Commit Graph

32 Commits

Author SHA1 Message Date
Kevin Codex
5ef79546e9 test: stabilize suite and add coverage heatmap (#373)
* test: stabilize suite and add coverage heatmap

* ci: run full bun test suite in pr checks
2026-04-05 12:44:54 +08:00
Vasanth T
4c3118e071 fix: harden execFileNoThrow for CodeQL (#338) 2026-04-04 21:39:54 +08:00
KRATOS
27e6505bfd hardening: isolate third-party paths and clean external-build metadata (#311)
* hardening: isolate third-party paths and clean external-build metadata

* fix: restore external feedback flow and make privacy check portable
2026-04-04 14:22:33 +08:00
KRATOS
c52245fc0a fix: restore image paste and image tool-result handling (#308) 2026-04-04 14:10:26 +08:00
Meetpatel006
e5c9a6f629 Enable Free DDG WebSearch For Non-Claude Models (#234)
* added duck duck go for websearch tools that allowed free searching

* update readme

* Replace @phukon/duckduckgo-search with duck-duck-scrape and fix Firecrawl routing priority, and add DDG error handling

* refactor: streamline DuckDuckGo search fallback to use Firecrawl directly on rate limit

* docs: update README to clarify DuckDuckGo web search fallback and its limitations with TOS
2026-04-04 09:21:54 +08:00
Vasanth T
6181050811 chore: patch dependabot vulnerabilities (#225) 2026-04-03 11:34:09 +08:00
Mikey
7bd7d0f54d security: pin @mendable/firecrawl-js to exact version
Pins @mendable/firecrawl-js from ^4.18.1 to 4.18.1, consistent with
the pinning policy established in #102.
2026-04-02 11:07:54 -07:00
Leonardo Grigorio
ac4efae870 feat: add Firecrawl backend for WebSearch and WebFetch tools
WebSearch is currently disabled for all non-Anthropic providers (OpenAI
shim, DeepSeek, Ollama, etc.) because those providers have no native
search backend. This adds Firecrawl as a fallback that activates when
FIRECRAWL_API_KEY is set, unlocking web search for every model
openclaude supports.

WebFetch uses basic HTTP + Turndown for HTML-to-markdown conversion,
which fails silently on JS-rendered SPAs and bot-protected pages.
Firecrawl scrape replaces the fetch layer when FIRECRAWL_API_KEY is set,
returning clean markdown that handles dynamic content correctly.

Changes:
- WebSearchTool: add runFirecrawlSearch() using @mendable/firecrawl-js,
  respects allowed_domains (post-filter) and blocked_domains (-site: operators),
  includes result snippets alongside links. shouldUseFirecrawl() ensures
  firstParty/Vertex/Foundry/Codex providers keep their native backends.
- WebFetchTool: add scrapeWithFirecrawl(), drops into the existing
  applyPromptToMarkdown() pipeline so prompt processing is unchanged.
- Remove "Web search is only available in the US" restriction from
  prompt when Firecrawl is active (it works globally).
2026-04-02 12:18:20 -03:00
Kevin Codex
3353101e83 chore: release 0.1.7 2026-04-02 22:07:28 +08:00
Kevin Codex
903a30916a Merge pull request #107 from rithulkamesh/main
feat: GitHub Models provider + interactive onboard (keychain-backed)
2026-04-02 20:14:51 +08:00
Kevin Codex
6b7c0e5339 Merge pull request #74 from Vect0rM/feature/atomic-chat-integration
feat: add support for Atomic Chat provider
2026-04-02 20:13:37 +08:00
Misha Skvortsov
577e654ae7 feat: add support for Atomic Chat provider
- Introduced a new provider profile for Atomic Chat, allowing it to be used alongside existing providers.
- Updated `package.json` to include a new development script for launching Atomic Chat.
- Modified `smart_router.py` to recognize Atomic Chat as a local provider that does not require an API key.
- Enhanced provider discovery and launch scripts to handle Atomic Chat, including model listing and connection checks.
- Added tests to ensure proper environment setup and behavior for Atomic Chat profiles.

This update expands the functionality of the application to support local LLMs via Atomic Chat, improving versatility for users.
2026-04-02 10:37:54 +03:00
Rithul Kamesh
f07f11b7b6 fix: use bun test for provider-recommendation script to resolve module errors 2026-04-02 12:53:56 +05:30
Mikey
5f75f67a27 security: pin all dependencies to exact versions
Removes caret (^) ranges from all 74 dependencies in package.json,
locking each to the exact version resolved in bun.lock.

Motivation: the axios supply chain attack of March 31 2026 demonstrated
that caret ranges are a live attack vector. axios@^1.14.0 would have
resolved to the trojanized 1.14.1 (bundled plain-crypto-js RAT, C2
sfrclak.com). Both 1.14.1 and 0.30.4 were unpublished within 24h.

Key pins:
  axios      ^1.14.0  → 1.14.0   (trojanized 1.14.1 blocked)
  undici     ^7.3.0   → 7.24.6   (7 CVEs between 7.3 and 7.24)
  yaml       ^2.7.0   → 2.8.3    (CVE-2026-33532 fix)
  ajv        ^8.17.0  → 8.18.0   (ReDoS fix)
  lodash-es  ^4.17.21 → 4.17.23  (prototype pollution fix)
  zod        ^3.24.0  → 3.25.76  (large range locked)

All 74 deps verified: integrity hashes match npm registry, no known
supply chain incidents, no postinstall scripts in lockfile.
2026-04-01 21:29:42 -07:00
Kevin Codex
cb8973e99b chore: release 0.1.6 2026-04-02 11:18:21 +08:00
Kevin Codex
8645dc4cce bump version 2026-04-02 09:39:44 +08:00
Vasanthdev2004
7ef085c605 test: cover deepseek max token limits 2026-04-01 19:17:58 +05:30
Vasanthdev2004
ce45bd080e Merge origin/main into provider-profile-recommendations 2026-04-01 18:38:59 +05:30
Kevin Codex
0192dc0fa0 Merge pull request #21 from gnanam1990/fix/openai-stream-duplicate-response
fix: prevent duplicate responses in OpenAI streaming
2026-04-01 20:57:52 +08:00
Kevin Codex
e7c600de3b chore: release 0.1.4 2026-04-01 20:10:12 +08:00
gnanam1990
a3d8ab0fec feat: add native Gemini provider for Google AI models
Adds Google Gemini as a first-class provider using Gemini's OpenAI-compatible
endpoint, supporting gemini-2.0-flash, gemini-2.5-pro, and gemini-2.0-flash-lite
across all three model tiers (opus/sonnet/haiku).

- Add 'gemini' to APIProvider type with CLAUDE_CODE_USE_GEMINI env detection
- Map all 11 model configs to appropriate Gemini models per tier
- Route Gemini through existing OpenAI shim (generativelanguage.googleapis.com)
- Support GEMINI_API_KEY and GOOGLE_API_KEY for authentication
- Fix model display name to show actual Gemini model instead of Claude fallback
- Add Gemini support to provider-launch, provider-bootstrap, system-check scripts
- Add dev:gemini npm script for local development

Bootstrap: bun run profile:init -- --provider gemini --api-key <key>
Launch: bun run dev:gemini

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 17:38:30 +05:30
Vasanthdev2004
f51cd3aa15 Merge origin/main into codex/provider-profile-recommendations
Preserve provider recommendation workflows while integrating Codex profile support, safer launch isolation, and updated docs/scripts from upstream main.
2026-04-01 17:33:07 +05:30
vp
cbeed0f76f Add Codex plan/spark provider support 2026-04-01 10:44:35 +03:00
Vasanthdev2004
8fe03cba57 fix: harden provider recommendation safety 2026-04-01 11:55:24 +05:30
Vasanthdev2004
174eb8ad3b feat: add intelligent provider profile recommendation 2026-04-01 11:16:49 +05:30
Kevin
c957d495ac fix: prevent interactive stream crash on node removal 2026-04-01 11:23:47 +08:00
Kevin
ba5e1f07af fix: suppress OpenAI startup warning and account banner 2026-04-01 11:02:56 +08:00
Kevin
958f8c1869 chore: publish @gitlawb/openclaude package 2026-04-01 10:52:59 +08:00
Reservieren
e69cf0917e feat: enhance provider-launch script with fast mode and improved argument parsing 2026-03-31 22:12:00 -03:00
Reservieren
009c29d318 refactor: update import paths for react/compiler-runtime to react-compiler-runtime
feat: add OpenClaude local agent playbook for setup and usage instructions

chore: implement provider bootstrap script for profile initialization

chore: create provider launch script to manage provider execution

chore: add system check script for runtime diagnostics and validation

feat: implement useEffectEventCompat hook for React 18 compatibility
2026-03-31 22:09:56 -03:00
Kevin
747be9c2f3 fix: restore interactive OpenAI REPL startup 2026-04-01 05:16:40 +08:00
did:key:z6MkqDnb7Siv3Cwj7pGJq4T5EsUisECqR8KpnDLwcaZq5TPr
3e652cafdf feat: add build system, stubs, and npm packaging — openclaude is now runnable
- package.json with all 70+ dependencies
- Bun build script with feature flag shims, native module stubs, otel externals
- Stubs for ~15 missing source files (snapshot gaps)
- tsconfig.json for TypeScript
- bin/openclaude entry point
- Builds to single 19MB dist/cli.mjs
- Verified: --version and --help work

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-01 02:36:07 +08:00