new-api

6,661 Commits 9 Branches 712 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
RedwindA	19d435e7fd	fix(relay): mask only the custom upstream address in error messages (#7822 ) * fix(relay): mask only the upstream address in error messages MaskSensitiveInfo masked every URL, domain and IPv4 in upstream error messages, which garbled documentation links, email domains and dotted identifiers that clients need to read. It now takes the upstream addresses of the request: the channel base URL, the origin the gateway actually dialed (recorded in doRequest, DoWssRequest, the AWS SDK client and the Xunfei and Volcengine TTS dials, which covers absolute Advanced Custom routes), the channel proxy and the environment proxy. URLs and bare hostnames on those hosts and all IPv4 addresses are masked; other URLs and domains stay readable. With no upstream address no address is masked. Credentials are masked on every URL regardless of host: api_key values, query values and userinfo. The URL matcher also keeps quotes, colons and semicolons that follow a URL, keeps parentheses and apostrophes inside it, masks an IPv4 URL host whole and keeps a country-code TLD when the host has a port. * fix(relay): keep preset official endpoints readable in masked errors A channel on the base URL new-api presets for its type reaches a public official endpoint, so its address is not masked. Only addresses the admin configured are: a custom base URL, the origin of an Advanced Custom route, and the channel and environment proxies. Preset hosts are compared with their port so a configured localhost upstream stays apart from the Ollama preset. The origins recorded for the AWS SDK, Xunfei and Volcengine TTS dials and the plugin allowedHosts masking are dropped: they are all official endpoints. * fix(relay): mask IPv4 addresses and plugin allowed hosts in every error IPv4 addresses in network errors include the gateway's own address, so they are masked even when the channel uses a preset base URL. Task plugin build failures mask the plugin's allowedHosts again: an installed plugin may point them at private hosts. * fix(relay): mask bracketed IPv6 addresses in errors Go network errors write IPv6 addresses in brackets, as in "dial tcp [2001:db8::1]:443". Like IPv4, they are the resolved upstream or the gateway's own address, so they are masked on every error once the bracketed content parses as an IP.	2026-10-15 15:49:45 +08:00
Calcium-Ion	128089fa7d	feat(i18n): translate web console messages in the frontend and AI-client errors in the backend (#7712 ) * feat(i18n): translate web console messages in the frontend and AI-client errors in the backend Chinese text was hard-coded in API messages, stored log content, emails and server logs, so it reached users of every interface language. Text is now translated where its reader is: - Web console APIs return the English source text as message_key with message_params, and the web console translates it in all seven languages. message keeps the English text for other API callers. - Errors returned to AI clients, emails and notifications are translated by the backend (en, zh-CN, zh-TW) in the language saved on the account, then the language of the request's Accept-Language header. - A reader who states no language still gets the original Chinese text of the messages that were Chinese before, word for word. Gateways that use another new-api as their upstream match that text, for example to disable a channel whose account ran out of quota. - Usage, top-up and system log content is stored as content_parts (key and params) and rendered in the viewer's language. Task fail reasons and refund reasons written by the gateway are English keys. Rows written earlier are shown as before. - Server logs are English. Also: - The saved interface language zhTW, and zh-HK, zh-MO and zh-Hant, now select Traditional Chinese in the backend instead of Simplified Chinese. - The built-in group descriptions are translated; descriptions an administrator saved are shown as written. - .agents/rules/i18n.md records the conventions. Tests in i18n/ fail on a non-English string literal, on a web console message without translations and on a locale key without a constant. * feat(i18n): print server logs in Chinese when LOG_LANGUAGE asks for it Server log lines are English by default. With LOG_LANGUAGE=zh-CN, the lines that were Chinese before print their original Chinese text. common.LogText formats a log line from its English format, which is also the key of its Chinese text in common/log_text.zh-CN.json. A line without an entry prints in English. go vet checks the arguments of every call, and TestServerLogTexts checks that each entry still matches a call and has the same verbs as its key. * docs: list LOG_LANGUAGE in the docker compose example * feat(i18n): translate every server log line and add DEFAULT_LANGUAGE Every line the gateway prints goes through common.LogText. With DEFAULT_LANGUAGE=zh-CN, the lines that have a Chinese text in common/log_text.zh-CN.json print it and the others print English. DEFAULT_LANGUAGE replaces LOG_LANGUAGE. It also sets the language of backend messages, emails and notifications for a reader who states no language: en, zh-CN or zh-TW, English when unset. The list of messages that stayed Chinese for such readers is removed. Review fixes: - Channel test logs store the token name "Model test"; the console shows it in the interface language. - Task fail reasons written by the gateway are fixed sentences the console translates. The HTTP status and the upstream detail go to the server log when a polled task is failed. - The auto-disable reason of a slow channel is written in DEFAULT_LANGUAGE. Also: - Drop the repository-scanning lint tests, the i18n rules file and its read gate. AGENTS.md keeps the conventions in four lines. - Payment error toasts keep their previous text and only add the translated message key. - Remove guards and helpers that no caller needs. * fix(i18n): address review on language lookup, notices and error responses - Relay requests no longer load the user a second time to find the language: the settings TokenAuth put into the request are used as they are, also when they hold no language. - Upstream model update notices are rendered in each recipient's saved language, DEFAULT_LANGUAGE when none. - /api/usage/token and /api/log/token answer with backend-translated messages again, with the keys and status codes used before this PR. Their callers are scripts, not the web console. - Webhook notifications fill {{value}} placeholders like the other senders. Running the rendered text through Sprintf appended %!(EXTRA ...) and broke %2F in links. - RootUserLanguage reads the setting of the root user it already loaded. - zh_TW and zh_HK are read as Traditional Chinese. - Add common.ApiErrorStatus for error responses under another HTTP status and use it where those responses were built by hand. - Remove middleware.GetLanguage, which had no callers.	2026-10-09 21:39:51 +08:00
CaIon	03563a4a79	feat(plugins): serve OpenAI Images API through task plugins Add the synchronous openai_image host protocol so a task plugin can claim POST /v1/images/generations and /v1/images/edits; the host submits the task, polls it inside the request and lets the plugin render the OpenAI image response. Unclaimed models still fall back to the HTTP image relay. - Migrate Ali (Bailian) image models to the alibaba plugin and remove the ali channel image/wan adaptors and the qwen model setting - Add Doubao Seedream image generation to the doubao plugin - Support retainResult on routes and indexed multipart file references - Settle image counts from upstream usage or image payloads; document the rule in the billing conventions and plugin API docs - Show billing source and task artifacts in usage logs; rename the DoubaoVideo channel display name to Doubao and refresh the favicon	2026-09-20 17:58:45 +08:00

Author

SHA1

Message

Date

RedwindA

19d435e7fd

fix(relay): mask only the custom upstream address in error messages (#7822 )

* fix(relay): mask only the upstream address in error messages

MaskSensitiveInfo masked every URL, domain and IPv4 in upstream error
messages, which garbled documentation links, email domains and dotted
identifiers that clients need to read.

It now takes the upstream addresses of the request: the channel base URL,
the origin the gateway actually dialed (recorded in doRequest, DoWssRequest,
the AWS SDK client and the Xunfei and Volcengine TTS dials, which covers
absolute Advanced Custom routes), the channel proxy and the environment
proxy. URLs and bare hostnames on those hosts and all IPv4 addresses are
masked; other URLs and domains stay readable. With no upstream address no
address is masked. Credentials are masked on every URL regardless of host:
api_key values, query values and userinfo.

The URL matcher also keeps quotes, colons and semicolons that follow a URL,
keeps parentheses and apostrophes inside it, masks an IPv4 URL host whole and
keeps a country-code TLD when the host has a port.

* fix(relay): keep preset official endpoints readable in masked errors

A channel on the base URL new-api presets for its type reaches a public
official endpoint, so its address is not masked. Only addresses the admin
configured are: a custom base URL, the origin of an Advanced Custom route,
and the channel and environment proxies. Preset hosts are compared with
their port so a configured localhost upstream stays apart from the Ollama
preset.

The origins recorded for the AWS SDK, Xunfei and Volcengine TTS dials and the
plugin allowedHosts masking are dropped: they are all official endpoints.

* fix(relay): mask IPv4 addresses and plugin allowed hosts in every error

IPv4 addresses in network errors include the gateway's own address, so they
are masked even when the channel uses a preset base URL. Task plugin build
failures mask the plugin's allowedHosts again: an installed plugin may point
them at private hosts.

* fix(relay): mask bracketed IPv6 addresses in errors

Go network errors write IPv6 addresses in brackets, as in
"dial tcp [2001:db8::1]:443". Like IPv4, they are the resolved upstream or
the gateway's own address, so they are masked on every error once the
bracketed content parses as an IP.

2026-10-15 15:49:45 +08:00

Calcium-Ion

128089fa7d

feat(i18n): translate web console messages in the frontend and AI-client errors in the backend (#7712 )

* feat(i18n): translate web console messages in the frontend and AI-client errors in the backend

Chinese text was hard-coded in API messages, stored log content, emails and
server logs, so it reached users of every interface language.

Text is now translated where its reader is:

- Web console APIs return the English source text as message_key with
message_params, and the web console translates it in all seven languages.
message keeps the English text for other API callers.
- Errors returned to AI clients, emails and notifications are translated by
the backend (en, zh-CN, zh-TW) in the language saved on the account, then
the language of the request's Accept-Language header.
- A reader who states no language still gets the original Chinese text of the
messages that were Chinese before, word for word. Gateways that use another
new-api as their upstream match that text, for example to disable a channel
whose account ran out of quota.
- Usage, top-up and system log content is stored as content_parts (key and
params) and rendered in the viewer's language. Task fail reasons and refund
reasons written by the gateway are English keys. Rows written earlier are
shown as before.
- Server logs are English.

Also:

- The saved interface language zhTW, and zh-HK, zh-MO and zh-Hant, now select
Traditional Chinese in the backend instead of Simplified Chinese.
- The built-in group descriptions are translated; descriptions an
administrator saved are shown as written.
- .agents/rules/i18n.md records the conventions. Tests in i18n/ fail on a
non-English string literal, on a web console message without translations
and on a locale key without a constant.

* feat(i18n): print server logs in Chinese when LOG_LANGUAGE asks for it

Server log lines are English by default. With LOG_LANGUAGE=zh-CN, the lines
that were Chinese before print their original Chinese text.

common.LogText formats a log line from its English format, which is also the
key of its Chinese text in common/log_text.zh-CN.json. A line without an entry
prints in English. go vet checks the arguments of every call, and
TestServerLogTexts checks that each entry still matches a call and has the
same verbs as its key.

* docs: list LOG_LANGUAGE in the docker compose example

* feat(i18n): translate every server log line and add DEFAULT_LANGUAGE

Every line the gateway prints goes through common.LogText. With
DEFAULT_LANGUAGE=zh-CN, the lines that have a Chinese text in
common/log_text.zh-CN.json print it and the others print English.

DEFAULT_LANGUAGE replaces LOG_LANGUAGE. It also sets the language of
backend messages, emails and notifications for a reader who states no
language: en, zh-CN or zh-TW, English when unset. The list of messages
that stayed Chinese for such readers is removed.

Review fixes:
- Channel test logs store the token name "Model test"; the console shows
it in the interface language.
- Task fail reasons written by the gateway are fixed sentences the console
translates. The HTTP status and the upstream detail go to the server log
when a polled task is failed.
- The auto-disable reason of a slow channel is written in DEFAULT_LANGUAGE.

Also:
- Drop the repository-scanning lint tests, the i18n rules file and its
read gate. AGENTS.md keeps the conventions in four lines.
- Payment error toasts keep their previous text and only add the
translated message key.
- Remove guards and helpers that no caller needs.

* fix(i18n): address review on language lookup, notices and error responses

- Relay requests no longer load the user a second time to find the
language: the settings TokenAuth put into the request are used as they
are, also when they hold no language.
- Upstream model update notices are rendered in each recipient's saved
language, DEFAULT_LANGUAGE when none.
- /api/usage/token and /api/log/token answer with backend-translated
messages again, with the keys and status codes used before this PR.
Their callers are scripts, not the web console.
- Webhook notifications fill {{value}} placeholders like the other
senders. Running the rendered text through Sprintf appended
%!(EXTRA ...) and broke %2F in links.
- RootUserLanguage reads the setting of the root user it already loaded.
- zh_TW and zh_HK are read as Traditional Chinese.
- Add common.ApiErrorStatus for error responses under another HTTP status
and use it where those responses were built by hand.
- Remove middleware.GetLanguage, which had no callers.

2026-10-09 21:39:51 +08:00

CaIon

03563a4a79

feat(plugins): serve OpenAI Images API through task plugins

Add the synchronous openai_image host protocol so a task plugin can claim
POST /v1/images/generations and /v1/images/edits; the host submits the
task, polls it inside the request and lets the plugin render the OpenAI
image response. Unclaimed models still fall back to the HTTP image relay.

- Migrate Ali (Bailian) image models to the alibaba plugin and remove the
  ali channel image/wan adaptors and the qwen model setting
- Add Doubao Seedream image generation to the doubao plugin
- Support retainResult on routes and indexed multipart file references
- Settle image counts from upstream usage or image payloads; document the
  rule in the billing conventions and plugin API docs
- Show billing source and task artifacts in usage logs; rename the
  DoubaoVideo channel display name to Doubao and refresh the favicon

2026-09-20 17:58:45 +08:00