cc-switch

Merge remote-tracking branch 'origin/main' into feat/usage-dashboard-refinement

Jason · 2026-04-15 11:36:52 +08:00

e1292a82cd

Merge branch 'main' into feat/usage-dashboard-refinement

Resolve conflicts in usage dashboard components:

- RequestLogTable.tsx: keep PR's new `range: UsageRangeSelection` API
  (replaces the old timeMode/rollingWindowSeconds mechanism), while
  preserving main's advanced pagination (ellipsis pages + jump input)
  and page-reset effect. Removed obsolete handleRefresh and datetime
  converters that are no longer needed under the new range API.

- UsageDashboard.tsx: keep PR's redesigned filter panel with calendar
  picker and preset buttons. Drop the stale `timeRange={timeRange}`
  prop that was auto-preserved from main but references a variable
  that no longer exists in the PR's design.

Jason · 2026-04-15 11:33:24 +08:00

0c4226a271

fix(proxy): strip hop-by-hop response headers per RFC 7230 (#2060 )

Dex Miller · 2026-04-15 11:28:56 +08:00

ef41e4da46

fix(opencode): use json5 parser for trailing comma tolerance (#2023 )

* fix(opencode): use json5 parser for trailing comma tolerance

OpenCode CLI writes opencode.json with trailing commas (valid JSONC),
but CC Switch parsed it with serde_json (strict JSON), causing errors
like 'trailing comma at line 35 column 3'.

Switch to json5::from_str which accepts both JSON and JSONC. The json5
crate is already a project dependency. Change error type from
AppError::json() to AppError::Config() since json5::Error differs from
serde_json::Error.

* style(opencode): apply rustfmt to satisfy cargo fmt --check

The previous commit's .map_err(...) chain exceeded rustfmt's default
100-char max_width, breaking CI's `cargo fmt --check`. Let rustfmt
wrap the closure body as a multi-line block. No behavior change.

---------

Co-authored-by: 18067889926 <ming.flute@outlook.com>
Co-authored-by: Jason <farion1231@gmail.com>

wwminger · 2026-04-15 11:11:48 +08:00

78198e262b

fix: remove unused mut to pass clippy -D warnings

Jason · 2026-04-15 09:16:22 +08:00

79eb773195

fix: preserve env vars when saving Google Official Gemini provider (#2087 )

write_gemini_live() unconditionally cleared env_map for GoogleOfficial
auth type, discarding user-configured env vars (e.g. GEMINI_MODEL).
Remove the env_map.clear() call so the user's settings_config.env is
written as-is, and merge identical Packycode/Generic match arms.

Jason · 2026-04-15 09:05:45 +08:00

6092a87b40

feat: classify stream check errors with color-coded toasts

Distinguish between "provider rejects probe" (yellow warning) and
"genuinely broken" (red error) in health check results.

Backend: add AppError::HttpStatus variant to carry structured HTTP
status codes, populate http_status on error results, classify codes
into short labels (e.g. "Auth rejected (401)"), and truncate overly
long response bodies.

Frontend: route 401/403/400/429/5xx to toast.warning with localized
hints explaining the error may not indicate actual unusability; route
404/402/connection errors to toast.error. Add i18n keys for all three
locales (zh/en/ja).

Also deduplicate check_once by reusing build_stream_check_result.

Jason · 2026-04-14 17:11:13 +08:00

689ca08409

fix: handle root-level skill repos during installation

When a repo itself is a single skill (SKILL.md at repo root), the
discovery phase sets directory to the repo name, but after ZIP
extraction (which strips the root folder), no matching subdirectory
exists. Add a fallback to check if SKILL.md exists directly in the
extracted temp directory before reporting SKILL_DIR_NOT_FOUND.

Fixes installation of repos like zlbigger/Google-SEOs.skill.

Jason · 2026-04-14 15:56:31 +08:00

04508801ef

refactor: remove per-provider proxy config feature

The per-provider proxy configuration (meta.proxyConfig) is removed
because its scope is too narrow and covered by global proxy settings
and proxy takeover mode. Users can achieve the same result via the
global proxy panel.

Changes:
- Remove ProviderProxyConfig type (frontend TS + backend Rust)
- Remove ProviderAdvancedConfig proxy UI block, keep testConfig/pricingConfig
- Simplify http_client: delete build_proxy_url_from_config,
  build_client_for_provider, get_for_provider
- Simplify forwarder/stream_check/model_fetch to use global client
- Remove i18n keys (en/zh/ja)
- Fix pre-existing test bug in transform.rs (extra None arg)

Jason · 2026-04-14 14:26:55 +08:00

4a0b5c3dec

fix(clippy): remove redundant closure in session ID parsing

Replace `|uid| parse_session_from_user_id(uid)` with direct
function reference to satisfy clippy::redundant_closure.

Jason · 2026-04-14 10:34:58 +08:00

d13a8d7353

fix(proxy): reduce unnecessary Copilot premium interaction consumption

- Fix request classification: treat messages containing tool_result as
  agent continuation instead of user-initiated, preventing false premium
  charges on every tool call
- Add subagent detection via __SUBAGENT_MARKER__ and metadata._agent_
  fallback, setting x-interaction-type=conversation-subagent
- Add deterministic x-interaction-id derived from session ID to group
  requests into a single billing interaction
- Add orphan tool_result sanitization to prevent upstream API errors
  that could cause retries and duplicate billing
- Reorder pipeline: classify (on original body) → sanitize → merge →
  warmup, ensuring classification sees raw tool_result semantics
- Enable warmup downgrade by default with gpt-5-mini model
- Enhance session ID extraction priority chain for Copilot cache keys
- Detect infinite whitespace bug in streaming tool call arguments

Jason · 2026-04-14 10:34:58 +08:00

0739b60341

fix(usage): remove unnecessary private IP restrictions from usage script

SSRF protection (private IP blocking, suspicious hostname detection) was
originally added for web-server threat models but is unnecessary for a
local desktop app where the user already has full network access. This
removal unblocks legitimate use cases like enterprise intranet APIs,
Docker container addresses, and self-hosted services.

Retained: HTTPS enforcement and same-origin checks which still provide
meaningful security (protecting API keys in transit and preventing
scripts from leaking keys to unrelated domains).

Jason · 2026-04-14 10:33:41 +08:00

c01338ac33

fix(sessions): strip OpenClaw message_id suffix and allow 2-line titles

OpenClaw gateway injects `[message_id: UUID]` metadata at the end of
every message, wasting display space. Strip this suffix from both title
and summary fields.

Also change session title display from single-line truncate to
line-clamp-2, so longer titles (e.g. OpenClaw's timestamp-prefixed
messages) can show more meaningful content across two lines.

Jason · 2026-04-14 10:33:41 +08:00

420f4c8c23

feat(sessions): extract meaningful titles for Codex and OpenClaw sessions

Previously Codex and OpenClaw sessions only showed the working directory
basename as the title, making it hard to distinguish sessions in the same
project. Now both providers extract the first real user message as the
session title, matching the existing Claude Code behavior.

- Codex: first user message → dir basename (skips AGENTS.md injection)
- OpenClaw: displayName (sessions.json) → first user message → dir basename
- Move TITLE_MAX_CHARS constant to shared utils.rs
- Use Option<&HashMap> for OpenClaw parse_session to avoid leaky abstraction

Jason · 2026-04-14 10:33:41 +08:00

ed269cc20e

fix(usage): deduplicate proxy and session log usage records

Extract message_id from Claude API responses (msg_xxx) and use it to
generate a shared request_id format (session:{msg_xxx}) between the
proxy logger and session log sync. When session sync encounters the
same request_id via INSERT OR IGNORE, it skips the duplicate.

- Add message_id field to TokenUsage, extracted from Claude responses
- Add TokenUsage::dedup_request_id() to generate shared request IDs
- Define SESSION_REQUEST_ID_PREFIX constant to eliminate magic strings
- Change proxy logger to INSERT OR REPLACE for richer-data-wins semantics

Jason · 2026-04-14 10:33:41 +08:00

8669b408e9

feat(pricing): add ~50 new model pricing entries and fix outdated prices

Add pricing data for 4 new providers (Qwen, xAI Grok, Mistral, Cohere)
and supplement existing providers (MiniMax M2.5/M2.7, GLM-5/5.1,
Doubao Seed 2.0, MiMo V2 Pro, OpenAI o1/o3/codex-mini/gpt-5-mini/nano).

Fix outdated prices for deepseek-chat, deepseek-reasoner, and kimi-k2.5.
Fix display_name casing "Mimo" → "MiMo" for consistency.

Use prepared statement in seed_model_pricing() to avoid recompiling SQL
on each of ~130 INSERT iterations.

Schema migration v8→v9: DELETE + re-seed model_pricing for existing users.

Jason · 2026-04-14 10:33:41 +08:00

bb7c83c214

feat: block official provider switching during proxy takeover

Prevent users from switching to official providers (Anthropic/OpenAI/Google)
when proxy takeover is active, as using a proxy with official APIs may cause
account bans.

Defense-in-depth across 4 layers:
- Backend: ProviderService::switch(), hot_switch_provider(), switch_proxy_provider command
- Frontend: useProviderActions soft guard with error toast
- UI: ProviderActions button disabled with ShieldAlert icon
- Tray menu: official provider items disabled with ⛔ indicator

Also warns when enabling proxy takeover while current provider is official.

Jason · 2026-04-14 10:33:41 +08:00

a514f27937

fix(proxy): remove permissive CORS layer (#1915 )

zerone0x · 2026-04-13 12:26:19 +08:00

2937eb6766

[codex] Preserve cache_control when merging system prompts (#1946 )

* Preserve cache hints when collapsing system prompts

Strict OpenAI-compatible chat backends still need fragmented Claude\nsystem prompts collapsed into one leading system message, but that\nnormalization should not silently drop stable cache hints. Preserve\nmessage-level cache_control when the merged system fragments agree,\nand fall back to omitting it when the fragments conflict.\n\nConstraint: Must keep single-system normalization for Nvidia/Qwen-style chat backends\nRejected: Always copy the first cache_control | could misrepresent conflicting cache boundaries\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: If system prompt merging changes again, preserve cache_control whenever the merged metadata is unambiguous\nTested: cargo test proxy::providers::transform --manifest-path src-tauri/Cargo.toml\nNot-tested: End-to-end prompt caching behavior against cache-aware OpenAI-compatible upstreams\nRelated: #1881

* Tighten cache hint inheritance for merged system prompts

The follow-up cache hint fix still treated mixed present/absent\ncache_control across fragmented system prompts as inheritable, which\nexpanded the cache scope after prompt collapse. Treat that mix as\nambiguous and only preserve cache_control when every merged fragment\nexplicitly agrees on the same value.\n\nConstraint: Must preserve strict-backend system prompt normalization from #1942\nRejected: Inherit first present cache_control | widens cache scope when later fragments were intentionally uncached\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: Any future merged-system cache hint logic should treat missing cache_control as semantically significant\nTested: cargo test proxy::providers::transform --manifest-path src-tauri/Cargo.toml\nNot-tested: End-to-end upstream caching behavior against cache-aware relays\nRelated: #1881\nRelated: #1946

* Keep cache-control merge regressions easy to review

Reflow the two long cache-control regression assertions in transform.rs so the neighboring merge cases stay rustfmt-aligned and easier to scan.

This keeps the preserved code change separate from the untracked Markdown design notes the user did not want committed.

Constraint: Exclude Markdown design files from the commit while preserving the local code change
Rejected: Include docs in the same commit | user explicitly asked to leave Markdown files out
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Treat this as a readability-only test change; do not infer runtime behavior changes from it
Tested: cargo test --manifest-path src-tauri/Cargo.toml test_anthropic_to_openai_drops_ --lib
Tested: cargo check --manifest-path src-tauri/Cargo.toml --tests
Tested: pnpm format:check
Tested: pnpm typecheck
Not-tested: Full application integration and manual flows

Dex Miller · 2026-04-13 10:42:29 +08:00

313a6e3f6c

Stop sending prompt cache keys on Claude chat conversions (#2003 )

Responses conversions still use promptCacheKey, but chat completions now stay a pure shape transform. This keeps Claude -> chat requests aligned with providers that do not understand the field and keeps stream checks consistent with production behavior.

Constraint: Issue #1919 requires removing prompt_cache_key from Claude -> OpenAI Chat requests
Rejected: Add a runtime toggle for chat injection | requested behavior is unconditional removal
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep promptCacheKey limited to Claude -> Responses conversions unless a provider-specific contract is proven
Tested: cargo test anthropic_to_openai
Tested: cargo test anthropic_to_responses_with_cache_key
Tested: cargo test transform_claude_request_for_api_format_responses
Not-tested: Full src-tauri test suite
Related: #1919

Dex Miller · 2026-04-13 10:22:55 +08:00

5566be2b4b

添加应用级别窗口按钮，以改善linux wayland下系统窗口按钮失效的问题 (#1119 )

* feat(window): add app-level window controls with settings toggle

Add a persistent settings toggle to enable app-level minimize/maximize/close controls and hide system decorations when enabled, providing a Wayland-friendly fallback for broken native titlebar interactions.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(window): restrict app-level window controls to Linux only and fix startup flicker

- Guard useAppWindowControls with isLinux() in App.tsx so it's always
  false on macOS/Windows even if persisted as true
- Wrap set_decorations call in lib.rs with #[cfg(target_os = "linux")]
- Only show the toggle in WindowSettings on Linux
- Skip setDecorations effect while settingsData is still loading to
  prevent the Rust-side decoration state from being overridden by the
  undefined->false fallback, which caused a brief title bar flicker

---------

Co-authored-by: wzk <wx13571681304@outlook.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Jason <farion1231@gmail.com>

v2v · 2026-04-12 20:59:04 +08:00

cfcf9452d0

feat(usage): enhance usage stats backend and query hooks

YoVinchen · 2026-04-11 15:36:06 +08:00

7402f1ca05

chore(release): bump version to v3.13.0 and sync changelog/release notes

Backfill post-draft changes into CHANGELOG and three-language release
notes (en/zh/ja): 16 new Added entries, 6 Fixed entries, 1 Docs entry,
and updated header stats (139 commits, 280 files, +31627/-3042).

Jason · 2026-04-10 23:20:57 +08:00

74b9f52d90

fix: map adaptive thinking to xhigh reasoning_effort instead of high

When thinking.type is "adaptive" (Claude's maximum thinking mode) and
output_config.effort is absent, resolve_reasoning_effort() incorrectly
mapped it to "high" instead of "xhigh" in OpenAI format conversions.

Jason · 2026-04-10 22:40:29 +08:00

af679cda25

Let Kaku users launch sessions from their chosen terminal (#1954 ) (#1983 )

Kaku is a WezTerm-derived macOS terminal, so reusing the existing WezTerm-compatible launch path keeps the change small while making it selectable in settings and session resume flows.

Constraint: Kaku support should stay macOS-only and avoid introducing a separate launcher model
Rejected: Treat Kaku as a silent WezTerm fallback | users could not explicitly choose it in settings
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep Kaku on the shared WezTerm-compatible launch path unless upstream drops the start-compatible CLI
Tested: pnpm typecheck; pnpm format:check; cargo check --manifest-path src-tauri/Cargo.toml; cargo fmt --manifest-path src-tauri/Cargo.toml --check; cargo test --manifest-path src-tauri/Cargo.toml --lib session_manager::terminal::tests
Not-tested: End-to-end launch against a locally installed Kaku.app
Related: #1954

Dex Miller · 2026-04-10 22:35:16 +08:00

e4b58c7206

style: apply cargo fmt to schema migration code

Jason · 2026-04-10 11:23:08 +08:00

489c7c75ea

fix: guard migrations against missing tables and fix highlighted text assertion

- Make migrate_v6_to_v7 check skills table existence before ALTER
- Make migrate_v7_to_v8 check model_pricing table existence before UPDATE
- Fix SessionManagerPage test: use getByRole heading instead of getAllByText
  which breaks when highlightText splits text across <mark> elements

Jason · 2026-04-10 11:20:47 +08:00

b85e449949

fix: update tests for InstalledSkill new fields and missing hook mocks

- Add content_hash and updated_at fields to 4 InstalledSkill literals in skill_sync.rs
- Add useCheckSkillUpdates and useUpdateSkill to UnifiedSkillsPanel test mock
- Suppress unused import warning in auto_launch.rs test module

Jason · 2026-04-10 11:08:09 +08:00

c4458cf280

feat(session-manager): extract meaningful titles for Claude sessions

Instead of showing directory basenames for all Claude sessions, extract
titles from JSONL content with a priority chain:
1. custom-title metadata (set via /rename in Claude Code)
2. First real user message (skipping /clear, /compact caveats)
3. Directory basename (fallback)

Jason · 2026-04-09 23:18:06 +08:00

5ac6fb5315

feat(common-config): show first-run notice dialog when editing providers

Display a one-time informational dialog explaining the Common Config
Snippet feature when users first open the add/edit provider form.
Uses a derived isOpen state from settings to avoid race conditions.
Adds commonConfigConfirmed flag to both TS and Rust settings types.

Jason · 2026-04-09 16:49:14 +08:00

fa4297f4d3

feat(welcome): show first-run welcome dialog on fresh install

Introduce a one-time welcome dialog that explains CC Switch's workflow
to new users: how their existing config is preserved as a "default"
provider and how the bundled "Official" preset enables one-click revert.
Upgrade users are excluded by checking is_providers_empty() at startup
and never see the dialog.

Persistence follows the existing *_confirmed convention in AppSettings
(proxy/usage/stream_check/failover), stored in settings.json. The field
is only written when the user explicitly clicks the confirm button,
keeping its semantics strictly about user acknowledgement.

Also adds two reusable DAO helpers:
- Database::is_providers_empty for fresh-install detection, using
  EXISTS(SELECT 1) for a short-circuit query.
- Database::get_bool_flag accepting "true" | "1", with
  init_default_official_providers migrated to use it.

Dialog copy in zh/en/ja uses conditional phrasing so it stays
accurate whether or not existing live config was found.

Jason · 2026-04-09 16:49:14 +08:00

8669879ad0

feat(providers): auto-import OpenCode/OpenClaw live providers on startup

Drops the friction of clicking the manual "Import current config" button
for OpenCode and OpenClaw — they now match the auto-import behavior the
previous commit added for Claude/Codex/Gemini.

- New "1.6." startup block in lib.rs runs both
  import_opencode_providers_from_live and import_openclaw_providers_from_live
  on every launch. The functions are id-keyed and idempotent, so re-running
  just picks up new providers added externally to the live JSON files.
- Both functions now use a new Database::get_provider_ids() helper
  (HashSet<String> from a single SELECT id-only query) instead of
  get_all_providers(), avoiding the N+1 endpoint sub-queries that would
  otherwise hit the startup hot path on every launch.

Jason · 2026-04-09 16:49:14 +08:00

24bf3e810b

feat(providers): seed an official preset on startup for Claude/Codex/Gemini

New and existing users now see a built-in "Claude Official" / "OpenAI
Official" / "Google Official" entry in their provider list, so switching
back to the official endpoint is one click away instead of buried in the
README.

- New providers_seed.rs holds the three seeds (id, name, settings_config,
  icon) keyed by AppType, with a single is_official_seed_id() helper that
  scans OFFICIAL_SEEDS so the id list has one source of truth.
- Database::init_default_official_providers() runs once per database
  (gated by an official_providers_seeded setting flag), appends each seed
  to the end of the sort order, and never touches is_current.
- Startup also auto-imports the live config (settings.json / auth.json /
  .env) as a "default" provider before seeding, so users with an existing
  manual config don't lose it when they click the official preset.
- Database::has_non_official_seed_provider() replaces the get_all_providers
  call in import_default_config's gating check with an id-only scan,
  dropping the N+1 endpoint sub-queries from every startup.

Jason · 2026-04-09 16:49:14 +08:00

5dbea70eb1

refactor(stream-check): rename helper and drop phase markers

Post-merge cleanup from a simplify review pass on the phase 1-4
OpenCode/OpenClaw changes.

- Rename check_once_opencode_like → check_once_without_adapter. The
  new name directly expresses the intent (bypass get_adapter) instead
  of suggesting the function is somehow "like" OpenCode.
- Drop two "Phase 4 会美化错误消息" phase-history markers from
  docstrings; git history is the right place for them.
- Document in resolve_opencode_base_url why its default endpoints
  cannot be merged with ProviderType::default_endpoint(): the former
  encode AI SDK package defaults (e.g. @ai-sdk/openai ships with the
  /v1 suffix) while the latter encode proxy upstream hosts. They
  happen to overlap but are two independent truth sources.

Jason · 2026-04-09 16:49:14 +08:00

50cbb3be12

feat(stream-check): handle edge cases for OpenCode/OpenClaw

Phase 4: polish the four remaining edge cases uncovered by Phase 1-3.

Custom headers passthrough
- check_claude_stream and check_gemini_stream now accept an optional
  extra_headers map which is appended after all built-in headers so it
  can override defaults (e.g. a custom User-Agent).
- OpenClaw reads from settings_config.headers.
- OpenCode reads from settings_config.options.headers.
- All pre-existing Claude/Codex/Gemini call sites pass None.

OpenClaw custom auth header (Longcat-style)
- When settings_config.authHeader is true, the provider expects a
  custom auth header whose name is only known to the OpenClaw gateway
  itself. Return a dedicated openclaw_auth_header_not_supported error
  so the user sees a meaningful explanation instead of a 401.

Bedrock error polish
- The bedrock-converse-stream (OpenClaw) and @ai-sdk/amazon-bedrock
  (OpenCode) branches now explain why (SigV4 signing) and point to
  the official consoles as an alternative test path.

OpenCode baseURL fallback
- resolve_opencode_base_url: when options.baseURL is empty and the
  npm package has a canonical default endpoint (@ai-sdk/openai,
  @ai-sdk/anthropic, @ai-sdk/google), fall back to that endpoint.
  @ai-sdk/openai-compatible still requires an explicit baseURL
  because its whole purpose is to point at a custom OpenAI clone.

Tests
- 8 new unit tests covering authHeader detection, baseURL resolution
  (explicit / fallback / error), and header map extraction on both
  apps. Total stream_check tests: 18 → 26.

Jason · 2026-04-09 16:49:14 +08:00

5a61f01cfc

feat(stream-check): support OpenCode via npm package mapping

Phase 3: implement stream check for OpenCode providers by mapping the
`settings_config.npm` (AI SDK package name) to the corresponding API
protocol and delegating to the existing stream checkers.

Package mapping:
- @ai-sdk/openai-compatible → openai_chat
- @ai-sdk/openai            → openai_responses
- @ai-sdk/anthropic         → anthropic (ClaudeAuth strategy)
- @ai-sdk/google            → gemini (Google strategy)
- @ai-sdk/amazon-bedrock    → not supported (phase 4 message polish)

Note: OpenCode nests baseURL/apiKey under `settings_config.options`
(different from OpenClaw's root-level fields) and uses `baseURL` with
a capital L. Three new extractors (base_url / api_key / npm) encode
these shape differences so check_opencode_stream stays symmetric with
check_openclaw_stream.

Frontend: drop the remaining `appId !== "opencode"` filter in
ProviderList.tsx — both apps can now test providers.

Jason · 2026-04-09 16:49:14 +08:00

c02b8c58cb

feat(stream-check): support remaining 3 OpenClaw protocols

Phase 2: extend check_openclaw_stream to cover the full non-Bedrock
protocol set declared by openclawApiProtocols.

- openai-responses   → check_claude_stream(api_format="openai_responses")
- anthropic-messages → check_claude_stream(api_format="anthropic"),
  using AuthStrategy::ClaudeAuth (Bearer-only) so Claude relay
  services that reject a simultaneous x-api-key still work. Official
  Anthropic also accepts pure Bearer on /v1/messages.
- google-generative-ai → check_gemini_stream with AuthStrategy::Google.

bedrock-converse-stream still errors out but with a dedicated
openclaw_bedrock_not_supported key; its user-facing message will be
polished in phase 4.

Each protocol now builds its own AuthInfo inside the match arm because
the auth strategy is protocol-specific.