Resolve the app path via os.homedir() in launch to match install/uninstall;
validate the host on every redirect hop (manual follow, not blind
maxRedirections); reject zip-slip entries before extracting into ~/Applications.
Add ccs bar (install/launch/uninstall/version) and the ~/.ccs/bar.json
discovery handshake the app reads. install resolves a floating release asset,
follows redirects, validates the download host over HTTPS, checks status,
verifies the extracted app, and runs a real version-compat handshake against
/api/overview.
Two pre-existing test bugs surfaced under CCS CI on the new claw self-
hosted runners but stayed hidden locally:
1. tests/unit/commands/cliproxy-routing-subcommand.test.ts mocks the
routing-subcommand module with only 3 exports, but
src/commands/cliproxy/index.ts statically imports 6. Bun resolves
the static import graph against the mock and reports
SyntaxError: Export named 'handleRoutingAffinitySet' not found
for every test in the file. Add the missing 3 exports
(handleRoutingAffinityStatus, handleRoutingAffinityHelp,
handleRoutingAffinitySet) to the mock and document why the mock
must mirror every named export of the target module.
2. tests/unit/hooks/websearch-transformer.test.ts builds the
"disallowed" trace path from process.cwd() and from os.homedir().
Both fall under the os.tmpdir() safe-prefix in two real
environments: CI runners with cwd == /tmp/runner/work/... and Bun
test isolation that re-roots HOME under tmpdir. The hook treats
them as safe, writes the trace, and the assertion that the file
does NOT exist fails. Anchor disallowedTracePath under /etc/...
instead so it cannot satisfy the tmpdir, /var/log, or
<CCS_HOME>/.ccs/logs prefixes in any host environment.
Both fixes are independent of the OAuth callback traceability change
that this branch otherwise carries, but ship together so the PR
clears CI on the new runner stack.
Resolve the dispatcher and dashboard conflicts from origin/dev while preserving the configured local CLIProxy port behavior. Also harden lifecycle port fallback and wait for the actual stopped port during binary installs.
All call sites that spawn or probe CLIProxyApiPlus now read
cliproxy_server.local.port from config via resolveLifecyclePort()
instead of using the hardcoded CLIPROXY_DEFAULT_PORT constant.
- Move resolveLifecyclePort helper to src/cliproxy/config/port-manager.ts
- Fix 7 call sites: ccs.ts, config-command.ts, copilot-executor.ts,
lifecycle.ts, binary-manager.ts, cliproxy-stats-routes.ts,
cliproxy-local-proxy.ts
- Remove duplicate resolveLocalCliproxyPort helper
- Cache port resolution in /proxy-status handler to avoid repeated I/O
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- derive repo imports from each test file via file URLs
- avoid hardcoded paths in the repo
- launch child scripts with the current runtime for consistent local and runner behavior
- isolate tokens and session-tracker tests in child processes
- make child scripts resolve repo modules from the test location
- avoid machine-specific paths in the repo
- skip CLIProxy auto-update checks on runtime bootstrap paths
- fail fast when local startup needs a missing binary instead of attempting installs
- add regression coverage for dashboard limited mode and startup test isolation
Tam Nhu Tran