Lays down the server side of a per-request Ed25519 signature scheme that
binds a token to a specific desktop install, so the bearer key can't be
extracted from ~/.claude/cc-haha/providers.json and resold. Plan lives
at ~/.claude/plans/peaceful-sprouting-crane.md.
Compatibility: legacy bare-bearer sk- callers (CLI/SDK) pass through
unchanged until P3 (30-day deadline) flips RequireGlobal=true. No
existing token rows are modified — pubkey is nullable and defaults to
null.
Pieces:
- model.Token gains DeviceId, DevicePubkey, DeviceFingerprint, DeviceName,
DevicePlatform, DeviceAppVersion, DeviceBoundAt, DeviceLastSeenIp,
DeviceLastUsedAt, RequireDeviceBinding, RevokedAt, RevokedReason.
Pure additive columns, GORM AutoMigrate handles SQLite/MySQL/PG.
- common.VerifyEd25519Signature: thin wrapper around crypto/ed25519
stdlib, used by the new middleware. No new external deps.
- service.MarkNonceUsed: Redis SETNX-based nonce store with an
in-memory sync.Map fallback for single-instance dev. TTL = setting.
- middleware.VerifyDeviceSignatureIfRequired: wired into TokenAuth as
a fail-fast dispatch right after model.ValidateUserToken. Verifies
canonical = METHOD\nPATH\nTS_MS\nNONCE\nFINGERPRINT\nSHA256(BODY),
signed as Ed25519(sha256(canonical)). 120s timestamp window, 300s
nonce window, fingerprint stored at pair time must match the header.
- controller.PairDevice / ListUserDevices / RenameUserDevice /
RevokeUserDevice, mounted at /api/devices/* behind UserAuth().
PairDevice enforces 5-per-user cap and returns the raw sk- once,
to be stored in the client's OS keychain (not providers.json).
- operation_setting.DeviceBindingSetting: MaxDevicesPerUser=5,
TimestampWindowMs=120000, NonceTTLSec=300, RequireGlobal=false.
Tests:
- common/crypto_test.go covers round-trip + tamper + malformed inputs.
- middleware/device_signature_test.go covers all error-path branches
(expired ts, wrong sig, tampered body, fingerprint mismatch, replay,
revoked, missing headers, legacy fallthrough).
- testdata/device_signature_vectors.json is the cross-language contract
Rust+TS sides will load to assert byte-identical canonical strings.
Untouched but reserved for follow-up phases:
- Anomaly detection / IP-diversity flagging (P1)
- 30-day deprecation banner + email notifications (P2)
- Hard cutover RequireGlobal=true (P3, day 31)
Surface a clickable mailto link in the page footer so users on
code.xinghanlab.com have a clear contact path without digging into
docs. Lives in the bottom border-separated band alongside the
'Platform Console' label.
i18n: 'Contact' key added to en (Contact) and zh (联系我们).
Win release artifacts now live in their own Azure Blob container
(heicodeblob/win/) — Manager download page and Tauri auto-updater both
point at win/updater/win-latest.json. Mac stays on the existing custom
sha256-verified mac-latest.json until the Mac CI/CD pipeline migrates
to Tauri minisign format.
Also fixes the in-app balance pill: /v1/dashboard/billing/{subscription,usage}
on the Manager accepts the `sk-` channel token, /api/user/self does not.
Switched the proxy in heicode-auth to use the billing endpoints so the
BalanceBar actually renders real remaining/used quota.
- cc-haha/desktop/src-tauri/tauri.conf.json: updater endpoint → win container
- cc-haha/src/server/api/heicode-auth.ts: balance via /v1/dashboard/billing
- cc-haha/desktop version bump 0.2.4 → 0.2.5 (next Win release)
- cc-haha/.gitignore: exclude installer artifacts (msi, dmg, sig, …)
- heicode/controller/desktop_download.go: dual-feed (Win Tauri + Mac custom)
The balance endpoint was trying /api/user/heicode/balance on
mcp-server first, but that route doesn't exist on the Manager
backend, so it always 404'd. The fallback to /api/user/self
only ran if apiKey was present but the guard was nested behind
the mcpAuth check.
Swap the order: try /api/user/self with apiKey first (always
works after login), fall back to mcp-server path second.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Guard installUpdate() with isDownloading flag to prevent concurrent downloads
- Deduplicate checkForUpdates() with checkInProgress promise
- Track monotonic progress (peakPercent never decreases)
- Reduce startup check delay from 5s to 1s
- Bump desktop to 0.2.4
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
appendAssistantTextMessage was merging consecutive assistant_text messages
regardless of whether they belonged to different conversation turns. Added
turnComplete flag that gets set on message_complete, error, and status(idle)
events, preventing subsequent turns from merging into the previous response.
Claude Code sends Anthropic format requests directly to /v1/messages with
thinking.type=enabled. ClaudeHelper was forwarding this unchanged to
upstream, but Opus 4.7 rejects thinking.type=enabled and requires
thinking.type=adaptive with output_config.effort instead.
Opus 4.7 rejects thinking.type="enabled". The effort-suffix and
-thinking suffix paths already handled this, but the ReasoningEffort
and Reasoning parameter paths still sent "enabled". Now all paths
use "adaptive" + output_config.effort for Opus 4.7.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Website visitors now have a single registration path through the CodeGW sign-up page, while the header no longer presents a separate login action beside registration. Static export output is included so the repository matches the deployed Azure Static Web Apps artifact.
Constraint: Website must use the CodeGW sign-up URL and remove the header login button.
Rejected: Keeping the separate Agnet login URL | it sends registration traffic to the wrong surface.
Confidence: high
Scope-risk: narrow
Directive: Keep public website registration links pointed at https://code.xinghanlab.com/sign-up unless product routing changes.
Tested: pnpm run build; Azure Static Web Apps production deploy; live curl checks for sign-up URL and removed login link.
Not-tested: Browser visual pass after deployment.
Co-authored-by: OmX <omx@oh-my-codex.dev>
Opus 4.7 requires thinking.type="adaptive" instead of "enabled".
The CLI sends "enabled" which upstream APIs reject. Now all providers
(including Anthropic-format) route through the proxy, which patches
the thinking parameter before forwarding.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The 30-second AbortSignal.timeout on streaming fetch requests was
causing long-running tool calls (file editing, code search) to be
silently killed. The UI would show the task as still running but
no data was flowing, making it appear stuck indefinitely.
- Increase fetch timeout to 600s (10 min) for both stream and
non-stream requests
- Add 5-minute per-chunk timeout in both stream parsers so a
truly dead upstream is detected and surfaced as an error
instead of hanging forever
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Login page now shows "Don't have an account? Create a new account"
link to /sign-up when registration is enabled, replacing the old
"Contact tenant operator" mailto link.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add brand gradient title, status badge, and descriptive subtitle
- Polished form inputs: h-12 rounded-xl with icons matching sign-in
- Password fields in 2-column grid layout on desktop
- Brand gradient submit button with hover/active animations
- Styled verification code row with matching heights
- Consistent uppercase tracking labels throughout
- "Already registered?" section with link matching sign-in's footer
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Registration now goes through the Agnet auth proxy (/api/heicode-auth/*)
instead of the local Manager API. Email verification is always required
(太极 mandates it). After successful registration, tokens are used
directly to establish the Manager session without a redundant login call.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When user clicks the X button, the app now hides to the system tray
instead of exiting. Users can restore the window by clicking the tray
icon or selecting "显示 Heicode" from the tray menu. To fully quit,
use "退出 Heicode" from the tray menu.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- OAuth: safe type assertions for session state and affiliate code
(oauth.go, github.go, discord.go, linuxdo.go, oidc.go)
- Model: Scan() methods handle string values from DB drivers, not just []byte
(channel.go ChannelInfo, task.go Properties/TaskPrivateData)
- Model: safe type assertion in CleanupChannelPollingLocks sync.Map iteration
- Relay: safe type assertions in audio_handler, AWS InvokeModel,
ollama ConvertClaudeRequest, claude stop sequences, zhipu token cache
- Service: fix slice bounds panic in Gemini->OpenAI stop sequences conversion
- Service: safe type assertion in CleanupFileSources middleware
- Middleware: add missing c.Abort() in turnstile session save failure
- Middleware: safe type assertion in distributor channelId
- Middleware: safe int comparison in auth helper
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Replace all encoding/json direct calls with common.Marshal/Unmarshal/DecodeJson per Rule 1
- Fix Dify nil pointer dereference on remote image upload (relay-dify.go)
- Fix Claude relay file content type detection for text/* and PDF (relay-claude.go)
- Fix unsafe type assertions in Claude relay and Vertex GetModelRegion
- Fix StreamScanner unconditionally resetting pre-existing StreamStatus
- Add inferMimeTypeFromFilename() for proper MIME type handling in DTO
- Fix Mac build script hardcoded DMG version (now reads from tauri.conf.json)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- relay/channel/aws/relay-aws.go: add bounds check before accessing
Content[0] — empty response array caused index-out-of-range panic
- dto/embedding.go: convert Seed, TopK, NumPredict, NumCtx from int
to *int so explicit zero values survive omitempty marshaling (Rule 6)
- dto/video.go: convert Fps, Seed, N from int to *int (Rule 6)
- dto/suno.go: convert ContinueAt from float64 to *float64 (Rule 6)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Client (cc-haha):
- server/api/sessions.ts: use path.basename() instead of split('/').pop()
for extracting project/repo names on Windows
- server/api/filesystem.ts: use os.tmpdir() and os.homedir() instead of
hardcoded '/tmp' and process.env.HOME which don't exist on Windows
- utils/plugins/pluginVersioning.ts: split on /[/\]/ for Windows paths
- utils/plugins/loadPluginCommands.ts: handle backslash separators in
plugin namespace construction
- cli/handlers/autoMode.ts: add optional chaining on response.content
to prevent crash when API returns null content
Manager (heicode):
- auth/api.ts: fix status always returning 1 regardless of active state
(was `? 1 : 1`, now `? 1 : 2`)
- users/api.ts, redemption-codes/api.ts, profile/api.ts: use
URLSearchParams for query string encoding to prevent breakage with
special characters in search keywords and email addresses
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- middleware/auth.go: session.Get() returns interface{} which can be nil;
use safe type assertions with ok checks to prevent panics on corrupted sessions
- controller/misc.go: replace json.NewDecoder with common.DecodeJson per project
convention, add error check before using decoded struct
- handle-server-error.ts: add optional chaining on error.response.data to prevent
crash when response body is undefined
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Bump version to 0.2.1 across tauri.conf.json, package.json,
Cargo.toml, updater manifest, and Mac fallback URL.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
On Windows, Tauri returns paths with backslash separators. Multiple
components used .split('/') to extract filenames/segments, which
returned the entire path as a single element on Windows. Changed all
instances to .split(/[/\]/) to handle both Unix and Windows paths.
Affected: ProjectContextChip, ToolCallBlock, PermissionDialog,
ToolCallGroup, FileSearchMenu, InlineImageGallery,
LocalSlashCommandPanel, ProjectFilter, StatusBar, DirectoryPicker.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Same bug as ChatInput — inserting filename at cursor without removing
the @filter trigger text, producing @foofile.ts instead of file.ts.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The onSelect handler inserted the filename at cursor position without
removing the @filter trigger text, producing "@foofilename.ts" instead
of replacing the whole "@foo" with "filename.ts".
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Guard empty thinking events from creating blank ThinkingBlock rows
- Skip empty assistant_text from history loading
- Hide ToolResultBlock when content is empty (non-error)
- Add component-level null returns as safety net
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix CJK font rendering: add PingFang SC, Microsoft YaHei, Noto Sans CJK SC
fallbacks to all CSS font stacks (headline, body, label, mono)
- Clear docs_link default (was pointing to upstream docs)
- Remove user-facing "NewAPI" text from en/zh i18n strings
- Bump desktop version to 0.2.0
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Manager web:
- Replace favicon.ico (both default & classic themes) with new H icon
- Compact heicode-logo.svg from 204KB base64 blob to 5KB
- Replace classic theme logo.png (was still old NewAPI icon)
Client (cc-haha):
- Fix isInBundledMode() to detect Bun-compiled sidecars that have no
explicit embeddedFiles — checks process.execPath basename instead
- Add well-known ripgrep install paths (/opt/homebrew/bin, /usr/local/bin,
~/.cargo/bin, etc.) as fallback when PATH is incomplete in Tauri sidecar
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- assets/logo.tsx: drop the hand-drawn "H" path SVG and render
/logo.png (already swapped to the new gradient icon when we
refreshed branding). One source asset across desktop + favicon +
Manager web.
- desktop_download.go: Mac fallback URL points at HeiCode_0.1.9_
aarch64.dmg now (drag-to-Applications installer), not the
.app.tar.gz updater payload that confuses end users.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Balance pill was rendering nothing for admin/root accounts because
mcp-server's §4 returns HEICODE_USER_NOT_FOUND for users that never
came through from-agnet onboarding. Fall back to Heicode NewAPI's
own /api/user/self when that happens; reshape into the same envelope
so the UI is path-agnostic.
New balanceStore (zustand) — single polling loop, BalanceBar +
avatar ring share it. AppShell starts it once auth bootstraps.
BalanceBar now shows a "loading…" placeholder on first fetch so
the widget is visible from frame one.
SidebarUserCard avatar wears an SVG ring whose arc length tracks
remaining/(remaining+used) and color hits the same green→amber→red
thresholds as the bar.
Manager: /desktop-client drops the manifest-notes wall of text, the
old HEICODE_DESKTOP_FILE_* subtitle goes away, and a Mac fallback
entry is always spliced in when the live manifest is Win-only.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Today's 0.1.6/0.1.7/0.1.8 all built but never shipped a manifest
(some were superseded mid-iteration; 0.1.8 had Win binary on blob
but Mac wasn't ready). 0.1.9 ships the full stack as one release:
- BalanceBar under the composer now has a real progress bar (was
text only). Fill = remaining/(remaining+used); color shifts
green → amber → red below 30%/10%.
- (from 0.1.8) AskUserQuestion early-return moved below all hooks
so the render order is stable across input mutations.
- (from 0.1.8) chatStore content_delta throttle is now per-session
(Map<sessionId, {pending, timer}>); no more cross-tab text bleed.
- (from 0.1.8) endpoints array trimmed to blob-only — SWA URL gone
so a fallback failure no longer flashes a third-party domain.
- (from 0.1.7) new app icon — already on disk in icons/ + public/.
- (from 0.1.6) Manager desktop_download.go reads blob manifest so
the /desktop-client page tracks releases without env wrangling.
- Build pipeline: `tauri build --bundles nsis` is the release path
(skips MSI/WiX, ~2-3 min/build saved). sccache wired into
~/.cargo/config.toml; next build is the first with warm cache.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
P0: AskUserQuestion.tsx had `if (questions.length === 0) return null`
sitting between the `useState` calls and the `useMemo` calls below.
On any render where parseInput(input) flipped between empty and
non-empty (e.g. streaming permission_request input mutates) React
threw "Rendered more hooks than during the previous render". Moved
the early return after every hook call.
P1: chatStore.ts had `pendingDelta` + `flushTimer` at module scope,
shared across every active session. When two sessions streamed at
the same time (e.g. user has a team-member tab open alongside their
own), session B's content_delta would queue onto the same module
buffer as session A; whichever flush timer fired first emptied the
buffer into its own session. Result: text leaked between
conversations.
Replaced with a `Map<sessionId, { pending, timer }>` so each stream
owns its own throttle buffer. `consumePendingDelta(sessionId)` and
`dropBuffer(sessionId)` keep the API similar to before; nine
callsites updated.
Both issues caught by the bug-audit agent run after 0.1.7 build.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
chenchen
