- [403 Ban State Machine & Quota Refresh Overwrite Protection: Root-Fixing 403 State Loss on 200 OK Daily Quota & Adding Abnormal Filter] (Fixes #3863, Ref #3865, PR #3875, commit fc45775, a079bdf, 3010f9e, Thanks to @cubelikeplayDaniel, @jeikl):
- 403 Status Lock Persistence: Established invariant that 403/Ban state outranks daily quota 200 OK responses. Guarded
update_quotaandupdate_account_quota_internalso background/manual quota refreshes never wipe activeis_forbiddenorproxy_disabledflags, resolving the issue where banned accounts seemed healthy until invoked. (Fixes #3863, PR #3875) - Safe Probe Healing: Non-model 403 locks are only released when live production probes return
Healthy; model-scoped restrictions preserve locks, preventing regular daily quota pulls from spoofing unbans. (commit a079bdf, 3010f9e) - Abnormal Account Filter & Direct Navigation: Added an "Abnormal" filter button on the Accounts toolbar aggregating all banned / validation_blocked / 403 accounts with badge counts; made Dashboard "Health & Risk" card clickable for direct navigation to the abnormal filter view. (Ref #3865, PR #3875)
- 403 Status Lock Persistence: Established invariant that 403/Ban state outranks daily quota 200 OK responses. Guarded
- [UI Interaction & Dialog Layering Fix: Eliminating Add Account Button Penetration] (Fixes #3853, PR #3872, Thanks to @cubelikeplayDaniel):
- [Startup Asynchronous Quota Refresh & Toolbar Action] (Ref #3726, PR #3871, Thanks to @lbjlaq):
- [Pedal Quota Mode Stability & Visual Polishing] (Ref #3870, commit 73d798c, 0f734f5, Thanks to @cubelikeplayDaniel):
- [Web Model Probe Dispatch & Credential Refresh] (Ref #3861, Ref #3869, PR #3868, commit fb32517, 8232798, 2677d8c, 32735f9, Thanks to @cubelikeplayDaniel):
- [Hierarchical Quota Window Contract & Recovery Governance: Root-Fixing Cross-Model Reset Contamination & Zero-Quota Deadlock] (Fixes #3840, #3845, PR #3852, Thanks to @jeikl, @cubelikeplayDaniel):
- Weekly Hard Quota Priority Contract (P0-1): Enforced strict hierarchy between weekly windows and short-term 5-hour rolling windows. When an account's weekly hard quota is depleted (0%), self-healing is strictly disallowed even if the 5h window has elapsed; all depleted buckets (e.g. secondary Argon WTU weekly buckets) must expire before admission is restored. (Fixes #3840, PR #3852)
- Model-Family Reset Isolation (P0-2): Decoupled reset timestamp extraction into independent model-family maps (Argon / 3P / Gemini); models absent from the family reset map never fall back to the global reset timestamp when per-model maps are populated, preventing Argon resets from erroneously accelerating Gemini models. (Fixes #3845, PR #3852)
- Decoupled Admission from Scheduling Weight (P1-4): Separated
has_candidate_quota_admission(binary gate) fromget_candidate_quota(weight ranking); self-healed accounts receive a conservative positive sentinel (20) to participate in candidate competition without usurping healthy 80%-100% accounts. (PR #3852) - Realtime Quota Refresh State Synchronization (P1-2, P1-3): Synchronized
model_reset_times,model_weekly_reset_times, and detailedmodel_quota_windowssimultaneously acrossfetch_and_lock_with_realtime_quotaandload_single_account, picking the earliest deadline (.min(ts)) when multiple buckets share a window, and purging historical mappings upon receiving new quota groups to prevent stale timestamp contamination; robustly supports camelCasequotaGroups. (PR #3852) - Selective Circuit Breaker Reconciliation (P1-6): Replaced indiscriminate quota-lock wiping in account reloads with model-scoped
reconcile_quota_recovery, ensuring a positive Gemini quota cannot prematurely unlock an exhausted Claude model, while strictly preserving 429RateLimitExceededbackoff. (PR #3852) - Account-Level Lock & Global Fallback Boundaries (P1-7): Clear the account-level "all models exhausted"
QuotaExhaustedlock as soon as any model recovers; restrict global reset fallback to the case where both short-term and weekly per-model maps are empty, eliminating residual cross-family clock contamination. (PR #3852)
- [Docker Healthcheck Leak & Tini Init Process Governance] (Fixes #3850, PR #3854, Thanks to @cubelikeplayDaniel):
- [Upload Bandwidth Semantics & Budget Alignment: Eliminating 15s Request Drop on Large Payloads] (Ref #3763, Ref #3821, PR #3857, Thanks to @wakeupnotfound):
- [Account Ban Detection & Zero-Quota Admission Deadlock Resolution] (Ref #3525, #3630, #3631, #3840, commit 03c83b1, Thanks to @jeikl):
- Added production endpoint
TOS_VIOLATIONdetection and appeal link extraction, instantly isolating banned accounts from routing; added disk account pool throttled reload and mapped-model re-validation before 502 rejection to unblock admission upon adding new accounts. (Ref #3525, #3630, #3631, #3840)
- Added production endpoint
- [Embedded Text Data URL Media Auto-Recovery & Token Blowup Prevention] (PR #3864, Ref #3830, Thanks to @mclinyeshi):
- Promoted Base64 Data URL images serialized within plain text (such as rollout transcripts in Codex background memory generation) into canonical
inlineDatavisual parts with content deduplication, eliminating massive token billing blowups (from 500k+ text tokens down to standard image tokens) and drastically reducing prefill latency; - Traffic Log Defense: Automatically collapsed massive Base64 payloads in frontend concise views and persistent audit storage, preventing UI freezes and database bloating. (PR #3864)
- Promoted Base64 Data URL images serialized within plain text (such as rollout transcripts in Codex background memory generation) into canonical
- [Responses Protocol Tool Call & Response Adjacency Alignment: Eliminating Claude 400 Prefill Error and Gemini Cache Invalidation] (PR #3866, PR #3867, Thanks to @mclinyeshi):
- Folded plain-text commentary turns wedged between
functionCallandfunctionResponseturns in Codex/v1/responsesback into the calling turn (protocol-agnostic): eliminated upstream Claude HTTP 400 rejection (This model does not support assistant message prefill) and prevented Gemini thought signature flickering on wedged turns across adjacent turns to preserve context cache stability. (PR #3866, PR #3867)
- Folded plain-text commentary turns wedged between
- [403 封禁锁状态机与配额刷新防覆写:根治日配额 200 OK 冲掉 403 缺陷并新增异常账号一键筛选] (Fixes #3863, Ref #3865, PR #3875, commit fc45775, a079bdf, 3010f9e, Thanks to @cubelikeplayDaniel, @jeikl):
- 403 状态硬锁定保持: 确立 403 封禁状态高于日配额 200 OK 契约。在
update_quota与update_account_quota_internal中引入锁定守卫,无论后台定时刷新还是手动刷新日配额,现存 403is_forbidden与proxy_disabled标记绝对不被冲掉,彻底解决“刷新额度 403 凭空消失,调用一次又报错”的严重缺陷。(Fixes #3863, PR #3875) - 生产测活精准安全自愈: 仅当生产端点真实探测返回
Healthy时方可解除非模型级 403 锁;模型定向受限保留模型锁,杜绝拉取普通日配额欺骗解限。(commit a079bdf, 3010f9e) - 账号列表「异常」快捷过滤与直达: 账号管理页工具栏新增「异常」快捷过滤按钮,一键聚合展示所有 banned / validation_blocked / 403 账号并显示精确计数;仪表盘「健康度 & 风控」卡片支持点击直达异常过滤视图。(Ref #3865, PR #3875)
- 403 状态硬锁定保持: 确立 403 封禁状态高于日配额 200 OK 契约。在
- [UI 交互与弹窗层级修复:根治添加账号按钮穿透更新弹窗] (Fixes #3853, PR #3872, Thanks to @cubelikeplayDaniel):
- [启动配额异步刷新与工具栏操作] (Ref #3726, PR #3871, Thanks to @lbjlaq):
- [蹬额度模式稳定性与视觉体验优化] (Ref #3870, commit 73d798c, 0f734f5, Thanks to @cubelikeplayDaniel):
- [Web 端测活自动调度与安全自愈] (Ref #3861, Ref #3869, PR #3868, commit fb32517, 8232798, 2677d8c, 32735f9, Thanks to @cubelikeplayDaniel):
- [分级配额契约与自愈架构重构:根治跨模型重置时间污染与零配额死锁,实现周硬配额绝对优先与安全自愈] (Fixes #3840, #3845, PR #3852, Thanks to @jeikl, @cubelikeplayDaniel):
- Weekly 硬配额优先契约 (P0-1): 严格落实周窗口与短期 5 小时滚动窗口的层级约束。当周硬配额耗尽(0%)时,系统严禁仅因短期 5h 窗口重置而误触发账号自愈;多周桶(如 Argon WTU 7d)并发耗尽时需全部桶到期自愈,方可解除配额耗尽锁定并恢复调度准入。(Fixes #3840, PR #3852)
- 模型大类组级隔离 (P0-2): 重置时间提取与模型映射全面解耦,按模型大类族群(Argon / 3P / Gemini)维护独立重置映射与窗口快照;当模型重置时间映射非空时,严禁未匹配模型回退至全局全局最早重置时间,彻底杜绝 Argon 重置到期污染普通 Gemini 模型或导致错误提权。(Fixes #3845, PR #3852)
- 准入资格与调度排序解耦 (P1-4): 拆分
has_candidate_quota_admission(布尔准入资格)与get_candidate_quota(排序权重计算);自愈到期账号赋予保守正向 sentinel (20),既能及时参与候选调度竞争,又绝不抢占与压制具备健康正配额(40%~100%)的高可用账号。(PR #3852) - 实时配额刷新全状态同步 (P1-2, P1-3):
fetch_and_lock_with_realtime_quota与load_single_account同步提取model_reset_times、model_weekly_reset_times与详细model_quota_windows,多桶同窗口取最早截止时间戳 (.min(ts)),并在接收新配额组时彻底清空旧映射防止跨窗口陈旧时间戳污染,实现动态模型族映射与快照一致性;同时健壮兼容 camelCasequotaGroups结构。(PR #3852) - 熔断锁模型级精准解限与 429 退避保护 (P1-6): 账号重载与正配额快照恢复时,对各模型分别进行正配额校验并按模型粒度调用
reconcile_quota_recovery,防止正向 Gemini 模型提前解禁尚在耗尽状态的 Claude 模型,仅精准释放已恢复的QuotaExhausted状态,严格保留 429RateLimitExceeded速率退避时间。(PR #3852) - 账号级锁与全局兜底边界收敛 (P1-7): 任一模型恢复正配额时同步解除账号级“全模型耗尽”
QuotaExhausted锁;全局 reset 兜底收紧为仅当短期与周周期两个 per-model map 均为空时才生效,彻底封堵残余跨族时间污染。(PR #3852)
- [Docker 容器健康检查超时修复与 Tini Init 进程泄漏治理] (Fixes #3850, PR #3854, Thanks to @cubelikeplayDaniel):
- [上传带宽语义与预算对齐:根治大请求体 15s 误杀] (Ref #3763, Ref #3821, PR #3857, Thanks to @wakeupnotfound):
- [账号封禁识别与无配额门禁卡死修复] (Ref #3525, #3630, #3631, #3840, commit 03c83b1, Thanks to @jeikl):
- [文本内嵌 Data URL 视觉自愈与超大 Token 计费治理] (PR #3864, Ref #3830, Thanks to @mclinyeshi):
- 将序列化进纯文本(如 Codex memory 提取的 rollout JSON)中的 Data URL 图像提升为规范
inlineData部件(按内容去重),彻底消除数十万字符 Base64 被上游按文本 Token 逐字计费(输入膨胀至 500k+ tokens 且极度拉长首字延迟)的缺陷; - 日志精简防护:在前端简要视图与后端持久化审计中自动折叠大段 Base64,防止前端与 SQLite 数据库被巨量字符串卡死。(PR #3864)
- 将序列化进纯文本(如 Codex memory 提取的 rollout JSON)中的 Data URL 图像提升为规范
- [Responses 协议工具调用与回执相邻性对齐:根治 Claude 400 与 Gemini 缓存跳变] (PR #3866, PR #3867, Thanks to @mclinyeshi):
Full Changelog: v5.0.3-beta.5...v5.0.4-beta.1