11 Commits

• refactor(sdk): simplify provider lifecycle and registration logic
  Luis Pater · 2026-02-10 15:39:26 +08:00
  0040d78496
• docs: remove Amp CLI integration guides and update references
  Luis Pater · 2025-12-15 23:50:56 +08:00
  3af24597ee
• docs: add model mapping documentation for Amp CLI integration

  - Add model mapping feature to README.md Amp CLI section
  - Add detailed Model Mapping Configuration section to amp-cli-integration.md
  - Update architecture diagram to show model mapping flow
  - Update Model Fallback Behavior to include mapping step
  - Add Table of Contents entry for model mapping

  Trung Nguyen · 2025-11-29 12:51:03 +07:00
  33a5656235
• **docs: add Amp CLI integration guide to Chinese documentation**

  - Updated `README_CN.md` to introduce Amp CLI and IDE support.
  - Added detailed integration guide in `docs/amp-cli-integration_CN.md`.
  - Covered setup, configuration, OAuth, security, and usage of Amp CLI with Google/ChatGPT/Claude subscriptions.

  Luis Pater · 2025-11-20 21:07:20 +08:00
  93fa1d1802
• security: fix localhost middleware header spoofing vulnerability

  Fix critical security vulnerability in amp-restrict-management-to-localhost
  feature where attackers could bypass localhost restriction by spoofing
  X-Forwarded-For headers.
  
  Changes:
  - Use RemoteAddr (actual TCP connection) instead of ClientIP() in
    localhostOnlyMiddleware to prevent header spoofing attacks
  - Add comprehensive test coverage for spoofing prevention (6 test cases)
  - Update documentation with reverse proxy deployment guidance and
    limitations of the RemoteAddr approach
  
  The fix prevents attacks like:
    curl -H "X-Forwarded-For: 127.0.0.1" https://server/api/user
  
  Trade-off: Users behind reverse proxies will need to disable the feature
  and use alternative security measures (firewall rules, proxy ACLs).
  
  Addresses security review feedback from PR #287.

  Ben Vargas · 2025-11-19 22:09:04 -07:00
  a6cb16bb48
• docs: reposition Amp CLI as integrated feature for upstream PR

  - Update README.md to present Amp CLI as standard feature, not fork differentiator
  - Remove USING_WITH_FACTORY_AND_AMP.md (fork-specific, Factory docs live upstream)
  - Add comprehensive docs/amp-cli-integration.md with setup, config, troubleshooting
  - Eliminate fork justification messaging throughout documentation
  - Prepare Amp CLI integration for upstream merge consideration
  
  This positions Amp CLI support as a natural extension of CLIProxyAPI's
  multi-client architecture rather than a fork-specific feature.

  Ben Vargas · 2025-11-19 18:23:17 -07:00
  1fb96f5379
• feat(auth, docs): add SDK guides and local password support for management

  - Added extensive SDK usage guides for `cliproxy`, `sdk/access`, and watcher integration.
  - Introduced `--password` flag for specifying local management access passwords.
  - Enhanced management API with local password checks to secure localhost requests.
  - Updated documentation to reflect the new password functionality.

  Luis Pater · 2025-09-25 11:32:14 +08:00
  a4767fdd8e
• remove all
  Luis Pater · 2025-09-25 10:31:02 +08:00
  3f69254f43
• feat(auth): enhance watcher with asynchronous dispatch and buffering

  - Added async dispatch loop to `Watcher` for handling incremental `AuthUpdate` with in-memory buffering.
  - Improved resilience against high-frequency auth changes by coalescing updates and reducing redundant processing.
  - Updated `cliproxy` service to increase auth update queue capacity and optimize backlog consumption.
  - Added detailed SDK integration documentation in English and Chinese (`sdk-watcher.md`, `sdk-watcher_CN.md`).

  Luis Pater · 2025-09-23 04:33:48 +08:00
  6046a8c95b
• docs(sdk-access): add SDK usage guides in English and Chinese

  - Added `sdk-access.md` and `sdk-access_CN.md` documentation files.
  - Included detailed guidelines for authentication manager lifecycle, configuration, built-in and custom providers.
  - Documented integration steps with `cliproxy` and instructions for hot reloading.

  Luis Pater · 2025-09-23 03:27:03 +08:00
  3ffd87d8de
• feat: introduce custom provider example and remove redundant debug logs

  - Added `examples/custom-provider/main.go` showcasing custom executor and translator integration using the SDK.
  - Removed redundant debug logs from translator modules to enhance code cleanliness.
  - Updated SDK documentation with new usage and advanced examples.
  - Expanded the management API with new endpoints, including request logging and GPT-5 Codex features.

  Luis Pater · 2025-09-22 03:37:53 +08:00
  f81898c906