feat(ccs): add CCS configuration with dynamic secret hydration - #597
Conversation
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
|
Caution Review failedThe pull request is closed. 📝 WalkthroughSummary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings. WalkthroughThis PR updates account metadata, enables three Claude model mappings in the cliproxyapi configuration, and adds sed rules to the startup script to comment out specific YAML keys during config templating. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Possibly related PRs
Suggested labels
Poem
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @shunkakinoki, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Mesa DescriptionTL;DRAdded CCS configuration with dynamic secret hydration and an accounts registry for cliproxy providers (agy, gemini, codex). Fixed auth directory scanning and model routing, and integrated What changed?
Description generated by Mesa. Update settings |
08158d8 to
d276723
Compare
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces configuration for CCS, including dynamic secret hydration. The changes are generally good, but there are a few important issues to address. I've found a potential security risk with committed personal information in a configuration file. There's also a bug in a shell script that could cause it to fail if an API key contains special characters. Finally, there's an issue with incorrect indentation in another script that modifies a YAML file. I've provided suggestions to fix these issues.
I am having trouble creating individual review comments. Click here to see my feedback.
config/ccs/accounts.json (5-9)
This configuration file appears to contain a personal email address and nickname. It's a security risk to commit personal data into a version control system. Please replace these with placeholder values, for example: user@example.com and example-user. This applies to all providers in this file.
"default": "user@example.com",
"accounts": {
"user@example.com": {
"email": "user@example.com",
"nickname": "example-user",
config/ccs/hydrate.sh (20-51)
The script could fail if the CLIPROXY_API_KEY contains special characters used by sed in the replacement string (like &, \, or the delimiter |). It's much safer to escape the API key value before using it in the sed substitution command.
if [ -z "${CLIPROXY_API_KEY:-}" ]; then
echo "Warning: CLIPROXY_API_KEY not set in .env, skipping CCS hydration" >&2
exit 0
fi
# Escape special characters in the API key to prevent issues with sed.
# The sed delimiter is '|', so we need to escape '|', '\', and '&'.
escaped_api_key=$(printf '%s' "${CLIPROXY_API_KEY}" | @sed@ -e 's/[&\\|]/\\&/g')
mkdir -p "$CCS_DIR"
# Hydrate config.yaml
CONFIG_TEMPLATE="${TEMPLATE_DIR}/config.template.yaml"
if [ -f "$CONFIG_TEMPLATE" ]; then
@sed@ \
-e "s|__CLIPROXY_API_KEY__|${escaped_api_key}|g" \
"$CONFIG_TEMPLATE" >"${CCS_DIR}/config.yaml"
echo "Hydrated CCS config.yaml" >&2
fi
# Process all provider settings templates
for template in "$TEMPLATE_DIR"/*.settings.template.json; do
[ -f "$template" ] || continue
# Extract provider name: foo.settings.template.json -> foo
filename=$(basename "$template")
provider="${filename%.settings.template.json}"
output="${CCS_DIR}/${provider}.settings.json"
# Substitute placeholder and write output
@sed@ \
-e "s|__CLIPROXY_API_KEY__|${escaped_api_key}|g" \
"$template" >"$output"
echo "Hydrated CCS ${provider}.settings.json" >&2
donehome-manager/services/cliproxyapi/scripts/start.sh (90-99)
The sed commands to comment out the ampcode block are adding extra spaces, which results in incorrect indentation for the commented-out block. This makes the resulting YAML file harder to read and could potentially cause issues with strict parsers. The replacement string should prepend # to the original line, preserving the indentation.
Also, this approach is quite brittle. A small change to the config.template.yaml could break this script. Consider using a YAML-aware tool like yq in the future for more robust modifications (e.g., yq -i 'del(.ampcode)' "$CONFIG").
For now, let's fix the indentation.
@sed@ -i \
-e 's|^ampcode:|#ampcode:|' \
-e 's|^ upstream-url:|# upstream-url:|' \
-e 's|^ upstream-api-key:|# upstream-api-key:|' \
-e 's|^ restrict-management-to-localhost:|# restrict-management-to-localhost:|' \
-e 's|^ # Map non-prefixed|# # Map non-prefixed|' \
-e 's|^ model-mappings:|# model-mappings:|' \
-e 's|^ - from:|# - from:|' \
-e 's|^ to:|# to:|' \
"$CONFIG"
The antigravity provider requires `gemini-` prefix on model names: - gemini-claude-opus-4-5-thinking - gemini-claude-sonnet-4-5 Without this prefix, requests get routed to ampcode.com and fail with 404. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Use non-prefixed model names (claude-opus-4-5-thinking) in templates - Add model-mappings in ampcode section to map to gemini- prefixed names - On Linux: AMP disabled, non-prefixed names work directly - On macOS: AMP enabled, model-mappings route to antigravity provider - Update start.sh to comment out model-mappings on Linux too Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1 participant
Summary
CLIPROXY_API_KEYsubstitutionmake switchrestart targetsChanges
config/ccs/accounts.json- CCS account registry for OAuth providersconfig/ccs/config.template.yaml- CCS config with auth_token placeholderconfig/ccs/*.settings.template.json- Provider settings templates (agy, codex, gemini)config/ccs/hydrate.sh- Script to substitute secrets from.envconfig/cliproxyapi/config.yaml- Add model-mappings for antigravity providerhome-manager/services/cliproxyapi/scripts/start.sh- Disable AMP on Linux, comment model-mappingsHow it works
make switch, hydration script runs during home-manager activationCLIPROXY_API_KEYfrom~/dotfiles/.env~/.ccs/config.yamland~/.ccs/*.settings.jsonwith actual API keyTest plan
make shell-checkpassesmake shell-testpasses (359 examples, 0 failures)make buildsucceedsmake switchhydrates settings correctlyccs agy -p "say hi"works on Linux🤖 Generated with Claude Code
Summary by cubic
Add CCS config with dynamic secret hydration and an accounts registry for cliproxy providers (agy, gemini, codex). Fix auth directory scanning and model routing, and make switch now hydrates settings and restarts cliproxyapi for reliable ccs commands on Linux and macOS.
New Features
Bug Fixes
Written for commit d276723. Summary will update on new commits.