Commit Graph
30 Commits
Author SHA1 Message Date
Sergey Galuza cbcdb6ba62 fix(glmt): emit thinking signature as opaque string
generateThinkingSignature() returned an object
({type, hash, length, timestamp}) but Anthropic requires a thinking
block's `signature` to be a non-empty opaque STRING. The object made
the thinking block invalid, breaking the stream against reasoning
backends and surfacing as a false 502 "did not respond within 600s".

Return a deterministic base64 token instead (no Date.now()), and
narrow ThinkingSignature to a string alias so existing imports stay
intact. The signature is only ever assigned, never read as an object,
so consumers are unaffected. Update the existing unit test to the
corrected string contract.

Built [OnSteroids](https://onsteroids.ai)
2026-06-29 13:27:09 +02:00
Tam Nhu Tran 87aeb8f193 feat(logging): P3 hotpath console.error migration + redaction gate (928->267)
Epic P3. Migrates hotpath console.error/warn to the structured logger
(diagnostics) or process.stderr.write (user-facing), and adds a redaction
safety gate so the migration cannot leak credentials.

Redaction gate (MR1):
- log-redaction: scrub known credential token shapes (sk-ant, sk-, xoxb,
  ghp, glpat, AIza, JWT bodies, api_key=, Bearer/Basic/Token scheme) in
  string values, Error.message, AND the log message string (defense-in-depth).
- logger: message now passes through maskSecretTokens.

tool-sanitization-proxy: deleted the private file-logging subsystem
(initLogFile/writeLog/log/warn, logFilePath, debugMode); 13 call sites now
route through the existing createLogger('cliproxy:tool-sanitization-proxy').

Sweep (~120 diagnostic -> structured createLogger; ~540 user-facing -> stderr):
- diagnostics converted across proxy, web-server/routes, glmt pipeline, quota
  fetchers, executors, delegation, session-bridge, https-tunnel-proxy.
- user-facing CLI output (flows, arg-parser usage, installers, prompts, adapter
  launch errors, error display) moved to process.stderr.write (preserves stderr).
- src/utils/error-manager.ts reclassified CLI-UX-exempt (user-facing display).

Metric: hotpath console.error 928 -> 267 (71%); createLogger files 35 -> 64.
Residual 267 is user-facing CLI output (not diagnostics); documented in
docs/hardening-debt-burndown.md. Redaction gate makes further conversion safe.

Tests: hotpath-redaction-regression (12 token shapes); updated delegation-handler,
arg-parser, model-warnings spies (console.error -> process.stderr.write).
validate + validate:ci-parity green.
2026-06-18 18:48:12 -04:00
Tam Nhu Tran 27c8a9570b fix(test): run bucket paths explicitly 2026-06-14 11:55:01 -04:00
Kai (Tam Nhu) Tran 2ec23c6c3a fix(sse): make CRLF normalization chunk-boundary safe (#1359)
* fix(sse): handle CRLF split across chunk boundaries

* style: apply prettier formatting
2026-05-23 21:44:32 -04:00
Tam Nhu Tran 4f6e61739c refactor(config): adopt config-loader-facade across the codebase
Issue #1161. Sweeps 127 files to import from
src/config/config-loader-facade.ts instead of unified-config-loader or
utils/config-manager directly.

WRITE callers (32 files): replaced raw saveUnifiedConfig /
mutateUnifiedConfig / updateUnifiedConfig calls with the facade's
cache-coherent wrappers saveConfig / mutateConfig / updateConfig. This
fixes a latent stale-cache window where direct writes through the
underlying loader bypassed the facade's memoization.

READ callers (95 files): mechanical import-path migration only —
function names unchanged because the facade re-exports them. No
behavior change.

Also updated:
- tests/unit/utils/browser/browser-setup.test.ts (DI interface rename)
- src/management/checks/image-analysis-check.ts (dynamic import rename)
- src/web-server/health-service.ts (dynamic require rename)
- src/ccs.ts (path prefix fix from sweep script)

After sweep: zero raw write callers remain outside src/config/. Direct
imports of config-manager remain only for symbols not in the facade
(getConfigPath, getCcsDirSource, etc). Behavior unchanged; full suite
passes 1824/1824.

Out of scope: switching loadOrCreateUnifiedConfig() callers to
getCachedConfig() — needs per-callsite cache-safety analysis. Tracked
as follow-up.

Refs #1161
2026-05-03 01:42:53 -04:00
Tam Nhu Tran 1ff4329ee4 feat(providers): instrument copilot, cursor, and glmt across daemons and executors
Provider modules now emit structured stage tags around daemon spawn /
ready / stop, executor invocations, and upstream dispatch. glmt-transformer
gets cleanup-stage error conversion; legacy glmt-proxy adds minimal
listen + retry instrumentation (full per-request stages live in proxy-server
since glmt-proxy is compat-only).

Refs #1141, #1138
2026-04-30 13:00:33 -04:00
Tam Nhu Tran 399f403322 fix(transformers): preserve tool ordering across proxy streams
- reject pending tool_result layouts that cannot be translated without reordering user content

- keep interleaved GLMT tool_use blocks open until finalization instead of stopping early

- cover leading/interleaved tool_result regressions and interleaved streaming tool fragments
2026-04-20 13:17:30 -04:00
Grandis SYF a0f91761ed feat(glmt): fix sequential tool_use block handling 2026-04-20 13:06:00 -04:00
Tam Nhu Tran a3407093d7 refactor(proxy): internalize sse translation and cleanup handlers 2026-04-15 01:44:01 -04:00
Tam Nhu Tran 074e900557 feat(proxy): add openai-compatible local proxy runtime 2026-04-14 19:26:59 -04:00
Tam Nhu Tran 6c799b2e58 feat(logging): unify CCS runtime logs and dashboard viewer
- add a shared structured logging service with bounded retention

- expose native /api/logs endpoints and the dashboard /logs route

- wire focused runtime emitters, cleanup support, and feature tests

Refs #926
2026-04-08 15:57:15 -04:00
Tam Nhu Tran 5525098400 feat: deprecate GLMT user-facing surfaces 2026-03-17 15:49:29 -04:00
Tam Nhu Tran a35859aba5 fix(cursor): harden anthropic daemon contract handling 2026-03-17 07:17:35 -04:00
Tam Nhu Tran 3e26dee013 feat(glm): update default model to GLM-5 and fix all GLM pricing
- Update default GLM model from glm-4.7 to glm-5 across configs, presets, help text, and fallbacks
- Add glm-5 pricing entry ($1.00/$3.20 per M tokens, OpenRouter verified)
- Fix incorrect glm-4.7 pricing: $0.60/$2.20 -> $0.40/$1.50 (OpenRouter verified)
- Fix incorrect glm-4.6 pricing: $0.60/$2.20 -> $0.35/$1.50 (OpenRouter verified)
- Fix incorrect glm-4.5 pricing: $0.60/$2.20 -> $0.35/$1.55 (OpenRouter verified)
- Keep all previous GLM model entries for backward compatibility

Closes #532
2026-02-12 01:43:59 +07:00
kaitranntt 8c6afe2e73 feat: update cliproxy, config loader, glmt transformer, and provider routes 2026-02-10 10:45:16 -05:00
kaitranntt 73824bc99e fix(glmt): gate retry rate limit logs behind verbose flag
Rate limit retry messages now only appear when verbose mode is enabled,
keeping test output clean while preserving debug capability.
2026-02-03 21:09:18 -05:00
kaitranntt 62ac3e2ae9 fix(glmt): extract Retry-After from HTTP headers and cap maxRetries
- Extract Retry-After from actual HTTP response headers instead of parsing error messages
- Cap GLMT_MAX_RETRIES at 10 to prevent misconfiguration
- Prefer header-based Retry-After over message parsing (fallback preserved)

Addresses PR review feedback.
2026-01-30 08:14:10 -05:00
kaitranntt 67a8e2cefc fix(glmt): add env var validation and max delay cap
- Validate GLMT_MAX_RETRIES and GLMT_RETRY_BASE_DELAY for NaN/negative
- Add 30s max delay cap to prevent excessively long waits

Addresses PR review feedback.
2026-01-30 08:05:38 -05:00
kaitranntt 3afdcea379 feat(glmt): add rate limit resilience with exponential backoff retry
Add retry logic and connection pooling to GLMT proxy for handling Z.AI
429 rate limit errors gracefully.

Changes:
- Add RetryConfig with env vars (GLMT_MAX_RETRIES, GLMT_RETRY_BASE_DELAY, GLMT_DISABLE_RETRY)
- Add exponential backoff with jitter and Retry-After header support
- Add forwardWithRetry() and forwardAndStreamWithRetry() wrappers
- Add HTTPS connection pooling via shared https.Agent
- Add comprehensive unit tests (19 tests covering all scenarios)

Fixes: #402
2026-01-30 07:53:04 -05:00
kaitranntt 9b61f5318e fix(isolation): use getCcsDir() for test isolation
Replace os.homedir() with getCcsDir() in 11 source files to ensure
tests don't touch the user's real ~/.ccs/ directory. The getCcsDir()
function from config-manager.ts respects CCS_HOME env var for
test isolation.

Files fixed:
- src/auth/profile-detector.ts
- src/auth/profile-registry.ts
- src/delegation/headless-executor.ts
- src/delegation/session-manager.ts
- src/glmt/glmt-transformer.ts
- src/management/checks/config-check.ts
- src/management/checks/profile-check.ts
- src/management/checks/system-check.ts
- src/management/instance-manager.ts
- src/management/shared-manager.ts
- src/utils/update-checker.ts
2026-01-25 21:38:27 -05:00
kaitrannttandClaude bd343f3f02 fix(glmt): respect user-configured model instead of hardcoding glm-4.6
Root cause: execClaudeWithProxy() was ignoring ANTHROPIC_MODEL from
user settings and always using hardcoded 'glm-4.6'.

Changes:
- Read model from user's settings file in GLMT proxy flow
- Update default model to glm-4.7 in base configs (matches presets)
- Update fallback models in transformer/response-builder

Closes #358

Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-23 17:08:08 -05:00
kaitranntt cc2d62db38 fix(profiles): prevent GLM auth regression from first-time install detection
- Check legacy config.json/profiles.json in isFirstTimeInstall()
- Use expandPath() for cross-platform path handling in profile-detector
- Add pre-flight API key validation for better error messages
- Enhance 401 error handling with Z.AI refresh guidance

Fixes #195
2025-12-24 18:09:09 -05:00
kaitranntt 6372b3d303 refactor: add barrel exports to api/, glmt/, management/
- src/api/index.ts: re-export services module

- src/glmt/index.ts: export all GLMT transformers and pipeline

- src/management/index.ts: export doctor, managers, diagnostics, checks, repair
2025-12-19 16:01:22 -05:00
kaitranntt cd107e354c refactor(glmt): modularize transformer pipeline
- extract 7 pipeline modules (1122 → 206 lines)

- request-transformer, stream-parser, response-builder

- tool-call-handler, content-transformer

- shared types.ts for pipeline interfaces

Phase 3: Large Files Breakdown (glmt-transformer.ts)
2025-12-19 11:48:07 -05:00
kaitranntt 077a406df6 fix(glmt): add bearer prefix for openai-compatible endpoints
OpenAI-compatible endpoints like /chat/completions require Authorization header
with 'Bearer ' prefix. Previously the token was sent without prefix, causing
401 Unauthorized errors.

Auto-detects endpoint type based on URL path and formats header accordingly.

Fixes #61
2025-12-07 22:52:31 -05:00
Kai (Tam Nhu) Tranandsemantic-release-bot 7fc281fcec chore: promote beta to main (v5.2.0) (#32)
* fix(cliproxy): use double-dash flags for cliproxyapi auth (#24)

CLIProxyAPI updated from single-dash to double-dash CLI flags.
Changed -login to --login, -codex-login to --codex-login,
-antigravity-login to --antigravity-login, -config to --config,
and -no-browser to --no-browser.

* chore(release): 5.1.1-beta.1 [skip ci]

## [5.1.1-beta.1](https://github.com/kaitranntt/ccs/compare/v5.1.0...v5.1.1-beta.1) (2025-12-01)

### Bug Fixes

* **cliproxy:** use double-dash flags for cliproxyapi auth ([#24](https://github.com/kaitranntt/ccs/issues/24)) ([4c81f28](https://github.com/kaitranntt/ccs/commit/4c81f28f0b67ef92cf74d0f5c13a5943ff0a7f00))

* chore(release): 5.1.1-beta.2 [skip ci]

## [5.1.1-beta.2](https://github.com/kaitranntt/ccs/compare/v5.1.1-beta.1...v5.1.1-beta.2) (2025-12-01)

### Bug Fixes

* **cliproxy:** use double-dash flags for cliproxyapi auth ([9489884](https://github.com/kaitranntt/ccs/commit/94898848ea4533dcfc142e1b6c9bf939ba655537))

* fix(glmt): handle 401 errors and headers-already-sent exception (#30)

- add res.headersSent check before writing error headers
- write error as SSE event when headers already sent (streaming mode)
- add parseUpstreamError() for user-friendly error messages
- return proper HTTP status codes (401, 403, 429, 502, 504)
- clear auth error: check ANTHROPIC_AUTH_TOKEN in config

Fixes #26

* chore(release): 5.1.1-beta.3 [skip ci]

## [5.1.1-beta.3](https://github.com/kaitranntt/ccs/compare/v5.1.1-beta.2...v5.1.1-beta.3) (2025-12-01)

### Bug Fixes

* **glmt:** handle 401 errors and headers-already-sent exception ([#30](https://github.com/kaitranntt/ccs/issues/30)) ([c953382](https://github.com/kaitranntt/ccs/commit/c95338232a37981b95b785b47185ce18d6d94b7a)), closes [#26](https://github.com/kaitranntt/ccs/issues/26)

* chore(release): enable success comments and released labels in semantic-release

* feat(cliproxy): add qwen code oauth provider support (#31)

Add 'qwen' as new CLIProxy OAuth provider with --qwen-login flag.
Support qwen3-coder model with base config at config/base-qwen.settings.json.
Register qwen OAuth endpoints and token prefix handling.
Update help documentation across all CLI entry points.

Implements issue #29

* chore(release): 5.2.0-beta.1 [skip ci]

# [5.2.0-beta.1](https://github.com/kaitranntt/ccs/compare/v5.1.1-beta.3...v5.2.0-beta.1) (2025-12-01)

### Features

* **cliproxy:** add qwen code oauth provider support ([#31](https://github.com/kaitranntt/ccs/issues/31)) ([a3f1e52](https://github.com/kaitranntt/ccs/commit/a3f1e52ac68600ba0806d67aacceb6477ffa3543)), closes [#29](https://github.com/kaitranntt/ccs/issues/29)

* feat(cliproxy): auto-update cliproxyapi to latest release on startup

- add github api integration to fetch latest release version
- check for updates on every startup (cached for 1 hour)
- auto-download newer versions when available
- rename CLIPROXY_VERSION to CLIPROXY_FALLBACK_VERSION (safety net)
- add version tracking (.version file) and caching (.version-cache.json)
- non-blocking: startup continues if update check fails

* chore(release): 5.2.0-beta.2 [skip ci]

# [5.2.0-beta.2](https://github.com/kaitranntt/ccs/compare/v5.2.0-beta.1...v5.2.0-beta.2) (2025-12-01)

### Features

* **cliproxy:** auto-update cliproxyapi to latest release on startup ([8873ccd](https://github.com/kaitranntt/ccs/commit/8873ccd981679e8acff8965accdc22215c6e4aa2))

---------

Co-authored-by: semantic-release-bot <semantic-release-bot@martynus.net>
2025-12-01 04:11:14 -05:00
kaitranntt 7a413a81b7 refactor: enhance TypeScript types and improve delegation system 2025-11-27 09:25:12 -05:00
kaitranntt 0139333146 feat: set up quality gates for CCS TypeScript package
- Migrate package manager from npm to bun
- Add ESLint configuration with TypeScript support
- Add Prettier configuration and .prettierignore
- Format all TypeScript source files
- Update CLAUDE.md with bun instructions
- Verify 39 tests passing
2025-11-26 20:43:21 -05:00
kaitranntt 3cb52e6917 feat(glmt): convert GLMT system to TypeScript
- Add reasoning-enforcer.ts with 4 effort-level prompts
- Add glmt-transformer.ts (~1000 LOC) for Anthropic/OpenAI format conversion
- Add glmt-proxy.ts (~530 LOC) HTTP proxy with SSE streaming
- Extend delta-accumulator.ts with state getters/setters for streaming
- All 39 tests passing
2025-11-26 19:57:58 -05:00
kaitranntt 77d026869e fix(tsconfig): remove duplicate compiler options
- Remove duplicate allowSyntheticDefaultImports (lines 16 & 42)
- Remove duplicate skipLibCheck (lines 18 & 46)
- Add TypeScript source files for npm package migration
- Verify build pipeline works (42/42 tests pass)
2025-11-26 19:24:40 -05:00