Danny Avila 9277620282 🔒 fix: Anchor the /files/usage hold to upload time ... Codex review on b687922. The hold derived each new deadline from `Date.now()`, so a caller touching once a day advanced it by another 24h every time, far below the rate limit. That left indefinite preservation reachable and made the PR's replay claim wrong: the window was bounded per call but not in aggregate. Anchor the deadline to the file's immutable `createdAt` instead of the request clock. `extendFilesTTL` now takes a lifetime and sets `expiresAt = max(expiresAt, createdAt + holdMs)` in an aggregation pipeline, so the target is a fixed point per file and replay is inert rather than merely bounded. `$max` keeps the widen-only property and the `expiresAt: {$exists: true}` filter still refuses to resurrect a released TTL; `createdAt: {$exists: true}` fail-closes when the anchor is absent. The update runs with `timestamps: false`: a hold is TTL bookkeeping, not a content write, and bumping `updatedAt` also made every re-touch count as a modification, hiding whether the deadline actually moved. Also drop four `.node_modules-*` symlinks that `git add -A` swept in from an npm install. They pointed at absolute paths on one machine, so every other checkout got dangling entries. Added the pattern to .gitignore so a workspace install cannot reintroduce them.		2026-07-27 22:16:47 -04:00
..
app	🔗 fix: Resolve MCP Tool-Key Boundary Against Configured Server Names (#14448)	2026-07-27 14:45:38 -04:00
cache	📉 perf: cache OpenID JWT user documents (#14187)	2026-07-12 07:53:50 -04:00
config	🪵 refactor: Bound Log Traversal And Remove Legacy api/config Logger (#13813)	2026-06-17 12:31:32 -04:00
db	⚖️ feat: Add Operational Prometheus Metrics (#13265)	2026-05-22 20:47:41 -04:00
models	🧩 fix: Preserve Deployment Skill IDs on Agents (#14368)	2026-07-21 19:44:27 -04:00
server	🔒 fix: Anchor the /files/usage hold to upload time	2026-07-27 22:16:47 -04:00
strategies	📉 perf: cache OpenID JWT user documents (#14187)	2026-07-12 07:53:50 -04:00
test	fix: use logAxiosError at the RAG file_search/context call sites (#14014)	2026-06-30 20:35:01 -04:00
utils	✳️ feat: Claude Opus 5 Support (#14422)	2026-07-24 21:45:32 -04:00
jest.config.js	📦 chore: npm audit fix (#13828)	2026-06-17 21:54:04 -04:00
jsconfig.json
package.json	🍃 chore: Bump Mongoose to 8.24.1 to Patch Prototype Pollution (#14461)	2026-07-27 12:40:14 -04:00
typedefs.js	🛂 test: Cover Tool Approval Workflows End to End (#14427)	2026-07-26 21:58:25 -04:00