3 Commits

Author	SHA1	Message	Date
Dex Miller	67e074c0a7	refactor(proxy): transparent header forwarding via hyper client (#1714) ... * style(frontend): reformat provider forms, constants and hooks Apply prettier formatting across 5 frontend files. No logic changes. Changed files: - AddProviderDialog.tsx: reformat generic type annotation and callback - ClaudeFormFields.tsx: consolidate multi-line useState and Collapsible props - CodexConfigSections.tsx: expand single-line React imports to multi-line, collapse removeCodexTopLevelField() call - constants.ts: merge TemplateType into single line - useSkills.ts: expand single-line TanStack Query imports to multi-line, reformat uninstallSkill mutationFn chain * deps(proxy): add hyper ecosystem crates and manual decompression libs reqwest internally normalizes all header names to lowercase and does not preserve insertion order, causing proxied requests to differ from the original client requests. To achieve transparent header forwarding with original casing and order, introduce lower-level hyper HTTP client libs. New dependencies: - hyper-util 0.1: TokioExecutor + legacy Client with preserve_header_case support for HTTP/1.1 - hyper-rustls 0.27: rustls-based TLS connector for hyper - http 1 / http-body 1 / http-body-util 0.1: HTTP type crates for hyper 1.x request/response construction - flate2 1: manual gzip/deflate decompression (replaces reqwest auto) - brotli 7: manual brotli decompression Changed dependencies: - serde_json: enable preserve_order feature to keep JSON field order - reqwest: drop gzip feature to prevent reqwest from overriding the client's original accept-encoding header * refactor(proxy): use hyper client for header-case preserving forwarding Previously the proxy used reqwest for all upstream requests. reqwest normalizes header names to lowercase and reorders them internally, making proxied requests distinguishable from direct CLI requests. Some upstream providers are sensitive to these differences. This commit replaces reqwest with a hyper-based HTTP client on the default (non-proxy) path, achieving wire-level header fidelity: Server layer (server.rs): - Replace axum::serve with a manual hyper HTTP/1.1 accept loop - Enable preserve_header_case(true) so incoming header casing is captured in a HeaderCaseMap extension on each request - Bridge hyper requests to axum Router via tower::Service New hyper client module (hyper_client.rs): - Lazy-initialized hyper-util Client with preserve_header_case - ProxyResponse enum wrapping both hyper::Response and reqwest::Response behind a unified interface (status, headers, bytes, bytes_stream) - send_request() builds requests with ordered HeaderMap + case map Request handlers (handlers.rs): - Switch from (HeaderMap, Json<Value>) extractors to raw axum::extract::Request to preserve Extensions (containing the HeaderCaseMap from the accept loop) - Pass extensions through the forwarding chain Forwarder (forwarder.rs): - Remove HEADER_BLACKLIST array; replace with ordered header iteration that preserves original header sequence and casing - Build ordered_headers by iterating client headers, skipping only auth/host/content-length, and inserting auth headers at the original authorization position to maintain order - Handle anthropic-beta (ensure claude-code-20250219 tag) and anthropic-version (passthrough or default) inline during iteration - Remove should_force_identity_encoding() — accept-encoding is now transparently forwarded to upstream - Use hyper client by default; fall back to reqwest only when an HTTP/SOCKS5 proxy tunnel is configured Provider adapters (adapter.rs, claude.rs, codex.rs, gemini.rs): - Replace add_auth_headers(RequestBuilder) -> RequestBuilder with get_auth_headers(AuthInfo) -> Vec<(HeaderName, HeaderValue)> - Adapters now return header pairs instead of mutating a reqwest builder - Claude adapter: merge Anthropic/ClaudeAuth/Bearer into single branch; move Copilot fingerprint headers into get_auth_headers Response processing (response_processor.rs): - Add manual decompression (gzip/deflate/brotli via flate2 + brotli) for non-streaming responses, since reqwest auto-decompression is now disabled to allow accept-encoding passthrough - Add compressed-SSE warning log for streaming responses - Accept ProxyResponse instead of reqwest::Response HTTP client (http_client.rs): - Disable reqwest auto-decompression (.no_gzip/.no_brotli/.no_deflate) on both global and per-provider clients Streaming adapters (streaming.rs, streaming_responses.rs): - Generalize stream error type from reqwest::Error to generic E: Error Misc: - log_codes.rs: add SRV-005 (ACCEPT_ERR) and SRV-006 (CONN_ERR) - stream_check.rs: reformat copilot header lines - transform.rs: fix trailing whitespace alignment * fix(lint): resolve 35 clippy warnings across Rust codebase Fix all clippy warnings reported by `cargo clippy --lib`: - codex_config.rs: fix doc_overindented_list_items (3 spaces -> 2) - commands/copilot.rs: inline format args in 2 log::error! calls - commands/provider.rs: inline format args in 3 map_err closures - proxy/hyper_client.rs: inline format arg in log::debug! call - proxy/providers/copilot_auth.rs: inline format args in 16 locations (log macros, format! in headers, error constructors) - proxy/thinking_optimizer.rs: inline format args in 2 log::info! calls - services/skill.rs: inline format args in log::debug! call - services/webdav_sync.rs: inline format args in 6 format! calls (version compat messages, download limit messages) - services/webdav_sync/archive.rs: inline format args in 2 format! calls - session_manager/providers/opencode.rs: inline format args in source_path format! All fixes use the clippy::uninlined_format_args suggestion pattern: format!("msg: {}", var) -> format!("msg: {var}") * deps(proxy): add raw HTTP write and native TLS cert dependencies Add crates required for the raw TCP/TLS write path that bypasses hyper's header encoder to preserve original header name casing: - httparse: parse raw TCP peek bytes to capture header casings - tokio-rustls + rustls: direct TLS connections for raw write path - webpki-roots: Mozilla CA bundle baseline - rustls-native-certs: load system keychain CAs (trusts proxy MITM certificates from Clash, mitmproxy, etc.) * fix(proxy): address code review feedback on response handling Fixes from PR #1714 code review: - Extract `read_decoded_body()` and `strip_entity_headers_for_rebuilt_body()` in response_processor to properly clean content-encoding/content-length headers after decompression - Reuse `read_decoded_body()` in handlers.rs for Claude transform path, ensuring compressed responses are decoded before format conversion - Make `build_proxy_url_from_config()` public so forwarder can pass proxy URL to the hyper raw write path - Add `has_system_proxy_env()` utility with test coverage - Add 50ms backoff after accept() failures in server.rs to prevent tight-loop CPU spin on transient socket errors * feat(proxy): implement raw TCP/TLS write with HTTP CONNECT tunnel Rewrite hyper_client with a two-tier strategy for header case preservation: Primary path (raw write): - Peek raw TCP bytes in server.rs to capture OriginalHeaderCases before hyper lowercases them - Build raw HTTP/1.1 request bytes with exact original header name casing - Write directly to TLS stream, then use WriteFilter to let hyper parse the response while discarding its duplicate request writes - Support HTTP CONNECT tunneling through upstream proxies, so header case is preserved even when a proxy (Clash, V2Ray) is configured Fallback path (hyper-util Client): - Used when OriginalHeaderCases is empty or raw write fails - Configured with title_case_headers(true) for best-effort casing TLS improvements: - Load native system certificates alongside webpki roots so proxy MITM CAs (installed in system keychain) are trusted through CONNECT tunnels Key types added: - OriginalHeaderCases: maps lowercase name → original wire-casing bytes - WriteFilter<S>: AsyncRead+AsyncWrite wrapper that discards writes - connect_via_proxy(): HTTP CONNECT tunnel establishment - ExtensionDebugMarker: diagnostic marker for extension chain debugging * refactor(proxy): route requests through hyper with proxy-aware forwarding Rework forwarder request dispatch to always prefer the hyper raw write path (header case preservation) over reqwest: Request routing: - HTTP/HTTPS proxy: hyper raw write through CONNECT tunnel (case preserved) - SOCKS5 proxy: reqwest fallback (CONNECT not supported for SOCKS5) - No proxy: hyper raw write direct connection Header handling improvements: - Replace host header in-place at original position instead of skip-and-append, preserving client's header ordering - Preserve client's original accept-encoding for transparent passthrough; only force identity encoding when transform path needs decompression - Add should_force_identity_encoding() to centralize the decision - Remove hardcoded 'br, gzip, deflate' override that masked client values Proxy URL resolution (priority order): 1. Provider-specific proxy config (if enabled) 2. Global proxy URL configured in CC Switch 3. Direct connection (no proxy) * chore(proxy): remove dead code, redundant tests and debug scaffolding - Inline should_force_identity_encoding() (was just `needs_transform`) and delete its 5 test cases - Remove ExtensionDebugMarker diagnostic type - Remove unused has_system_proxy_env() and its test - Remove strip_entity_headers test - Simplify hyper path: remove redundant is_socks_proxy ternary - Update hyper_client module doc to reflect CONNECT tunnel support * fix(proxy): block direct-connect fallback and complete CONNECT tunnel support * feat(hooks): improve proxy requirement warnings with specific reasons - Remove redundant OpenAI format hint toast messages - Add detailed reason detection for proxy requirements (OpenAI Chat, OpenAI Responses, full URL mode) - Update i18n files with new reason-specific keys * style(*): format code with prettier - Remove extra whitespace in http_client.rs - Fix formatting issues in useProviderActions.ts * fix(proxy): post-merge fixes for forward return type and clippy warnings - Restore forward() return type to (ProxyResponse, Option<String>) to pass claude_api_format through to callers - Inline format args in log::warn! macro (clippy::uninlined_format_args) - Suppress too_many_arguments for check_claude_stream * refactor(proxy): preserve original header wire order and add non-streaming body timeout - Rewrite build_raw_request to emit headers in original client-sent sequence instead of hash-map order - Remove unused OriginalHeaderCases::get_all method - Add body_timeout to read_decoded_body to prevent requests hanging when upstream stalls after headers	2026-03-29 20:26:15 +08:00
Jason	1573474e3a	Fix proxy forwarder failure logs	2026-03-08 19:42:18 +08:00
Dex Miller	6dd809701b	Refactor/simplify proxy logs (#585) ... * refactor(proxy): simplify logging for better readability - Delete 17 verbose debug logs from handlers, streaming, and response_processor - Convert excessive INFO logs to DEBUG level for internal processing details - Add 2 critical INFO logs in forwarder.rs for failover scenarios: - Log when switching to next provider after failure - Log when all providers have been exhausted - Fix clippy uninlined_format_args warning This reduces log noise while maintaining visibility into key user-facing decisions. * fix: replace unsafe unwrap() calls with proper error handling - database/dao/mcp.rs: Use map_err for serde_json serialization - database/dao/providers.rs: Use map_err for settings_config and meta serialization - commands/misc.rs: Use expect() for compile-time regex pattern - services/prompt.rs: Use unwrap_or_default() for SystemTime - deeplink/provider.rs: Replace unwrap() with is_none_or pattern for Option checks Reduces potential panic points from 26 to 1 (static regex init, safe). * refactor(proxy): simplify verbose logging output - Remove response JSON full output logging in response_processor - Remove per-request INFO logs in provider_router (failover status, provider selection) - Change model mapping log from INFO to DEBUG - Change usage logging failure from INFO to WARN - Remove redundant debug logs for circuit breaker operations Reduces log noise significantly while preserving important warnings and errors. * feat(proxy): add structured log codes for i18n support Add error code system to proxy module logs for multi-language support: - CB-001~006: Circuit breaker state transitions and triggers - SRV-001~004: Proxy server lifecycle events - FWD-001~002: Request forwarding and failover - FO-001~005: Failover switch operations - USG-001~002: Usage logging errors Log format: [CODE] Chinese message Frontend/log tools can map codes to any language. New file: src/proxy/log_codes.rs - centralized code definitions * chore: bump version to 3.9.1 * style: format code with prettier and rustfmt * fix(ui): allow number inputs to be fully cleared before saving - Convert numeric state to string type for controlled inputs - Use isNaN() check instead of || fallback to allow 0 values - Apply fix to ProxyPanel, CircuitBreakerConfigPanel, AutoFailoverConfigPanel, and ModelTestConfigPanel * feat(pricing): support @ separator in model name matching - Refactor model name cleaning into chained method calls - Add @ to - replacement (e.g., gpt-5.2-codex@low → gpt-5.2-codex-low) - Add test case for @ separator matching * fix(proxy): improve validation and error handling in proxy config panels - Add StopTimeout/StopFailed error types for proper stop() error reporting - Replace silent clamp with validation-and-block in config panels - Add listenAddress format validation in ProxyPanel - Use log_codes constants instead of hardcoded strings - Use once_cell::Lazy for regex precompilation * fix(proxy): harden error handling and input validation - Handle RwLock poisoning in settings.rs with unwrap_or_else - Add fallback for dirs::home_dir() in config modules - Normalize localhost to 127.0.0.1 in ProxyPanel - Format IPv6 addresses with brackets for valid URLs - Strict port validation with pure digit regex - Treat NaN as validation failure in config panels - Log warning on cost_multiplier parse failure - Align timeoutSeconds range to [0, 300] across all panels	2026-01-11 20:50:54 +08:00