6 Commits

Author	SHA1	Message	Date
ZhenYi	4c4c33f970	refactor(git,gingress-proxy): apply rustfmt formatting	2026-05-14 10:02:00 +08:00
ZhenYi	14f6e1e500	feat(core): initialize project with access control and AI integration ... - Add gitignore and prettier configuration files for project scaffolding - Implement room access control service with project member verification - Create user access key management with CRUD operations and activity logging - Add accordion UI component for frontend expandable sections - Implement room AI configuration with list, upsert, and delete operations - Add AI event types for agent join/leave/status change tracking - Create streaming AI processing services for mode and react patterns - Build room AI service with model detection and idempotency handling - Integrate chat service orchestration for AI message processing - Add typing indicators and stream cancellation for AI interactions - Implement mention parsing and context extraction for AI agents	2026-05-03 06:04:31 +08:00
ZhenYi	bdb5393835	fix: resolve 30+ bugs from security audit ... Critical: - CORS: replace allow_any_origin + credentials with env-configured origins - XSS: escape HTML before dangerouslySetInnerHTML in search results - Path traversal: sanitize storage keys to reject ".." components - Auth missing: add Session requirement to git init/open/is-repo endpoints - Transaction: wrap issue cascade delete in DB transaction High: - Mutex poisoning: replace unwrap() with poison-recovering guards - Drop tokio::spawn: use runtime handle or fallback thread for lock release - Redis KEYS: replace with non-blocking SCAN for typing events - SSH panic: handle missing stdin/stdout/stderr gracefully - LFS auth: remove x-user-uid header injection vector, generate per-request tokens Medium: - Memory leak: remove Box::leak in provider normalization - Race conditions: query closed count directly instead of subtraction - Silent failures: add tracing::warn for AI tasks, room events, activity logs - Frontend nav: sync activeRoomId when initialRoomId prop changes - Duplicate nav: remove redundant setActiveRoom in delete handler - Callback conflict: skip undefined values in updateCallbacks merge - Stale closure: use wsClient state instead of wsClientRef.current in useMemo Low: - Captcha: validate captcha not empty before login submission - Broadcast capacity: reduce from 100K to 1000 - Error handling: add try/catch for removeMember and updateMemberRole - Loading state: show placeholder instead of null in RepositoryContextProvider - WebSocket: add heartbeat ping and jitter to reconnect backoff	2026-04-27 10:57:23 +08:00
ZhenYi	64dc27161b	chore(git): minor fixes and improvements across git library modules ... Apply small fixes across multiple git ops files: handle errors, improve type safety, and refine HTTP handler and SSH git operations.	2026-04-27 08:28:09 +08:00
ZhenYi	f5ab554d6b	fix(git): add LFS upload size limits and fix HTTP rate limiter read/write counter ... - Add LFS_MAX_OBJECT_SIZE (50 GiB) and validate object sizes in both the batch advisory check and the upload_object streaming loop to prevent unbounded disk usage from malicious clients - Fix HTTP rate limiter: track read_count and write_count separately so a burst of writes cannot exhaust the read budget (previously all operations incremented read_count regardless of type)	2026-04-16 20:14:13 +08:00
ZhenYi	93cfff9738	init	2026-04-15 09:08:09 +08:00