2 commits

Author	SHA1	Message	Date
Stephen Dennis	cb4c101125	fix: resolve Pass 4 Hydra Medium audit defects #1095–#1102 ... - #1095: WS RSV + control FIN/len≤125 before ext-len (no large PING→PONG) - #1096: cap writeBuffers_ (256 KiB, close slow FD); subscriber queues drop oldest at 256 - #1097: gRPC/grpc-web login lockout by peer IP; /passwd requires old password - #1098: RAND_bytes hard-fail; password/scrollback salts via CSPRNG - #1099: ProcessManager::stopAndWait with SIGKILL escalate; restart + dtor wait/reap - #1100: scrollback_lines applied on session create/restore; max_sessions_per_account enforced - #1101: telnet IAC SB reassembly capped at 64 KiB - #1102: /metrics loopback-only; ListGames/GetGameStatus require session proxy_regression: ok (RSV, large PING, SB cap + prior WS cases) hydra: builds with GRPC=1	2026-07-24 18:22:17 -06:00
Stephen Dennis	1167fe2c07	Add scroll-back persistence with AEAD encryption (Phase 1 Step 8) ... Encrypt scroll-back lines with AES-256-GCM using the player-derived key before flushing to SQLite. Sessions are saved to the saved_sessions table and restored on login after a Hydra restart. Flush triggers: periodic (60s), on detach, and on shutdown. AAD includes account ID, session ID, and sequence number to prevent reordering attacks. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-22 12:04:38 -06:00