farion1231/cc-switch
A cross-platform desktop All-in-One assistant for Claude Code, Codex, OpenCode, OpenClaw, Grok Build & Hermes Agent. Only official website: ccswitch.io
How cc-switch is put together
CC Switch is a cross-platform (Windows/macOS/Linux) Tauri 2 desktop application that manages and switches API provider configurations for AI coding tools (Claude Code, Claude Desktop, Codex, Gemini CLI, Grok Build, OpenCode, OpenClaw, Hermes Agent, Pi). A React 18 + TypeScript frontend (Vite, Tailwind, Radix UI) renders a multi-view shell (providers, prompts, skills, MCP, agents, sessions, proxy controls) and communicates exclusively with a Rust backend via Tauri IPC commands and events. The Rust side persists a central configuration under ~/.cc-switch (JSON plus SQLite via rusqlite and tauri-plugin-store), writes per-tool native config files through dedicated adapter modules, runs an embedded axum/tokio HTTP proxy for request takeover and failover, executes user-defined usage scripts in an embedded QuickJS engine (rquickjs), and supports deep-link import and auto-update.
Languages
Frameworks
Datastores
Infrastructure
Major components
Tauri Rust backend core
Registers IPC commands, initializes plugins, handles startup errors, panic hooks, tray, window state, and single-instance behavior (src-tauri/src/lib.rs, main.rs, init_status.rs, tray.rs).
Per-app config adapters
Read/write native configuration files for each supported tool (claude_desktop_config.rs, codex_config.rs, gemini_config.rs, grok_config.rs, opencode_config.rs, openclaw_config.rs, hermes_config.rs).
Provider & settings persistence
Models providers, MCP servers, and skills (app_config.rs, provider.rs) and persists them centrally via config.rs, store.rs, app_store.rs, and SQLite state (codex_state_db.rs).
Embedded local proxy
Axum/tokio/hyper-based local relay providing provider takeover, failover, and routing toggles surfaced in the UI (ProxyToggle, FailoverToggle, useProxyStatus).
React frontend shell
App.tsx orchestrates views (providers, prompts, skills, MCP, agents, sessions, workspace, openclaw/hermes panels), app switching, dialogs, and env-conflict warnings.
Provider preset catalog
Static presets/templates per tool under src/config (claudeProviderPresets, codexTemplates, geminiProviderPresets, universalProviderPresets, mcpPresets, piModelCatalog).
Usage & pricing analytics
Executes user-supplied usage scripts (usage_script.rs via rquickjs), streams usage events (usage_events.rs), and syncs model pricing from models.dev (modelsDevAutoSync.ts, modelsDevPricing.ts).
Deep-link import & update
Handles cc-switch deep links for importing provider configs with risk assessment (DeepLinkImportDialog.tsx, deeplinkRisk.ts, tauri-plugin-deep-link) and app self-update (updater.ts, UpdateContext).
A quiet week with a single housekeeping change to a preset endpoint.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quiet week with a single housekeeping change to a preset endpoint.
Week of 2026-08-17
Version 3.20.0 shipped alongside a batch of Codex fixes and small usability wins.
Week of 2026-08-10
The busiest week of the period: a new Pi coding agent, many new vendor presets, and a wave of Windows and proxy fixes.
Week of 2026-08-03
Release v3.19.2 landed with performance work on backups and usage data, plus searchable management lists.
Week of 2026-07-27
Two releases (v3.19.0 and v3.19.1) anchored a week dominated by security hardening, DeepSeek native support, and deeplink import safety.
Over the past five weeks, cc-switch shipped a steady stream of provider presets, usage-tracking improvements, and reliability fixes, punctuated by three releases (v3.19.0, v3.19.1, v3.20.0). A major security push in late July closed credential leaks, zip-slip, and injection vulnerabilities, while August added native support for new coding agents (Pi, Grok Build) and richer Codex features like per-model reasoning levels and OAuth account management. The most recent weeks focused on polish: faster backups, smoother UI, better Windows behavior, and keeping sponsor and preset listings current.
Week by week
2026-08-24A quiet week with a single housekeeping change to a preset endpoint.latest1 change
Chore
TeamoRouter preset moved to a new domain
The TeamoRouter preset now points to teamorouter.cn, with the old .com address kept as a fallback.
2026-08-17Version 3.20.0 shipped alongside a batch of Codex fixes and small usability wins.6 changes
Chore
Release v3.20.0
The project cut its v3.20.0 release with accompanying release notes and changelog updates.
Fix
Faster duplicate-session lookups for Pi usage stats
Usage statistics for Pi sessions now use an index so checking for duplicates is much quicker.
Fix
Exit buttons actually quit the app
A missing permission was granted so the app's exit buttons can properly close the program.
Fix
Upgrade checks no longer hang forever
The pre-flight check that looks for upgrade conflicts could get stuck indefinitely; it now times out properly.
Feature
1M context window toggle restored in Codex provider form
Users can again toggle the one-million-token context window when editing a Codex provider, since upstream re-enabled goals by default and made the old Goal mode toggle unnecessary.
Fix
Multiple follow-login providers allowed for Codex
Codex now supports configuring several providers that require logging in after setup, with configurable OAuth usage queries.
2026-08-10The busiest week of the period: a new Pi coding agent, many new vendor presets, and a wave of Windows and proxy fixes.6 changes
Feature
Native support for the Pi coding agent
Pi is now a supported coding agent, including session usage statistics so users can track what it consumes.
Feature
Managed OAuth account selection for providers
Providers can now be tied to specific managed OAuth accounts instead of a single global login.
Fix
Windows startup flash eliminated
The white/black flash when launching on Windows was removed, and CLI detection now reads from the registry PATH and standalone installer directories.
Fix
Proxy support for hosted web search
The built-in proxy now handles Codex Alpha Search and Claude's hosted WebSearch features.
Feature
New vendor presets across all apps
Presets were added or expanded for Baidu Qianfan Token Plan, XycAi, JieKou AI, and Volcengine (split into Agent Plan and Coding Plan), plus real thinking switches for several platforms.
Fix
macOS typing corruption fixed
Text typed with input-method editors (e.g., Chinese/Japanese keyboards) no longer gets corrupted in provider fields on macOS.
2026-08-03Release v3.19.2 landed with performance work on backups and usage data, plus searchable management lists.6 changes
Chore
Release v3.19.2
A patch release went out covering the week's fixes and performance improvements.
Refactor
Faster backups via batched database writes
Database dumps now write rows in batches and restore preserved tables in a single transaction, making backup and recovery much faster and safer.
Feature
Searchable lists and bulk app toggles
Management screens gained search boxes and the ability to enable or disable multiple apps at once.
Feature
Per-account usage shown in Auth Center
For Codex OAuth logins, the Auth Center now displays usage statistics for each individual account.
Fix
Security caps on scripts, file reads, and proxy bodies
Limits were placed on how much data scripts, file reads, and proxied requests can consume, closing potential resource-abuse holes.
Fix
Honest reporting of dropped tool calls
When the proxy has to drop Chat tool calls, it now reports them as dropped rather than pretending the request completed successfully.
2026-07-27Two releases (v3.19.0 and v3.19.1) anchored a week dominated by security hardening, DeepSeek native support, and deeplink import safety.6 changes
Chore
Releases v3.19.0 and v3.19.1
Two versions shipped this week, with release notes, changelog sync, and an updated DeepSeek routing guide.
Fix
Major security patch bundle
A zip-slip vulnerability in skill installs, two credential leaks, and three crash paths were fixed in one coordinated security update.
Feature
DeepSeek native Responses support
Codex can now talk to DeepSeek using its native Responses API, backed by an official model catalog mirror, alongside new Tencent Hunyuan and Volcengine native-Responses presets.
Fix
Safer deeplink imports
Importing configurations via links now decodes URL-safe Base64 correctly, shows MCP arguments and environment values, flags risky settings, and disables imported usage scripts until reviewed.
Fix
SQL import hardened against cross-file attacks
Database imports now reject statements that try to reach across files, and config snippet parsing no longer risks polluting JavaScript's Object prototype.
Feature
Automatic model pricing sync
Model prices are now automatically synced from models.dev, so built-in pricing stays current without manual updates.
Dependencies and code review
Dependency advisories
Security Watch
3 vulnerable packages (7 advisories) across 67 scanned dependencies.
vitest 2.0.5
2 advisories. Fixed in 4.1.0.
How it can be abusedAn attacker could trick a developer running Vitest's UI or API test server into visiting a malicious website, which would let that site talk to the local test server and read files or run code on the developer's machine. Only developers working on this repo while its test server is running are affected; end users of the shipped CC Switch app are not.
- criticalGHSA-5xrq-8626-4rwpWhen Vitest UI server is listening, arbitrary file can be read and executed
- criticalGHSA-9crc-q9x8-hgqqVitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
postcss 8.4.49
2 advisories. Fixed in 8.5.12.
How it can be abusedIf PostCSS processed CSS from an untrusted source during the build, a hidden comment pointing to a crafted source map file could make it read and leak arbitrary files from the build machine. Here the frontend only builds its own trusted stylesheets, so no attacker-controlled CSS ever reaches PostCSS.
- highGHSA-6g55-p6wh-862qPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
- highGHSA-r28c-9q8g-f849PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
vite 7.3.0
3 advisories. Fixed in 8.0.16.
How it can be abusedThese flaws only exist in Vite's development server, so they affect developers working on CC Switch, not end users of the installed app. While someone runs npm run dev locally, a malicious website open in their browser could connect to that local dev server over WebSocket and read arbitrary files from their machine, including files under ~/.cc-switch that may contain API keys.
- highGHSA-fx2h-pf6j-xcffvite: `server.fs.deny` bypass on Windows alternate paths
- highGHSA-p9ff-h696-f583Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
- highGHSA-v2wj-q39q-566rVite: `server.fs.deny` bypassed with queries
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required