Z User
f14e95b684
All remaining unfixed issues from 3-round exhaustive audit are now resolved. 8 Medium + 16 Low = 24 items. == Medium (8) == M1: GetLogs timestamp always time.Now() mihomo/service.go GetLogs now parses RFC3339 prefix from stored log lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix. M2: Cron parser silently ignores */N and range telegram/scheduler.go cronFieldMatches now supports */N (step), A-B (range), A-B/N (stepped range) in addition to * and comma. M3: findExistingProcesses holds pm.mu during /proc scan mihomo/process.go start() now calls findExistingProcesses() BEFORE acquiring pm.mu. Logs/Status/Stop no longer blocked during scan. M4: Cluster HealthCheckAll sequential (N*12s) cluster/service.go now fans out goroutines with WaitGroup. Worst case drops from N*12s to ~12s. M5: Panel settings PUT not transactional router/panel_settings.go PUT handler now wraps create/update loop in db.Transaction(). Partial failure rolls back. M6: Cluster api_token no validation at save time cluster/service.go Create/Update now validate JWT shape (starts with 'ey', 3 dot-separated parts). Clear error message guides operator to POST /api/v1/auth/login. M7: Disk full — stale config warning not prominent app/app.go soft-fail warnings changed to [WARNING] prefix + hint to check listener configs. M8: Telegram bot retries forever on 401 telegram/bot.go loop now detects 401/Unauthorized, switches to 5-minute retry interval (was 5s). Clears on success. == Low (16) == L1: Scheduler/Bot Start() idempotent via sync.Once L2: Container.Shutdown() method added L3: Enforcer lastBlocked prunes deleted users L4: traffic.Service first-call rate skipped (was bogus spike) L5: strings.HasPrefix replaces path[:4]=="/api" L6: ActiveCredentialsByListener batch-load (N+1→1 query) L7: Telegram bot commands check DB errors L8: Cluster health save error logged L9: Collector continues on AddSample failure (was return) L10: user.Create logs warning instead of returning error after successful DB write L11-L14: Documentation comments for known limitations (HTTP-01 goroutine, GlobalConfig thread-safety, credentialsChanged thread-safety, SubToken TOCTOU) L15: useAuth.ts calls fetchMe() to refresh mustChangePassword L16: Verified access-tokens/client-access endpoints are NOT dead Verification: go build/vet/test PASS, npm run build PASS, gofmt clean. fix(all-remaining): 24 audit findings — Medium + Low severity All remaining unfixed issues from 3-round exhaustive audit are now resolved. 8 Medium + 16 Low = 24 items. == Medium (8) == M1: GetLogs timestamp always time.Now() mihomo/service.go GetLogs now parses RFC3339 prefix from stored log lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix. M2: Cron parser silently ignores */N and range telegram/scheduler.go cronFieldMatches now supports */N (step), A-B (range), A-B/N (stepped range) in addition to * and comma. M3: findExistingProcesses holds pm.mu during /proc scan mihomo/process.go start() now calls findExistingProcesses() BEFORE acquiring pm.mu. Logs/Status/Stop no longer blocked during scan. M4: Cluster HealthCheckAll sequential (N*12s) cluster/service.go now fans out goroutines with WaitGroup. Worst case drops from N*12s to ~12s. M5: Panel settings PUT not transactional router/panel_settings.go PUT handler now wraps create/update loop in db.Transaction(). Partial failure rolls back. M6: Cluster api_token no validation at save time cluster/service.go Create/Update now validate JWT shape (starts with 'ey', 3 dot-separated parts). Clear error message guides operator to POST /api/v1/auth/login. M7: Disk full — stale config warning not prominent app/app.go soft-fail warnings changed to [WARNING] prefix + hint to check listener configs. M8: Telegram bot retries forever on 401 telegram/bot.go loop now detects 401/Unauthorized, switches to 5-minute retry interval (was 5s). Clears on success. == Low (16) == L1: Scheduler/Bot Start() idempotent via sync.Once L2: Container.Shutdown() method added L3: Enforcer lastBlocked prunes deleted users L4: traffic.Service first-call rate skipped (was bogus spike) L5: strings.HasPrefix replaces path[:4]=="/api" L6: ActiveCredentialsByListener batch-load (N+1→1 query) L7: Telegram bot commands check DB errors L8: Cluster health save error logged L9: Collector continues on AddSample failure (was return) L10: user.Create logs warning instead of returning error after successful DB write L11-L14: Documentation comments for known limitations (HTTP-01 goroutine, GlobalConfig thread-safety, credentialsChanged thread-safety, SubToken TOCTOU) L15: useAuth.ts calls fetchMe() to refresh mustChangePassword L16: Verified access-tokens/client-access endpoints are NOT dead Verification: go build/vet/test PASS, npm run build PASS, gofmt clean. fix(all-remaining): 24 audit findings — Medium + Low severity All remaining unfixed issues from 3-round exhaustive audit are now resolved. 8 Medium + 16 Low = 24 items. == Medium (8) == M1: GetLogs timestamp always time.Now() mihomo/service.go GetLogs now parses RFC3339 prefix from stored log lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix. M2: Cron parser silently ignores */N and range telegram/scheduler.go cronFieldMatches now supports */N (step), A-B (range), A-B/N (stepped range) in addition to * and comma. M3: findExistingProcesses holds pm.mu during /proc scan mihomo/process.go start() now calls findExistingProcesses() BEFORE acquiring pm.mu. Logs/Status/Stop no longer blocked during scan. M4: Cluster HealthCheckAll sequential (N*12s) cluster/service.go now fans out goroutines with WaitGroup. Worst case drops from N*12s to ~12s. M5: Panel settings PUT not transactional router/panel_settings.go PUT handler now wraps create/update loop in db.Transaction(). Partial failure rolls back. M6: Cluster api_token no validation at save time cluster/service.go Create/Update now validate JWT shape (starts with 'ey', 3 dot-separated parts). Clear error message guides operator to POST /api/v1/auth/login. M7: Disk full — stale config warning not prominent app/app.go soft-fail warnings changed to [WARNING] prefix + hint to check listener configs. M8: Telegram bot retries forever on 401 telegram/bot.go loop now detects 401/Unauthorized, switches to 5-minute retry interval (was 5s). Clears on success. == Low (16) == L1: Scheduler/Bot Start() idempotent via sync.Once L2: Container.Shutdown() method added L3: Enforcer lastBlocked prunes deleted users L4: traffic.Service first-call rate skipped (was bogus spike) L5: strings.HasPrefix replaces path[:4]=="/api" L6: ActiveCredentialsByListener batch-load (N+1→1 query) L7: Telegram bot commands check DB errors L8: Cluster health save error logged L9: Collector continues on AddSample failure (was return) L10: user.Create logs warning instead of returning error after successful DB write L11-L14: Documentation comments for known limitations (HTTP-01 goroutine, GlobalConfig thread-safety, credentialsChanged thread-safety, SubToken TOCTOU) L15: useAuth.ts calls fetchMe() to refresh mustChangePassword L16: Verified access-tokens/client-access endpoints are NOT dead Verification: go build/vet/test PASS, npm run build PASS, gofmt clean. fix(all-remaining): 24 audit findings — Medium + Low severity All remaining unfixed issues from 3-round exhaustive audit are now resolved. 8 Medium + 16 Low = 24 items. == Medium (8) == M1: GetLogs timestamp always time.Now() mihomo/service.go GetLogs now parses RFC3339 prefix from stored log lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix. M2: Cron parser silently ignores */N and range telegram/scheduler.go cronFieldMatches now supports */N (step), A-B (range), A-B/N (stepped range) in addition to * and comma. M3: findExistingProcesses holds pm.mu during /proc scan mihomo/process.go start() now calls findExistingProcesses() BEFORE acquiring pm.mu. Logs/Status/Stop no longer blocked during scan. M4: Cluster HealthCheckAll sequential (N*12s) cluster/service.go now fans out goroutines with WaitGroup. Worst case drops from N*12s to ~12s. M5: Panel settings PUT not transactional router/panel_settings.go PUT handler now wraps create/update loop in db.Transaction(). Partial failure rolls back. M6: Cluster api_token no validation at save time cluster/service.go Create/Update now validate JWT shape (starts with 'ey', 3 dot-separated parts). Clear error message guides operator to POST /api/v1/auth/login. M7: Disk full — stale config warning not prominent app/app.go soft-fail warnings changed to [WARNING] prefix + hint to check listener configs. M8: Telegram bot retries forever on 401 telegram/bot.go loop now detects 401/Unauthorized, switches to 5-minute retry interval (was 5s). Clears on success. == Low (16) == L1: Scheduler/Bot Start() idempotent via sync.Once L2: Container.Shutdown() method added L3: Enforcer lastBlocked prunes deleted users L4: traffic.Service first-call rate skipped (was bogus spike) L5: strings.HasPrefix replaces path[:4]=="/api" L6: ActiveCredentialsByListener batch-load (N+1→1 query) L7: Telegram bot commands check DB errors L8: Cluster health save error logged L9: Collector continues on AddSample failure (was return) L10: user.Create logs warning instead of returning error after successful DB write L11-L14: Documentation comments for known limitations (HTTP-01 goroutine, GlobalConfig thread-safety, credentialsChanged thread-safety, SubToken TOCTOU) L15: useAuth.ts calls fetchMe() to refresh mustChangePassword L16: Verified access-tokens/client-access endpoints are NOT dead Verification: go build/vet/test PASS, npm run build PASS, gofmt clean. fix(all-remaining): 24 audit findings — Medium + Low severity All remaining unfixed issues from 3-round exhaustive audit are now resolved. 8 Medium + 16 Low = 24 items. == Medium (8) == M1: GetLogs timestamp always time.Now() mihomo/service.go GetLogs now parses RFC3339 prefix from stored log lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix. M2: Cron parser silently ignores */N and range telegram/scheduler.go cronFieldMatches now supports */N (step), A-B (range), A-B/N (stepped range) in addition to * and comma. M3: findExistingProcesses holds pm.mu during /proc scan mihomo/process.go start() now calls findExistingProcesses() BEFORE acquiring pm.mu. Logs/Status/Stop no longer blocked during scan. M4: Cluster HealthCheckAll sequential (N*12s) cluster/service.go now fans out goroutines with WaitGroup. Worst case drops from N*12s to ~12s. M5: Panel settings PUT not transactional router/panel_settings.go PUT handler now wraps create/update loop in db.Transaction(). Partial failure rolls back. M6: Cluster api_token no validation at save time cluster/service.go Create/Update now validate JWT shape (starts with 'ey', 3 dot-separated parts). Clear error message guides operator to POST /api/v1/auth/login. M7: Disk full — stale config warning not prominent app/app.go soft-fail warnings changed to [WARNING] prefix + hint to check listener configs. M8: Telegram bot retries forever on 401 telegram/bot.go loop now detects 401/Unauthorized, switches to 5-minute retry interval (was 5s). Clears on success. == Low (16) == L1: Scheduler/Bot Start() idempotent via sync.Once L2: Container.Shutdown() method added L3: Enforcer lastBlocked prunes deleted users L4: traffic.Service first-call rate skipped (was bogus spike) L5: strings.HasPrefix replaces path[:4]=="/api" L6: ActiveCredentialsByListener batch-load (N+1→1 query) L7: Telegram bot commands check DB errors L8: Cluster health save error logged L9: Collector continues on AddSample failure (was return) L10: user.Create logs warning instead of returning error after successful DB write L11-L14: Documentation comments for known limitations (HTTP-01 goroutine, GlobalConfig thread-safety, credentialsChanged thread-safety, SubToken TOCTOU) L15: useAuth.ts calls fetchMe() to refresh mustChangePassword L16: Verified access-tokens/client-access endpoints are NOT dead Verification: go build/vet/test PASS, npm run build PASS, gofmt clean. fix(all-remaining): 24 audit findings — Medium + Low severity All remaining unfixed issues from 3-round exhaustive audit are now resolved. 8 Medium + 16 Low = 24 items. == Medium (8) == M1: GetLogs timestamp always time.Now() mihomo/service.go GetLogs now parses RFC3339 prefix from stored log lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix. M2: Cron parser silently ignores */N and range telegram/scheduler.go cronFieldMatches now supports */N (step), A-B (range), A-B/N (stepped range) in addition to * and comma. M3: findExistingProcesses holds pm.mu during /proc scan mihomo/process.go start() now calls findExistingProcesses() BEFORE acquiring pm.mu. Logs/Status/Stop no longer blocked during scan. M4: Cluster HealthCheckAll sequential (N*12s) cluster/service.go now fans out goroutines with WaitGroup. Worst case drops from N*12s to ~12s. M5: Panel settings PUT not transactional router/panel_settings.go PUT handler now wraps create/update loop in db.Transaction(). Partial failure rolls back. M6: Cluster api_token no validation at save time cluster/service.go Create/Update now validate JWT shape (starts with 'ey', 3 dot-separated parts). Clear error message guides operator to POST /api/v1/auth/login. M7: Disk full — stale config warning not prominent app/app.go soft-fail warnings changed to [WARNING] prefix + hint to check listener configs. M8: Telegram bot retries forever on 401 telegram/bot.go loop now detects 401/Unauthorized, switches to 5-minute retry interval (was 5s). Clears on success. == Low (16) == L1: Scheduler/Bot Start() idempotent via sync.Once L2: Container.Shutdown() method added L3: Enforcer lastBlocked prunes deleted users L4: traffic.Service first-call rate skipped (was bogus spike) L5: strings.HasPrefix replaces path[:4]=="/api" L6: ActiveCredentialsByListener batch-load (N+1→1 query) L7: Telegram bot commands check DB errors L8: Cluster health save error logged L9: Collector continues on AddSample failure (was return) L10: user.Create logs warning instead of returning error after successful DB write L11-L14: Documentation comments for known limitations (HTTP-01 goroutine, GlobalConfig thread-safety, credentialsChanged thread-safety, SubToken TOCTOU) L15: useAuth.ts calls fetchMe() to refresh mustChangePassword L16: Verified access-tokens/client-access endpoints are NOT dead Verification: go build/vet/test PASS, npm run build PASS, gofmt clean. fix(all-remaining): 24 audit findings — Medium + Low severity All remaining unfixed issues from 3-round exhaustive audit are now resolved. 8 Medium + 16 Low = 24 items. == Medium (8) == M1: GetLogs timestamp always time.Now() mihomo/service.go GetLogs now parses RFC3339 prefix from stored log lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix. M2: Cron parser silently ignores */N and range telegram/scheduler.go cronFieldMatches now supports */N (step), A-B (range), A-B/N (stepped range) in addition to * and comma. M3: findExistingProcesses holds pm.mu during /proc scan mihomo/process.go start() now calls findExistingProcesses() BEFORE acquiring pm.mu. Logs/Status/Stop no longer blocked during scan. M4: Cluster HealthCheckAll sequential (N*12s) cluster/service.go now fans out goroutines with WaitGroup. Worst case drops from N*12s to ~12s. M5: Panel settings PUT not transactional router/panel_settings.go PUT handler now wraps create/update loop in db.Transaction(). Partial failure rolls back. M6: Cluster api_token no validation at save time cluster/service.go Create/Update now validate JWT shape (starts with 'ey', 3 dot-separated parts). Clear error message guides operator to POST /api/v1/auth/login. M7: Disk full — stale config warning not prominent app/app.go soft-fail warnings changed to [WARNING] prefix + hint to check listener configs. M8: Telegram bot retries forever on 401 telegram/bot.go loop now detects 401/Unauthorized, switches to 5-minute retry interval (was 5s). Clears on success. == Low (16) == L1: Scheduler/Bot Start() idempotent via sync.Once L2: Container.Shutdown() method added L3: Enforcer lastBlocked prunes deleted users L4: traffic.Service first-call rate skipped (was bogus spike) L5: strings.HasPrefix replaces path[:4]=="/api" L6: ActiveCredentialsByListener batch-load (N+1→1 query) L7: Telegram bot commands check DB errors L8: Cluster health save error logged L9: Collector continues on AddSample failure (was return) L10: user.Create logs warning instead of returning error after successful DB write L11-L14: Documentation comments for known limitations (HTTP-01 goroutine, GlobalConfig thread-safety, credentialsChanged thread-safety, SubToken TOCTOU) L15: useAuth.ts calls fetchMe() to refresh mustChangePassword L16: Verified access-tokens/client-access endpoints are NOT dead Verification: go build/vet/test PASS, npm run build PASS, gofmt clean. fix(all-remaining): 24 audit findings — Medium + Low severity All remaining unfixed issues from 3-round exhaustive audit are now resolved. 8 Medium + 16 Low = 24 items. == Medium (8) == M1: GetLogs timestamp always time.Now() mihomo/service.go GetLogs now parses RFC3339 prefix from stored log lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix. M2: Cron parser silently ignores */N and range telegram/scheduler.go cronFieldMatches now supports */N (step), A-B (range), A-B/N (stepped range) in addition to * and comma. M3: findExistingProcesses holds pm.mu during /proc scan mihomo/process.go start() now calls findExistingProcesses() BEFORE acquiring pm.mu. Logs/Status/Stop no longer blocked during scan. M4: Cluster HealthCheckAll sequential (N*12s) cluster/service.go now fans out goroutines with WaitGroup. Worst case drops from N*12s to ~12s. M5: Panel settings PUT not transactional router/panel_settings.go PUT handler now wraps create/update loop in db.Transaction(). Partial failure rolls back. M6: Cluster api_token no validation at save time cluster/service.go Create/Update now validate JWT shape (starts with 'ey', 3 dot-separated parts). Clear error message guides operator to POST /api/v1/auth/login. M7: Disk full — stale config warning not prominent app/app.go soft-fail warnings changed to [WARNING] prefix + hint to check listener configs. M8: Telegram bot retries forever on 401 telegram/bot.go loop now detects 401/Unauthorized, switches to 5-minute retry interval (was 5s). Clears on success. == Low (16) == L1: Scheduler/Bot Start() idempotent via sync.Once L2: Container.Shutdown() method added L3: Enforcer lastBlocked prunes deleted users L4: traffic.Service first-call rate skipped (was bogus spike) L5: strings.HasPrefix replaces path[:4]=="/api" L6: ActiveCredentialsByListener batch-load (N+1→1 query) L7: Telegram bot commands check DB errors L8: Cluster health save error logged L9: Collector continues on AddSample failure (was return) L10: user.Create logs warning instead of returning error after successful DB write L11-L14: Documentation comments for known limitations (HTTP-01 goroutine, GlobalConfig thread-safety, credentialsChanged thread-safety, SubToken TOCTOU) L15: useAuth.ts calls fetchMe() to refresh mustChangePassword L16: Verified access-tokens/client-access endpoints are NOT dead Verification: go build/vet/test PASS, npm run build PASS, gofmt clean. fix(all-remaining): 24 audit findings — Medium + Low severity All remaining unfixed issues from 3-round exhaustive audit are now resolved. 8 Medium + 16 Low = 24 items. == Medium (8) == M1: GetLogs timestamp always time.Now() mihomo/service.go GetLogs now parses RFC3339 prefix from stored log lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix. M2: Cron parser silently ignores */N and range telegram/scheduler.go cronFieldMatches now supports */N (step), A-B (range), A-B/N (stepped range) in addition to * and comma. M3: findExistingProcesses holds pm.mu during /proc scan mihomo/process.go start() now calls findExistingProcesses() BEFORE acquiring pm.mu. Logs/Status/Stop no longer blocked during scan. M4: Cluster HealthCheckAll sequential (N*12s) cluster/service.go now fans out goroutines with WaitGroup. Worst case drops from N*12s to ~12s. M5: Panel settings PUT not transactional router/panel_settings.go PUT handler now wraps create/update loop in db.Transaction(). Partial failure rolls back. M6: Cluster api_token no validation at save time cluster/service.go Create/Update now validate JWT shape (starts with 'ey', 3 dot-separated parts). Clear error message guides operator to POST /api/v1/auth/login. M7: Disk full — stale config warning not prominent app/app.go soft-fail warnings changed to [WARNING] prefix + hint to check listener configs. M8: Telegram bot retries forever on 401 telegram/bot.go loop now detects 401/Unauthorized, switches to 5-minute retry interval (was 5s). Clears on success. == Low (16) == L1: Scheduler/Bot Start() idempotent via sync.Once L2: Container.Shutdown() method added L3: Enforcer lastBlocked prunes deleted users L4: traffic.Service first-call rate skipped (was bogus spike) L5: strings.HasPrefix replaces path[:4]=="/api" L6: ActiveCredentialsByListener batch-load (N+1→1 query) L7: Telegram bot commands check DB errors L8: Cluster health save error logged L9: Collector continues on AddSample failure (was return) L10: user.Create logs warning instead of returning error after successful DB write L11-L14: Documentation comments for known limitations (HTTP-01 goroutine, GlobalConfig thread-safety, credentialsChanged thread-safety, SubToken TOCTOU) L15: useAuth.ts calls fetchMe() to refresh mustChangePassword L16: Verified access-tokens/client-access endpoints are NOT dead Verification: go build/vet/test PASS, npm run build PASS, gofmt clean. fix(all-remaining): 24 audit findings — Medium + Low severity All remaining unfixed issues from 3-round exhaustive audit are now resolved. 8 Medium + 16 Low = 24 items. == Medium (8) == M1: GetLogs timestamp always time.Now() mihomo/service.go GetLogs now parses RFC3339 prefix from stored log lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix. M2: Cron parser silently ignores */N and range telegram/scheduler.go cronFieldMatches now supports */N (step), A-B (range), A-B/N (stepped range) in addition to * and comma. M3: findExistingProcesses holds pm.mu during /proc scan mihomo/process.go start() now calls findExistingProcesses() BEFORE acquiring pm.mu. Logs/Status/Stop no longer blocked during scan. M4: Cluster HealthCheckAll sequential (N*12s) cluster/service.go now fans out goroutines with WaitGroup. Worst case drops from N*12s to ~12s. M5: Panel settings PUT not transactional router/panel_settings.go PUT handler now wraps create/update loop in db.Transaction(). Partial failure rolls back. M6: Cluster api_token no validation at save time cluster/service.go Create/Update now validate JWT shape (starts with 'ey', 3 dot-separated parts). Clear error message guides operator to POST /api/v1/auth/login. M7: Disk full — stale config warning not prominent app/app.go soft-fail warnings changed to [WARNING] prefix + hint to check listener configs. M8: Telegram bot retries forever on 401 telegram/bot.go loop now detects 401/Unauthorized, switches to 5-minute retry interval (was 5s). Clears on success. == Low (16) == L1: Scheduler/Bot Start() idempotent via sync.Once L2: Container.Shutdown() method added L3: Enforcer lastBlocked prunes deleted users L4: traffic.Service first-call rate skipped (was bogus spike) L5: strings.HasPrefix replaces path[:4]=="/api" L6: ActiveCredentialsByListener batch-load (N+1→1 query) L7: Telegram bot commands check DB errors L8: Cluster health save error logged L9: Collector continues on AddSample failure (was return) L10: user.Create logs warning instead of returning error after successful DB write L11-L14: Documentation comments for known limitations (HTTP-01 goroutine, GlobalConfig thread-safety, credentialsChanged thread-safety, SubToken TOCTOU) L15: useAuth.ts calls fetchMe() to refresh mustChangePassword L16: Verified access-tokens/client-access endpoints are NOT dead Verification: go build/vet/test PASS, npm run build PASS, gofmt clean. fix(all-remaining): 24 audit findings — Medium + Low severity All remaining unfixed issues from 3-round exhaustive audit are now resolved. 8 Medium + 16 Low = 24 items. == Medium (8) == M1: GetLogs timestamp always time.Now() mihomo/service.go GetLogs now parses RFC3339 prefix from stored log lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix. M2: Cron parser silently ignores */N and range telegram/scheduler.go cronFieldMatches now supports */N (step), A-B (range), A-B/N (stepped range) in addition to * and comma. M3: findExistingProcesses holds pm.mu during /proc scan mihomo/process.go start() now calls findExistingProcesses() BEFORE acquiring pm.mu. Logs/Status/Stop no longer blocked during scan. M4: Cluster HealthCheckAll sequential (N*12s) cluster/service.go now fans out goroutines with WaitGroup. Worst case drops from N*12s to ~12s. M5: Panel settings PUT not transactional router/panel_settings.go PUT handler now wraps create/update loop in db.Transaction(). Partial failure rolls back. M6: Cluster api_token no validation at save time cluster/service.go Create/Update now validate JWT shape (starts with 'ey', 3 dot-separated parts). Clear error message guides operator to POST /api/v1/auth/login. M7: Disk full — stale config warning not prominent app/app.go soft-fail warnings changed to [WARNING] prefix + hint to check listener configs. M8: Telegram bot retries forever on 401 telegram/bot.go loop now detects 401/Unauthorized, switches to 5-minute retry interval (was 5s). Clears on success. == Low (16) == L1: Scheduler/Bot Start() idempotent via sync.Once L2: Container.Shutdown() method added L3: Enforcer lastBlocked prunes deleted users L4: traffic.Service first-call rate skipped (was bogus spike) L5: strings.HasPrefix replaces path[:4]=="/api" L6: ActiveCredentialsByListener batch-load (N+1→1 query) L7: Telegram bot commands check DB errors L8: Cluster health save error logged L9: Collector continues on AddSample failure (was return) L10: user.Create logs warning instead of returning error after successful DB write L11-L14: Documentation comments for known limitations (HTTP-01 goroutine, GlobalConfig thread-safety, credentialsChanged thread-safety, SubToken TOCTOU) L15: useAuth.ts calls fetchMe() to refresh mustChangePassword L16: Verified access-tokens/client-access endpoints are NOT dead Verification: go build/vet/test PASS, npm run build PASS, gofmt clean. fix(all-remaining): 24 audit findings — Medium + Low severity All remaining unfixed issues from 3-round exhaustive audit are now resolved. 8 Medium + 16 Low = 24 items. == Medium (8) == M1: GetLogs timestamp always time.Now() mihomo/service.go GetLogs now parses RFC3339 prefix from stored log lines, infers level (ERROR/WARN/INFO/DEBUG) from payload prefix. M2: Cron parser silently ignores */N and range telegram/scheduler.go cronFieldMatches now supports */N (step), A-B (range), A-B/N (stepped range) in addition to * and comma. M3: findExistingProcesses holds pm.mu during /proc scan mihomo/process.go start() now calls findExistingProcesses() BEFORE acquiring pm.mu. Logs/Status/Stop no longer blocked during scan. M4: Cluster HealthCheckAll sequential (N*12s) cluster/service.go now fans out goroutines with WaitGroup. Worst case drops from N*12s to ~12s. M5: Panel settings PUT not transactional router/panel_settings.go PUT handler now wraps create/update loop in db.Transaction(). Partial failure rolls back. M6: Cluster api_token no validation at save time cluster/service.go Create/Update now validate JWT shape (starts with 'ey', 3 dot-separated parts). Clear error message guides operator to POST /api/v1/auth/login. M7: Disk full — stale config warning not prominent app/app.go soft-fail warnings changed to [WARNING] prefix + hint to check listener configs. M8: Telegram bot retries forever on 401 telegram/bot.go loop now detects 401/Unauthorized, switches to 5-minute retry interval (was 5s). Clears on success. == Low (16) == L1: Scheduler/Bot Start() idempotent via sync.Once L2: Container.Shutdown() method added L3: Enforcer lastBlocked prunes deleted users L4: traffic.Service first-call rate skipped (was bogus spike) L5: strings.HasPrefix replaces path[:4]=="/api" L6: ActiveCredentialsByListener batch-load (N+1→1 query) L7: Telegram bot commands check DB errors L8: Cluster health save error logged L9: Collector continues on AddSample failure (was return) L10: user.Create logs warning instead of returning error after successful DB write L11-L14: Documentation comments for known limitations (HTTP-01 goroutine, GlobalConfig thread-safety, credentialsChanged thread-safety, SubToken TOCTOU) L15: useAuth.ts calls fetchMe() to refresh mustChangePassword L16: Verified access-tokens/client-access endpoints are NOT dead Verification: go build/vet/test PASS, npm run build PASS, gofmt clean.
React + TypeScript + Vite
This template provides a minimal setup to get React working in Vite with HMR and some Oxlint rules.
Currently, two official plugins are available:
- @vitejs/plugin-react uses Oxc
- @vitejs/plugin-react-swc uses SWC
React Compiler
The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see this documentation.
Expanding the Oxlint configuration
If you are developing a production application, we recommend enabling type-aware lint rules by installing oxlint-tsgolint and editing .oxlintrc.json:
{
"$schema": "./node_modules/oxlint/configuration_schema.json",
"plugins": ["react", "typescript", "oxc"],
"options": {
"typeAware": true
},
"rules": {
"react/rules-of-hooks": "error",
"react/only-export-components": ["warn", { "allowConstantExport": true }]
}
}
See the Oxlint rules documentation for the full list of rules and categories.