2 Commits

Include renames

Author	SHA1	Message	Date
arkonandClaude Opus 4.6	18217268bf	fix: extract QR auth magic numbers into named constants, add 16 security tests ... Replace hardcoded per-IP rate limit (10) and cookie maxAge (86400) in system-routes.ts with QR_AUTH_FAILURE_MAX and AUTH_SESSION_TTL_MS/1000 so both auth paths stay in sync if constants change. Add 16 new tests: grace period boundary precision, base62 charset validation, current+previous token during grace, stopTokenRotation state cleanup, rate limit reset, consumed token eviction, full end-to-end QR flow, per-IP 429, cookie attributes, concurrent race, regenerate invalidation, URL encoding, path traversal, /q without param, and session record method:qr. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-01 17:32:02 +01:00
arkonandClaude Opus 4.6	97ca13916a	refactor: consolidate ~70 scattered constants into 6 new config files (phase 6) ... Create 6 domain-focused config files in src/config/ to centralize operational tuning knobs that were scattered across 15+ source files: - server-timing.ts: SSE batching, state debounce, scheduled runs, error recovery - auth-config.ts: session TTL, rate limits, hook timeout - tunnel-config.ts: QR token rotation, tunnel process lifecycle - terminal-limits.ts: input length, terminal cols/rows, session name - ai-defaults.ts: AI model string, idle/plan context limits - team-config.ts: poll interval, cache sizes Eliminates all cross-file duplicates: - AI model string: 5 occurrences → 1 (config only) - STATS_COLLECTION_INTERVAL_MS: 2 → 1 - timeout: 10000 in hooks-config: 6 → 0 (now HOOK_TIMEOUT_MS) - MAX_TRACKED_AGENTS shadow: removed, imports from map-limits Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-01 13:19:16 +01:00