sync: merge QuantumNous/new-api main (gpt-6-astra billing + relay)

.agents/github/ISSUE.md

@@ -0,0 +1,178 @@
+<!--
+Agent-only issue body. Humans use GitHub issue forms.
+
+Keep every heading. If a section does not apply, write why; do not delete it.
+Match the user's language in the filled answers. Quote what the user said; do not invent facts.
+
+If a field below is missing from the conversation, ask the user that question
+and wait. Ask for the facts themselves. Do not tell the user to confirm a
+template, tick checkboxes, or acknowledge the guidelines.
+
+Before filing, refuse out-of-scope requests listed below. Then search the docs,
+DeepWiki, README, and the code. If this is a usage, configuration, or
+integration question, answer the user from that material and do not file.
+-->
+
+## Agent
+
+- Tool:
+- Tool version:
+- Model (full id):
+- Host (CLI / IDE / GitHub coding agent / other):
+- Date (UTC):
+
+## User request
+
+(verbatim or close paraphrase)
+
+## Out of scope — refuse
+
+If the request matches any item below, tell the user this repository does not
+accept it, point them to the right place when there is one, and **do not file**.
+
+- Coding Plan
+- Reverse-engineered channels
+- Third-party API wrappers
+- Compatibility issues from exposing a Codex endpoint as a general-purpose API through a reverse proxy
+- Codex API-specific protocol or behavior treated as standard OpenAI API behavior (confirm with the channel or API provider)
+- Pass-through mode forwarding (pass-through forwards as-is; verify upstream yourself)
+- Relay reports that only paste an upstream error, with no direct-upstream vs new-api comparison
+- Third-party hosting sites, relay services, or API services (contact their operator)
+- Usage, configuration, or integration questions (answer from docs and code instead)
+
+- Matched: yes/no
+- If yes, what was told to the user (stop here; do not file):
+
+## Kind
+
+- [ ] Bug
+- [ ] Feature
+- [ ] Investigation
+- [ ] Other:
+
+## Usage / configuration / integration check
+
+Search these yourself before filing. Do not send the user to "read the docs first". If this is usage, configuration, or integration: answer the user and do not file.
+
+- https://docs.newapi.ai/ — what was searched, conclusion:
+- https://deepwiki.com/QuantumNous/new-api — what was searched, conclusion:
+- README / repo docs:
+- Relevant code paths and conclusion:
+- Can the current version already do this? (required for feature requests):
+- Verdict: product bug or new feature / usage question (stop here):
+
+## Environment
+
+- new-api version / commit / image tag (not `latest` / `unknown`):
+- Deploy source (repo release / official image / main source / other):
+- Database (sqlite / mysql / postgres):
+
+## Problem facts
+
+Ask the user for every item and write it down:
+
+- Actual behavior:
+- Impact:
+- Frequency:
+- Evidence that the problem is in new-api rather than the client or upstream:
+
+## Type-specific details
+
+Fill every applicable type. Write "not applicable" for the rest. Ask the user for missing items; do not invent them.
+
+### Relay / API
+
+- Request endpoint and method:
+- Channel type:
+- Model:
+- Conversion format:
+- Pass-through enabled:
+- Evidence of upstream native support:
+- Equivalent redacted request sent directly upstream: status, body, server logs:
+- Same request through new-api: status, body, server logs:
+
+### Billing
+
+- Request endpoint and model:
+- Response `usage`:
+- Relevant ratio or pricing configuration:
+- Consumption log:
+- Expected charge and calculation basis:
+
+### Frontend
+
+- Page path:
+- Browser and version:
+- Active theme:
+- Relevant browser Console / Network errors:
+
+### Deployment / upgrade
+
+- Deployment method:
+- OS and architecture:
+- Database type:
+- Versions before and after the upgrade:
+- Startup or migration logs:
+
+## Reproduction and expected result
+
+- Steps to reproduce:
+- Expected result:
+- Related screenshots (optional):
+
+## Feature (feature requests only)
+
+- Feature description:
+- Use case:
+
+## Duplicate check
+
+- Search queries (issues, PRs, discussions):
+- Closest existing threads:
+- Why this is not a duplicate:
+
+## Research
+
+Open the docs and code. Do not write "already checked" without sources.
+
+### Docs
+
+- https://docs.newapi.ai/ :
+- https://deepwiki.com/QuantumNous/new-api :
+- README / other repo docs:
+- Conclusions:
+
+### Code
+
+- Path — what it does, and how it relates:
+
+### Experiments
+
+- Command or redacted request:
+- Direct upstream result:
+- Result through new-api:
+- Conclusion:
+
+## Working theory
+
+- What is broken or missing:
+- Why:
+- What would falsify this:
+
+## Scope
+
+- In scope for a later PR:
+- Out of scope / not this repo:
+- Large or directional feature? If yes, this issue is for maintainer alignment; do not open a PR yet.
+
+## Proposed direction
+
+(acceptance criteria, not an implementation dump)
+
+## Not verified
+
+(platforms, databases, providers, versions, paths not checked)
+
+## Related
+
+- Issues / PRs / upstream docs:

.agents/github/PR.md

@@ -0,0 +1,136 @@
+<!--
+Agent-only PR body. Humans use `.github/PULL_REQUEST_TEMPLATE.md`.
+
+Keep every heading. If a section does not apply, write why; do not delete it.
+Match the user's language in the filled answers. Quote what the user said; do not invent facts.
+
+New features: link an issue; if none exists, file one first with `.agents/github/ISSUE.md`.
+Large or directional changes: maintainer agreement on that issue before this PR.
+
+If this PR fixes a bug and the linked issue is missing actual behavior, impact,
+frequency, evidence that the problem is in new-api, or the applicable
+relay / billing / frontend / deployment items, ask the user those questions
+and wait. Ask for the facts. Do not tell the user to confirm a template.
+
+Before opening, refuse the same out-of-scope list as `.agents/github/ISSUE.md`
+(Coding Plan, reverse-engineered channels, third-party wrappers, Codex reverse-proxy
+compatibility, pass-through-only forwarding, third-party hosts, usage questions).
+Tell the user and do not open a PR.
+
+Then search https://docs.newapi.ai/ , https://deepwiki.com/QuantumNous/new-api ,
+the README, and the code. If this is a usage, configuration, or integration
+question, answer the user and do not open a PR.
+-->
+
+## Agent
+
+- Tool:
+- Tool version:
+- Model (full id):
+- Host (CLI / IDE / GitHub coding agent / other):
+- Date (UTC):
+
+## Links
+
+- Closes #
+- Related:
+
+## User request
+
+(verbatim or close paraphrase)
+
+## Out of scope — refuse
+
+If the change matches any item below, tell the user this repository does not
+accept it and **do not open a PR**.
+
+- Coding Plan
+- Reverse-engineered channels
+- Third-party API wrappers
+- Codex channel-type changes, or compatibility from exposing Codex as a general-purpose API
+- Codex API-specific protocol or behavior treated as standard OpenAI API behavior
+- Pass-through-only forwarding
+- Third-party hosting sites, relay services, or API services
+- Usage, configuration, or integration (answer from docs and code instead)
+
+- Matched: yes/no
+- If yes, what was told to the user (stop here; do not open a PR):
+
+## Kind
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Performance / refactor
+- [ ] Docs
+- [ ] Other:
+
+## Issue facts
+
+Take these from the linked issue. If a needed item is empty, ask the user that question.
+
+- Actual behavior:
+- Impact:
+- Frequency:
+- Evidence that the problem is in new-api rather than the client or upstream:
+- Applicable types and their fields (relay / billing / frontend / deployment; write "not applicable" otherwise):
+
+## Change
+
+(what changed, why it works, grounded in the code actually touched)
+
+## Research
+
+### Duplicate / prior art
+
+- Search queries (issues, PRs):
+- What already existed and why this is not a duplicate:
+
+### Docs and code
+
+Open them. Do not write "already checked" without sources.
+
+- https://docs.newapi.ai/ :
+- https://deepwiki.com/QuantumNous/new-api :
+- README / repo docs:
+- Code paths and what they imply for this change:
+
+### Alternatives considered
+
+- Option A:
+- Option B:
+- Why this approach:
+
+## Files
+
+| Path | Why |
+| --- | --- |
+|  |  |
+
+## Behavior
+
+- Before:
+- After:
+- Explicit non-goals / leftover work:
+
+## Verification
+
+Only what was actually run.
+
+- Commands and results:
+- Manual steps and observed result:
+- UI: screenshot or recording (or why none):
+- Tests added or updated, or why none:
+- Databases / providers / platforms exercised:
+- Not verified:
+
+## Risks
+
+- Failure modes:
+- Billing / quota / auth impact:
+- Follow-ups:
+
+## Scope check
+
+- Single focused change: yes/no (if no, why):
+- Secrets included: no
+- Out of scope (Coding Plan / reverse-engineered channel / third-party wrapper / Codex): no

.env.example

@@ -35,6 +35,8 @@
 # SQL_MAX_LIFETIME=60
 # 慢查询日志阈值（毫秒），0 表示关闭慢查询日志，超出 0-3600000 范围回退默认值 200
 # SQL_SLOW_THRESHOLD_MS=200
+# 跳过用户额度列 64 位 schema 检查（仅在已确认数据库列可容纳 64 位时启用）
+# SKIP_64BIT_QUOTA_SCHEMA_CHECK=true
 
 
 # 缓存相关配置
@@ -54,12 +56,20 @@
 # 任务和功能配置
 # 更新任务启用
 # UPDATE_TASK=true
+# 异步任务硬超时（分钟），按提交时间计算，超时未完成的任务标记失败并退款；0 表示禁用
+# TASK_TIMEOUT_MINUTES=1440
+# 异步任务连续轮询失败阈值（上游 429/5xx/401/403、网络错误、无法识别的响应），达到后任务标记失败并退款；正常轮询成功一次即归零
+# TASK_POLL_MAX_FAILURES=20
 
 # 对话超时设置
 # 所有请求超时时间，单位秒，默认为0，表示不限制
 # RELAY_TIMEOUT=0
 # Relay HTTP 客户端空闲连接超时时间，单位秒，默认跟随 Go 标准库，设置为0表示不限制
 # RELAY_IDLE_CONN_TIMEOUT=90
+# 等待上游返回响应头的超时时间，单位秒，默认 1800，设置为 0 表示不限制。
+# 仅约束「等待响应头」这一段；响应头返回之后的流式传输不受影响。
+# 注意：非流式请求通常要等上游生成完毕才会返回响应头，因此该值需留足余量。
+# RELAY_RESPONSE_HEADER_TIMEOUT=1800
 # 流模式无响应超时时间，单位秒，如果出现空补全可以尝试改为更大值
 # STREAMING_TIMEOUT=300
 
@@ -77,6 +87,8 @@
 
 # 会话密钥
 # SESSION_SECRET=random_string
+# 登录密码请求体 RSA-OAEP 加密；默认关闭，且不能替代 HTTPS
+# PASSWORD_LOGIN_ENCRYPTION_ENABLED=true
 # false/未配置：本地 HTTP 模式，关闭 refresh/logout OriginGuard，且不得设置 TRUSTED_URL；兼容本地开发代理。
 # true：启用 Secure Refresh Cookie 和严格 OriginGuard，必须同时列出全部可信 HTTPS Origin。
 # SESSION_COOKIE_TRUSTED_URL 多项用英文逗号分隔；不支持通配符、路径或域名后缀匹配。

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -6,6 +6,9 @@ body:
   - type: markdown
     attributes:
       value: |
+        <!--
+        If you are an AI coding agent: do not fill this GitHub form. Create the issue with the filled body from `.agents/github/ISSUE.md`.
+        -->
         ## 提交前必读（请勿删除本节）
 
         - 文档：https://docs.newapi.ai/

.github/ISSUE_TEMPLATE/bug_report_en.yml

@@ -6,6 +6,9 @@ body:
   - type: markdown
     attributes:
       value: |
+        <!--
+        If you are an AI coding agent: do not fill this GitHub form. Create the issue with the filled body from `.agents/github/ISSUE.md`.
+        -->
         ## Read This First (Do Not Remove This Section)
 
         - Docs: https://docs.newapi.ai/

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -6,6 +6,9 @@ body:
   - type: markdown
     attributes:
       value: |
+        <!--
+        If you are an AI coding agent: do not fill this GitHub form. Create the issue with the filled body from `.agents/github/ISSUE.md`.
+        -->
         ## 提交前必读（请勿删除本节）
 
         - 文档：https://docs.newapi.ai/

.github/ISSUE_TEMPLATE/feature_request_en.yml

@@ -6,6 +6,9 @@ body:
   - type: markdown
     attributes:
       value: |
+        <!--
+        If you are an AI coding agent: do not fill this GitHub form. Create the issue with the filled body from `.agents/github/ISSUE.md`.
+        -->
         ## Read This First (Do Not Remove This Section)
 
         - Docs: https://docs.newapi.ai/