CyberMind
2b036db0d6
Merge pull request #658 from CyberMind-FR/fix/ad-learn-self-block-hardening
...
fix(toolbox #658 ): ad-learn never self-blocks own infra + exact-host promotion
2026-06-18 13:55:47 +02:00
376b4ecd2a
fix(toolbox #658 ): ad-learn never self-blocks own infra + exact-host promotion (no registrable over-fold)
2026-06-18 13:53:42 +02:00
a3cd643da4
docs: HISTORY — #656 Ad Intelligence shipped + splice/banner reverted
License Headers / check (push) Waiting to run
2026-06-18 13:33:49 +02:00
CyberMind
f9e2032750
Merge pull request #657 from CyberMind-FR/feature/656-feat-toolbox-ad-intelligence-aggressive
...
feat(toolbox): Ad Intelligence — aggressive ad-URL learning + block/silent/drop + contextual #ads metrics
2026-06-18 13:21:01 +02:00
e39123dc7e
fix(toolbox): allow #ads deep-link to auto-open the tab on load (ref #656 )
2026-06-18 13:20:26 +02:00
d5408536b3
chore(toolbox): changelog 2.6.56 for Ad Intelligence (ref #656 )
2026-06-18 13:17:46 +02:00
12277f3c08
feat(toolbox): #ads dashboard tab — contextual ad-block stats (ref #656 )
2026-06-18 13:16:48 +02:00
976db154a0
feat(toolbox): autolearn _ad_feed promotes ad-candidates to blocklist (ref #656 )
2026-06-18 13:15:45 +02:00
d6dda15024
feat(toolbox): ad_ghost contextual recording + candidates + allowlist (ref #656 )
2026-06-18 13:14:01 +02:00
fa1ad79239
test(toolbox): modernize emoji test to asyncio.run (order-independent, fixes flake) (ref #656 )
2026-06-18 13:11:36 +02:00
e23fa9545e
feat(toolbox): GET /admin/ad-stats contextual metrics (ref #656 )
2026-06-18 13:09:39 +02:00
96836d865c
feat(toolbox): ad_learn filter toggle (ref #656 )
2026-06-18 13:08:36 +02:00
3243e0d2f2
feat(toolbox): ad_block_stats + ad_candidates store helpers (ref #656 )
2026-06-18 13:08:01 +02:00
3dfe85f547
docs: implementation plan for Ad Intelligence ( #656 )
2026-06-18 13:06:26 +02:00
221abd94a2
docs: spec for Ad Intelligence — learn/act/measure + #ads tab ( #656 )
2026-06-18 13:04:53 +02:00
ebb6b3067c
Revert "Merge pull request #654 from CyberMind-FR/fix/653-fix-toolbox-banner-reliability-inline-bu"
...
License Headers / check (push) Waiting to run
This reverts commit 6160ec9aaaf69384f1e0
2026-06-18 12:23:03 +02:00
CyberMind
6160ec9aaa
Merge pull request #654 from CyberMind-FR/fix/653-fix-toolbox-banner-reliability-inline-bu
...
License Headers / check (push) Waiting to run
fix(toolbox): banner reliability — inline bundle (kill connect-src fetch) + SPA re-assert
2026-06-18 12:14:33 +02:00
f30b3b39f8
fix(toolbox #653 ): inline bundle into loader (kill connect-src fetch, faster) + SPA re-assert
2026-06-18 12:11:47 +02:00
CyberMind
f69384f1e0
Merge pull request #652 from CyberMind-FR/feature/651-perf-toolbox-649-follow-up-broaden-splic
...
License Headers / check (push) Waiting to run
perf(toolbox): #649 follow-up — broaden splice seed + trustworthy per-worker stats + admin toggle, flip on
2026-06-18 11:53:01 +02:00
56baace9d1
fix( #651 ): narrow risky seed entries to media shards before arming (imgur/giphy/redd.it/pstatic apex → media subdomains; drop akamaihd)
2026-06-18 11:52:20 +02:00
53df892193
perf(toolbox #651 ): broaden media splice seed (35) + per-worker stats + console feedback
2026-06-18 11:50:25 +02:00
1139ce103e
docs: record #649 selective SNI-splice (Lever A) ship + soak/flip next (PR #650 )
License Headers / check (push) Waiting to run
2026-06-18 11:30:02 +02:00
CyberMind
173b67c495
Merge pull request #650 from CyberMind-FR/feature/649-perf-toolbox-selective-sni-splice-passth
...
perf(toolbox): selective SNI-splice — passthrough pure-asset flows, MITM only what needs L7 (Lever A)
2026-06-18 11:26:59 +02:00
e8cebe1662
fix(toolbox): refresh never-set on filters.json mtime too (fortknox via WebUI) (ref #649 )
2026-06-18 11:26:35 +02:00
3b0423189e
feat(toolbox): register tls_splice first in mitm-wg chain + changelog 2.6.54 (ref #649 )
2026-06-18 11:23:59 +02:00
742897700c
perf(toolbox): offload splice obs to bg thread + skip decided hosts; add fail-safe/recorder tests (ref #649 )
2026-06-18 11:22:47 +02:00
296cebc69e
feat(toolbox): autolearn promotes never-HTML hosts to splice-learned (ref #649 )
2026-06-18 11:18:36 +02:00
4160167e5c
feat(toolbox): tls_splice addon — SNI-splice at ClientHello + obs recorder (ref #649 )
2026-06-18 11:17:39 +02:00
d836179a72
feat(toolbox): splice_host_obs table + record/never_html helpers (ref #649 )
2026-06-18 11:16:39 +02:00
9d3630574f
feat(toolbox): curated media SNI-splice seed (ref #649 )
2026-06-18 11:11:43 +02:00
8664c84893
feat(toolbox): SNI-splice classifier (seed/learned/never) (ref #649 )
2026-06-18 11:11:30 +02:00
96e04bbe0f
feat(toolbox): tls_splice filter toggle off|observe|on (ref #649 )
2026-06-18 11:10:53 +02:00
09e16f35a1
docs: implementation plan for toolbox selective SNI-splice ( #649 )
2026-06-18 11:09:02 +02:00
7834a29724
docs: spec for toolbox selective SNI-splice (Lever A, #649 )
2026-06-18 11:04:26 +02:00
ab8822e3f4
docs: record #623 systemic shared-parent clobber fix (PR #648 )
License Headers / check (push) Waiting to run
2026-06-18 10:48:24 +02:00
CyberMind
9950e9ec3e
Merge pull request #648 from CyberMind-FR/fix/623-postinst-systemic-var-lib-log-cache-secu
...
postinst: systemic /var/{lib,log,cache}/secubox parent-mode clobber across ~12 packages (board-wide traversal breakage)
2026-06-18 10:41:52 +02:00
951af764fb
fix( #623 ): close review gaps — 3 chmod 750 /var/log clobbers + tmpfiles defense-in-depth
...
Review found two gaps the install-d sweep missed:
- chmod-form clobber: soc-gateway/soc-agent/ui-manager did 'chmod 750
/var/log/secubox' (same #511 traversal class) -> now 0755.
- secubox-core tmpfiles.d only declared /run/secubox; now declares all 5 shared
parents at 0755 (mode-only, owner-agnostic) for boot/install-time self-heal.
core 1.1.7 -> 1.1.8.
2026-06-18 10:39:52 +02:00
6b7d7f8607
fix( #623 ): shared /run|/var/lib|/var/cache|/etc/secubox parents stay 1777/0755 in all postinsts
...
Systemic clobber: the scaffold boilerplate (install -d -m 750 /var/lib/secubox,
/run/secubox) put restrictive modes on SHARED parents in ~56 module postinsts,
reverting them to 0750 on every install/upgrade and breaking traversal for
non-secubox daemons (kbin/toolbox 500). Empirically confirmed install -d -m only
modes the final component, so /parent/leaf forms are harmless — only bare-parent
targets were rewritten. Multi-arg lines (incl. ones making /var/lib world-writable
1777) split per-parent: /run/secubox=1777 root:root, /var/lib|cache|etc=0755
secubox:secubox; module-private leaves keep 0750. Scaffold + PATTERNS.md fixed so
new packages don't reintroduce it.
2026-06-18 10:32:58 +02:00
68490a4a9b
docs: update WIP + HISTORY for #644/#646 perf sprint + crowdsec unblock
License Headers / check (push) Waiting to run
2026-06-18 10:18:01 +02:00
CyberMind
a44d9c51d8
Merge pull request #647 from CyberMind-FR/feature/646-perf-toolbox-adaptive-accept-encoding-st
...
License Headers / check (push) Waiting to run
perf(toolbox): adaptive Accept-Encoding strip — stop pulling CSP-strict pages uncompressed through R3
2026-06-18 09:34:00 +02:00
013385a6c4
chore(toolbox): changelog 2.6.53 for adaptive Accept-Encoding strip (ref #646 )
2026-06-18 09:31:50 +02:00
6ee7fe3cbc
perf(toolbox): adaptive Accept-Encoding strip — only force identity on stream-eligible hosts (ref #646 )
2026-06-18 09:31:29 +02:00
CyberMind
2f9b16f05a
Merge pull request #645 from CyberMind-FR/fix/644-hub-dashboard-latency-9-12s-per-module-s
...
License Headers / check (push) Waiting to run
hub dashboard latency: 9-12s (per-module systemctl) + health-batch 3.3s (uncached); clients/rich 180ms
2026-06-18 09:01:41 +02:00
ce571233d7
perf(hub): double-checked locking on cold cache refresh — collapse thundering herd (ref #644 )
2026-06-18 09:01:04 +02:00
89b962aa8c
chore: changelogs for hub latency + toolbox clients/rich cap (ref #644 )
2026-06-18 08:57:47 +02:00
d8edf050f5
perf(toolbox): cap /admin/clients/rich enrichment to ENRICH_LIMIT most-recent rows (ref #644 )
2026-06-18 08:56:13 +02:00
7349288e88
perf(hub): warm services cache on /alerts too — last cold _svc consumer (ref #644 )
2026-06-18 08:54:24 +02:00
3ec9a82984
perf(hub): serve dashboard/health-batch from cache, one batched systemctl on cold path (ref #644 )
2026-06-18 08:52:28 +02:00
1a87993394
perf(hub): add _ensure_services_warm + _refresh_health_batch cache helpers (ref #644 )
2026-06-18 08:47:55 +02:00
7dd39d52a4
docs: spec + plan for hub dashboard latency fix (ref #644 )
2026-06-18 08:45:31 +02:00
