Spaces:
Sleeping
Sleeping
Commit History
-
fix: bypass dashboard auth on HF Spaces
Lenson8c41cd9 -
feat: dashboard login gate for public deployments (#148)
icebear +1: icebear0828Unverified signature* feat: dashboard login gate for public deployments (#141) Cookie-based session auth when proxy_api_key is set and request is non-localhost. API routes (/v1/*) unaffected, Electron (localhost) auto-bypassed. - In-memory session store with TTL from session.ttl_minutes config - Dashboard auth middleware with path-based allowlist - Login/logout/status endpoints with per-IP brute-force protection - HTTPS auto-detection: Secure flag on cookie when X-Forwarded-Proto: https - Remote session cannot clear proxy_api_key (prevents disabling login gate) - Frontend LoginGate component with i18n (en/zh), conditional logout button * fix: dashboard login security hardening - Timing-safe password comparison (crypto.timingSafeEqual) - Rate limiter cleanup of expired entries to prevent memory leak - Extract shared parseSessionCookie to src/utils/parse-cookie.ts - Remove silent password.trim() that could cause subtle mismatches - Logout button visible on mobile (icon-only on small screens) - Fix fragi…91ee702
-
fix(api): return 400 invalid_json for malformed chat payload
icebear08280be9bdf
-
refactor: architecture audit fixes (P0-P2 stability & reliability)
icebear0828 +1: Claude Opus 4.6P0: curl header parse timeout (30s), kill curl on stream disconnect via AbortController, cap error response body at 1MB. P1: acquireLock TTL (5min auto-release), atomic config hot-reload, encapsulate 429 counting in AccountPool, graceful shutdown with server.close() + 5s drain period. P2: send error SSE event on stream failure, structured JSON logger, O(1) session LRU eviction via Map insertion order. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>b1107bc -
refactor: fingerprint alignment, auto-maintenance, Docker deployment
icebear0828 +1: Claude Opus 4.6Phase 1 - Eliminate fingerprint detection gaps: - Dynamic sec-ch-ua from config chromium_version (aligned with TLS profile) - Inject full fingerprint headers into curl-fetch (OAuth/appcast) - Unify Accept-Encoding based on curl-impersonate detection - Optimize header ordering (single sort pass) Phase 2 - Auto-maintenance: - Structured YAML mutation utility (replace regex hacks) - Auto full-update pipeline on new version detection - Config hot-reload after updates - Exponential backoff token refresh (5 attempts + 10m recovery) - Immediate persistence for critical data (tokens, cf_clearance) - Cookie v2 format with expiry timestamps - Graceful shutdown with 10s timeout protection - Usage counters auto-reset on rate limit window rollover Phase 3 - Docker deployment: - Dockerfile, docker-compose.yml, .dockerignore - Deployment docs in README Fixes: - Extract planType from JWT /auth claim (was looking in /profile) - Backfill missing planType on startup for existing accounts - Show full d…347f81b -
refactor: extract shared proxy handler, eliminate route duplication
icebear0828 +1: Claude Opus 4.6- Extract withRetry() to src/utils/retry.ts (was duplicated 3x) - Create shared proxy-handler.ts encapsulating acquire/stream/release lifecycle - Refactor chat.ts, messages.ts, gemini.ts to use shared handler (-264 lines net) - Convert models.ts from default export to named createModelRoutes() - Extract GEMINI_STATUS_MAP to types/gemini.ts (was duplicated in error-handler) - Add SessionManager.destroy() with interval cleanup + unref - Remove dead captureCookies() method from codex-api.ts - Add stack trace logging to error handler - Fix hardcoded localhost in startup message - Use atomic write-to-temp-then-rename for cookie-jar and account-pool - Add warning logs for previously silent catch blocks Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>8b777a2 -
feat: multi-protocol support — Anthropic Messages API + Google Gemini API
icebear0828 +1: Claude Opus 4.6Add two new protocol translation layers so the proxy can serve clients speaking Anthropic (/v1/messages) or Gemini (/v1beta/models/:model:generateContent) in addition to the existing OpenAI /v1/chat/completions endpoint. All three protocols translate to the same upstream Codex Responses API. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>d0eb8b9
-
Initial commit: Codex Proxy with quota API and Cloudflare bypass
icebear0828 +1: Claude Opus 4.6OpenAI-compatible proxy that translates Chat Completions API to ChatGPT's Codex Responses API. Includes multi-account management, official quota querying via curl subprocess (bypasses Cloudflare TLS fingerprinting), per-account cookie jar, and full API documentation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>5d0a52f