3 Commits

Author	SHA1	Message	Date
ZhenYi	bdb5393835	fix: resolve 30+ bugs from security audit ... Critical: - CORS: replace allow_any_origin + credentials with env-configured origins - XSS: escape HTML before dangerouslySetInnerHTML in search results - Path traversal: sanitize storage keys to reject ".." components - Auth missing: add Session requirement to git init/open/is-repo endpoints - Transaction: wrap issue cascade delete in DB transaction High: - Mutex poisoning: replace unwrap() with poison-recovering guards - Drop tokio::spawn: use runtime handle or fallback thread for lock release - Redis KEYS: replace with non-blocking SCAN for typing events - SSH panic: handle missing stdin/stdout/stderr gracefully - LFS auth: remove x-user-uid header injection vector, generate per-request tokens Medium: - Memory leak: remove Box::leak in provider normalization - Race conditions: query closed count directly instead of subtraction - Silent failures: add tracing::warn for AI tasks, room events, activity logs - Frontend nav: sync activeRoomId when initialRoomId prop changes - Duplicate nav: remove redundant setActiveRoom in delete handler - Callback conflict: skip undefined values in updateCallbacks merge - Stale closure: use wsClient state instead of wsClientRef.current in useMemo Low: - Captcha: validate captcha not empty before login submission - Broadcast capacity: reduce from 100K to 1000 - Error handling: add try/catch for removeMember and updateMemberRole - Loading state: show placeholder instead of null in RepositoryContextProvider - WebSocket: add heartbeat ping and jitter to reconnect backoff	2026-04-27 10:57:23 +08:00
ZhenYi	0e53f4a69f	fix(room): fix two major memory leaks ... 1. WS disconnect now unsubscribes from user_notification_inner. Previously, every WebSocket connection created a broadcast channel for user notifications that was never removed on disconnect, causing unbounded growth proportional to unique connected users over time. 2. Room worker tasks now use the manager's room_shutdown_txs channel instead of a local broadcast channel. shutdown_room() sends on this channel, so when a room is deleted the worker task receives the signal and terminates, releasing its DashMap (capacity 10,000) and all captured closures. Previously the worker ran forever.	2026-04-26 16:52:20 +08:00
ZhenYi	f5e3da35b0	feat(room): store ordered streaming chunks + billing integration ... - Save thinking_content as {"__chunks__": [{type, content}]} for replay - Tool call sanitization — don't expose raw results to frontend - Billing record_ai_usage integration - Room service module refactoring into service/ directory	2026-04-26 13:10:42 +08:00