GRAB Racem 2aab3e8210 fix(auth): require a setup token for /api/auth/init and bind 8787 to localhost ...

POST /api/auth/init accepted any caller while auth.password_hash was empty,
so whoever reached port 8787 first could set the admin password and take the
instance. When no password is set at startup, the server now generates a
random one-time setup token and writes it to the server log. authInit
compares it in constant time, rejects a missing or wrong token with 403, and
clears it once the password is stored.

The setup page has a field for the token and api.initPassword sends it.
docker-compose publishes 8787 on 127.0.0.1 only, like 8788. README says where
to find the token.

2026-11-03 22:18:27 +01:00

..

ask_operator_test.go

feat: ask_operator environmental handoff discipline

2026-10-12 06:45:21 +02:00

ask_operator.go

feat: ask_operator environmental handoff discipline

2026-10-12 06:45:21 +02:00

assembly_test.go

chore: ARTEX 初始化

2026-07-26 04:27:45 -04:00

assembly.go

feat: first-layer prompt-injection hardening for agents

2026-10-12 00:58:53 +02:00

asset_intercept.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

assets_scope_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

assets.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

auth_test.go

fix(auth): require a setup token for /api/auth/init and bind 8787 to localhost

2026-11-03 22:18:27 +01:00

auth.go

fix(auth): require a setup token for /api/auth/init and bind 8787 to localhost

2026-11-03 22:18:27 +01:00

broadcast.go

chore: ARTEX 初始化

2026-07-26 04:27:45 -04:00

chat_llm_resolve_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

chat_mentions_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

chat_mentions.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

chatupload.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

commands.go

chore: sync upstream v0.3.6 changes

2026-08-28 14:03:07 +08:00

constraints_api.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

conversation_status_test.go

feat: 支持会话级漏洞复测与运行状态展示

2026-09-10 16:06:08 +08:00

conversations.go

ollama llm

2026-10-23 18:12:38 -03:00

core_test.go

fix: test isolation for the escalation streak + compliant goal fixtures

2026-10-21 15:08:37 +02:00

cost_ledger_test.go

fix: cost ledger charges fresh input only (cache read is part of input tokens)

2026-10-12 08:53:20 +02:00

customtool_test.go

fix(tools): MCP/自定义工具输出统一走 Capture 截断，修复 mcp 截断不生效 (#176)

2026-09-29 10:09:23 -04:00

customtool.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

dto.go

feat(engine): per-intent LLM chain-head rotation (opt-in llm_rotate)

2026-10-21 15:00:16 +02:00

engine_cancelcause_test.go

重构 worker 对话：复用 resume 机制，改专属 goroutine 运行

2026-08-31 09:00:21 -04:00

engine_emptyturn_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

engine_llm_calls_test.go

feat(llm): add profile failover and pool health

2026-08-24 19:28:18 +08:00

engine_timeout.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

engine.go

feat(engine): per-intent LLM chain-head rotation (opt-in llm_rotate)

2026-10-21 15:00:16 +02:00

env_scrub_test.go

fix(security): scrub startup secrets before any child can spawn

2026-11-03 22:14:35 +01:00

env_scrub.go

fix(security): scrub startup secrets before any child can spawn

2026-11-03 22:14:35 +01:00

finding_retests_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

finding_retests.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

finding_traffic_export.go

feat: 支持漏洞关联多条流量证据

2026-09-10 13:03:20 +08:00

finding_traffic_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

finding_traffic.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

finding_workflow_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

finding_workflow.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

findings_groups_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

findings_groups.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

goal_gate_test.go

feat(engine): ouroboros takes - goal ambiguity gate, failover escalation, stagnation surfacing

2026-10-21 14:46:56 +02:00

goal_gate.go

feat(engine): ouroboros takes - goal ambiguity gate, failover escalation, stagnation surfacing

2026-10-21 14:46:56 +02:00

goals_api.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

goals_test.go

feat(tasks): add runtime controls and inherited context

2026-08-24 19:29:00 +08:00

goals.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

inheritance_api_test.go

fix: inheritance test teardown closes the manager after the DeleteTask cleanups

2026-10-12 18:43:41 +02:00

inheritance_dto_test.go

feat(tasks): add runtime controls and inherited context

2026-08-24 19:29:00 +08:00

intent_intervention.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

intercept_detail_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

intercept_filter_test.go

Skip the four known-broken tests in code instead of CI -skip flags

2026-10-10 18:12:42 +02:00

intercept_live_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

intercept_review_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

intercept.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

lessons_test.go

feat(rsi): evidence-gated lesson library in shadow mode

2026-10-21 14:25:35 +02:00

lessons.go

feat(rsi): evidence-gated lesson library in shadow mode

2026-10-21 14:25:35 +02:00

llm_ollama_test.go

fix(ollama): normalize the base URL on the environment path too

2026-11-02 17:03:57 +01:00

llm_test_fallback_test.go

fix: llm/test stored profile fills endpoint fields from the row

2026-10-12 08:54:29 +02:00

llmpool_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

llmpool.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

llmrec_raw_test.go

feat(llmrec): 录制 LLM 请求/响应 HTTP 原文

2026-08-25 09:40:05 -04:00

llmretry_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

llmretry.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

logsink.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

manager_delete_files_test.go

feat(tasks): add runtime controls and inherited context

2026-08-24 19:29:00 +08:00

manager_lifecycle_test.go

feat(tasks): add runtime controls and inherited context

2026-08-24 19:29:00 +08:00

manager.go

feat(engine): per-intent LLM chain-head rotation (opt-in llm_rotate)

2026-10-21 15:00:16 +02:00

mcp_health_test.go

feat: surface MCP server connect health to operators and agents

2026-10-11 22:50:00 +02:00

mcpdiscover.go

feat: surface MCP server connect health to operators and agents

2026-10-11 22:50:00 +02:00

mgmt_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

notifier.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

notify_api_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

notify_api.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

orchestration.go

ollama llm

2026-10-23 18:12:38 -03:00

planner_quiet_test.go

feat: per-task planner quiet-mode switch, editable mid-run

2026-10-12 21:13:28 +02:00

platform_tools_test.go

chore: ARTEX 初始化

2026-07-26 04:27:45 -04:00

platform_tools.go

feat: ask_operator tool - workers can request operator input (captcha/OTP) with a screenshot and pause

2026-10-11 23:06:39 +02:00

prompt_vars_test.go

同步

2026-08-24 14:14:15 +08:00

scheduler.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

server_mgmt.go

fix(ollama): keyless env config and /v1 base URL normalization

2026-10-25 19:18:25 +01:00

server.go

fix(auth): require a setup token for /api/auth/init and bind 8787 to localhost

2026-11-03 22:18:27 +01:00

shipped_skills_test.go

feat: codeaudit skill (white-box source audit pipeline)

2026-10-12 06:41:22 +02:00

side_questions_test.go

feat(intent): 意图删除支持假删除/真删除两种模式

2026-09-17 12:52:57 -04:00

side_questions.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

skill_frontmatter_test.go

fix: emit safe skill frontmatter YAML and verify it round-trips

2026-10-11 22:26:22 +02:00

skill_gaps_test.go

feat(server): capability-gap report from skill misses

2026-10-19 00:33:08 +02:00

skill_gaps.go

feat(server): capability-gap report from skill misses

2026-10-19 00:33:08 +02:00

skill_upload_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

skill_usage.go

feat(skills): track usage and missing dependencies

2026-08-24 19:30:14 +08:00

skill_zip.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

sync_scopesentry.go

feat: rea reverse-engineering skill + per-server MCP HTTP request timeout

2026-10-11 19:02:23 +02:00

task_admission_test.go

同步

2026-08-24 14:14:15 +08:00

task_archive_package_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

task_archive_package.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

task_archives_test.go

归档

2026-08-28 12:56:29 +08:00

task_archives.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

task_assets.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

task_categories_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

task_categories.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

task_control_routes_test.go

feat(tasks): add runtime controls and inherited context

2026-08-24 19:29:00 +08:00

task_control.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

task_credentials_test.go

fix: test isolation for the escalation streak + compliant goal fixtures

2026-10-21 15:08:37 +02:00

task_credentials.go

feat(tasks): per-task test-account credentials

2026-10-09 14:28:08 +02:00

task_delete_barrier_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

task_detail_metrics_test.go

fix(server): fill task metrics on the detail endpoint

2026-10-13 14:49:47 +02:00

task_intercept.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

task_llm_escalation_test.go

fix(test): escalation test to the ctx-aware hooks.current signature

2026-10-21 15:16:25 +02:00

task_llm_rotation_test.go

feat(engine): per-intent LLM chain-head rotation (opt-in llm_rotate)

2026-10-21 15:00:16 +02:00

task_llm_test.go

Merge pull request #114 from BaaRai/feat/per-intent-llm-rotation

2026-10-21 15:13:56 +02:00

task_llm.go

Merge pull request #114 from BaaRai/feat/per-intent-llm-rotation

2026-10-21 15:13:56 +02:00

task_metadata_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

task_metadata.go

feat: per-task planner quiet-mode switch, editable mid-run

2026-10-12 21:13:28 +02:00

task_outcome_test.go

feat(server): per-task outcome card for RSI baselines

2026-10-19 00:28:27 +02:00

task_outcome.go

feat(server): per-task outcome card for RSI baselines

2026-10-19 00:28:27 +02:00

task_pause_deadline_test.go

fix(tasks): freeze the timeout budget while a task is paused

2026-10-09 11:37:30 +02:00

task_resolution.go

ollama llm

2026-10-23 18:12:38 -03:00

task_templates_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

task_templates.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

testmain_test.go

feat: each test package runs on its own database

2026-10-12 18:43:29 +02:00

tool_usage_test.go

抽屉优化

2026-08-25 12:05:26 +08:00

tool_usage.go

抽屉优化

2026-08-25 12:05:26 +08:00

tools_wire_test.go

chore: ARTEX 初始化

2026-07-26 04:27:45 -04:00

traffic_ingest_test.go

Traffic ingest: capture operator browsing via a browser extension

2026-10-11 14:53:08 +02:00

traffic_ingest.go

Traffic ingest: capture operator browsing via a browser extension

2026-10-11 14:53:08 +02:00

trigger_merge_test.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

triggers.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

webui_embed.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

webui_stub.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00

worker_message_test.go

重构 worker 对话：复用 resume 机制，改专属 goroutine 运行

2026-08-31 09:00:21 -04:00

workspace.go

Translate all Chinese text to English

2026-10-08 23:14:34 +02:00