76 Commits

Author	SHA1	Message	Date
Xu Lei	13ea497ab0	fix(proxy): improve GitHub Copilot compatibility with modern Claude Code (#5832) ... * 修复 Copilot 与新版 Claude Code 的兼容问题 * docs(proxy): correct Copilot placeholder rationale to the real mechanism Claude Code (verified on 2.1.220) does not format-validate ANTHROPIC_API_KEY against sk-ant-*: in headless mode the placeholder is sent upstream as-is. The actual failure mode is the interactive custom-API-key approval prompt, which defaults to "No (recommended)" — following the default ignores the key and lands users in "Not logged in". Also drop the #3289 citation, which describes a missing-placeholder scenario, not key validation. --------- Co-authored-by: Jason <farion1231@gmail.com>	2026-08-03 10:26:22 +08:00
zayoka	ff3bc242cc	fix(Security): zip-slip on skill install, two credential leaks, and three panic paths (#5811) ... * fix(security): harden GrokBuild credential handling and Codex/Anthropic transforms against malformed input Three robustness/security fixes in the upstream v3.18.0 code, each with a regression test. 1) grok_config: remove the unconditional XAI_API_KEY fallback in extract_credentials(). Credentials now come only from an explicit inline api_key or the process env var named by env_key. Silently substituting a different account's key (when the declared env_key var is unset) could leak that key to whatever base_url the config points at. 2) deeplink/provider: merge_grokbuild_config no longer resolves env vars into a plaintext api_key on import. A deeplink is untrusted input; resolving+inlining would persist the victim's environment secret into the imported provider's config.toml and ship it to the link's declared base_url. env_key now stays an indirection (name), not a resolved secret. 3) proxy transforms: stop panicking on malformed upstream data. - transform_codex_anthropic::anthropic_sse_to_message_value: only store a `message`/`content_block` when it is an object; otherwise treat it as empty, so the later `["content"]`/`["text"]`/`["signature"]` index assignments can't panic on a scalar/array Value. - streaming_codex_anthropic::responses_sse_events_from_anthropic_message: bail out with a failed-event when the buffered body is a top-level JSON array/scalar (a gateway that ignores stream:true), instead of index-assigning into a non-object. - mcp/grokbuild sync: normalize a non-table `mcp_servers` before inserting, avoiding a toml_edit IndexMut panic on a user-edited config.toml. Panic findings verified with a minimal repro (serde_json index-assignment on a non-object Value aborts). cargo test --lib: 2183 passed / 0 failed. Co-Authored-By: Claude <noreply@anthropic.com> * fix(mcp): normalize a non-table `mcp_servers` in Codex config before insert Same class of bug as the GrokBuild MCP fix in the previous commit, but in the much more widely used Codex path. `sync_single_server_to_codex` guarded only with `contains_key("mcp_servers")`, so a user-edited `~/.codex/config.toml` where the key exists but is *not* a table (`mcp_servers = "x"` / `[]` / `42`) skipped the rebuild and then hit `doc["mcp_servers"][id] = …`, which panics in toml_edit's `IndexMut` (`.expect("index not found")`). The panic happens inside a Tauri command and unwinds across the FFI boundary; in the provider-switch flow it also fires after the DB/live write already committed, leaving a half-applied switch. Extract the normalize-then-insert step into `upsert_mcp_server_table()` so the previously panic-prone logic is unit-testable without touching the real `~/.codex/config.toml`, and normalize any non-table value to an empty table before inserting. Audited the sibling MCP writers while here: claude.rs / gemini.rs / hermes.rs / opencode.rs do not have this pattern (their `contains_key` uses are read-only checks), and the other index-assignments in codex.rs operate on freshly built `Table::new()` values, which are safe. Tests: 2 new regression tests (malformed non-table values normalize and insert; an existing valid table keeps its entries). cargo test --lib 2185 passed / 0 failed; cargo clippy --lib -D warnings clean. Co-Authored-By: Claude <noreply@anthropic.com> * fix(security): reject path-traversal entries when extracting a skill repo archive `SkillService::download_and_extract` built the output path from the raw ZIP entry name (`file.name()`), stripped only the leading `<repo>-<branch>/` component, and then `dest.join(relative_path)` → `fs::File::create`. A crafted entry such as `repo-main/../../../evil.sh` therefore escaped the destination directory (zip-slip): arbitrary file write outside the temp extraction dir. The archive is third-party controlled: it is downloaded from `https://github.com/<owner>/<name>/archive/refs/heads/<branch>.zip`, and a skill repo (`owner`/`name`) can be added through an untrusted `ccswitch://` deeplink (`deeplink/skill.rs`), so the attacker fully controls the archive contents. Fix: resolve each entry through `zip::read::ZipFile::enclosed_name()`, which rejects `..` components and absolute paths, before stripping the archive's root directory and joining onto `dest`. Unsafe entries are skipped with a warning. This matches what the two sibling extractors in this codebase already did correctly (`extract_local_zip`, `webdav_sync/archive.rs`) — this call site was the one that had been missed. The extraction loop is split out into `extract_repo_archive()` so the guard is testable without network access. Verified the test actually catches the bug: with the guard reverted to the old `file.name()` behaviour the new test fails ("zip-slip entry must not escape dest (temp root)"); with the guard in place it passes. cargo test --lib: 2186 passed / 0 failed; cargo clippy --lib -D warnings clean. Co-Authored-By: Claude <noreply@anthropic.com> * fix(security): strip all credentials from the shared Gemini common-config snippet `extract_gemini_common_config` skipped only two hardcoded keys (`GOOGLE_GEMINI_BASE_URL`, `GEMINI_API_KEY`) and copied every other `env` entry into the shared snippet. But `GOOGLE_API_KEY` is a first-class Gemini credential — `provider.rs` resolves it via `first_non_empty(env, &["GEMINI_API_KEY", "GOOGLE_API_KEY"])` — so it was never stripped. That snippet is not inert: `apply_common_config_to_settings` (live.rs) deep-merges it into the `env` of *every other* Gemini provider that uses the common config, and the snippet is auto-extracted on startup, on import, and on switch. Net effect: account A's key gets written into provider B and sent to B's `GOOGLE_GEMINI_BASE_URL`, which may be a third-party relay. Anything else the user put in `env` (`GOOGLE_APPLICATION_CREDENTIALS`, a proxy `*_AUTH_TOKEN`, …) leaked the same way. Fix: also skip `Self::is_sensitive_config_key(key)`, reusing the pattern matcher the Claude extractor already relies on for exactly this reason (its comment notes a fixed enumeration "will always miss the next `*_API_KEY`"). `GOOGLE_API_KEY` matches its `_API_KEY` suffix rule. Shareable non-secret config (e.g. `GEMINI_TIMEOUT_MS`) is preserved. Verified the test catches the bug: run against the old two-key filter it fails with "credential GOOGLE_API_KEY must not leak into the shared Gemini snippet"; with the fix it passes. cargo test --lib: 2187 passed / 0 failed; cargo clippy --lib -D warnings clean. Co-Authored-By: Claude <noreply@anthropic.com> * fix(security): validate skill directory from backups and sync-imported DB rows The skill install pipeline sanitizes the install directory name, but two entry points bypassed it entirely: - restore_from_backup joined metadata.skill.directory (raw meta.json content) into the SSOT dir with no validation, allowing a crafted backup to copy attacker-controlled files outside the skills directory and to persist the poisoned value into the database. - Sync import (WebDAV/S3) loads the remote database dump verbatim, so a malicious or compromised sync snapshot could plant a skills row whose directory contains path traversal. Every later raw join then operated on attacker-controlled paths — uninstall/remove_from_app would remove_dir_all outside the managed dirs (arbitrary directory deletion), and sync_to_app_dir would write/symlink outside them. Add require_valid_directory() (built on the existing sanitize_install_name) and enforce it at restore_from_backup, sync_to_app_dir, remove_from_app, and uninstall. Regression tests cover all three sinks plus the metadata path; each was verified against the unguarded code first (disabling the guard makes the restore/uninstall tests complete the traversal write/delete, failing the assertions). Also fixes a pre-existing cargo fmt drift in mcp/grokbuild.rs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(security): reject path separators in sanitize_install_name on all platforms The previous components()-based check was platform-dependent: on Linux/macOS a backslash is not a path separator, so "a\b" parsed as a single Normal component and was accepted as a valid install name — the same value becomes a nested path when synced or restored onto Windows. CI caught this on the Linux runner (the Windows runner passed). Reject both '/' and '\' explicitly so the validation is platform-independent; the components() check stays as the second layer for dot segments, roots, and prefixes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(security): close the remaining skill-install attack chain The zip-slip guard added earlier only covered half the problem, and the repo coordinates that decide *which* archive gets downloaded were never validated at all. Together those two gaps let an attacker choose both the bytes and where they land. 1) zip-slip, second layer. `enclosed_name()` only guarantees the entry does not escape the *archive's own* root, and it does not normalise the path — `..` survives verbatim in the returned value. Stripping `root_name` afterwards spends one level of that depth budget, so `repo-main/../evil` still escaped `dest`. On Windows it is worse: `root_name` comes from `split('/')` and may contain backslashes, which Windows treats as separators, so one `strip_prefix` can eat N components. Re-check the *actual* relative path for `ParentDir` right before `dest.join()`. Verified by reverting the guard: the single-`..` case escapes without it. (The existing test used two `..`, which `enclosed_name()` rejects on its own — it covered the half that was already guarded.) 2) Repo coordinates are now validated. `download_repo` formats owner/name/ branch straight into `https://github.com/{owner}/{name}/archive/refs/heads/{branch}.zip`, and `deeplink/skill.rs` applied no validation whatsoever. URL parsing resolves dot segments, so a branch of `../../../releases/download/v1/evil` retargets the request at a *release asset* — arbitrary attacker-uploaded bytes. That is what made (1) reachable in practice: git itself will not let a tree contain `..`. Note the trigger is below "install": repos are enabled by default, so merely opening the Skills panel downloads and extracts. `validate_repo_ref` whitelists all three fields. Branch names legally contain `/` (`feature/x`), so the check is per segment rather than a blanket separator ban; an empty branch keeps its existing "use the default branch" sentinel meaning, same as `HEAD`. The main guard sits in `download_repo` — the single convergence point for all four call paths — because both `skill_repos` and `skills` can be overwritten wholesale by a sync snapshot, which no insert-time check can prevent. Entry-point checks (deeplink, `add_skill_repo`, agents lock) exist so bad values surface immediately instead of silently failing on every later panel open. `build_skill_doc_url` is covered too: it feeds `readme_url`, which the frontend hands to `openExternal`. 3) Regressions from the previous commits in this branch, both fixed: - `uninstall` ran the directory guard *before* `db.delete_skill`. That method has exactly one call site and is not exposed as a command, so a row with a dirty `directory` (pre-v3.11.0 installs, or anything `import_from_apps` still creates today — it has no sanitiser) became permanently undeletable from the UI. Now the guard skips the filesystem work but still deletes the row. - `sync_to_app` propagated with `?`, so one bad row aborted the entire app's skill sync — and that runs on provider switch. Now it warns and continues per entry. - `require_valid_directory` returned `sanitize_install_name`'s normalised value, which trims. A DB value of `" foo "` would then join as `"foo"` and miss the real directory. It now validates without rewriting. 4) Guard applied to the sinks the earlier commits missed: `migrate_storage` (rename + remove_dir_all), `update_skill` (delete + write attacker-named paths), `import_from_apps` (both a sink and the source of dirty values — `selection.directory` arrives raw over IPC), `resolve_uninstall_backup_source` (copies any directory into the backup area, which the UI then lists), `check_updates`, and `migrate_skills_to_ssot`. 5) Extraction limits. The archive bytes were fully attacker-controlled via (2), and this path had no ceiling of any kind, unlike `webdav_sync/archive.rs`. Added entry count, total extracted bytes, a symlink-target cap (zip 2.4.2's `make_reader` does not truncate at the declared `uncompressed_size`, so a symlink-flagged entry that inflates to gigabytes was read straight into memory), per-directory charging (a directory-only archive writes no content bytes but still consumes inodes), and a download-body cap (`response.bytes()` buffered the whole archive before any limit applied). Budget is charged on bytes actually read and written, never on sizes declared in the archive header. Symlink materialisation is charged to the same budget, and a target that contains the link itself (`dir/link -> ..`) is now rejected: the existing "must stay inside base" check passes for it, and the recursive copy then re-copies its own output every level until PATH_MAX. 6) Temp directories are now RAII. `download_repo` and `extract_local_zip` called `TempDir::keep()` immediately and relied on every exit path remembering `remove_dir_all`. Several did not — including `fetch_repo_skills`, the highest-frequency path of all. Returning the guard makes the leak unrepresentable at the call sites. * fix(config): make removals and edits survive user-authored config shapes The previous commits hardened the *write* side of the MCP tables against a non-table `mcp_servers`. The read/delete side kept using `as_table_mut`, which returns None for an inline table (`mcp_servers = { foo = {...} }` — valid TOML). Removal then silently did nothing: the UI reported success, the entry stayed in the file, and Codex loaded it again on next start. That is worse than the panic it mirrors, because users usually reach for the toggle precisely when an MCP server is misbehaving. Both Codex and GrokBuild now use `as_table_like_mut` on both sides. Normalisation is no longer silent either. Replacing a user's hand-written `mcp_servers = "x"` with an empty table destroys data, so all four sites that do it now log a warning first. `update_codex_toml_field` had the same asymmetry with a different symptom: when `model_providers` or `[model_providers.<id>]` was an inline table, `as_table_mut` returned None and execution fell through to the "write a top-level field" fallback. The user's `base_url` edit landed at the wrong level, Codex never read it, and nothing reported a problem. `opencode_config` parses `~/.config/opencode/opencode.json` with json5 into a bare Value and never checked the root's shape. A user file of `[]` or a scalar made `set_provider`, `set_mcp_server` and `add_plugin` all panic on index-assignment, inside a Tauri command, unwinding across the FFI boundary. (A top-level `null` is fine — serde_json promotes it.) Rejecting a non-object root at the single read site fixes all three. Rejecting rather than rebuilding is deliberate: the file also holds the user's own `model` / `theme` settings, so a silent rebuild would delete them. Same treatment for the `provider` and `mcp` sections, whose non-object forms made writes silently no-op. * fix(proxy): recover a malformed Anthropic content_block as text Sanitising a non-object `content_block` to `{}` stops the panic but creates a quieter failure: the final Responses conversion matches on the block's `type` and silently drops anything it does not recognise, so a garbled block header turned into a `completed` response with empty output. The client saw the model say nothing, with no signal that data had been discarded. The replacement now carries `type: "text"`. The deltas that follow a malformed header are usually well-formed, so this recovers the common case; a tool-use block still yields nothing, exactly as before. A warning is logged when the substitution happens. The regression test now asserts through `anthropic_response_to_responses` rather than on the intermediate value — asserting on the intermediate alone passes while the client still receives an empty response. * fix(grokbuild): decouple base_url from credential resolution, reject env_key-only links `resolve_usage_credentials` called `extract_credentials(...).unwrap_or_default()`, so a missing credential blanked the base_url too — even though it is written right there in the config. Removing the `XAI_API_KEY` fallback in the earlier commit widened that considerably: a GUI process on macOS does not inherit the shell environment, so an `env_key` that resolves fine in a terminal resolves to nothing here. The result was a Base URL shown in the UI that differed from the one actually used, `{{baseUrl}}` expanding to empty in usage scripts (turning requests relative), and native balance queries reporting "API key is empty" while hiding the real cause. The two values are now resolved independently, via the existing `grok_config::extract_base_url`, matching how the Codex arm of the same function already works. A deeplink whose only credential is `env_key` is now rejected by name. It was already unimportable — `build_grokbuild_settings` has no `env_key` slot — but it failed with the generic "API key is required", which reads like a malformed link and invites the obvious "just carry the name over" fix. Carrying it over is exactly what must not happen: the forwarder and the usage query both resolve `env_key` at request time, so the victim's environment secret would still reach the link's `base_url`. Same leak, merely deferred. The message says so, and the test sets the probe variable so that restoring the resolution turns it red. * fix(security): scrub credentials already leaked into the Gemini shared snippet Fixing the extractor only prevents new contamination. A Gemini snippet is never re-extracted once it exists — startup auto-extract and post-import extraction both require `snippet.is_none()`, and the on-switch rewrite only covers Claude and Codex — so existing users keep injecting the leaked key into live config, the proxy upstream, and the new-provider form, where another account's key is plainly visible. Removing it from the snippet alone would make things worse. Merge and strip cancel out by *value equality*: on switch-away, `remove_common_config_from_settings` deletes the injected keys using the snippet as its only record of what to look for. Once the key is gone from the snippet, the residue left in live config is backfilled verbatim into the victim provider's `settings_config`, turning a transient leak into a permanent one. So the cleanup covers all four locations at once, and step order is itself a safety property: every fallible step runs before the irreversible one, and a failure returns an error so the next start retries from an intact state. Deletion is by key *and* value, never by key name alone, so a provider's own same-named key with a different value survives. The `~/.gemini/.env` edit preserves layout rather than round-tripping through `parse_env_file`/`serialize_env_file`: that pair drops comments, blank lines and unparseable lines, collapses duplicate keys and re-sorts the file. Acceptable when re-projecting everything, destructive for a targeted removal the user never asked for — in testing it reduced a six-line fixture to one line, taking the user's own key with it. An audit record is written before any provider row changes, listing key names and affected provider ids but *no values*: `settings` is not in `SYNC_SKIP_TABLES`, so it is uploaded by WebDAV/S3 sync, and these are precisely the credentials that must be destroyed. Keeping values would trade one deletion for a plaintext copy that spreads across devices, has no UI to reach it, and never expires. It is written only when absent, so a partially-applied earlier run cannot overwrite the original pre-cleanup state. Consequence, intentional: some Gemini providers will now report a missing API key and need one entered. That key was never theirs. (The victim's own value was already overwritten at merge time and cannot be recovered — worth noting in the release notes, along with a recommendation to rotate the leaked key.) The snippet row is deleted rather than set to `{}` when nothing shareable remains, and the `cleared` flag is deliberately not set — either would disable auto-extract permanently and prevent the user's legitimate shared config from ever coming back. The frontend snippet validator is aligned with the backend matcher. It had the same two hardcoded key names, so a hand-edited snippet could put `GOOGLE_API_KEY` straight back with no error. --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Jason <farion1231@gmail.com>	2026-07-28 16:34:11 +08:00
Jason	a35209a6e7	feat(xai): add Grok OAuth device-flow backend and proxy routing ... Add an xAI OAuth manager using the OAuth 2.0 Device Authorization Grant with endpoints resolved from xAI's OIDC discovery document. All HTTP goes through the app-managed proxy client. - Managed provider kind xai_oauth: forced openai_responses wire format, pinned api.x.ai base URL, bearer injection gated to the xAI origin, tokens registered for log redaction, single-auth-key takeover policy. - Token cache cannot bypass account state: cache hits re-validate account usability, refresh commits run under the mutation lock with a refresh-token CAS check, and pending logins are re-checked before an account is persisted. - Refresh classification: 401/403 with any body and 400 with a non-JSON body mark the account for re-auth; 429/5xx stay transient. - Shared auth_* commands dispatch to xAI with guard types mirroring the Copilot/Codex branches.	2026-07-21 16:39:33 +08:00
Thefool	1c0ee0c58a	feat(grokbuild): add first-class Grok Build support (#5453) ... * feat(grokbuild): add backend integration * feat(grokbuild): add provider and management UI * test(grokbuild): cover configuration and integrations * fix(grokbuild): address backend review feedback * fix(grokbuild): complete UI review feedback * feat(grokbuild): add CLI lifecycle management * fix(grokbuild): align provider icon fallback * test(grokbuild): cover provider icon persistence	2026-07-17 15:50:50 +08:00
Jason	a078b4b207	feat(proxy): session-based prompt_cache_key routing for Codex Chat bridge ... Codex always sends prompt_cache_key in its Responses requests, but the Responses -> Chat Completions conversion dropped it, breaking session cache affinity on upstreams that route by key (e.g. Kimi Coding). - Re-inject prompt_cache_key after conversion in the forwarder: an explicit client key wins, otherwise a client-provided session ID; generated per-request UUIDs are never sent upstream. - Provider-aware gating: "auto" enables only known-compatible upstreams (api.openai.com, api.kimi.com/coding) because strict gateways reject unknown fields with HTTP 400 (e.g. Fireworks); an advanced Auto/Enabled/Disabled override is available on the Codex form in all four locales. - Kimi For Coding preset opts in explicitly.	2026-07-13 16:48:21 +08:00
Jason	06039540ff	refactor(health-check): remove per-provider test config	2026-07-13 16:48:21 +08:00
Yeeyzy	99e11e0851	feat(codex): support native Anthropic Messages protocol as upstream (#5071) ... * feat(codex): support native Anthropic Messages protocol as upstream Allow gateways that only expose the native Anthropic Messages protocol (/v1/messages) to be used by Codex: the local proxy performs bidirectional request/response/streaming conversion between Responses and Anthropic. Backend: - Add two conversion modules: transform_codex_anthropic / streaming_codex_anthropic - codex.rs: add routing detection and auth: ANTHROPIC_AUTH_TOKEN→Bearer (default), ANTHROPIC_API_KEY→x-api-key, mutually exclusive - handlers.rs: add handle_codex_anthropic_to_responses_transform - forwarder.rs: support optional Claude Code client fingerprint impersonation (User-Agent / anthropic-beta / x-app / system prompt first-line injection) and /responses→/v1/messages rewriting - codex_config: the anthropic format reuses the NativeResponses profile to strip custom tools - ProviderMeta: add impersonateClaudeCode Frontend: - CodexApiFormat: add "anthropic"; the form adds auth field selection and an impersonation toggle - Add en/ja/zh/zh-TW copy Robustness: - Downgrade when tool history / forced tool_choice conflicts with extended thinking, avoiding upstream 400s - Emit cache_creation_input_tokens in usage and use saturating_add to guard against overflow - Append a unique suffix to non-streaming/streaming output-item ids to avoid multi-segment text/thinking overwriting each other * fix(codex): harden Anthropic bridge against empty text blocks and truncated streams - Drop empty/whitespace-only text content blocks when rebuilding Anthropic messages from Responses history; Anthropic 400s on empty text blocks (e.g. an empty assistant text emitted alongside a tool_use), which broke follow-up and tool-result requests. Also drop messages left without content. - Do not report a truncated Anthropic stream as completed: when the SSE connection ends before message_stop with no stop_reason, emit an incomplete response if partial output exists, or a failed (stream_truncated) response otherwise, mirroring the chat converter's EOF handling. * fix(codex): resolve Anthropic-bridge review findings Blocking: 1. Defer stripping the [1m] long-context marker until after catalog matching and model write-back, re-stripping it on the final Codex→Anthropic body and setting a flag to emit the context-1m-2025-08-07 beta header, so the marker is no longer lost or overridden by the default model. 2. Gate Anthropic thinking on the trailing turn only (via trailing_turn_allows_thinking) instead of scanning full history, so a Codex session that resends history each round no longer permanently loses thinking after the first tool call. 3. Inject 5m ephemeral cache_control on the Codex→Anthropic body by reusing cache_injector (handling the system string→array conversion), so system/tools/history are cached instead of re-sent at full price every round. 4. Add a shared base_url_is_full_endpoint helper (normalizing whitespace/query/fragment/trailing slash) used by both the Anthropic and Chat paths, so a base URL already ending in /v1/messages is treated as a full endpoint instead of double-appending to /v1/messages/v1/messages. 5. Align the catalog tool-profile predicate with the routing predicate so resolve_codex_catalog_tool_profile returns the Anthropic profile whenever the request converts to Anthropic, preventing freeform tools like apply_patch from being silently filtered by a ProxyChat catalog. 6. Explicitly disable native web_search for the Anthropic profile (including the no-catalog branch) via set_codex_native_web_search_field, so Codex no longer treats it as available while the transform silently drops it. 7. Only forward tool_choice when tools survive filtering, dropping it otherwise, to avoid a non-retryable 400 from upstream when tool_choice is sent with no tools. 8. Lower the fallback default to max_tokens=8192 (only when max_output_tokens is omitted) and clamp the thinking budget to max_tokens/2, disabling thinking below the 1024 floor, to avoid hard 400s on low-output-ceiling models/gateways. Minor: 9. Centralize the Codex/OpenAI fingerprint-header denylist in is_codex_client_fingerprint_header so impersonating Claude Code uniformly drops originator/session_id/conversation_id/chatgpt-account-id/x-client-request-id/openai-* and the x-stainless-*/x-codex-* prefixes. 10. Retain content_block_start.input as start_input and fall back to it at block close when no input_json_delta arrived, so a gateway that carries the full tool input on the start event no longer yields empty tool arguments. 11. Extract a shared codex_responses_sse module as the single Responses SSE envelope builder that both the chat and anthropic streaming emitters delegate to, with byte-for-byte-unchanged wire output, so future event-format fixes touch one place instead of two. * fix(codex): add per-provider max_output_tokens override for Codex→Anthropic path Codex does not forward model_max_output_tokens in the request body, causing the proxy to fall back to a conservative 8192 default. This truncates long or thinking-heavy responses (stop_reason=max_tokens). - Add maxOutputTokens field to ProviderMeta (Rust + TypeScript) - Inject the value into the Anthropic request body before transform, taking precedence over request-supplied and default values - Add numeric input in Codex form fields (Anthropic format only) - Add i18n entries for label, placeholder, and hint (en/zh/zh-TW/ja) - Include roundtrip and omission unit tests for the new field * fix(codex): harden Anthropic protocol bridge * fix(codex): address Anthropic bridge review * fix(codex): preserve flattened Anthropic inputs * fix(codex): harden Anthropic recovery paths * fix(ci): satisfy Rust clippy --------- Co-authored-by: Jason <farion1231@gmail.com>	2026-07-10 23:06:30 +08:00
zhanxin.xu	95c917b337	feat(provider): add Zhipu team plan quota query support (#5128) ... 智谱团队套餐（Team Plan）的额度查询与个人版不同：同一 quota 端点加 `?type=2`，需额外 `bigmodel-organization` / `bigmodel-project` 请求头 （api_key + 组织 ID + 项目 ID 三者缺一不可），且仅存在于国内站 open.bigmodel.cn。参考 token-monitor/src/shared/zaiTeamLimits.js 实现。 - Backend (services/coding_plan.rs): 新增 query_zhipu_team（固定 CN 站、 ?type=2、org/project 头）；抽出 zhipu_quota_from_body 与个人版共用解析； 入口 get_coding_plan_quota 靠显式 coding_plan_provider == "zhipu_team" 路由（base_url 与个人版智谱相同，detect_provider 无法区分）。新字段经 UsageScript、IPC 命令、后台查询路径（query_provider_usage_inner）透传。 - Frontend: UsageScriptModal 新增「Zhipu GLM Team」选项 + 组织/项目 ID 输入；模板切换时保留 team 字段；测试与保存逻辑按 team 传参。 - i18n: en/zh/zh-TW/ja 四个 locale 更新。 - Tests: 凭据校验/路由（缺任一凭据 → NotFound，标识大小写不敏感）+ 本地 server 验证 ?type=2 与 org/project 请求头形状。 Co-authored-by: XuZhanXin <1239576606@qq.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-09 09:21:10 +08:00
Jianfeng Mei	6fd4e6f462	feat(proxy): 添加本地代理请求覆盖功能，支持自定义请求头和请求体 (#4589) ... * feat(proxy): 添加本地代理请求覆盖功能，支持自定义请求头和请求体 * fix(proxy): harden local request overrides validation * feat(proxy): 添加受保护的本地代理请求头名称验证功能 * fix(i18n): 更新本地代理请求覆盖的错误提示信息格式 --------- Co-authored-by: jason.mei <jason.mei@ucloud.cn>	2026-06-24 22:19:01 +08:00
Jason	c4630b5c26	feat(providers): add Volcengine Ark usage query with AK/SK signing ... Query coding-plan / agent-plan usage for Volcengine Ark via the control-plane OpenAPI (open.volcengineapi.com), which requires account-level AccessKey signing rather than the inference API key. - Implement Volcengine Signature V4 (an AWS SigV4 variant: fixed canonical header order, "HMAC-SHA256" algorithm without the AWS4 prefix, scope ending in "request", service "ark") in services/coding_plan.rs - Auto-detect the plan by probing GetAFPUsage (Agent Plan, AFP five-hour/weekly/monthly quotas) first, falling back to GetCodingPlanUsage (Coding Plan, session/weekly/monthly percentages); a single credential covers whichever plan the account holds - Parse the real response shape: the window label lives in the `Level` field; guard ResetTimestamp <= 0 (session returns -1) - Store account-level credentials on UsageScript (accessKeyId / secretAccessKey), threaded through both the test command and the TOKEN_PLAN auto-refresh path - Add an independent AK/SK input block with a detailed hint pointing to the Volcengine console -> API Access Keys - Add the `monthly` tier label (frontend TIER_I18N_KEYS + tray TIER_LABEL_GROUPS + subscription service) - Sync zh / en / ja / zh-TW locales and the usage-query docs	2026-06-22 10:28:10 +08:00
Jason	a5903d8600	feat(health-check): replace real-LLM probe with HTTP reachability check ... The provider panel health check sent a real streaming model request, which many third-party providers block (401/403/WAF), causing false negatives while only stable official endpoints passed. Replace it with a lightweight reachability probe: GET the provider base_url and treat any HTTP response (200/4xx/5xx) as reachable; only DNS/connect/TLS/timeout count as failure. Latency is the probe's TTFB. Backend (services/stream_check.rs): rewrite ~2200 -> ~350 lines, dropping real-request building, format conversion, auth and API-path resolution while keeping per-app base_url extraction. Defaults: 8s timeout, 1 retry, 1500ms degraded threshold. Failover invariant: the reachability check must never reset the circuit breaker (reachable != usable; a 403 host is reachable but broken for real traffic). Remove the resetCircuitBreaker call from useStreamCheck; failover failure detection stays driven solely by real proxy traffic (forwarder/circuit_breaker untouched). useResetCircuitBreaker is kept dormant for a future manual-recovery entry. Open the check to all providers: drop the official/copilot/codex-oauth/third-party gating and the 'sends a real request' confirm dialog. For official providers whose base_url is intentionally empty, fall back to the endpoint the client actually uses (Claude -> api.anthropic.com, Codex -> chatgpt.com/backend-api/codex, Gemini -> generativelanguage). Non-official providers with a missing base_url still error to avoid a false green light. Claude Desktop Official is native 1P mode (talks to claude.ai, cc-switch not in the request path, no reliable endpoint) so its button stays hidden. Slim StreamCheckConfig and per-provider testConfig to timeout/threshold/retries (drop test model + prompt); sync zh/en/ja/zh-TW. Retain the now-unused anthropic_to_openai/anthropic_to_gemini transform utilities and their test suites.	2026-06-14 21:21:45 +08:00
Jason	8b925c2f2f	feat(proxy): honor custom User-Agent across stream check and model fetch ... Extract a shared `parse_custom_user_agent` helper in provider.rs returning `Result<Option<HeaderValue>>`, and reuse it in the forwarder, stream check, and model fetch paths so detection, forwarding, and model listing all apply the same provider-level User-Agent. Previously only the forwarder honored it, so stream check could fail (or model listing 403) on UA-gated upstreams that the proxy itself handled fine. - stream_check injects the provider's custom UA on the claude/codex paths and still skips the GitHub Copilot fingerprint UA. - model_fetch service + command and the model-fetch.ts wrapper thread an optional UA through to GET /v1/models. - runtime callers silently ignore invalid values via `.ok().flatten()` (no save-time block, so deeplink imports stay lenient).	2026-06-11 08:29:29 +08:00
RoromoriYuzu	ff706e9e96	feat: add provider user agent override	2026-06-11 08:29:29 +08:00
pa001024	9ea303b224	fix: usage script provider credential resolution (#1479) ... The JS-script usage path resolved {{apiKey}}/{{baseUrl}} with env-only field guessing, so apps that store credentials elsewhere (Codex: auth.OPENAI_API_KEY + config.toml base_url) always got empty values and custom-template queries failed despite a fully configured provider. - query_usage / test_usage_script now delegate to Provider::resolve_usage_credentials, the same per-app resolver used by the native balance/coding-plan path and mirrored by the frontend getProviderCredentials; explicit non-empty script values still win - test_usage_script loads the provider and applies the same fallback, so testing matches what a saved script does - the custom-template variable preview shows the effective values (script overrides first, then provider config) instead of always showing provider credentials - extract_codex_base_url documents and test-locks the frontend-mirror invariant: non-active [model_providers.*] sections are never read Reworked from the original patch to reuse the existing resolver instead of duplicating per-app extraction. Co-authored-by: Jason <farion1231@gmail.com>	2026-06-10 22:57:27 +08:00
Siskon	afa09e127e	fix(usage): resolve per-app credentials for native balance/coding-plan queries (#3355) ... * fix(usage): resolve per-app credentials for native balance/coding-plan queries The native usage-query paths (balance + coding_plan) in `query_provider_usage_inner` read credentials only from `env.ANTHROPIC_*`. That matches Claude providers, but Codex stores its key in `auth.OPENAI_API_KEY` with the base URL inside a TOML `config` string, Hermes/OpenClaw flatten them at the top level, and OpenCode nests them under `options`. So the card "refresh usage" / auto-query returned empty credentials and failed ("查询失败") for those apps, even though the config-page "Test" button worked (the frontend extracts per-app correctly). Introduce a single per-app resolver `Provider::resolve_usage_credentials` that mirrors the frontend `getProviderCredentials`, and route both native branches through it. Add `extract_codex_base_url` to `codex_config` as the canonical Codex TOML base-URL parser and make the proxy adapter delegate to it (removing a duplicate copy). Align the frontend `getProviderCredentials` to cover OpenCode and Claude Desktop and to use the same OpenRouter/Google key fallbacks as the backend. Fixes #3158 Fixes #3100 Fixes #2625 * refactor(usage): explicit AppType arms + frontend trailing-slash trim Address two review nits on the per-app credential resolver: - provider.rs: replace the catch-all `_` arm in resolve_usage_credentials with an explicit `AppType::Claude | AppType::ClaudeDesktop` arm, so a new AppType variant fails to compile here instead of silently defaulting to the Anthropic env shape. - UsageScriptModal.tsx: normalize getProviderCredentials baseUrl through a single trailing-slash trim so the frontend 'Test' path matches the backend resolver (trim_end_matches), keeping front/back truly in lockstep. No behavior change for well-formed configs; tests/typecheck/fmt/clippy clean. * fix(usage): skip empty primary credential fields in fallback chain `obj.get(key)` returns `Some` for a present-but-empty field, so the `.or_else()` fallback chains for the Claude/ClaudeDesktop and Gemini api-key lookups only skipped *absent* keys, not empty ones. Presets seed fields like `ANTHROPIC_AUTH_TOKEN` as present-but-empty placeholders, so a provider whose real key lives in a fallback field (`ANTHROPIC_API_KEY` / `OPENROUTER_API_KEY` / `GOOGLE_API_KEY`, or `GOOGLE_API_KEY` for Gemini) resolved to an empty key on the native balance/coding-plan path — while the frontend `a || b` (which skips empty strings) still found it, reproducing the same Test-works / refresh-fails divergence this PR removes. Add a `first_non_empty` helper that skips present-but-empty values, matching the frontend `||` semantics, and use it for both fallback chains. Tests cover empty primary + populated fallback for Claude and Gemini.	2026-06-01 08:43:40 +08:00
Jason	fc0433f2f4	refactor(codex): unify custom model_provider routing key to "custom" ... - Always emit `model_provider = "custom"` from deep link, UniversalProvider, and the universal form modal so future writes share one stable routing key. - Add `codex_provider_template_v1` local migration that rewrites legacy keys (aihubmix/ccswitch/...) under `[model_providers.custom]`, updates profile refs, and backs up the original settings_config under `~/.cc-switch/backups/<timestamp>/providers/`. - Tighten history migration source detection to a whitelist plus `[model_providers.<id>]` existence check so user-authored keys are never rewritten in jsonl/state DB. - Encode deep link name/model/endpoint through `toml_edit::Value` so display names containing quotes or backslashes no longer break the generated config.toml. - Stabilize provider settings backup filename hash with Sha256 (was process-random SipHash).	2026-05-28 17:30:44 +08:00
Jason	44d9aabbf3	feat: adaptive reasoning detection for Codex Chat providers ... Auto-detect each Chat-routed Codex provider's reasoning interface from its name, base URL, and model, then inject the matching thinking parameter without manual configuration: - Platform-first inference (OpenRouter, SiliconFlow) overrides model rules, since the same model exposes different reasoning controls depending on the hosting platform. - Effort tiers are forwarded only to providers that support them (DeepSeek, OpenRouter, and StepFun's step-3.5-flash-2603); on/off-only providers (Kimi, GLM, Qwen, MiniMax, MiMo, SiliconFlow) drop the level instead of sending a field the upstream rejects. - OpenRouter uses the native reasoning:{effort} object, clamps max to xhigh (its enum has no max), and forwards an explicit effort:"none" so reasoning can be turned off. - StepFun falls back to inference so per-model effort support is honored (the static preset would have forced effort on step-3.5-flash too). Includes the Codex provider-form reasoning controls, i18n strings (zh/en/ja), and response-side reasoning extraction.	2026-05-25 22:20:33 +08:00
Jason	61e68d754c	fix(proxy): inject only ANTHROPIC_API_KEY for managed-account Claude takeover ... - Provider: add uses_managed_account_auth / is_github_copilot helpers to identify managed-account providers (GitHub Copilot / Codex OAuth) - ProxyService: choose auth policy by provider type when taking over Claude Live config. Managed accounts drop token env keys and write only the ANTHROPIC_API_KEY placeholder; other providers keep the existing ANTHROPIC_AUTH_TOKEN fallback behavior - Forwarder: add outbound guard that refuses to send the PROXY_MANAGED placeholder upstream to *.githubcopilot.com and chatgpt.com /backend-api/codex - Add unit tests covering detection, injection, and the outbound guard	2026-05-18 22:46:18 +08:00
Jason	84bac6dce6	refactor(claude-desktop): lock route IDs to sonnet/opus/haiku roles ... Adapt to Claude Desktop 1.6259.1+ fail-all validation which only accepts claude-(sonnet|opus|haiku)-* route IDs. Branded model names (DeepSeek, Kimi, GLM, etc.) now live in a new labelOverride field instead of being embedded in route IDs. - Backend auto-repairs legacy unsafe routes to the next free sonnet/opus/haiku slot instead of erroring - Frontend swaps the free-form route input for a role dropdown plus menu display name field - Add CLAUDE_DESKTOP_ROLE_ROUTE_IDS as the single source of truth for role-to-route mapping; presets and form both consume it - Drop the dead displayName alias on ClaudeDesktopModelRoute and the ineffective /v1/models display_name injection (UI ignores it) - Update i18n (en/ja/zh) and form focus test for the new fields	2026-05-13 15:22:23 +08:00
Jason	953b7cdcf9	refactor(claude-desktop): drop displayName from model route schema ... Claude Desktop's new model menu reads model IDs directly and ignores the display_name field, so a separate displayName slot added UI noise without any product value. Collapse the routeId / model / displayName tuple down to routeId / model, and let the route ID carry the user-visible name through a non-editable claude- prefix rendered next to the input. Drop display_name from ClaudeDesktopModelRoute, ClaudeDesktopDefaultRoute, and ResolvedModelRoute on the Rust side plus the matching TS interfaces, stop emitting it in /v1/models responses, derive route IDs from upstream model IDs when picked via the model dropdown, and update zh/en/ja copy to describe the new two-field layout.	2026-05-12 10:46:35 +08:00
Jason	00a789e7a3	fix(proxy): improve cache hit rate for Codex/Responses requests ... prompt_cache_key was falling back to provider.id when the client did not supply a session, which collapsed every conversation onto a single key and defeated upstream prefix caching. Only emit the key when a real client-provided session/thread identity is available; otherwise let the upstream use its default matching behaviour. Additional fixes that affect cache stability: - Canonicalise (sort) JSON keys in outgoing request bodies and in tool_call arguments / tool_result content so semantically identical requests produce identical byte sequences for upstream prefix caches. - Exempt JSON Schema property maps (properties, patternProperties, definitions, \$defs) from the underscore-prefix filter so user-defined schema keys like _id and _meta survive. - Add a [CacheTrace] debug log with stable hashes for instructions, tools, input and include to help diagnose cache misses. - Thread session_id into the usage logger for request correlation.	2026-05-11 15:25:48 +08:00
Jason	292c117509	chore(backend): satisfy cargo fmt and clippy --all-targets ... - Apply rustfmt diffs in claude_desktop_config.rs - Allow needless_return on current_platform_paths (cfg-mirrored arms) - Allow too_many_arguments on RequestForwarder::forward - Replace `let mut + reassign` with struct literals in tests (settings, backup, provider, response_processor) - Use Path::new instead of PathBuf::from to fix cmp_owned in misc tests - Replace 3.14 with 3.5 in config test to avoid approx_constant lint	2026-05-09 09:04:01 +08:00
Jason	8b3ad9caf9	feat(claude-desktop): add 3P provider switching with proxy gateway ... Adds a new ClaudeDesktop AppType that writes Claude Desktop's third-party inference profile under configLibrary/, sharing _meta.json with other launchers (Ollama-compatible) so cc-switch can coexist with them. Two switch modes: - direct: provider already exposes claude-* / anthropic/claude-* model ids on Anthropic Messages, Claude Desktop connects to it directly. - proxy: cc-switch's local proxy acts as the inference gateway, presenting only claude-* route names to Claude Desktop and mapping them to real upstream models. Required after Anthropic restricted Claude Desktop to claude-family ids. Backend: - New module claude_desktop_config with snapshot/rollback, official seed bypass, /claude-desktop/v1/{models,messages} routes, and a single source of truth for default proxy routes. - Gateway token persisted in SQLite, validated on every proxied request. - get_claude_desktop_status surfaces drift signals (stale models, missing routes, proxy stopped, base URL mismatch, missing token). Frontend: - Slim ClaudeDesktopProviderForm independent from ProviderForm, controlled by a top-level appId guard. - ProviderList banner consumes the status query (5s polling) and renders actionable diagnostics. - ClaudeDesktopRouteToggle in the header to start/stop the local gateway without touching takeover state. - Three-locale i18n synchronised.	2026-05-08 22:34:46 +08:00
涂瑜	dc04165f18	feat(tray): show cached provider usage in the system tray menu (#2184) ... * feat: add Rust-side write-through usage cache Introduce an in-memory UsageCache on AppState that the existing usage query commands populate on success. The cache is read-only to the rest of the app today; the next commit consumes it from the tray menu. - New services::usage_cache module with split maps: subscription keyed by AppType, script keyed by (AppType, provider_id). - AppType gains Eq + Hash so it can be used as a HashMap key. - commands::subscription::get_subscription_quota now takes State<AppState> and writes through on success (signature change is invisible to the frontend — Tauri injects State automatically). - commands::provider::queryProviderUsage body extracted into an inner async fn; the public command wraps it with write-through, covering Copilot, coding-plan, balance, and generic script paths uniformly. Cache is in-memory only; auto-query interval and the upcoming tray refresh action rebuild it after restarts. * feat(tray): surface cached usage in the system tray menu Read UsageCache populated by the previous commit and render it in three places, scoped to whatever TRAY_SECTIONS covers (Claude/Codex/Gemini): 1. Inline suffix on each provider submenu item "AnyProvider · 🟢 5h 18% / 7d 23%" 2. Disabled summary row per visible app under "Show Main" "Claude · Anthropic Official · 🟢 5h 18% / 7d 23%" 3. "Refresh all usage" menu item that triggers get_subscription_quota + queryProviderUsage for every applicable provider, then rebuilds the tray menu via the existing refresh_tray_menu path. Color encoding uses emoji (🟢 <70% / 🟠 70-89% / 🔴 ≥90%) since Tauri 2 tray labels are plain text. Missing cache entry leaves the label unchanged — tray never issues network requests when opened. Three new i18n-ready strings live in TrayTexts (en/zh/ja), following the existing pattern for tray text. Closes #2178. * feat(usage): bridge tray UsageCache writes to frontend React Query Why: tray hover triggers backend-only refresh that wrote to UsageCache but never notified the frontend, leaving main UI stale while tray showed fresh numbers. Emit a payload-carrying event after each cache write so React Query can setQueryData directly, keeping both views in sync without duplicate fetches. * fix(tray): skip hidden apps on hover refresh and drop stale disabled-script cache Address P2 findings from automated review on #2184: 1. refresh_all_usage_in_tray now filters TRAY_SECTIONS by settings.visible_apps before scheduling subscription/script queries, matching create_tray_menu and preventing wasted external API calls (and rate-limit/auth-error log noise) for apps the user has hidden. 2. format_usage_suffix only trusts the script cache when provider.meta.usage_script is still enabled; when a script is disabled/removed the cached suffix is now invalidated so the tray label no longer shows stale data indefinitely. * refactor: consolidate codex provider helpers and fix test semantics - Add Provider::is_codex_oauth() and Provider::codex_fast_mode_enabled() to eliminate duplicated meta extraction in claude.rs and stream_check.rs - Fix non-codex-oauth tests to pass codex_fast_mode=false (was true, harmless but semantically misleading) - Remove redundant is_dir() guard after resolve_skill_source_dir already guarantees the returned path is a directory * style: apply cargo fmt * fix(tray): reflect failed refreshes in cache and support Gemini flash-lite Follow-up to the tray usage-display feature addressing review feedback: - Write snapshots for both Ok(success:false) and Err paths in queryProviderUsage / get_subscription_quota so stale success data no longer persists across failed refreshes; the original Err is still returned to the frontend onError handler. - Include gemini_flash_lite tier in the tray summary with label "l". Matches the frontend SubscriptionQuotaFooter and keeps the worst emoji correct when lite is the highest utilization. - Add TIER_GEMINI_PRO / _FLASH / _FLASH_LITE constants in services/subscription.rs and reuse them in classify_gemini_model and sort_order. - Extract Provider::has_usage_script_enabled() to remove the duplicated meta.usage_script chain at two call sites. - Use db.get_provider_by_id in refresh_all_usage_in_tray instead of materialising the full provider map, and parallelise subscription and script futures via futures::future::join. - Narrow refresh_all_usage_in_tray to each section's effective current provider (script if enabled, else subscription when the provider is official). Hover refreshes now issue at most TRAY_SECTIONS.len() outbound requests. - Add 10 unit tests in tray::tests covering Claude/Codex h/w dispatch, Gemini p/f/l dispatch (including lite-only and lite-worst cases), and success/failure guards. --------- Co-authored-by: Jason <farion1231@gmail.com>	2026-04-23 16:17:15 +08:00
Jesus Díaz Rivas	10e0772d8c	feat: Add Codex OAuth FAST mode toggle (#2210) ... * Add Codex OAuth FAST mode toggle * fix(codex-oauth): default FAST mode to off to avoid surprise quota burn service_tier="priority" consumes ChatGPT subscription quota at a higher rate. Users must now opt in explicitly rather than inherit FAST mode silently when this feature ships. --------- Co-authored-by: Jason <farion1231@gmail.com>	2026-04-23 12:05:17 +08:00
lif	444c123ad0	[codex] Stabilize Codex OAuth cache routing (#2218) ... * Stabilize Codex OAuth cache routing Codex OAuth-backed Claude proxy requests now reuse a client-provided session identity for prompt cache routing and send Codex-like session headers when that identity exists. Generated proxy UUIDs are intentionally excluded so they do not fragment cache locality.\n\nThe same path exposed two runtime issues during validation: rustls needed an explicit process crypto provider, and Codex OAuth can return Responses SSE even when the original Claude request is non-streaming. Those are handled so cache-routed requests can complete instead of panicking or being parsed as JSON.\n\nConstraint: Official Codex uses conversation identity and Responses session headers for prompt cache routing.\nRejected: Always use generated proxy session IDs | generated IDs change per request and reduce cache reuse.\nConfidence: medium\nScope-risk: moderate\nDirective: Do not remove the client-provided-session guard unless generated session IDs become stable per conversation.\nTested: cargo test codex_oauth\nTested: Local dev app health check on 127.0.0.1:15721\nTested: Local proxy logs showed cache_read_tokens after restart\nNot-tested: Full cargo test without local cc-switch port conflict\nRelated: #2217 * feat(proxy): aggregate forced Codex OAuth SSE into JSON for non-streaming clients Narrow override on top of #2235's streaming fallback. Codex OAuth always forces upstream openai_responses into SSE, even when the original Claude request is stream:false. #2235 handles this by routing such responses through the streaming transform so the client receives text/event-stream — that avoids the 422 that JSON parsing would produce, and it also protects any other provider that unexpectedly returns SSE (the response.is_sse() guard). But for Claude SDK callers that sent stream:false, returning SSE still violates the Anthropic non-streaming contract. This commit adds an override on exactly one combination — non-streaming client + codex_oauth + openai_responses — to aggregate the upstream Responses SSE into a synthetic Responses JSON and then run the regular responses_to_anthropic non-streaming transform. All other paths, including the generic response.is_sse() fallback, remain on the streaming path from #2235. The aggregator reuses proxy::sse::take_sse_block / strip_sse_field, which support both \n\n and \r\n\r\n delimiters; a hand-rolled split("\n\n") would silently fail on real HTTPS upstreams. Tests cover the happy path, CRLF delimiters, response.failed errors, and the missing response.completed defensive branch. --------- Co-authored-by: Jason <farion1231@gmail.com>	2026-04-23 11:15:01 +08:00
Jason	4a0b5c3dec	refactor: remove per-provider proxy config feature ... The per-provider proxy configuration (meta.proxyConfig) is removed because its scope is too narrow and covered by global proxy settings and proxy takeover mode. Users can achieve the same result via the global proxy panel. Changes: - Remove ProviderProxyConfig type (frontend TS + backend Rust) - Remove ProviderAdvancedConfig proxy UI block, keep testConfig/pricingConfig - Simplify http_client: delete build_proxy_url_from_config, build_client_for_provider, get_for_provider - Simplify forwarder/stream_check/model_fetch to use global client - Remove i18n keys (en/zh/ja) - Fix pre-existing test bug in transform.rs (extra None arg)	2026-04-14 14:26:55 +08:00
Dex Miller	5566be2b4b	Stop sending prompt cache keys on Claude chat conversions (#2003) ... Responses conversions still use promptCacheKey, but chat completions now stay a pure shape transform. This keeps Claude -> chat requests aligned with providers that do not understand the field and keeps stream checks consistent with production behavior. Constraint: Issue #1919 requires removing prompt_cache_key from Claude -> OpenAI Chat requests Rejected: Add a runtime toggle for chat injection | requested behavior is unconditional removal Confidence: high Scope-risk: narrow Reversibility: clean Directive: Keep promptCacheKey limited to Claude -> Responses conversions unless a provider-specific contract is proven Tested: cargo test anthropic_to_openai Tested: cargo test anthropic_to_responses_with_cache_key Tested: cargo test transform_claude_request_for_api_format_responses Not-tested: Full src-tauri test suite Related: #1919	2026-04-13 10:22:55 +08:00
Jason	bfdac2a22a	feat: add Token Plan quota query for Kimi, Zhipu GLM, and MiniMax ... Add a new "Token Plan" template type in the usage query panel that natively queries quota/usage from Chinese coding plan providers (Kimi For Coding, Zhipu GLM, MiniMax) without requiring custom scripts. - Rust backend: new coding_plan service with provider-specific API queries (Kimi /v1/usages, Zhipu /api/monitor/usage/quota/limit, MiniMax /coding_plan/remains) normalized into UsageResult - Frontend: Token Plan template in UsageScriptModal with auto-detection of provider based on ANTHROPIC_BASE_URL pattern matching - Follows the same pattern as GitHub Copilot template (dedicated API path in queryProviderUsage, no JS script needed)	2026-04-05 11:39:29 +08:00
Dex Miller	3553d05bf0	feat(provider): additive provider key lifecycle & fix openclaw serializer panic (#1724) ... * feat(provider): support additive provider key lifecycle management Add `addToLive` parameter to add_provider so callers can opt out of writing to the live config (e.g. when duplicating an inactive provider). Add `originalId` parameter to update_provider to support provider key renames — the old key is removed from live config before the new one is written. Frontend: ProviderForm now exposes provider-key input for openclaw app type, and EditProviderDialog forwards originalId on save. Deep-link import passes addToLive=true to preserve existing behavior. * test(provider): add integration tests for additive provider key flows Cover openclaw provider duplication scenario to verify that a generated provider key is assigned automatically. Add MSW handlers for get_openclaw_live_provider_ids, get_openclaw_default_model, scan_openclaw_config_health, and check_env_conflicts endpoints. Update EditProviderDialog mock to pass originalId alongside provider. * fix(openclaw): replace json-five serializer to prevent panic on empty collections json-five 0.3.1 panics when pretty-printing nested empty maps/arrays. Switch value_to_rt_value() to serde_json::to_string_pretty() which produces valid JSON5 output without the panic. Add regression test for removing the last provider (empty providers map). * style: apply rustfmt formatting to proxy and provider modules Reformat chained .header() calls in ClaudeAdapter and StreamCheckService for consistent alignment. Reorder imports alphabetically in stream_check. Fix trailing whitespace in transform.rs and merge import lines in provider/mod.rs. * style: fix clippy warnings in live.rs and tray.rs * refactor(provider): simplify live_config_managed and deduplicate tolerant live config checks - Change live_config_managed from Option<bool> to bool with #[serde(default)] - Extract repeated tolerant live config query into check_live_config_exists helper - Fix duplicate key generation to also check live-only provider IDs - Fix updateProvider test to match new { provider, originalId } call signature - Add streaming_responses test type annotation for compiler inference * fix(provider): distinguish legacy providers from db-only when tolerating live config errors Change `ProviderMeta.live_config_managed` from `bool` to `Option<bool>` to introduce a three-state semantic: - `Some(true)`: provider has been written to live config - `Some(false)`: explicitly db-only, never written to live config - `None`: legacy data or unknown state (pre-existing providers) Previously, legacy providers defaulted to `live_config_managed = false` via `#[serde(default)]`, which silently swallowed live config parse errors. This could mask genuine configuration issues for providers that had actually been synced to live config before the field was introduced. Now, only providers with an explicit `Some(false)` marker tolerate parse errors; legacy `None` providers surface errors as before, preserving safety for already-managed configurations. Also wrap the `ensureQueryData` call for live provider IDs during duplication in a try/catch so that a malformed config file shows a user-facing toast instead of silently failing. Add tests for both the legacy error propagation path and the frontend duplication failure scenario. * refactor(provider): unify OMO variant updates with atomic file-then-db writes and rollback Consolidate the duplicated omo/omo-slim update branches into a single match on the variant. Write the OMO config file from the in-memory provider state *before* persisting to the database, so a file-write or plugin-sync failure leaves the database unchanged. If `add_plugin` fails after the config file is already written, roll back to the previous on-disk contents via snapshot/restore. Also: - `sync_all_providers_to_live` now skips db-only providers (`live_config_managed == Some(false)`) instead of attempting to write them to live config. - `import_{opencode,openclaw}_providers_from_live` mark imported providers as `live_config_managed: Some(true)` so they are correctly recognized during subsequent syncs. - Extract OmoService helpers: `profile_data_from_provider`, `snapshot_config_file`, `restore_config_file`, `write_profile_config`, and the new public `write_provider_config_to_file`. - Add 9 new tests covering sync skip, legacy restore, import marking, OMO persistence, file-write failure, and plugin-sync rollback. * fix(provider): fix additive provider delete/switch regressions and redundancy - fix(delete): replace stale live_config_managed flag check with check_live_config_exists so providers written to live before the flag-flip logic was introduced are still cleaned up on delete - fix(switch): make write_live_with_common_config return Err instead of silently returning Ok when config structure is invalid, preventing live_config_managed from being incorrectly flipped to true - fix(update): block provider key rename for OMO/OMO Slim categories to prevent orphaned current-state markers breaking OMO file syncs - fix(switch): flip live_config_managed to true after successful live write for DB-only additive providers so sync_all_providers_to_live includes them on future syncs; roll back live write if DB update fails - refactor(delete): merge symmetric OMO/OMO-Slim blocks into single match-on-variant path; hoist DB read to top of additive branch - refactor(remove_from_live_config): merge OMO/OMO-Slim if/else-if into single match-on-variant path - refactor(switch_normal): merge two OMO/OMO-Slim if blocks into one OpenCode guard with (enable, disable) variant pair - fix(update): remove redundant duplicate return Ok(true) after OMO current-state write * fix(test): use preferred_filename after OMO field rename The merge from main brought in #1746 which renamed OmoVariant.filename → preferred_filename, but the test helper omo_config_path() was not updated, breaking compilation of all new provider tests. --------- Co-authored-by: Jason <farion1231@gmail.com>	2026-04-01 21:16:41 +08:00
Dex Miller	8cae7b7b73	feat(proxy): add full URL mode and refactor endpoint rewriting (#1561) ... * feat(proxy): add full URL mode and refactor endpoint rewriting - Add `isFullUrl` provider meta to treat base_url as complete API endpoint - Remove hardcoded `?beta=true` from Claude adapter, pass through from client - Refactor forwarder endpoint rewriting with proper query string handling - Block provider switching when proxy is required but not running - Add full URL toggle UI in endpoint field with i18n (zh/en/ja) * refactor(proxy): remove beta query handling * fix(proxy): strip beta query when rewriting Claude endpoints * feat(codex): complete full URL support * refactor(ui): refine full URL endpoint hint	2026-03-28 15:52:02 +08:00
Zhou Mengze	8ccfbd36d6	feat(copilot): add GitHub Copilot reverse proxy support (#930) ... * refactor(toolsearch): replace binary patch with ENABLE_TOOL_SEARCH env var toggle - Remove toolsearch_patch.rs binary patching mechanism (~590 lines) - Delete `toolsearch_patch.rs` and `commands/toolsearch.rs` - Remove auto-patch startup logic and command registration from lib.rs - Remove `tool_search_bypass` field from settings.rs - Remove frontend settings ToggleRow, useSettings hook sync logic, and API methods - Clean up zh/en/ja i18n keys (notifications + settings) - Add ENABLE_TOOL_SEARCH toggle to Claude provider form - Add checkbox in CommonConfigEditor.tsx (alongside teammates toggle) - When enabled, writes `"env": { "ENABLE_TOOL_SEARCH": "true" }` - When disabled, removes the key; takes effect on provider switch - Add zh/en/ja i18n key: `claudeConfig.enableToolSearch` Claude Code 2.1.76+ natively supports this env var, eliminating the need for binary patching. * feat(claude): add effortLevel high toggle to provider form - Add "high-effort thinking" checkbox to Claude provider config form - When checked, writes `"effortLevel": "high"`; when unchecked, removes the field - Add zh/en/ja i18n translations * refactor(claude): remove deprecated alwaysThinking toggle - Claude Code now enables extended thinking by default; alwaysThinkingEnabled is a no-op - Thinking control is now handled via effortLevel (added in prior commit) - Remove state, switch case, and checkbox UI from CommonConfigEditor - Clean up alwaysThinking i18n keys across zh/en/ja locales * feat(opencode): add setCacheKey: true to all provider presets - Add setCacheKey: true to options in all 33 regular presets - Add setCacheKey: true to OPENCODE_DEFAULT_CONFIG for custom providers - Exclude 2 OMO presets (Oh My OpenCode / Slim) which have their own config mechanism Closes #1523 * fix(codex): resolve 1M context window toggle causing MCP editor flicker - Add localValueRef to short-circuit duplicate CodeMirror updateListener callbacks, breaking the React state → CodeMirror → stale onChange → React state feedback loop - Use localValueRef.current in handleContextWindowToggle and handleCompactLimitChange to avoid stale closure reads - Change compact limit input from type="number" to type="text" with inputMode="numeric" to remove unnecessary spinner buttons * feat(codex): add 1M context window toggle utilities and i18n keys - Add extractCodexTopLevelInt, setCodexTopLevelInt, removeCodexTopLevelField TOML helpers in providerConfigUtils.ts - Add i18n keys for contextWindow1M, autoCompactLimit in zh/en/ja locales * feat(claude): collapse model mapping fields by default - Wrap 5 model mapping inputs in a Collapsible, collapsed by default - Auto-expand when any model value is present (including preset-filled) - Show hint text when collapsed explaining most users need no config - Add zh/en/ja i18n keys for toggle label and collapsed hint - Use variant={null} to avoid ghost button hover style clash in dark mode * feat(claude): merge advanced fields into single collapsible section - Merge API format, auth field, and model mapping into a unified "Advanced Options" collapsible - Extend smart-expand logic to detect non-default values across all advanced fields - Preserve model mapping sub-header and hint with a separator line - Update zh/en/ja i18n keys (advancedOptionsToggle, advancedOptionsHint, modelMappingLabel, modelMappingHint) * feat(copilot): add GitHub Copilot reverse proxy support Add GitHub Copilot as a Claude provider variant with OAuth device code authentication and Anthropic ↔ OpenAI format transformation. Backend: - Add CopilotAuthManager for GitHub OAuth device code flow - Implement Copilot token auto-refresh (60s before expiry) - Persist GitHub token to ~/.cc-switch/copilot_auth.json - Add ProviderType::GitHubCopilot and AuthStrategy::GitHubCopilot - Modify forwarder to use /chat/completions for Copilot - Add Copilot-specific headers (Editor-Version, Editor-Plugin-Version) Frontend: - Add CopilotAuthSection component for OAuth UI - Add useCopilotAuth hook for OAuth state management - Auto-copy user code to clipboard and open browser - Use 8-second polling interval to avoid GitHub rate limits - Skip API Key validation for Copilot providers - Add GitHub Copilot preset with claude-sonnet-4 model Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(copilot): remove is_expired() calls from tests Remove references to deleted is_expired() method in test code. Only is_expiring_soon() is needed for token refresh logic. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * feat(copilot): add real-time model listing from Copilot API - Add fetch_models() to CopilotAuthManager calling GET /models endpoint - Add copilot_get_models Tauri command - Add copilotGetModels() frontend API wrapper - Modify ClaudeFormFields to show model dropdown for Copilot providers - Fetches available models on component mount when isCopilotPreset - Groups models by vendor (Anthropic, OpenAI, Google, etc.) - Input + dropdown button combo allows both manual entry and selection - Non-Copilot providers keep original plain Input behavior Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(copilot): add usage query integration - Add Copilot usage API integration (fetch_usage method) - Add copilot_get_usage Tauri command - Add GitHub Copilot template in usage query modal - Unify naming: copilot → github_copilot - Add constants management (TEMPLATE_TYPES, PROVIDER_TYPES) - Improve error handling with detailed error messages - Add database migration (v5 → v6) for template type update - Add i18n translations (zh, en, ja) - Improve type safety with TemplateType - Apply code formatting (cargo fmt, prettier) * 修复github 登录和注销问题 ，模型选择问题 * feat(copilot): add multi-account support for GitHub Copilot - Add multi-account storage structure with v1 to v2 migration - Add per-account token caching and auto-refresh - Add new Tauri commands for account management - Integrate account selection in Proxy forwarder - Add account selection UI in CopilotAuthSection - Save githubAccountId to ProviderMeta - Add i18n translations for multi-account features (zh/en/ja) * 修复用量查询Reset字段出现多余字符 * refactor(auth-binding): introduce generic provider auth binding primitives - add shared authBinding types in Rust and TypeScript while keeping githubAccountId as a compatibility field\n- resolve Copilot token, models, and usage through provider-bound account lookup instead of only the implicit default account\n- fix the Unix build regression in settings.rs by restoring std::io::Write for write_all()\n- remove the accidental .github ignore entry and drop leftover Copilot form debug logs\n- keep the first migration step non-breaking by writing both authBinding and the legacy githubAccountId field from the form * refactor(auth-service): add managed auth command surface and explicit default account state - introduce generic managed auth commands and frontend auth API wrappers for provider-scoped login, status, account listing, removal, logout, and default-account selection\n- store an explicit Copilot default_account_id instead of relying on HashMap iteration order, and use it consistently for fallback token/model/usage resolution\n- sort managed accounts deterministically and surface default-account state to the UI\n- refactor the Copilot form hook to wrap a generic useManagedAuth implementation while preserving the existing component contract\n- add default-account controls to the Copilot auth section and extend Copilot auth status serialization/tests for the new state * feat(auth-center): add a dedicated settings entrypoint for managed OAuth accounts - add an Auth Center tab to Settings so managed OAuth accounts are no longer hidden inside individual provider forms\n- introduce a first AuthCenterPanel that hosts GitHub Copilot account management as the initial managed auth provider\n- keep the provider form experience intact while establishing a global account-management surface for future providers such as OpenAI\n- validate that the new settings tab works cleanly with the generic managed auth hook and existing Copilot account controls * feat(add-provider): expose managed OAuth sources alongside universal providers - add an OAuth tab to the Add Provider flow so managed auth sources sit beside app-specific and universal providers\n- reuse the new Auth Center panel inside the dialog, keeping account management discoverable during provider creation\n- make the dialog footer adapt to the OAuth tab so account setup does not pretend to create a provider directly\n- align the add-provider UX with the new architecture where OAuth accounts are global assets and providers bind to them later * fix(auth-reliability): harden managed auth persistence and refresh behavior - replace direct Copilot auth store writes with private temp-file writes and atomic rename semantics, and document the local token storage limitation\n- add per-account refresh locks plus a double-check path so concurrent requests do not stampede GitHub token refresh\n- surface legacy migration failures through auth status, expose them in the UI, and add translated copy for the new account-state labels\n- stop writing the legacy githubAccountId field from the provider form while keeping compatibility reads in place\n- add logout error recovery and Copilot model-load toasts so auth failures are no longer silently swallowed * refactor(copilot-detection): prefer provider type before URL fallbacks - update forwarder endpoint rewriting to treat providerType as the primary GitHub Copilot signal\n- keep githubcopilot.com string matching only as a compatibility fallback for older provider records without providerType\n- reduce one more path where Copilot behavior depended purely on URL heuristics * fix(copilot-auth): add cancel button to error state in CopilotAuthSection - 错误状态下仅有"重试"按钮，用户无法退出（如不可恢复的 403 未订阅错误） - 新增"取消"按钮，复用已有的 cancelAuth 逻辑重置为 idle 状态 * 修复打包后github账号头像显示异常 * 修复github copilot 来源的模型测试报错 * feat(copilot-preset): add default model presets for GitHub Copilot - 补充 Copilot 预设的默认模型配置，用户选完预设即可直接使用 - ANTHROPIC_MODEL: claude-opus-4.6 - ANTHROPIC_DEFAULT_HAIKU_MODEL: claude-haiku-4.5 - ANTHROPIC_DEFAULT_SONNET_MODEL: claude-sonnet-4.6 - ANTHROPIC_DEFAULT_OPUS_MODEL: claude-opus-4.6 --------- Co-authored-by: Jason <farion1231@gmail.com> Co-authored-by: 周梦泽 <mengze.zhou@dafeng-tech.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>	2026-03-17 23:57:58 +08:00
Jason	dd971246be	feat: restore Claude provider auth field selector (AUTH_TOKEN / API_KEY)	2026-03-09 08:56:58 +08:00
Jason	9092e97bc2	style: format Rust code with cargo fmt	2026-03-08 22:27:53 +08:00
Jason	6d078e7f33	feat: apply common config as runtime overlay instead of materialized merge ... Common config snippets are now dynamically overlaid when writing live files, rather than being pre-merged into provider snapshots at edit time. This ensures that updating a snippet immediately takes effect for the current provider and automatically propagates to other providers on their next switch. Key changes: - Add write_live_with_common_config() overlay pipeline - Strip common config from live before backfilling provider snapshots - Normalize provider snapshots on save to keep them snippet-free - Add explicit commonConfigEnabled flag in ProviderMeta (Option<bool>) - Migrate legacy providers on snippet save (infer flag from subset check) - Add Codex TOML snippet validation in set_common_config_snippet - Stabilize onConfigChange callbacks with useCallback in ProviderForm	2026-03-08 21:45:20 +08:00
Jason	11f70f676e	refactor: deduplicate and improve OpenAI Responses API conversion ... - Extract shared map_responses_stop_reason and build_anthropic_usage_from_responses into transform_responses.rs as pub(crate) - Align cache token extraction priority: OpenAI nested details as fallback, direct Anthropic fields as override - Extract resolve_content_index helper to eliminate 3x copy-paste in streaming_responses.rs - Add streaming reasoning/thinking event handlers (response.reasoning.delta/done) - Add explanatory comment to transform_response heuristic detection - Add openai_responses to api_format doc comment and needs_transform test - Add explicit no-op match arms for lifecycle events - Add promptCacheKey to TS ProviderMeta type - Update toast i18n key to be generic for both OpenAI formats (zh/en/ja)	2026-03-08 19:41:29 +08:00
Jason	859f413756	revert: restore full config overwrite + Common Config Snippet (revert 992dda5c) ... Revert the partial key-field merging refactoring introduced in 992dda5c, along with two dependent commits (24fa8a18, 87604b18) that referenced the now-removed ClaudeQuickToggles component. The whitelist-based partial merge approach had critical issues: - Non-whitelisted custom fields were lost during provider switching - Backfill permanently stripped non-key fields from the database - Whitelist required constant maintenance to track upstream changes This restores the proven "full config overwrite + Common Config Snippet" architecture where each provider stores its complete configuration and shared settings are managed via a separate snippet mechanism. Reverted commits: - 24fa8a18: context-aware JSON editor hint + hide quick toggles - 87604b18: hide ClaudeQuickToggles when creating - 992dda5c: partial key-field merging refactoring Restored: - Full config snapshot write (write_live_snapshot) for Claude/Codex/Gemini - Full config backfill (settings_config = live_config) - Common Config Snippet UI and backend commands - 6 frontend components/hooks for common config editing - configApi barrel export and DB snippet methods Removed: - ClaudeQuickToggles component - write_live_partial / backfill_key_fields / patch_claude_live - All KEY_FIELDS constants	2026-02-27 23:12:34 +08:00
Jason Young	992dda5c5c	refactor(provider): switch from full config overwrite to partial key-field merging (#1098) ... * refactor(provider): switch from full config overwrite to partial key-field merging Replace the provider switching mechanism for Claude/Codex/Gemini from full settings_config overwrite to partial key-field replacement, preserving user's non-provider settings (plugins, MCP, permissions, etc.) across switches. - Add write_live_partial() with per-app implementations for Claude (JSON env merge), Codex (auth replace + TOML partial merge), and Gemini (env merge) - Add backfill_key_fields() to extract only provider-specific fields when saving live config back to provider entries - Update switch_normal, sync_current_to_live, add, update to use partial merge - Remove common config snippet feature for Claude/Codex/Gemini (no longer needed with partial merging); preserve OMO common config - Delete 6 frontend files (3 components + 3 hooks), clean up 11 modified files - Remove backend extract_common_config_* methods, 3 Tauri commands, CommonConfigSnippets struct, and related migration code - Update integration tests to validate key-field-only backfill behavior * refactor(cleanup): remove dead code and redundant MCP sync after partial-merge refactor - Remove ConfigService legacy full-overwrite sync methods (~150 lines) - Remove redundant McpService::sync_all_enabled from switch_normal - Switch proxy fallback recovery from write_live_snapshot to write_live_partial - Remove dead ProviderService::write_gemini_live wrapper - Update tests to reflect partial-merge behavior (MCP preserved, not re-synced) * feat(claude): add Quick Toggles for common Claude Code preferences Add checkbox toggles for hideAttribution, alwaysThinking, and enableTeammates that write directly to the live settings file via RFC 7396 JSON Merge Patch. Mirror changes to the form editor using form.watch for reactive updates. * fix(provider): add missing key fields to partial-merge constants Add provider-specific fields verified against official docs to prevent key residue or loss during provider switching: - Claude: CLAUDE_CODE_SUBAGENT_MODEL (env), model (top-level) - Codex: review_model, plan_mode_reasoning_effort - Gemini: GOOGLE_API_KEY (official alternative to GEMINI_API_KEY) * fix(provider): expand partial-merge key fields for Bedrock, Vertex, Foundry and behavior settings Add missing env/top-level fields to CLAUDE_KEY_ENV_FIELDS and CLAUDE_KEY_TOP_LEVEL so that provider switching correctly replaces (and clears) credentials and flags for AWS Bedrock, Google Vertex AI, Microsoft Foundry, and provider behavior overrides like max output tokens and prompt caching. * feat(provider): add auth field selector for Claude providers (AUTH_TOKEN / API_KEY) Allow users to choose between ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY when creating or editing custom Claude providers, persisted in meta.apiKeyField. * refactor(preset): remove AiHubMix hardcoded API_KEY in favor of generic auth selector AiHubMix was the only preset that hardcoded ANTHROPIC_API_KEY before the generic auth field selector was introduced. Now that users can freely choose between AUTH_TOKEN and API_KEY via the UI, remove the special-case and default AiHubMix to the standard ANTHROPIC_AUTH_TOKEN.	2026-02-23 21:57:04 +08:00
Jason	70a18c1141	refactor(claude): migrate api_format from settings_config to meta ... Move api_format storage from settings_config to ProviderMeta to prevent polluting ~/.claude/settings.json when switching providers. - Add api_format field to ProviderMeta (Rust + TypeScript) - Update ProviderForm to read/write apiFormat from meta - Maintain backward compatibility for legacy settings_config.api_format and openrouter_compat_mode fields (read-only fallback) - Strip api_format from settings_config before writing to live config	2026-01-30 16:40:41 +08:00
Andrew Leng	0dd823ae3a	fix(codex): fix 404 errors and connection timeout with custom base_url (#760) ... * fix(proxy): fix Codex 404 errors with custom base_url prefixes - handlers.rs:268: Remove hardcoded /v1 prefix in Codex forwarding - codex.rs:140: Only add /v1 for origin-only base_urls, dedupe /v1/v1 - stream_check.rs:364: Try /responses first, fallback to /v1/responses - provider.rs:427: Don't force /v1 for custom prefix base_urls Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(codex): always add /v1 for custom prefix base_urls Changed logic to always add /v1 prefix unless base_url already ends with /v1. This fixes 504 timeout errors with relay services that expect /v1 in the path. - Most relay services follow OpenAI standard format: /v1/responses - Users can opt-out by adding /v1 to their base_url configuration - Updated test case to reflect new behavior Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(proxy): allow system proxy on localhost with different ports - Only bypass system proxy if it points to CC Switch's own port (15721) - Allow other localhost proxies (e.g., Clash on 7890) to be used - Add INFO level logging for request URLs to aid debugging This fixes connection timeout issues when using local proxy tools. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(codex): don't add /v1 for custom prefix base_urls Reverted logic to not add /v1 for base_urls with custom prefixes. Many relay services use custom paths without /v1. - Pure origin (e.g., https://api.openai.com) → adds /v1 - With /v1 (e.g., https://api.openai.com/v1) → no change - Custom prefix (e.g., https://example.com/openai) → no /v1 This fixes 404 errors with relay services that don't use /v1 in their paths. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(proxy): use dynamic port for system proxy detection Instead of hardcoding port 15721, now uses the actual configured listen_port from proxy settings. - Added set_proxy_port() to update the port when proxy server starts - Added get_proxy_port() to retrieve current port for detection - Updated server.rs to call set_proxy_port() on startup - Updated tests to reflect new behavior This allows users to change the proxy port in settings without breaking the system proxy detection logic. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(proxy): change default proxy port from 15721 to 5000 Update the default fallback port in get_proxy_port() from 15721 to 5000 to match the project's standard default port configuration. Also updated test cases to use port 5000 consistently. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(proxy): revert default port back to 15721 Revert the default fallback port in get_proxy_port() from 5000 back to 15721 to align with the project's updated default port configuration. Also updated test cases to use port 15721 consistently. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> --------- Co-authored-by: ozbombor <ozbombor@users.noreply.github.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-29 09:10:17 +08:00
Dex Miller	785e1b5add	Feat/pricing config enhancement (#781) ... * feat(db): add pricing config fields to proxy_config table - Add default_cost_multiplier field per app type - Add pricing_model_source field (request/response) - Add request_model field to proxy_request_logs table - Implement schema migration v5 * feat(api): add pricing config commands and provider meta fields - Add get/set commands for default cost multiplier - Add get/set commands for pricing model source - Extend ProviderMeta with cost_multiplier and pricing_model_source - Register new commands in Tauri invoke handler * fix(proxy): apply cost multiplier to total cost only - Move multiplier calculation from per-item to total cost - Add resolve_pricing_config for provider-level override - Include request_model and cost_multiplier in usage logs - Return new fields in get_request_logs API * feat(ui): add pricing config UI and usage log enhancements - Add pricing config section to provider advanced settings - Refactor PricingConfigPanel to compact table layout - Display all three apps (Claude/Codex/Gemini) in one view - Add multiplier column and request model display to logs - Add frontend API wrappers for pricing config * feat(i18n): add pricing config translations - Add zh/en/ja translations for pricing defaults config - Add translations for multiplier, requestModel, responseModel - Add provider pricing config translations * fix(pricing): align backfill cost calculation with real-time logic - Fix backfill to deduct cache_read_tokens from input (avoid double billing) - Apply multiplier only to total cost, not to each item - Add multiplier display in request detail panel with i18n support - Use AppError::localized for backend error messages - Fix init_proxy_config_rows to use per-app default values - Fix silent failure in set_default_cost_multiplier/set_pricing_model_source - Add clippy allow annotation for test mutex across await * style: format code with cargo fmt and prettier * fix(tests): correct error type assertions in proxy DAO tests The tests expected AppError::InvalidInput but the DAO functions use AppError::localized() which returns AppError::Localized variant. Updated assertions to match the correct error type with key validation. --------- Co-authored-by: Jason <farion1231@gmail.com>	2026-01-27 10:43:05 +08:00
Jason	a6ad896db0	fix(opencode): preserve extra model fields during serialization ... Add `extra` field with serde flatten to OpenCodeModel struct to capture custom fields like cost, modalities, thinking, and variants that were previously lost during save operations.	2026-01-23 20:42:50 +08:00
Dex Miller	e7badb1a24	Feat/provider individual config (#663) ... * refactor(ui): simplify UpdateBadge to minimal dot indicator * feat(provider): add individual test and proxy config for providers Add support for provider-specific model test and proxy configurations: - Add ProviderTestConfig and ProviderProxyConfig types in Rust and TypeScript - Create ProviderAdvancedConfig component with collapsible panels - Update stream_check service to merge provider config with global config - Proxy config UI follows global proxy style (single URL input) Provider-level configs stored in meta field, no database schema changes needed. * feat(ui): add failover toggle and improve proxy controls - Add FailoverToggle component with slide animation - Simplify ProxyToggle style to match FailoverToggle - Add usage statistics button when proxy is active - Fix i18n parameter passing for failover messages - Add missing failover translation keys (inQueue, addQueue, priority) - Replace AboutSection icon with app logo * fix(proxy): support system proxy fallback and provider-level proxy config - Remove no_proxy() calls in http_client.rs to allow system proxy fallback - Add get_for_provider() to build HTTP client with provider-specific proxy - Update forwarder.rs and stream_check.rs to use provider proxy config - Fix EditProviderDialog.tsx to include provider.meta in useMemo deps - Add useEffect in ProviderAdvancedConfig.tsx to sync expand state Fixes #636 Fixes #583 * fix(ui): sync toast theme with app setting * feat(settings): add log config management Fixes #612 Fixes #514 * fix(proxy): increase request body size limit to 200MB Fixes #666 * docs(proxy): update timeout config descriptions and defaults Fixes #612 * fix(proxy): filter x-goog-api-key header to prevent duplication * fix(proxy): prevent proxy recursion when system proxy points to localhost Detect if HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables point to loopback addresses (localhost, 127.0.0.1), and bypass system proxy in such cases to avoid infinite request loops. * fix(i18n): add providerAdvanced i18n keys and fix failover toast parameter - Add providerAdvanced.* i18n keys to en.json, zh.json, and ja.json - Fix failover toggleFailed toast to pass detail parameter - Remove Chinese fallback text from UI for English/Japanese users * fix(tray): restore tray-provider events and enable Auto failover properly - Emit provider-switched event on tray provider click (backward compatibility) - Auto button now: starts proxy, takes over live config, enables failover * fix(log): enable dynamic log level and single file mode - Initialize log at Trace level for dynamic adjustment - Change rotation strategy to KeepSome(1) for single file - Set max file size to 1GB - Delete old log file on startup for clean start * fix(tray): fix clippy uninlined format args warning Use inline format arguments: {app_type_str} instead of {} * fix(provider): allow typing :// in endpoint URL inputs Change input type from "url" to "text" to prevent browser URL validation from blocking :// input. Closes #681 * fix(stream-check): use Gemini native streaming API format - Change endpoint from OpenAI-compatible to native streamGenerateContent - Add alt=sse parameter for SSE format response - Use x-goog-api-key header instead of Bearer token - Convert request body to Gemini contents/parts format * feat(proxy): add request logging for debugging Add debug logs for outgoing requests including URL and body content with byte size, matching the existing response logging format. * fix(log): prevent usize underflow in KeepSome rotation strategy KeepSome(n) internally computes n-2, so n=1 causes underflow. Use KeepSome(2) as the minimum safe value.	2026-01-20 21:02:44 +08:00
Jason	3bd3845ec0	feat(opencode): add model-level options editor ... Add support for configuring per-model options like provider routing. Each model row now has an expand/collapse toggle to show a key-value editor for model-specific options (e.g., provider order, fallbacks). - Add options field to OpenCodeModel in Rust and TypeScript - Add expandable key-value editor UI for each model - Use local state pattern for option key input to prevent focus loss - Add i18n translations for zh/en/ja	2026-01-19 15:05:01 +08:00
Jason	b0d0a2c466	feat(opencode): add extra options editor for SDK configuration ... Add key-value pair editor for configuring additional SDK options like timeout, setCacheKey, etc. Values are automatically parsed to appropriate types (number, boolean, object) on save. - Add `extra` field with serde flatten in Rust backend - Add index signature to OpenCodeProviderOptions type - Create ExtraOptionKeyInput component with local state pattern - Place extra options section above models configuration	2026-01-19 11:42:24 +08:00
Jason	d765364a18	chore(opencode): remove unused functions and legacy code ... Remove dead code that was never called after v3.7.0 architecture change: - mcp/opencode.rs: sync_enabled_to_opencode, collect_enabled_servers - opencode_config.rs: 8 unused utility functions - provider.rs: OpenCodeProviderConfig impl block (4 methods) These functions were designed for batch operations but McpService uses per-server sync pattern instead. No functionality affected.	2026-01-16 15:56:03 +08:00
Jason	de3a22535d	fix(opencode): address issues found during OpenCode integration review ... - Fix MCP server not removed from opencode.json when unchecked in edit modal - Fix Windows atomic write failure when opencode.json already exists - Fix i18n keys mismatch in OpenCodeFormFields (use opencode.* namespace) - Fix unit test missing apps.opencode field assertion	2026-01-15 19:07:49 +08:00
Jason	58ecc44ee6	feat(opencode): Phase 2 - Add OpenCode provider data structures ... Add OpenCode-specific configuration structures for the AI SDK format: - OpenCodeProviderConfig: Main config with npm package, options, and models - OpenCodeProviderOptions: baseURL, apiKey, and headers support - OpenCodeModel: Model definition with name and token limits - OpenCodeModelLimit: Context and output token limits Key features: - Supports environment variable references (e.g., "{env:API_KEY}") - Custom headers support for specialized providers - Model-level token limits for context management - Helper methods for parsing and validation	2026-01-15 15:59:44 +08:00
杨永安	07d022ba9f	feat(usage): improve custom template system with variable hints and validation fixes (#628) ... * feat(usage): improve custom template with variables display and explicit type detection Combine two feature improvements: 1. Display supported variables ({{baseUrl}}, {{apiKey}}) with actual values in custom template mode 2. Add explicit templateType field for accurate template mode detection ## Changes ### Frontend - Display template variables with actual values extracted from provider settings - Add templateType field to UsageScript for explicit mode detection - Support template mode persistence across sessions ### Backend - Add template_type field to UsageScript struct - Improve validation logic based on explicit template type - Maintain backward compatibility with type inference ### I18n - Add "Supported Variables" section translation (zh/en/ja) ### Benefits - More accurate template mode detection (no more guessing) - Better user experience with variable hints - Clearer validation rules per template type * fix(usage): resolve custom template cache and validation issues Combine three bug fixes to make custom template mode work correctly: 1. **Update cache after test**: Testing usage script successfully now updates the main list cache immediately 2. **Fix same-origin check**: Custom template mode can now access different domains (SSRF protection still active) 3. **Fix field naming**: Unified to use autoQueryInterval consistently between frontend and backend ## Problems Solved - Main provider list showing "Query failed" after successful test - Custom templates blocked by overly strict same-origin validation - Auto-query intervals not saved correctly due to inconsistent naming ## Changes ### Frontend (UsageScriptModal) - Import useQueryClient and update cache after successful test - Invalidate usage cache when saving script configuration - Use standardized autoQueryInterval field name ### Backend (usage_script.rs) - Allow custom template mode to bypass same-origin checks - Maintain SSRF protection for all modes ### Hooks (useProviderActions) - Invalidate usage query cache when saving script ## Impact Users can now use custom templates freely while security validations remain intact for general templates. * fix(usage): correct provider credential field names - Claude: support both ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN - Gemini: use GEMINI_API_KEY instead of GOOGLE_GEMINI_API_KEY - Codex: use OPENAI_API_KEY and parse base_url from TOML config string Addresses review feedback from PR #628 * style: format code --------- Co-authored-by: Jason <farion1231@gmail.com>	2026-01-14 15:42:05 +08:00
Dex Miller	99c910e58e	fix(provider): persist endpoint auto-select state (#611) ... - Add endpointAutoSelect field to ProviderMeta for persistence - Lift autoSelect state from EndpointSpeedTest to ProviderForm - Save auto-select preference when provider is saved - Restore preference when editing existing provider Fixes https://github.com/farion1231/cc-switch/issues/589	2026-01-12 16:26:17 +08:00