Refactor/plugin

.ccproxy.toml

@@ -0,0 +1,74 @@
+# Enable local plugin discovery so in-tree plugins are loaded from ./plugins
+plugins_disable_local_discovery = false
+# disabled_plugins = ["docker"]
+
+# Logging configuration
+[logging]
+level = "INFO"
+format = "auto"
+file = "/tmp/ccproxy/ccproxy.log"
+verbose_api = false
+enable_plugin_logging = true
+plugin_log_base_dir = "/tmp/ccproxy"
+
+# Per-plugin logging overrides
+[logging.plugin_overrides]
+request_tracer = true
+access_log = true
+pricing = true
+permissions = true
+
+# Request Tracer plugin configuration
+[plugins.request_tracer]
+enabled = true
+log_dir = "/tmp/ccproxy/tracer"
+json_logs_enabled = true
+verbose_api = true
+log_client_request = true
+log_client_response = true
+
+# Access Log plugin configuration
+[plugins.access_log]
+enabled = true
+client_enabled = true
+client_format = "combined"                             # Options: combined, common, structured
+client_log_file = "/tmp/ccproxy/combined_access.log"
+provider_enabled = false
+provider_format = "structured"
+provider_log_file = "/tmp/ccproxy/provider_access.log"
+exclude_paths = ["/health", "/metrics", "/logs"]
+buffer_size = 100
+flush_interval = 1.0
+
+[plugins.claude_api]
+enabled = true
+
+[plugins.codex]
+enabled = true
+
+[plugins.claude_sdk]
+enabled = true
+# default_session_id = "default-session"  # Commented out - should be None for normal operations
+
+[plugins.claude_sdk.sdk_session_pool]
+enabled = true
+session_ttl = 3600
+max_sessions = 1000
+
+[plugins.permissions]
+enabled = false
+
+# DuckDB storage and analytics plugins
+[plugins.duckdb_storage]
+enabled = false
+database_path = "/tmp/ccproxy/metrics.duckdb"
+register_app_state_alias = true
+
+[plugins.analytics]
+enabled = true
+
+[plugins.docker]
+enabled = false
+
+[plugins.command_replay]
+enabled = true

.env.example

@@ -6,7 +6,14 @@ ANTHROPIC_API_KEY=your_anthropic_api_key_here
 # Optional: Server Configuration
 HOST=0.0.0.0
 PORT=8000
-LOG_LEVEL=INFO
+
+# Optional: Logging Configuration (centralized)
+LOGGING__LEVEL=INFO
+LOGGING__FORMAT=auto
+LOGGING__FILE=/tmp/ccproxy/ccproxy.log
+LOGGING__VERBOSE_API=false
+LOGGING__ENABLE_PLUGIN_LOGGING=true
+LOGGING__PLUGIN_LOG_BASE_DIR=/tmp/ccproxy
 
 # Optional: Security Configuration
 CLAUDE_USER=claude
@@ -27,5 +34,6 @@ RATE_LIMIT_WINDOW=60
 # Optional: Request Timeout
 REQUEST_TIMEOUT=300
 
-# Optional: CORS Origins (comma-separated)
-CORS_ORIGINS=*
+# Optional: CORS Origins (comma-separated, avoid using '*' for security)
+# Examples: http://localhost:3000,https://app.example.com
+CORS_ORIGINS=http://localhost:3000,http://localhost:8080,http://127.0.0.1:3000,http://127.0.0.1:8080

.github/workflows/ci.yml

@@ -2,43 +2,87 @@ name: CI
 
 on:
   push:
-    branches: [main, develop]
+    branches: [ main, dev ]
   pull_request:
-    branches: [main, develop]
+    branches: [ main, dev ]
 
 jobs:
-  test:
+  boundaries:
+    name: Import Boundaries
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: ["3.11", "3.12", "3.13"]
-
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@v4
 
-      - uses: oven-sh/setup-bun@v2
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
 
-      - name: Install uv
+      - name: Setup uv
         uses: astral-sh/setup-uv@v3
         with:
           enable-cache: true
-
-      - name: Set up Python ${{ matrix.python-version }}
-        run: uv python install ${{ matrix.python-version }}
+          cache-dependency-path: |
+            uv.lock
 
       - name: Install dependencies
-        run: make dev-install
+        run: uv sync --all-extras --dev
+
+      - name: Run boundary checks
+        run: make check-boundaries
 
-      - name: Run CI pipeline
-        run: make ci
+  lint:
+    name: Lint (ruff)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - uses: astral-sh/setup-uv@v3
+        with:
+          enable-cache: true
+          cache-dependency-path: |
+            uv.lock
+      - name: Install deps
+        run: uv sync --all-extras --dev
+      - name: Ruff check
+        run: uv run ruff check .
 
-      - name: Build documentation
-        run: make docs-build
+  typecheck:
+    name: Typecheck (mypy)
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - uses: astral-sh/setup-uv@v3
+        with:
+          enable-cache: true
+          cache-dependency-path: |
+            uv.lock
+      - name: Install deps
+        run: uv sync --all-extras --dev
+      - name: mypy
+        run: uv run mypy .
 
-      - name: Upload coverage reports
-        uses: codecov/codecov-action@v4
+  tests:
+    name: Unit Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
         with:
-          file: ./coverage.xml
-          flags: unittests
-          name: codecov-umbrella
-          fail_ci_if_error: false
+          python-version: '3.11'
+      - uses: astral-sh/setup-uv@v3
+        with:
+          enable-cache: true
+          cache-dependency-path: |
+            uv.lock
+      - name: Install deps
+        run: uv sync --all-extras --dev
+      - name: Run unit tests (no network)
+        run: uv run pytest tests/unit -m "not real_api" --durations=10 -q

.gitignore

@@ -163,3 +163,4 @@ ccproxy/static/dashboard/
 
 *.wal
 *.duckdb
+.lazy.lua

.pre-commit-config.yaml

@@ -1,4 +1,13 @@
 repos:
+  # Import boundary check: prevent core -> plugins.* imports
+  - repo: local
+    hooks:
+      - id: check-import-boundaries
+        name: check import boundaries (core must not import plugins)
+        entry: python3 scripts/check_import_boundaries.py
+        language: system
+        pass_filenames: false
+        files: ^ccproxy/
   # Ruff linting and formatting
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.12.8
@@ -24,6 +33,8 @@ repos:
           # Type stubs
           # - types-toml
           # - types-PyYAML
+          - types-aiofiles>=24.0.0
+          - types-PyYAML>=6.0.12.12
           # Core dependencies
           - pydantic>=2.8.0
           - pydantic-settings>=2.4.0
@@ -35,6 +46,8 @@ repos:
           - typer>=0.16.0
           - uvicorn>=0.34.0
           - check-jsonschema>=0.33.2
+          - aiohttp>=3.12.0
+          - aiofiles>=24.1.0
           # Test dependencies
           - pytest>=7.0.0
           - pytest-asyncio>=0.23.0
@@ -49,18 +62,16 @@ repos:
           - claude-code-sdk>=0.0.14
           - keyring>=24.0.0
           - aiosqlite>=0.21.0
-          - types-PyYAML>=6.0.12.12
           - sqlmodel>=0.0.24
           - duckdb-engine>=0.17.0
           - tomli>=2.0.0
           - fastapi-mcp>=0.1.0
           - sse-starlette>=1.0.0
           - textual>=3.7.1
-          - aiofiles>=24.1.0
-          - types-aiofiles>=24.0.0
           - pyjwt>=2.10.0
+          - sortedcontainers>=2.4.0
         args: [--config-file=pyproject.toml]
-        exclude: ^(docs/|examples/)
+        exclude: ^(docs/|examples/|scripts/)
 
   # Biome for TypeScript/JavaScript (dashboard)
   # - repo: local

CHANGELOG.md

@@ -601,15 +601,15 @@ This is the initial public release of the CCProxy API.
 
 - **Unified `ccproxy` CLI**: A single, user-friendly command-line interface for managing the proxy.
 - **TOML Configuration**: Configure the server using a `config.toml` file with JSON Schema validation.
-- **Keyring Integration**: Securely stores and manages OAuth credentials in the system's native keyring.
+<!-- Keyring integration was planned but has been removed; credentials are stored via project-managed files. -->
 - **`generate-token` Command**: A CLI command to manually generate and manage API tokens.
 - **Systemd Integration**: Includes a setup script and service template for running the proxy as a systemd service in production environments.
 - **Docker Support**: A `Dockerfile` and `docker-compose.yml` for running the proxy in an isolated containerized environment.
 
 #### Security
 
 - **Local-First Design**: All processing and authentication happens locally; no conversation data is stored or transmitted to third parties.
-- **Credential Security**: OAuth tokens are stored securely in the system keyring, not in plaintext files.
+<!-- Credential storage now uses project-managed files; system keyring is not used. -->
 - **Header Stripping**: Automatically removes client-side `Authorization` headers to prevent accidental key leakage.
 
 #### Developer Experience
@@ -619,3 +619,35 @@ This is the initial public release of the CCProxy API.
 - **Modern Tooling**: Uses `uv` for package management and `devenv` for a reproducible development environment.
 - **Extensive Test Suite**: Includes unit, integration, and benchmark tests to ensure reliability.
 - **Rich Logging**: Structured and colorized logging for improved readability during development and debugging.
+## [Unreleased]
+
+### Removed
+
+- Dead code: removed `ccproxy/utils/models_provider.py` (unreferenced; model listing is provided by plugins).
+- Pruned root runtime dependencies no longer used directly by core:
+  - `aiosqlite` (unused in repo)
+  - `h2` (no direct imports; `httpx[http2]` brings HTTP/2 support transitively)
+
+### Notes
+
+- Plugin-owned dependencies remain in root for now (plugins are bundled): `duckdb`, `duckdb-engine`, `sqlmodel`, `prometheus-client`, `textual`. These may move to plugin-specific distributions or optional extras in a future split.
+## [0.2.0] - 2025-09-02
+
+### Changed
+
+- Core health endpoints simplified and plugin-agnostic; provider/OAuth/SDK checks moved to plugin health under `/plugins/{name}/health`.
+- Plugins CLI now uses centralized `load_plugin_system()`; discovery logic consolidated.
+- Documentation updated to reflect plugin-first architecture and loader flow.
+
+### Removed
+
+- Legacy plugin management endpoints: `POST /plugins/{name}/reload`, `POST /plugins/discover`, `DELETE /plugins/{name}` (v2 loads at startup; restart to apply changes).
+- Scheduler references to Pushgateway in core; metrics plugin fully owns push task registration.
+- Core middleware reliance on `app.state.duckdb_storage` alias; storage wiring is plugin-owned.
+
+### Added
+
+- Configuration validation that fails fast when deprecated keys are present, with guidance to the corresponding `plugins.*` keys.
+- Migration guide: `docs/migration/0.2-plugin-first.md`.
+
+This release completes the plugin-first migration and removes transitional shims.