Commit Graph
159 Commits
Author SHA1 Message Date
Kai (Tam Nhu) TranandGitHub 107b5b5db4 fix(docker): apply red-team findings — drop :full, rc.1 soak, healthcheck, signing (#1251) (#1262)
* docs(quickstart): fix raw URL for corporate-proxy fallback (H1)

* feat(docker)!: drop :full image variant — use sibling containers on ccs-net (Q3)

No AI CLIs (claude-code/gemini-cli/grok-cli/opencode) are bundled in the image.
Use sibling containers attached to ccs-net instead.
See docker/README.md#connect-your-app-to-cliproxy.

Also removes bash from apk deps (entrypoint uses #!/bin/sh — L2).

ci(docker): publish only immutable :<ver> tag pre-smoke; promote-mutable-tags
job adds :latest/:MAJOR/:MINOR aliases only after smoke tests pass (H3)

ci(docker): smoke-test-compose-url runs network-contract.sh against the
downloaded /tmp/ccs-compose.yaml instead of re-cloning the repo (H4)

ci(docker): sign published images with cosign keyless OIDC + attach
provenance/SBOM via build-push-action (M8)

test(docker): network-contract.sh now accepts compose-file and image-ref
positional args; replaces python3 healthcheck parser with jq (L4)

* chore(release): cut every main release as rc.N prerelease, manual promote flow (H2)

- .releaserc.cjs: main branch now uses prerelease 'rc' channel — every
  semantic-release cut becomes vX.Y.Z-rc.N
- add promote-release.yml: workflow_dispatch flips rc → stable via
  'gh release edit --prerelease=false'; triggers docker promote-mutable-tags
- add docs/release-process.md: full soak + promote procedure, rollback steps,
  cosign verification command
- releaseNotesGenerator: add revert section, document chore hidden behaviour (L8)

* fix(docker): healthcheck probes both dashboard and cliproxy ports (M1)

compose.yaml healthcheck now checks :3000 and :8317 concurrently with
a 4.5s internal timeout, within Docker's 5s timeout budget.

Also:
- docs(docker): document npm lockfile ephemeral tradeoff above install
  layer; note size-budget regression test as the practical safeguard (M3)
- docs(docker): drop :full row from Choosing an image table; add sibling
  container note pointing to connect-your-app-to-cliproxy (Q3/docs)
- docs(docker): remove :full docker run block; fix release-tag sentence (Q3)
- docs(docker): fix raw URL in migration section (H1 parity)
- docs(docker): add Volume warning — 'down -v' deletes named volumes (L13)
- docs(docker): update What changes table — remove :full reference (Q3)
- docs(docker): add Image Signatures and SBOM section with cosign verify
  and sbom download commands (M8/docs)
- changelog: add Unreleased entries for rc soak, cosign signing, :full
  removal with migration guidance

* ci(docker): assert image-size budget per platform; add compose parity + breaking-change guard (M6/L9/L12)

- image-size.sh: add --platform flag; uses 'docker buildx imagetools
  inspect' to sum compressed layer sizes from registry manifest for
  linux/amd64 and linux/arm64 separately (M6)
- docker-release.yml smoke-test: runs size check for both platforms
- compose-parity.sh: diffs docker/compose.yaml vs
  docker/docker-compose.integrated.yml for image name, ports 3000/8317,
  volume mounts /root/.ccs and /var/log/ccs, ccs-net definition (L12)
- ci.yml: add compose-parity job wired to cliproxy runner (L12)
- breaking-change-guard.yml: fails PR if compose.yaml changes image name,
  network name, or container_name without a feat!/fix! commit (L9)

* chore(ci): fix cosign shell substitution — use tr instead of bash @L expansion (L6/nit)

* test(docker): fix compose-parity port regex for variable-interpolated host ports
2026-05-16 13:33:12 -04:00
Kai (Tam Nhu) TranandGitHub b50c2db3ce docs(docker): P3 — hoist two-command quickstart, restructure docker/README, add parity CI (#1260)
* docs: hoist Docker zero-install quickstart above npm install path

- Create docs/quickstart-snippet.md as canonical source for the
  two-command flow (curl + docker compose up -d), wrapped in
  <!-- quickstart-snippet-start/end --> markers
- Hoist the snippet into README.md immediately below the deprecation
  banner, above all other install paths
- Rename old npm-only "## Quick Start" to "## Install on Host (npm)"
  and move it below the Docker quickstart

* docs(docker): restructure README with zero-install first and migration section

- Reorder top-level sections: zero-install (canonical snippet with
  markers), choosing an image, power-user ccs docker, prebuilt image,
  connect your app to CLIProxy, migration, env vars, troubleshooting
- Add deprecation banner at the top pointing at the migration section
- Add ## Migration from ccs-dashboard:latest section with step-by-step
  instructions covering compose down, data preservation, named volume
  vs bind-mount path, and compose up with the new image
- Keep P1's Choosing an image table and P5's Connect Your App to
  CLIProxy section intact, just repositioned

* test(docs): parity check for quickstart snippet across README files

Assert README.md and docker/README.md both contain the canonical
quickstart block verbatim, anchored by marker comments. Exits non-zero
and prints a diff on any drift.

* ci(docs): wire quickstart-parity test on push and PR

Runs tests/docs/quickstart-parity.sh on self-hosted runner whenever
docs/quickstart-snippet.md, README.md, docker/README.md, or the
test/workflow files themselves change. Fails fast on snippet drift.
2026-05-16 12:56:09 -04:00
Kai (Tam Nhu) TranandGitHub 28f08cbb50 docs(docker): document ccs-net contract for sibling containers (#1259)
Add "Connect your app to CLIProxy" section to docker/README.md with:
- Public contract table (network=ccs-net, service DNS=ccs, ports 8317/3000)
- Pattern A: same compose file with external network reference
- Pattern B: docker run --network ccs-net
- Troubleshooting subsection (DNS, missing network, conflict, Podman, MTU)

Add one-line link in README.md pointing to the new section.
Add CHANGELOG entry under Unreleased noting the contract as SemVer-major stable.
Add CONTRIBUTING.md note that changing services.ccs or networks.ccs-net requires major bump.
2026-05-16 12:46:33 -04:00
Kai (Tam Nhu) TranandGitHub d558cd2e36 feat(docker): publish ccs:latest + ccs:full integrated images (P1 of #1251) (#1257)
* feat(docker): parameterize Dockerfile.integrated with ARG FLAVOR=minimal|full

Add FLAVOR build arg that gates the AI CLI install layer (claude-code,
gemini-cli, grok-cli, opencode) so one Dockerfile produces both the
minimal (< 350 MB) and full (< 600 MB) integrated images.

Use BuildKit cache mount for /root/.npm to speed up repeated builds.
Part of #1251 (P1 — publish integrated images).

* feat(docker): emit startup deprecation warning in legacy ccs-dashboard entrypoint

Prepend a [WARN] line to stderr on every container start so operators
running ghcr.io/kaitranntt/ccs-dashboard:latest are notified to migrate
to ghcr.io/kaitranntt/ccs:latest. Sunset window: 2 releases. See #1251.

* test(docker): add image-size.sh budget assertion + unit test suite

image-size.sh: asserts docker image inspect .Size against a byte budget.
  Usage: image-size.sh <image:tag> <max-bytes>
  Budgets: minimal=350 MB (367001600), full=600 MB (629145600)

image-size-logic.test.sh: 6 mock-docker unit tests covering pass/fail
boundaries, bad arg count, and non-integer input. All 6 pass locally.
Part of #1251 (P1).

* ci(docker): extend docker-release.yml to publish ccs:latest and ccs:full

- Add publish-integrated job with matrix flavor: [minimal, full]
  - minimal -> ghcr.io/kaitranntt/ccs:<ver> + :latest (when promoted)
  - full    -> ghcr.io/kaitranntt/ccs:full-<ver> + :full (when promoted)
  - Multi-arch: linux/amd64 + linux/arm64 via buildx
  - Scoped GHA cache per flavor to avoid cross-contamination

- Add promote_to_latest workflow_dispatch input (default false)
  - rc.1 soak: first publish only pushes immutable version tag
  - Mutable :latest/:full promoted only on release event OR explicit opt-in

- Add smoke-test job (post-publish) for each flavor
  - Pulls the just-published version tag
  - Asserts image size via tests/docker/image-size.sh
  - Boots container, waits for healthcheck, probes :3000 and :8317

- Keep publish-dashboard job unchanged (legacy 2-release sunset)
  - Updated labels to note deprecation status

All jobs run on self-hosted cliproxy runners. Part of #1251 (P1).

* docs(docker): document new image tags, add ccs-dashboard deprecation notices

docker/README.md:
- Add "Choosing an image" table (ccs:latest / ccs:full / ccs-dashboard deprecated)
- Update Quick Start section to use ccs:latest as primary example
- Add legacy image note with sunset timeline

CHANGELOG.md:
- Add Unreleased > ### Deprecated entry for ccs-dashboard:latest
  pointing to migration path and #1251

README.md:
- Add one-line deprecation banner near top routing users to ccs:latest

Part of #1251 (P1).
2026-05-16 12:33:42 -04:00
Kai (Tam Nhu) TranandGitHub 19a50a8dd8 feat: deprecate GitHub Copilot compatibility surfaces (#1196) 2026-05-07 13:06:03 -04:00
Kai (Tam Nhu) TranandGitHub 923683bf30 feat(cliproxy): route plus dashboard to maintained fork (#1173) 2026-05-03 13:01:04 -04:00
Tam Nhu Tran 3d22bb07f0 fix(cliproxy): route plus backend to maintained fork 2026-04-23 21:25:29 -04:00
Tam Nhu Tran 5af639ddf7 fix(ci): tighten slow bucket guardrails 2026-04-22 15:54:07 -04:00
Tam Nhu Tran ddfbcb63f4 docs(contrib): align local gate shortcuts 2026-04-22 15:12:24 -04:00
Tam Nhu Tran c9eaae17c1 docs(contrib): clarify CI lanes and parity gates 2026-04-22 15:07:12 -04:00
Tam Nhu Tran 4e30c9b080 feat(cli): add browser automation commands 2026-04-16 18:49:24 -04:00
Tam Nhu Tran 17187c4abd feat(proxy): complete openai routing scope 2026-04-15 00:55:11 -04:00
Tam Nhu Tran b346693c3a docs(proxy): credit claude-code-router 2026-04-15 00:01:38 -04:00
Tam Nhu Tran 7b64852495 docs(proxy): document openai-compatible routing 2026-04-14 19:27:38 -04:00
Tam Nhu Tran 6393249111 feat(cliproxy): add routing guidance and strategy controls 2026-04-07 18:17:06 -04:00
Tam Nhu Tran 217e71f9f8 docs(readme): preserve opencode contributor guidance
- add an OpenCode sync guide link to the README docs matrix

- keep the community project attribution intact

- document that contributor community integrations should move

  into docs pages instead of being dropped
2026-04-05 01:18:01 -04:00
Tam Nhu Tran 0e37033f33 docs(readme): broaden CCS runtime positioning
- reframe README and internal docs around CCS as a multi-provider,

  multi-runtime manager

- preserve protected README sections and add guidance to avoid

  Gemini and Antigravity as generic hero examples

- update architecture and product docs to use Codex- and

  Droid-oriented examples in generic flows
2026-04-04 21:41:45 -04:00
Tam Nhu Tran dc56e55f52 docs: add community projects section and fix header link
- Add Community Projects table above Three Pillars to shoutout
  @JasonLandbridge's opencode-ccs-sync plugin
- Change "Features & Pricing" to "Features" (no pricing exists)
2026-04-04 17:03:24 -04:00
Tam Nhu Tran 2830c2ae9e feat(auth): add resume lane diagnostics and recovery
- add runtime-aware resume lane diagnostics and auth backup flows

- warn when account resume uses a different plain ccs continuity lane

- surface lane mismatch guidance in the accounts dashboard, docs, and tests
2026-04-04 12:17:32 -04:00
Kai (Tam Nhu) TranandGitHub 6e2dba8bfc Merge pull request #891 from kaitranntt/kai/fix/855-cursor-dual-mode-runtime-dev-refresh
fix(cursor): make Cursor a first-class runtime profile and harden integration
2026-04-03 00:03:45 -04:00
Tam Nhu Tran 6d1c895721 docs(image-analysis): document managed runtime flow 2026-04-02 15:44:13 -04:00
Tam Nhu Tran 2d67f40175 fix(cursor): route bare cursor through runtime profile 2026-04-01 22:50:58 -04:00
Tam Nhu Tran d7b907ed9f fix(cursor): make bare cursor command useful and harden tool-result translation 2026-04-01 22:50:58 -04:00
Tam Nhu Tran 982ffc5895 feat(image): add native-read controls and autosave settings
- add per-profile native image preferences and native-capability detection
- redesign Settings -> Image around compact sections with Web-style autosave
- expose richer backend/profile status and update Gemini Flash defaults
2026-04-01 15:32:37 -04:00
Tam Nhu Tran d394772f7c fix(image-analysis): preview backend status safely 2026-04-01 15:32:37 -04:00
Tam Nhu Tran d40cc60a1d docs(readme): document image-analysis backend visibility 2026-04-01 15:32:37 -04:00
Tam Nhu Tran cae5b710b8 fix(websearch): close review gaps in managed runtime 2026-03-30 23:02:20 -04:00
Tam Nhu Tran de7171d810 feat(websearch): finish managed third-party rollout
- steer third-party launches toward the managed WebSearch MCP tool

- add opt-in trace diagnostics across launch, MCP, provider, and headless paths

- extend docs and regression coverage for the first-class runtime

Refs #862
2026-03-30 22:41:51 -04:00
Tam Nhu Tran e260df7178 feat: add first-class CCS WebSearch runtime 2026-03-30 16:10:39 -04:00
Tam Nhu Tran 318b57bedc docs(codex): clarify ccsxp and cliproxy setup 2026-03-29 19:43:46 -04:00
Tam Nhu Tran ca981847b2 docs(codex): document control center behavior
- describe the split-view Codex dashboard and guided config surfaces

- document raw-editor guardrails, trust path rules, and reset-to-default support

- refresh related architecture and docs cross-links
2026-03-29 13:14:15 -04:00
Tam Nhu Tran 8c5da9f9e8 feat: add codex dashboard parity 2026-03-29 13:14:15 -04:00
Tam Nhu Tran da4bb29fd7 docs(codex): document runtime target support
- document the ccs-codex and ccsx runtime aliases

- capture the supported v1 matrix and bridge behavior for native Codex runs

Refs #773
2026-03-29 13:14:15 -04:00
Tam Nhu Tran 6c7d215ecc feat(websearch): add real provider chain 2026-03-23 15:26:05 -04:00
Tam Nhu Tran 1f667b5953 fix: harden droid runtime alias resolution 2026-03-23 14:15:30 -04:00
Tam Nhu Tran 160be319d0 feat: add explicit droid runtime alias surface 2026-03-23 13:44:32 -04:00
Tam Nhu Tran bdb7ac2937 feat(cliproxy): allow optional provider nicknames
- stop requiring manual unique nicknames for no-email providers by default

- preserve explicit nickname validation and same-account reauth semantics

- persist optional nicknames through dashboard manual callback flows
2026-03-23 11:02:08 -04:00
Kai (Tam Nhu) TranandGitHub 185f7f469e docs(repo): add security reporting and issue routing (#769) 2026-03-23 09:51:33 -04:00
Tam Nhu Tran 50c55bb108 feat(cliproxy): add dedicated ai providers workspace 2026-03-19 11:55:02 -04:00
Tam Nhu Tran 7d87cfa448 docs(cliproxy): document api profile bridge flow
- explain the new CLIProxy to API Profiles bridge in README

- record issue #649 in roadmap and PDR updates

Refs #649
2026-03-19 10:24:34 -04:00
Tam Nhu Tran 9a44f53c15 docs(readme): highlight hosted docs hub 2026-03-17 15:42:30 -04:00
Tam Nhu Tran dcc67477ec fix: align dashboard host warnings with effective bind 2026-03-17 09:58:11 -04:00
Tam Nhu Tran 553f8ac1e5 feat: add dashboard host binding option 2026-03-17 09:57:51 -04:00
Kai (Tam Nhu) TranandGitHub 4f0b9ce261 Merge pull request #723 from Alex-wuhu/novita-integration
feat: add Novita AI provider preset
2026-03-17 08:23:51 -04:00
Tam Nhu Tran 94fa96aa81 fix: correct novita preset endpoint and asset handling 2026-03-17 07:02:47 -04:00
Kai (Tam Nhu) TranandGitHub 3c7c8d5573 Merge pull request #726 from Kherrisan/main
feat: add support for setting the global fetch proxy through HTTP_PROXY
2026-03-16 07:20:48 -04:00
Tam Nhu Tran f50c9625de fix: harden global fetch proxy handling 2026-03-16 06:58:01 -04:00
Tam Nhu Tran 56db6035f5 docs(readme): document Claude IDE extension setup 2026-03-15 15:58:37 -04:00
Kai (Tam Nhu) TranandGitHub f6100a5588 Merge pull request #718 from kaitranntt/kai/fix/702-raptor-mini-copilot-model-guardrails
fix: normalize stale copilot raptor-mini model
2026-03-15 15:01:31 -04:00
Tam Nhu Tran 298b591d14 docs(readme): clarify copilot config save behavior 2026-03-15 14:53:54 -04:00