v0.4.21 - Session resilience, lifetime quota regrant, model-library routing

English

Overview

This release promotes the verified dev branch to main through release PR #859. It hardens admin and portal sessions against lockouts and silent sign-outs, lets operators re-grant lifetime spending allowances, makes newly added model-library IDs routable immediately, and includes the previously untagged main work from the v0.4.20 merge (CORS auth headers + README refresh).

Key fixes and improvements

• Session resilience (#858): login throttling and token rotation no longer lock accounts or silently sign users out; sessions stay usable across refresh failures and concurrent rotation races.
• Lifetime spending re-grant (#856): operators can re-issue a lifetime spending allowance for an account through the management API.
• Model-library IDs routable immediately (#855): a model ID added to the library can route to the owning account without waiting for a separate refresh cycle.
• Channel-group editor model scope (#854): models that exist only in the model library are selectable in the channel-group editor.
• Proxy pool IDs and runtime rebind (#857): duplicate proxy IDs are rejected; tenant executors rebind when the proxy pool changes.
• CORS auth headers (#849, previously on main as untagged v0.4.20): Access-Control-Allow-Headers now declares every header provider.Authenticate actually accepts (Authorization / X-Api-Key / X-Goog-Api-Key, plus anthropic-version / anthropic-beta / x-stainless-*), so browser clients are not blocked at preflight.
• README refresh (#851, previously on main as untagged v0.4.20): screenshots and copy rewritten for the current 5-group / 22-page multi-tenant panel.

Compatibility and upgrade notes

• Pairs with codeProxy v0.4.23 for the lifetime-quota re-grant UI, session refresh resilience, and related panel surfaces.
• Auth-session / lockout storage migrations run automatically on start.
• No manual configuration change is required for CORS; the allowlist still controls which origins are admitted.

Verification

• Release PR #859 checks (build / vulncheck / ensure-no-translator-changes) passed and merged.
• Release branch was re-verified locally: gofmt -l (clean), go vet ./..., python3 scripts/check-backend-structure.py, go build ./..., go test ./....
• Tag v0.4.21 was created from the released main tip; goreleaser and Build & Push Docker Image (GHCR) both succeeded.

中文

概览

本版本通过发布 PR #859 将已验证的 dev 分支提升合并到 main。重点是会话韧性（避免误锁号与静默踢下线）、累计消费额度可重新发放、模型库新增 id 立即可路由，并一并纳入此前已合入 main 但未打 tag 的 v0.4.20 内容（CORS 认证头与 README 重写）。

主要修复与改进

• 会话韧性（#858）：登录限流与 token 轮转不再误锁号、不再静默踢下线；刷新失败与并发轮转下会话保持可用。
• 累计额度可重新发放（#856）：管理接口支持对账号累计消费额度重新发放。
• 模型库 id 立即可路由（#855）：模型库新增的 model id 立刻可路由到对应账号，无需等额外刷新。
• 渠道分组编辑器模型库范围（#854）：仅存在于模型库的模型也可在渠道分组编辑器中选中。
• 代理池 id 与运行时刷新（#857）：拒绝重复 proxy id；代理变更后租户 executor 正确 rebind。
• CORS 认证头（#849，此前作为未打 tag 的 v0.4.20 已在 main）：Access-Control-Allow-Headers 与 provider.Authenticate 真正接受的头对齐（Authorization / X-Api-Key / X-Goog-Api-Key，以及 anthropic-version / anthropic-beta / x-stainless-*），浏览器预检不再被挡。
• README 重写（#851，同上）：按当前 5 分组 22 页面的多租户面板重写截图与文案。

兼容性与升级说明

• 与 codeProxy v0.4.23 配套，面板侧消费累计额度重新发放、会话刷新韧性等相关界面。
• 鉴权会话 / 锁号相关迁移在启动时自动执行。
• CORS 无需手工改配置；仍由既有来源白名单决定放行范围。

验证

• 发布 PR #859 的 checks（build / vulncheck / ensure-no-translator-changes）已通过并合并。
• release 分支本地复验：gofmt -l（无输出）、go vet ./...、python3 scripts/check-backend-structure.py、go build ./...、go test ./...。
• Tag v0.4.21 基于已发布的 main tip 创建；goreleaser 与 Build & Push Docker Image（GHCR）均成功。

Changed PRs

• fix(cors): 放行服务端真正接受的认证头 by @kittors in #849
• docs(readme): 按当前面板重写介绍与截图 by @kittors in #851
• fix(models): 渠道分组编辑器可选中仅存在于模型库的模型 by @kittors in #854
• feat(models): 模型库新增的 model id 立即可路由到对应账号 by @kittors in #855
• feat(quota): 累计消费额度可重新发放 by @kittors in #856
• fix(proxy-pool): rebind tenant executors and reject duplicate proxy ids by @kittors in #857
• fix(auth): stop lockouts and silent sign-outs from throttling and rotation by @kittors in #858

Full Changelog: v0.4.19...v0.4.21