feat(tracker-adapters): TorrentLeech hit-and-run + count fix

[patrickdundas]

Implements the reason this fork exists, using a real logged-in TL header capture.

Hit and run

TL exposes it in the header menu, linking to /profile/<user>/hnr:

<div title="Hit and Run" class="div-menu-item">
  <span class="link" onclick="...'/profile/evergreen99/hnr'"><i class="fa fa-ban"></i>  0</span>
</div>

hitAndRuns stays null when that element is absent rather than defaulting to 0 — a missing counter must not render as "no hit and runs", which would hide the exact condition the field exists to surface.

Bug found in the process

The menu has two shapes, and the existing parser only handled one:

<div title="Uploaded (Seeding)">  <i/> <span>2.39 TB</span> (30) </div>
<div title="Hit and Run">         <i/>  0                        </div>

Seeding/leeching lead with the transfer size and carry the torrent count in trailing parens. Matching "the first number in the element" therefore returned 2 (from "2.39 TB") and 244 (from "244.44 GB") instead of 30 and 9 — so seeding and leeching counts are wrong for every TL user on upstream jordanlambrecht#175. Fixed by matching the parenthesised count for those and the bare number for Hit and Run.

Tests

Upstream had no .div-menu-item fixture, which is why the count bug went unnoticed. Added one taken from real markup, plus regression coverage for both shapes and the null-vs-zero distinction. 17 pass locally; tsc --noEmit and biome check clean.

One unrelated pre-existing failure in chart-transforms.test.ts reproduces identically on unmodified upstream/main — it is timezone-dependent and should pass in CI's UTC.

Still stubbed

requiredRatio and warned remain null — neither appears in the header capture. warned feeds the warned notification event, so it is worth a follow-up if TL surfaces it elsewhere.

🤖 Generated with Claude Code

[github-actions]

Knip Code Analysis

Found 8 total issues

Category	Count
Unused Dependencies	1
Unused Dev Dependencies	3
Unused Exports	4

View details

Run pnpm knip locally to see the full report.

Use pnpm knip:filter pattern to filter results by file path.

---

Use /** @public */ JSDoc tags to mark intentionally exported symbols.

[github-actions]

🚫 Security audit failed

Critical Failures

Check	File	Details
External fetch calls have timeouts	src/lib/adapters/btn.ts:69	fetch() call without a timeout signal — add signal: AbortSignal.timeout(ms)

Warnings

Check	File	Details
No swallowed errors in catch blocks	src/lib/adapters/iptorrents.ts:108	catch block swallows error without logging or re-throwing
No swallowed errors in catch blocks	src/lib/adapters/iptorrents.ts:114	catch block swallows error without logging or re-throwing
No swallowed errors in catch blocks	src/lib/adapters/iptorrents.ts:175	catch block swallows error without logging or re-throwing
No swallowed errors in catch blocks	src/lib/adapters/iptorrents.ts:181	catch block swallows error without logging or re-throwing

Passed (36/38)

• ✅ Auth enforcement on protected routes (per-handler)
• ✅ No dangerous functions (eval, innerHTML, etc.)
• ✅ No hardcoded secrets in source
• ✅ Security headers in next.config.ts
• ✅ Cookie security (httpOnly, sameSite, secure)
• ✅ No sensitive fields in API responses
• ✅ No .env files committed to repo
• ✅ No raw SQL in API routes
• ✅ No fetch/redirect with unvalidated URLs in routes
• ✅ Timing-safe comparison for secret values
• ✅ No raw SQL migration files (schema-first only)
• ✅ Docker container runs as non-root user
• ✅ Public routes match proxy allowlist
• ✅ File delete operations have path traversal defense
• ✅ Password hashing uses Argon2 (not SHA-256/bcrypt)
• ✅ Encrypted columns written via encrypt()
• ✅ TOTP 2FA flow integrity
• ✅ Emergency lockdown flow integrity
• ✅ Scrub & delete (nuke) flow integrity
• ✅ Backup restore flow integrity
• ✅ Login flow integrity
• ✅ Auth result checked before proceeding
• ✅ Backup password inputs bounded before key derivation
• ✅ Webhook delivery fetch uses redirect: "error"
• ✅ SESSION_SECRET minimum-length guard in auth/crypto modules
• ✅ Notification URL validators include SSRF protection
• ✅ Dockerfile does not COPY sensitive files
• ✅ No secret env vars in client components
• ✅ Adapter Cookie headers guard against injection
• ✅ Adapter files do not log credential values
• ✅ No console.log in API routes
• ✅ No TODO/FIXME in security-critical files
• ✅ JSON.parse wrapped in try-catch
• ✅ Request body size validation on upload routes
• ✅ BigInt fields use string serialization
• ✅ No raw error messages in API responses

---

Summary: 36/38 checks passed
— 1 critical failure(s)
— 1 warning(s)

See scripts/security-audit.ts for check definitions and SECURITY.md for the full security architecture.