4 Commits

Author	SHA1	Message	Date
Dex Miller	67e074c0a7	refactor(proxy): transparent header forwarding via hyper client (#1714) ... * style(frontend): reformat provider forms, constants and hooks Apply prettier formatting across 5 frontend files. No logic changes. Changed files: - AddProviderDialog.tsx: reformat generic type annotation and callback - ClaudeFormFields.tsx: consolidate multi-line useState and Collapsible props - CodexConfigSections.tsx: expand single-line React imports to multi-line, collapse removeCodexTopLevelField() call - constants.ts: merge TemplateType into single line - useSkills.ts: expand single-line TanStack Query imports to multi-line, reformat uninstallSkill mutationFn chain * deps(proxy): add hyper ecosystem crates and manual decompression libs reqwest internally normalizes all header names to lowercase and does not preserve insertion order, causing proxied requests to differ from the original client requests. To achieve transparent header forwarding with original casing and order, introduce lower-level hyper HTTP client libs. New dependencies: - hyper-util 0.1: TokioExecutor + legacy Client with preserve_header_case support for HTTP/1.1 - hyper-rustls 0.27: rustls-based TLS connector for hyper - http 1 / http-body 1 / http-body-util 0.1: HTTP type crates for hyper 1.x request/response construction - flate2 1: manual gzip/deflate decompression (replaces reqwest auto) - brotli 7: manual brotli decompression Changed dependencies: - serde_json: enable preserve_order feature to keep JSON field order - reqwest: drop gzip feature to prevent reqwest from overriding the client's original accept-encoding header * refactor(proxy): use hyper client for header-case preserving forwarding Previously the proxy used reqwest for all upstream requests. reqwest normalizes header names to lowercase and reorders them internally, making proxied requests distinguishable from direct CLI requests. Some upstream providers are sensitive to these differences. This commit replaces reqwest with a hyper-based HTTP client on the default (non-proxy) path, achieving wire-level header fidelity: Server layer (server.rs): - Replace axum::serve with a manual hyper HTTP/1.1 accept loop - Enable preserve_header_case(true) so incoming header casing is captured in a HeaderCaseMap extension on each request - Bridge hyper requests to axum Router via tower::Service New hyper client module (hyper_client.rs): - Lazy-initialized hyper-util Client with preserve_header_case - ProxyResponse enum wrapping both hyper::Response and reqwest::Response behind a unified interface (status, headers, bytes, bytes_stream) - send_request() builds requests with ordered HeaderMap + case map Request handlers (handlers.rs): - Switch from (HeaderMap, Json<Value>) extractors to raw axum::extract::Request to preserve Extensions (containing the HeaderCaseMap from the accept loop) - Pass extensions through the forwarding chain Forwarder (forwarder.rs): - Remove HEADER_BLACKLIST array; replace with ordered header iteration that preserves original header sequence and casing - Build ordered_headers by iterating client headers, skipping only auth/host/content-length, and inserting auth headers at the original authorization position to maintain order - Handle anthropic-beta (ensure claude-code-20250219 tag) and anthropic-version (passthrough or default) inline during iteration - Remove should_force_identity_encoding() — accept-encoding is now transparently forwarded to upstream - Use hyper client by default; fall back to reqwest only when an HTTP/SOCKS5 proxy tunnel is configured Provider adapters (adapter.rs, claude.rs, codex.rs, gemini.rs): - Replace add_auth_headers(RequestBuilder) -> RequestBuilder with get_auth_headers(AuthInfo) -> Vec<(HeaderName, HeaderValue)> - Adapters now return header pairs instead of mutating a reqwest builder - Claude adapter: merge Anthropic/ClaudeAuth/Bearer into single branch; move Copilot fingerprint headers into get_auth_headers Response processing (response_processor.rs): - Add manual decompression (gzip/deflate/brotli via flate2 + brotli) for non-streaming responses, since reqwest auto-decompression is now disabled to allow accept-encoding passthrough - Add compressed-SSE warning log for streaming responses - Accept ProxyResponse instead of reqwest::Response HTTP client (http_client.rs): - Disable reqwest auto-decompression (.no_gzip/.no_brotli/.no_deflate) on both global and per-provider clients Streaming adapters (streaming.rs, streaming_responses.rs): - Generalize stream error type from reqwest::Error to generic E: Error Misc: - log_codes.rs: add SRV-005 (ACCEPT_ERR) and SRV-006 (CONN_ERR) - stream_check.rs: reformat copilot header lines - transform.rs: fix trailing whitespace alignment * fix(lint): resolve 35 clippy warnings across Rust codebase Fix all clippy warnings reported by `cargo clippy --lib`: - codex_config.rs: fix doc_overindented_list_items (3 spaces -> 2) - commands/copilot.rs: inline format args in 2 log::error! calls - commands/provider.rs: inline format args in 3 map_err closures - proxy/hyper_client.rs: inline format arg in log::debug! call - proxy/providers/copilot_auth.rs: inline format args in 16 locations (log macros, format! in headers, error constructors) - proxy/thinking_optimizer.rs: inline format args in 2 log::info! calls - services/skill.rs: inline format args in log::debug! call - services/webdav_sync.rs: inline format args in 6 format! calls (version compat messages, download limit messages) - services/webdav_sync/archive.rs: inline format args in 2 format! calls - session_manager/providers/opencode.rs: inline format args in source_path format! All fixes use the clippy::uninlined_format_args suggestion pattern: format!("msg: {}", var) -> format!("msg: {var}") * deps(proxy): add raw HTTP write and native TLS cert dependencies Add crates required for the raw TCP/TLS write path that bypasses hyper's header encoder to preserve original header name casing: - httparse: parse raw TCP peek bytes to capture header casings - tokio-rustls + rustls: direct TLS connections for raw write path - webpki-roots: Mozilla CA bundle baseline - rustls-native-certs: load system keychain CAs (trusts proxy MITM certificates from Clash, mitmproxy, etc.) * fix(proxy): address code review feedback on response handling Fixes from PR #1714 code review: - Extract `read_decoded_body()` and `strip_entity_headers_for_rebuilt_body()` in response_processor to properly clean content-encoding/content-length headers after decompression - Reuse `read_decoded_body()` in handlers.rs for Claude transform path, ensuring compressed responses are decoded before format conversion - Make `build_proxy_url_from_config()` public so forwarder can pass proxy URL to the hyper raw write path - Add `has_system_proxy_env()` utility with test coverage - Add 50ms backoff after accept() failures in server.rs to prevent tight-loop CPU spin on transient socket errors * feat(proxy): implement raw TCP/TLS write with HTTP CONNECT tunnel Rewrite hyper_client with a two-tier strategy for header case preservation: Primary path (raw write): - Peek raw TCP bytes in server.rs to capture OriginalHeaderCases before hyper lowercases them - Build raw HTTP/1.1 request bytes with exact original header name casing - Write directly to TLS stream, then use WriteFilter to let hyper parse the response while discarding its duplicate request writes - Support HTTP CONNECT tunneling through upstream proxies, so header case is preserved even when a proxy (Clash, V2Ray) is configured Fallback path (hyper-util Client): - Used when OriginalHeaderCases is empty or raw write fails - Configured with title_case_headers(true) for best-effort casing TLS improvements: - Load native system certificates alongside webpki roots so proxy MITM CAs (installed in system keychain) are trusted through CONNECT tunnels Key types added: - OriginalHeaderCases: maps lowercase name → original wire-casing bytes - WriteFilter<S>: AsyncRead+AsyncWrite wrapper that discards writes - connect_via_proxy(): HTTP CONNECT tunnel establishment - ExtensionDebugMarker: diagnostic marker for extension chain debugging * refactor(proxy): route requests through hyper with proxy-aware forwarding Rework forwarder request dispatch to always prefer the hyper raw write path (header case preservation) over reqwest: Request routing: - HTTP/HTTPS proxy: hyper raw write through CONNECT tunnel (case preserved) - SOCKS5 proxy: reqwest fallback (CONNECT not supported for SOCKS5) - No proxy: hyper raw write direct connection Header handling improvements: - Replace host header in-place at original position instead of skip-and-append, preserving client's header ordering - Preserve client's original accept-encoding for transparent passthrough; only force identity encoding when transform path needs decompression - Add should_force_identity_encoding() to centralize the decision - Remove hardcoded 'br, gzip, deflate' override that masked client values Proxy URL resolution (priority order): 1. Provider-specific proxy config (if enabled) 2. Global proxy URL configured in CC Switch 3. Direct connection (no proxy) * chore(proxy): remove dead code, redundant tests and debug scaffolding - Inline should_force_identity_encoding() (was just `needs_transform`) and delete its 5 test cases - Remove ExtensionDebugMarker diagnostic type - Remove unused has_system_proxy_env() and its test - Remove strip_entity_headers test - Simplify hyper path: remove redundant is_socks_proxy ternary - Update hyper_client module doc to reflect CONNECT tunnel support * fix(proxy): block direct-connect fallback and complete CONNECT tunnel support * feat(hooks): improve proxy requirement warnings with specific reasons - Remove redundant OpenAI format hint toast messages - Add detailed reason detection for proxy requirements (OpenAI Chat, OpenAI Responses, full URL mode) - Update i18n files with new reason-specific keys * style(*): format code with prettier - Remove extra whitespace in http_client.rs - Fix formatting issues in useProviderActions.ts * fix(proxy): post-merge fixes for forward return type and clippy warnings - Restore forward() return type to (ProxyResponse, Option<String>) to pass claude_api_format through to callers - Inline format args in log::warn! macro (clippy::uninlined_format_args) - Suppress too_many_arguments for check_claude_stream * refactor(proxy): preserve original header wire order and add non-streaming body timeout - Rewrite build_raw_request to emit headers in original client-sent sequence instead of hash-map order - Remove unused OriginalHeaderCases::get_all method - Add body_timeout to read_decoded_body to prevent requests hanging when upstream stalls after headers	2026-03-29 20:26:15 +08:00
Andrew Leng	0dd823ae3a	fix(codex): fix 404 errors and connection timeout with custom base_url (#760) ... * fix(proxy): fix Codex 404 errors with custom base_url prefixes - handlers.rs:268: Remove hardcoded /v1 prefix in Codex forwarding - codex.rs:140: Only add /v1 for origin-only base_urls, dedupe /v1/v1 - stream_check.rs:364: Try /responses first, fallback to /v1/responses - provider.rs:427: Don't force /v1 for custom prefix base_urls Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(codex): always add /v1 for custom prefix base_urls Changed logic to always add /v1 prefix unless base_url already ends with /v1. This fixes 504 timeout errors with relay services that expect /v1 in the path. - Most relay services follow OpenAI standard format: /v1/responses - Users can opt-out by adding /v1 to their base_url configuration - Updated test case to reflect new behavior Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(proxy): allow system proxy on localhost with different ports - Only bypass system proxy if it points to CC Switch's own port (15721) - Allow other localhost proxies (e.g., Clash on 7890) to be used - Add INFO level logging for request URLs to aid debugging This fixes connection timeout issues when using local proxy tools. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(codex): don't add /v1 for custom prefix base_urls Reverted logic to not add /v1 for base_urls with custom prefixes. Many relay services use custom paths without /v1. - Pure origin (e.g., https://api.openai.com) → adds /v1 - With /v1 (e.g., https://api.openai.com/v1) → no change - Custom prefix (e.g., https://example.com/openai) → no /v1 This fixes 404 errors with relay services that don't use /v1 in their paths. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(proxy): use dynamic port for system proxy detection Instead of hardcoding port 15721, now uses the actual configured listen_port from proxy settings. - Added set_proxy_port() to update the port when proxy server starts - Added get_proxy_port() to retrieve current port for detection - Updated server.rs to call set_proxy_port() on startup - Updated tests to reflect new behavior This allows users to change the proxy port in settings without breaking the system proxy detection logic. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(proxy): change default proxy port from 15721 to 5000 Update the default fallback port in get_proxy_port() from 15721 to 5000 to match the project's standard default port configuration. Also updated test cases to use port 5000 consistently. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(proxy): revert default port back to 15721 Revert the default fallback port in get_proxy_port() from 5000 back to 15721 to align with the project's updated default port configuration. Also updated test cases to use port 15721 consistently. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> --------- Co-authored-by: ozbombor <ozbombor@users.noreply.github.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-29 09:10:17 +08:00
Dex Miller	e7badb1a24	Feat/provider individual config (#663) ... * refactor(ui): simplify UpdateBadge to minimal dot indicator * feat(provider): add individual test and proxy config for providers Add support for provider-specific model test and proxy configurations: - Add ProviderTestConfig and ProviderProxyConfig types in Rust and TypeScript - Create ProviderAdvancedConfig component with collapsible panels - Update stream_check service to merge provider config with global config - Proxy config UI follows global proxy style (single URL input) Provider-level configs stored in meta field, no database schema changes needed. * feat(ui): add failover toggle and improve proxy controls - Add FailoverToggle component with slide animation - Simplify ProxyToggle style to match FailoverToggle - Add usage statistics button when proxy is active - Fix i18n parameter passing for failover messages - Add missing failover translation keys (inQueue, addQueue, priority) - Replace AboutSection icon with app logo * fix(proxy): support system proxy fallback and provider-level proxy config - Remove no_proxy() calls in http_client.rs to allow system proxy fallback - Add get_for_provider() to build HTTP client with provider-specific proxy - Update forwarder.rs and stream_check.rs to use provider proxy config - Fix EditProviderDialog.tsx to include provider.meta in useMemo deps - Add useEffect in ProviderAdvancedConfig.tsx to sync expand state Fixes #636 Fixes #583 * fix(ui): sync toast theme with app setting * feat(settings): add log config management Fixes #612 Fixes #514 * fix(proxy): increase request body size limit to 200MB Fixes #666 * docs(proxy): update timeout config descriptions and defaults Fixes #612 * fix(proxy): filter x-goog-api-key header to prevent duplication * fix(proxy): prevent proxy recursion when system proxy points to localhost Detect if HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables point to loopback addresses (localhost, 127.0.0.1), and bypass system proxy in such cases to avoid infinite request loops. * fix(i18n): add providerAdvanced i18n keys and fix failover toast parameter - Add providerAdvanced.* i18n keys to en.json, zh.json, and ja.json - Fix failover toggleFailed toast to pass detail parameter - Remove Chinese fallback text from UI for English/Japanese users * fix(tray): restore tray-provider events and enable Auto failover properly - Emit provider-switched event on tray provider click (backward compatibility) - Auto button now: starts proxy, takes over live config, enables failover * fix(log): enable dynamic log level and single file mode - Initialize log at Trace level for dynamic adjustment - Change rotation strategy to KeepSome(1) for single file - Set max file size to 1GB - Delete old log file on startup for clean start * fix(tray): fix clippy uninlined format args warning Use inline format arguments: {app_type_str} instead of {} * fix(provider): allow typing :// in endpoint URL inputs Change input type from "url" to "text" to prevent browser URL validation from blocking :// input. Closes #681 * fix(stream-check): use Gemini native streaming API format - Change endpoint from OpenAI-compatible to native streamGenerateContent - Add alt=sse parameter for SSE format response - Use x-goog-api-key header instead of Bearer token - Convert request body to Gemini contents/parts format * feat(proxy): add request logging for debugging Add debug logs for outgoing requests including URL and body content with byte size, matching the existing response logging format. * fix(log): prevent usize underflow in KeepSome rotation strategy KeepSome(n) internally computes n-2, so n=1 causes underflow. Use KeepSome(2) as the minimum safe value.	2026-01-20 21:02:44 +08:00
Dex Miller	8b92982112	Feature/global proxy (#596) ... * refactor(proxy): simplify logging for better readability - Delete 17 verbose debug logs from handlers, streaming, and response_processor - Convert excessive INFO logs to DEBUG level for internal processing details - Add 2 critical INFO logs in forwarder.rs for failover scenarios: - Log when switching to next provider after failure - Log when all providers have been exhausted - Fix clippy uninlined_format_args warning This reduces log noise while maintaining visibility into key user-facing decisions. * fix: replace unsafe unwrap() calls with proper error handling - database/dao/mcp.rs: Use map_err for serde_json serialization - database/dao/providers.rs: Use map_err for settings_config and meta serialization - commands/misc.rs: Use expect() for compile-time regex pattern - services/prompt.rs: Use unwrap_or_default() for SystemTime - deeplink/provider.rs: Replace unwrap() with is_none_or pattern for Option checks Reduces potential panic points from 26 to 1 (static regex init, safe). * refactor(proxy): simplify verbose logging output - Remove response JSON full output logging in response_processor - Remove per-request INFO logs in provider_router (failover status, provider selection) - Change model mapping log from INFO to DEBUG - Change usage logging failure from INFO to WARN - Remove redundant debug logs for circuit breaker operations Reduces log noise significantly while preserving important warnings and errors. * feat(proxy): add structured log codes for i18n support Add error code system to proxy module logs for multi-language support: - CB-001~006: Circuit breaker state transitions and triggers - SRV-001~004: Proxy server lifecycle events - FWD-001~002: Request forwarding and failover - FO-001~005: Failover switch operations - USG-001~002: Usage logging errors Log format: [CODE] Chinese message Frontend/log tools can map codes to any language. New file: src/proxy/log_codes.rs - centralized code definitions * chore: bump version to 3.9.1 * style: format code with prettier and rustfmt * fix(ui): allow number inputs to be fully cleared before saving - Convert numeric state to string type for controlled inputs - Use isNaN() check instead of || fallback to allow 0 values - Apply fix to ProxyPanel, CircuitBreakerConfigPanel, AutoFailoverConfigPanel, and ModelTestConfigPanel * feat(pricing): support @ separator in model name matching - Refactor model name cleaning into chained method calls - Add @ to - replacement (e.g., gpt-5.2-codex@low → gpt-5.2-codex-low) - Add test case for @ separator matching * feat(proxy): add global proxy settings support Add ability to configure a global HTTP/HTTPS proxy for all outbound requests including provider API calls, speed tests, and stream checks. * fix(proxy): improve validation and error handling in proxy config panels - Add StopTimeout/StopFailed error types for proper stop() error reporting - Replace silent clamp with validation-and-block in config panels - Add listenAddress format validation in ProxyPanel - Use log_codes constants instead of hardcoded strings - Use once_cell::Lazy for regex precompilation * fix(proxy): harden error handling and input validation - Handle RwLock poisoning in settings.rs with unwrap_or_else - Add fallback for dirs::home_dir() in config modules - Normalize localhost to 127.0.0.1 in ProxyPanel - Format IPv6 addresses with brackets for valid URLs - Strict port validation with pure digit regex - Treat NaN as validation failure in config panels - Log warning on cost_multiplier parse failure - Align timeoutSeconds range to [0, 300] across all panels * feat(proxy): add local proxy auto-scan and fix hot-reload - Add scan_local_proxies command to detect common proxy ports - Fix SkillService not using updated proxy after hot-reload - Move global proxy settings to advanced tab - Add error handling for scan failures * fix(proxy): allow localhost input in proxy address field * fix(proxy): restore request timeout and fix proxy hot-reload issues - Add URL scheme validation in build_client (http/https/socks5/socks5h) - Restore per-request timeout for speedtest, stream_check, usage_script, forwarder - Fix set_global_proxy_url to validate before persisting to DB - Mask proxy credentials in all log outputs - Fix forwarder hot-reload by fetching client on each request * style: format code with prettier * fix(proxy): improve global proxy stability and error handling - Fix RwLock silent failures with explicit error propagation - Handle init() duplicate calls gracefully with warning log - Align fallback client config with build_client settings - Make scan_local_proxies async to avoid UI blocking - Add mixed mode support for Clash 7890 port (http+socks5) - Use multiple test targets for better proxy connectivity test - Clear invalid proxy config on init failure - Restore timeout constraints in usage_script - Fix mask_url output for URLs without port - Add structured error codes [GP-001 to GP-009] * feat(proxy): add username/password authentication support - Add separate username and password input fields - Implement password visibility toggle with eye icon - Add clear button to reset all proxy fields - Auto-extract auth info from saved URL and merge on save - Update i18n translations (zh/en/ja) * fix(proxy): fix double encoding issue in proxy auth and add debug logs - Remove encodeURIComponent in mergeAuth() since URL object's username/password setters already do percent-encoding automatically - Add GP-010 debug log for database read operations - Add GP-011 debug log to track incoming URL info (length, has_auth) - Fix username.trim() in fallback branch for consistent behavior	2026-01-13 10:55:53 +08:00