hermes 66207d24b6 fix(net): bounded request time, curl size and time caps, lock waits, sane prices ... From the full-repo Codex audit: - MSN and Yahoo clients set connect and body timeouts but none for the response headers, so a server that stalled before answering hung the call; four such calls take every MCP call slot. Add a 30 s overall deadline. Every curl-impersonate run gets --max-time 600 and a 256 MiB --max-filesize, and output above that is rejected (curl cannot cap a response without a length); the Yahoo cookie fetch gets --max-time. - Ownership commands blocked on the database lock without limit, so a long sync or import, or a stuck process, held MCP call slots indefinitely. Wait up to 30 s, then fail with a "busy, try again" error. - A price of 1e20 saturated `as i64` and the change subtraction then overflowed. Prices that are not finite, negative, or above 1e12 IDR are treated as missing, and a quote's own price as an error. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh		2026-10-17 12:26:26 +00:00
..
msn	fix(net): bounded request time, curl size and time caps, lock waits, sane prices	2026-10-17 12:26:26 +00:00
yahoo	fix(net): bounded request time, curl size and time caps, lock waits, sane prices	2026-10-17 12:26:26 +00:00
mock.rs	refactor(core): compile the mock provider only with a testing feature	2026-10-14 09:31:12 +00:00
mod.rs	fix: address final review (path traversal, sync races, MCP limits)	2026-10-14 21:58:37 +00:00
types.rs	feat(news): rank this company's news first and label each item	2026-10-16 09:54:30 +00:00