8 Commits

Author	SHA1	Message	Date
shinchan-zhai	d6dafd830e	fix: SSE streaming for no-tool path, batch ticker API, security & cleanup ... - Fix thinkAndActStream: emit delta event for non-tool responses (was silent) - Add fallback to streaming on first LLM call failure - Add batch ticker endpoint /api/agent/tickers (3 API calls → 1) - Update MarketTicker to use batch endpoint, remove unused state - Warn loudly when JWT_SECRET uses default value - Fix 华为 mapping (was incorrectly mapped to Tencent) - Replace ioutil.ReadAll with safe.ReadAllLimited in nofxos client - Remove unused variable in hyperliquid trader_account - Wrap CoinAnk WS readers with safe.GoNamed for panic recovery - Use 100dvh for mobile viewport in AgentChatPage - console.log → console.warn for auth events	2026-03-25 01:05:54 +08:00
shinchan-zhai	456570c37c	security: add safe.ReadAllLimited — bound all HTTP response body reads to 10MB ... - Created safe/io.go with ReadAllLimited helper (default 10MB limit) - Replaced 62 unbounded io.ReadAll(resp.Body) calls across 32 files - Covers all exchange traders (Hyperliquid, Bybit, Binance, OKX, Aster, KuCoin, Gate, Bitget, Lighter, Indodax), providers (CoinAnk, Alpaca, TwelveData), MCP client/x402, market data, wallet, telegram, kernel - Prevents OOM from malicious/buggy exchange API responses - Previously fixed: brain.go, sentinel.go already had manual LimitReader	2026-03-25 01:05:54 +08:00
shinchan-zhai	6acf925a0b	security: configurable CORS origins, limit sentinel response body ... - Add CORS_ALLOWED_ORIGINS config (comma-separated origins, default allow-all) - CORS middleware now validates Origin header against allowlist - Add io.LimitReader to sentinel.go (was unbounded, now 256KB) - Include previous: agent chat auth middleware + frontend token header	2026-03-25 01:05:54 +08:00
shinchan-zhai	f28f0e340c	security: login rate limiting, fix health endpoint, harden error handling ... - Fix health endpoint returning null time (use time.Now() instead of context value) - Add LoginRateLimiter: 5 attempts per 15min window, 5min block on brute-force - Apply rate limiting to login/register endpoints - Move reset-password to authenticated routes (was unauthenticated — critical vuln) - Limit response body sizes on proxy/external API calls (prevent memory exhaustion) - Sanitize error messages in agent chat endpoint (don't leak internal errors) - Record login success/failure for rate limiting tracking	2026-03-25 01:05:54 +08:00
shinchan-zhai	e2de4e8d0b	feat: US stock pre-market/after-hours data support ... - Parse extended hours fields from Sina Finance API (field 21-24) - Display pre-market/after-hours price, change%, and time in stock quotes - Update system prompt: stocks have real-time data via search_stock tool - Remove incorrect 'no real-time stock data' disclaimer	2026-03-25 01:05:54 +08:00
shinchan-zhai	5676ba2e5c	feat: dynamic stock search via Sina suggest API ... - Add searchStock() using Sina's suggest API (type=11,31,41) - Supports A-share, HK, and US markets dynamically - No longer limited to hardcoded knownStocks map - resolveStockCodeDynamic: tries static map first, then API fallback - extractStockKeyword: smart keyword extraction from natural language - New LLM tool 'search_stock': agent can proactively search stocks - Top 3 search results auto-enriched with real-time quotes - System prompts updated for both zh/en	2026-03-25 01:05:54 +08:00
shinchan-zhai	2cb8970e23	feat: real-time data for A-shares, HK stocks, and US stocks ... Data source: Sina Finance API (free, no key needed) - A股: sh/sz prefix, GBK→UTF-8, 30+ fields - 港股: hk prefix, different field layout - 美股: gb_ prefix, USD prices Coverage: - 20+ A-share stocks (拓维信息/贵州茅台/比亚迪/宁德时代...) - 12 HK stocks (腾讯/阿里/美团/小米/京东...) - 20 US tickers (AAPL/TSLA/NVDA/MSFT/GOOGL/AMZN...) - Auto-detect 6-digit A-share codes, 5-digit HK codes - US ticker symbols recognized (TSLA, AAPL, etc.) All three markets tested: - A股 拓维信息: ¥35.57 (-6.71%) ✅ - 港股 腾讯: HK$510.50 (-0.49%) ✅ - 美股 TSLA: $367.96 (-3.24%) ✅	2026-03-25 01:05:54 +08:00
shinchan-zhai	53db1c72ac	feat: real-time A-share stock data via Sina Finance API ... NOFXi can now fetch REAL stock prices for A-shares. Data source: Sina Finance hq.sinajs.cn (free, no API key) - Name, price, open, prev close, high, low, volume, turnover - Change % calculated from prev close - GBK → UTF-8 encoding handled Stock resolution: - Known stocks: 拓维信息→sz002261, 贵州茅台→sh600519, etc. - Auto-detect 6-digit codes in user text - Prefix detection: 6xx→sh, 0xx/3xx→sz Context injection: - Stock data auto-appended to LLM context when user mentions a stock - AI sees REAL price, volume, change % — cannot fabricate Tested: '拓维信息这只股，10万元，1个月交易计划' → Returns ¥35.57 (real price), -6.71% (real change), 53.94亿成交额 → Strategy based on actual price levels, not hallucinated	2026-03-25 01:05:54 +08:00