- add lock-held mutateUnifiedConfig read-modify-write path for config.yaml
- use atomic mutation in /api/settings/auth/antigravity-risk to prevent stale overwrites
- replace browser confirm with in-app 2-step banner + typed phrase validation
- verify saved AGY power-user value with post-save read before showing success
Refs #509
- add safer error responses for settings/auth routes to avoid leaking internals
- guard sensitive AGY settings endpoints to localhost when dashboard auth is off
- validate start-route bodies and reject OAuth start in remote mode for consistency
- preserve cliproxy.kiro_no_incognito and token_refresh during config merges
- enforce AGY acknowledgement in remote auth-token run/auth command paths
Handle shared skills and agents when entries are symlinked directories.
Also avoid classifying root markdown files in skills/agents as commands.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Address review feedback from PR #585:
- Add missing kimi-k2 pricing entry ($0.60/$2.50, cache $0.15)
to avoid fallback to unknown model pricing
- Add kimi provider tests to model-catalog.test.js verifying
catalog structure, default model, and model IDs
- Add kimi entry to UI model-catalogs.ts with K2.5, K2 Thinking, K2
models and preset mappings so dashboard shows available models
- Add kimi to CHANNEL_TO_PROVIDER and SYNCABLE_PROVIDERS in
catalog-cache.ts so models sync from upstream CLIProxyAPI
- Add kimi/moonshot to provider-editor ownerMap for model filtering
- Update Kimi model pricing to match official Kimi Platform rates:
kimi-k2.5 ($0.60/$3.00), kimi-k2-thinking ($0.60/$2.50),
kimi-k2-turbo-preview ($1.15/$8.00)
- Add missing kimi-k2.5 pricing entry
Closes#581
- unify CLIPROXY_SUPPORTED_PROVIDERS to import from CLIPROXY_PROVIDER_IDS
- replace 4 inline union types with CLIProxyProvider import
- replace hardcoded provider arrays in migration-manager and proxy-routes
- remove duplicate PROVIDER_DISPLAY_NAMES, use getProviderDisplayName()
- sync test now imports from ui/src/lib/provider-config instead of hardcoded array
Adding a new CLIProxy provider no longer requires updating 14+ hardcoded lists.
Implement target adapter pattern enabling CCS CLI to support multiple backend targets
(Claude, Droid) via pluggable adapters. Core additions:
- TargetAdapter interface for pluggable target implementations
- ClaudeAdapter and DroidAdapter concrete implementations
- Target registry (singleton Map-based storage)
- Target resolver with precedence: --target flag > per-profile config > busybox detection
- Droid config manager with atomic writes and file locking to ~/.factory/settings.json
- Droid binary detector to validate runtime environment
- Adapter dispatch integrated into ccs.ts main execution flow
- ccsd busybox alias for seamless Droid invocation
- --target flag documentation in help
- Session tracking enriched with target metadata
- Dashboard target badge for visual identification
Testing:
- 43 unit tests covering resolver, registry, config manager, and adapters
- Full coverage of target detection logic and edge cases
Documentation:
- Refactored system-architecture.md into modular docs/system-architecture/ subdirectory
- Updated code-standards.md with target adapter guidelines
- Updated codebase-summary.md with architecture overview
- Updated maintainability baseline (33.8% → 35.2%)
This establishes extensible foundation for multi-target support without breaking
existing Claude workflows. Droid adapter is production-ready but defaults to Claude
for backward compatibility.
- add cursor model fields to unified config defaults and YAML comments
- expand Cursor model catalog/defaults and return configured current model
- keep cursor.settings.json env model fields in sync with config updates
- align unit tests for new model defaults and route merge behavior
Refs #555
- require model when changing single-variant provider to avoid mixed config
- rewrite provider-specific core env when provider changes while preserving custom fields
- preserve custom composite settings path and return persisted composite PUT state
- P1: Thinking "off" now fully disables all tier thinking
When thinkingValue === 'off' AND no per-tier config, return early
Preserves behavior for "off" with per-tier config (skips main, processes tiers)
Fixes regression where tier defaults were applied despite explicit off setting
- P2: Handle composite-create thrown errors in POST route
Wrap createCompositeVariant() in try/catch
Returns 400 instead of generic 500 when function throws (e.g., legacy mode)
- Add requireAllTiers parameter to validateCompositeTiers (default false)
- POST/create passes true to enforce all 3 tiers required
- PUT/update passes false (default) to allow partial updates
- Guard against null tier values that would throw at runtime
P1 (Critical): Remote composite execution now correctly uses remote endpoint
- Reorder condition to check useRemoteProxy before isComposite
- Composite variants now work with remote CLIProxy instances
P2a (Medium): Tier deep-merge preserves optional fields during updates
- Use spread merge instead of ?? to preserve fallback/thinking/account
P2b (Medium): API accepts partial tier updates in PUT endpoint
- Skip validation for tiers not present in request
- Aligns with updateCompositeVariant's merge behavior
- Validate fallback doesn't point to same provider+model (circular)
- Reject empty/whitespace model strings in composite tiers
- Add TODO comment for concurrent modification race condition
- Allow partial composite updates in PUT endpoint (|| -> &&)
- Map service validation errors to 400 status, not 404
- Widen 4xx regex to cover full 400-499 range
Tam Nhu Tran