v0.3.0

Added

• AUTH_DISABLED=true turns off every credential check — SOCKS5, the HTTP proxy's 407 and the API's bearer token — so a plain socks5h://127.0.0.1:9250 works and the dashboard opens straight to the pool. Only set it where nothing else can reach the ports: whoever can open a socket gets your Tor bandwidth, the session table and the ability to restart instances. GET /api/auth/status reports whether authentication is required.
• Typed failure reports. POST /api/sessions/{key}/failure accepts kind: captcha, blocked, rate_limited, transport or other. A captcha means the exit IP is burnt, so two reports quarantine the instance; a 429 means the exit still works, so it counts for less than one and never trips QUARANTINE_CONSECUTIVE. reason still works, and a bodyless POST is still worth one ordinary failure.
• failure_score, quarantine_score and failures_by_kind in each instance's health, with matching torpool_* metrics — the score, not the report count, is what says how close an instance is to quarantine.
• Documentation at lncrawl.github.io/tor-pool, built from docs/ on every push to main.

Changed

• compose.yml defaults to AUTH_DISABLED=true, since it publishes every port to 127.0.0.1. If you deploy from a checkout of this repo, set AUTH_DISABLED=false in your .env before upgrading — a restart otherwise turns authentication off, and if you had widened a *_PUBLISH line the pool becomes reachable and unauthenticated in the same step. The image's own default is still false, so docker run and your own compose file are unaffected.
• Tokens and token ids are base62 — tp_ plus 22 alphanumerics instead of base64url. Same bits, no - or _ for a terminal to word-break or a double-click to half-select. Tokens issued before this keep working.
• DELETE /api/sessions/{key} needs proxy, not admin, so a client can release the session it created. A scraper holds a proxy token by design, so until now every session it opened sat in its slot until SESSION_TTL, and enough of them ran the pool out of capacity. GET /api/sessions stays admin.

Fixed

• The dashboard no longer polls the session list from a hidden tab. Opening Sessions started a 3-second GET /api/sessions loop that then ran for the life of the page.
• The Python examples in README.md and docs/scraper.md run against lncrawl-scraper 1.x, and the stickiness promise now names PIN_EXIT_RELAY — without it one instance can hand a caller more than one exit IP.