feat(aws): Bedrock 智能模型解析与推理模式自适应 - #3183
Closed
keithyt06 wants to merge 5380 commits into
Closed
Conversation
…al file types for LF normalization and binary detection
Mitigate XSS vulnerabilities in the playground where AI-generated content is rendered without sanitization, allowing potential script injection via prompt injection attacks. MarkdownRenderer.jsx: - Replace dangerouslySetInnerHTML with a sandboxed iframe for HTML preview - Use sandbox="allow-same-origin" to block script execution while allowing CSS rendering and iframe height auto-sizing - Add SandboxedHtmlPreview component with automatic height adjustment CodeViewer.jsx: - Add escapeHtml() utility to encode HTML entities before rendering - Rewrite highlightJson() to process tokens iteratively, escaping each token and structural text before wrapping in syntax highlighting spans - Escape non-JSON and very-large content paths that previously bypassed sanitization - Update linkRegex to correctly match URLs containing & entities These changes only affect the playground (AI output rendering). Admin- configured content (home page, about page, footer, notices) remains unaffected as they use separate code paths and are within the trusted admin boundary.
🔒 fix(security): sanitize AI-generated HTML to prevent XSS in playground
feat: add claude-opus-4-6
…idation - Add configurable per-user token creation limit (max_user_tokens) - Sanitize search input patterns to prevent expensive queries - Add per-user search rate limiting (by user ID) - Add pagination to search endpoint with strict page size cap - Skip empty search fields instead of matching nothing - Hide internal errors from API responses - Fix Interface2String float64 formatting causing config parse failures - Add float-string fallback in config system for int/uint fields
fix: harden token search with pagination, rate limiting and input validation
- Change ESCAPE character from '\' to '!' for compatibility with MySQL/PostgreSQL/SQLite - Adjust sanitization logic to escape '!' and '_' correctly, improving input validation for search queries
…d improved rate limiting
fix: /v1/chat/completions -> /v1/responses json_schema
将散落在多个文件中的预扣费/结算/退款逻辑抽象为统一的 BillingSession 生命周期管理： - 新增 BillingSettler 接口 (relay/common/billing.go) 避免循环引用 - 新增 FundingSource 接口 + WalletFunding / SubscriptionFunding 实现 (service/funding_source.go) - 新增 BillingSession 封装预扣/结算/退款原子操作 (service/billing_session.go) - 新增 SettleBilling 统一结算辅助函数，替换各 handler 中的 quotaDelta 模式 - 重写 PreConsumeBilling 为 BillingSession 工厂入口 - controller/relay.go 退款守卫改用 BillingSession.Refund() 修复的 Bug： - 令牌额度泄漏：PreConsumeTokenQuota 成功但 DecreaseUserQuota 失败时未回滚 - 订阅退款遗漏：FinalPreConsumedQuota=0 但 SubscriptionPreConsumed>0 时跳过退款 - 订阅多扣费：subConsume 强制为 1 但 FinalPreConsumedQuota 不同步 - 退款路径不统一：钱包/订阅退款逻辑现统一由 FundingSource.Refund 分派
- Settle 部分失败保护：新增 fundingSettled 标记，资金来源提交后 令牌调整失败不再导致 Refund 误退已结算的资金 - 订阅多扣费修复：trySubscription 传 subConsume 而非 preConsumedQuota 给 preConsume，保证三者（amount/preConsume/FinalPreConsumedQuota）一致 - 令牌回滚错误记录：preConsume 中 funding 失败时令牌回滚错误不再丢弃 - 移除钱包路径死代码：用户额度不足的 strings.Contains 匹配不可能命中 - WalletFunding.Refund 不重试：IncreaseUserQuota 非幂等，重试会多退
…e recharge card tabs - Defaulting to subscriptions when available and avoiding initial flash when no plans exist. - Adjust the wide-screen layout to place wallet and invite sections side by side, simplify the subscription header and controls, and add padding to prevent card borders from clipping. - Update related i18n strings by adding the new tab label and removing the obsolete subscription blurb.
…ide-wildcard-path Feature/param override wildcard path
…7aec3eb60f27ca33dbb4dc9610a fix: fetch model add header passthrough rule key check
feats: repair the thinking of claude to openrouter convert
…d958a777a7e7ac8c1e4b5b3e537 feat: kling cost quota support use FinalUnitDeduction as totalToken
…-top_p fix: If top_p is not provided, Claude's logic will set to 1
…es-body-no-retry fix(relay): skip retries for bad response body errors
…tter clarity and functionality
Keep the model pricing editor wording aligned with the new price-based UI while exposing cache, image, and audio pricing in the marketplace so users can see the full configured pricing model.
Introduce a billing display mode feature allowing users to toggle between price and ratio views. Update relevant components and hooks to support this new functionality, ensuring consistent pricing information is displayed across the application.
Add siteDisplayType prop across various pricing components to conditionally render pricing information based on the selected display type. This update enhances the user experience by ensuring that pricing details are accurately represented according to the chosen display mode, particularly for token-based views.
…amOverrideEditorModal
为渠道参数覆盖可视化规则提供拖拽排序支持
三层智能模型 ID 解析: - Layer 1: 完整 Bedrock ID 检测（区域/Provider 前缀）直接透传 - Layer 2: 精确映射查找（向后兼容现有 awsModelIDMap） - Layer 3: 模式匹配自动构建（claude-* → anthropic., nova-* → amazon.） 模型级推理模式自适应: - Claude 4.5+/Nova 2/DeepSeek R1 等新模型自动使用 global. 推理配置 - Claude 3.x/Nova v1/MiniMax 等旧模型使用 on-demand 直连 - 通过 awsModelsRequireInferenceProfile 映射表精确控制 其他改进: - 支持 global./jp. 等推理配置前缀 - 完整 Provider ID 透传（用户显式控制） - API Key 模式同步支持推理配置解析 经 AWS SDK (Go + boto3) 对 Claude 4.6/4.5、Nova v1/v2、 MiniMax M2/M2.1、DeepSeek R1/V3.2 进行真实 API 验证。
Contributor
WalkthroughThe AWS Bedrock relay channel undergoes a refactor of its model ID resolution logic. It introduces a layered resolution system supporting Bedrock ID passthrough, exact map lookups, and pattern-based auto-prefixing. Inference profile requirements are now evaluated conditionally, and cross-region handling maps are replaced with a unified architecture. Test coverage is added for the new behavior. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs). Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
left a comment
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
relay/channel/aws/adaptor.go (1)
104-104:⚠️ Potential issue | 🔴 CriticalCritical: URL construction has swapped parameters.
The
fmt.Sprintfarguments are in the wrong order. The URL format expects{region}in the hostname and{modelId}in the path, but the code provides them in reverse order:fmt.Sprintf("https://bedrock-runtime.%s.amazonaws.com/model/%s/converse", awsModelId, awsSecret[1])This produces:
https://bedrock-runtime.{modelId}.amazonaws.com/model/{region}/converseBut should be:
https://bedrock-runtime.{region}.amazonaws.com/model/{modelId}/converse🐛 Proposed fix
- return fmt.Sprintf("https://bedrock-runtime.%s.amazonaws.com/model/%s/converse", awsModelId, awsSecret[1]), nil + return fmt.Sprintf("https://bedrock-runtime.%s.amazonaws.com/model/%s/converse", awsSecret[1], awsModelId), nil🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@relay/channel/aws/adaptor.go` at line 104, The URL construction in adaptor.go uses fmt.Sprintf with its arguments swapped; update the fmt.Sprintf call that builds the Bedrock runtime URL so the first %s is awsSecret[1] (region) and the second %s is awsModelId (modelId) — i.e., swap the two arguments passed to fmt.Sprintf in the function that returns the Bedrock runtime URL so the hostname contains the region and the path contains the model ID.relay/channel/aws/relay-aws.go (1)
5-5:⚠️ Potential issue | 🟡 MinorDirect
encoding/jsonimport violates coding guidelines.The file imports
encoding/jsondirectly and uses it at line 325 (json.Unmarshal). As per coding guidelines, all JSON marshal/unmarshal operations must use wrapper functions fromcommon/json.go.🛠️ Proposed fix
Remove the direct import:
import ( "context" - "encoding/json" "fmt"And update the usage at line 325:
- if err := json.Unmarshal(awsResp.Body, &novaResp); err != nil { + if err := common.Unmarshal(awsResp.Body, &novaResp); err != nil {As per coding guidelines: "All JSON marshal/unmarshal operations MUST use wrapper functions in common/json.go (
common.Marshal,common.Unmarshal, etc.). Do NOT directly import or callencoding/jsonin business code."🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@relay/channel/aws/relay-aws.go` at line 5, Remove the direct "encoding/json" import and replace direct calls to json.Unmarshal with the project wrapper common.Unmarshal (and json.Marshal with common.Marshal if present); update the import block to remove "encoding/json" and add the common package import, and change the call at the location using json.Unmarshal to call common.Unmarshal with the same arguments so the file relies on the common/json.go wrappers instead of the encoding/json package.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@relay/channel/aws/constants.go`:
- Around line 68-69: awsModelIDMap is missing a short-name entry and
modelProviderPatterns lacks a DeepSeek pattern, causing getAwsModelID to treat
"deepseek.r1-v1:0" as a provider-prefixed ID (skipInferenceResolve=true) and
bypass awsModelsRequireInferenceProfile logic; add a short-name mapping for the
DeepSeek model in awsModelIDMap (so callers can use the short name) and add the
DeepSeek regex to modelProviderPatterns so Layer 1 detection recognizes the
provider correctly, which will allow getAwsModelID to resolve inference profile
requirements and make the model appear in GetModelList (see awsModelIDMap,
modelProviderPatterns, getAwsModelID, awsModelsRequireInferenceProfile,
GetModelList/adaptor.go).
---
Outside diff comments:
In `@relay/channel/aws/adaptor.go`:
- Line 104: The URL construction in adaptor.go uses fmt.Sprintf with its
arguments swapped; update the fmt.Sprintf call that builds the Bedrock runtime
URL so the first %s is awsSecret[1] (region) and the second %s is awsModelId
(modelId) — i.e., swap the two arguments passed to fmt.Sprintf in the function
that returns the Bedrock runtime URL so the hostname contains the region and the
path contains the model ID.
In `@relay/channel/aws/relay-aws.go`:
- Line 5: Remove the direct "encoding/json" import and replace direct calls to
json.Unmarshal with the project wrapper common.Unmarshal (and json.Marshal with
common.Marshal if present); update the import block to remove "encoding/json"
and add the common package import, and change the call at the location using
json.Unmarshal to call common.Unmarshal with the same arguments so the file
relies on the common/json.go wrappers instead of the encoding/json package.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 64d2fda4-0bf4-4f69-b307-11e1c9a08d44
📒 Files selected for processing (4)
relay/channel/aws/adaptor.gorelay/channel/aws/constants.gorelay/channel/aws/relay-aws.gorelay/channel/aws/relay_aws_test.go
Comment on lines
+68
to
+69
| // DeepSeek | ||
| "deepseek.r1-v1:0": true, |
Contributor
There was a problem hiding this comment.
Missing awsModelIDMap entry for deepseek.r1-v1:0 causes incorrect invocation.
The model deepseek.r1-v1:0 is listed in awsModelsRequireInferenceProfile, indicating it requires the global. prefix for inference profile invocation. However:
- There is no short-name entry in
awsModelIDMapfor this model, so users must pass the full provider IDdeepseek.r1-v1:0. - When passed as
deepseek.r1-v1:0, Layer 1 ingetAwsModelID()detects thedeepseek.provider prefix and returnsskipInferenceResolve=true, bypassing the inference profile check entirely. - The model will be invoked without the
global.prefix, potentially causing an API error since it requires an inference profile.
Additionally, this model won't appear in GetModelList() (see adaptor.go:179-185).
🐛 Proposed fix: Add short-name mapping and pattern for DeepSeek
Add the mapping in awsModelIDMap:
"nova-sonic-v1:0": "amazon.nova-sonic-v1:0",
+ // DeepSeek models
+ "deepseek-r1": "deepseek.r1-v1:0",
}And add the pattern in modelProviderPatterns:
var modelProviderPatterns = map[string]string{
"claude-": "anthropic.",
"nova-": "amazon.",
+ "deepseek-": "deepseek.",
}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@relay/channel/aws/constants.go` around lines 68 - 69, awsModelIDMap is
missing a short-name entry and modelProviderPatterns lacks a DeepSeek pattern,
causing getAwsModelID to treat "deepseek.r1-v1:0" as a provider-prefixed ID
(skipInferenceResolve=true) and bypass awsModelsRequireInferenceProfile logic;
add a short-name mapping for the DeepSeek model in awsModelIDMap (so callers can
use the short name) and add the DeepSeek regex to modelProviderPatterns so Layer
1 detection recognizes the provider correctly, which will allow getAwsModelID to
resolve inference profile requirements and make the model appear in GetModelList
(see awsModelIDMap, modelProviderPatterns, getAwsModelID,
awsModelsRequireInferenceProfile, GetModelList/adaptor.go).
commented
Mar 11, 2026
Collaborator
|
会破坏现有的默认行为吗？把模型名和地区组装 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
19 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概述
当前 new-api 的 AWS Bedrock 渠道存在以下限制：
global.（全局推理）和jp.（东京区域）等推理配置前缀global.anthropic.claude-opus-4-6-v1）可能被错误处理ap-northeast-1的前缀提取不正确本 PR 通过三层智能解析 + 模型级推理模式自适应，一次性解决以上所有问题。
变更内容
1. 三层智能模型 ID 解析
重写
getAwsModelID()，实现分层解析：2. 模型级推理模式自适应
通过实际 API 测试验证，不同模型的调用模式完全不同：
新增
awsModelsRequireInferenceProfile映射表，短名称解析后自动选择正确的调用模式：global.前缀3. 用户体验
修改后，用户可以灵活使用以下任何方式调用模型：
claude-opus-4-6anthropic.claude-opus-4-6-v1us.anthropic.claude-opus-4-6-v1global.anthropic.claude-opus-4-6-v1claude-future-model-2026anthropic.前缀变更文件
relay/channel/aws/constants.gorelay/channel/aws/relay-aws.gogetAwsModelID()（三层解析）；更新doAwsClientRequest()推理模式逻辑relay/channel/aws/adaptor.gorelay/channel/aws/relay_aws_test.go向后兼容性
claude-opus-4-6global.anthropic.claude-opus-4-6-v1（正确）nova-micro-v1:0amazon.nova-micro-v1:0anthropic.claude-opus-4-6-v1global.anthropic.claude-opus-4-6-v1测试
单元测试
集成测试（真实 Bedrock API 验证）
使用 AWS SDK (Go + boto3) 验证：Claude 4.6 Opus/Sonnet、Claude 4.5 Haiku、Claude 3 Haiku、Nova Micro/Lite/Pro、Nova 2 Lite、MiniMax M2/M2.1、DeepSeek R1/V3.2 — 12/12 全部通过
新增模型流程
awsModelsRequireInferenceProfile加一行awsModelIDMap加一行（可选）不包含的改动
Summary by CodeRabbit
Improvements
Tests