jlcodes99/cockpit-tools v1.3.52

Cockpit Tools v1.3.52

on GitHub

更新日志（中文）

[1.3.52] - 2026-09-14

新增

• DeepSeek 实例在底部显示账号余额：绑定 DeepSeek 账号的实例不再受接入方式限制，网关列出、CDP 注入和直连官方都会在输入框下方显示余额徽标；点击可查看总余额、赠金余额、充值余额、可用状态与币种，也可手动刷新。余额来自 DeepSeek 官方余额接口，60 秒自动刷新一次，查询失败时保留上一次的有效结果。该显示跟随「显示 API 服务额度」开关，关闭后不再注入。
• 实例网关现在可以在账号总览直接查看：API 服务卡片上新增「实例网关」入口，显示数量与异常提示；点开后的弹框以只读方式列出所有实例级本地网关（供应商网关、混合模型路由），每张卡片按「实例与状态 → 账号 / 本地地址 / 协议 / 上游模型」对齐展示，地址行可直接复制，重启与关闭放在卡片右侧竖排；网关较多时只在列表区域内部滚动，标题、刷新与关闭按钮保持可见。
• 实例网关支持启动自愈：宿主重启后，只要 profile 仍绑定需要网关的账号，且该网关此前启动过（或对应 Codex 实例仍在运行），供应商网关会在后台自动重建，失败会按次数重试并在实例网关弹框里显示失败原因。网关端口改为按 profile 持久化，仍处于打开状态的 Codex 实例不会因为端口变化失联；端口被占用时会自动改用新的空闲端口。
• 鹈鹕测智支持展示本轮 Token 与 5h 额度：每个账号列会显示本轮消耗的 Token 数与 5h 额度消耗值（无法计算差值时显示剩余额度），结果详情弹框展示剩余额度与重置时间。额度优先读取上游响应头，缺失时回退到账号配额接口。
• 统计与日志支持展示 Codex 请求的速度模式：每条请求日志都会显示实际生效的档位标记（「快速」「超高速」「标准」，客户端请求的其它档位如 flex 按原值显示），便于确认哪些请求真正以快速模式处理。取值依次来自上游实际返回的档位、客户端请求的档位和当前速度注入的默认档位，被上游降级或按标准档位处理的请求不再显示为空。
• Codex 账号导出与导入现在会带上标签和分组：导出「Cockpit Tools」格式时，每个账号会一并写入标签、账号备注名、账号结构与所属分组（文件夹）名称；导入同一份文件时会自动恢复这些标签与归类，同名分组直接复用，缺失的分组按文件自动创建，方便多人或多设备沿用同一套分类管理。旧版本导出的文件没有这些字段，导入行为与之前完全一致；auth.json、sub2api、cpa 等对外格式不受影响。
• Codex 速度支持官方「超高速」档位：账号总览、启动预览与实例表单的速度选择器在「标准」「快速」之外新增「超高速」（官方 service tier ultrafast），切号与启动时按官方客户端当前的落盘规则写入 config.toml 顶层 service_tier（快速写 priority，标准写 default），并保留旧的 [desktop] default-service-tier 与客户端持久化状态，切换账号后速度仍然生效。托管给官方客户端的模型目录会与官方一致地为 gpt-5.6-sol 声明该档位，API 服务会原样转发 service_tier: "ultrafast" 而不再丢弃，请求日志以「超高速」标记（官方尚未公布单独费率前，费用估算按快速档费率计算）。

变更

• 模型管理默认关闭，并且不再被混合模型路由打开：升级后首次启动会把历史遗留的「模型管理」统一关闭、恢复跟随官方模型目录，且只执行这一次，之后由你自己开启或关闭。混合模型路由不再改动这个开关：它需要的那份模型目录只在实例运行期间临时生效，停止实例或退出 Cockpit 后自动恢复，其他账号和实例不受影响。

修复

• 修复第三方推理历史导致会话切到严格 Responses 上游或官方账号后无法继续：DeepSeek 等第三方供应商返回的 reasoning 项会把可见推理正文放在 content 里，同时带上非官方的 encrypted_content，官方 Codex 后端会直接拒绝（Invalid 'input[i].content': array too long. Expected an array with maximum length 0，以及 The encrypted content ... could not be verified），自动压缩同样失败，导致用过这些供应商的会话切到官方账号或直连 Responses API Key 后无法继续。现在本地网关在响应出口就会把这段正文改写成合法 summary、把 content 清空，并丢弃非官方格式的 encrypted_content（流式与非流式、API 服务与 provider gateway 都覆盖），新产生的历史不会再出现该问题；更早写下的历史改为启动后在后台一次性迁移，不再每次切号或启动都扫描，迁移同时清理历史库与会话日志（sessions / archived_sessions），只读取推理条目、只备份被改动的内容，不再复制整库；仍在写入中的会话日志会跳过并在下次启动继续处理。
• 修复用过混合模型路由后第三方账号看不到自己的模型：切到 DeepSeek 等 API Key / 第三方供应商账号时，模型目录不再被「模型管理」覆盖，账号自己的模型清单（如 DeepSeek Flash / Pro）会正常显示；这些账号的切换也不会再清掉你在模型管理里保存的清单。
• 修复切换账号被混合模型路由拦截：混合模型路由现在只在实例绑定「可直接登录的 OAuth 订阅账号」时生效；把实例或默认实例切到普通账号、API Key 账号或 API 服务时，路由会自动关闭（渠道配置保留）并释放对应网关，不再报「必须先绑定 OAuth 订阅账号」而中断切换或启动。
• 修复实例不运行时实例网关仍然存在：实例级网关现在只在实例运行期间保留，实例关闭后会自动停止并还原接管配置，也不会再出现在「实例网关」列表里；运行中的实例网关新增「关闭」和「重启」两个手动操作（关闭混合模型路由网关会同时关闭该实例的混合模型路由，渠道配置保留）。
• 修复删除账号后混合模型路由残留报错：删除实例绑定的 OAuth 底座账号，或删除某个路由使用的 API 账号后，会自动关闭相关实例的混合模型路由（渠道配置保留）并释放对应网关，不再因为路由引用了已删除的账号而反复恢复失败并弹出与删除操作无关的提示。
• 修复开启第三方 API 路由的实例无法切换账号或启动：启动预览现在会在实例有效绑定与所选 OAuth 订阅账号不一致时，把该账号一并保存为实例绑定，选择「直接登录的 OAuth 订阅账号」不再报「必须绑定直接登录的 OAuth 订阅账号」；该报错文案也补充了处理方式。
• 修复会话管理「打开位置」和「打开会话文件」在多实例下无效：会话同时存在于多个实例时，原来会弹出要求输入实例 ID 的系统输入框，但界面位置列显示的是实例名称，输入的 ID 不正确就无法打开。现在改为在会话管理内弹出实例列表，直接点选位置列里显示的实例名称即可打开，打开失败的原因也会显示在该弹框内。(#2129)
• 修复 Codex 会话管理里的会话名与官方客户端不一致：会话标题改为按官方客户端的展示规则读取（优先客户端维护的会话展示名，没有生成标题时显示首条消息并截断），不再只认 session_index.jsonl，未生成标题的会话不再显示成一串会话 ID；分组标题同时改用官方客户端项目名，在 Codex 里重命名项目后会话管理会同步显示新名称。
• 修复在会话管理把会话移到废纸篓后 Codex 侧仍然显示：删除改为调用官方 Codex 的会话删除流程，会话会同时从官方会话列表、状态库与本地会话目录移除，无需重启客户端即可消失；官方删除不可用时会自动回退到原有文件方式，并在结果提示里说明需要重启 Codex 才会同步。
• 修复 Windows 关闭到托盘后后台额度刷新停止：只要启用了任意平台的自动刷新，关闭到托盘现在会隐藏主窗口而不是销毁 WebView，现有刷新调度器可以继续运行；当所有自动刷新都禁用时，仍保持原来的销毁 WebView 以省内存行为。
• 修复严格 Responses 上游因历史工具调用缺少 call_id 而拒绝请求：Codex 请求在转发前会为缺失 call_id 的 function_call / custom_tool_call 补齐 ID，并让对应输出使用同一个 ID；已有 ID 不会被改写。该修复覆盖本地 API 网关与 provider gateway 两条链路。
• 修复开启模型目录同步后 HTTP-only 自定义 Responses 渠道失效：缺失 wireApi 时现在会按 Responses 处理，关闭 WebSocket 的自定义渠道即使开启模型目录同步也会保留独立的 HTTP-only provider，确保 supports_websockets = false 生效，Codex 不再尝试 wss://.../responses。
• 修复 Codex 会话亲和在账号额度耗尽后不故障转移：选择器包装层现在会把执行结果转发给会话亲和选择器，绑定账号失败后会解绑，下一次请求可切换到其他可用账号。调度选项里的会话亲和开关在服务运行时也可以取消勾选，仅在实际保存调度选项时禁用。
• 修复 Windows 上 Store 版 Codex 实际已启动却提示启动失败：当系统入口已经拉起 Codex、但未能匹配到新进程时，旧逻辑会回退直接启动受保护的 WindowsApps 可执行文件并返回 ACCESS_DENIED (os error 5)。启动器现在会依次尝试 powershell.exe、Windows PowerShell 绝对路径和 pwsh.exe；确认 Codex 已在运行时按成功处理；不再直接启动 WindowsApps 路径，并给出可操作提示，避免误导性的启动失败。
• 修复窗口高度受限时弹框遮挡内容或操作按钮：弹框限制高度后，账号选择器的同优先级样式可能把正文滚动覆盖回去，同时正文区块仍可能被压到零高度。现在 API 服务与分组账号选择弹框的正文区块固定按内容高度排列并独立滚动，标题栏与底部操作栏始终保留在视口内，总量统计、额度池、服务配置以及「取消」「保存集合」「添加账号」等操作都可正常访问；鹈鹕测智结果详情弹框也会固定保留关闭操作，仅让较长的结果正文滚动。
• 修复中文等非 ASCII 项目路径的信任记录被删除：Codex config.toml 里的 [projects.'E:\中文项目\店铺管理'] 本身是合法 TOML，但配置净化逻辑会把所有非 ASCII 头部判定为不安全并整段删除（config.toml.bak 也会被一并清理），导致这些项目每次启动都要重新信任。现在只有缺少 ] 或无法按 TOML 表解析的头部才会被移除，合法的 Unicode 路径与 \uXXXX 转义写法都会原样保留。
• 修复在 API 账号与 ChatGPT 登录账号之间切号后官方客户端提示「继续登录」：官方 config.toml 里的 forced_login_method 是限制登录方式的开关，手工设置过该键的用户切到另一种账号时，官方客户端会把已经写好的有效凭据判定为未登录，只能手动改回该键才能使用。现在切号写入登录信息时会按当前账号类型同步该键（API Key 账号写 api，OAuth 账号写 chatgpt），仅在该键与本次凭据冲突时改写；用户从未设置过该键时保持原样，仍由官方客户端按 auth.json 自动识别登录方式。(#2209)
• 修复切到 DeepSeek 后 preferred_auth_method 残留：该键现在与其他 DeepSeek 临时改动一起记录，切走时还原用户原值（原本没有该键则删除），避免切回官方 ChatGPT 账号后仍保留 DeepSeek 的登录方式设置。(#1961)
• 修复 Windows 上 Store 版 Claude Desktop 切号时因登录态文件被占用而备份失败：备份前改为用登录态文件本身确认 Claude 已经退出——按与备份完全相同的复制路径探测 Network\Cookies、LevelDB LOCK 等 Chromium 独占文件；仍被占用时按 Store / MSIX 包路径结束还持有这些文件的 claude.exe（含 network service 等 Electron 子进程，排除 Claude Code CLI）后复检。若文件依旧被占用，会返回「请完全退出 Claude Desktop 后重试」的可读提示，而不是抛出 os error 32 并中止整次切号。(#2161)

Changelog (English)

[1.3.52] - 2026-09-14

Added

• DeepSeek instances now show the account balance under the composer: instances bound to a DeepSeek account show a balance badge below the composer regardless of the start mode (gateway list, CDP injection, or official direct). Clicking it reveals the total, granted, and topped-up balances plus availability and currency, and the value can be refreshed manually. It comes from DeepSeek's official balance endpoint, refreshes every 60 seconds, and keeps the last valid value when a query fails. The badge follows the Show API Service quota toggle and is not injected while that toggle is off.
• Instance gateways are now visible from the account overview: the API service card shows an Instance gateways entry with the total count and an abnormal badge. It opens a read-only dialog listing every instance-level local gateway (provider gateway and mixed model routing) as a card that aligns the instance and live status (running / started but unreachable / port in use / stopped / not started) above the bound account, local address, protocol and upstream models, with a copy-address control on the address row and Restart and Stop stacked on the right. Long lists scroll inside the dialog body only, so the title, Refresh and Close stay reachable.
• Instance gateways now recover after the host restarts: provider gateway processes are rebuilt in the background at startup while the profile is still bound to a gateway account and the gateway had been started before (or the Codex instance is still running), with bounded retries and the failure reason shown in the instance gateway dialog. Their local port is now stored per profile, so a Codex instance that is still open keeps the same endpoint instead of pointing at a stale port; if that port is taken, a free one is picked instead.
• Pelican tests now report token usage and 5-hour quota: each account column shows the tokens consumed by that run plus the 5-hour quota consumed (or remaining when no delta is available), and the result detail dialog shows the remaining quota and reset time. Usage comes from upstream response headers when present and falls back to the account quota endpoint.
• Statistics & Logs now show the Codex request speed: every request log row shows the tier that actually ran (Fast, Ultrafast or Standard; other client-requested tiers such as flex are shown as their raw tier value), so it is clear which requests really ran in Fast mode. The value comes from the tier the upstream actually served, then the tier the client requested, then the tier the app injects for the current speed, so downgraded or standard requests are no longer left blank.
• Codex account export and import now carry tags and groups: exporting the Cockpit Tools format writes each account's tags, account name, account structure and folder (group) name, and importing that file restores the tags and grouping — an existing group with the same name is reused and a missing one is created from the file — so the same categories can be shared across devices and people. Files exported by older versions contain no such fields and import exactly as before; external formats such as auth.json, sub2api and cpa are unchanged.
• Codex speed now supports the official Ultrafast tier: the speed picker in the account overview, launch preview and instance form offers Ultrafast (official service tier ultrafast) next to Standard and Fast, and account switching and launching write the official client's current storage — the top-level service_tier key in config.toml (Fast writes priority, Standard writes default) while the legacy [desktop] default-service-tier and the persisted client state are kept — so the chosen speed survives a switch. The managed Codex model catalog advertises the tier for gpt-5.6-sol exactly like the official client, the API service forwards service_tier: "ultrafast" instead of dropping it, and request logs label it Ultrafast (cost estimates use the Fast-tier rates until an official rate exists).

Changed

• Model management is now off by default and is no longer switched on by mixed model routing: the first launch after upgrading turns off any previously enabled Model management, restores the official model catalog and only does this once — afterwards the switch is entirely yours. Mixed model routing no longer touches that switch: the model catalog it needs applies only while the instance runs and is restored automatically when the instance stops or Cockpit exits, leaving other accounts and instances untouched.

Fixed

• Fixed third-party reasoning history breaking sessions moved to a strict Responses upstream or to an official account: reasoning items returned by third-party providers (such as DeepSeek) carried the visible reasoning text in content and a non-official encrypted_content value, which the official Codex backend rejects with Invalid 'input[i].content': array too long. Expected an array with maximum length 0 and The encrypted content ... could not be verified, so sessions used with those providers could no longer be continued through the official account or a direct Responses API key, including during automatic compaction. The local gateway now rewrites that text into a legal summary, leaves content empty and drops any encrypted_content that is not a real official signature on the response path for both streaming and non-streaming responses, through the API service and through provider gateways, so newly written history stays compatible; history written earlier is migrated once in the background at startup instead of being re-scanned on every account switch or launch, and that migration cleans both the history database and the session logs (sessions / archived_sessions), only reads reasoning entries and only backs up what it changes instead of copying the whole history database. Session logs that are still being written are skipped and picked up on the next start.
• Fixed third-party accounts losing their own models after mixed model routing was used: switching to a DeepSeek or other API key / provider account no longer has its model catalog overwritten by Model management, so the account's own models (such as DeepSeek Flash / Pro) show up again, and those account switches no longer clear the catalog you saved in model management.
• Fixed account switching being blocked by mixed model routing: mixed model routing now only applies while an instance is bound to a directly signed-in OAuth subscription account. Switching an instance (or the default instance) to a normal account, an API key account or the API service now turns the routing off automatically (channel configuration is kept) and releases its gateway, instead of failing the switch or the launch with a request to bind an OAuth account.
• Fixed instance gateways surviving after their instance was closed: instance-level gateways now only exist while the instance runs — closing the instance stops them and restores the takeover configuration, and they are no longer listed in Instance gateways. Gateways of running instances gained manual Stop and Restart actions (stopping a mixed model routing gateway also turns off that instance's mixed model routing while keeping its channel configuration).
• Fixed leftover mixed model routing errors after deleting accounts: deleting an instance's OAuth base account, or an API account used by one of its routes, now turns off that instance's mixed model routing automatically (channel configuration is kept) and releases its gateway, instead of repeatedly failing to recover the gateway and reporting an error unrelated to the deletion.
• Fixed account switching and launching failing on instances with third-party API routing enabled: the launch preview now saves the selected routing account as the instance binding whenever it differs from the instance's effective binding, so choosing a directly signed-in OAuth subscription account no longer fails with a request to bind such an account; the message also states how to fix the binding.
• Fixed Open location and Open session file doing nothing for sessions on multiple instances: the session manager used to ask for an instance ID through a native prompt, while the location column only shows instance names, so any wrong ID simply failed to open. The session manager now shows an in-app instance list and opens the instance whose name is listed in the location column, and any failure reason is reported inside that dialog. (#2129)
• Fixed session names in the Codex session manager not matching the official client: session titles now follow the official client's display rules — the display name the client keeps first, and the first message truncated when no title has been generated — instead of relying on session_index.jsonl alone, so untitled sessions no longer show as a raw session ID. Group headers now use the official project name as well, so renaming a project in Codex is reflected in the session manager.
• Fixed sessions still showing in Codex after being deleted in the session manager: moving sessions to the trash now goes through the official Codex delete flow, so they leave the official conversation list, the state database and the local session directory without restarting the client. When the official flow is unavailable, the previous file-based deletion is used and the result message states that Codex has to be restarted to sync.
• Fixed Windows tray minimize stopping background quota refresh: when any periodic account refresh is enabled, closing to tray now hides the main window instead of destroying its WebView, so the existing refresh scheduler keeps running. With all periodic refreshes disabled, the previous memory-saving WebView destroy behavior is preserved.
• Fixed strict Responses upstreams rejecting replayed tool calls with missing field call_id: Codex requests now repair historical function_call / custom_tool_call items that lack a call ID before forwarding, match the corresponding outputs to the synthesized ID, and preserve existing IDs. This covers both the local API gateway and provider-gateway paths.
• Fixed HTTP-only custom Responses providers being ignored when model catalog sync is enabled: a missing wireApi now defaults to Responses in the provider override check, and WebSocket-disabled custom providers keep their managed HTTP-only provider even when the model catalog is synced to Codex, so supports_websockets = false remains effective and Codex no longer attempts wss://.../responses.
• Fixed Codex session affinity not failing over after a credential quota failure: wrapper selectors now forward result notifications to the session-affinity selector, so a failed bound account is unbound and the next request can move to another eligible account. The routing form also lets Session Affinity be turned off while the service is running; only the routing save operation disables the control.
• Fixed Windows Store Codex launches being reported as failed after the app actually started: when the Store activation entry worked but the new process could not be matched, the launcher fell back to directly starting the protected WindowsApps executable and returned ACCESS_DENIED (os error 5). The launcher now resolves PowerShell through powershell.exe, the absolute Windows PowerShell path, then pwsh.exe; treats an already-running Codex as success; skips direct execution of WindowsApps paths; and shows an actionable message instead of a misleading launch failure.
• Fixed dialogs hiding content or actions at constrained window heights: after dialog heights were capped, competing account-picker styles could disable body scrolling, while flexible body sections could still be squeezed to zero height. API service and group account-picker dialogs now keep every section at its content height and scroll inside the body with the header and footer visible, so totals, quota pools, configuration sections, and actions such as Cancel, Save Collection, and Add Accounts remain reachable. The Pelican result detail dialog also keeps its close action fixed while long result content scrolls independently.
• Fixed valid project trust entries being deleted for non-ASCII (such as Chinese) project paths: entries like [projects.'E:\中文项目\店铺管理'] in Codex config.toml are valid TOML, but the config sanitizer treated any non-ASCII header as unsafe and removed the whole section (including from config.toml.bak), so those projects had to be trusted again. Only headers that are missing ] or cannot be parsed as a TOML table are removed now, while valid Unicode paths and \uXXXX escapes are kept unchanged.
• Fixed the official client asking to sign in again after switching between API and ChatGPT accounts: the official forced_login_method restrict setting in config.toml allows only one login method, so accounts of the other type were reported as "Not logged in" even though the switch had written valid credentials. Switching now aligns that key with the account being written (API accounts → api, OAuth accounts → chatgpt) whenever the stored value conflicts with the credentials, and leaves configs that never set the key untouched so the official client keeps detecting the login method from auth.json. (#2209)
• Fixed the preferred_auth_method setting being left behind after switching to DeepSeek: the key is now recorded together with the other DeepSeek temporary overrides and restored to the user's original value (or removed when the user never set it) after switching away, so returning to an official ChatGPT account no longer keeps the DeepSeek value. (#1961)
• Fixed Windows Claude Desktop switching failing to back up the profile while its files were still locked: before backing up, the switch now confirms the profile was really released by copying the Chromium-locked files (Network\Cookies, LevelDB LOCK, …) through the same path the backup uses, and if they are still held it force-closes the remaining Microsoft Store / MSIX claude.exe processes by package path (including Electron child processes such as the network service, and excluding the Claude Code CLI) before retrying. When the files remain locked the user gets a readable “quit Claude Desktop completely, then retry” message instead of the whole switch aborting with os error 32. (#2161)