Address the review of the webui plugin:
- Live download rates. A background sampler polls the daemon once per
second, derives per-torrent dlspeed from successive byte counts (EWMA
smoothed), and computes a real ETA. dl_info_speed now aggregates the
fleet instead of reporting a hardcoded 0.
- Single shared snapshot. The sampler publishes one cached snapshot that
/api/snapshot, /api/torrents and every SSE stream serve, so N browser
tabs no longer each poll the engine and race the speed table. SSE
waiters block on a condition and wake promptly on shutdown.
- Honest /api/action. The engine has no pause/resume/recheck/queue verbs,
so the endpoint returns 501 with an explanatory message instead of
claiming success.
- Reject oversized uploads with 413 instead of silently truncating a
torrent into garbage.
- Auth hardening: constant-time credential comparison, CSPRNG-only token
generation via getrandom (fail closed, no weak fallback), oldest-session
eviction instead of clobbering slot 0, and a warning when bound to a
non-loopback address.
- Cap concurrent connections (503 beyond the limit) so a client can't
spawn unbounded threads.
- nautd: tear down plugins (joining the webui's threads) before freeing
torrent tasks, closing a shutdown-time use-after-free window where an
in-flight request could touch freed state.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
41ed172272