mirror of
https://github.com/motiful/cc-gateway.git
synced 2026-08-28 18:53:10 +08:00
whiletrue0x
447fad19b2
Major overhaul for usability and security: - Client launcher (ccg): install/hijack/release/status/help subcommands, supports zsh/bash/fish, coexists with native claude - Auth via x-api-key header (matches how CC sends ANTHROPIC_API_KEY) - Strip billing header entirely instead of rewriting hash — eliminates detectable fingerprint and enables 99.98% prompt cache hit rate - Use existing access token on startup (zero network call), auto-refresh only when expired - Proxy support (HTTPS_PROXY/HTTP_PROXY) for outbound connections - Path rewriting scoped to <system-reminder> tags only — no longer corrupts user message content - Admin tooling: quick-setup.sh, admin-setup.sh, add-client.sh - Connection-level request logging - Docker healthcheck, TLS auto-generation for remote deployment - 16 tests passing, stale scripts removed, dead code cleaned up Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
79 lines
2.7 KiB
YAML
79 lines
2.7 KiB
YAML
# CC Gateway Configuration
|
|
# Copy to config.yaml and modify, or use: bash scripts/quick-setup.sh
|
|
|
|
server:
|
|
port: 8443
|
|
# TLS cert/key paths (required for remote deployment, not needed for localhost)
|
|
# Generate self-signed: openssl req -x509 -newkey rsa:2048 -keyout certs/key.pem -out certs/cert.pem -days 365 -nodes
|
|
# tls:
|
|
# cert: ./certs/cert.pem
|
|
# key: ./certs/key.pem
|
|
|
|
# Upstream Anthropic API
|
|
upstream:
|
|
url: https://api.anthropic.com
|
|
|
|
# OAuth - gateway manages token lifecycle centrally
|
|
# Extract credentials from macOS Keychain:
|
|
# security find-generic-password -a "$USER" -s "Claude Code-credentials" -w | python3 -c "import sys,json; d=json.load(sys.stdin)['claudeAiOauth']; print(f'access_token: {d[\"accessToken\"]}\nrefresh_token: {d[\"refreshToken\"]}\nexpires_at: {d[\"expiresAt\"]}')"
|
|
# Or just run: bash scripts/quick-setup.sh (extracts automatically)
|
|
oauth:
|
|
access_token: "your-access-token-here"
|
|
refresh_token: "your-refresh-token-here"
|
|
expires_at: 0
|
|
|
|
# Authentication - each client gets a unique token
|
|
# Generate tokens: bash scripts/add-client.sh <name>
|
|
auth:
|
|
tokens:
|
|
- name: machine-a
|
|
token: change-me-token-1
|
|
- name: machine-b
|
|
token: change-me-token-2
|
|
|
|
# Canonical identity - all clients will appear as this single device
|
|
# Generate a fresh identity: npm run generate-identity
|
|
identity:
|
|
device_id: "0000000000000000000000000000000000000000000000000000000000000000"
|
|
email: "user@example.com"
|
|
|
|
# Canonical environment fingerprint
|
|
# Should match a real machine's profile to look natural
|
|
env:
|
|
platform: darwin
|
|
platform_raw: darwin
|
|
arch: arm64
|
|
node_version: v24.3.0
|
|
terminal: iTerm2.app
|
|
package_managers: npm,pnpm
|
|
runtimes: node
|
|
is_running_with_bun: false
|
|
is_ci: false
|
|
is_claude_ai_auth: true
|
|
version: "2.1.81"
|
|
version_base: "2.1.81"
|
|
build_time: "2026-03-20T21:26:18Z"
|
|
deployment_environment: unknown-darwin
|
|
vcs: git
|
|
|
|
# System prompt environment masking
|
|
# These values replace the <env> block in the system prompt text.
|
|
# MUST be consistent with the env section above!
|
|
prompt_env:
|
|
platform: darwin # Must match env.platform
|
|
shell: zsh # Shell name shown in prompt
|
|
os_version: "Darwin 24.4.0" # uname -sr output
|
|
working_dir: /Users/jack/projects # Canonical home directory path prefix
|
|
|
|
# Canonical process metrics (should look like a real machine)
|
|
process:
|
|
constrained_memory: 34359738368 # 32GB - pick a realistic value
|
|
rss_range: [300000000, 500000000] # 300-500MB realistic range
|
|
heap_total_range: [40000000, 80000000]
|
|
heap_used_range: [100000000, 200000000]
|
|
|
|
# Logging
|
|
logging:
|
|
level: info # debug | info | warn | error
|
|
audit: true # log which client made each request
|