:00
InfinityPacer
4847813ca7
feat(sdk): expose Feishu event long connection to plugins
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-30 15:39:30 +08:00
InfinityPacer
437b232773
perf(feishu): replace lark-oapi with lightweight OpenAPI and long-connection clients
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-30 14:59:42 +08:00
jxxghp
104d8028e8
feat(music): expose recognition evidence and release groups in transfer previews
2026-09-30 14:11:07 +08:00
InfinityPacer
4bd7e3dc04
perf(webpush): send Web Push with http-ece and py-vapid instead of pywebpush
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-30 13:20:00 +08:00
jxxghp
9b054bdf0c
feat(music): preserve classical credits and verify performance evidence
2026-09-30 12:55:21 +08:00
jxxghp
72fcd8413a
fix(music): verify artist aliases and preserve ambiguous identities
2026-09-30 11:42:23 +08:00
InfinityPacer
fb9d0204b6
perf(telegram): replace pyTelegramBotAPI with a lightweight Bot API client
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-30 11:36:30 +08:00
jxxghp
ee9fbf2264
feat(smb): mount multiple shares in one storage service
2026-09-30 11:27:24 +08:00
jxxghp
3a5486ae0d
feat(music): add bounded source fallback and verified album matching
2026-09-30 10:50:09 +08:00
jxxghp
61e9ef7d8e
fix(transfer): organize remote downloads on the SMB server
2026-09-30 10:36:56 +08:00
jxxghp
3a7b0c1efc
feat(music): validate bounded fingerprint candidates and recover failed lookups
2026-09-30 07:42:38 +08:00
jxxghp
7e43ea9676
ci: replace line budgets with structural complexity gates
2026-09-30 07:36:53 +08:00
jxxghp
4a2ef75706
fix(music): retry transient recognition before freezing file operations
2026-09-30 06:36:04 +08:00
jxxghp
54591ac50e
feat(music): bound recognition requests and make lookup caches recoverable
2026-09-30 05:15:14 +08:00
