tiennm99/ccs
1
0 Fork 0
mirror of https://github.com/tiennm99/ccs.git synced 2026-10-13 00:14:15 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,284 Commits 1 Branch 0 Tags
bc02ecc94c5120bb0a4491fd9f88c71fb9f26b7f
Commit Graph
1284 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
kaitranntt bc02ecc94c fix(dashboard): harden projectId handling with edge case fixes 
- Validate empty string projectId with typeof check and trim()
- Include projectId in registerAccount return value
- Update projectId when changed (not just when missing)
- Add aria-hidden/aria-label for accessibility
- Add max-width + truncate for long projectId overflow
 2026-01-15 11:46:02 -05:00
kaitranntt 36367d49f0 fix(dashboard): update projectId for existing accounts during discovery 
Previously, discoverExistingAccounts skipped existing token files
entirely, so accounts created before the projectId feature never
got their projectId populated from auth files.

Now when a token file is already registered, we still check if
projectId needs to be updated for agy accounts.
 2026-01-15 11:22:40 -05:00
kaitranntt ed2ce138e4 feat(dashboard): add project_id display for Antigravity accounts 
Display GCP project_id for Antigravity (agy) accounts in the Dashboard:

- Add projectId field to AccountInfo interface (account-manager.ts)
- Read project_id from auth files when discovering/registering accounts
- Pass projectId through token-manager when registering new accounts
- Add projectId to OAuthAccount type (api-client.ts)
- Add projectId to AccountRow type (auth-monitor/types.ts)
- Display project_id in account-item.tsx with FolderCode icon
- Show N/A warning with amber tooltip if project_id is missing
  suggesting user remove and re-add account to fetch it

Note: project_id is read-only and respects privacy mode blur.
 2026-01-15 10:49:23 -05:00
semantic-release-bot 3de894784f chore(release): 7.21.0 [skip ci] 
## [7.21.0](https://github.com/kaitranntt/ccs/compare/v7.20.1...v7.21.0) (2026-01-14)

### Features

* **dashboard:** implement full parity UX improvements ([bd5e9d2](https://github.com/kaitranntt/ccs/commit/bd5e9d2b78b7348443770de3f4e5848390ff34fd))

### Bug Fixes

* **dashboard:** address code review feedback for PR [#336](https://github.com/kaitranntt/ccs/issues/336) ([e808972](https://github.com/kaitranntt/ccs/commit/e808972df0e3ce1987bb3b5a346add3e6d592b56))
* **dashboard:** resolve 6 critical security and UX edge cases ([623a314](https://github.com/kaitranntt/ccs/commit/623a3146d775b9666218343a0dc39434b77dd24d))
* **dashboard:** resolve edge cases in backup restore and settings UI ([2e45447](https://github.com/kaitranntt/ccs/commit/2e45447bb7c6bb48337076871d78a152bfb79880))
* **persist:** add rate limiting, tests, and code quality improvements ([7b80dcc](https://github.com/kaitranntt/ccs/commit/7b80dccdd312fc6651ce03524699a30b8310c998)), closes [#339](https://github.com/kaitranntt/ccs/issues/339)

### Documentation

* update minimax preset references to 'mm' ([eee62a4](https://github.com/kaitranntt/ccs/commit/eee62a46a23f925e7ee891ef0c0ee5ca2271a462))
 2026-01-14 23:10:15 +00:00
Kai (Tam Nhu) Tran d662f43447 Merge pull request #339 from kaitranntt/dev 
feat(release): v7.21 - dashboard UX parity, login auth, backup management
 2026-01-14 18:09:11 -05:00
github-actions[bot] 64a46d298b chore(release): 7.20.1-dev.3 [skip ci] 2026-01-14 23:00:38 +00:00
kaitranntt 7b80dccdd3 fix(persist): add rate limiting, tests, and code quality improvements 
- Add express-rate-limit to restore endpoint (5 req/min)
- Add JSDoc documentation to RestoreMutex class
- Extract magic numbers to named constants in BackupsSection
- Add unit tests for persist-routes.ts (23 tests)
- Add unit tests for BackupsSection component (28 tests)

Addresses PR #339 code review feedback.
 2026-01-14 17:59:15 -05:00
github-actions[bot] a63373fd6a chore(release): 7.20.1-dev.2 [skip ci] 2026-01-14 22:45:10 +00:00
kaitranntt eee62a46a2 docs: update minimax preset references to 'mm' 
Align README and CLI help with actual preset ID.
 2026-01-14 17:43:52 -05:00
github-actions[bot] 2626ee99ea chore(release): 7.20.1-dev.1 [skip ci] 2026-01-14 22:37:54 +00:00
Kai (Tam Nhu) Tran 812447e3f0 Merge pull request #336 from kaitranntt/kai/feat/dashboard-ux-parity 
feat(dashboard): implement full UX parity with edge case fixes
 2026-01-14 17:36:55 -05:00
kaitranntt e808972df0 fix(dashboard): address code review feedback for PR #336 
- Fix documentation: config.yaml -> settings.json in backups-section
- Wrap restoreBackup in useCallback for callback stability
- Auth middleware verified: inherited from app.use(authMiddleware)
 2026-01-14 16:51:56 -05:00
kaitranntt 623a3146d7 fix(dashboard): resolve 6 critical security and UX edge cases 
- TOCTOU symlink attack: use file descriptor for atomic read in persist-routes
- Non-atomic mutex: add RestoreMutex class with Promise queue pattern
- Restore confirmation: add AlertDialog before destructive backup restore
- Sensitive data exposure: sanitize auth_token/management_key in debug console
- Chunk retry: add lazyWithRetry wrapper with exponential backoff (3 retries)
- URL tab case sensitivity: normalize tab param with toLowerCase()
 2026-01-14 16:47:11 -05:00
kaitranntt 2e45447bb7 fix(dashboard): resolve edge cases in backup restore and settings UI 
Backend:
- Add atomic restore with mutex to prevent concurrent corruption
- Implement rollback on failure for backup restore
- Add symlink security validation

Frontend:
- Add 'backups' tab to URL validation in settings hook
- Add error boundary for lazy-loaded settings sections
- Clamp progress bar values to prevent visual bugs
- Add AbortController cleanup to prevent memory leaks
- Fix misleading debug mode description and add actual console logging
 2026-01-14 15:42:12 -05:00
kaitranntt bd5e9d2b78 feat(dashboard): implement full parity UX improvements 
- Remove 'agy' hardcode from quota hook (multi-provider support)
- Add quota N/A badge with AlertCircle icon for fetch failures
- Add new 'backups' tab to Settings page with Archive icon
- Create BackupsSection component with list/restore UI
- Add persist backend routes (GET /api/persist/backups, POST /api/persist/restore)
- Add debug mode toggle in Settings proxy section (localStorage persisted)

Closes documentation gap for persist command dashboard parity.
 2026-01-14 13:52:54 -05:00
semantic-release-bot 01fe780514 chore(release): 7.20.1 [skip ci] 
## [7.20.1](https://github.com/kaitranntt/ccs/compare/v7.20.0...v7.20.1) (2026-01-14)

### Bug Fixes

* **ci:** expand ai-review allowedTools to prevent token waste ([ac7b324](https://github.com/kaitranntt/ccs/commit/ac7b324d4989883c7a8e92030891e51bfc040cc3))
* **cliproxy:** address PR review feedback ([04c9b08](https://github.com/kaitranntt/ccs/commit/04c9b087ca3466c4b2871a777906f87b19566d3c))
* **cliproxy:** return null for unknown quota, add verbose diagnostics ([1ac1941](https://github.com/kaitranntt/ccs/commit/1ac19415ce835df15f3fcefbb698f12ec89ec5e9))
* **deps:** add express-rate-limit to production dependencies ([d9631be](https://github.com/kaitranntt/ccs/commit/d9631be81a018d9e007f241bcb6b928664cc6991)), closes [#333](https://github.com/kaitranntt/ccs/issues/333)
 2026-01-14 18:39:17 +00:00
Kai (Tam Nhu) Tran bc1b1b6799 Merge pull request #335 from kaitranntt/dev 
feat(release): v7.20.1 - quota diagnostics and ai-review improvements
 2026-01-14 13:38:10 -05:00
github-actions[bot] bb9549cb22 chore(release): 7.20.0-dev.3 [skip ci] 2026-01-14 18:32:34 +00:00
kaitranntt ac7b324d49 fix(ci): expand ai-review allowedTools to prevent token waste 
- Add more allowed bash patterns: gh issue view, gh api, git commands
- Add base tools: Edit, LS for better flexibility
- Update prompt to write pr_review.md in working dir (not /tmp/)
- Add step to Read before Write to avoid security block
- Add explicit rules about avoiding shell operators (||, &&, <<)
- Allow rm pr_review.md for cleanup

Previous run had 9 tool rejections wasting ~5000 tokens due to:
- gh issue view not allowed (only gh pr view was)
- /tmp/ outside working directory
- Write without Read blocked
- Complex shell operators blocked
 2026-01-14 13:31:18 -05:00
github-actions[bot] 43aaa6dbf4 chore(release): 7.20.0-dev.2 [skip ci] 2026-01-14 18:12:00 +00:00
Kai (Tam Nhu) Tran 3ea1ea3064 Merge pull request #334 from kaitranntt/kai/fix/missing-express-rate-limit 
fix(deps): add express-rate-limit to production dependencies
 2026-01-14 13:10:58 -05:00
kaitranntt d9631be81a fix(deps): add express-rate-limit to production dependencies 
express-rate-limit was imported in auth-middleware.ts but only the
@types/express-rate-limit package was declared in devDependencies.
This caused "Cannot find module 'express-rate-limit'" error when
running `ccs config` after installing v7.20.0 globally.

Closes #333
 2026-01-14 13:06:58 -05:00
github-actions[bot] b740816dd9 chore(release): 7.20.0-dev.1 [skip ci] 2026-01-14 16:39:33 +00:00
Kai (Tam Nhu) Tran cc83b596fb Merge pull request #331 from kaitranntt/fix/quota-fix 
fix(cliproxy): return null for unknown quota, add verbose diagnostics
 2026-01-14 11:38:31 -05:00
kaitranntt 04c9b087ca fix(cliproxy): address PR review feedback 
- Pass verbose flag through fetchQuotaWithDedup to fetchAccountQuota
- Change verbose logging from console.log to console.error (stderr)
- Keep quotaPercent optional (semantically correct for cases without quota)
 2026-01-14 10:49:47 -05:00
semantic-release-bot 8e115a2a20 chore(release): 7.20.0 [skip ci] 
## [7.20.0](https://github.com/kaitranntt/ccs/compare/v7.19.2...v7.20.0) (2026-01-14)

### Features

* **config:** add ccs config auth CLI subcommand ([39c1ee2](https://github.com/kaitranntt/ccs/commit/39c1ee2ca0f01a1254812a4a8fe8f6c2ed052fe0)), closes [#319](https://github.com/kaitranntt/ccs/issues/319)
* **dashboard:** add optional login authentication ([#319](https://github.com/kaitranntt/ccs/issues/319)) ([464b410](https://github.com/kaitranntt/ccs/commit/464b410e8b3e017689ce7de6b6fc06b3f04c7fdd))
* **persist:** add --list-backups and --restore options for backup management ([ef7e595](https://github.com/kaitranntt/ccs/commit/ef7e595b6fa4c96ac88e2e98f992fd05f7525e2e))
* **persist:** add backup management for settings.json ([#312](https://github.com/kaitranntt/ccs/issues/312)) ([3ac687e](https://github.com/kaitranntt/ccs/commit/3ac687ec9fab6ad4ce11bd3af6af5c596958a5e2)), closes [#248](https://github.com/kaitranntt/ccs/issues/248)

### Bug Fixes

* **auth:** add security hardening per code review ([a3a167e](https://github.com/kaitranntt/ccs/commit/a3a167e62aaa555c71379e91a9dfd0b7f5ddf145))
* **auth:** move redirect to useEffect and validate bcrypt hash format ([37e3468](https://github.com/kaitranntt/ccs/commit/37e3468d4dece26d35ef6b5ad9683312473e1ca9))
* **ci:** add full CLIProxy env vars for AI review ([7cfd3c1](https://github.com/kaitranntt/ccs/commit/7cfd3c1f9dbd387d4fc6388382727222bd8475bd))
* **ci:** add Write tool to allowedTools for PR comment posting ([e7dca48](https://github.com/kaitranntt/ccs/commit/e7dca480d313b2227638a3e8a53554b3d28d2c8e))
* **persist:** harden security and edge case handling ([#328](https://github.com/kaitranntt/ccs/issues/328)) ([397331e](https://github.com/kaitranntt/ccs/commit/397331ec8995b261e0b6916874d59947ede0a88f)), closes [#312](https://github.com/kaitranntt/ccs/issues/312)
* **ui:** use wss:// for WebSocket on HTTPS pages ([#315](https://github.com/kaitranntt/ccs/issues/315)) ([db58c6b](https://github.com/kaitranntt/ccs/commit/db58c6bbcabdb1edc1748212ad0b85af682ac597))
 2026-01-14 15:35:23 +00:00
Kai (Tam Nhu) Tran 2faa837777 Merge pull request #329 from kaitranntt/dev 
feat(release): v7.20.0 - persist command and dashboard auth
 2026-01-14 10:34:23 -05:00
github-actions[bot] cafb849b0b chore(release): 7.19.2-dev.5 [skip ci] 2026-01-14 15:32:37 +00:00
kaitranntt 7cfd3c1f9d fix(ci): add full CLIProxy env vars for AI review 
- Use /api/provider/agy endpoint for proper model routing
- Set ANTHROPIC_DEFAULT_*_MODEL to route Haiku/Sonnet/Opus correctly
- Disable telemetry, error reporting, bug command
- Set max output/thinking tokens
 2026-01-14 10:31:37 -05:00
kaitranntt 1ac19415ce fix(cliproxy): return null for unknown quota, add verbose diagnostics 
- Change calculateAverageQuota() to return null instead of 100 when no model data
- Update callers to use null coalescing (?? 0) for health check thresholds
- Display "N/A (fetch unavailable)" for null quota values
- Add --verbose flag to quota-related functions for troubleshooting
- Add debug logging: token refresh status, API response, errors
 2026-01-14 10:19:27 -05:00
github-actions[bot] 2af9c31643 chore(release): 7.19.2-dev.4 [skip ci] 2026-01-14 15:07:42 +00:00
Kai (Tam Nhu) Tran 397331ec89 fix(persist): harden security and edge case handling (#328) 
Security fixes:
- Add fs.chmodSync(backupPath, 0o600) after backup creation
- Add symlink detection (isSymlink helper) before all file operations
- Reject symlinks in write, backup, and restore operations

Edge case fixes:
- Handle empty settings.json (0 bytes) gracefully
- Validate parsed JSON is object type (not array/primitive)
- Validate backup JSON integrity before restore
- Show backup path guidance on write failure
- Validate existing env is object before spread

Maintenance:
- Add backup rotation (keep last 10, MAX_BACKUPS constant)
- Add cleanupOldBackups() function

Addresses security findings from PR #312 code review.
 2026-01-14 10:06:44 -05:00
kaitranntt e7dca480d3 fix(ci): add Write tool to allowedTools for PR comment posting 
Root cause: Claude's allowedTools pattern matching is literal string
matching. Multiline content in --body breaks the `Bash(gh pr comment *)`
pattern. The Bash(cat *) pattern only matches reading, not writing with
redirection.

Changes:
- Add Write tool to allowedTools (enables temp file creation)
- Remove Bash(cat *) (not needed, Write replaces it)
- Update prompt to require Write + --body-file pattern
- Explicitly warn against inline --body with multiline content

Tested locally: Successfully posted comment using Write + --body-file
 2026-01-14 10:06:05 -05:00
github-actions[bot] c2a16a253e chore(release): 7.19.2-dev.3 [skip ci] 2026-01-14 14:30:53 +00:00
kaitrannttandLeynier Gutiérrez González 3ac687ec9f feat(persist): add backup management for settings.json (#312) 
Add `--list-backups` and `--restore` options to the ccs persist command
for backup management. Enables users to list and restore settings.json
backups. Updated CLAUDE.md to document persist command.

Resolves #248

Co-authored-by: Leynier Gutiérrez González <leynier41@gmail.com>
 2026-01-14 09:29:32 -05:00
Leynier Gutiérrez González ef7e595b6f feat(persist): add --list-backups and --restore options for backup management 
Add backup management functionality to the persist command:
- List available backups with timestamps and dates
- Restore from most recent or specific backup
- Improved error handling for corrupted settings.json
- Updated CLAUDE.md to document the persist command and the exception to the non-invasive constraint
 2026-01-14 09:27:48 -05:00
github-actions[bot] 3b4c29ddcb chore(release): 7.19.2-dev.2 [skip ci] 2026-01-14 13:35:51 +00:00
Sergey db58c6bbca fix(ui): use wss:// for WebSocket on HTTPS pages (#315) 2026-01-14 08:34:53 -05:00
github-actions[bot] 8daabdde5c chore(release): 7.19.2-dev.1 [skip ci] 2026-01-13 21:46:25 +00:00
Kai (Tam Nhu) Tran 4a1679d747 Merge pull request #327 from kaitranntt/feat/login-auth 
feat(dashboard): add optional login authentication with CLI setup (#319)
 2026-01-13 16:45:27 -05:00
github-actions[bot] fffcd7aa0e chore(sync): merge main into dev after release [skip ci] 2026-01-13 21:45:08 +00:00
semantic-release-bot cb32e913d2 chore(release): 7.19.2 [skip ci] 
## [7.19.2](https://github.com/kaitranntt/ccs/compare/v7.19.1...v7.19.2) (2026-01-13)

### Bug Fixes

* **ci:** expand allowedTools patterns for flexible comment posting ([0a27c6a](https://github.com/kaitranntt/ccs/commit/0a27c6a12f53dd050dc8104ce8d82e2cb4bcef3f))
 2026-01-13 21:44:41 +00:00
kaitranntt 0a27c6a12f fix(ci): expand allowedTools patterns for flexible comment posting 
Add Bash(echo *) and Bash(cat *) patterns to allow heredocs and pipes.
This gives the AI reviewer flexibility to use any method for posting
multi-line review comments while remaining safe (shell-operator aware).
 2026-01-13 16:43:39 -05:00
github-actions[bot] a4437491ed chore(sync): merge main into dev after release [skip ci] 2026-01-13 21:39:14 +00:00
semantic-release-bot e0776df0e6 chore(release): 7.19.1 [skip ci] 
## [7.19.1](https://github.com/kaitranntt/ccs/compare/v7.19.0...v7.19.1) (2026-01-13)

### Bug Fixes

* **ci:** update allowedTools pattern to prevent token waste on retries ([edec6f6](https://github.com/kaitranntt/ccs/commit/edec6f6df242a092545a3c7ffd2856aad4f3f2af))
 2026-01-13 21:38:50 +00:00
kaitranntt edec6f6df2 fix(ci): update allowedTools pattern to prevent token waste on retries 
Changed pattern from `Bash(gh pr comment:*)` to `Bash(gh pr comment *)`
to match space-separated args. Updated prompt to discourage heredocs
and pipes which don't match the pattern, causing 6+ retry attempts.
 2026-01-13 16:37:43 -05:00
kaitranntt a3a167e62a fix(auth): add security hardening per code review 
- Add timing-safe username comparison to prevent timing attacks
- Regenerate session on login to prevent session fixation
- Add warning log when session secret persistence fails
 2026-01-13 16:23:10 -05:00
github-actions[bot] 60488c262d chore(sync): merge main into dev after release [skip ci] 
# Conflicts:
#	package.json
 2026-01-13 21:23:02 +00:00
semantic-release-bot c514a8bc75 chore(release): 7.19.0 [skip ci] 
## [7.19.0](https://github.com/kaitranntt/ccs/compare/v7.18.3...v7.19.0) (2026-01-13)

### Features

* **doctor:** add --help flag with comprehensive command documentation ([22c7d4a](https://github.com/kaitranntt/ccs/commit/22c7d4a20d96d12a2c38ec60d226a6bc26dce9b0))

### Bug Fixes

* **ci:** prevent AI review self-cancellation with smart concurrency ([25d31ce](https://github.com/kaitranntt/ccs/commit/25d31ce4329daf9512df4e0236e02d89d05b0842))
* **ci:** trigger AI review on follow-up commits to PR ([a2a13fb](https://github.com/kaitranntt/ccs/commit/a2a13fb16ec3d655a817e548a5cb72a21c6c774e))
 2026-01-13 21:22:36 +00:00
github-actions[bot] 1d2dcbf1f6 chore(release): 7.18.3-dev.3 [skip ci] 2026-01-13 21:04:12 +00:00