Commit Graph
1256 Commits
Author SHA1 Message Date
github-actions[bot] cafb849b0b chore(release): 7.19.2-dev.5 [skip ci] 2026-01-14 15:32:37 +00:00
kaitranntt 7cfd3c1f9d fix(ci): add full CLIProxy env vars for AI review
- Use /api/provider/agy endpoint for proper model routing
- Set ANTHROPIC_DEFAULT_*_MODEL to route Haiku/Sonnet/Opus correctly
- Disable telemetry, error reporting, bug command
- Set max output/thinking tokens
2026-01-14 10:31:37 -05:00
github-actions[bot] 2af9c31643 chore(release): 7.19.2-dev.4 [skip ci] 2026-01-14 15:07:42 +00:00
Kai (Tam Nhu) TranandGitHub 397331ec89 fix(persist): harden security and edge case handling (#328)
Security fixes:
- Add fs.chmodSync(backupPath, 0o600) after backup creation
- Add symlink detection (isSymlink helper) before all file operations
- Reject symlinks in write, backup, and restore operations

Edge case fixes:
- Handle empty settings.json (0 bytes) gracefully
- Validate parsed JSON is object type (not array/primitive)
- Validate backup JSON integrity before restore
- Show backup path guidance on write failure
- Validate existing env is object before spread

Maintenance:
- Add backup rotation (keep last 10, MAX_BACKUPS constant)
- Add cleanupOldBackups() function

Addresses security findings from PR #312 code review.
2026-01-14 10:06:44 -05:00
kaitranntt e7dca480d3 fix(ci): add Write tool to allowedTools for PR comment posting
Root cause: Claude's allowedTools pattern matching is literal string
matching. Multiline content in --body breaks the `Bash(gh pr comment *)`
pattern. The Bash(cat *) pattern only matches reading, not writing with
redirection.

Changes:
- Add Write tool to allowedTools (enables temp file creation)
- Remove Bash(cat *) (not needed, Write replaces it)
- Update prompt to require Write + --body-file pattern
- Explicitly warn against inline --body with multiline content

Tested locally: Successfully posted comment using Write + --body-file
2026-01-14 10:06:05 -05:00
github-actions[bot] c2a16a253e chore(release): 7.19.2-dev.3 [skip ci] 2026-01-14 14:30:53 +00:00
kaitrannttandLeynier Gutiérrez González 3ac687ec9f feat(persist): add backup management for settings.json (#312)
Add `--list-backups` and `--restore` options to the ccs persist command
for backup management. Enables users to list and restore settings.json
backups. Updated CLAUDE.md to document persist command.

Resolves #248

Co-authored-by: Leynier Gutiérrez González <leynier41@gmail.com>
2026-01-14 09:29:32 -05:00
Leynier Gutiérrez Gonzálezandkaitranntt ef7e595b6f feat(persist): add --list-backups and --restore options for backup management
Add backup management functionality to the persist command:
- List available backups with timestamps and dates
- Restore from most recent or specific backup
- Improved error handling for corrupted settings.json
- Updated CLAUDE.md to document the persist command and the exception to the non-invasive constraint
2026-01-14 09:27:48 -05:00
github-actions[bot] 3b4c29ddcb chore(release): 7.19.2-dev.2 [skip ci] 2026-01-14 13:35:51 +00:00
SergeyandGitHub db58c6bbca fix(ui): use wss:// for WebSocket on HTTPS pages (#315) 2026-01-14 08:34:53 -05:00
github-actions[bot] 8daabdde5c chore(release): 7.19.2-dev.1 [skip ci] 2026-01-13 21:46:25 +00:00
Kai (Tam Nhu) TranandGitHub 4a1679d747 Merge pull request #327 from kaitranntt/feat/login-auth
feat(dashboard): add optional login authentication with CLI setup (#319)
2026-01-13 16:45:27 -05:00
github-actions[bot] fffcd7aa0e chore(sync): merge main into dev after release [skip ci] 2026-01-13 21:45:08 +00:00
semantic-release-bot cb32e913d2 chore(release): 7.19.2 [skip ci]
## [7.19.2](https://github.com/kaitranntt/ccs/compare/v7.19.1...v7.19.2) (2026-01-13)

### Bug Fixes

* **ci:** expand allowedTools patterns for flexible comment posting ([0a27c6a](https://github.com/kaitranntt/ccs/commit/0a27c6a12f53dd050dc8104ce8d82e2cb4bcef3f))
2026-01-13 21:44:41 +00:00
kaitranntt 0a27c6a12f fix(ci): expand allowedTools patterns for flexible comment posting
Add Bash(echo *) and Bash(cat *) patterns to allow heredocs and pipes.
This gives the AI reviewer flexibility to use any method for posting
multi-line review comments while remaining safe (shell-operator aware).
2026-01-13 16:43:39 -05:00
github-actions[bot] a4437491ed chore(sync): merge main into dev after release [skip ci] 2026-01-13 21:39:14 +00:00
semantic-release-bot e0776df0e6 chore(release): 7.19.1 [skip ci]
## [7.19.1](https://github.com/kaitranntt/ccs/compare/v7.19.0...v7.19.1) (2026-01-13)

### Bug Fixes

* **ci:** update allowedTools pattern to prevent token waste on retries ([edec6f6](https://github.com/kaitranntt/ccs/commit/edec6f6df242a092545a3c7ffd2856aad4f3f2af))
2026-01-13 21:38:50 +00:00
kaitranntt edec6f6df2 fix(ci): update allowedTools pattern to prevent token waste on retries
Changed pattern from `Bash(gh pr comment:*)` to `Bash(gh pr comment *)`
to match space-separated args. Updated prompt to discourage heredocs
and pipes which don't match the pattern, causing 6+ retry attempts.
2026-01-13 16:37:43 -05:00
kaitranntt a3a167e62a fix(auth): add security hardening per code review
- Add timing-safe username comparison to prevent timing attacks
- Regenerate session on login to prevent session fixation
- Add warning log when session secret persistence fails
2026-01-13 16:23:10 -05:00
github-actions[bot] 60488c262d chore(sync): merge main into dev after release [skip ci]
# Conflicts:
#	package.json
2026-01-13 21:23:02 +00:00
semantic-release-bot c514a8bc75 chore(release): 7.19.0 [skip ci]
## [7.19.0](https://github.com/kaitranntt/ccs/compare/v7.18.3...v7.19.0) (2026-01-13)

### Features

* **doctor:** add --help flag with comprehensive command documentation ([22c7d4a](https://github.com/kaitranntt/ccs/commit/22c7d4a20d96d12a2c38ec60d226a6bc26dce9b0))

### Bug Fixes

* **ci:** prevent AI review self-cancellation with smart concurrency ([25d31ce](https://github.com/kaitranntt/ccs/commit/25d31ce4329daf9512df4e0236e02d89d05b0842))
* **ci:** trigger AI review on follow-up commits to PR ([a2a13fb](https://github.com/kaitranntt/ccs/commit/a2a13fb16ec3d655a817e548a5cb72a21c6c774e))
2026-01-13 21:22:36 +00:00
github-actions[bot] 1d2dcbf1f6 chore(release): 7.18.3-dev.3 [skip ci] 2026-01-13 21:04:12 +00:00
kaitranntt 25d31ce432 fix(ci): prevent AI review self-cancellation with smart concurrency
Root cause: When the bot posts a review comment, GitHub fires an
issue_comment event that joins the same concurrency group and cancels
the in-progress run BEFORE job `if` conditions are evaluated.

Solution: Non-actionable triggers (bot comments, comments without
/review) get a unique per-run group via format('skip-{0}', github.run_id),
while legitimate triggers share the PR-based group for proper
cancellation of outdated reviews.
2026-01-13 16:03:02 -05:00
github-actions[bot] 865870ba4c chore(release): 7.18.3-dev.2 [skip ci] 2026-01-13 20:53:31 +00:00
kaitranntt a2a13fb16e fix(ci): trigger AI review on follow-up commits to PR
- Add `synchronize` event to trigger on new commits pushed to PR
- Add `reopened` event to trigger when PR is reopened
- Update documentation comments to reflect new behavior
- Keep cancel-in-progress to prevent stale reviews

Fixes issue where AI review only ran on PR creation, requiring
manual /review comment for subsequent commits.
2026-01-13 15:52:18 -05:00
kaitranntt 39c1ee2ca0 feat(config): add ccs config auth CLI subcommand
Interactive CLI for managing dashboard authentication:
- ccs config auth setup: Interactive wizard with bcrypt password hashing
- ccs config auth show: Display current auth status and ENV overrides
- ccs config auth disable: Disable auth with confirmation

Follows modular facade pattern from auth-commands.ts.
Uses InteractivePrompt for masked password input.
Includes local documentation at docs/dashboard-auth-cli.md.

Related: #319
2026-01-13 15:13:10 -05:00
kaitranntt 37e3468d4d fix(auth): move redirect to useEffect and validate bcrypt hash format
- Fix React side effect: move navigate() to useEffect in LoginPage
- Remove misplaced express-rate-limit from ui/package.json
- Add bcrypt hash format validation before bcrypt.compare
2026-01-13 14:43:55 -05:00
kaitranntt 759d43c8f7 Merge remote-tracking branch 'origin/dev' into feat/login-auth 2026-01-13 14:31:01 -05:00
github-actions[bot] 097b018532 chore(release): 7.18.3-dev.1 [skip ci] 2026-01-13 19:22:20 +00:00
Kai (Tam Nhu) TranandGitHub 8fb822f873 Merge pull request #320 from kaitranntt/feat/doctor-help-command
feat(doctor): add --help flag with comprehensive command documentation
2026-01-13 14:21:23 -05:00
github-actions[bot] aaa8f88662 chore(sync): merge main into dev after release [skip ci]
# Conflicts:
#	package.json
2026-01-13 19:02:01 +00:00
semantic-release-bot 75609221b1 chore(release): 7.18.3 [skip ci]
## [7.18.3](https://github.com/kaitranntt/ccs/compare/v7.18.2...v7.18.3) (2026-01-13)

### Bug Fixes

* **ci:** simplify AI review workflow by disabling progress tracking ([4ef2d48](https://github.com/kaitranntt/ccs/commit/4ef2d4848cf12d197ba1f8cd5dac66b55c82c8be))
* **ci:** simplify AI review workflow by disabling progress tracking ([#323](https://github.com/kaitranntt/ccs/issues/323)) ([39b37ca](https://github.com/kaitranntt/ccs/commit/39b37caa892f8b723f003c8ed0c6d8f2fe96d799))
2026-01-13 19:01:33 +00:00
github-actions[bot] dfe0e2d5ba chore(release): 7.18.2-dev.1 [skip ci] 2026-01-13 19:01:15 +00:00
Kai (Tam Nhu) TranandGitHub 39b37caa89 fix(ci): simplify AI review workflow by disabling progress tracking (#323)
fix(ci): simplify AI review workflow by disabling progress tracking
2026-01-13 14:00:31 -05:00
kaitranntt 4ef2d4848c fix(ci): simplify AI review workflow by disabling progress tracking
Root cause of cancellations was track_progress posting comments that
triggered new workflow runs. Instead of complex concurrency isolation,
simply disable progress tracking.

Changes:
- track_progress: false (no intermediate comments)
- Simple concurrency: ai-review-<PR_NUMBER>
- Removed extra bot filters (no longer needed)

Result: Clean PRs with just the final review comment.
2026-01-13 14:00:14 -05:00
github-actions[bot] 9e0ba102a5 chore(sync): merge main into dev after release [skip ci]
# Conflicts:
#	package.json
2026-01-13 18:51:11 +00:00
semantic-release-bot 7355360e8c chore(release): 7.18.2 [skip ci]
## [7.18.2](https://github.com/kaitranntt/ccs/compare/v7.18.1...v7.18.2) (2026-01-13)

### Bug Fixes

* **ci:** isolate concurrency groups by comment author ([3163509](https://github.com/kaitranntt/ccs/commit/316350905233d776968f53732974a77997513f24))
* **ci:** isolate concurrency groups by comment author ([#322](https://github.com/kaitranntt/ccs/issues/322)) ([1d33012](https://github.com/kaitranntt/ccs/commit/1d33012b4e5ad02bac63f9b559f64c3efdf26044))
2026-01-13 18:50:44 +00:00
github-actions[bot] c122754dd1 chore(release): 7.18.1-dev.1 [skip ci] 2026-01-13 18:50:17 +00:00
Kai (Tam Nhu) TranandGitHub 1d33012b4e fix(ci): isolate concurrency groups by comment author (#322)
fix(ci): isolate concurrency groups by comment author
2026-01-13 13:49:42 -05:00
kaitranntt 3163509052 fix(ci): isolate concurrency groups by comment author
Previous fix was incomplete - both human /review comments and bot
progress comments were issue_comment events sharing the same
concurrency group.

Now includes comment author in concurrency group:
- Human: ai-review-issue_comment-kaitranntt-320
- Bot: ai-review-issue_comment-ccs-agy-reviewer[bot]-320
- PR/dispatch: ai-review-<event>-system-320

This completely isolates bot activity from human-triggered reviews.
2026-01-13 13:49:20 -05:00
semantic-release-bot a6346dc393 chore(release): 7.18.1 [skip ci]
## [7.18.1](https://github.com/kaitranntt/ccs/compare/v7.18.0...v7.18.1) (2026-01-13)

### Bug Fixes

* **ci:** add explicit instruction to post review as PR comment ([85f6bc0](https://github.com/kaitranntt/ccs/commit/85f6bc07d44f54673163ad4fed6045a37ccabad0))
* **ci:** exclude bot comments from triggering AI review ([ce70617](https://github.com/kaitranntt/ccs/commit/ce70617ee94645399ba05af581240a696ca9cfed))
* **ci:** prevent self-cancelling AI review workflow ([120aca4](https://github.com/kaitranntt/ccs/commit/120aca466d646ee1c770b2712a0d2742d5dd62d6))
* **ci:** prevent self-cancelling AI review workflow ([#321](https://github.com/kaitranntt/ccs/issues/321)) ([fa1899f](https://github.com/kaitranntt/ccs/commit/fa1899f4611d570b2a8bf5e1a5342d5392466263))
* **delegation:** improve profile discovery and CI workflow ([#310](https://github.com/kaitranntt/ccs/issues/310)) ([affdaea](https://github.com/kaitranntt/ccs/commit/affdaead80c3635f49ef562cac81bde8db0cab23))
* **delegation:** only check profiles defined in config.yaml ([0075248](https://github.com/kaitranntt/ccs/commit/0075248273e2d4912c4e277deebd6e668c5b3466))
* **doctor:** use dynamic profile discovery for delegation check ([f88ad8e](https://github.com/kaitranntt/ccs/commit/f88ad8e78198302f68ee0b420075d704ab01d8ff))
* **ui:** improve sidebar navigation for collapsible menu items ([12b68f9](https://github.com/kaitranntt/ccs/commit/12b68f9f136c3529ac976eaec9e8903b43185e89))
* **ui:** improve sidebar navigation for collapsible menu items ([#313](https://github.com/kaitranntt/ccs/issues/313)) ([e2e2ecd](https://github.com/kaitranntt/ccs/commit/e2e2ecda3c1948fb90f9b47b1e31782ef30cc31f))
2026-01-13 18:45:15 +00:00
Kai (Tam Nhu) TranandGitHub fa1899f461 fix(ci): prevent self-cancelling AI review workflow (#321)
fix(ci): prevent self-cancelling AI review workflow
2026-01-13 13:44:08 -05:00
github-actions[bot] 28f3206a20 chore(release): 7.18.0-dev.6 [skip ci] 2026-01-13 18:42:48 +00:00
kaitranntt 120aca466d fix(ci): prevent self-cancelling AI review workflow
Root cause: Bot progress comments triggered issue_comment events,
which created new workflow runs with the same concurrency group,
causing cancel-in-progress to kill the original review.

Fixes:
1. Add event_name to concurrency group (prevents cross-event cancellation)
2. Explicit filter for ccs-agy-reviewer[bot] comments (belt-and-suspenders)

Closes race condition causing 25+ cancelled AI review runs.
2026-01-13 13:41:30 -05:00
kaitranntt 805ff64a7e Merge remote-tracking branch 'origin/main' into dev 2026-01-13 13:40:08 -05:00
kaitranntt 464b410e8b feat(dashboard): add optional login authentication (#319)
Add session-based username/password auth for CCS dashboard:
- Backend: Express session middleware with bcrypt password verification
- Frontend: React AuthContext, login page, protected routes
- Config: dashboard_auth section in config.yaml + env var overrides
- Security: Rate limiting (5 attempts/15min), persistent session secret
- 16 unit tests for auth middleware

Auth disabled by default for backward compatibility.
2026-01-13 13:27:38 -05:00
kaitranntt 22c7d4a20d feat(doctor): add --help flag with comprehensive command documentation
- Add showHelp() with usage, options, checks, examples, exit codes
- Update handleDoctorCommand to accept args array instead of boolean
- Update ccs.ts to pass restArgs to doctor command
- Add doctor to CLAUDE.md Help Location Reference table
2026-01-13 11:43:27 -05:00
Kai (Tam Nhu) TranGitHubgithub-actions[bot] <github-actions[bot]@users.noreply.github.com>
e2e2ecda3c fix(ui): improve sidebar navigation for collapsible menu items (#313)
* fix(doctor): use dynamic profile discovery for delegation check

Replace hardcoded ['glm', 'kimi'] list with DelegationValidator.getReadyProfiles()
to detect all configured *.settings.json profiles including mm, or1, g7, etc.

* fix(ci): exclude bot comments from triggering AI review

Bot progress comments were triggering new workflow runs,
which cancelled in-progress reviews due to concurrency group.
Added check for github.event.comment.user.type != 'Bot'.

* chore(release): 7.18.0-dev.1 [skip ci]

* fix(delegation): only check profiles defined in config.yaml

Previously getReadyProfiles() scanned all *.settings.json files,
including orphan files (ghcp, kiro) not in config.yaml.

Now reads from config.yaml:
- profiles section (excluding 'default')
- cliproxy.providers section

Fixes doctor showing 11 profiles instead of configured 9.

* chore(release): 7.18.0-dev.3 [skip ci]

* fix(ui): improve sidebar navigation for collapsible menu items

- CLIProxy Plus click now navigates to Overview AND opens submenu
- Parent menu item highlights when any child route is active
- Provides consistent visual hierarchy across all collapsible menus

* chore(release): 7.18.0-dev.4 [skip ci]

* fix(ci): add explicit instruction to post review as PR comment

The AI reviewer was completing the review but not posting it because
the prompt didn't explicitly instruct it to use gh pr comment.

* chore(release): 7.18.0-dev.5 [skip ci]

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-01-11 15:24:35 -05:00
github-actions[bot] dcc5c5d4ed chore(release): 7.18.0-dev.5 [skip ci] 2026-01-11 20:21:51 +00:00
kaitranntt 85f6bc07d4 fix(ci): add explicit instruction to post review as PR comment
The AI reviewer was completing the review but not posting it because
the prompt didn't explicitly instruct it to use gh pr comment.
2026-01-11 15:20:46 -05:00