wushenghua/sub2api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5,020 Commits 1 Branch 0 Tags
bfabfe60c84cfbb10fbe7900a7ea2bd280aefb75
Commit Graph
5020 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Wesley LiddickandGitHub bc4bd118d8 Merge pull request #4547 from heathermhuang/codex/fix-model-scoped-temp-cooldown-4527 
fix(routing): isolate temporary cooldowns by model
 2026-07-18 20:41:12 +08:00
Wesley LiddickandGitHub f3925db11b Merge pull request #4496 from StarryKira/agent/fix-4470-pool-temp-unschedulable 
fix: honor temp unschedulable rules in pool mode
 2026-07-18 20:40:12 +08:00
Wesley LiddickandGitHub f9a467a4c0 Merge pull request #4520 from StarryKira/codex/fix-4487 
fix: report Chat Completions stream transport failures
 2026-07-18 20:39:49 +08:00
Wesley LiddickandGitHub 8ce9288a6a Merge pull request #4489 from fengshao1227/fix/grok-free-cache-tool-injection 
fix(grok): 纯客户端函数工具不再注入原生搜索工具
 2026-07-18 20:39:37 +08:00
Wesley LiddickandGitHub c1e702be5e Merge pull request #4505 from cyhhao/fix/claude-1m-model-suffix 
fix(gateway): normalize Claude Code 1m model suffix
 2026-07-18 20:39:27 +08:00
Wesley LiddickandGitHub bc6b69289c Merge pull request #4468 from docooler/fix/responses-stream-content-part 
fix(apicompat): emit content_part events and full output in Responses stream
 2026-07-18 20:39:15 +08:00
Wesley LiddickandGitHub 5a0492bf88 Merge pull request #4517 from weiness/fix/custom-branding-flash 
fix: prevent custom branding flash on initial load
 2026-07-18 20:39:00 +08:00
Wesley LiddickandGitHub fdc9d92fdb Merge pull request #4528 from feitianbubu/fix/plan-validity-label-unit 
fix(i18n): 套餐有效期表头与表单标签去掉写死的"天"，与动态单位一致
 2026-07-18 20:38:47 +08:00
Wesley LiddickandGitHub 8cdd372b7e Merge pull request #4507 from coo1white/fix-dockerfile-cross-compile 
fix(docker): cross-compile the image instead of running Go under QEMU
 2026-07-18 20:38:37 +08:00
Wesley LiddickandGitHub 080a52121a Merge pull request #4506 from coo1white/fix-compose-redis-command 
fix(deploy): make the redis command flags take effect
 2026-07-18 20:38:27 +08:00
harukaandClaude Opus 4.8 37db8d031b fix(config): 让环境变量能真正配置 image_storage 等凭证 
viper.Unmarshal 只解码 AllKeys() 返回的键，而 AllKeys() 只汇总 SetDefault、
配置文件和显式 BindEnv 三个来源。AutomaticEnv 仅能覆盖已在其中的键，无法引入
新键；能兜底的 viper_bind_struct 又被 build tag 排除（我们只用 -tags embed）。

因此任何「没有注册默认值、且不在 config.yaml 里」的配置项，其环境变量会被静默
丢弃。image_storage 的 endpoint/bucket/access_key_id/secret_access_key/
public_base_url 正属此列，于是纯环境变量部署落到最坏组合：IMAGE_STORAGE_ENABLED
生效使 Enabled=true，四个凭证却为空 → Active()=false → 异步生图接口整体 404，
运维看到的却是"凭证不完整"。deploy/docker-compose.yml 默认就是纯环境变量驱动，
且自动生成的 config.yaml 从不写 image_storage 段，必然踩中（见 #4458、#4542）。

同类缺口不止于此：github_oauth、google_oauth、dingtalk_connect 三组第三方登录
配置（含 client_secret）同样完全无法用环境变量设置。

- 为这些键注册零值默认，使其进入 AllKeys() 而可被环境变量覆盖。零值与"键缺失"
  时的解码结果一致，故行为不变。
- sticky_escape_enabled 例外：它的实际默认是 true（靠 IsSet 守卫在解码后补上），
  注册 false 会让 IsSet 恒真而永久关闭该特性，故直接注册 true。
- 启动告警补上 missing_keys 字段，指明到底哪个凭证为空。
- 新增反射守卫测试：Config 结构体上每个可由环境变量表达的字段都必须已注册默认值。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VHreE5pzCkSYz7J45fmd2Y
 2026-07-18 05:24:32 -07:00
王鹏 f0e0b7e6d8 fix(openai-ws): enforce passthrough turn lifecycle 2026-07-18 19:17:53 +08:00
Heatherm Huang 4c845ca697 test(grok): sanitize security fixtures 2026-07-18 17:50:53 +08:00
Heatherm Huang 95d27f2dce fix(grok): fetch validated signed video content 2026-07-18 17:49:09 +08:00
Heatherm Huang f2e7a55703 fix(grok): proxy signed video status URLs 2026-07-18 17:21:53 +08:00
Heatherm Huang 1ed9f59599 test(grok): keep media failover coverage on generation 2026-07-18 15:54:43 +08:00
Heatherm Huang b4ad7fd363 test(grok): configure multipart media mapping 2026-07-18 15:49:21 +08:00
Heatherm Huang ef2a22be70 fix(routing): isolate temporary cooldowns by model 2026-07-18 15:35:30 +08:00
Heatherm Huang c831bb979f fix(grok): scope video content to request owner 2026-07-18 14:56:15 +08:00
Heatherm Huang 3edcbfd120 fix(grok): keep media content proxy URLs same-origin 2026-07-18 14:43:08 +08:00
wucm667 1db10dc559 fix(subscription): renew expired admin assignments 2026-07-18 14:42:22 +08:00
Vz7797andHeatherm Huang 3f6b5c7bd7 fix(grok): proxy protected video content through upstream account 
(cherry picked from commit a01177e294aa3df1134cd3cf12b49635c1097035)
 2026-07-18 14:37:25 +08:00
Heatherm Huang 2946281a43 fix(grok): retry CLI chat permission denial 2026-07-18 14:32:56 +08:00
Heatherm Huang 335edde9c8 fix(grok): apply account model mapping to media 2026-07-18 14:21:47 +08:00
mark-ly-wangandHeatherm Huang 1a855d3e0e fix(monitor): extract anthropic text blocks 
(cherry picked from commit 76cf1ee834c78e3b15dee6fc23244fbae94a4bd1)
 2026-07-18 13:53:36 +08:00
Wesley LiddickandGitHub b1a6b80267 Merge pull request #4526 from Wei-Shaw/feat/security-switches-default-off 
feat(security): 敏感操作 step-up 2FA 开关化，安全开关默认关闭
 2026-07-18 11:32:17 +08:00
feitianbubu c3f759d13a fix(i18n): 套餐有效期表头与表单标签去掉写死的"天"，与动态单位一致 2026-07-18 10:59:11 +08:00
shaw 539bfc8bad feat(security): 敏感操作 step-up 2FA 开关化，安全开关默认关闭 
新增系统设置 step_up_enabled（默认关闭），把敏感操作 2FA 门控做成可开关；
同时将会话 IP/UA 绑定默认值从开启改为关闭，避免用户因 IP 变动登录后掉线。

## 新增功能
- 敏感操作 step-up 2FA 总开关 step_up_enabled（默认关闭）：关闭时账号/代理导出、
  备份创建/下载、S3 配置修改、提升管理员等操作恢复门控引入前的直接放行行为；
  开启后要求当前会话在 15 分钟内完成过 TOTP step-up 验证。

## 优化改进
- 会话 IP/UA 绑定默认改为关闭（功能保留，可在设置页按需开启）。
- 开启 step-up 开关需操作者本人已启用 TOTP（防自锁）；关闭开关本身作为敏感操作，
  需通过 step-up 验证（防止攻击者拿到会话后先关闸再导出/备份）。
- 两个安全开关请求字段改为可空指针（省略=保持现值），避免旧客户端全量保存时
  静默重置安全开关。
- 备份恢复（整库覆盖可回滚安全设置）纳入 step-up 门控。
- 审计摘要 diffSettings 补记 step_up_enabled / session_binding_enabled 变更。

## Bug 修复
- 修复 BackupView 恢复操作 409（恢复进行中）判断未适配 apiClient 扁平化错误对象。
 2026-07-18 10:46:42 +08:00
wucm667 8b75dd5576 docs: clarify OpenAI WS mode router prerequisite 2026-07-18 08:37:15 +08:00
haruka bd0f2d6405 fix: report chat stream transport failures 2026-07-18 03:24:04 +08:00
benjamin 71afe24710 fix: 修复CI检查问题 2026-07-18 00:42:16 +08:00
weiness 500f241692 fix: prevent custom branding flash on initial load 2026-07-18 00:24:06 +08:00
benjamin b92bbf0299 fix: 过滤入口拒绝日志并强化鉴权边界 2026-07-18 00:11:18 +08:00
wucm667 2594950993 fix: classify transient account exhaustion as 503 instead of 404 2026-07-17 22:10:18 +08:00
Nick 9386ce8a13 fix(docker): cross-compile the image instead of running Go under QEMU 
Building the image for linux/amd64 on an arm64 host (Apple Silicon)
kept failing at 'go mod download' with 'unexpected EOF'.

Two changes:

1. The builder stages had no --platform, so the Node and Go toolchains
   ran under QEMU emulation of the target arch. Pin frontend-builder
   and backend-builder to $BUILDPLATFORM and cross-compile: add
   TARGETOS/TARGETARCH args and set them on 'go build'. The binary is
   CGO_ENABLED=0, so this is a clean pure-Go cross-compile - much
   faster, and the emulated networking that dropped module fetches
   with EOF is gone. The frontend output is JS (arch-neutral), so it
   is safe to build on the host arch too.

2. Add go module and build cache mounts, so a retry after a network
   blip goes on from where it stopped instead of starting over.

The runtime image and app behavior are unchanged.
 2026-07-17 21:05:42 +07:00
Nick be74deae73 fix(deploy): make the redis command flags take effect 
The redis command is one quoted script given to the inner `sh -c`.
Docker compose keeps the newlines inside the quoted string, so
`redis-server` on the first line ran as a complete command with no
flags at all, and --save / --appendonly / --appendfsync after it were
silently never applied (`redis-cli CONFIG GET appendonly` said "no").

Trailing `\` line continuations fold the script back into one command.
Checked with redis:7-alpine: appendonly is now "yes" and save is
"60 1".
 2026-07-17 21:04:47 +07:00
cyh 2264a33085 fix(gateway): normalize Claude Code 1m model suffix 2026-07-17 21:59:57 +08:00
Tian Lee d2585097f3 fix: 完善上游 Sub2API 计费倍率探测与账号展示 2026-07-17 20:59:29 +08:00
Heatherm Huang e86063155f fix(grok): gate OAuth media on paid eligibility 2026-07-17 19:15:16 +08:00
haruka 1f7b7b9132 fix: honor temp unschedulable rules in pool mode 2026-07-17 18:12:33 +08:00
li 7043982ae3 fix(grok): 纯客户端函数工具不再注入原生搜索工具 
Fixes #4486
 2026-07-17 16:59:40 +08:00
github-actions[bot] 57914967cb chore: sync VERSION to 0.1.160 [skip ci] 2026-07-17 08:48:10 +00:00
Wesley LiddickandGitHub 8bfbc5ca99 Merge pull request #4485 from Sub2API-Devs/dev 
feat(security-audit): 新增 OpenAI 兼容提示词审计能力与安全审计控制台
 2026-07-17 16:15:26 +08:00
Wesley LiddickandGitHub cb40288fb8 Merge pull request #4479 from fengshao1227/fix/backup-s3-stepup-totp 
fix(frontend): saveS3Config 接入 step-up TOTP 门控
 2026-07-17 16:14:49 +08:00
Wesley LiddickandGitHub 33766c299f Merge pull request #4481 from fengshao1227/fix/passive-image-namespace-capability 
fix(gateway): 被动 image_gen namespace 不再强制要求 Responses capability
 2026-07-17 16:14:35 +08:00
Wesley LiddickandGitHub 13468b3fa5 Merge pull request #4484 from heathermhuang/codex/fix-grok-scheduler-media-cache 
fix(grok): preserve media eligibility in scheduler cache
 2026-07-17 16:13:31 +08:00
mt21625457 e69e46ba02 feat: allow one-click audit event filter deletion 2026-07-17 15:50:31 +08:00
Heatherm Huang eaf0691752 fix(grok): preserve media eligibility in scheduler cache 2026-07-17 15:45:19 +08:00
li 5fd030a01b test: 更新 image permission 测试适配 explicit intent 检查 
被动 namespace 不再触发 403，新增 PassiveNamespaceDoesNotTrigger403
测试和 OpenAI native/image model 的正向用例。
 2026-07-17 15:29:14 +08:00
li fc3c5a1e0c fix: 权限检查和并发槽也使用显式检查，修复被动 namespace 触发 403 
Fixes #4447
 2026-07-17 15:15:54 +08:00