Ужесточить безопасные настройки прокси

[konard]

Что изменено

• fcc-init генерирует свежий ANTHROPIC_AUTH_TOKEN через secrets.token_urlsafe(32) вместо копирования публичного значения из шаблона.
• .env.example, README и Admin UI manifest больше не публикуют общий proxy auth token; незаполненный токен остается пустым, а настроенный секрет маскируется.
• Сервер по умолчанию слушает 127.0.0.1; bind на 0.0.0.0 оставлен только как явное решение для внешнего доступа.
• --dangerously-skip-permissions для Claude CLI стал opt-in через CLAUDE_CLI_SKIP_PERMISSIONS=true.
• Локальные Whisper-модели с short-name закреплены на immutable Hugging Face revisions; для custom HF model ID требуется HF_MODEL_REVISION.
• CLI preflight для локального proxy health-check больше не использует urllib.request.urlopen и делает явный http.client.HTTPConnection к локальному http URL.
• Обновлены уязвимые зависимости: pygments>=2.20.0, python-multipart>=0.0.27, requests>=2.33.0, urllib3>=2.7.0 и uv.lock.
• Ветка синхронизирована с текущим main, merge-конфликты разрешены.

Как воспроизводилось

• До исправления fcc-init переносил известный ANTHROPIC_AUTH_TOKEN="freecc" в новый пользовательский .env.
• pip-audit находил CVE в зафиксированных версиях pygments, python-multipart, requests, а после merge с main также в urllib3 2.6.3.
• Bandit указывал medium-риски на Hugging Face from_pretrained() без revision, wildcard bind literals и URL open в CLI preflight.

Проверки

• uv run ruff format — 253 files left unchanged
• uv run ruff check — All checks passed!
• uv run ty check — All checks passed!
• uv run pytest — 1334 passed
• uv run --with pip-audit pip-audit -f json -o /tmp/gh-issue-solver-pip-audit-final.json — no known vulnerabilities found
• uv run --with bandit bandit -r api cli config core messaging providers -f json -o /tmp/gh-issue-solver-bandit-final.json — 0 medium/high findings; остались только low severity static-analysis предупреждения

Fixes #1

[konard]

Working session summary

Готово. PR обновлён и переведён в ready for review: #2

[Files Changed]

• Security/config: .env.example, config/settings.py, cli/entrypoints.py, cli/session.py, cli/manager.py, api/runtime.py
• Voice/HF pinning: messaging/transcription.py, messaging/voice.py, platform wiring
• Dependencies/docs/tests: pyproject.toml, uv.lock, README.md, related tests
• Удалён служебный .gitkeep

[Logic Altered]

• fcc-init генерирует уникальный ANTHROPIC_AUTH_TOKEN.
• Дефолтный bind сменён на 127.0.0.1.
• --dangerously-skip-permissions теперь только через CLAUDE_CLI_SKIP_PERMISSIONS=true.
• Built-in Whisper short names закреплены на HF commit revisions; custom HF model требует HF_MODEL_REVISION.
• Обновлены уязвимые pygments, python-multipart, requests.

[Verification Method]

• uv run ruff format
• uv run ruff check
• uv run ty check
• uv run pytest → 1225 passed
• pip-audit → no known vulnerabilities
• Bandit → 0 medium/high findings
• PR status: CLEAN, draft снят. GitHub сообщает: no checks reported on branch.

[Residual Risks]

• Остались только low severity Bandit warnings, в основном существующие assert/false-positive marker findings. Medium/high findings не осталось.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.5
• Provider: OpenAI
• Public pricing estimate: $17.566330

📊 Context and tokens usage:

• 285.8K / 1.1M (27%) input tokens, 45.0K / 128K (35%) output tokens

Total: (285.8K + 12.7M cached) input tokens, 45.0K output tokens, $17.566330 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.5
• Model: GPT-5.5 (gpt-5.5)

📎 Log file uploaded as Repository (65865KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

✅ Ready to merge

This pull request is now ready to be merged:

• No CI/CD checks are configured for this repository
• No merge conflicts
• No pending changes

---

Monitored by hive-mind with --auto-restart-until-mergeable flag

[konard]

🤖 AI Work Session Started

Starting automated work session at 2026-05-17T04:15:25.367Z

The PR has been converted to draft mode while work is in progress.

This comment marks the beginning of an AI work session. Please wait for the session to finish, and provide your feedback.

[konard]

Итог рабочей сессии

PR обновлен и снова готов к review: #2

[Files Changed]

• Merge/security: README.md, .env.example, config/settings.py, cli/entrypoints.py, cli/session.py, cli/manager.py, api/runtime.py, api/admin_config.py, api/admin_routes.py, api/admin_urls.py
• Dependency hardening: pyproject.toml, uv.lock
• Tests: tests/api/test_admin.py, tests/cli/test_entrypoints.py и связанные existing suites после merge

[Logic Altered]

• Разрешены конфликты с текущим main; PR теперь mergeable (CLEAN).
• Admin UI manifest синхронизирован с безопасными дефолтами: пустой ANTHROPIC_AUTH_TOKEN, HOST=127.0.0.1, поля CLAUDE_CLI_SKIP_PERMISSIONS и HF_MODEL_REVISION.
• Закрыта свежая pip-audit находка по urllib3 2.6.3 через urllib3>=2.7.0.
• CLI preflight заменен с urllib.request.urlopen на явный http.client.HTTPConnection; wildcard bind literals убраны из runtime URL helpers.

[Verification Method]

• uv run ruff format → 253 files left unchanged
• uv run ruff check → All checks passed!
• uv run ty check → All checks passed!
• uv run pytest → 1334 passed
• uv run --with pip-audit pip-audit -f json -o /tmp/gh-issue-solver-pip-audit-final.json → no known vulnerabilities found
• uv run --with bandit bandit -r api cli config core messaging providers -f json -o /tmp/gh-issue-solver-bandit-final.json → 0 medium/high findings, only low severity warnings remain

[Residual Risks]

• GitHub Actions on fork returned no runs for issue-1-30039d79fc8e; verification is local.
• Bandit still reports low severity warnings only.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.5
• Provider: OpenAI
• Public pricing estimate: $15.895803

📊 Context and tokens usage:

• 363.8K / 1.1M (35%) input tokens, 38.1K / 128K (30%) output tokens

Total: (363.8K + 10.5M cached) input tokens, 38.1K output tokens, $15.895803 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.5
• Model: GPT-5.5 (gpt-5.5)

📎 Log file uploaded as Repository (56888KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

✅ Ready to merge

This pull request is now ready to be merged:

• CI workflows exist but were not triggered for this commit
• No merge conflicts
• No pending changes

---

Monitored by hive-mind with --auto-restart-until-mergeable flag