github/sub2api
4
0
Fork 0
mirror of https://github.com/Wei-Shaw/sub2api.git synced 2026-10-27 16:07:02 +00:00
Code Issues Packages Projects Releases Wiki Activity
5,020 Commits 49 Branches 64 Tags
bfabfe60c84cfbb10fbe7900a7ea2bd280aefb75
Commit Graph
2688 Commits
Author SHA1 Message Date
Wesley Liddick a98397adbb Merge pull request #3778 from fengshao1227/fix/websearch-emulation-history-blocks 
fix(websearch): 剥离历史消息中上游不接受的 web search 块
 2026-07-07 14:33:16 +08:00
Wesley Liddick aff87d9497 Merge pull request #3776 from alfadb/fix/openai-compact-usage-sse-detection 
fix(openai): 避免 JSON 响应被 SSE 文本误判导致用量丢失
 2026-07-07 14:31:52 +08:00
li 9b75c7b76c fix(scheduler): 改用异族厂商前缀黑名单，兼容渠道级模型映射 
自审发现白名单守卫有误伤面：渠道级模型映射在账号选定之后才改写
请求体模型名，调度过滤看到的是改写前的原始别名。若按 Codex 白名单
判定，「渠道映射自定义别名 → gpt-5.x + 空映射 OAuth 账号」的既有
部署会被误判为 model_not_found。

改为保守 fail-open 黑名单：空映射默认仍允许，仅排除 deepseek/glm/
kimi/qwen/gemini/grok 等明确异族厂商前缀（Codex 上游绝无可能服务，
透传必然换来不可重试 400）。前缀分类先例见 ResolveThinkingProtocol。
 2026-07-07 14:19:58 +08:00
li 2a3dcb499f fix(scheduler): 空 model_mapping 的 OpenAI OAuth 账号不再吸收全部模型 
空映射此前一律视为「允许所有」，导致混合部署下请求非 OpenAI 模型
别名（deepseek-v4 等）时，OAuth 账号可能被调度选中；转发阶段对未知
模型原样透传，Codex 上游返回不可重试的 400，请求无法 failover 到
真正支持该模型的 API Key 账号。

IsModelSupported 对空映射的 OpenAI OAuth（未开透传）账号改为与转发
归一化对齐的判定 isOpenAIOAuthServableModel：可归一到已知 Codex 模型
集合（含 gpt-image-*、推理后缀、别名拼写）或 claude-* dispatch 系列
才视为可服务。API Key/显式映射/透传/其他平台语义不变。

Fixes #3662
 2026-07-07 14:06:21 +08:00
li 40c563c4ae fix(gateway): 记录请求体解析失败的真实原因，不再吞错 
400 "Failed to parse request body" 此前丢弃底层错误，无法区分
JSON 真非法、还是 body 被截断/被中间件提前消费。

- 服务层 invalid json 错误增补 len/offset/非法字符信息
  （仅诊断元数据，不含 body 内容，可安全 wrap）；
- handler 层新增 logRequestBodyParseFailure，向服务端日志输出
  底层错误 + body 长度 + 转义后的 head/tail 片段（各 256B），
  客户端响应文案保持不变；
- 接入全部 9 处入站解析点（messages/count_tokens/responses/
  chat_completions/embeddings，Anthropic 与 OpenAI 网关）。

Fixes #3715
 2026-07-07 13:53:39 +08:00
li 867616fca8 fix(websearch): 剥离历史消息中上游不接受的 web search 块 
Web Search 模拟合成的 server_tool_use / web_search_tool_result 块
（srvtoolu_ws_ 前缀）被客户端回传到后续 /v1/messages 历史后，
上游一律 400（GLM 等第三方兼容上游只接受
text/thinking/image/tool_use/tool_result），会话从此卡死。

新增 FilterWebSearchHistoryBlocks 预过滤：
- 模拟伪造块对所有上游无条件剥离；
- 真实 web search 块仅对 passback-required 协议族剥离
  （复用 ResolveThinkingProtocol），不误伤官方 Anthropic 会话；
- 接入 Anthropic 通用转发与 API Key 透传两条路径的既有 pre-filter 区。

Fixes #3677
 2026-07-07 13:41:40 +08:00
alfadb 438f17be5e fix(openai): avoid compact usage loss from json sse heuristic 
Replace the substring-based data:/event: SSE heuristic in
handleNonStreamingResponse with bodyHasSSEFraming, a line-level check
that only matches when a physical line starts with the SSE data:/
event: field names. This prevents OAuth compact JSON responses whose
output text merely contains the literal substrings "data:" or
"event:" from being misrouted into handleSSEToJSON, which was
causing usage to be recorded as zero even though the JSON body itself
carries a valid top-level usage object. Content-Type: text/event-stream
detection and genuine SSE body handling are unaffected.
 2026-07-07 13:04:28 +08:00
Heatherm Huang c34db70a88 fix: bridge grok composer image inputs 2026-07-07 10:55:07 +08:00
Turtle_Li 5494261902 Merge remote-tracking branch 'origin/main' into feature/batch-image-foundation 
# Conflicts:
#	.github/audit-exceptions.yml
 2026-07-07 10:53:17 +08:00
Turtle_Li aff148167c fix: address batch image ci failures 2026-07-07 10:50:36 +08:00
shaw d37d216f9d Merge remote-tracking branch 'origin/main' into pr-3762 
# Conflicts:
#	backend/internal/repository/concurrency_cache.go
#	backend/internal/repository/concurrency_cache_integration_test.go
 2026-07-07 09:22:44 +08:00
Wesley Liddick a862eac1d8 Merge pull request #3758 from catoncat/fix/test-oauth-codex-headers 
fix: add missing Codex CLI headers for OAuth account test
 2026-07-07 08:34:18 +08:00
Wesley Liddick 3828a48752 Merge pull request #3751 from heathermhuang/codex/grok-image-pricing-latest 
fix: expose Grok image pricing controls
 2026-07-07 08:29:01 +08:00
Wesley Liddick 77b1a0452e Merge pull request #3760 from DaydreamCoding/fix/codex-detect-version-gate-message 
fix(codex-detect): codex 版本门拒绝返回带版本号的差异化文案
 2026-07-07 08:28:51 +08:00
Wesley Liddick 26b51ccfd3 Merge pull request #3737 from wucm667/fix/sync-models-non-v1-base-url 
fix(models): 同步上游模型支持非 /v1 API 版本 base_url（如智谱 /v4）
 2026-07-07 08:28:41 +08:00
Turtle_Li 89edba8028 fix: restrict batch image groups to gemini 2026-07-07 04:14:09 +08:00
Turtle_Li 3c43fdec11 docs: add batch image PR readiness notes 2026-07-07 03:31:39 +08:00
Turtle_Li 1b07fe821a merge: sync batch image branch with origin main 2026-07-07 03:27:11 +08:00
cat cb151e36eb fix: respect custom User-Agent in OAuth account test 
Match the image OAuth test path and gateway behavior: check for a
custom user_agent credential first, fall back to codexCLIUserAgent
only when no custom UA is configured.
 2026-07-06 20:45:00 +08:00
jjaw 5089c303e1 优化 Redis SCAN 清理架构 2026-07-06 20:27:13 +08:00
shaw 31b6e0d94a fix: 请求头覆写审计问题修复（禁止名单缺口/beta 对称性/批量清空防护） 
后端：
- 禁止名单补充 content-type（multipart boundary 为每请求随机值，静态覆写必坏
  images 路径）、x-claude-code-session-id / x-client-request-id（会击穿每请求
  会话同步，与已禁的 session_id 等同类）、cookie / x-goog-api-key（与透传路径
  的入站鉴权残留清洗保持一致）
- anthropic-beta 覆写与 body 净化对称：四个 Anthropic 构建器在
  sanitizeAnthropicBodyForBetaTokens 前以覆写值为有效 finalBeta，避免覆写
  丢 token 后 header/body 不对称被上游 400
- 保存/应用两路径共用 normalizeHeaderOverrideEntry，消除双份校验规则漂移
- GetHeaderOverrides 按 modelMappingCache 先例增加热路径缓存（WS 每消息
  重建头场景收益最大）；ApplyHeaderOverrides 移除无观测效果的排序

前端：
- 禁止名单镜像同步新增项；值长度改按 UTF-8 字节校验（与后端 len() 对齐）
- Create 弹窗切换平台时重置覆写配置，避免上一平台模板行串台
- BulkEdit：开启覆写但无有效行时拦截保存（防止整键替换静默清空所选账号
  既有配置）；开启分支显示整体替换警告；混合平台选择时隐藏模板按钮
- 删除未使用的 isBlockedHeaderOverrideName 导出
 2026-07-06 20:05:50 +08:00
shaw ec7b20649e feat: apikey 账号支持请求头覆写（Anthropic/OpenAI） 
- 账号 credentials 新增 header_override_enabled / header_overrides，
  仅对 anthropic/openai 平台的 api_key 账号生效
- 转发前对同名请求头做大小写不敏感覆盖（EqualFold 全量删除后按
  wire casing 写入单值），值为空的条目视为占位不参与覆盖
- 覆盖全部出站路径：/v1/messages（标准+透传）、count_tokens、
  /v1/responses、chat completions、embeddings、images、全部 WS 模式、
  账号测试/探测、上游模型列表
- 创建/编辑/批量更新统一校验：RFC 7230 名称格式、去重、长度/条目上限、
  24 个禁止覆写头（认证/连接控制/accept-encoding/sec-websocket-*/
  会话隔离头），应用时二次防御过滤
- 前端三个账号弹窗新增开关+键值行编辑器+模板按钮（Claude Code CLI /
  Codex CLI 标准头，值为空），本地校验与后端规则对齐，i18n 中英文
 2026-07-06 19:11:08 +08:00
cat 1c0ccb477a fix: add missing Codex CLI headers for OAuth account test 
The testOpenAIAccountConnection function was sending requests to
chatgpt.com/backend-api/codex/responses without the required Codex CLI
identification headers, causing 401 Unauthorized for OAuth/PAT accounts.

The gateway Forward path and the compact test path both set these headers:
- Originator: codex_cli_rs
- User-Agent: codex_cli_rs/<version>
- OpenAI-Beta: responses=experimental

This patch adds the same headers to the normal (non-compact) OAuth test
path. API key accounts and other platforms are unaffected since the
headers are inside the isOAuth branch.
 2026-07-06 19:09:26 +08:00
DaydreamCodingandClaude Opus 4.8 4b321142bb fix(codex-detect): codex 版本门拒绝返回带版本号的差异化文案 
codex_cli_only 的 403 出口此前对所有拒绝原因硬编码同一句
"This account only allows Codex official clients"，但能走到版本门
（判定链第 5 步）的请求其实已命中官方 UA/originator，仅版本不符，
再回「只允许官方客户端」会误导。

- CodexClientRestrictionDetectionResult 增 DetectedVersion/MinCodexVersion/
  MaxCodexVersion，仅在 VersionTooLow/VersionTooHigh 分支填充
- 新增 CodexClientRestrictionMessage：too_low/too_high 给出带实际版本号与
  边界的提示；undetectable/未命中/黑名单/缺指纹 仍用通用兜底句（不泄露门控细节）
- Forward 唯一 403 出口改用该映射函数

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-06 19:03:36 +08:00
Heatherm Huang de31e57333 test: document Grok video media billing unit 2026-07-06 18:32:29 +08:00
Heatherm Huang 95717a7e62 test: clarify Grok video billing test name 2026-07-06 18:30:32 +08:00
Heatherm Huang 6b4c3c6ed1 test: cover Grok video media rate billing 2026-07-06 18:23:38 +08:00
wucm667 f881ff7cb0 fix(models): support non-v1 OpenAI models URLs 2026-07-06 17:46:44 +08:00
shaw 6cea1c35bb feat: 适配 OpenAI 新模型 gpt-5.6-sol/terra/luna 2026-07-06 17:34:22 +08:00
Wesley Liddick d1d3400b69 Merge pull request #3645 from bestony/worktree/lucky-harbor-dbe4 
feat(keys): add api key concurrency stats
 2026-07-06 16:45:15 +08:00
Albert Coady 0dc6e56aae fix: harden easypay custom method validation 2026-07-06 15:00:29 +08:00
Albert Coady bf76168ba5 feat: add custom easypay payment methods 2026-07-06 15:00:29 +08:00
shaw d56e94b875 feat(payment): 订阅 CNY 换算改为独立汇率配置的显式 opt-in 
- 新增 SUBSCRIPTION_USD_TO_CNY_RATE 配置（1 USD = X CNY，默认 0=关闭），
  替代复用 balance_recharge_multiplier 的隐式换算，促销倍率与订阅定价解耦
- 未配置汇率时订阅保持 price 直付的存量行为，存量部署升级零影响
- 前端确认页/原价/手续费/方式限额与后端换算条件严格镜像（rate>0 且币种为 CNY）
- 管理后台新增汇率配置输入（zh/en 文案），checkout-info 透出 subscription_usd_to_cny_rate
- 单测锁定：汇率未配置时不换算、换算使用汇率而非余额倍率、余额订单不受影响、返利仍按 USD price
 2026-07-06 14:34:17 +08:00
shaw d089c5789c Merge branch 'pr-3738' into fix/subscription-cny-optin-rate 2026-07-06 14:14:19 +08:00
Turtle_Li 9703ca9d33 merge: sync batch image foundation with upstream main 2026-07-06 13:40:09 +08:00
Turtle_Li d8e96f0f97 fix: bound batch image settlement retries 2026-07-06 13:33:53 +08:00
Turtle_Li 8fab636998 feat: complete batch image workflow 2026-07-06 12:22:04 +08:00
shaw 0fd2e9216d fix(scheduler): 修复 OpenAI 高级调度器审计发现的正确性与性能问题 
针对 #3692 合并后审计发现的问题集中修复：

- previous_response_id 剥离条件改为按 call_id 全覆盖校验，
  部分可重建的工具续链不再被误剥离（不受开关门控的行为回归）
- 粘性加权回退路径补分组归属校验并清理失效绑定，杜绝跨分组账号泄漏
- 账号列表页：无 OpenAI 账号时跳过分数计算、过滤池限定 openai 平台、
  负载批查合并为账号并集一次查询，消除全表扫描与 Redis N+1
- 订阅优先模式下常规池不可用时回退订阅池等待计划，
  busy-but-waitable 的订阅账号不再导致请求硬失败
- TopK/权重 DB 覆盖显式受总开关门控，与兄弟子开关语义一致
- 前端未分组 OpenAI 账号回退展示基础分，不再显示 "-"
- ListAllWithFilters 等能力正式进入 AccountRepository/AdminService 接口，
  移除匿名接口断言与静默降级；负载批查失败补 warn 日志
- SelectAccountWithSchedulerForCapability 增加显式 previousResponseCanMove
  参数，移除 "previous_response_can_move" 魔法字符串哨兵
- 设置写入路径补"基础权重不得全为零"聚合校验；
  运行时设置批量读取失败的降级路径覆盖全部键并留痕
 2026-07-06 11:43:16 +08:00
Wesley Liddick 759332aa92 Merge pull request #3692 from linshuboy/codex/openai-advanced-scheduler-controls-squashed 
[codex] add OpenAI advanced scheduler controls
 2026-07-06 10:59:23 +08:00
wucm667 b408edf97b fix(payment): convert subscription CNY pay amount 2026-07-06 10:56:43 +08:00
Wesley Liddick f0f1f59a44 Merge pull request #3716 from wucm667/fix/antigravity-refresh-server-invalidated-token 
fix(antigravity): 401 服务端失效的 token 触发主动刷新，修复 NeedsRefresh 仅看 expires_at 的死循环
 2026-07-06 10:18:49 +08:00
linshuboy f26ca5661e feat: add OpenAI advanced scheduler controls 
Related: #1089, #408, #123
 2026-07-05 17:24:38 +08:00
wucm667 b23475ac0c fix(antigravity): refresh server-invalidated tokens 2026-07-05 08:34:34 +08:00
MoRanHuiShou-pug e76e0499d7 fix: sanitize payment response NUL bytes 2026-07-05 03:55:40 +08:00
sweetcornna cbfeab964e fix(antigravity): default gateway forward base URL to the production endpoint 
resolveAntigravityForwardBaseURL() used ForwardBaseURLs() (which reorders the
daily/sandbox endpoint to the front) and returned the first entry by default —
daily-cloudcode-pa.sandbox.googleapis.com. Every Antigravity gateway request
was therefore sent to Google's sandbox endpoint, which rejects production OAuth
tokens: the account is benched with "OAuth 401: Invalid bearer token" (native
paths surface it as 502) and never recovers. The dashboard "test connection"
uses the production endpoint (antigravity.BaseURL), which is exactly why the
test succeeds while the gateway 401s.

Default to production (antigravity.BaseURLs[0] = cloudcode-pa.googleapis.com),
matching the OAuth/test path; the daily/sandbox endpoint is now opt-in via
GATEWAY_ANTIGRAVITY_FORWARD_BASE_URL=daily|sandbox.

Fixes #3611, #2962. Supersedes the token-refresh self-heal approach (that
premise — token staleness — was disproven: a 30s-old freshly-authorized token
also 401s on the gateway while working on the test path).

Verified on a live instance with a freshly-authorized Antigravity account:
/antigravity/v1/messages and /v1/messages now return real completions
(claude-sonnet-4-6, claude-opus-4-6); the same account/token 401/502'd before.
 2026-07-04 17:09:16 +08:00
wucm667 4dd3aee5c2 fix(openai): use mapped billing model for responses 2026-07-04 10:04:42 +08:00
Wesley Liddick dfdb838ce4 Merge pull request #3690 from AndersonBY/feature/codex-image-tool-policy 
feat: add Codex image tool strip policy
 2026-07-04 09:27:37 +08:00
Wesley Liddick be3aee1a4b Merge pull request #3694 from zhaoteng45/fix/antigravity-gemini31-pro-agent 
fix: normalize Antigravity Gemini 3.1 Pro routing
 2026-07-04 09:23:46 +08:00
Wesley Liddick 588e02b29e Merge pull request #3673 from heathermhuang/codex/grok-admin-issues-3545-3649 
fix: preserve configured Grok OAuth concurrency
 2026-07-04 09:22:18 +08:00
Wesley Liddick 0c53d4f334 Merge pull request #3661 from jianjianai/fix/group-capacity-batch-hotpath 
fix: 优化用户组容量汇总批量统计性能
 2026-07-04 09:20:02 +08:00