Pin build inputs and fix admin detail and download handling

.github/workflows/docker.yml

@@ -36,7 +36,7 @@ jobs:
         id: version
         run: python scripts/check_version.py
       - name: Install test dependencies
-        run: python -m pip install -r requirements.txt
+        run: 'python -m pip install --require-hashes --only-binary=:all: -r requirements.txt'
       - name: Run regression tests
         run: |
           for script in tests/test_*.py; do
@@ -74,7 +74,7 @@ jobs:
           echo "PLAYWRIGHT_BROWSERS_PATH=$RUNNER_TEMP/codebuddy-browser" >> "$GITHUB_ENV"
           "$RUNNER_TEMP/vp/vp" env off
       - name: Install backend fixture dependencies
-        run: python -m pip install -r requirements.txt
+        run: 'python -m pip install --require-hashes --only-binary=:all: -r requirements.txt'
       - name: Check and build WebUI
         working-directory: web
         run: |

Dockerfile

@@ -1,12 +1,12 @@
-# syntax=docker/dockerfile:1
+# syntax=docker/dockerfile:1@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32
 ARG BUILDARCH
 FROM scratch AS vp-amd64
 ADD --checksum=sha256:a3a728816a5937fbfd06d9987c8d8a1152c6a90de22a827b840079140021d030 https://github.com/voidzero-dev/vite-plus/releases/download/v0.3.1/vp-x86_64-unknown-linux-gnu.tar.gz /vp.tar.gz
 FROM scratch AS vp-arm64
 ADD --checksum=sha256:5af89c1118f402a71063ca0d2737a58ca61054b8996f4f6c87511700e7a6b4cb https://github.com/voidzero-dev/vite-plus/releases/download/v0.3.1/vp-aarch64-unknown-linux-gnu.tar.gz /vp.tar.gz
 FROM vp-${BUILDARCH} AS vp-bin
 
-FROM --platform=$BUILDPLATFORM node:24.21.0-bookworm-slim AS frontend
+FROM --platform=$BUILDPLATFORM node:24.21.0-bookworm-slim@sha256:2fe369e969550cde8e867afc3fe370b260140cab4a23d467074295b42163d553 AS frontend
 COPY --from=vp-bin /vp.tar.gz /tmp/vp.tar.gz
 RUN mkdir /opt/vp && tar -xzf /tmp/vp.tar.gz -C /opt/vp
 ENV PATH="/opt/vp:${PATH}"
@@ -18,11 +18,11 @@
 # Bound native checker concurrency independently of the build host CPU count.
 RUN GOMAXPROCS=2 GOMEMLIMIT=512MiB RAYON_NUM_THREADS=2 vp check && vp test run && vp build
 
-FROM python:3.12-slim AS runtime
+FROM python:3.12-slim@sha256:78387bc3881b8273120a12ebe6c1ab22b018ccc2c9adf565ae1ac9b536e184ea AS runtime
 WORKDIR /app
 ENV CODEBUDDY_AUTH_DIR=/data/auth
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+RUN pip install --no-cache-dir --require-hashes --only-binary=:all: -r requirements.txt
 COPY VERSION ./
 COPY converter.py ./
 COPY app/ ./app/

docs/deployment.md

@@ -49,17 +49,30 @@ Requires Python, uv, and Node.js with the vp CLI to build the interface:
 
 ```bash
 uv venv
-uv pip install -r requirements.txt
+uv pip install --require-hashes --only-binary=:all: -r requirements.txt
 (cd web && vp install --frozen-lockfile && vp build)
 uv run --env-file .env converter.py --desensitize
 ```
 
 Configure `.env` as above before starting, then open `/dashboard` to add accounts. Rebuild the WebUI after changing frontend source.
 
-Without uv, run `python3 -m venv .venv`, activate it, install dependencies with `pip install -r requirements.txt`, and start with `python3 converter.py --desensitize`. **Plain Python does not load `.env`**; export environment variables or pass CLI flags explicitly.
+Without uv, run `python3 -m venv .venv`, activate it, install dependencies with `pip install --require-hashes --only-binary=:all: -r requirements.txt`, and start with `python3 converter.py --desensitize`. **Plain Python does not load `.env`**; export environment variables or pass CLI flags explicitly.
 
 Local Python binding uses `--host` and `--port`. Compose-only `CODEBUDDY2API_BIND`, `CODEBUDDY2API_PORT` and `CODEBUDDY2API_AUTH_PATH` do not change the local listener or data directory.
 
+## Dependency locks
+
+`requirements.in` lists direct dependencies; install the committed, hash-locked `requirements.txt`. To regenerate it with uv:
+
+```bash
+uv pip compile --universal --python-version 3.12 --no-python-downloads --generate-hashes requirements.in -o requirements.txt
+```
+
+Existing pins are reused; use `--upgrade-package NAME` only for deliberate updates and review the lockfile diff. Installation requires matching binary wheels and hashes; fix the lock or roll back rather than disabling those checks.
+
+Docker's build frontend, Node and Python images are pinned by multi-platform digest. When refreshing them, retain `linux/amd64` and `linux/arm64` support and verify the build. Locks prevent drift, not future vulnerabilities; security updates still require reviewed refreshes.
+
+
 ## CLI login
 
 When the WebUI is unavailable, browser login also works without starting the server:

docs/deployment.zh-CN.md

@@ -49,17 +49,30 @@ docker compose up -d --no-build
 
 ```bash
 uv venv
-uv pip install -r requirements.txt
+uv pip install --require-hashes --only-binary=:all: -r requirements.txt
 (cd web && vp install --frozen-lockfile && vp build)
 uv run --env-file .env converter.py --desensitize
 ```
 
 先按上文配置 `.env`，再启动服务并进入 `/dashboard` 添加账号。更改前端源码后需重新构建 WebUI。
 
-不使用 uv 时，可执行 `python3 -m venv .venv`，激活环境后用 `pip install -r requirements.txt` 安装依赖，将运行命令换为 `python3 converter.py --desensitize`。**普通 Python 不自动读取 `.env`**，须显式导出环境变量或传入 CLI 参数。
+不使用 uv 时，可执行 `python3 -m venv .venv`，激活环境后用 `pip install --require-hashes --only-binary=:all: -r requirements.txt` 安装依赖，将运行命令换为 `python3 converter.py --desensitize`。**普通 Python 不自动读取 `.env`**，须显式导出环境变量或传入 CLI 参数。
 
 本地 Python 的监听地址和端口由 `--host`、`--port` 控制；Compose 专用的 `CODEBUDDY2API_BIND`、`CODEBUDDY2API_PORT`、`CODEBUDDY2API_AUTH_PATH` 不改变本地监听和数据目录。
 
+## 依赖锁定
+
+`requirements.in` 维护直接依赖；安装使用已提交、带哈希的 `requirements.txt`。用 uv 重新生成：
+
+```bash
+uv pip compile --universal --python-version 3.12 --no-python-downloads --generate-hashes requirements.in -o requirements.txt
+```
+
+默认沿用已有固定版本；有意升级时再用 `--upgrade-package NAME`，并审阅锁文件差异。安装要求匹配的二进制 wheel 和哈希；失败时修正锁文件或回退，不关闭检查。
+
+Docker 构建前端、Node 和 Python 镜像按多架构 digest 固定。更新时保留 `linux/amd64`、`linux/arm64` 并验证构建。锁定防止漂移，不代替后续安全更新。
+
+
 ## 命令行登录
 
 无法使用 WebUI 时也可扫码登录，无需先启动服务：

docs/webui.md

@@ -11,9 +11,9 @@ Management is locked without a key. After changing it, sign in again and restart
 ## Common tasks
 
 - **Overview:** view requests, usage and credential health. Official account balances may include usage from other clients.
-- **Credentials:** select Mainland China (CN), International WorkBuddy or International CodeBuddy for browser login, or import `.info`/ZIP files. Distinguish manual disabling, credential-level authentication circuits and model-level 429 cooldowns. Disabling keeps files; deletion removes them and requires removing model bindings first. Exports contain plaintext credentials; do not share them.
+- **Credentials:** select Mainland China (CN), International WorkBuddy or International CodeBuddy for browser login, or import `.info`/ZIP files. Distinguish manual disabling, credential-level authentication circuits and model-level 429 cooldowns. Disabling keeps files; deletion removes them and requires removing model bindings first. Exports preserve safe UTF-8 filenames (otherwise `credential.info`/`credentials.zip`) and contain plaintext credentials; do not share them.
 - **Models:** enable models, set public IDs, regions/products and specific accounts. Unavailable bindings never fall back to unselected accounts. Clients use the IDs published here.
-- **Logs:** filter requests and inspect failed attempts. Clearing details keeps historical statistics.
+- **Logs:** filter requests and inspect failed attempts. Closing details or switching log type cancels pending detail loads. Clearing details keeps historical statistics.
 - **Settings:** edit unlocked options; hot changes apply immediately, while restart-marked settings require a manual restart. Change locked options in the startup configuration; see [configuration precedence](advanced.md).
   - “Keep tool descriptions” is off by default and works across all three protocols, independently of prompt compaction; see [tool metadata retention](advanced.md#tool-metadata-retention) for configuration and limits.
 

docs/webui.zh-CN.md

@@ -11,9 +11,9 @@
 ## 常用操作
 
 - **运行概览**：查看请求、用量和凭证健康状态。官方账号余额可能包含其他客户端的使用。
-- **凭证管理**：选择“中国大陆 · CN”“国际 · WorkBuddy”或“国际 · CodeBuddy”扫码添加账号，也可导入 `.info`、ZIP 文件。区分人工停用、凭证级认证熔断和模型级 429 冷却；停用保留文件，删除会移除文件，仍有模型绑定时需先解除。导出含明文凭证，请勿分享。
+- **凭证管理**：选择“中国大陆 · CN”“国际 · WorkBuddy”或“国际 · CodeBuddy”扫码添加账号，也可导入 `.info`、ZIP 文件。区分人工停用、凭证级认证熔断和模型级 429 冷却；停用保留文件，删除会移除文件，仍有模型绑定时需先解除。导出保留安全的 UTF-8 文件名，否则使用 `credential.info`/`credentials.zip`；文件含明文凭证，请勿分享。
 - **模型路由**：设置模型启停、对外 ID、地域/产品和指定账号；绑定不可用时不会回退到未选账号。客户端使用这里发布的 ID。
-- **日志审计**：筛选请求、查看失败详情。清空明细会保留历史统计。
+- **日志审计**：筛选请求、查看失败详情。关闭详情或切换日志类型会取消未完成的详情加载。清空明细会保留历史统计。
 - **系统设置**：修改可编辑项；热更新项立即生效，标记为重启生效的设置需手动重启。锁定项在启动配置中修改，优先级见 [进阶参考](advanced.zh-CN.md)。
   - “保留工具描述”默认关闭，可为三协议保留工具说明；独立于提示词压缩，配置与限制见 [工具描述保留](advanced.zh-CN.md#工具描述保留)。
 

requirements.in

@@ -0,0 +1,5 @@
+# Direct dependencies; requirements.txt is the generated, hash-locked install file.
+fastapi
+uvicorn[standard]
+httpx
+pytest