Keep PR 900 overrides bounded and opt-in

The PR adds API limit overrides and static proxy support, but the review found that the default proxy provider changed to an invalid static placeholder and the new API fields accepted unbounded values. This keeps the existing proxy default intact, makes static proxy explicit via config or CLI, validates API limit ranges, and adds focused regression coverage for both paths.

Constraint: PR branch must remain contributor-branch compatible and avoid adding dependencies

Rejected: Keep static as the default provider | breaks existing --enable_ip_proxy defaults with an invalid placeholder URL

Rejected: Accept arbitrary integer limits | lets API callers request negative or excessive crawl sizes

Confidence: high

Scope-risk: narrow

Directive: Do not change proxy provider defaults when adding new providers; new providers should be opt-in and covered by provider-specific tests

Tested: uv run pytest tests/test_api_limits.py tests/test_static_proxy_provider.py

Tested: uv run pytest tests

Tested: uv run pytest test/test_utils.py

Tested: uv run python -m compileall api cmd_arg config proxy tests

Tested: git diff --cached --check

Not-tested: Live crawler run against external platforms or real proxy vendor endpoints

tests/test_api_limits.py

@@ -13,7 +13,7 @@ async def test_cmd_arg_crawler_max_notes_count():
     # Store original values
     orig_notes = config.CRAWLER_MAX_NOTES_COUNT
     orig_comments = config.CRAWLER_MAX_COMMENTS_COUNT_SINGLENOTES
-    
+
     try:
         await parse_cmd([
             "--platform", "xhs",
@@ -28,7 +28,7 @@ async def test_cmd_arg_crawler_max_notes_count():
 
 def test_crawler_manager_build_command():
     cm = CrawlerManager()
-    
+
     # 1. No max limits passed in API request
     req1 = CrawlerStartRequest(
         platform=PlatformEnum.XHS,
@@ -64,10 +64,10 @@ def test_crawler_manager_build_command():
 
 def test_api_start_crawler_with_limits():
     client = TestClient(app)
-    
+
     with patch("api.routers.crawler.crawler_manager.start", new_callable=AsyncMock) as mock_start:
         mock_start.return_value = True
-        
+
         # Test case 1: with limits
         response = client.post("/api/crawler/start", json={
             "platform": "xhs",
@@ -77,10 +77,10 @@ def test_api_start_crawler_with_limits():
             "max_notes_count": 50,
             "max_comments_count": 5
         })
-        
+
         assert response.status_code == 200
         assert response.json() == {"status": "ok", "message": "Crawler started successfully"}
-        
+
         mock_start.assert_called_once()
         called_request = mock_start.call_args[0][0]
         assert called_request.platform == PlatformEnum.XHS
@@ -89,10 +89,10 @@ def test_api_start_crawler_with_limits():
 
 def test_api_start_crawler_without_limits():
     client = TestClient(app)
-    
+
     with patch("api.routers.crawler.crawler_manager.start", new_callable=AsyncMock) as mock_start:
         mock_start.return_value = True
-        
+
         # Test case 2: without limits
         response = client.post("/api/crawler/start", json={
             "platform": "xhs",
@@ -100,10 +100,38 @@ def test_api_start_crawler_without_limits():
             "crawler_type": "search",
             "keywords": "test"
         })
-        
+
         assert response.status_code == 200
         mock_start.assert_called_once()
         called_request = mock_start.call_args[0][0]
         assert called_request.platform == PlatformEnum.XHS
         assert called_request.max_notes_count is None
         assert called_request.max_comments_count is None
+
+
+@pytest.mark.parametrize(
+    ("field_name", "value"),
+    [
+        ("max_notes_count", 0),
+        ("max_notes_count", -1),
+        ("max_notes_count", 10001),
+        ("max_comments_count", 0),
+        ("max_comments_count", -1),
+        ("max_comments_count", 10001),
+    ],
+)
+def test_api_rejects_invalid_limits(field_name, value):
+    client = TestClient(app)
+    payload = {
+        "platform": "xhs",
+        "login_type": "qrcode",
+        "crawler_type": "search",
+        "keywords": "test",
+        field_name: value,
+    }
+
+    with patch("api.routers.crawler.crawler_manager.start", new_callable=AsyncMock) as mock_start:
+        response = client.post("/api/crawler/start", json=payload)
+
+    assert response.status_code == 422
+    mock_start.assert_not_called()