- Extract generic shouldCacheQuotaResult replacing 4 identical functions
- Move parseTarget to route-helpers.ts (was duplicated in profile/variant routes)
- Add createRouteErrorHelpers factory (was duplicated in auth/settings routes)
- Fix config read-then-write race in proxy-routes.ts and misc-routes.ts
using mutateUnifiedConfig for atomic read-modify-write
- Replace raw error messages in 500 responses with generic messages +
server-side logging across all cliproxy-stats-routes handlers
- Convert extractErrorLogMetadata from sync fs to async fs.promises
- Fix X-Forwarded-For header spoofing in requireSensitiveLocalAccess (use socket-level address only)
- Add model ID length validation (max 256 chars) in PUT /models/:provider
- Add provider name validation (alphanumeric, max 64 chars) to prevent path traversal
- Add stale entry eviction for unbounded quotaRateLimits Map (>1000 entries)
- Fix concurrent refresh race in usage aggregator (wait for in-flight before forced refresh)
- Sanitize internal URLs/paths from OAuth failure diagnostics
- Add ValidationError class for denylist violations (distinct from system errors)
- Make CLIProxy sync interval configurable via CCS_CLIPROXY_SYNC_INTERVAL env var
- Improve legacy continuity config error logging (unconditional warn)
- Add CACHE_VERSION history comments
- share one full-refresh promise across usage loaders to avoid duplicate work
- sync CLIProxy snapshot before source refresh and start sync lazily
- make refresh handler execute full refresh with proper error response
- reset pending cache state and guard sync interval double-start
- prevent km continuity mappings from affecting kimi cliproxy executions
- apply canonical alias fallback only for settings profile lookups
- add regression test for cross-type alias isolation
- resolve mappings with alias/canonical profile candidates
- fail open when source account initialization errors
- remove metadata touch side effects from inheritance preflight
Add unified analytics tracking for all CLIProxy-routed providers
(Gemini/Droid, Codex, OpenCode, Antigravity, Qwen) alongside
existing Claude JSONL data.
- New transformer converts CLIProxy usage API response to
DailyUsage/HourlyUsage/MonthlyUsage types
- New syncer periodically fetches CLIProxy data (5min interval)
and persists snapshots to ~/.ccs/cache/cliproxy-usage/
- Aggregator treats CLIProxy as 3rd data source alongside
default Claude config and CCS instances
- Charts automatically show multi-provider data in unified view
- Graceful degradation when CLIProxy is unavailable
- replace sync fs calls in compatible CLI JSON helper with fs.promises
- make droid diagnostics/raw-settings service + routes async
- update unit tests for async save/read paths
- add shared backend JSON file probe/write utilities for compatible CLI settings
- add shared frontend raw JSON editor panel and wire Droid page to it
- support PUT save flow with validation and mtime conflict handling
- replace ~/.config/factory/config.json diagnostics with legacy ~/.factory/config.json
- keep ~/.factory/settings.json as the primary BYOK source in UI + API payload
- update droid dashboard tests and frontend typings for legacyConfig
- add /droid route under a new Compatible CLIs sidebar section
- expose /api/droid/diagnostics and /api/droid/settings/raw for install and BYOK visibility
- include read-only settings.json viewer plus model/provider breakdown
- add unit coverage for droid dashboard service parsing and path logic
Tam Nhu Tran