claude-code-workflow 6.3.18 → 6.3.20

package/ccw/src/config/litellm-api-config-manager.ts

@@ -3,7 +3,7 @@
  * Manages provider credentials, custom endpoints, and cache settings
  */
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'fs';
 import { homedir } from 'os';
 import { join } from 'path';
 import { StoragePaths, GlobalPaths, ensureStorageDir } from './storage-paths.js';
@@ -18,6 +18,10 @@ import type {
   CodexLensEmbeddingProvider,
   EmbeddingPoolConfig,
 } from '../types/litellm-api-config.js';
+import {
+  addClaudeApiEndpoint,
+  removeClaudeApiEndpoint
+} from '../tools/claude-cli-tools.js';
 
 /**
  * Default configuration
@@ -44,6 +48,14 @@ function getConfigPath(_baseDir?: string): string {
   return join(configDir, 'litellm-api-config.json');
 }
 
+function bestEffortRestrictPermissions(filePath: string, mode: number): void {
+  try {
+    chmodSync(filePath, mode);
+  } catch {
+    // Ignore permission errors (e.g., Windows or restrictive environments)
+  }
+}
+
 /**
  * Load configuration from file
  */
@@ -68,7 +80,8 @@ export function loadLiteLLMApiConfig(baseDir: string): LiteLLMApiConfig {
  */
 function saveConfig(baseDir: string, config: LiteLLMApiConfig): void {
   const configPath = getConfigPath(baseDir);
-  writeFileSync(configPath, JSON.stringify(config, null, 2), 'utf-8');
+  writeFileSync(configPath, JSON.stringify(config, null, 2), { encoding: 'utf8', mode: 0o600 });
+  bestEffortRestrictPermissions(configPath, 0o600);
 }
 
 /**
@@ -117,10 +130,26 @@ export function getProviderWithResolvedEnvVars(
   const provider = getProvider(baseDir, providerId);
   if (!provider) return null;
 
-  return {
+  const resolvedApiKey = resolveEnvVar(provider.apiKey);
+
+  // Avoid leaking env-var syntax or secrets if this object is logged/serialized.
+  const sanitizedProvider: ProviderCredential = {
     ...provider,
-    resolvedApiKey: resolveEnvVar(provider.apiKey),
+    apiKey: '***',
+    apiKeys: provider.apiKeys?.map(keyEntry => ({
+      ...keyEntry,
+      key: '***',
+    })),
   };
+
+  Object.defineProperty(sanitizedProvider, 'resolvedApiKey', {
+    value: resolvedApiKey,
+    enumerable: false,
+    writable: false,
+    configurable: false,
+  });
+
+  return sanitizedProvider as ProviderCredential & { resolvedApiKey: string };
 }
 
 /**
@@ -245,6 +274,20 @@ export function addEndpoint(
   config.endpoints.push(endpoint);
   saveConfig(baseDir, config);
 
+  // Sync to cli-tools.json as api-endpoint type
+  // Usage: ccw cli -p "..." --tool <endpoint-id>
+  try {
+    addClaudeApiEndpoint(homedir(), {
+      id: endpoint.id,
+      name: endpoint.id,  // Use endpoint ID as tool name for CLI access
+      enabled: endpoint.enabled !== false
+    });
+    console.log(`[LiteLLM Config] Synced endpoint ${endpoint.id} to cli-tools.json (api-endpoint)`);
+  } catch (syncError) {
+    console.warn(`[LiteLLM Config] Failed to sync endpoint to cli-tools.json: ${syncError}`);
+    // Non-fatal: continue even if sync fails
+  }
+
   return endpoint;
 }
 
@@ -275,7 +318,21 @@ export function updateEndpoint(
   };
 
   saveConfig(baseDir, config);
-  return config.endpoints[endpointIndex];
+
+  // Sync enabled status to cli-tools.json
+  const updatedEndpoint = config.endpoints[endpointIndex];
+  try {
+    addClaudeApiEndpoint(homedir(), {
+      id: updatedEndpoint.id,
+      name: updatedEndpoint.id,
+      enabled: updatedEndpoint.enabled !== false
+    });
+    console.log(`[LiteLLM Config] Synced endpoint ${updatedEndpoint.id} update to cli-tools.json`);
+  } catch (syncError) {
+    console.warn(`[LiteLLM Config] Failed to sync endpoint update to cli-tools.json: ${syncError}`);
+  }
+
+  return updatedEndpoint;
 }
 
 /**
@@ -297,6 +354,15 @@ export function deleteEndpoint(baseDir: string, endpointId: string): boolean {
   }
 
   saveConfig(baseDir, config);
+
+  // Remove from cli-tools.json
+  try {
+    removeClaudeApiEndpoint(homedir(), endpointId);
+    console.log(`[LiteLLM Config] Removed endpoint ${endpointId} from cli-tools.json`);
+  } catch (syncError) {
+    console.warn(`[LiteLLM Config] Failed to remove endpoint from cli-tools.json: ${syncError}`);
+  }
+
   return true;
 }
 
@@ -479,18 +545,34 @@ export function getEmbeddingProvidersForRotation(baseDir: string): Array<{
 }
 
 /**
- * Generate rotation endpoints for ccw_litellm
- * Creates endpoint list from rotation config for parallel embedding
- * Supports both legacy codexlensEmbeddingRotation and new embeddingPoolConfig
+ * Extended rotation endpoint with routing and health check info
  */
-export function generateRotationEndpoints(baseDir: string): Array<{
+export interface RotationEndpointConfig {
   name: string;
   api_key: string;
   api_base: string;
   model: string;
   weight: number;
   max_concurrent: number;
-}> {
+  /** Routing strategy for load balancing */
+  routing_strategy?: string;
+  /** Health check configuration */
+  health_check?: {
+    enabled: boolean;
+    interval_seconds: number;
+    cooldown_seconds: number;
+    failure_threshold: number;
+  };
+  /** Last recorded latency in milliseconds */
+  last_latency_ms?: number;
+}
+
+/**
+ * Generate rotation endpoints for ccw_litellm
+ * Creates endpoint list from rotation config for parallel embedding
+ * Supports both legacy codexlensEmbeddingRotation and new embeddingPoolConfig
+ */
+export function generateRotationEndpoints(baseDir: string): RotationEndpointConfig[] {
   const config = loadLiteLLMApiConfig(baseDir);
 
   // Prefer embeddingPoolConfig, fallback to codexlensEmbeddingRotation for backward compatibility
@@ -517,22 +599,8 @@ function generateEndpointsFromPool(
   baseDir: string,
   poolConfig: EmbeddingPoolConfig,
   config: LiteLLMApiConfig
-): Array<{
-  name: string;
-  api_key: string;
-  api_base: string;
-  model: string;
-  weight: number;
-  max_concurrent: number;
-}> {
-  const endpoints: Array<{
-    name: string;
-    api_key: string;
-    api_base: string;
-    model: string;
-    weight: number;
-    max_concurrent: number;
-  }> = [];
+): RotationEndpointConfig[] {
+  const endpoints: RotationEndpointConfig[] = [];
 
   if (poolConfig.autoDiscover) {
     // Auto-discover all providers offering targetModel
@@ -560,10 +628,20 @@ function generateEndpointsFromPool(
       let keysToUse: Array<{ id: string; key: string; label: string }> = [];
 
       if (provider.apiKeys && provider.apiKeys.length > 0) {
-        // Use all enabled keys
-        keysToUse = provider.apiKeys
-          .filter(k => k.enabled)
-          .map(k => ({ id: k.id, key: k.key, label: k.label || k.id }));
+        // Use all enabled and healthy keys (filter out unhealthy)
+        const healthyKeys = provider.apiKeys.filter(k =>
+          k.enabled && k.healthStatus !== 'unhealthy'
+        );
+
+        // Log filtered keys for debugging
+        const unhealthyCount = provider.apiKeys.filter(k =>
+          k.enabled && k.healthStatus === 'unhealthy'
+        ).length;
+        if (unhealthyCount > 0) {
+          console.log(`[RotationEndpoints] Filtered ${unhealthyCount} unhealthy key(s) from provider ${provider.name}`);
+        }
+
+        keysToUse = healthyKeys.map(k => ({ id: k.id, key: k.key, label: k.label || k.id }));
       } else if (provider.apiKey) {
         // Single key fallback
         keysToUse = [{ id: 'default', key: provider.apiKey, label: 'Default' }];
@@ -571,14 +649,37 @@ function generateEndpointsFromPool(
 
       // Create endpoint for each key
       for (const keyInfo of keysToUse) {
-        endpoints.push({
+        const endpoint: RotationEndpointConfig = {
           name: `${provider.name}-${keyInfo.label}`,
           api_key: resolveEnvVar(keyInfo.key),
           api_base: apiBase,
           model: embeddingModel.name,
           weight: 1.0, // Default weight for auto-discovered providers
           max_concurrent: poolConfig.defaultMaxConcurrentPerKey,
-        });
+        };
+
+        // Add routing strategy from provider config
+        if (provider.routingStrategy) {
+          endpoint.routing_strategy = provider.routingStrategy;
+        }
+
+        // Add health check config from provider
+        if (provider.healthCheck) {
+          endpoint.health_check = {
+            enabled: provider.healthCheck.enabled,
+            interval_seconds: provider.healthCheck.intervalSeconds,
+            cooldown_seconds: provider.healthCheck.cooldownSeconds,
+            failure_threshold: provider.healthCheck.failureThreshold,
+          };
+        }
+
+        // Add last latency if available from key entry
+        const keyEntry = provider.apiKeys?.find(k => k.id === keyInfo.id);
+        if (keyEntry && keyEntry.lastLatencyMs !== undefined) {
+          endpoint.last_latency_ms = keyEntry.lastLatencyMs;
+        }
+
+        endpoints.push(endpoint);
       }
     }
   }
@@ -593,22 +694,8 @@ function generateEndpointsFromLegacyRotation(
   baseDir: string,
   rotationConfig: CodexLensEmbeddingRotation,
   config: LiteLLMApiConfig
-): Array<{
-  name: string;
-  api_key: string;
-  api_base: string;
-  model: string;
-  weight: number;
-  max_concurrent: number;
-}> {
-  const endpoints: Array<{
-    name: string;
-    api_key: string;
-    api_base: string;
-    model: string;
-    weight: number;
-    max_concurrent: number;
-  }> = [];
+): RotationEndpointConfig[] {
+  const endpoints: RotationEndpointConfig[] = [];
 
   for (const rotationProvider of rotationConfig.providers) {
     if (!rotationProvider.enabled) continue;
@@ -630,15 +717,26 @@ function generateEndpointsFromLegacyRotation(
     let keysToUse: Array<{ id: string; key: string; label: string }> = [];
 
     if (provider.apiKeys && provider.apiKeys.length > 0) {
+      // Filter out unhealthy keys first
+      const healthyKeys = provider.apiKeys.filter(k =>
+        k.enabled && k.healthStatus !== 'unhealthy'
+      );
+
+      // Log filtered keys for debugging
+      const unhealthyCount = provider.apiKeys.filter(k =>
+        k.enabled && k.healthStatus === 'unhealthy'
+      ).length;
+      if (unhealthyCount > 0) {
+        console.log(`[RotationEndpoints] Filtered ${unhealthyCount} unhealthy key(s) from provider ${provider.name}`);
+      }
+
       if (rotationProvider.useAllKeys) {
-        // Use all enabled keys
-        keysToUse = provider.apiKeys
-          .filter(k => k.enabled)
-          .map(k => ({ id: k.id, key: k.key, label: k.label || k.id }));
+        // Use all enabled and healthy keys
+        keysToUse = healthyKeys.map(k => ({ id: k.id, key: k.key, label: k.label || k.id }));
       } else if (rotationProvider.selectedKeyIds && rotationProvider.selectedKeyIds.length > 0) {
-        // Use only selected keys
-        keysToUse = provider.apiKeys
-          .filter(k => k.enabled && rotationProvider.selectedKeyIds!.includes(k.id))
+        // Use only selected healthy keys
+        keysToUse = healthyKeys
+          .filter(k => rotationProvider.selectedKeyIds!.includes(k.id))
           .map(k => ({ id: k.id, key: k.key, label: k.label || k.id }));
       }
     } else if (provider.apiKey) {
@@ -648,14 +746,37 @@ function generateEndpointsFromLegacyRotation(
 
     // Create endpoint for each key
     for (const keyInfo of keysToUse) {
-      endpoints.push({
+      const endpoint: RotationEndpointConfig = {
         name: `${provider.name}-${keyInfo.label}`,
         api_key: resolveEnvVar(keyInfo.key),
         api_base: apiBase,
         model: embeddingModel.name,
         weight: rotationProvider.weight,
         max_concurrent: rotationProvider.maxConcurrentPerKey,
-      });
+      };
+
+      // Add routing strategy from provider config
+      if (provider.routingStrategy) {
+        endpoint.routing_strategy = provider.routingStrategy;
+      }
+
+      // Add health check config from provider
+      if (provider.healthCheck) {
+        endpoint.health_check = {
+          enabled: provider.healthCheck.enabled,
+          interval_seconds: provider.healthCheck.intervalSeconds,
+          cooldown_seconds: provider.healthCheck.cooldownSeconds,
+          failure_threshold: provider.healthCheck.failureThreshold,
+        };
+      }
+
+      // Add last latency if available from key entry
+      const keyEntry = provider.apiKeys?.find(k => k.id === keyInfo.id);
+      if (keyEntry && keyEntry.lastLatencyMs !== undefined) {
+        endpoint.last_latency_ms = keyEntry.lastLatencyMs;
+      }
+
+      endpoints.push(endpoint);
     }
   }
 
@@ -1008,5 +1129,219 @@ function objectToYaml(obj: unknown, indent: number = 0): string {
   return String(obj);
 }
 
+// ===========================
+// Multi-Model Pool Management
+// ===========================
+
+/**
+ * Migrate legacy embeddingPoolConfig to new modelPools array
+ * This function ensures backward compatibility with existing configurations
+ */
+function migrateEmbeddingPoolToModelPools(config: LiteLLMApiConfig): void {
+  // Skip if already has modelPools or no legacy config
+  if (config.modelPools && config.modelPools.length > 0) return;
+  if (!config.embeddingPoolConfig) return;
+
+  // Convert legacy embeddingPoolConfig to ModelPoolConfig
+  const legacyPool = config.embeddingPoolConfig;
+  const modelPool: import('../types/litellm-api-config.js').ModelPoolConfig = {
+    id: `pool-embedding-${Date.now()}`,
+    modelType: 'embedding',
+    enabled: legacyPool.enabled,
+    targetModel: legacyPool.targetModel,
+    strategy: legacyPool.strategy,
+    autoDiscover: legacyPool.autoDiscover,
+    excludedProviderIds: legacyPool.excludedProviderIds || [],
+    defaultCooldown: legacyPool.defaultCooldown,
+    defaultMaxConcurrentPerKey: legacyPool.defaultMaxConcurrentPerKey,
+    name: `Embedding Pool - ${legacyPool.targetModel}`,
+    description: 'Migrated from legacy embeddingPoolConfig',
+  };
+
+  config.modelPools = [modelPool];
+  // Keep legacy config for backward compatibility with old CodexLens versions
+}
+
+/**
+ * Get all model pool configurations
+ * Returns empty array if no pools configured
+ */
+export function getModelPools(baseDir: string): import('../types/litellm-api-config.js').ModelPoolConfig[] {
+  const config = loadLiteLLMApiConfig(baseDir);
+  
+  // Auto-migrate if needed
+  migrateEmbeddingPoolToModelPools(config);
+  
+  return config.modelPools || [];
+}
+
+/**
+ * Get a specific model pool by ID
+ */
+export function getModelPool(
+  baseDir: string,
+  poolId: string
+): import('../types/litellm-api-config.js').ModelPoolConfig | undefined {
+  const pools = getModelPools(baseDir);
+  return pools.find(p => p.id === poolId);
+}
+
+/**
+ * Add a new model pool configuration
+ */
+export function addModelPool(
+  baseDir: string,
+  poolConfig: Omit<import('../types/litellm-api-config.js').ModelPoolConfig, 'id'>
+): { poolId: string; syncResult?: { success: boolean; message: string; endpointCount?: number } } {
+  const config = loadLiteLLMApiConfig(baseDir);
+  
+  // Auto-migrate if needed
+  migrateEmbeddingPoolToModelPools(config);
+  
+  // Ensure modelPools array exists
+  if (!config.modelPools) {
+    config.modelPools = [];
+  }
+
+  // Generate unique ID
+  const poolId = `pool-${poolConfig.modelType}-${Date.now()}`;
+  
+  const newPool: import('../types/litellm-api-config.js').ModelPoolConfig = {
+    ...poolConfig,
+    id: poolId,
+  };
+
+  config.modelPools.push(newPool);
+  saveConfig(baseDir, config);
+
+  // Sync to CodexLens if this is an embedding pool
+  const syncResult = poolConfig.modelType === 'embedding' && poolConfig.enabled
+    ? syncCodexLensConfig(baseDir)
+    : undefined;
+
+  return { poolId, syncResult };
+}
+
+/**
+ * Update an existing model pool configuration
+ */
+export function updateModelPool(
+  baseDir: string,
+  poolId: string,
+  updates: Partial<Omit<import('../types/litellm-api-config.js').ModelPoolConfig, 'id'>>
+): { success: boolean; syncResult?: { success: boolean; message: string; endpointCount?: number } } {
+  const config = loadLiteLLMApiConfig(baseDir);
+  
+  // Auto-migrate if needed
+  migrateEmbeddingPoolToModelPools(config);
+  
+  if (!config.modelPools) {
+    return { success: false };
+  }
+
+  const poolIndex = config.modelPools.findIndex(p => p.id === poolId);
+  if (poolIndex === -1) {
+    return { success: false };
+  }
+
+  // Apply updates
+  config.modelPools[poolIndex] = {
+    ...config.modelPools[poolIndex],
+    ...updates,
+  };
+
+  saveConfig(baseDir, config);
+
+  // Sync to CodexLens if this is an enabled embedding pool
+  const pool = config.modelPools[poolIndex];
+  const syncResult = pool.modelType === 'embedding' && pool.enabled
+    ? syncCodexLensConfig(baseDir)
+    : undefined;
+
+  return { success: true, syncResult };
+}
+
+/**
+ * Delete a model pool configuration
+ */
+export function deleteModelPool(
+  baseDir: string,
+  poolId: string
+): { success: boolean; syncResult?: { success: boolean; message: string; endpointCount?: number } } {
+  const config = loadLiteLLMApiConfig(baseDir);
+  
+  if (!config.modelPools) {
+    return { success: false };
+  }
+
+  const poolIndex = config.modelPools.findIndex(p => p.id === poolId);
+  if (poolIndex === -1) {
+    return { success: false };
+  }
+
+  const deletedPool = config.modelPools[poolIndex];
+  config.modelPools.splice(poolIndex, 1);
+  
+  saveConfig(baseDir, config);
+
+  // Sync to CodexLens if we deleted an embedding pool
+  const syncResult = deletedPool.modelType === 'embedding'
+    ? syncCodexLensConfig(baseDir)
+    : undefined;
+
+  return { success: true, syncResult };
+}
+
+/**
+ * Get available models for a specific model type
+ * Used for pool configuration UI
+ */
+export function getAvailableModelsForType(
+  baseDir: string,
+  modelType: import('../types/litellm-api-config.js').ModelPoolType
+): Array<{ modelId: string; modelName: string; providers: string[] }> {
+  const config = loadLiteLLMApiConfig(baseDir);
+  const availableModels: Array<{ modelId: string; modelName: string; providers: string[] }> = [];
+  const modelMap = new Map<string, { modelId: string; modelName: string; providers: string[] }>();
+
+  for (const provider of config.providers) {
+    if (!provider.enabled) continue;
+
+    let models: typeof provider.embeddingModels | undefined;
+    
+    switch (modelType) {
+      case 'embedding':
+        models = provider.embeddingModels;
+        break;
+      case 'llm':
+        models = provider.llmModels;
+        break;
+      case 'reranker':
+        models = provider.rerankerModels;
+        break;
+    }
+
+    if (!models) continue;
+
+    for (const model of models) {
+      if (!model.enabled) continue;
+
+      const key = model.id;
+      if (modelMap.has(key)) {
+        modelMap.get(key)!.providers.push(provider.name);
+      } else {
+        modelMap.set(key, {
+          modelId: model.id,
+          modelName: model.name,
+          providers: [provider.name],
+        });
+      }
+    }
+  }
+
+  availableModels.push(...Array.from(modelMap.values()));
+  return availableModels;
+}
+
 // Re-export types
 export type { ProviderCredential, CustomEndpoint, ProviderType, CacheStrategy, CodexLensEmbeddingRotation, CodexLensEmbeddingProvider, EmbeddingPoolConfig };

package/ccw/src/core/auth/csrf-manager.ts

@@ -0,0 +1,104 @@
+import { randomBytes } from 'crypto';
+
+export interface CsrfTokenManagerOptions {
+  tokenTtlMs?: number;
+  cleanupIntervalMs?: number;
+}
+
+type CsrfTokenRecord = {
+  sessionId: string;
+  expiresAtMs: number;
+  used: boolean;
+};
+
+const DEFAULT_TOKEN_TTL_MS = 15 * 60 * 1000; // 15 minutes
+const DEFAULT_CLEANUP_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes
+
+export class CsrfTokenManager {
+  private readonly tokenTtlMs: number;
+  private readonly records = new Map<string, CsrfTokenRecord>();
+  private readonly cleanupTimer: NodeJS.Timeout | null;
+
+  constructor(options: CsrfTokenManagerOptions = {}) {
+    this.tokenTtlMs = options.tokenTtlMs ?? DEFAULT_TOKEN_TTL_MS;
+
+    const cleanupIntervalMs = options.cleanupIntervalMs ?? DEFAULT_CLEANUP_INTERVAL_MS;
+    if (cleanupIntervalMs > 0) {
+      this.cleanupTimer = setInterval(() => {
+        this.cleanupExpiredTokens();
+      }, cleanupIntervalMs);
+
+      if (this.cleanupTimer.unref) {
+        this.cleanupTimer.unref();
+      }
+    } else {
+      this.cleanupTimer = null;
+    }
+  }
+
+  dispose(): void {
+    if (this.cleanupTimer) {
+      clearInterval(this.cleanupTimer);
+    }
+    this.records.clear();
+  }
+
+  generateToken(sessionId: string): string {
+    const token = randomBytes(32).toString('hex');
+    this.records.set(token, {
+      sessionId,
+      expiresAtMs: Date.now() + this.tokenTtlMs,
+      used: false,
+    });
+    return token;
+  }
+
+  validateToken(token: string, sessionId: string): boolean {
+    const record = this.records.get(token);
+    if (!record) return false;
+    if (record.used) return false;
+    if (record.sessionId !== sessionId) return false;
+
+    if (Date.now() > record.expiresAtMs) {
+      this.records.delete(token);
+      return false;
+    }
+
+    record.used = true;
+    return true;
+  }
+
+  cleanupExpiredTokens(nowMs: number = Date.now()): number {
+    let removed = 0;
+
+    for (const [token, record] of this.records.entries()) {
+      if (record.used || nowMs > record.expiresAtMs) {
+        this.records.delete(token);
+        removed += 1;
+      }
+    }
+
+    return removed;
+  }
+
+  getActiveTokenCount(): number {
+    return this.records.size;
+  }
+}
+
+let csrfManagerInstance: CsrfTokenManager | null = null;
+
+export function getCsrfTokenManager(options?: CsrfTokenManagerOptions): CsrfTokenManager {
+  if (!csrfManagerInstance) {
+    csrfManagerInstance = new CsrfTokenManager(options);
+  }
+  return csrfManagerInstance;
+}
+
+export function resetCsrfTokenManager(): void {
+  if (csrfManagerInstance) {
+    csrfManagerInstance.dispose();
+  }
+  csrfManagerInstance = null;
+}
+