James Feng
76c47956dd
fix: resolve ~50 CodeQL alerts — unused, injection, type issues
...
unused-local-variable / useless-assignment (~30 alerts):
- mcp-client: manager.ts (11), connection.ts (3)
- acp-link: server.ts (4), rcs-upstream.ts
- remote-control-server: 10 files (SessionDetail, acp/client, transports, etc.)
- src: constants/tools.ts, attribution.ts, win32.ts, main.tsx, attachments.ts
log-injection (2):
- chromeNativeHost.ts, rcs-upstream.ts — apply sanitizeLog()
indirect-command-line-injection (4):
- imagePaste.ts: convert shell:true to explicit sh -c pattern
use-before-declaration (4):
- query.ts, claude.ts, tools.ts, attachments.ts — move feature() import up
comparison-between-incompatible-types (2):
- ExitPlanModePermissionRequest.tsx, useTerminalNotification.ts
shared: sensitive.ts — sanitizeLog() helper
2026-06-08 17:15:22 +08:00
James Feng
2b6cf08c7c
fix: resolve 13 trivial-conditional alerts + remove community gemini
...
Trivial-conditional cleanup (13 alerts auto-closed):
- bashSecurity.ts: remove 3 redundant !inSingleQuote checks
- WebFetchTool/UI.tsx, WebSearchTool/UI.tsx: remove redundant guards
- theme.ts: simplify getStoredTheme() || defaultTheme
- EventStream.tsx: remove dead !replay check
- MCPRemoteServerMenu.tsx: remove redundant isAuthenticating
- managedEnv.ts: remove dead !env guard
- permissionSetup.ts: delete duplicate code block
- marketplaceHelpers.ts: simplify blockedValue || undefined
- toolExecution.ts: remove dead : '' ternary branch
- main.tsx: remove dead dynamicMcpConfig && guard
- attachments.ts: wire up suppressNextDiscovery (set flag before await)
Also: remove abandoned community gemini (src/services/api/gemini/)
and its routing from claude.ts. Upgrade CodeQL to security-and-quality.
2026-06-08 16:29:34 +08:00
James Feng
2249f184ba
fix: resolve 17 CodeQL alerts — log injection, command injection, ReDoS
...
- acp/client.ts: add _sanitize helper with CR/LF escaping to prevent
js/log-injection in 20 console.log/error calls (15 flagged alerts)
- execFileNoThrowPortable.ts: remove redundant env:process.env from
execaSync (already inherited by default) — fixes js/indirect-command-line-injection
- toolCalls.ts: replace ambiguous regex [\w.-]* with non-backtracking
[\w-]*(\.[\w-]*)+ and add 255-char length guard — fixes js/polynomial-redos
Validation: bun run check:fix ✓, bunx tsc --noEmit (0 new errors) ✓,
bun run build ✓
2026-06-08 10:10:29 +08:00
James Feng
e3908ab430
chore: align remote control web ui with upstream
2026-06-07 02:35:51 +08:00
claude-code-best
2d05da1096
feat: remote control 支持 auto bind 功能 ( #300 )
...
* feat: acp-link 支持 --group 参数指定 channel group
- 添加 --group CLI flag，校验格式 [a-zA-Z0-9_-]+
- 支持 ACP_RCS_GROUP 环境变量 fallback
- 传递 channelGroupId 到 RcsUpstreamClient
- 更新 README 文档说明 --group 和相关环境变量
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: RCS 后端 session 复用与 group 绑定
- storeFindEnvironmentByMachineName 匹配 offline 状态，防止重连创建重复 session
- registerEnvironment 复用已有 session 而非每次新建
- EnvironmentResponse 返回 channel_group_id 字段
- 注册时将 session 绑定到 group ID，支持 web UI 按 group 查询
- apiKeyAuth 不再设置 uuid，由 uuidAuth 统一处理
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: Web UI Token Manager — 多 token 切换与 session 隔离
- 新增 useTokens hook 管理 localStorage token CRUD
- 新增 TokenManagerDialog 弹窗组件（添加/编辑/删除/切换 token）
- api client 支持Bearer token 认证，UUID 跟随 token 变化
- Navbar 添加 token 切换按钮
- 切换 token 时自动 reload，实现 session 数据隔离
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: 修复 useTokens useState 初始化函数签名错误
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-06-04 23:53:13 +08:00
claude-code-best
c112237e5c
fix: 替换 web 端 crypto.randomUUID 为 uuid 库以支持 HTTP 环境
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-06-04 23:53:13 +08:00
claude-code-best
d719508733
feat: ACP 协议版本 remote control ( #293 )
...
Commit: 2e9aaf49
2026-06-04 23:53:06 +08:00
James Feng
056231d02b
feat: 支持 acp-link 包进行 acp 通用的 remote-control ( #292 )
...
Commit: 34154ee
2026-06-04 23:52:35 +08:00
James Feng
7f4dcfbabf
feat(remote-control): 优化 Web 展示、状态同步与桥接控制流程 ( #288 )
...
Commit: 72a2093c
2026-06-04 23:51:54 +08:00
Cheng Zi Feng
d1176325a4
fix(remote-control): harden self-hosted session flows ( #278 )
...
Co-authored-by: chengzifeng <chengzifeng@meituan.com>
2026-06-04 23:50:24 +08:00
claude-code-best
2da6514095
feat: 支持自托管的 remote-control-server ( #214 )
...
* feat: 支持自托管的 remote-control-server (#214 )
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2026-04-09 17:40:50 +08:00
