fix: premature torrent removals, HnR clear mode, tests, .cursor in gi…

.github/autofix/auto_fix.py

@@ -9,10 +9,10 @@
 import sys
 import textwrap
 import uuid
+from collections.abc import Iterable
 from dataclasses import dataclass
 from io import BytesIO
 from pathlib import Path
-from typing import Iterable
 from zipfile import ZipFile
 
 import requests

.github/scripts/update_releases.py

@@ -7,10 +7,9 @@
 import re
 import subprocess
 import sys
-from typing import Dict, List
 
 
-def extract_changelog_entries() -> Dict[str, str]:
+def extract_changelog_entries() -> dict[str, str]:
     """Extract all changelog entries from CHANGELOG.md"""
     with open("CHANGELOG.md") as f:
         content = f.read()
@@ -31,7 +30,7 @@ def extract_changelog_entries() -> Dict[str, str]:
     return entries
 
 
-def get_existing_releases() -> List[str]:
+def get_existing_releases() -> list[str]:
     """Get list of existing GitHub releases"""
     result = subprocess.run(
         ["gh", "release", "list", "--limit", "100"], capture_output=True, text=True, check=True

.github/workflows/codeql.yml

@@ -21,6 +21,7 @@ jobs:
       matrix:
         language:
         - python
+        - javascript-typescript
     steps:
     - name: Checkout repository
       uses: actions/checkout@v6

.github/workflows/dockerhub-description.yml

@@ -13,6 +13,8 @@ jobs:
   publish-descriptions:
     name: Update Docker Hub and PyPI metadata
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
     - name: Check out repository
       uses: actions/checkout@v6

.github/workflows/docs.yml

@@ -55,6 +55,13 @@ jobs:
         git config user.name "github-actions[bot]"
         git config user.email "github-actions[bot]@users.noreply.github.com"
 
+    - name: Ensure changelog page exists
+      run: |
+        if [ ! -f docs/changelog.md ] || [ -L docs/changelog.md ]; then
+          rm -f docs/changelog.md
+          cp CHANGELOG.md docs/changelog.md
+        fi
+
     - name: Build documentation
       run: mkdocs build --strict --verbose
 
@@ -99,6 +106,13 @@ jobs:
         pip install -r requirements.docs.txt
         pip install linkchecker
 
+    - name: Ensure changelog page exists
+      run: |
+        if [ ! -f docs/changelog.md ] || [ -L docs/changelog.md ]; then
+          rm -f docs/changelog.md
+          cp CHANGELOG.md docs/changelog.md
+        fi
+
     - name: Build docs
       run: mkdocs build
 

.github/workflows/nightly.yml

@@ -23,9 +23,6 @@ jobs:
       packages: write
       contents: read
     if: ${{ ! startsWith(github.event.head_commit.message, '[patch]') && ! startsWith(github.event.head_commit.message, '[minor]') && ! startsWith(github.event.head_commit.message, '[major]') }}
-    strategy:
-      matrix:
-        platform: [amd64, arm64]
     steps:
     - id: string
       uses: ASzc/change-string-case-action@v6
@@ -65,7 +62,7 @@ jobs:
       uses: docker/build-push-action@v6
       with:
         context: .
-        platforms: linux/amd64
+        platforms: linux/amd64,linux/arm64
         push: true
         tags: feramance/qbitrr:nightly,ghcr.io/${{ steps.string.outputs.lowercase }}:nightly
         labels: ${{ steps.meta.outputs.labels }}

.github/workflows/pre-commit.yaml

@@ -8,10 +8,14 @@ on:
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v6
     - name: Set up Python
       uses: actions/setup-python@v6
       with:
         python-version: '3.12'
+    - name: Install project (for absolufy-imports and import resolution)
+      run: pip install -e .
     - uses: pre-commit/action@v3.0.1

.github/workflows/pull_requests.yml

@@ -43,11 +43,12 @@ jobs:
         ref: ${{ github.event.pull_request.head.ref }}
     - name: Install Homebrew dependencies
       if: runner.os == 'macOS'
-      run: "/bin/bash -c \"$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)\"\n"
+      run: |
+        brew install sdl2
     - name: Set up Python ${{ matrix.python }}
       uses: actions/setup-python@v6
       with:
-        python-version: ${{ matrix.python}}
+        python-version: ${{ matrix.python }}
         architecture: ${{ matrix.arch }}
         cache: pip
     - name: Install APT dependencies
@@ -64,7 +65,7 @@ jobs:
         RELEASE_HASH: ${{ steps.git_hash.outputs.HASH }}
       run: "python - <<'PY'\nimport os\nfrom pathlib import Path\nimport re\n\nrelease_hash = os.environ[\"RELEASE_HASH\"]\npath = Path(\"qBitrr/bundled_data.py\")\ncontent = path.read_text()\nupdated = re.sub(r'git_hash = \".*\"', f'git_hash = \"{release_hash}\"', content)\npath.write_text(updated)\nPY\n"
     - name: Retrieve current version
-      run: "echo \"Current version: $(python setup.py --version)\"\necho \"VERSION=$(python setup.py --version)\" >> $GITHUB_OUTPUT\n"
+      run: "VERSION=$(python -c \"import configparser; c = configparser.ConfigParser(); c.read('setup.cfg'); print(c['metadata']['version'])\")\necho \"Current version: ${VERSION}\"\necho \"VERSION=${VERSION}\" >> $GITHUB_OUTPUT\n"
       id: current_version
     - name: Set up Node.js
       uses: actions/setup-node@v6
@@ -102,6 +103,7 @@ jobs:
   docker_image:
     name: Build Docker Images
     runs-on: ubuntu-latest
+    if: github.event.pull_request.head.repo.full_name == github.repository
     permissions:
       packages: write
       contents: read

.github/workflows/release.yml

@@ -61,7 +61,7 @@ jobs:
       run: "bump2version \"${RELEASE_TYPE}\"\n"
     - name: Capture new version
       id: version
-      run: "VERSION=$(python setup.py --version)\necho \"value=${VERSION}\" >> \"${GITHUB_OUTPUT}\"\necho \"New version: ${VERSION}\"\n"
+      run: "VERSION=$(python -c \"import configparser; c = configparser.ConfigParser(); c.read('setup.cfg'); print(c['metadata']['version'])\")\necho \"value=${VERSION}\" >> \"${GITHUB_OUTPUT}\"\necho \"New version: ${VERSION}\"\n"
     - name: Import GPG key
       id: import_gpg
       uses: crazy-max/ghaction-import-gpg@v6.3.0

.gitignore

@@ -7,6 +7,7 @@
 .run/
 .vscode/
 .vs/
+.cursor
 
 # Testing
 /qBitrr/testing/test.py
@@ -20,6 +21,7 @@ __pycache__/
 *.so
 *.egg
 *.egg-info/
+qBitrr2.egg-info/
 .Python
 
 # Build artifacts
@@ -69,7 +71,6 @@ test_webui.sh
 /scripts/temp/
 
 # Development
-CLAUDE.md
-compose.yml
 opencodetmp/
 .claude
+CLAUDE.md

.pre-commit-config.yaml

@@ -19,7 +19,7 @@ repos:
   rev: v3.21.0
   hooks:
   - id: pyupgrade
-    args: [--py38-plus]
+    args: [--py311-plus]
 - repo: https://github.com/pycqa/isort
   rev: 7.0.0
   hooks:

AGENTS.md

@@ -307,7 +307,7 @@ Each release produces:
 - **Tagging**: Radarr/Sonarr downloads MUST have tags matching the category configured for qBitrr to track them
 - **Paths**: qBit's "Save Path" must be accessible to Radarr/Sonarr (common issue in Docker with mismatched volumes)
 - **WebUI Token**: If `Settings.WebUIToken` is set, all `/api/*` calls require `X-API-Token` header
-- **Database Locks**: Use `db_lock.py:locked_database()` context manager for all Peewee queries to avoid conflicts
+- **Database Locks**: Use `db_lock.py:database_lock()` context manager for all Peewee queries to avoid conflicts
 
 ## Documentation Maintenance
 

Dockerfile

@@ -6,29 +6,39 @@ RUN cd webui && npm ci
 COPY webui webui
 RUN mkdir -p qBitrr/static && cd webui && npm run build
 
-# Pin Python to the latest supported version we support in production
-FROM python:3.14
+FROM python:3.12-slim
 
 LABEL Name="qBitrr"
 LABEL Maintainer="feramance"
 LABEL Version="5.9.1"
 LABEL org.opencontainers.image.source=https://github.com/feramance/qbitrr
 
+# Install tini (PID 1, SIGTERM forwarding), gosu (drop privileges after chown), and curl (health checks)
+RUN apt-get update && apt-get install -y --no-install-recommends tini gosu curl \
+    && rm -rf /var/lib/apt/lists/*
+
 # Env used by the script to determine if it's inside a docker -
 # if this is set to 69420 it will change the working dir for docker specific values
 ENV QBITRR_DOCKER_RUNNING=69420
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1
 ENV PYTHONOPTIMIZE=1
 
-RUN pip install --quiet -U pip wheel
+RUN pip install --no-cache-dir --quiet -U pip wheel
 WORKDIR /app
 COPY . /app
 COPY --from=webui-build /src/qBitrr/static/ /app/qBitrr/static/
-RUN rm -rf qBitrr2.egg-info *.egg-info && pip install --quiet ".[fast]"
+RUN rm -rf qBitrr2.egg-info *.egg-info && pip install --no-cache-dir --quiet ".[fast]"
+
+RUN groupadd -r qbitrr && useradd -r -g qbitrr -d /config -s /sbin/nologin qbitrr \
+    && mkdir -p /config && chown -R qbitrr:qbitrr /config /app
+
+COPY docker-entrypoint.sh /docker-entrypoint.sh
+RUN chmod +x /docker-entrypoint.sh
 
 WORKDIR /config
 
 EXPOSE 6969
 
-ENTRYPOINT ["python", "-m", "qBitrr.main"]
+ENTRYPOINT ["/docker-entrypoint.sh"]
+CMD ["python", "-m", "qBitrr.main"]

README.md

@@ -186,4 +186,4 @@ Released under the [MIT License](LICENSE). Use it, modify it, share it—commerc
    <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=Feramance/qBitrr&type=date&legend=top-left" />
    <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=Feramance/qBitrr&type=date&legend=top-left" />
  </picture>
-</a>
+</a>

config.example.toml

@@ -155,8 +155,8 @@ MaxSeedingTime = -1
 #    4 = Remove when both conditions are met (AND)
 RemoveTorrent = -1
 
-# Enable Hit and Run protection for managed category torrents
-HitAndRunMode = false
+# Hit and Run mode: and = require both ratio and time; or = either clears; disabled = no HnR
+HitAndRunMode = "disabled"
 
 # Minimum seed ratio before removal allowed (HnR protection)
 MinSeedRatio = 1.0

docker-compose.yml

@@ -0,0 +1,32 @@
+services:
+  qbitrr:
+    container_name: qbitrr
+    build:
+      context: .
+      dockerfile: Dockerfile
+    environment:
+    - UMASK=000
+    - TZ=${TZ}
+    - PUID=${USER_ID}
+    - PGID=${USER_ID}
+    restart: always
+    tty: true
+    stop_grace_period: 30s
+    volumes:
+    - torrents:/torrents
+    - .config:/config
+    logging:
+      driver: json-file
+      options:
+        max-size: 50m
+        max-file: 1
+    ports:
+    - 6969:6969
+
+volumes:
+  torrents:
+    driver: local
+    driver_opts:
+      type: cifs
+      device: ${CIFS_PATH}
+      o: username=${CIFS_USER},password=${CIFS_PASS},vers=3.1.1,iocharset=utf8

docker-entrypoint.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+set -e
+# Default to 1000:1000 when PUID/PGID are not set (e.g. docker run without -e)
+export PUID="${PUID:-1000}"
+export PGID="${PGID:-1000}"
+
+# When running as root, ensure /config is owned by PUID:PGID so the app can write
+# (mounted volumes often appear as root-owned; this restores writability)
+if [ "$(id -u)" = "0" ] && [ "${PUID}" != "0" ]; then
+    chown -R "${PUID}:${PGID}" /config 2>/dev/null || true
+fi
+
+# Run the container CMD as the specified user (tini + python)
+exec gosu "${PUID}:${PGID}" /usr/bin/tini -- "$@"

docs/advanced/architecture.md

@@ -939,7 +939,7 @@ def run_loop(self):
             time.sleep(LOOP_SLEEP_TIMER)
 
         except DelayLoopException as e:
-            logger.warning(f"Delaying loop for {e.length}s: {e.type}")
+            logger.warning(f"Delaying loop for {e.length}s: {e.error_type}")
             time.sleep(e.length)
 
         except RestartLoopException:
@@ -970,12 +970,12 @@ if torrent['category'] not in self.categories:
 
 ```python
 class DelayLoopException(qBitManagerError):
-    def __init__(self, length: int, type: str):
-        self.type = type      # Reason for delay
-        self.length = length  # Seconds to delay
+    def __init__(self, length: int, error_type: str):
+        self.error_type = error_type  # Reason for delay
+        self.length = length          # Seconds to delay
 
 # Usage: raised when qBittorrent or an Arr API is unreachable
-raise DelayLoopException(length=60, type="qbittorrent_offline")
+raise DelayLoopException(length=60, error_type="qbittorrent_offline")
 ```
 
 **RestartLoopException** -- restart from the beginning after a config reload:
@@ -989,9 +989,9 @@ class RestartLoopException(ArrManagerException):
 
 ```python
 class NoConnectionrException(qBitManagerError):
-    def __init__(self, message: str, type: str = "delay"):
+    def __init__(self, message: str, error_type: str = "delay"):
         self.message = message
-        self.type = type  # "delay" or "fatal"
+        self.error_type = error_type  # "delay" or "fatal"
 ```
 
 ### Torrent State Machine

docs/advanced/index.md

@@ -345,7 +345,7 @@ External monitoring can check:
 
 ```bash
 # Check if qBitrr is running
-curl http://localhost:6969/api/health
+curl http://localhost:6969/health
 
 # Expected response:
 {"status": "healthy", "version": "5.5.5"}

docs/changelog.md

@@ -1 +1 @@
-../CHANGELOG.md
+{% include-markdown "../CHANGELOG.md" %}