From 7ccac89e2b8e55349e0ffddf2a632054318e3b23 Mon Sep 17 00:00:00 2001 From: shinchan-zhai Date: Mon, 23 Mar 2026 11:00:48 +0800 Subject: [PATCH] =?UTF-8?q?docs:=20update=20nofxi-tasks.md=20=E2=80=94=20r?= =?UTF-8?q?ecord=2010:52=20batch=20progress?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- nofxi-tasks.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/nofxi-tasks.md b/nofxi-tasks.md index 6c0b2709..2ed6caeb 100644 --- a/nofxi-tasks.md +++ b/nofxi-tasks.md @@ -55,7 +55,19 @@ - [DONE] Sanitize 3 more error message leaks in API responses (handler_trader.go ×2, handler_ai_cost.go ×1) - [PENDING] `context.Background()` used in ~69 exchange/trader calls — should propagate request context for proper cancellation (partially done: kline handlers fixed, trader/exchange calls remain) +### Security — Response Body Limits +- [DONE] Created `safe/io.go` with `ReadAllLimited` (default 10MB limit) to prevent OOM from malicious responses +- [DONE] Replaced 62 unbounded `io.ReadAll(resp.Body)` calls across 32 files (all exchange traders, providers, MCP, market, wallet, telegram, kernel) + +### Robustness — HTTP Status Code Checks +- [DONE] Add HTTP status code checks in market/api_client.go (exchangeInfo, klines, price) +- [DONE] Add HTTP status code checks in market/data.go (openInterest, premiumIndex) +- [DONE] Add HTTP status code checks in provider/coinank (GET + POST) +- [DONE] Add HTTP status code checks in provider/twelvedata (timeSeries + quote) +- [DONE] Add `truncateBody` helper for safe error messages + ### Performance +- [DONE] Reuse shared HTTP client in Hyperliquid trader (was creating new client per API call, preventing TCP/TLS connection reuse) - [PENDING] `gatherContext` in agent.go iterates all traders and positions on every message — consider caching (low priority: only triggered per user message) ### Features