Commit Graph
100 Commits
Author SHA1 Message Date
Wesley Liddick ab80abc6d1 Merge pull request #7960 from feeeei/feat/group-i18n
feat(groups): 分组名称与描述支持多语言
2026-10-12 22:16:51 +08:00
Wesley Liddick 9591136d45 Merge pull request #8033 from Larry-Labs/fix/gpt61-sol-500k-context
fix(codex): raise GPT-6.1 Sol generated context default to 500k
2026-10-12 17:18:51 +08:00
Wesley Liddick 7b03b1f75a Merge pull request #8036 from Wei-Shaw/fix/gpt61-sol-subscription-long-context
fix(billing): 取消 GPT-6.1 Sol 订阅长上下文附加费
2026-10-12 17:04:09 +08:00
shaw 43768680d3 fix(billing): 取消 GPT-6.1 Sol 订阅长上下文附加费 2026-10-12 16:47:22 +08:00
Wesley Liddick e468262294 Merge pull request #8002 from obst4cle/fix/group-rpm-override-stale-load
fix(groups): ignore stale RPM override loads
2026-10-12 14:38:14 +08:00
Wesley Liddick 5dbb8f7085 Merge pull request #7649 from Yukinoshita-Yukino/fix/codex-image-bridge-openai-only
fix(openai): only inject the Codex image generation bridge for OpenAI accounts
2026-10-12 14:38:00 +08:00
Wesley Liddick 6d509c632d Merge pull request #7711 from wucm667/fix/issue-7709-risk-control-groups
fix(risk-control): remove deleted groups from moderation scope
2026-10-12 14:37:44 +08:00
Wesley Liddick 6a6d4728a0 Merge pull request #7696 from a408665321/codex/issue-7687-timer-only
fix(ui): refresh usage countdown when tab becomes visible
2026-10-12 14:37:26 +08:00
Wesley Liddick 832677a5e6 Merge pull request #7717 from ouchihao/codex/bug-payment-countdown-drift
fix(payment): calculate QR countdowns from elapsed time
2026-10-12 14:37:11 +08:00
Wesley Liddick c2885c430f Merge pull request #7738 from r266-tech/codex/monitor-add-platform
fix(monitor): allow adding missing platforms in v2 settings
2026-10-12 14:36:41 +08:00
Wesley Liddick 59fb22791e Merge pull request #7933 from yan9651688/feat/issue-7926-ops-details-account-column
feat(ops): show account names in request details table
2026-10-12 14:36:28 +08:00
Wesley Liddick 20b0be5b05 Merge pull request #7969 from ouchihao/codex/bug-ops-custom-timezone
fix(ops): initialize custom time ranges in local time
2026-10-12 14:36:12 +08:00
Wesley Liddick d70265306b Merge pull request #7970 from ouchihao/codex/bug-select-ime-navigation
fix(select): preserve keyboard input during IME composition
2026-10-12 14:35:53 +08:00
Wesley Liddick f2b1556bd4 Merge pull request #7972 from ouchihao/codex/bug-group-rate-edit-validation
fix(groups): reject nonpositive rate multiplier edits
2026-10-12 14:35:37 +08:00
Wesley Liddick 0ae1b371fa Merge pull request #7973 from ouchihao/codex/bug-monitor-auto-detail-refresh
fix(monitor): refresh cached availability on automatic reload
2026-10-12 14:35:24 +08:00
Wesley Liddick da9799542d Merge pull request #7974 from ouchihao/codex/bug-gemini-auth-url-error
fix(gemini): preserve authorization URL error messages
2026-10-12 14:35:12 +08:00
Wesley Liddick 6977bb63bb Merge pull request #7983 from hutututtt/fix/account-group-names
fix(frontend): show full account group names
2026-10-12 14:34:58 +08:00
Wesley Liddick b63dafa426 Merge pull request #7982 from wucm667/fix/issue-7981-embedded-static-asset
test(web): use shipped SVG asset in embedded frontend tests
2026-10-12 14:34:38 +08:00
Wesley Liddick f2669c8cf6 Merge pull request #7939 from IrisRainbowNeko/fix/issue-7927-web-search-history-tool
fix(openai): declare web_search when OAuth history replays web_search_call
2026-10-09 11:19:17 +08:00
shaw 85e3110953 fix(lint): check type assertions in web_search history helper and test 2026-10-09 11:10:11 +08:00
Wesley Liddick d0392edf06 Merge pull request #7618 from SavitarC/feat/provider-profile
feat(platform): 平台与多协议供应商改为数据驱动,并接入 Command Code 与 Cline
2026-10-09 11:01:09 +08:00
Wesley Liddick 5fc0e486c3 Merge pull request #7916 from wucm667/fix/issue-7914-monitor-request-sample
fix(channel-monitor): require request samples before health scoring
2026-10-08 13:52:34 +08:00
Wesley Liddick 3e69643392 Merge pull request #7721 from ouchihao/codex/bug-fractional-byte-rate
fix(ops): retain byte units for sub-byte throughput
2026-10-08 13:51:52 +08:00
Wesley Liddick 3a012ac0ce Merge pull request #7725 from ouchihao/codex/bug-select-disabled-open
fix(ui): close selectors when they become disabled
2026-10-08 13:51:40 +08:00
Wesley Liddick 80dd7288a6 Merge pull request #7728 from ouchihao/codex/bug-oauth-code-unmount
fix(auth): avoid starting OAuth code cooldowns after unmount
2026-10-08 13:51:30 +08:00
Wesley Liddick 5a6e826f83 Merge pull request #7716 from ouchihao/codex/bug-scaled-price-exponent
fix(pricing): preserve exponents when trimming scaled prices
2026-10-08 13:51:19 +08:00
Wesley Liddick d068b866f3 Merge pull request #7718 from ouchihao/codex/bug-bulk-user-error-message
fix(users): show normalized errors when bulk updating limits
2026-10-08 13:51:05 +08:00
Wesley Liddick a618338987 Merge pull request #7719 from ouchihao/codex/bug-notify-email-timers
fix(profile): ignore obsolete notification email code responses
2026-10-08 13:50:54 +08:00
Wesley Liddick b0c2c4d623 Merge pull request #7720 from ouchihao/codex/bug-usage-zero-rate
fix(usage): preserve zero user multipliers in cost details
2026-10-08 13:50:39 +08:00
Wesley Liddick 9663b5ccf0 Merge pull request #7722 from ouchihao/codex/bug-announcement-read-failure
fix(announcements): report failed read confirmations accurately
2026-10-08 13:50:19 +08:00
Wesley Liddick 6cfa0f4ef8 Merge pull request #7723 from ouchihao/codex/bug-batch-image-access-retry
fix(batch-image): allow access lookup retries after request failures
2026-10-08 13:50:08 +08:00
Wesley Liddick 3149d62851 Merge pull request #7724 from ouchihao/codex/bug-cleanup-task-race
fix(usage): ignore obsolete cleanup task list responses
2026-10-08 13:49:58 +08:00
Wesley Liddick 0b51cbe15d Merge pull request #7729 from ouchihao/codex/bug-backup-polling-unmount
fix(backup): prevent polling from restarting after navigation
2026-10-08 13:49:48 +08:00
Wesley Liddick 3dc2a9c371 Merge pull request #7731 from ouchihao/codex/bug-dialog-escape-stack
fix(ui): limit Escape to the most recently opened dialog
2026-10-08 13:49:34 +08:00
Wesley Liddick 2c13fb595e Merge pull request #7764 from ouchihao/codex/bug-plugin-config-session-race
fix(plugins): ignore obsolete configuration UI sessions
2026-10-08 13:49:23 +08:00
Wesley Liddick 068239305e Merge pull request #7765 from ouchihao/codex/bug-compliance-reset-race
fix(auth): keep cleared compliance state isolated from pending requests
2026-10-08 13:49:13 +08:00
Wesley Liddick 9e46f2d77e Merge pull request #7732 from ouchihao/codex/bug-step-up-concurrent-prompts
fix(auth): share pending step-up verification prompts
2026-10-08 13:48:52 +08:00
Wesley Liddick 2eb7ccb6d2 Merge pull request #7703 from wucm667/fix/issue-7700-thinking-signature
fix(openai): recover rejected encrypted reasoning signatures
2026-10-08 13:48:33 +08:00
Wesley Liddick 745ff1d3ca Merge pull request #7911 from lyy0709/codex/usage-output-tps
feat(usage): add output TPS to usage logs and ops dashboard
2026-10-08 11:40:15 +08:00
Wesley Liddick 8e2c4fad32 Merge pull request #7793 from wucm667/fix/issue-7784-composite-route-model-list
fix(models): list composite exact route aliases
2026-10-08 11:39:51 +08:00
Wesley Liddick 0ac774e378 Merge pull request #7853 from wucm667/feat/issue-7847-compact-account-filters
feat(accounts): compact account search and filters
2026-10-08 11:39:40 +08:00
Wesley Liddick ba3af61251 Merge pull request #7897 from wucm667/fix/issue-7894-long-context-marker
fix(usage): replace misleading long-context multiplier badge
2026-10-08 11:37:40 +08:00
Wesley Liddick 48c647b5d2 Merge pull request #7833 from ShanYi-Hui/fix/preserve-email-binding-draft
fix(profile): preserve email binding draft during user refresh
2026-10-08 11:37:25 +08:00
Wesley Liddick b94974467b Merge pull request #7818 from ouchihao/codex/bug-custom-page-request-race
fix(custom-pages): ignore obsolete Markdown responses
2026-10-08 11:37:11 +08:00
Wesley Liddick 4747827e35 Merge pull request #7819 from ouchihao/codex/bug-stripe-payment-unmount
fix(payment): stop late Stripe callbacks after leaving the page
2026-10-08 11:36:59 +08:00
Wesley Liddick f3bcad3c33 Merge pull request #7839 from ouchihao/codex/bug-scheduled-results-race
fix(admin): keep scheduled test results scoped to the expanded plan
2026-10-08 11:36:33 +08:00
Wesley Liddick 2c6bd63de9 Merge pull request #7840 from ouchihao/codex/bug-monitor-template-list-race
fix(monitor): ignore obsolete template manager list responses
2026-10-08 11:36:19 +08:00
Wesley Liddick 02aad478f3 Merge pull request #7841 from ouchihao/codex/bug-alert-events-pagination-race
fix(ops): discard stale alert event pages after filter changes
2026-10-08 11:36:07 +08:00
Wesley Liddick 486b226b69 Merge pull request #7842 from ouchihao/codex/bug-ops-settings-load-guard
fix(ops): require loaded settings before saving
2026-10-08 11:35:56 +08:00
Wesley Liddick d1202bea5f Merge pull request #7843 from ouchihao/codex/bug-alert-rule-integer-duration
fix(ops): validate alert rule durations as whole minutes
2026-10-08 11:35:42 +08:00
Wesley Liddick 1865f28469 Merge pull request #7900 from ouchihao/codex/bug-rpm-edit-number
fix(groups): preserve numeric values when editing RPM overrides
2026-10-08 11:35:27 +08:00
Wesley Liddick c2f0edc137 Merge pull request #7901 from ouchihao/codex/bug-airwallex-navigation
fix(payment): stop Airwallex checkout after leaving the page
2026-10-08 11:35:15 +08:00
Wesley Liddick cdbf1d6f4d Merge pull request #7902 from ouchihao/codex/bug-passthrough-toggle-state
fix(admin): use the saved passthrough rule enabled state
2026-10-08 11:35:01 +08:00
Wesley Liddick b126b94525 Merge pull request #7903 from ouchihao/codex/bug-profile-username-draft
fix(profile): preserve username edits made during save
2026-10-08 11:34:49 +08:00
Wesley Liddick 7fc5332b45 Merge pull request #7904 from ouchihao/codex/bug-group-rate-load-race
fix(groups): ignore stale rate multiplier loads
2026-10-08 11:34:38 +08:00
Wesley Liddick 4bcad0657b Merge pull request #7800 from duckducktw/fix/pricing-entry-autofill-append
fix(channels): 追加模型时不再改写条目已留空的价格
2026-10-08 11:34:17 +08:00
Wesley Liddick 7ff5cff1bb Merge pull request #7822 from neotan/fix/issue-7670-bare-api-alias-bypass
fix(web): bypass bare API aliases from embedded frontend fallback
2026-10-08 11:33:58 +08:00
Wesley Liddick bc63bd2874 Merge pull request #7782 from lyy0709/codex/fix-remote-model-catalog
fix(models): enforce account mappings for remote Codex discovery
2026-10-08 11:33:27 +08:00
Wesley Liddick 458865ed1b Merge pull request #7878 from Achordchan/fix/account-test-log-context
fix(accounts): attribute connectivity test failure logs
2026-10-08 11:33:14 +08:00
Wesley Liddick 3a7fd4ae78 Merge pull request #7837 from yJader/fix/antigravity-account-test-models
fix: use account mapping keys for Antigravity connectivity tests
2026-10-08 11:32:59 +08:00
Wesley Liddick 4b8c557705 Merge pull request #7877 from hezhaoqian1/fix/upstream-channel-monitor-zhipu-path
fix(channel-monitor): build zhipu probe URL from the configured endpoint
2026-10-08 11:32:38 +08:00
Wesley Liddick bb0d4a53c9 Merge pull request #7887 from whhphd/fix/grok-sso-consent
fix(grok): include consent token and origin in SSO device approval
2026-10-08 11:32:25 +08:00
Wesley Liddick 3c274768c1 Merge pull request #7889 from aishangwuji/fix/opencode-zen-routing-and-unsupported-models
fix(opencode): correct Zen qwen3.8-max endpoint and reject unsupported models
2026-10-08 11:32:11 +08:00
Wesley Liddick bbf1d37783 Merge pull request #7891 from aishangwuji/fix/opencode-go-usage-retry-after-and-403
fix(opencode): cap Retry-After backoff at 24h and report neutral 403
2026-10-08 11:31:40 +08:00
Wesley Liddick 90afaf120e Merge pull request #7854 from wucm667/fix/issue-7852-chat-stream-heartbeats
fix(streaming): preserve chat stream heartbeat comments
2026-10-08 11:28:38 +08:00
Wesley Liddick 6cacccc767 Merge pull request #7775 from YahooYuan666/fix/grok-empty-completed-silent-refusal
fix(grok): fail over silent-refusal empty response.completed on Grok Responses streams
2026-10-08 11:28:22 +08:00
Wesley Liddick 2afe7d4577 Merge pull request #7910 from liuyh06/codex/fix-responses-namespace-noop
perf(openai): lazily rebuild input when stripping namespaces
2026-10-08 11:28:02 +08:00
Wesley Liddick 129369204e Merge pull request #7827 from Achordchan/fix/anthropic-tool-change-betas
fix(anthropic): preserve requested tool change beta headers
2026-10-08 11:27:45 +08:00
Wesley Liddick f19cd4fdea Merge pull request #7844 from cyhhao/fix/anthropic-cache-ttl-order
fix(anthropic): keep cache TTL order valid on the mimic path
2026-10-08 11:27:27 +08:00
Wesley Liddick e473fba99c Merge pull request #7869 from 3219378872/fix/thinking-signature-key
fix(apicompat): always include `signature` on Anthropic thinking blocks
2026-10-08 11:27:14 +08:00
Wesley Liddick cc4a1e3f61 Merge pull request #7789 from SPHINX998/fix/anthropic-buffered-negative-block-index
fix(gateway): ignore negative content block index in buffered Anthropic paths
2026-10-08 11:26:47 +08:00
Wesley Liddick 9d49d275f3 Merge pull request #7788 from SPHINX998/fix/apicompat-responses-refusal-to-chat
fix(apicompat): preserve refusals when converting Responses to Chat
2026-10-08 11:26:28 +08:00
Wesley Liddick 8d50466809 Merge pull request #7787 from SPHINX998/fix/apicompat-chat-legacy-function-call
fix(apicompat): pair legacy chat function calls with their results
2026-10-08 11:26:15 +08:00
Wesley Liddick f9bd97cc15 Merge pull request #7786 from SPHINX998/fix/apicompat-chat-developer-role
fix(apicompat): keep chat developer messages as developer role
2026-10-08 11:26:03 +08:00
Wesley Liddick f087fdb205 Merge pull request #7785 from SPHINX998/fix/apicompat-chat-named-tool-choice
fix(apicompat): flatten named chat tool_choice for Responses
2026-10-08 11:25:46 +08:00
Wesley Liddick ef16f8a3d1 Merge pull request #7792 from SPHINX998/fix/ws-passthrough-image-usage
fix(openai): account image input usage on WS passthrough
2026-10-08 11:25:31 +08:00
Wesley Liddick 6db4171cfb Merge pull request #7779 from SPHINX998/fix/ws-turn-group-pricing
fix(openai-ws): bill each later turn with the current group pricing
2026-10-08 11:25:10 +08:00
Wesley Liddick db29b3a773 Merge pull request #7811 from kingsleydon/fix/codex-service-tiers-null-fallback
fix(codex): never advertise null service_tiers in models manifest
2026-10-08 11:23:47 +08:00
Wesley Liddick 0363b8cdba Merge pull request #7893 from Wei-Shaw/fix/issue-7850-admin-bootstrap-hardening
fix(setup): stop shipping guessable admin credentials on fresh installs (fixes #7850)
2026-10-07 09:50:45 +08:00
shaw 0f9d460dc6 fix(deps): resolve frontend audit failures (vue, source-map-js, xlsx exceptions)
- Bump vue to ^3.5.43 so @vue/server-renderer is >= 3.5.42
  (GHSA-g2v6-rqmx-r4w6).
- Override source-map-js to >= 1.2.2 (GHSA-68fv-2mgg-jv7q).
- Renew the expired xlsx exceptions until 2027-01-06: xlsx has no patched
  release on npm and is only used for XLSX.write export in the admin usage
  view; both advisories require parsing a crafted file and no read path exists.

Lockfile regenerated with pnpm 9 to match CI.
2026-10-07 09:44:01 +08:00
shaw 6e315616ed fix(setup): stop shipping guessable admin credentials on fresh installs (fixes #7850)
Fresh Docker installs created the admin as admin@sub2api.local and accepted
any ADMIN_PASSWORD (e.g. "123456"), making them easy brute-force targets.

- Generate a random admin-<12 hex>@sub2api.local login email when
  ADMIN_EMAIL is empty; drop the fixed default from .env.example and the
  compose files, and have docker-deploy.sh write a random ADMIN_EMAIL.
- Validate user-supplied ADMIN_PASSWORD (8-72 bytes) and ADMIN_EMAIL on the
  auto-setup path, only when an admin is actually about to be created, so
  existing deployments are never blocked at startup.
- Align validateEmail with the login endpoint's email binding so setup can no
  longer create an admin that can never log in (e.g. "a@b", "Name <a@b.com>").
- Cap validatePassword at bcrypt's 72-byte limit; the CLI reuses it and now
  defaults to a random admin email instead of admin@example.com.
- Update READMEs/deploy docs to stop suggesting guessable credentials.
2026-10-07 09:27:36 +08:00
Wesley Liddick d97ccc952f Merge pull request #7888 from honestTai/fix/easypay-callback-forgery
fix(payment): 修复易支付回调签名复用伪造入账漏洞 (fixes #7881)
2026-10-07 08:33:53 +08:00
Wesley Liddick 33d9e72f90 Merge pull request #7851 from ZeroClover/fix/remote-model-catalog-discovery
fix: enable API-key discovery for remote Codex catalogs
2026-10-07 08:27:17 +08:00
Wesley Liddick 3040209f20 Merge pull request #7813 from kingsleydon/fix/typesafe-upstream-billing-probe
fix(billing): allow upstream billing probe for TypeSafe API-key accounts
2026-10-02 20:02:28 +08:00
Wesley Liddick f5aca74623 Merge pull request #7816 from Wei-Shaw/fix/usage-billing-deleted-key
fix(billing): settle usage when the API key is deleted before billing completes
2026-10-02 20:01:45 +08:00
shaw 432a6a461f chore(billing): simplify comment 2026-10-02 19:52:00 +08:00
shaw c2d5bbd93e fix(billing): settle usage when the API key is deleted before billing completes
When an API key with quota or rate limits was deleted while a request was
still in flight, the key counter update matched no rows and returned
ErrAPIKeyNotFound, rolling back the whole billing transaction including the
balance/subscription charge. Skip the key-scoped counters in that case and
keep settling the user and account side as usual.
2026-10-02 19:51:06 +08:00
Wesley Liddick ae501cc220 Merge pull request #7814 from Wei-Shaw/docs/security-policy
docs: add security policy with private vulnerability reporting
2026-10-02 19:06:07 +08:00
shaw 99efaa477f docs(security): add dev@sub2api.org as fallback reporting email 2026-10-02 19:04:36 +08:00
shaw d9d4333795 docs: add security policy with private vulnerability reporting
Closes #7812
2026-10-02 18:59:29 +08:00
Wesley Liddick 5106065716 Merge pull request #7630 from william-drakemond/feat/account-priority-quick-adjust
feat(admin): inline quick-adjust stepper for account priority
2026-10-02 14:33:29 +08:00
Wesley Liddick 46f5f5e8ba Merge pull request #7773 from william-drakemond/fix/custom-error-codes-warning-text
fix(frontend): correct custom error code warning and upgrade Axios
2026-10-02 14:33:03 +08:00
Wesley Liddick 2529371bab Merge pull request #7676 from william-drakemond/fix/email-code-token-atomic
fix(email): 验证码尝试次数原子化 + 重置密码 token 哈希存储且原子单次消费
2026-10-02 14:32:42 +08:00
Wesley Liddick 43c4c882fd Merge pull request #7674 from william-drakemond/fix/antigravity-sanitize-upstream-error
fix(antigravity): 返回客户端前脱敏上游错误体,避免泄露账号池身份
2026-10-02 14:32:12 +08:00
Wesley Liddick 719013053a Merge pull request #7803 from william-drakemond/feat/api-key-group-sort
feat(keys): 支持按分组名称排序 API 密钥
2026-10-02 14:31:49 +08:00
Wesley Liddick f3dc0835df Merge pull request #7673 from william-drakemond/fix/public-order-verify-hardening
fix(payment): 为匿名订单查询接口 /payment/public/orders/verify 增加 IP 限流
2026-10-02 14:31:17 +08:00
Wesley Liddick 5637f469fa Merge pull request #7802 from feeeei/feat/recharge-promotion-tiers
feat(payment): 充值优惠阶梯,支持赠金与折扣两种模式
2026-10-02 14:30:29 +08:00
Wesley Liddick 34fe845f5a Merge pull request #7425 from aofee/codex/jev-system-one
feat: add native TypeSafe Jev System One support
2026-10-02 14:16:08 +08:00
shaw fa49647c6d test(model): 错误透传平台列表守卫纳入 typesafe 2026-10-02 14:00:12 +08:00
shaw 9eb394e3e9 fix(typesafe): 堵住校验解析差异与审计盲区,收紧模型列表口径
- System One 校验拒绝重复键与大小写/Unicode 折叠变体键(请求顶层、
  questions、问题对象):encoding/json 大小写不敏感且取最后一个重复键,
  而原始 body 原样转发,此前 {"model":"x","MODEL":"jev-latest"} 可绕过
  jev-latest 限制、模型白名单与流式限制。
- Prompt 审计与旧审核同时收集对象键名、问题 ID 与未知扩展字段(不含规范
  字段名与已校验的 type),此前把内容放进键名即可完全绕过审计。
- 上游成功响应的 usage/model 宽松解码(浮点、数字字符串),避免上游已
  计费而网关整体 502 不记账;解码失败记录 response_error ops 事件。
- 上游 413 与 400/422 同视为请求错误:透传状态码、不切换、不改账号状态。
- TypeSafe base_url 末尾的 /v1 自动剥离,避免拼出 /v1/v1/systemone;
  /v1/systemone 改挂文本请求体上限。
- Composite 静态兜底模型列表、管理端候选列表恢复为不含 jev-latest;
  Codex 清单永不列出 TypeSafe 模型;TypeSafe 分组候选默认 jev-latest。
- 创建账号从 Grok 切到 TypeSafe 时重置为白名单模式;错误透传平台列表补 typesafe。
2026-10-02 13:51:58 +08:00