fix(cc-switch-import): adopt five P1 findings from multi-role review

- Corrupt/unparseable profile.json now ABORTS the import (ok:false +
  reportSwallowed) instead of merging into an empty base and wiping
  user-created proxy_ profiles; non-object JSON shapes abort the same way.
- Client success is decided strictly on resp.ok && data.ok === true; the
  403 local-only gate and 400 exception paths now carry ok:false, so they
  can no longer render as a green "Imported 0, updated 0" toast.
- mergeImportedProfiles seeds the built-in max profile at the front when
  missing (mirrors proxyProfilesPost's invariant; a fresh install importing
  first no longer loses the Default option) and preserves id-less entries.
- The node:sqlite-unavailable error now names the real requirement
  (Node >= 22.5 with --experimental-sqlite, or >= 23.4) and ProxyModal maps
  it to a dedicated localized message ui.proxy.ccswitchNodeUnsupported
  (x18 locales); degradation contract pinned via _setDatabaseSyncForTest.
- New test/api-ccswitch-import.test.js covers the previously-untested HTTP
  surface with a fixture SQLite db: 403 gate writes nothing, ok:false
  contract, first-import max seeding + 0o600 + credential-free SSE refresh
  broadcast, preserve/prune merge semantics, corrupt-file abort leaves the
  file byte-identical, off-host GET masking never leaks the plaintext key.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 2 people

history.md

@@ -4,6 +4,7 @@
 
 - feat(proxy): **Import providers from cc-switch** — reads AI provider credentials (baseURL/authToken/model mappings) from the local [cc-switch](https://github.com/farion1231/cc-switch) Tauri app's SQLite database and auto-generates cc-viewer proxy profiles. Cross-platform path detection probes `~/.cc-switch/cc-switch.db` **first on every platform** (cc-switch hardcodes this path via `get_app_config_dir()` in its `config.rs` on mac/linux/windows; the Tauri identifier does not affect the DB path), with platform-specific Tauri app-data paths (`~/Library/Application Support/cc-switch/`, `%APPDATA%\cc-switch\`, `~/.local/share/cc-switch/`) kept only as low-priority legacy fallbacks so a stale leftover there can never shadow the real DB. Opens `cc-switch.db` in **read-only** mode (no SQLITE_BUSY lock when cc-switch is running), queries the `providers` table for `app_type='claude'` rows, and maps `settings_config.env` → cc-viewer profile fields (`ANTHROPIC_BASE_URL`→`baseURL`, `ANTHROPIC_AUTH_TOKEN`/`ANTHROPIC_API_KEY`→`apiKey`, `ANTHROPIC_MODEL` + the three family-model fields, ignoring the `_NAME` suffixed variants; `CLAUDE_CODE_EFFORT_LEVEL`→`effort` so a user's effort toggle is not silently dropped on import). Codex providers are skipped (incompatible auth format). Imported profiles get a `ccs_` id prefix and `source: 'cc-switch'` marker; a `mergeImportedProfiles` pure function updates existing `ccs_` entries (credential refresh) and appends new ones while **leaving user-created `proxy_` profiles untouched** — deleted-from-cc-switch entries are pruned. New `server/lib/ccswitch-import.js` (pure functions, fully unit-tested against the real db); `GET /api/ccswitch-providers` (preview, masked off-host) + `POST /api/ccswitch-import` (local-only merge + SSE `proxy_profile` broadcast); a "从 cc-switch 导入" button in ProxyModal. 4 new `ui.proxy.ccswitch*` i18n keys × 18 locales; `test/ccswitch-import.test.js` (25 cases incl. live-db integration + cross-platform path-priority injection).
   - fix(cc-switch-import): **the import reported a misleading `providers table not found`** whenever the DB was unreadable. The `sqlite_master` existence query's inner `catch {}` swallowed the real error (e.g. `file is not a database` for a corrupt/non-SQLite `cc-switch.db`) and collapsed every failure into the generic message, so the user could not tell a corrupt file from a genuine schema mismatch. The catch is removed — a throw now propagates to the existing outer catch, which surfaces `query failed: <real message>`; the genuine table-missing case reports `providers table not found in <resolved path>` (naming the file so a stale leftover at a probed path is distinguishable from the real cc-switch DB). Tests: a non-SQLite file asserts the error is *not* the masked string and exposes the real cause; a valid-but-tableless DB asserts the distinct `providers table not found in <path>` message.
+  - fix(cc-switch-import): **five P1 findings from a 6-role review adopted.** (1) A corrupt/unparseable existing `profile.json` no longer wipes user-created proxies: the import previously swallowed the parse error, merged into an empty base, and overwrote the file with only `ccs_` entries — it now ABORTS with `ok:false` (`reportSwallowed('ccswitch-import.read-existing')`), and a parse to a non-object shape aborts the same way; the on-disk file is left byte-identical. (2) The client no longer misreports 403/400 as success: those response shapes carry no `imported`/`updated` counters, so the old `data.imported === 0` heuristic fell through to the green "Imported 0, updated 0" toast — success is now decided strictly on `resp.ok && data.ok === true`, and every server error path (403 gate, 400 exception) carries `ok:false`. (3) `mergeImportedProfiles` now upholds the same `max`-invariant as `proxyProfilesPost`: the built-in Default is seeded at the front when missing (a fresh install importing before ever saving a proxy used to write a list with no Default option), and existing id-less entries are preserved instead of silently dropped. (4) The Node floor mismatch is surfaced instead of silent: `node:sqlite` needs Node ≥ 22.5 (`--experimental-sqlite`) / ≥ 23.4 unflagged while the project floor is 20.14 — the unavailable-runtime error now names the requirement and ProxyModal maps it to a dedicated localized message (`ui.proxy.ccswitchNodeUnsupported` × 18 locales) instead of the misleading "cc-switch not detected"; the degradation contract is pinned by a test via the new `_setDatabaseSyncForTest` hook (CI runs Node 24, so the sqlite suites are exercised there). (5) The two HTTP endpoints — previously untested — get route coverage in `test/api-ccswitch-import.test.js` (fixture SQLite db under an injected HOME, no real cc-switch needed): local-only 403 gate writes nothing, `ok:false` contract on 400, first-import max seeding + `0o600` + credential-free SSE `refresh` broadcast, re-import preserve/prune semantics, corrupt/non-object `profile.json` abort leaves the file untouched, and off-host GET masking never leaks the plaintext key.
   - fix(cc-switch-import): **a stale/empty leftover `cc-switch.db` at a platform-specific probe path could shadow the real DB**. `candidateDbPaths()` probed `~/Library/Application Support/cc-switch/`, `%APPDATA%\cc-switch\`, and `~/.local/share/cc-switch/` *before* `~/.cc-switch/cc-switch.db`, but cc-switch never writes to those Tauri app-data paths — a leftover file there was matched first and yielded `providers table not found`. `~/.cc-switch/cc-switch.db` is now the primary probe on all platforms; the platform paths are demoted to legacy fallbacks. `candidateDbPaths()` was refactored to accept an injectable `{plat, home, env}` and exported as `_candidateDbPathsForTest` so the win32/darwin priority ordering is exercised on any test host (previously zero coverage on non-linux branches); new cross-platform tests assert the primary path wins and a stale legacy file cannot shadow it, using a neutral home value (no hardcoded username).
 
 ## 1.7.3 (2026-07-17)

server/lib/ccswitch-import.js

@@ -69,6 +69,11 @@ function candidateDbPaths(opts) {
 // Exported for unit tests so the win32/darwin priority ordering can be exercised on any host.
 export { candidateDbPaths as _candidateDbPathsForTest };
 
+// Test hook: override the cached DatabaseSync — pass false to simulate a runtime
+// without node:sqlite (the getter returns the cached falsy value and the callers
+// take the unavailable path), or null to restore lazy detection.
+export function _setDatabaseSyncForTest(v) { _DatabaseSync = v; }
+
 // Returns the first existing cc-switch.db path, or null if none found.
 export function findCcSwitchDbPath() {
   for (const p of candidateDbPaths()) {
@@ -146,7 +151,9 @@ export function mapProviderToProfile(row) {
 export async function readCcSwitchProviders(dbPath) {
   const DatabaseSync = await getDatabaseSync();
   if (!DatabaseSync) {
-    return { profiles: [], error: 'node:sqlite unavailable on this runtime' };
+    // Keep the 'node:sqlite unavailable' prefix stable — the UI keys a dedicated
+    // localized message off it (ui.proxy.ccswitchNodeUnsupported).
+    return { profiles: [], error: 'node:sqlite unavailable on this runtime (requires Node >= 22.5 with --experimental-sqlite, or >= 23.4)' };
   }
   let db = null;
   try {
@@ -196,9 +203,10 @@ export async function discoverCcSwitchProviders() {
 // Merge cc-switch-imported profiles into cc-viewer's existing profile list.
 // Rules:
 // - ccs_-prefixed (previously imported): matched by id, updated with fresh data (credential refresh)
-// - proxy_-prefixed (user-created): left untouched, preserved as-is
+// - proxy_-prefixed (user-created) and any entry without a ccs_ id (including id-less ones): preserved as-is
 // - newly seen ccs_ ids: appended to the end of the list
-// - max (built-in default) is always kept at the front
+// - max (built-in default) is always present and first — seeded when missing, mirroring
+//   proxyProfilesPost's invariant, so a first-ever import can never write a list without it
 // Returns { profiles, imported, updated } counts.
 export function mergeImportedProfiles(existing, importedList) {
   const existingArr = Array.isArray(existing) ? existing : [];
@@ -209,23 +217,22 @@ export function mergeImportedProfiles(existing, importedList) {
   let newCount = 0;
   let updatedCount = 0;
 
-  // Put built-in max first (if present)
-  for (const p of existingArr) {
-    if (p.id === 'max') {
-      result.push(p);
-      break;
-    }
-  }
-  // User-created profiles (proxy_ prefix + others that are not ccs_ and not max) are preserved as-is
+  // Built-in max always first — reuse the existing entry, or seed the same shape
+  // proxyProfilesPost injects. Without this, a fresh install importing before ever
+  // saving a proxy would write a profiles list with no Default option.
+  const existingMax = existingArr.find(p => p && p.id === 'max');
+  result.push(existingMax || { id: 'max', name: 'Default' });
+  // Everything that is not max and not ccs_-sourced (user proxy_ profiles, unknown or
+  // id-less entries) is preserved verbatim — this function only owns the ccs_ namespace
   for (const p of existingArr) {
-    if (p.id === 'max') continue;
-    if (p.id && !p.id.startsWith('ccs_')) {
+    if (!p || p.id === 'max') continue;
+    if (!p.id || !p.id.startsWith('ccs_')) {
       result.push(p);
     }
   }
   // ccs_-sourced: use the freshly imported data
   for (const p of existingArr) {
-    if (p.id && p.id.startsWith('ccs_')) {
+    if (p && p.id && p.id.startsWith('ccs_')) {
       if (importedMap.has(p.id)) {
         result.push(importedMap.get(p.id));
         importedMap.delete(p.id);

server/routes/preferences.js

@@ -6,6 +6,7 @@ import { LOG_DIR, setLogDir, getClaudeConfigDir } from '../../findcc.js';
 import { PROFILE_PATH, _defaultConfig, getActiveProfileId, setActiveProfileForWorkspace, _loadProxyProfile } from '../interceptor.js';
 import { migrateProxyProfileList } from '../lib/interceptor-core.js';
 import { discoverCcSwitchProviders, mergeImportedProfiles } from '../lib/ccswitch-import.js';
+import { reportSwallowed } from '../lib/error-report.js';
 import { setLang } from '../i18n.js';
 import { reconcileVoicePackPrefs as vpReconcile } from '../lib/voice-pack-manager.js';
 import { readClaudeProjectModel } from '../lib/context-watcher.js';
@@ -331,7 +332,7 @@ async function ccswitchProvidersGet(req, res, _parsedUrl, isLocal, _deps) {
 async function ccswitchImportPost(req, res, _parsedUrl, isLocal, deps) {
   if (!isLocal) {
     res.writeHead(403, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ error: 'cc-switch import is local-only' }));
+    res.end(JSON.stringify({ ok: false, error: 'cc-switch import is local-only' }));
     return;
   }
   let body = '';
@@ -346,11 +347,39 @@ async function ccswitchImportPost(req, res, _parsedUrl, isLocal, deps) {
         res.end(JSON.stringify({ ok: false, error: result.error, imported: 0, updated: 0 }));
         return;
       }
-      // 读现有 profile.json
+      // Read existing profile.json. A missing file is a legitimate first import,
+      // but a file that exists and fails to parse must ABORT: merging into an
+      // empty base and writing back would silently wipe every user-created
+      // proxy_ profile (existing IS the source of truth here, unlike
+      // proxyProfilesPost where the client sends the full desired list).
       let existing = { profiles: [] };
-      try {
-        if (existsSync(PROFILE_PATH)) existing = JSON.parse(readFileSync(PROFILE_PATH, 'utf-8'));
-      } catch { /* 首次导入无文件 */ }
+      if (existsSync(PROFILE_PATH)) {
+        let parsed = null;
+        try {
+          parsed = JSON.parse(readFileSync(PROFILE_PATH, 'utf-8'));
+        } catch (err) {
+          reportSwallowed('ccswitch-import.read-existing', err);
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({
+            ok: false,
+            error: 'existing profile.json is unreadable; import aborted to avoid overwriting your profiles',
+            imported: 0, updated: 0,
+          }));
+          return;
+        }
+        // JSON that parses to a non-object (null, array, number) is just as
+        // destructive to merge into — treat it the same as a parse failure.
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({
+            ok: false,
+            error: 'existing profile.json has an unexpected shape; import aborted to avoid overwriting your profiles',
+            imported: 0, updated: 0,
+          }));
+          return;
+        }
+        existing = parsed;
+      }
       // merge
       const merged = mergeImportedProfiles(existing.profiles || [], result.profiles);
       const toWrite = { ...existing, profiles: merged.profiles };
@@ -383,8 +412,10 @@ async function ccswitchImportPost(req, res, _parsedUrl, isLocal, deps) {
         dbPath: result.dbPath,
       }));
     } catch (err) {
+      // ok:false keeps the response contract uniform — the client decides
+      // success strictly on data.ok, never on the presence of counter fields.
       res.writeHead(400, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: String(err && err.message || err) }));
+      res.end(JSON.stringify({ ok: false, error: String(err && err.message || err) }));
     }
   });
 }

src/components/settings/ProxyModal.jsx

@@ -4,6 +4,7 @@ import { EditOutlined, DeleteOutlined, PlusOutlined, ImportOutlined } from '@ant
 import { t } from '../../i18n';
 import { isMobile } from '../../env';
 import { apiUrl, appendToken } from '../../utils/apiUrl';
+import { reportSwallowed } from '../../utils/errorReport';
 import { BLUR_MASK_STYLE } from '../../utils/modalMask';
 import ConceptHelp from '../common/ConceptHelp';
 import styles from './ProxyModal.module.css';
@@ -59,9 +60,12 @@ export default function ProxyModal({
   const [deleteConfirmTarget, setDeleteConfirmTarget] = useState(null);
   const [importing, setImporting] = useState(false);
 
-  // 从 cc-switch 导入：POST /api/ccswitch-import（local-only），merge 进 profile.json。
-  // 成功后主动重新 GET /api/proxy-profiles 刷新列表（不依赖 SSE——SSE proxy_profile
-  // 事件在 profile:null 时不触发重新 GET，本地有时序问题，直接 fetch 最可靠）。
+  // Import from cc-switch: POST /api/ccswitch-import (local-only) merges into
+  // profile.json. Success is decided STRICTLY on resp.ok + data.ok — the 403
+  // (remote client) and 400 (server exception) shapes carry no imported/updated
+  // counters, so any counter-based heuristic misreads them as success.
+  // After success the list is refetched directly for immediate UI update (the
+  // server also broadcasts SSE proxy_profile {profile:'refresh'} as a fallback).
   const handleImportFromCcSwitch = async () => {
     setImporting(true);
     try {
@@ -70,21 +74,26 @@ export default function ProxyModal({
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ setActive: false }),
       });
-      const data = await resp.json();
-      if (data.error && data.imported === 0 && data.updated === 0) {
-        message.error(t('ui.proxy.ccswitchImportFail') + (data.error ? ': ' + data.error : ''));
-      } else {
+      let data = null;
+      try { data = await resp.json(); } catch (e) { reportSwallowed('fetch.ccswitch-import-json', e); }
+      if (resp.ok && data && data.ok === true) {
         message.success(t('ui.proxy.ccswitchImported', { imported: data.imported || 0, updated: data.updated || 0 }));
-        // 主动重新拉取 profile 列表刷新 UI（导入是列表变化，SSE profile:null 不触发重 GET）
         try {
           const pr = await fetch(appendToken(apiUrl('/api/proxy-profiles')));
           const pd = await pr.json();
           if (pd.profiles && onProxyProfileChange) {
             onProxyProfileChange({ active: pd.active, profiles: pd.profiles });
           }
-        } catch { /* 刷新失败不阻塞，SSE 兜底 */ }
+        } catch (e) { reportSwallowed('fetch.ccswitch-refresh', e); /* SSE refresh is the fallback */ }
+      } else if (data && typeof data.error === 'string' && data.error.startsWith('node:sqlite unavailable')) {
+        // Runtime lacks node:sqlite (Node < 22.5, or 22.x without --experimental-sqlite):
+        // an actionable message beats the generic "cc-switch not detected".
+        message.error(t('ui.proxy.ccswitchNodeUnsupported'));
+      } else {
+        message.error(t('ui.proxy.ccswitchImportFail') + (data && data.error ? ': ' + data.error : ''));
       }
     } catch (err) {
+      reportSwallowed('fetch.ccswitch-import', err);
       message.error(t('ui.proxy.ccswitchImportFail'));
     } finally {
       setImporting(false);