3 Commits

Include renames

Author	SHA1	Message	Date
stroblmeandClaude Opus 5	57eace2226	Bound what the API accepts, and close the holes the audit found ... **SQLite is the database, and now says so.** `metric_minute` and every run table are written with `sqlalchemy.dialects.sqlite.insert(...) .on_conflict_do_update` and with `max(a, b)`, neither of which another dialect has — so pointing `DATABASE_URL` at Postgres migrated cleanly, served, logged in, and then lost every observability flush into the collector's hold buffer and failed every run. It refuses at startup instead. (The Postgres in the compose stack is Umami's; the engine's own database has been a file beside the flows since 2026-08-21.) **Every integer query parameter is bounded.** The caps were written as `min(limit, 500)`, which a negative walks straight through — `?limit=-1` compiles to `LIMIT -1` and SQLite returns the whole table. Ten signatures, now `Query(ge=…, le=…)`. `hours=0` still means an hour, which `_window_hours` was already deliberate about. **Exports are capped at 10 000 runs** and say so with `X-Truncated`. The filters bounded a sensible request and nothing bounded an unfiltered one, which read every row into memory before a byte was streamed. `_series` resolves cached curves in two queries rather than a `Run` lookup and a `RunMetric` query per restored node — a comparison of twenty runs was calling that twenty times over. **`PUT /artifacts` has a size limit** (`MAX_ARTIFACT_BYTES`, 2 GiB, 0 to disable), checked against `Content-Length` and again against the stream for a chunked body, and its writes moved off the event loop. **`/observability/timeseries` takes `since`/`until`**, the same window `/runs` and `/events` take, capped at 2000 points — `hours=720&bucket_s=60` was 43 200 of them in one array. It is also what a dragged chart needs to re-fetch at its own resolution rather than magnifying buckets it has. **Composite indexes** for the three list screens: `run(flow, created_at)` and `(status, created_at)`, `flow_run(flow, started_at)`, `engine_event(type, ts)`. Every index was single-column, so SQLite picked one and sorted the rest by hand. Verified against a copy of a live database (250k `flow_run` rows): the planner takes all four. **Redis clients have socket timeouts.** A Redis that stops answering without closing the connection hung the caller until the kernel gave up — including `/utils/health/`, whose job is to notice. **The panels file is written under one lock.** `save_panels` and `unpair_panel` are both read-modify-write, and a save that read before an unpair wrote put the old nonce back — silently un-revoking a screen that had just been unpaired. The nonce carry-forward was written to make that impossible; the gap between its read and its write is where it happened. **Startup releases what it acquired.** Everything past `event_bus.bind` registers how to close itself and the `finally` walks that list backwards; a failure part-way through used to reach none of the shutdown steps and leave the worker pool's subprocesses and every background task behind — under `--reload`, once per bad edit. `modules.reconcile` moved into the background: `uv` gets five minutes twice over, the healthcheck allows eighty seconds, and the autoheal restarted the container before it could finish installing. `delete_run` takes SQLite's write lock up front (`core.db.writing`) rather than upgrading a deferred transaction and losing to whichever flush committed in between. `modules.sync` is serialised — two applies mutated one venv at once. The proxied-call and stream dicts are bounded, and a reused id cancels its predecessor instead of dropping the reference. Security, found in passing and small enough to fix here: - **`/secrets/` required only a signed-in user.** The names alone say what this installation talks to, and `PUT /{name}` takes any name, so any account could overwrite the credential a flow authenticates with. Superuser now — which `/search` already assumed and said so. - **`POST /login/access-token` had no rate limit.** Argon2 is deliberately expensive and the route is unauthenticated and runs in the shared threadpool. Ten *failed* attempts per address per five minutes; a successful sign-in spends nothing. - **a password reset link worked repeatedly for 48 hours.** The token now carries a digest of the password hash it was minted against, so it stops verifying once it has set one. No table of spent tokens needed. - **enrolment accepted `http://`**, sending the claim code and then this installation's credential in clear. https, or a local address. - the rate limiter read `request.client.host`, which behind Traefik is the proxy — so every per-address limit was one global bucket and one caller could lock out everyone. It reads the forwarded address, and its bucket table is capped rather than growing one key per address forever. - SMTP has a timeout and sends after the response, so an unreachable mail host cannot pin a threadpool worker, and a reply's timing no longer says whether the address exists. Test suite: engine-written rows are cleared between modules. A `FlowRun` left `running` by one module turned up in another's query. Per-test rollback is not available here — the module-scoped `client` runs the real lifespan and its collector and run service write through sessions of their own — so this bounds it where the writes come from. Three consecutive green runs, orders randomised. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M6hPWS6YEbT1P8LxhhFb2T	2026-08-29 20:40:05 +02:00
stroblmeandClaude Opus 5	0ffcabfdb9	Media dtypes: image, audio and video as narrowed artifact references ... A port may now declare `image`, `audio` or `video`. Each is the artifact reference the engine already had, narrowed by the `media_type` on it, so a speech recogniser declares what it eats rather than taking any bytes at all and finding out. Bytes still never travel as a message and nothing on the wire stops being JSON: a camera publishes one reference per frame, a microphone one per chunk, and a reference may carry a `meta` dict nothing here interprets. Streaming media is therefore an ordinary streaming port — with one change to what that means. An emission used to journal an item with no payload, so downstream read whatever was current when the item was claimed; a consumer slower than its producer saw only the newest chunk and the ones between were lost. That is right for a training curve and wrong for a second of speech, so an emission now journals a `kind="emission"` item carrying its values, and the executor hands them to the nodes reading that message instead of writing them to state again. The value in state stays the latest, which is what everything else reads, and the wave is filtered by what actually changed rather than walking everything reachable. No queue serialization change — the existing `outputs` field carries it. Continuous media makes the store's missing GC a real problem, so this closes it: `sweep_artifacts` runs hourly, keeps every digest a `run_artifact` row records or a live message holds, spares anything written in the last hour, and stands aside entirely while a run is in flight, since a node may store a checkpoint long before it returns the reference to it. That also collects the orphans a deleted flow has always left behind. `ARTIFACT_GC_INTERVAL_S=0` turns it off. Around the edges: `GET /artifacts/{digest}` serves the media type the caller passes and answers ranged requests, so a browser plays a clip rather than downloading it; `PUT` spools to disk instead of holding the whole body in memory, as does `save_artifact` given a path; a Media widget draws whatever its message points at, and a wall panel may fetch the bytes its own tiles are showing and nothing else; and a connector gets `save_artifact`, for a device whose readings are bytes. What this cannot do is live video: a frame every second or two is a glance, and the honest answer above that is the camera's own stream, which the widget takes as a URL and the browser plays from source. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-26 23:44:55 +02:00
stroblmeandClaude Opus 5	60d7ec81c0	Rename the import package app to fluksio ... A wheel whose top-level module is `app` collides with anything else in a user's venv, so the package that is about to be published takes the name it is published under. Only the Python package moves; the repo, the Docker WORKDIR and the compose project keep theirs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-21 21:48:05 +02:00