github/sub2api
4
0
Fork 0
mirror of https://github.com/Wei-Shaw/sub2api.git synced 2026-10-21 03:51:47 +00:00
Code Issues Packages Projects Releases Wiki Activity
5,405 Commits 49 Branches 63 Tags
v0.1.169
Commit Graph
5405 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
shaw f06c8c5698 Merge branch 'main' into fix/issue-4798-gemini-image-chat-content 
解决 frontend/pnpm-lock.yaml 冲突：采用 main 的 frontend/package.json 与
frontend/pnpm-lock.yaml，回退本 PR 附带的 postcss ^8.4.32 -> ^8.5.12 改动。
main 已通过 pnpm.overrides ("postcss@<8.5.18": ">=8.5.18") 强制安全下限，
本 PR 的直接依赖下限低于该值，保留会与 overrides 冲突且无安全收益。
本 PR 的功能改动（gemini_* compat service 及其测试）未受影响。
 2026-07-25 14:33:06 +08:00
shaw 8bed40c67b Merge branch 'main' into fix/issue-4819-drop-orphan-tool-choice 
解决 frontend/pnpm-lock.yaml 冲突：采用 main 的 frontend/package.json 与
frontend/pnpm-lock.yaml，回退本 PR 附带的 postcss ^8.4.32 -> ^8.5.12 改动。
main 已通过 pnpm.overrides ("postcss@<8.5.18": ">=8.5.18") 强制安全下限，
本 PR 的直接依赖下限低于该值，保留会与 overrides 冲突且无安全收益。
本 PR 的功能改动（openai_gateway_grok.go 及其测试）未受影响。
 2026-07-25 14:32:18 +08:00
Wesley Liddick a29a62112b Merge pull request #4842 from Cynicismcart/fix/openai-pool-retry-transient-cooldown 
fix(openai): preserve pool-mode same-account retries
 2026-07-25 14:30:04 +08:00
Wesley Liddick eb03be0dbf Merge pull request #4788 from wucm667/fix/issue-4782-pool-5xx-cooldown 
fix(grok): avoid pool cooldown on 5xx
 2026-07-25 14:29:36 +08:00
Wesley Liddick 6d956bdc20 Merge pull request #4801 from SemonCat/feat/persist-session-id 
feat(usage): persist client session identifiers
 2026-07-25 14:03:32 +08:00
Wesley Liddick 333acde7d1 Merge pull request #4832 from ListenCodes/fix/openai-apikey-responses-item-id-v2 
fix(openai): sanitize API-key responses item IDs
 2026-07-25 13:42:35 +08:00
Wesley Liddick 9994eaa70f Merge pull request #4804 from scp-planet/fix/openai-strip-input-namespace 
fix(openai): strip input item namespaces before HTTP forwarding / HTTP 转发前移除 input 项 namespace
 2026-07-25 13:42:17 +08:00
Wesley Liddick a9866f03db Merge pull request #4841 from wucm667/fix/issue-4838-affiliate-mobile-copy 
fix(frontend): adapt affiliate copy controls for mobile
 2026-07-25 13:42:03 +08:00
Wesley Liddick 0e39e21fa2 Merge pull request #4796 from 404QAQ/codex/fix-image-request-diagnostics 
fix(images): log requested quality and size
 2026-07-25 13:41:52 +08:00
Wesley Liddick 95cc6ee2c0 Merge pull request #4793 from 404QAQ/codex/fix-pricing-empty-remote-url 
fix(pricing): skip remote scheduler without URL
 2026-07-25 13:41:40 +08:00
song db6fbdbf29 fix(openai): satisfy Live CI checks 2026-07-25 12:51:20 +08:00
song 988d4b577e feat(openai): add macOS Live attestation 2026-07-25 12:50:46 +08:00
song ec23716ee4 fix(openai): align Live request metadata 2026-07-25 12:50:46 +08:00
song e6eb23eaac feat(openai): add Live gateway support 2026-07-25 12:50:46 +08:00
Wesley Liddick 37ed639d1e Merge pull request #4852 from Wei-Shaw/fix/bump-postcss-audit 
fix(security): 升 postcss 到 >=8.5.18 修复 frontend-security 红灯
 2026-07-25 12:01:42 +08:00
shaw a5aae5db9a fix(security): 升 postcss 到 >=8.5.18 修复 frontend-security 红灯 
新披露两条 high 级公告命中锁文件里的 postcss@8.5.6，frontend-security 的
audit exception 检查失败：

- GHSA-6g55-p6wh-862q（2026-07-23 披露，修复版 8.5.12）
  CSS 注释中攻击者可控的 sourceMappingURL 导致任意文件读取与信息泄露
- GHSA-r28c-9q8g-f849（2026-07-24 披露，修复版 8.5.18）
  Previous Source Map 自动加载存在路径穿越，导致任意 .map 文件泄露

postcss 不只是 devDependency —— 它经 vue → @vue/compiler-sfc 进入生产依赖树，
因此 `pnpm audit --prod` 会命中。用 pnpm.overrides 而非只升直接依赖，可保证
所有引入路径的实例都被抬到修复版（沿用本仓 form-data@<4.0.6 的既有写法）。

锁文件用 pnpm 10 重新解析以匹配现有锁文件的生成工具，避免 pnpm 9 误删
11 处 libc: [glibc|musl] 平台门控字段；lockfileVersion 保持 9.0。
实际解析到 postcss 8.5.23，nanoid 3.3.11→3.3.16 是 postcss 自身依赖的
补丁级跟随，diff 无其他无关变动。

验证：复现 CI 失败步骤（pnpm audit --prod --audit-level=high +
tools/check_pnpm_audit_exceptions.py）已通过；CI 所用 pnpm 9 的
--frozen-lockfile 接受该锁文件；vue-tsc --noEmit、pnpm build、vitest 均通过。
 2026-07-25 11:45:42 +08:00
shaw 6c9b84cc7a feat: 适配 Anthropic 新模型 claude-opus-5 
模型登记：/v1/models 清单、Bedrock 默认映射（us.anthropic.claude-opus-5-v1）、
定价条目（$5/$25 per MTok、1M 上下文、128K 输出）、前端模型清单与
Anthropic/Bedrock 预设映射、限流 scope 简称。

同时修复两个会静默出错的问题：

- 定价家族兜底 3 倍超收：定价数据缺 claude-opus-5 时，matchByModelFamily
  的 Phase 2 关键字兜底会落到 opus-4 系列、getFallbackPricing 会落到
  claude-3-opus，两条路都按 $15/$75 计费（官方 $5/$25），输入输出双双
  3 倍超收且无任何报错。两处补 opus-5 家族并回退到同价的 4.8；判断用
  opus-5/opus5 子串而非裸 "5"，避免误伤 claude-opus-4-5。顺带补齐兜底表
  缺失的 claude-opus-4.8（此前同样会掉到 claude-3-opus）。

- Bedrock 版本闸门降级：claudeVersionRe 强制要求 major-minor 两段版本号，
  只有主版本号的 claude-opus-5 / claude-sonnet-5 完全不匹配，被当成旧模型：
  isBedrockOpus47OrNewer 假导致 thinking.enabled 不转 adaptive（Opus 5 上游
  已移除 budget_tokens，透传直接 400）、isBedrockClaude45OrNewer 假导致
  cache_control.ttl 被剥离、bedrockModelSupportsToolSearch 假导致 tool search
  被过滤。改为 minor 可选（缺省 minor=0），claude-sonnet-5 的同一问题一并修复。

Vertex 无需改动：normalizeVertexAnthropicModelID 只处理 -YYYYMMDD→@YYYYMMDD，
无日期后缀的裸 ID 原样透传即正确。context-1m-2025-08-07 白名单不动：Opus 系
上游不接受该 beta，且 Opus 5 的 1M 上下文是默认能力。

Antigravity 暂不接入：无上游支持证据，mapAntigravityModel 对未映射模型返回
空字符串即"该账号不支持"，fails closed 安全。

回归测试 internal/service/claude_opus5_test.go 覆盖定价两层兜底、Bedrock
三个闸门、thinking 转换与模型清单；逐个回退上述修复已确认测试会红。
 2026-07-25 11:22:42 +08:00
visa2 386b57bb77 fix(composite): pass the requested model through when a prefix route leaves upstream_model empty 
Composite model routes support a match_type: prefix mode with an optional
upstream_model. Leaving upstream_model empty is meant to pass the concrete
requested model through to the upstream, but every request matching the prefix
collapsed to the route's public_model instead. A route with
public_model=deepseek-v4, match_type=prefix and an empty upstream_model
forwarded both deepseek-v4-flash and deepseek-v4-pro upstream as deepseek-v4.

Root cause: normalizeCompositeRouteInput backfilled an empty upstream_model with
public_model at save time, so CompositeRouteResolver.Resolve never reached its
"upstreamModel == '' -> concrete requested model" fallback.

- Skip the backfill for prefix routes only; an empty upstream_model stays empty
  and Resolve passes the concrete requested model through.
- exact routes keep the backfill (model == public_model, so persisted/display
  contract is unchanged).
- Explicit upstream_model still forwards that fixed model in every mode.
- Frontend: add an upstream_model hint (zh/en) documenting empty = passthrough.
 2026-07-25 10:20:50 +08:00
Cynicismcart 521db6869e fix(openai): preserve pool-mode same-account retries 
Avoid recording the generic account-model transient cooldown for pool-mode statuses explicitly configured for same-account retry. This lets the bounded request-local retry budget complete while preserving cooldowns for other statuses and non-pool accounts.
 2026-07-25 05:31:31 +08:00
wucm667 30d146e8b5 fix(frontend): adapt affiliate copy controls for mobile 2026-07-25 04:27:19 +08:00
LIULIXING 1891faa68d fix(openai): keep item ID sanitization linear 2026-07-25 01:40:26 +08:00
wucm667 41456b69dd fix(frontend): upgrade postcss for security audit 2026-07-24 22:37:42 +08:00
ListenCodes c5d9d57940 fix(openai): sanitize API-key responses item IDs 2026-07-24 20:15:58 +08:00
wucm667 41f12e874d fix(grok): drop orphaned Responses tool choice 2026-07-24 16:25:53 +08:00
weiness 67bb446b5c fix(deps): upgrade postcss for GHSA-6g55-p6wh-862q 2026-07-24 16:12:34 +08:00
weiness 972a4a471e feat(admin): add announcement preview action 2026-07-24 15:44:34 +08:00
weiness 7b387e479d fix(frontend): share announcement rich text styles 2026-07-24 15:44:27 +08:00
wucm667 b5979050f3 fix(frontend): upgrade postcss for security audit 2026-07-24 08:33:58 +08:00
wucm667 8276fdf605 fix: resolve Gemini compat test lint 2026-07-24 03:00:26 +08:00
scp-planet d2d4fb9221 fix(openai): satisfy buffer write lint checks 2026-07-24 02:59:32 +08:00
scp-planet 1bdf99109b fix(openai): strip input namespaces for api key accounts 2026-07-24 02:59:32 +08:00
scp-planet e70fbf3204 fix(openai): strip residual input namespaces before HTTP forwarding 2026-07-24 02:59:32 +08:00
wucm667 4dc0aedbfe fix(gemini): preserve image output in chat completions 2026-07-24 02:42:23 +08:00
Edison42 1c0cb24c7e feat(usage): persist client session identifiers 2026-07-24 01:22:34 +08:00
404QAQ 4fd9182aff fix(images): log requested quality and size 2026-07-23 23:04:00 +08:00
404QAQ 38cc916f7d fix(pricing): skip remote scheduler without URL 2026-07-23 22:43:36 +08:00
wucm667 51f354f5c2 fix(grok): avoid pool cooldown on 5xx 2026-07-23 12:24:30 +00:00
github-actions[bot] cb24522dd5 chore: sync VERSION to 0.1.164 [skip ci] 2026-07-23 09:54:18 +00:00
Wesley Liddick cd8bb98c44 Merge pull request #4774 from superman2003/fix/issues-4763-4765-4769-20260723 
fix: optimize Codex identity imports and OpenAI account tests
v0.1.164 		2026-07-23 17:38:05 +08:00
shaw 1be6f30188 fix(ollama): 测试仓储到期查询深拷贝消除数据竞争 
ollamaUsageTestRepo.ListDueOllamaCloudUsageAccounts 返回浅拷贝共享
Extra/Credentials map，RunDue 过滤循环的无锁读与组写协程在 r.mu 下的
map 删改构成数据竞争（-race 可复现；无 -race 时也可能触发 runtime
concurrent map read/write fatal 导致 CI 偶发崩溃）。两条返回路径改为
r.mu 下 mergeMap 深拷贝，并补全 ListOllamaCloudUsageGroupAccounts
只拷 Extra 不拷 Credentials 的半克隆，与基类 GetByID 惯例对齐。
生产仓储每次查询返回全新行，不受影响。
 2026-07-23 17:14:10 +08:00
shaw 2faa0891e4 fix(ollama): 审计日志不落会话明文并收紧凭证清理守卫 
- PUT /admin/accounts/:id/ollama-cloud-usage/session 加入审计整体不入库
  路由，并把裸键 session 纳入键级脱敏兜底，防止浏览器会话 Cookie 明文
  留存 audit_logs.request_body
- UpdateCredentials 的 Ollama 清理分支加顶层 credentials DISTINCT 守卫，
  凭证未变化的持久化不再误清 openai 探测快照或重写 NULL extra
 2026-07-23 16:43:18 +08:00
Wesley Liddick 3f03c93bc6 Merge pull request #4776 from alfadb/feature/ollama-cloud-usage 
feat(ollama): 支持 Cloud 官方用量自动刷新
 2026-07-23 16:36:59 +08:00
alfadb 5ac4a9fac2 feat(ollama): 支持 Cloud 官方用量自动刷新 2026-07-23 15:50:44 +08:00
BayinForge e46d55bc57 fix(ci): make Caddy check portable across awk implementations 2026-07-23 14:46:09 +08:00
Wesley Liddick 2c76506e07 Merge pull request #4734 from wjx2951874/feat/alipay-mobile-precreate-deep-link 
feat(payment): add mobile Alipay precreate deep link
 2026-07-23 14:06:18 +08:00
superman2003 dd5956be5e fix(openai): prefer concrete GPT-5.6 test model 2026-07-23 13:44:15 +08:00
superman2003 5dfe838c21 fix(admin): optimize Codex identity import index 2026-07-23 13:43:57 +08:00
Wesley Liddick 6aeea70ee0 Merge pull request #4749 from heathermhuang/codex/fix-openai-proxy-stream-quarantine 
fix(openai): quarantine proxies after incomplete SSE streams
 2026-07-23 11:20:01 +08:00
Wesley Liddick 6f7bad3f2f Merge pull request #4751 from heathermhuang/codex/fix-grok-402-account-cooldown 
fix(grok): cool down accounts after upstream 402
 2026-07-23 11:19:30 +08:00
Wesley Liddick fbc88edf90 Merge pull request #4750 from heathermhuang/codex/fix-simple-default-grok-image 
fix(simple-mode): enable images for auto-created Grok default
 2026-07-23 11:19:20 +08:00