chore: merge upstream QuantumNous/new-api eb99ab1b (48 commits) - #5
Merged
Conversation
…#6987) * fix(web): align admin binding types Refs QuantumNous#6985 * test(web): restore animation mock
Co-authored-by: seefs001 <i@seefs.me>
* fix(relay): return 400 for invalid request parameters
…in models Channel model_mapping keys exposed in a channel's model list now act as first-class aliases for task-plugin models across the whole line: - Derived alias view (model/task_model_alias.go): built from enabled channels' model_mapping, chain-following with cycle detection, declared names always win, cross-plugin conflicts dropped. Rebuilt on channel cache refresh, registry generation change, and a 60s TTL. - Request path: PinTaskPluginEndpoint resolves declared-name case folds and mapping aliases before endpoint lookup (never rewriting the body until the endpoint is claimed), pins with MappedModel, and the decode contract accepts alias echoes without loosening model ownership for normal pins. Legacy /v1/tasks submit folds case variants the same way. Fixes aliases on POST /v1/responses silently falling through to the main relay against task channels. - Mapping order: ModelMappedHelper now runs before the plugin submit hook builds and caches the upstream body, so channel model_mapping actually reaches the upstream request. Plugins receive the mapped name as ctx.upstreamModel in both decode and submit contexts. - Billing: identity stays the origin name; when the alias has no tiered expression, the selected channel's mapping tail expression applies. Pricing page and billing-expr smoke tests resolve aliases to the owning plugin's usage schema. - Case folding: ASCII-only fold with exact-match priority; same-plugin and cross-plugin fold collisions rejected at registration. - Plugins: model-keyed rate tables, req_key derivation, and combo validation in doubao/kling/jimeng/hailuo/vidu/sunoapi now key on ctx.upstreamModel || ctx.model; render/echo paths keep ctx.model.
…bility GORM v1.25.2 closes cached prepared statements asynchronously on any SQL error and immediately re-Parses the same deterministic name (pgx's stmt_<sha256>) on the same client connection. Transaction-pooling proxies (PgBouncer >=1.21 with max_prepared_statements, Neon, Supabase) respond with FATAL "prepared statement name is already in use" (SQLSTATE 08P01) and drop the connection. PreferSimpleProtocol only disables pgx's implicit prepare and never covered GORM's explicit PrepareStmt cache. - PostgreSQL now runs with PrepareStmt disabled entirely; named prepared statements are fundamentally session state and cannot be made safe under transaction pooling. Parse/plan cost is noise for this workload. - Upgrade gorm to v1.25.12 so MySQL/SQLite statement caches (still enabled) no longer churn close/re-prepare on ordinary SQL errors; v1.25.9+ restricts eviction to driver.ErrBadConn. Deliberately not v1.26+, whose LRU eviction has an open use-after-close race (#7831). - sanitizeDBError now attaches a remediation hint on 08P01/42P05 so affected deployments can self-diagnose from the log line.
Marketplace install/upgrade on a factory-served plugin actually created a permanent override shadowing every future built-in release. The card now shows an informational "Updates with the system" badge instead of the action, while keeping the built-in vs marketplace version line and the upgradable state badge visible. Deliberate overrides are untouched: upload and marketplace actions on overridden or third-party plugins behave as before, and the plugins table now hints when an override lags behind the shipped built-in version so operators know deleting it restores the newer factory plugin.
…us#7086) Co-authored-by: Claude <noreply@anthropic.com>
… stop concurrent write lockouts (QuantumNous#7030) * fix(sqlite): enable WAL + working busy timeout + _txlock=immediate to stop concurrent write lockouts
…ocol
With PrepareStmt disabled, PostgreSQL queries run over pgx's simple
protocol, which encodes every []byte parameter as a bytea hex literal
('\x...'). driver.Valuer implementations returning []byte from
json.Marshal therefore fail json-column writes with SQLSTATE 22P02
(reported on the channels UPDATE path via ChannelInfo).
Reproduced against a live PostgreSQL 16: []byte Valuer into a json
column fails under simple protocol, string succeeds; []byte into a
text column silently stores the hex literal (no such path exists in
the repo today — audited all Valuers, json.RawMessage fields, and raw
SQL call sites).
- ChannelInfo, Properties, TaskPrivateData, JSONValue Value() now
return string; zero-value nil semantics unchanged. Task.Data
(bare json.RawMessage) is unaffected — database/sql's default
converter already passes it as expected.
- Their Scan() counterparts now accept both []byte and string via a
shared jsonScanBytes helper: SQLite returns string for these columns
once Value() emits string, and the old []byte-only assertions
silently zeroed the field (caught by the model test suite).
- Add regression tests locking both contracts: json-column Valuers
must return string (or nil for zero values), Scanners must accept
[]byte and string.
Verified end-to-end against PostgreSQL 16 with the real model types:
Channel create/update/read-back, Task json fields, PrefillGroup items.
…nded heap growth → OOM) (QuantumNous#6949) * fix(relay): bound the wait for upstream response headers (fixes unbounded heap growth) The relay transport sets a dial timeout, a TLS handshake timeout and an expect-continue timeout, but nothing bounds how long it waits for the upstream *response headers* after the request has been written. An upstream that accepts the connection and then never answers -- without sending FIN/RST, which is what happens when a NAT/firewall silently drops the flow or the provider hangs -- parks the goroutine in net/http.(*persistConn).roundTrip forever. That goroutine keeps the whole request alive, which in practice means three copies of the request body stay reachable for the lifetime of the process: the raw bytes from io.ReadAll in CreateBodyStorageFromReader, the decoded messages held as json.RawMessage, and the re-marshalled upstream body from common.Marshal. BodyStorageCleanup cannot help here: it runs after c.Next() returns, and for these requests c.Next() never returns. Measured on v1.0.0-rc.23 in production (see QuantumNous#6947 for the full evidence): - 23 goroutines stuck in persistConn.roundTrip on a single 40h-old instance, blocked between 353 and 1894 minutes (5.9h to 31.5h) - 96.9% of the live heap, sampled after a forced GC, attributable to those three body copies (HeapAlloc 892 MiB surviving three GC cycles; HeapObjects dropping 30x while bytes dropped only 25%) - the live floor grows with uptime: 33.7 MiB at 0.1h, 89.2 at 13.8h, 510.0 at 40.1h, 955.2 at 146.8h, OOMKilled at 172.9h -- same image, same config, same load Doubling the memory limit and adding GOMEMLIMIT only moved the OOM from 132h to 172.9h. RELAY_TIMEOUT (http.Client.Timeout) cannot be used for this: it covers the whole response read and would cut legitimate long streaming calls, which is why it defaults to 0. ResponseHeaderTimeout only bounds the wait for the headers; streaming after they arrive is unaffected. The default is deliberately generous. Non-streaming upstreams usually send the response headers only once generation has finished, so the value has to leave room for a long completion. 1800s is 12x shorter than the shortest hang observed here while leaving several times the headroom a normal non-streaming request needs; 0 restores the previous unbounded behaviour. The assignment goes next to the other transport.* lines rather than inside the else branch: newRelayHTTPTransport() normally takes the http.DefaultTransport.Clone() path, and DefaultTransport does not set ResponseHeaderTimeout either. This repo already sets ResponseHeaderTimeout on its other outbound transports (controller/model_sync.go, controller/ratio_sync.go); the relay path appears to have been missed. Refs QuantumNous#6947. Likely also the root cause of QuantumNous#6731, which reported the same symptom (production OOM on /v1/responses after ~64h) but was closed for template reasons. * review: clamp overflowing timeout values and switch the test to testify Addresses the two CodeRabbit findings on this PR. Overflow (common/init.go:113): a RELAY_RESPONSE_HEADER_TIMEOUT beyond ~9.2e9 seconds overflows time.Duration and can wrap into a *tiny positive* timeout, which would cut every relay request instead of only the stuck ones. The value is now clamped before the conversion, with regression tests for both the negative and the overflowing input. I did not add fail-on-startup validation for negative values, for two reasons: the existing `if seconds > 0` guard already treats them as "disabled", and the neighbouring env-driven timeouts in this file are less strict still -- RelayIdleConnTimeout is converted with no guard at all. Failing startup on a bad value would be a behaviour change out of step with the rest of the file; happy to add it if you'd prefer that direction repo-wide. Test style: switched to testify (require.Equal / require.Zero / require.Positive), which is what every other test under service/ uses. go build, go vet and go test ./common/... ./service/... pass. (`go build ./...` fails on the `web/dist` embed both with and without this change -- the frontend bundle is not checked in.)
…efore Au…" (QuantumNous#7101) This reverts commit 69a41ee.
* fix(log): preserve quota in usage statistics
…, and billing usage integrity (QuantumNous#7137) * feat(relaykit): preserve hosted tools across conversions - add protocol-neutral hosted-tool DTOs, conversion metadata, and loss policies - bridge citations, grounding metadata, and hosted-tool stream lifecycles - document the public conversion behavior and channel policy controls * refactor(relaykit): normalize reasoning and thinking intent - centralize provider-neutral reasoning intent, effort, and budget mappings - parse model suffixes at the host entry boundary while preserving provider-owned tails - keep adaptive Claude thinking and explicit zero-token compatibility consistent * fix(billing): preserve authoritative usage across relay hops - carry native BillingUsage sidecars through direct and streamed protocol bridges - merge partial and terminal usage monotonically with safe fallback settlement - retain cache metadata, penultimate usage, and per-call Gemini tool surcharges * feat(relay): bridge Responses with Claude and Gemini protocols - add direct request, response, and stream converters across supported relay formats - expose Claude count_tokens and Chat-to-Responses compatibility endpoints - carry conversion diagnostics through the host while retaining the curated public goldens * fix(relay): wire relaykit conversions into host channels - connect handlers, adaptors, and channel settings to the standalone conversion layer - keep model mapping, pricing identity, retries, and provider-specific suffix behavior aligned - ignore local audit artifacts and retain focused public regression coverage
…uantumNous#7170) Deferred follow-ups from the relaykit-tools review cycle, verified by live end-to-end billing tests: - billing: normalize Gemini modality keys consistently between stream merge and settlement (case/whitespace variants no longer drop independent audio/image pricing) and sum duplicate modality entries on both paths - billing: sync legacy flat Claude cache-creation fields from the CacheCreation sub-object (including zeroing) and fall back to flat fields only when the snapshot never carried a sub-object, closing a stale 1h-cache overcharge path in cascaded deployments - relay: move Chat-to-Claude and Chat-to-Gemini stream conversion state from gin.Context onto RelayInfo and reset it with SendResponseCount in InitChannelMeta, so channel retries start clean while per-request state (stream error collection, conversion diagnostics, channel chain, billing accumulators) survives - relay: Claude channel now serves Gemini-format clients (request via registry conversion, response and stream composed through the Chat pivot), removing the last unimplemented conversion direction - relaykit: recognize legacy pseudo tool names (googleSearch, codeExecution, urlContext) in the toolconv decode stage and drop the string-matching bypass in the Chat-to-Gemini converter; native Gemini tool output is restored and non-Gemini targets follow standard loss diagnostics - relaykit: attach upstream Gemini usage (with billing_usage sidecar) to intermediate stream chunks so converted Claude streams report upstream truth from message_start, and preserve the sidecar through Claude stream usage merges; billing settlement unchanged - billing: clamp negative Total-Prompt completion derivation, OR the Estimated flag across cross-dialect snapshot replacement, and fill canonical OpenAI prompt details via field-wise merge
QuantumNous#7168) * feat(plugin): add MiniMax-H3 /v2 video generation to the hailuo task plugin MiniMax-H3 speaks a different contract from the other Hailuo models, so the hailuo task plugin now branches on the upstream model instead of adding a Go adaptor: - submit builds /v2/video_generation with a multimodal `content` array (text, first/last frame images, reference video/audio, or a full `metadata.content` passthrough), an explicit `ratio`, and 768P/2K resolutions; `metadata.callback_url` and `metadata.aigc_watermark` pass through - query uses /v2/query/video_generation/{task_id} and parses the `{"task": {...}}` envelope, falling back to the /v1 shapes for every other model - the /v2 result is a public CDN URL, so its artifact is proxied credentialless instead of through /v1/files/download - request bounds (duration 4-15, resolution 768P/2K, ratio whitelist, at most 2 frame images and 9/3/3 reference images/videos/audios) are enforced while the request body is built, which the host runs during validation, so an out-of-range duration is rejected with a 400 before it can become a billing multiplier - duration and resolution are reported as usage facts only. Like the rest of this plugin, extractUsage returns no billing ratios, so per-call pricing is flat and 2K/duration pricing is expressed through the model's tiered billing expression over those facts. Query hooks are driver hooks and are documented to receive `ctx.model` and `ctx.upstreamModel`, but polling has no relay info and never populated them. The polling and realtime-fetch call sites now carry the persisted task model properties and the plugin adaptor maps them onto the query context, with `upstreamModel` falling back to the origin name for tasks submitted without a channel mapping. * fix(plugin): validate Hailuo H3 requests and errors
* fix: reduce public bootstrap requests and revalidate content * fix(controller): use a weak ETag for revalidated public JSON /api is gzip-compressed by middleware that runs after the handler returns, and the validator is computed over the uncompressed body. The compressed and identity forms of one payload therefore share a validator, which a strong ETag must not do -- it asserts byte-for-byte equality across representations (RFC 9110 8.8.1). Serve W/ instead. Weak comparison ignores W/ on both operands, so etagMatches now strips it from the served validator as well as from each candidate. Stripping only the candidate would make a weak served validator match nothing and silently disable every 304. Vary: Accept-Encoding stays. Weakening the validator makes revalidation correct, but it does not separate the two encodings in a shared cache. * fix(test): align response cookie helper name * fix(auth): revalidate stale route sessions * Update web/src/features/about/api.ts Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * test: remove newly added PR tests --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
- Drop the unreachable user-visibility branch in LogOther.toMap and the receiver-mutating normalizeLegacyAdminFields; JSONString/Snapshot/ MarshalJSON now share one full serialization - Define legacySensitiveLogOtherKeys once and reference it from both SetPublic rejection and the user read-side projection - Return the original JSON for every role when formatLogOtherJSON removed nothing, avoiding a re-marshal on the user log list path - Log rejected OtherRatios keys in taskBillingOther instead of dropping them silently - Use Snapshot() with typed assertions in service tests
…fication, and bounded poll failures
Plugin polling hooks previously ran against a hollow context: parseTaskResult
and parseBatchResult received {} / nil, buildQueryRequest received a
{task_id, action} map under the misleading name requestBody, and batch hooks
saw only bare task ids. The per-task poller also never looked at the upstream
HTTP status, and every built-in plugin papered over unrecognized bodies with
`|| "IN_PROGRESS"`, so a 404, a revoked key, or a shape the plugin did not
know would sit in IN_PROGRESS for the full 24h TASK_TIMEOUT_MINUTES while
holding the user's pre-charged quota.
Contract (docs/plugin-api v1.d.ts, v1.md, v1.schema.json):
- TaskQueryContext is declared separately from DriverContext and rebuilt from
the persisted Task row: taskId, publicTaskId, action, model, upstreamModel,
baseUrl, apiKey, authHeader, auth, data, state. Query-side requestBody is
removed; the original request is not persisted and hooks that need a
request-derived value must save it into state at submit time.
- parseTaskResult / parseBatchResult receive a third {status, headers}
argument. Batch hooks receive tasks[] with one TaskQueryContext per task.
- NormalizedTaskResult accepts status "UNKNOWN" meaning "I do not recognize
this body". Falling back to IN_PROGRESS for unknown shapes is forbidden;
`plugin lint` warns on the literal.
- parseSubmitResponse / parseTaskResult / parseBatchResult may return `state`.
Task.Data remains a per-round snapshot overwritten on every valid parse;
state is plugin-owned, persisted in TaskPrivateData.PluginState, preserved
when a hook omits it, byte-capped like taskData, and never exposed through
presenter views.
Host (service/task_polling.go, relay/channel/task/jsplugin/adaptor.go):
- TaskPollingAdaptor / BatchTaskPollingAdaptor take *model.Task and the
*http.Response so the adaptor can build the full context; jsplugin is the
only implementation.
- HTTP classification before the plugin sees the body: 2xx -> plugin;
404/410 -> FAILURE and refund; 401/403 -> poll failure plus a channel-scoped
warning, no auto-disable; 429/5xx/transport -> poll failure; other 4xx ->
plugin with the status visible, counted as unrecognized if the plugin still
reports a non-terminal state.
- TaskPrivateData.PollFailures counts consecutive poll failures (transient
HTTP, auth, transport, hook error, UNKNOWN). It is persisted through the
existing UpdateWithStatus CAS so a concurrent terminal transition on another
instance is never clobbered, and reset on any valid 2xx non-terminal parse.
Reaching TASK_POLL_MAX_FAILURES (default 20, <= 0 disables) fails the task
with the last classification and HTTP code in fail_reason and runs the
existing settle/refund chain exactly once. sweepTimedOutTasks and its
1440-minute default are unchanged as the outer backstop.
- Unrecognized bodies are logged at WARN with a bounded redacted copy since
Task.Data is intentionally not overwritten on that path.
Plugins (all ten bumped one patch version):
- jimeng persists the outbound req_key in state and reads it back in
buildQueryRequest, replacing dead reads of ctx.data / ctx.requestBody that
never resolved.
- sunoapi batch hooks read tasks[] instead of the removed requestBody.
- hailuo treats base_resp.status_code != 0 as FAILURE before the status table.
- kling, vidu, sora, alibaba, doubao, hailuo, jimeng return UNKNOWN with the
raw upstream status in reason on table miss.
- google and vertex-ai treat a missing `done` as in-progress: Google
long-running operations omit proto3 default fields, so a running Veo
operation has no `done` key at all. Only a body without an operation name is
UNKNOWN. plugins/veo_poll_test.go locks this so the poll-failure cutoff can
never fail a rendering Veo task.
Tests cover the classification table end to end against a real DB (404
immediate refund, 429xN refund, 401 increments without status change, 2xx
reset, UNKNOWN increments, state preserved vs replaced, PollFailures survives
the CAS write), the query-context shape, UNKNOWN on unrecognized bodies, and
the absence of PluginState/PollFailures from TaskView. Controller tests derive
the kling factory version from the embedded manifest instead of hardcoding it.
A model declared by a task plugin is served only by that plugin's channels. When the claiming plugin has no enabled channel in the request group, the distributor answered with the generic "no available channel" text, which hides the actual cause and led operators to expect channel model_mapping on another plugin's channel to take over (QuantumNous#7185). That expectation is not supported: plugin declarations own model names statically, and channel availability must not silently reassign ownership at request time. The supported fixes are the existing operator tools, disabling the factory plugin per key or overriding it. Both no-channel 503 sites in the distributor now route through noAvailableChannelMessage. When the request is pinned to a task plugin, the message names the claiming plugin and points to disabling or overriding it; non-plugin requests keep the generic message. Added in en, zh-CN, zh-TW.
Model-name post-processing is rebuilt around an explicit trailing @key:value modifier syntax (thinking/effort/temperature/topp) that overrides request fields, survives model mapping, and records conversion diagnostics on the consume log. - Legacy naked aliases (-thinking, -nothinking, -thinking-<budget>, effort tails) now parse only for positively matched families (gpt-*/o-series, claude-*, gemini-*, incl. vendor/ namespaces); names like qwen-max stay opaque. EffortTailModelIDs remains the escape hatch for real in-family IDs such as gpt-5.1-codex-max. - Billing identity resolves once in ModelPriceHelper via a ladder: configured request name first (legacy wildcard entries intact), then canonical billing names rebuilt from parsed intent (base@effort:E@thinking:S, then base@thinking:S; order, duplicates, and budget values are irrelevant; temperature/topp never priced), then base. Routing and token limits fall back through RoutingMatchModelName; pricing lookups stay wildcard-only. - Pass-through stays byte-identical: modifiers and aliases are neither parsed nor validated there and forward verbatim for the upstream (or a chained gateway) to interpret. - Unknown modifier keys and invalid known-key values are rejected with 400; models whose real names contain @tag:value are exempted via the thinking-suffix blacklist, which now supports re:-prefixed Go regex entries. - Claude reasoning render coerces unsupported combinations (disable, adaptive, budgets) with warning diagnostics instead of erroring; native-protocol requests without host syntax pass through untouched. BREAKING(openrouter): drop the host-invented "-thinking" model-name alias (added in 4f6d16e) that trimmed any *-thinking model on OpenRouter channels and injected reasoning.enabled. It matched too broadly and mangled real model IDs such as kimi-k2-thinking. Migration: use some-model@thinking:on, or keep the old public name via a channel model mapping {"some-model-thinking": "some-model@thinking:on"}. Claude/Gemini family aliases (incl. anthropic/claude-*-thinking) keep working via the family whitelist.
Merge upstream main (2d8e50b..eb99ab1) into CuzTeam main: - Sandboxed JS task plugin system, hosted-tool conversion, reasoning normalization - Billing expression pricing for tasks, gpt-6-astra built-in pricing - Password transport encryption (opt-in), task artifact store, ETag revalidation - SQLite WAL/busy-timeout, PostgreSQL pooler compatibility, legacy token key migration Conflict resolutions keep fork policy: - controller/option.go: keep the fork's removal of the payment-compliance gate (revert 2eb3c7c); adopt upstream TaskPublicAddress validation and billing-expression option handling; drop now-unused strconv import. - web/src/i18n/locales/*.json: union of keys per locale. Upstream additions kept; fork's benchmark/landing keys kept; fork's compliance-key removals kept; zh landing copy kept; upstream's 'Overnight range' removal adopted; upstream's en/zh-only 'Serving' key backfilled to the other locales via i18n:sync.
|
Important Review skippedToo many files! This PR contains 560 files, which is 460 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (560)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
15 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important
AI 声明：本 PR 的合并、冲突解决与验证由 AI 编码代理（opencode，模型 z-ai/glm-5.3-flash）协助完成，本人已审阅合并策略、冲突取舍与验证结果，并对其准确性与完整性负责。
🔗 关联任务 / Related Issue
🚀 变更类型 / Type of change
2d8e50bf3..eb99ab1b4的 48 个提交，不 rebase、不 force-push、不覆写 fork 历史📝 变更描述 / Description
做了什么
以 merge commit（
5170564ac）将上游 QuantumNous/new-apimain分支自2d8e50bf3以来的 48 个提交合入本仓库，保留完整 upstream 提交历史与 fork 自有提交历史，保证可追溯。上游主要变更（48 提交）
pkg/jsplugin+plugins/tasks/*的 JS 插件，任务计费改为表达式定价（Task usage prices are USD per declared unit），并支持渠道映射别名解析、插件模型 503 提示、轮询查询上下文与受限轮询失败@模型修饰符与规范计费身份、MiniMax-H3 输入媒体用量、gpt-6-astra内置表达式定价、时间规则恒真表达式修复、任务差额结算回写修复_txlock=immediate（fix(sqlite): enable WAL + working busy timeout + _txlock=immediate to stop concurrent write lockouts QuantumNous/new-api#7030）、PostgreSQL 关闭 prepared statements 以兼容 pooler、legacy token key 约束迁移、prefill_groups 遗留唯一约束清理thinking_token_budget、GLM/v1/responses、Bun 1.4.0冲突解决策略（8 个文件）
controller/option.go2eb3c7c5（移除付费功能合规确认门槛）的删除——不恢复合规确认检查与isPositiveOptionValue/isPaymentComplianceOptionKey助手；采纳上游新增：TaskPublicAddress校验、计费表达式选项冒烟测试、GetOptions计费模式/表达式展示、slices/sort导入；移除随之无用的strconv导入web/src/i18n/locales/*.json（7 个）Overnight range的删除；保留 fork 新增的 47–48 个 benchmark/落地页键；保留 fork 对合规相关 32 个键的删除（与2eb3c7c5的合规回退一致，合并后全库无残留引用，已用 grep 验证 Go 与前端均无引用）；保留 fork 对 zh 落地页两处文案的修改；上游仅在 en/zh 有的Serving键经bun run i18n:sync回填至其余语言为什么生效
MsgPaymentComplianceRequired、IsPaymentComplianceConfirmed、risk-acknowledgement、合规相关 i18n 键均无引用），因此保留删除不会造成悬挂引用或未翻译键bun run i18n:sync规范化，7 个语言键集完全一致（en 5555 键，其余语言经回填后同为 5555 键，extras 均为 0）📸 运行证明 / Proof of Work
后端（Go 1.22+）
go build ./...✅ 通过；go vet ./...✅ 通过go test ./...：common/constant/controller/dto/e2e/middleware/model/oauth/billingexpr/jsplugin/plugins/relay/helper/router/setting 等全部包 ✅ 通过；relay/channel与service两个包存在上游既有的顺序依赖型 flaky 测试（HTTP2 GOAWAY 重试用例依赖本机网络栈、channel-affinity 缓存用例存在跨用例状态污染）：在纯 upstream/main（eb99ab1b4，临时 worktree）上全包运行出现同类失败（且每次失败用例名不同、单用例运行均通过），与合并无关，非本 PR 引入relaykit独立模块：GOWORK=off go build ./...✅、GOWORK=off go test ./...✅ 全部通过（满足 relaykit 模块独立可构建要求）前端（web/，Bun）
bun install（同步 node-forge 依赖）后bun run typecheck（tsgo）✅ 通过bun run i18n:sync✅ 执行完成，_sync-report.json：7 语言 missing/extras 均为 0（ja/ru 报告的 1 条 untranslated 为上游既有短词Serving，上游 en/zh 同样保留英文）冲突文件最终状态
git diff --check无冲突标记；8 个冲突文件全部解决并并入 merge commit5170564ac✅ 提交前检查项 / Checklist