Skip to content

Tags: patrickdundas/tracker-tracker

Tags

v2.8.9-homelab.9

Toggle v2.8.9-homelab.9's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
fix(tracker-adapters): accept numeric UNIT3D byte and ratio fields (#11)

UNIT3D deployments disagree about the JSON types of these fields. Seed Pool
and DarkPeers return formatted strings ("1.5 TiB", "2.31"). Blutopia returns
bare numbers:

  {"uploaded":53687091200,"downloaded":1073741824,"ratio":50,
   "buffer":133143986176,"seedbonus":"200001.00","hit_and_runs":0}

parseBytes() opened with formatted.trim(), so the numeric shape threw
"formatted.trim is not a function". That surfaced in the UI as a bare
"tracker test failed", which reads like a rejected API key and sends you
looking at credentials instead of at the response body.

parseBytes now takes string | number, truncating fractional counts and
rejecting negatives the same way the string path does. The response
interface widens to unions, and ratio/seedbonus go through a toNumber()
helper because parseFloat() only accepts a string.

Also records in the Blutopia registry entry that its IRC network is retired
in favour of Matrix, so autobrr has no network to connect to; the tracker's
client blacklist; the connectability requirement; and the PID exposure and
ratio risk in its RSS feeds.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

v2.8.9-homelab.8

Toggle v2.8.9-homelab.8's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
feat(tracker-adapters): add Simurg registry entry (#10)

Simurg is a book/audiobook/comic tracker launched August 2026. It runs
stock Gazelle with Ocelot, so the existing gazelle adapter and the
/ajax.php default path cover it — this is registry-only, no new adapter.

Two things here differ from every other tracker in the registry and are
recorded in fullRulesMarkdown so they are not lost:

- Rule 5.3 prohibits freeleech autosnatching outright, with no carve-out
  for autodl-irssi or autobrr. Sister Gazelle sites explicitly allow those
  two. Since the whole catalogue is freeleech at launch, this rules out
  autobrr for Simurg entirely.
- There is no minimum seed time and no concurrent-torrent cap. Stated
  outright by the site. seedTimeHours is therefore a real 0, not a
  placeholder, and no floor should be copied here from another entry.

loginIntervalDays is left at 0 deliberately. Accounts must log in or be
disabled and seeding does not count as activity, but the threshold is
configurable and the site's own wiki says to rely on the warning email
rather than a copied number.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

v2.8.9-homelab.7

Toggle v2.8.9-homelab.7's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
fix(scheduler): only pause a tracker on credential failures (#9)

A failed poll leaves lastPolledAt untouched, so a failing tracker stays
permanently overdue and is retried on every 5-minute scheduler tick. Four
ticks is 20 minutes, so any outage longer than that auto-paused the tracker
for good, and a paused tracker only resumes when a human clicks Resume.

On 2026-08-16 a home internet outage paused all six trackers at once. The
container stayed up, so container-level health stayed green and the fault
went unseen for 33.5 hours. The MyAnonaMouse balance hit its 99,999 cap in
that window and burned ~5,000 points (~10 GiB of upload credit).

Invert the default: only Authentication failed / Session expired / Invalid
credentials can pause a tracker. Everything else keeps its failure count for
visibility but retries forever under exponential backoff (5m, 10m, 20m, 40m,
then hourly), so connectivity faults heal on their own. Rate-limit and IP-ban
errors go straight to the hourly cap, since retrying hard is what causes them.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

v2.8.9-homelab.6

Toggle v2.8.9-homelab.6's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
feat(tracker-adapters): add TBDev adapter and DocsPedia registry entry (

#8)

TBDev (tbdev.org) is the classic PHP tracker codebase and exposes no API, so
stats are scraped from the logged-in /userdetails.php page.

Auth is by session cookie rather than username/password, and that is forced
rather than chosen: TBDev's login form carries a CAPTCHA, so the login-and-
collect-Set-Cookie flow the TorrentLeech adapter uses cannot work. The cookies
are long-lived, so capturing them once from a browser is the practical way in.
The uid is derived from whichever cookie name ends in `uid`, since the prefix is
site-specific (DocsPedia uses doccook_uid, stock TBDev uses uid).

Byte units get their own parser. TBDev's mksize() divides by 1024 at every step
but labels the result kB/MB/GB/TB, so a TBDev "1.00 GB" is one GiB. Routing that
through parseBytes unchanged would read it against the decimal table and
under-report by ~7% at GB and ~10% at TB - and parseBytes has no lowercase "kB"
entry at all, so the form TBDev actually emits would have thrown.

hitAndRuns is null, not 0: stock TBDev has no hit-and-run accounting, and 0
would assert a clean record the tracker cannot vouch for.

Verified end-to-end against a live DocsPedia account: HTTP 200, username, class
and karma parsed correctly.

v2.8.9-homelab.5

Toggle v2.8.9-homelab.5's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
feat(alerts): require an HnR rise to persist before notifying (#7)

* feat(alerts): require an HnR rise to persist before notifying

TorrentLeech publishes a LIVE "not currently satisfying" counter rather than a
permanent strike record. Stale tracker-side leech records age out through it, so
the count blips 0 -> 1 -> 0 with nothing actually wrong. checkHnrIncrease fires
on every blip, and every one of them is a false alarm.

Measured on 11 days of hourly TL polls: four separate blips, runs of 5, 4, 2 and
4 polls, all self-cleared. checkHnrSustained requires an increase to hold for N
consecutive polls (default 6 - the smallest value that suppresses all four) and
fires exactly once, on the poll where the run completes.

A genuine hit-and-run is a recorded penalty that never clears, so the only cost
is a few hours of notice on something already irreversible.

- N is configurable per target via thresholds.hnrSustainedPolls, clamped to
  HNR_SUSTAINED_POLLS_MAX so an over-large value cannot silently never fire.
- The scheduler now loads HNR_HISTORY_POLLS snapshots instead of one; only the
  HnR check reads the extra rows.
- Callers that supply no history keep the original single-step behaviour.

* fix(deps): override nanoid to the patched 3.x line

Trivy flagged CVE-2026-67213 (HIGH) against nanoid 3.3.16, reached transitively
through postcss, which is itself pulled in by next, @tailwindcss/postcss and
vite. The image build gates on the scan, so this blocked release.

Pinned to ^3.3.17 rather than the >=3.3.17 that a naive read of the advisory
suggests: the open range resolves to nanoid 6.x, which is a major version away
from the ^3.3.11 postcss actually asks for. Staying inside 3.x takes the fix
without swapping a scanner finding for a runtime break.

Unrelated to the HnR work on this branch; it surfaced because this is the first
build since the advisory landed.

v2.8.9-homelab.4

Toggle v2.8.9-homelab.4's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Merge pull request #5 from patrickdundas/feat/ui-redesign

UI redesign: Graphite — flat surfaces, real contrast, no more neon

v2.8.9-homelab.3

Toggle v2.8.9-homelab.3's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Merge pull request #6 from patrickdundas/fix/dependency-cves

fix(security): clear inherited dependency CVEs and stop shipping devDependencies in the image

v2.8.9-homelab.2

Toggle v2.8.9-homelab.2's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Merge pull request #3 from patrickdundas/fix/tl-profile-parsing

fix(tracker-adapters): correct TL downloaded bytes and user class parsing

v2.8.9-homelab.1

Toggle v2.8.9-homelab.1's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Merge pull request #2 from patrickdundas/feat/torrentleech

feat(tracker-adapters): TorrentLeech hit-and-run + count fix

v2.8.9

Toggle v2.8.9's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
Merge pull request jordanlambrecht#137 from jordanlambrecht/development

fix(release): broken auto-release ci