14 Commits

Author	SHA1	Message	Date
shinchan-zhai	812972c5e8	docs: update nofxi-tasks.md with latest fixes	2026-03-23 19:20:26 +08:00
shinchan-zhai	c6c4cac57a	docs: update nofxi-tasks.md with Alpaca bug fixes	2026-03-23 19:05:45 +08:00
shinchan-zhai	2b2e7d815f	docs: update nofxi-tasks.md — record 12:52 batch	2026-03-23 12:59:20 +08:00
shinchan-zhai	e65093f35e	docs: update nofxi-tasks.md — record 12:37 batch	2026-03-23 12:45:03 +08:00
shinchan-zhai	809b95d316	docs: update nofxi-tasks.md — record 12:22 batch	2026-03-23 12:29:43 +08:00
shinchan-zhai	2dbbc82506	docs: update nofxi-tasks.md with panic prevention work	2026-03-23 12:02:06 +08:00
shinchan-zhai	79b583bd9a	docs: update nofxi-tasks.md — record 11:22 batch	2026-03-23 11:29:16 +08:00
shinchan-zhai	7ccac89e2b	docs: update nofxi-tasks.md — record 10:52 batch progress	2026-03-23 11:00:48 +08:00
shinchan-zhai	982ee668c9	security: add safe.ReadAllLimited — bound all HTTP response body reads to 10MB ... - Created safe/io.go with ReadAllLimited helper (default 10MB limit) - Replaced 62 unbounded io.ReadAll(resp.Body) calls across 32 files - Covers all exchange traders (Hyperliquid, Bybit, Binance, OKX, Aster, KuCoin, Gate, Bitget, Lighter, Indodax), providers (CoinAnk, Alpaca, TwelveData), MCP client/x402, market data, wallet, telegram, kernel - Prevents OOM from malicious/buggy exchange API responses - Previously fixed: brain.go, sentinel.go already had manual LimitReader	2026-03-23 10:55:03 +08:00
shinchan-zhai	1d0d6f7afd	security: sanitize internal error messages in API responses ... - handler_trader.go: remove loadErr.Error() from 500 responses (2 instances) - handler_ai_cost.go: replace err.Error() with generic message, add logging - Internal errors now logged server-side, not exposed to clients	2026-03-23 10:46:22 +08:00
shinchan-zhai	ef438b4240	docs: update nofxi-tasks.md — record complete panic recovery coverage	2026-03-23 10:30:32 +08:00
shinchan-zhai	07b4f30b85	docs: update nofxi-tasks.md — record 10:07 batch progress	2026-03-23 10:15:41 +08:00
shinchan-zhai	cbf78e6b88	docs: update nofxi-tasks.md — mark completed, clean false positives	2026-03-23 09:54:53 +08:00
shinchan-zhai	f26a69d222	security: configurable CORS origins, limit sentinel response body ... - Add CORS_ALLOWED_ORIGINS config (comma-separated origins, default allow-all) - CORS middleware now validates Origin header against allowlist - Add io.LimitReader to sentinel.go (was unbounded, now 256KB) - Include previous: agent chat auth middleware + frontend token header	2026-03-23 09:53:49 +08:00