Commit Graph

7 Commits

Author SHA1 Message Date
shinchan-zhai
982ee668c9 security: add safe.ReadAllLimited — bound all HTTP response body reads to 10MB
- Created safe/io.go with ReadAllLimited helper (default 10MB limit)
- Replaced 62 unbounded io.ReadAll(resp.Body) calls across 32 files
- Covers all exchange traders (Hyperliquid, Bybit, Binance, OKX, Aster,
  KuCoin, Gate, Bitget, Lighter, Indodax), providers (CoinAnk, Alpaca,
  TwelveData), MCP client/x402, market data, wallet, telegram, kernel
- Prevents OOM from malicious/buggy exchange API responses
- Previously fixed: brain.go, sentinel.go already had manual LimitReader
2026-03-23 10:55:03 +08:00
shinchan-zhai
f26a69d222 security: configurable CORS origins, limit sentinel response body
- Add CORS_ALLOWED_ORIGINS config (comma-separated origins, default allow-all)
- CORS middleware now validates Origin header against allowlist
- Add io.LimitReader to sentinel.go (was unbounded, now 256KB)
- Include previous: agent chat auth middleware + frontend token header
2026-03-23 09:53:49 +08:00
shinchan-zhai
9c49a4c8cc security: login rate limiting, fix health endpoint, harden error handling
- Fix health endpoint returning null time (use time.Now() instead of context value)
- Add LoginRateLimiter: 5 attempts per 15min window, 5min block on brute-force
- Apply rate limiting to login/register endpoints
- Move reset-password to authenticated routes (was unauthenticated — critical vuln)
- Limit response body sizes on proxy/external API calls (prevent memory exhaustion)
- Sanitize error messages in agent chat endpoint (don't leak internal errors)
- Record login success/failure for rate limiting tracking
2026-03-23 09:43:20 +08:00
shinchan-zhai
4fff212dcd feat: US stock pre-market/after-hours data support
- Parse extended hours fields from Sina Finance API (field 21-24)
- Display pre-market/after-hours price, change%, and time in stock quotes
- Update system prompt: stocks have real-time data via search_stock tool
- Remove incorrect 'no real-time stock data' disclaimer
2026-03-23 09:20:38 +08:00
shinchan-zhai
d8d136ced6 feat: dynamic stock search via Sina suggest API
- Add searchStock() using Sina's suggest API (type=11,31,41)
- Supports A-share, HK, and US markets dynamically
- No longer limited to hardcoded knownStocks map
- resolveStockCodeDynamic: tries static map first, then API fallback
- extractStockKeyword: smart keyword extraction from natural language
- New LLM tool 'search_stock': agent can proactively search stocks
- Top 3 search results auto-enriched with real-time quotes
- System prompts updated for both zh/en
2026-03-23 02:54:20 +08:00
shinchan-zhai
5382e89cae feat: real-time data for A-shares, HK stocks, and US stocks
Data source: Sina Finance API (free, no key needed)
- A股: sh/sz prefix, GBK→UTF-8, 30+ fields
- 港股: hk prefix, different field layout
- 美股: gb_ prefix, USD prices

Coverage:
- 20+ A-share stocks (拓维信息/贵州茅台/比亚迪/宁德时代...)
- 12 HK stocks (腾讯/阿里/美团/小米/京东...)
- 20 US tickers (AAPL/TSLA/NVDA/MSFT/GOOGL/AMZN...)
- Auto-detect 6-digit A-share codes, 5-digit HK codes
- US ticker symbols recognized (TSLA, AAPL, etc.)

All three markets tested:
- A股 拓维信息: ¥35.57 (-6.71%) 
- 港股 腾讯: HK$510.50 (-0.49%) 
- 美股 TSLA: $367.96 (-3.24%) 
2026-03-23 01:44:28 +08:00
shinchan-zhai
bd6fe6bd6d feat: real-time A-share stock data via Sina Finance API
NOFXi can now fetch REAL stock prices for A-shares.

Data source: Sina Finance hq.sinajs.cn (free, no API key)
- Name, price, open, prev close, high, low, volume, turnover
- Change % calculated from prev close
- GBK → UTF-8 encoding handled

Stock resolution:
- Known stocks: 拓维信息→sz002261, 贵州茅台→sh600519, etc.
- Auto-detect 6-digit codes in user text
- Prefix detection: 6xx→sh, 0xx/3xx→sz

Context injection:
- Stock data auto-appended to LLM context when user mentions a stock
- AI sees REAL price, volume, change % — cannot fabricate

Tested: '拓维信息这只股,10万元,1个月交易计划'
→ Returns ¥35.57 (real price), -6.71% (real change), 53.94亿成交额
→ Strategy based on actual price levels, not hallucinated
2026-03-23 01:41:40 +08:00