Aamer Akhter ebb9e00de9 fix(auth): widen the per-IP login throttle to 50, keep the per-account lockout at 10 ...

One AUTH_FAILURE_MAX (10 per 15 min) gated the single-user per-IP
bucket, the multi-user per-IP pre-gate, the per-username lockout and the
hook-secret bucket. Clients sharing one egress IP (NAT, a tunnel, an
automated client retrying) were throttled after 10 failures in total.

Add AUTH_IP_FAILURE_MAX = 50 and use it for the two per-IP login buckets
only. The per-username lockout and the hook-secret bucket keep
AUTH_FAILURE_MAX = 10, so guessing against any one account, or against
the hook secret, is no easier than before.

2026-10-22 17:23:03 -04:00

..

agent-teams

refactor: restructure repo for cleaner GitHub landing page

2026-04-03 16:23:54 +02:00

archive

docs: archive stale findings docs (work completed)

2026-05-25 23:31:50 +02:00

images

docs(readme): add two codeman skill GIFs (5 tiles, 8 tabs with lineage)

2026-10-15 18:17:34 +02:00

reports

docs: refresh README + document v0.9.5 security hardening

2026-06-09 04:35:29 +02:00

screenshots

docs(readme): merge touch-optimized content into the mobile section

2026-07-28 10:57:14 +02:00

wiki

Merge pull request #674: fix(mobile): give a sideways drag on the terminal to the session swipe alone

2026-10-22 20:32:13 +02:00

agent-control-plan.md

feat(sessions): make pinning every tab name an opt-in setting

2026-10-18 13:58:09 +08:00

api-reference.md

Merge pull request #676: feat(tabs): per-case default session group

2026-10-22 19:54:54 +02:00

approvals-inbox-plan.md

docs: tighten the inbox, push and idle-detection wording

2026-10-17 18:28:03 +02:00

architecture-invariants.md

fix(auth): widen the per-IP login throttle to 50, keep the per-account lockout at 10

2026-10-22 17:23:03 -04:00

browser-testing-guide.md

docs(tests): finish the ephemeral-port wording (#570)

2026-10-10 02:54:39 +02:00

claude-code-hooks-reference.md

fix(hooks): guard subagent stops and rewake from the parent transcript

2026-08-08 22:31:38 +03:00

claude-voice-plan.md

feat(voice): dictate through the server's Claude Code login, no API key

2026-08-10 11:19:51 +02:00

cli-enable-disable-plan.md

feat(cli-registry): CLI management write API + Settings UI (Phases 1-6) (#476)

2026-09-24 01:48:26 +02:00

cli-registry.md

feat(copilot): plan-usage chip row for the monthly premium-request quota (#662)

2026-10-22 19:32:17 +02:00

copilot-integration.md

feat(copilot): plan-usage chip row for the monthly premium-request quota (#662)

2026-10-22 19:32:17 +02:00

cron-build-brief.md

refactor(cron): rename scheduler feature to cron

2026-06-29 11:35:56 +05:30

cron-discovery.md

feat(pi): add Pi (pi.dev) as a sixth CLI run mode (#206)

2026-08-13 13:54:47 +02:00

cron-guide.md

Merge pull request #670: fix(input): keep the line breaks of a multi-line mux prompt, pasted as one block

2026-10-22 19:23:17 +02:00

custom-model-endpoints-plan.md

fix(custom-model): root-cause and fix DeepSeek's HTTP_404 (missing /v1)

2026-09-17 13:41:19 +08:00

custom-model-endpoints.md

fix(custom-model): warn when parallel llama.cpp slots leave too little context per request (#658)

2026-10-22 19:32:24 +02:00

deepseek-integration-plan.md

fix(deepseek): run the web UI server in the background, not in a shell tab

2026-08-25 03:08:15 +02:00

deepseek-integration.md

docs: tighten the inbox, push and idle-detection wording

2026-10-17 18:28:03 +02:00

docker-cases-plan.md

docs(docker): record implementation status (phases 0-5 done, e2e verified)

2026-07-19 15:38:53 +02:00

docker-cases.md

fix(docker): address git identity review

2026-09-25 22:27:26 +08:00

docker-compose.md

fix(docker): merge-time fixes for #490

2026-09-28 16:28:29 +02:00

docker-self-update.md

fix(docker): merge-time fixes for Update-Codeman.sh (#465)

2026-09-23 11:40:03 +02:00

extending-codeman.md

docs: finish dropping the stripped-newline rule from the input docs

2026-10-21 04:11:28 +02:00

file-viewer-edit-plan.md

fix(files): read remote-case file previews and downloads over ssh

2026-09-14 14:54:41 +02:00

grok-integration-plan.md

feat(grok): add Grok Build (xAI) as a seventh CLI run mode

2026-08-23 08:39:03 +02:00

grok-integration.md

fix(#648): move Antigravity into the screen-checked group in five more docs

2026-10-18 08:14:39 +02:00

installer-v2-plan.md

fix(install): fold in both reviews of #460

2026-09-21 03:03:31 +02:00

local-echo-overlay-plan.md

chore: version packages

2026-05-09 03:23:34 +02:00

media-assets.md

docs(wiki): add a Codeman Skill page with the skill GIFs

2026-10-15 19:10:38 +02:00

mobile-testing-report.md

test(mobile): read PHONE_MAX as an exclusive bound everywhere, drop the stale 430px baselines

2026-09-14 15:53:22 +02:00

multi-user-plan.md

docs(multi-user): document the settings read, system operations and own picks

2026-10-16 13:13:35 +02:00

omp-integration.md

fix(omp): read omp's status bar so an omp turn can end

2026-10-09 02:43:22 +02:00

opencode-integration.md

fix(opencode): read opencode's composer bar and footer spinner so a turn can end

2026-10-09 02:40:04 +02:00

orchestrator-loop-architecture.md

fix(tmux): type a single-character submit so a dialog answer selects

2026-10-14 21:23:58 +02:00

orchestrator-loop-plan.md

feat: add Orchestrator Loop — phased plan execution with team agents

2026-03-21 07:20:18 +01:00

orchestrator-loop-research.md

feat: add Orchestrator Loop — phased plan execution with team agents

2026-03-21 07:20:18 +01:00

pi-integration-plan.md

feat(pi): add Pi (pi.dev) as a sixth CLI run mode (#206)

2026-08-13 13:54:47 +02:00

pi-integration.md

fix(pi): read pi's composer rule so a pi turn can end

2026-10-09 01:49:19 +02:00

predictive-echo-plan.md

fix(predictive-echo): anchor hold after unpredicted wire edits (review findings)

2026-08-09 05:29:45 +02:00

qr-auth-plan.md

feat: implement QR code authentication for tunnel access

2026-03-01 06:05:26 +01:00

ralph-wiggum-guide.md

chore: rename Claudeman to Codeman

2026-02-26 16:44:34 +01:00

readmymind-plan.md

fix(readmymind): style the modal footer, point the empty-result copy at the steer note

2026-08-10 11:15:47 +02:00

readmymind.md

docs: add pi to the mode lists the sixth-backend sweep missed

2026-08-13 19:40:54 +02:00

releasing.md

fix(ui): shorten the OpenCode notice to what OpenCode said, live from 17 October

2026-10-18 09:30:13 +02:00

reliable-input-delivery.md

fix(input): keep the line breaks of a multi-line mux prompt, pasted as one block

2026-10-21 03:51:31 +02:00

remote-sessions.md

Merge pull request #604: feat(preview): open ~/, relative and hard-wrapped paths; folder grid

2026-10-13 18:08:12 +02:00

respawn-state-machine.md

chore: bump version to 0.1538

2026-02-18 12:51:35 +01:00

scrollback-fix-plan.md

fix(terminal): strip opencode's mouse DECSETs so a drag selects text again

2026-10-08 14:55:02 +02:00

scrollback-issues-analysis.md

docs: record the scrollback analysis and its measurements for #205

2026-08-07 04:33:15 +02:00

security-architecture.md

fix(auth): widen the per-IP login throttle to 50, keep the per-account lockout at 10

2026-10-22 17:23:03 -04:00

session-lineage-lines-plan.md

fix(ui): draw session lineage lines in blue for contrast

2026-08-14 10:03:10 +02:00

SPEEDRUN.md

docs: move SECURITY.md to .github/ and SPEEDRUN.md to docs/

2026-07-27 14:00:26 +02:00

split-pane-sessions-plan.md

fix(tiles): wire the Android soft-keyboard controller into every tile (#541 parity)

2026-10-09 08:20:02 +02:00

tailscale-installer-plan.md

docs(install): describe installer v2 and the Tailscale naming options

2026-09-20 21:38:12 +02:00

terminal-anti-flicker.md

fix(terminal): drain deferred output without a wake event

2026-08-08 23:00:36 +03:00

terminal-copy-shortcut-plan.md

fix(terminal): strip opencode's mouse DECSETs so a drag selects text again

2026-10-08 14:55:02 +02:00

tile-grid-plan.md

docs(tiles): a reload brings the grid back only when it was open

2026-10-10 06:33:00 +02:00

tui-plan.md

docs: document codeman tui

2026-08-22 14:13:58 +02:00

tui.md

Merge pull request #670: fix(input): keep the line breaks of a multi-line mux prompt, pasted as one block

2026-10-22 19:23:17 +02:00

ultracode-agent-viz-plan.md

feat(ultracode): master-detail tab for Workflow/ultracode run visualization

2026-06-15 08:40:05 +02:00

usage-limits-display-plan.md

fix(telemetry): stamp a compaction on entering the null window

2026-10-11 12:36:59 -04:00

versioning-policy.md

fix(mobile): #432 landing fixes

2026-10-09 05:57:49 +02:00

vm-cases-plan.md

docs(vm): VM cases plan + Apple virtualization stack reference

2026-08-06 01:28:17 +02:00

vm-subsystem-apple-stack.md

docs(vm): VM cases plan + Apple virtualization stack reference

2026-08-06 01:28:17 +02:00

web-tabs-fixes-plan.md

chore: version packages

2026-08-04 15:02:46 +02:00

web-tabs.md

docs(webview): record the lost-frame page as the third unauthenticated 200, and the inline-style limit

2026-09-14 23:38:54 +02:00

worker-warm-pool-plan.md

feat: skill fast-path hardening, lineage retune + colors, per-tab pop-out, reliable tab alerts

2026-08-15 06:38:26 +02:00