更新日志（中文）
[1.3.58] - 2026-09-22
新增
- 账号风控检测：账号总览新增「风控检测」入口，按官方上游返回的
x-codex-turn-state长度判断：state为 312 即在账号卡片标记「疑似风控」（单次即判定），292/332 视为正常并自动摘除标记，其它长度只提示长度异常。检测、唤醒与 API 服务转发都会记录观测，点开可查看时间、state 长度与判定依据。只记录长度，不保存 state 原文；API Key 账号不参与。 - API 服务请求日志显示 state 长度与疑似风控：每行请求记录补充上游 state 长度；
state为 312 时直接标出「疑似风控」，其它长度如实显示，缺失时标出「未返回 state」。 - 中转站密钥改为横排表格，并可把官方配置一键写入本机：密钥列表按「名称 / API 密钥 / 模型 / 用量 / 状态 / 添加时间 / 操作」横排展示，只显示本地保存与查询得到的真实数据；每行提供「使用密钥」弹窗，按该密钥真实返回的模型自动识别分组，渲染 Codex App、Codex CLI、Claude Code、Claude Desktop 的官方配置，并可直接写入
~/.codex/config.toml、~/.codex/auth.json、~/.claude/settings.json（写入前自动备份，JSON/TOML 合并写入不覆盖其它配置）。原有的「添加到 Codex / 添加到 Claude / 添加到 Claude CLI」入口保留为横排按钮。 - Codex 启动预览按卡片记住目标实例：账号卡片、API 服务卡片和模型供应商卡片会各自记住上次在启动预览里选择的目标实例；再次打开时仍选中该实例，实例被删除后回退到默认实例。
- API 服务支持把生图交给指定 GPT 账号：启动预览提供与 DeepSeek 一致的「启用 GPT 生图」。勾选并选择 GPT 账号后，生图与图片编辑由所选账号执行并消耗其额度，对话仍按账号池调度。未启用时保持原有调度。
- DeepSeek、Grok 模型支持 Codex 子智能体协作：可派发、通讯和续跑子智能体，
wait_agent能正常等待结果；Grok 模型目录补齐多智能体能力声明，新开的 Grok 会话会注入协作工具。官方模型行为不变。 - API 服务明细同时展示请求模型与实际上游模型：日志首行保留客户端请求模型，第二行标出实际上游模型；仅在没有记录上游模型时回退为单行。
- macOS DMG 安装包内附「已损坏」排查说明：安装窗口附带双语说明，解释 Gatekeeper 提示（尚未接入 Apple Developer ID 签名与公证），并给出
xattr与「仍要打开」两种处理方式。
变更
- 「启动后自动最小化」默认关闭：升级后会一次性关闭该开关并写入配置；之后若再手动打开，不会被再次改回。
- 模型管理默认清单跟随账号池，并隐藏 5.5 以下官方模型：只列出该实例或 API 服务账号池实际能承接的模型。官方模型默认只保留
gpt-5.5及以上，账号池没有 GPT 能力时不再显示官方 GPT /gpt-reserve。Grok 供应商账号，以及只提供 DeepSeek / GLM / Kimi 等非 GPT 模型的账号（含借用 GPT 壳位的映射）不计入官方 GPT 能力；第三方 GPT 中转 Key 按它自己的模型清单提供官方 GPT 模型。未由用户主动保存的旧清单会回到跟随账号池；只有用户保存过的清单才停止自动更新，重置后重新跟随。 - 第三方 GPT 中转 Key 的模型清单直接追加进可用模型：从上游获取到的 GPT / Codex 模型（
gpt-5.5、gpt-5.6-*、gpt-6-astra等）会并入该 Key 的可见模型与路由，客户端选择器、启动预览、/v1/models与请求校验保持一致；不在官方推荐集里的 GPT 名字（如gpt-4o）以及 DeepSeek 等账号的壳位别名仍不展示。 - Grok（xAI）模型可使用 Codex 原生编辑文件工具：新开的 Grok 窗口走编辑文件工具，不再退回 shell 命令。
- Codex 唤醒统一走宿主直连 API：由宿主带所选账号凭据直接请求官方接口，不需要本机 Codex CLI，也不需要 API 服务运行；不再提供 CLI 执行方式。API Key 账号不支持唤醒，Agent Identity 走该直连链路。
- 唤醒默认模型改为 GPT-5.6 Luna，并过滤 5.5 之前的模型：任务与手动测试不再提供 5.5 之前的预设（含
gpt-5.4、gpt-5.4-mini及更早的自定义预设）；已有任务会改到 GPT-5.6 Luna 并使用默认推理档位。 - 模型目录可按模型设置上下文：支持跟随默认值、516K / 460K、1M / 900K 或自定义窗口与压缩阈值，并按模型保存。启动预览里点「应用上下文」立即写入；切到自定义会展开输入框并保留当前数值。
- 移除 Codex「超高速」选项：仅保留「标准」与「快速」，已保存的超高速回退为标准。
- 移除鹈鹕测智：不再提供测试入口及后台功能，已有本地测试历史不做删除。
- 同一份模型目录使用同一个压缩格式哈希：减少仅因切换模型、哈希不同而触发的压缩。
修复
- 修复 Windows 切号后因托盘菜单重建卡住界面：切号完成后先在后台读取托盘文案，再一次性提交原生菜单，不再为每个菜单项同步等待
set_menu。 - 修复只加 DeepSeek / Grok 账号时仍显示官方 GPT 模型：仅用于「启用 GPT 生图」转发的绑定 OAuth 账号不再被算作账号池的 GPT 能力，API 服务启动预览与 profile 模型清单只列出对话账号真正能承接的模型；生图转发账号仍正常保留凭据。
- 修复同一会话切换模型后，DeepSeek / Grok 等上游拒绝历史请求。
- 修复 DeepSeek 等严格 Responses 上游因历史工具调用缺少 ID 而拒绝请求。
- 修复 Codex 账号表单滚动时弹框被带出屏幕：添加、编辑 API Key 和切换供应商时，弹框保持固定，长表单只在内部滚动，操作按钮保持可达。
- 修复重新打开 Codex 启动预览后暂时无法操作：后台读取配置不再锁住关闭和无关操作，读取过慢时提供超时和重试。
- 修复 Codex 网关把上下文超限当成断流反复重连：超限交给客户端做正常的窗口处理，而不再反复重连。
- 修复 Antigravity 个人账号配额显示 100%、窗口拆分错误及 GCP ToS 误标：个人订阅不再仅凭套餐被当成 GCP 账号；无真实项目的账号按官方 IDE 用空请求体查配额，并清理占位项目和孤立 GCP 标记。账号卡片只展示 Claude 与 Gemini 的 5h / 周窗口，缺失显示无数据而不是满额；不再因重置时间较远显示 100%，也不再把模型高低配置当成小时或周窗口。刷新失败时保留可用缓存并标记陈旧数据；手动批量刷新会跳过短期 API 缓存。(#2326)
- 关闭更新提醒后不再自动弹窗：即使远端策略要求弹窗，或检查过程中关闭提醒，也会遵守本地设置；手动检查更新不受影响。
- 修复普通 Responses 供应商无法按模型开关识图，含大写字符的模型名也能正确保存开关。
gpt-5.5及以上模型默认按支持图片输入处理：openai/gpt-5.6-sol这类带命名空间或后缀的写法同样生效，不再因为逐模型能力表为空被 Provider Gateway 判定为 text-only 而删掉图片；gpt-5.4及更早、gpt-reserve、gpt-image-*与非 GPT 模型保持原样，显式开关（含手动关闭）仍然优先。- 修复升级后自定义 Responses 供应商的旧识图开关丢失导致图片被网关丢弃：升级时会把供应商级识图开关展开成逐模型能力并落盘，网关生成配置时也会按账号级/供应商级开关补齐逐模型表，图片不会再被静默删除。
- 修复首页纵向卡片不显示额度进度条，不改变横向布局及额度数值。
- 瞬时连接故障不再误报为账号池耗尽：TLS、EOF 和连接重置在配置次数内重试，真实认证、配额及账号池异常保持原有处理。
- API 服务后台维护不再覆盖用户改过的 Codex 配置：受管连接字段被外部修改后停止维护对应实例，并保留用户的模型与上下文选择；停止服务时恢复仍由服务接管的登录态，但不覆盖用户另行登录的账号或已被外部修改的实例。
- 修复混合模型路由中的 Grok 请求不可用：请求使用路由绑定的 Grok 账号，不会回退到其他账号。
- 修复 Grok 模型请求报「账号池没有可用账号（候选 1 个，其余为 0）」：宿主与本地网关对 Grok 平台的 provider 命名不一致，导致 Grok 模型被注册到 Codex 账号并被 API Key 账号范围过滤；现在按网关标识归一化，Grok 请求只会命中 Grok 账号。
- 修复升级后模型目录不自动刷新：受管模型目录新增版本戳与内容校验，应用启动时发现旧版本（或没有版本戳）会按当前生成逻辑在后台重建一次，不再依赖切号；重建保留原有模型清单与展示名。
- 删除 Grok 账号不再影响 API 服务中其他成员处理请求。
- 修复 API 服务成员弹框中 Grok 账号不显示、平台筛选结果为空：异步加载的账号会立即出现，切换平台后列表正确更新。
- 修复 Grok 流式工具调用的名称与参数前后不一致。
- 修复 Codex 额度刷新在 Grok 查询过慢或被取消时丢失已刷新凭据，刷新完成后徽章会更新。
- 修复 Grok 网关凭据过期时间不正确，同步失败后可能保留旧 Token 或恢复已删除账号。
Changelog (English)
[1.3.58] - 2026-09-22
Added
- Account risk checks: the accounts overview gains a Risk check entry that reads the official upstream
x-codex-turn-statelength: astatelength of 312 marks the account card as Suspected risk right away, 292/332 count as normal and clear that mark, and any other length only reports an abnormal length. Checks, wakeups and API-service forwarding all record observations, and opening an account shows the time, state length and reason. Only the length is stored, never the raw state, and API key accounts are not included. - API-service request logs show the state length and suspected risk: every request row carries the upstream state length, flags Suspected risk when
stateis 312, shows other lengths as-is, and marks No state returned when the header is missing. - Relay keys are now a horizontal table and can write the official configs to your machine: the key list shows Name / API key / Models / Usage / Status / Added / Actions using only locally stored or queried data, and each row opens a "Use API key" dialog that detects the group from the key's real model list, renders the official Codex App, Codex CLI, Claude Code and Claude Desktop configs, and can write
~/.codex/config.toml,~/.codex/auth.jsonand~/.claude/settings.jsondirectly (existing files are backed up and merged, never overwritten). The previous Add to Codex / Add to Claude / Add to Claude CLI entries remain as buttons in the same row. - Codex launch preview remembers the target instance per card: account cards, the API Service card, and model-provider cards each keep the last instance chosen in launch preview. Reopening the preview selects that instance again, and a deleted instance falls back to the default instance.
- API Service can hand image generation to selected GPT accounts: the launch preview gets the same Enable GPT image generation row as DeepSeek. Once enabled with GPT accounts chosen, image generation and image editing run on those accounts and consume their quota; chat requests keep using the service account pool. Leaving it disabled keeps the previous routing.
- DeepSeek and Grok models now support Codex sub-agent collaboration: dispatching, messaging and follow-ups work, and
wait_agentcan wait for results; Grok model catalog entries now declare multi-agent capability so new Grok sessions receive the collaboration tools. Official models are unchanged. - API-service request details show the requested and upstream model: each log row keeps the client-requested model on the first line and always marks the model sent upstream on a second line; only rows without a recorded upstream model stay on a single line.
- macOS DMG now ships the "app is damaged" troubleshooting note: the installer window places a bilingual
"已损坏"急救说明 (README).txtnext to the app icon, explaining the Gatekeeper warning (the release pipeline does not use Apple Developer ID signing or notarization yet) and giving both thexattrcommand and the System Settings "Open Anyway" path.
Changed
- "Start minimized" is now off by default: upgrading turns the switch off once and writes that to config; if you turn it back on later, it stays on.
- Model management now follows the account pool and hides official models older than 5.5: the default list only includes models the instance or API-service pool can actually serve. Official models below
gpt-5.5are no longer listed by default, and official GPT /gpt-reservestay hidden when the pool has no GPT capability. Grok provider accounts, plus accounts that only serve non-GPT models such as DeepSeek / GLM / Kimi (including mappings that borrow GPT shell names), never count as official GPT capability; third-party GPT relay keys provide official GPT models based on their own model list. Legacy catalogs that were never explicitly saved fall back to following the pool; only a user-saved list stops automatic updates, and an explicit reset returns to following the pool. - Third-party GPT relay keys now append their own model list to the available models: GPT / Codex models fetched from the upstream (
gpt-5.5,gpt-5.6-*,gpt-6-astra, …) are merged into that key's visible models and routing, keeping the client picker, launch preview,/v1/modelsand request validation in sync. GPT names outside the official set (such asgpt-4o) and DeepSeek-style shell aliases stay hidden. - Grok (xAI) models now use the Codex edit-file tool: new Grok windows edit files through the native tool instead of falling back to shell commands.
- Codex wakeups always run through the host-side API path: the host sends the selected account credentials straight to the official endpoint, so no local Codex CLI is required and the API Service does not need to be running. There is no longer a CLI execution option. API key accounts cannot wake up; Agent Identity accounts use this direct path.
- Wakeup now defaults to GPT-5.6 Luna and hides models older than 5.5: wakeup tasks and manual tests no longer offer pre-5.5 presets (including
gpt-5.4,gpt-5.4-miniand earlier custom presets). Existing tasks that pointed at those models move to GPT-5.6 Luna with the default reasoning effort. - Model catalog can set context per model: choose model defaults, 516K / 460K, 1M / 900K, or custom context windows and compact limits. Settings are saved per model. In launch preview, Apply context writes immediately, and switching to custom opens the input fields while keeping the current values.
- Removed the Codex Ultrafast option: speed controls now offer only Standard and Fast. Previously saved Ultrafast preferences fall back to Standard.
- Removed Pelican intelligence testing: the testing entry and its background functionality are no longer available; existing local test history is not deleted.
- Models in the same catalog now share one compaction hash: switching models is less likely to trigger compaction solely because the hash changed.
Fixed
- Fixed Windows freezing after an account switch while the tray menu rebuilt: Cockpit now reads tray labels in the background and applies the native menu in one UI-thread pass, so switching accounts no longer waits on dozens of tray
set_menuround-trips. - Fixed official GPT models appearing with only DeepSeek / Grok accounts in the pool: an OAuth account bound solely for GPT image-generation forwarding no longer counts as GPT capability, so the API Service launch preview and profile model catalog only list models the chat accounts can actually serve, while the image-forwarding account keeps its credentials.
- Fixed third-party upstreams rejecting the same thread after switching models: DeepSeek, Grok and similar upstreams no longer fail the next turn on replayed history.
- Fixed strict Responses upstreams such as DeepSeek rejecting replayed tool calls: missing tool-call IDs no longer cause the upstream to reject the request.
- Fixed scrolling in Codex account forms moving the dialog off screen: adding or editing API Keys and switching providers now keep their dialogs anchored, with long forms scrolling inside and action buttons remaining reachable.
- Fixed unresponsive Codex launch previews when reopened: background configuration loading no longer blocks closing the dialog or unrelated actions; slow reads offer a timeout and retry.
- Fixed context-limit errors through the Codex gateway being treated as disconnects: overflow is handed to the client for normal context-limit handling instead of reconnect loops.
- Fixed Antigravity personal-account quotas showing 100%, incorrect window rows, and incorrect GCP ToS badges: personal subscriptions are no longer treated as GCP accounts based solely on their plan; accounts without a real project query quotas with an empty payload, aligned with the official IDE, and stale placeholder projects or orphaned GCP tags are cleared. Account cards show only the Claude and Gemini 5h / weekly windows; missing windows render as no data instead of full, distant reset times no longer turn quotas into 100%, and model variants are no longer mistaken for hourly or weekly windows. Failed window-summary refreshes keep eligible cached windows with a stale-data indication; manual batch refresh bypasses the short-lived API cache. (#2326)
- Disabled update reminders now suppress automatic popups even if remote policy requests one or an update check is already running; manual update checks remain available.
- Fixed ordinary Responses providers losing per-model image-input controls, including model IDs with uppercase characters.
gpt-5.5and later models now default to image input: namespaced or suffixed IDs such asopenai/gpt-5.6-solare covered too, so the Provider Gateway no longer treats them as text-only and drops images when the per-model capability table is empty.gpt-5.4and earlier,gpt-reserve,gpt-image-*and non-GPT models keep their previous behaviour, and explicit switches (including a manual off) still win.- Fixed legacy vision settings of custom Responses providers being lost after an upgrade: upgrades expand the provider-level vision switch into per-model capabilities and persist them, and gateway config generation also backfills the per-model table from the account/provider switch, so images are no longer silently removed.
- Fixed missing quota progress tracks on stacked dashboard cards, without changing horizontal layouts or quota values.
- Transient connection failures no longer masquerade as account-pool exhaustion: TLS, EOF and connection-reset failures retry within the configured limit, while genuine authentication, quota and pool failures keep their existing handling.
- API-service background maintenance no longer overwrites Codex configuration you changed yourself: it stops updating profiles whose managed connection fields were changed externally and preserves user model and context choices. Stopping the service restores credentials still owned by its takeover without replacing a later login or an externally modified profile.
- Fixed Grok requests failing in mixed model routing: requests use the route's bound Grok account without falling back to another account.
- Fixed Grok requests failing with "no available account (1 candidate, 0 for every other reason)": the host and the local gateway disagreed on the Grok provider name, so Grok models were registered on Codex accounts and then filtered out by API-key scope; provider names are now normalized so Grok requests only match Grok accounts.
- Fixed managed model catalogs not refreshing after an app upgrade: managed catalogs now carry a generator version stamp plus a content hash, and startup rebuilds a stale or unstamped catalog in the background instead of waiting for an account switch; the rebuild keeps the existing model list and display names.
- Deleting a Grok account no longer prevents other API-service members from serving requests.
- Fixed missing Grok accounts and empty platform-filter results in the API-service members dialog: asynchronously loaded accounts appear immediately, and switching platforms updates the list correctly.
- Fixed inconsistent Grok streaming tool names and arguments.
- Fixed Codex quota refresh dropping already-refreshed credentials when a Grok query is slow or cancelled, and the badge now updates when the refresh finishes.
- Fixed Grok gateway credentials keeping the wrong expiry and, after a failed sync, retaining an old token or restoring a deleted account.