v0.5.7 - Monitor Center API, Credential Imports, and Faster Recovery From Dead Connections

v0.5.7 - Monitor Center API, Credential Imports, and Faster Recovery From Dead Connections

Pair this release with codeProxy v0.6.0. The redesigned panel's monitor center, guided "Add AI account" dialog and credential imports use the endpoints added here. Upgrade the backend first; see Upgrade Notes.

Highlights

1. Monitor center endpoints

• What was missing: the monitor page could only read /usage/chart-data: request counts, a success rate and token totals. There were no latency percentiles, first-token times, failure sources, rankings or live traffic.
• Overview: GET /v0/management/usage/monitor/overview.
  • Ranges 1h, 6h, 24h, today, 7d, 14d and 30d, filterable by portal user or API key, model and channel.
  • Totals compared with the previous period of equal length, and continuous zero-filled series.
  • Latency and first-token P50 / P90 / P95 / P99 / max / avg with a histogram.
  • Model, channel and portal-user rankings with sparklines, a weekday × hour heatmap, the consumer → model → channel flow, and recent failures.
• Realtime: GET /v0/management/usage/monitor/realtime covers the last hour per minute, current and peak RPM / TPM, and a five-minute window. It is cheap enough to poll every 15 seconds.
• Built to stay cheap:
  • Totals, series, rankings, heatmap and flows read the rollup buckets, so they cover the whole history.
  • Percentiles read request details only inside their retention window, and the response says where coverage starts.
  • A section that fails is logged and returned empty instead of failing the page.
  • Both endpoints are tenant-scoped and need monitor.read.
• Timezone label: services started without TZ reported their zone as Local. The label is now the IANA name, or the UTC offset (UTC+08:00) when the zone has no name. Bucket edges are unchanged.

2. Add AI accounts from credentials you already hold

• What's new: besides the browser and device sign-ins, an account can now be added from a credential you hold. CliRelay exchanges it for the same tokens a browser login would mint and saves the account under the caller's tenant. Four imports are supported:
  • a claude.ai session cookie;
  • an OpenAI / Codex CLI refresh token;
  • a Google / Antigravity refresh token;
  • a Grok web SSO cookie.
• Errors that say what went wrong:
  • A bad credential returns 422. It is never 401, which the panel would read as its own session expiring.
  • A Cloudflare challenge returns 502 and is reported as an egress problem rather than a bad credential. A timeout returns 504.
  • Secrets an upstream echoes back are masked in the message.
• The permission is auth_files.oauth, the same as for OAuth sign-in.

3. OAuth sign-ins report how they finish

• What was wrong: the panel only received a URL and a state, so it showed one generic "paste the callback URL" box for every provider, including device-code providers where there is nothing to paste. A login that had expired, or that had been replaced by a newer one, also read as {"status":"ok"}, which the panel showed as success.
• The fix:
  • The *-auth-url endpoints now return flow (redirect, code or device), expires_at, and for device logins user_code, verification_uri and expires_in.
  • Claude accepts ?callback_mode=code. Anthropic's own code page is then used, so a remote panel never sends the browser to a localhost forwarder.
  • Expired and superseded logins are reported as such. Late callbacks get 409 with oauth_login_expired or oauth_login_superseded, on a single node and in cluster mode.

4. Dead HTTP/2 connections are detected in about 45 seconds instead of about 15 minutes

• What was wrong: the fingerprinted transports, for Anthropic and the TLS-fingerprinted providers, reuse one HTTP/2 connection per host. A connection that had silently died still looked usable. A request written onto it was retransmitted until the kernel gave up, roughly 15 minutes on Linux, while the client waited. This was observed in production against Anthropic.
• The fix: both transports now ping a connection that has been idle for 30 seconds. If no reply arrives within 15 seconds, the connection is closed and the next request redials.
• Thanks to @RUIIIOVO for the diagnosis and the fix (#1085).

5. Images returned by tools stay images

• What was wrong: when a tool returned an image, such as a screenshot or a rendered chart, every request translator turned it into text. A single 1.9 MB screenshot became about 2.47 million text tokens and failed with prompt is too long or an upstream 400.
• The fix: a shared tool-result parser keeps images as image parts across the OpenAI Chat, Responses, Claude and Gemini translators, including mixed text-and-image results. A guard logs a warning if a large data:image/ payload ever leaks into text again.
• Thanks to @RUIIIOVO (#1086).

6. Claude keeps its reasoning through /v1/responses

• What was wrong: with a Claude model behind /v1/responses, follow-up turns lost the chain of thought. Thinking signatures were dropped on the way out, and replayed reasoning items were dropped on the way in.
• The fix: signatures are captured and emitted, replayed reasoning is accepted, and the order of reasoning, tool and function output is preserved in streamed and non-streamed responses.
• Thanks to @RUIIIOVO (#1104).

7. Claude Sonnet 5.5

• claude-sonnet-5-5 is in the model registry, with a 1M context window and 128k output.
• It is also in the Command Code fallback list and has Bedrock mappings.
• The default Claude Code fingerprint version is now 2.1.284, the first version that offers the model.
• Thanks to @RUIIIOVO (#1108).

8. Startup no longer waits for upstream model lists

• What was wrong: on 2026-09-25 a node that had lost its route to the residential proxies needed more than 200 seconds before its HTTP listener came up. Startup fetched each credential's model list one after another.
• The fix: credentials register immediately from their saved model lists, and live lists refresh in the background. Model removals are persisted, and concurrent registrations can no longer overwrite each other.

9. Grok CLI 1.0.46

• cli-chat-proxy.grok.com rejects client versions below 1.0.13. The default xAI fingerprint and the account-status probes now advertise 1.0.46, from one shared constant.
• Thanks to @lovinrain (#1124).

---

Detailed Changes

Backend CliRelay

• feat(usage): monitor center overview and realtime endpoints (#1129).
• fix(usage): label the monitor timezone by its UTC offset when Go only calls it "Local" (#1130).
• feat(oauth): add accounts from held credentials, not just by signing in (#1128).
• feat(oauth): tell the panel how each login finishes (#1127).
• fix(http2): detect dead pooled connections instead of waiting on the kernel (#1085, landed through #1125).
• fix(translator): preserve tool-result images across translators (#1120, from #1086 and #1116).
• fix(translator): preserve Claude Responses reasoning and output ordering (#1121, from #1104 and #1117).
• feat(registry): Claude Sonnet 5.5, Claude Code fingerprint 2.1.284, Bedrock mappings (#1112, from #1108).
• fix(startup): register credentials without waiting on upstream model listings; persist removals and guard registration races (#1118, from #1101 and #1115).
• fix(xai): advertise Grok CLI 1.0.46 to cli-chat-proxy and on billing probes (#1124, #1126).
• docs(readme): rewrite README and README_CN around the redesigned panel, with new screenshots (#1131).

Upgrade Notes

• Upgrade the backend before the panel. CliRelay pulls the latest codeProxy release on its own, roughly every three hours.
  • Backends older than v0.5.7 still work with panel v0.6.0, in a compatibility mode: the monitor center shows the daily view, and credential imports ask you to update the backend.
• Claude Code version: client User-Agents older than Claude Code 2.1.284 are replaced with the canonical one, as introduced in #1050. Update local Claude Code installs if you rely on the client's own User-Agent.
• No changes required: there are no configuration or database changes.

中文说明（点击展开）

v0.5.7 - 监控中心接口、凭据导入，以及更快识别失效连接

本版需与 codeProxy v0.6.0 搭配。新版面板的监控中心、引导式「添加 AI 账号」和凭据导入都依赖这里新增的接口。请先升级后端，详见下方升级提示。

核心更新

1. 监控中心接口

• 原来缺什么：监控页只能读 /usage/chart-data，只有请求数、成功率和 token 总量。看不到延迟分位、首 token 时间、失败来源和排行，也没有实时流量。
• 概览接口 GET /v0/management/usage/monitor/overview：
  • 时间范围 1h、6h、24h、today、7d、14d、30d，可按门户用户或 API Key、模型、渠道过滤。
  • 汇总值与上一个等长周期对比，时间序列连续补零。
  • 延迟和首 token 的 P50 / P90 / P95 / P99 / 最大 / 平均，附直方图。
  • 模型、渠道、门户用户排行（带迷你趋势），星期 × 小时热力图，用户 → 模型 → 渠道流向，以及最近失败。
• 实时接口 GET /v0/management/usage/monitor/realtime：最近一小时逐分钟数据，当前与峰值 RPM / TPM，以及五分钟窗口，开销小到可以 15 秒轮询一次。
• 控制开销：
  • 汇总、序列、排行、热力图和流向读预聚合桶，覆盖全部历史。
  • 分位数只读保留期内的请求详情，并返回覆盖起点。
  • 某一部分出错只记日志、返回空，不会拖垮整页。
  • 两个接口都按租户隔离，需要 monitor.read 权限。
• 时区标签：没有设置 TZ 的服务原来把时区显示为 Local，现在显示 IANA 名称，没有名称时显示 UTC 偏移（如 UTC+08:00）。分桶边界不变。

2. 用已有凭据添加 AI 账号

• 新增：除了浏览器登录和设备码登录，现在也可以直接用手上已有的凭据添加账号。CliRelay 会把它换成与浏览器登录相同的令牌，保存在调用者的租户下。支持四种：
  • claude.ai 会话 Cookie；
  • OpenAI / Codex CLI 的 refresh token；
  • Google / Antigravity 的 refresh token；
  • Grok 网页 SSO Cookie。
• 错误说得清楚：
  • 凭据无效返回 422，不会是 401，否则面板会误以为自己的登录过期了。
  • 遇到 Cloudflare 挑战返回 502，按出口问题报告，不算凭据错误；超时返回 504。
  • 上游回显的密钥在错误信息里会被打码。
• 权限沿用 OAuth 登录的 auth_files.oauth。

3. OAuth 登录会说明怎么完成

• 原来的问题：面板只拿到 URL 和 state，所以所有提供商都显示同一个「粘贴回调地址」输入框，连设备码登录这种根本没东西可贴的也一样。已过期或已被新登录取代的会话会返回 {"status":"ok"}，面板就当成登录成功。
• 修复：
  • *-auth-url 接口现在返回 flow（redirect、code 或 device）和 expires_at；设备码登录另外返回 user_code、verification_uri 和 expires_in。
  • Claude 支持 ?callback_mode=code，改用 Anthropic 官方的授权码页面，远程面板不会再把浏览器带到打不开的 localhost 转发页。
  • 过期和被取代的登录会如实报告。迟到的回调返回 409，附 oauth_login_expired 或 oauth_login_superseded，单节点和集群模式一致。

4. 失效的 HTTP/2 连接约 45 秒就能识别，不再挂约 15 分钟

• 原来的问题：带指纹的传输层（Anthropic 及使用 TLS 指纹的提供商）对每个主机复用一条 HTTP/2 连接。连接悄悄断开后仍然显示可用，请求写进去会一直重传，直到内核放弃（Linux 上约 15 分钟），期间客户端一直在等。生产环境里对 Anthropic 遇到过。
• 修复：两种传输层都会对空闲 30 秒的连接发 PING，15 秒内没有回应就关闭连接，下一个请求重新建连。
• 感谢 @RUIIIOVO 的定位和修复（#1085）。

5. 工具返回的图片保持为图片

• 原来的问题：工具返回图片（截图、渲染出的图表）时，各请求转换器都把它转成了文本。一张 1.9 MB 的截图会变成约 247 万个文本 token，直接报 prompt is too long 或上游 400。
• 修复：统一的工具结果解析器让图片在 OpenAI Chat、Responses、Claude、Gemini 各转换器之间都保持为图片，图文混合的结果也一样。如果以后再有大块 data:image/ 混进文本，会在日志里告警。
• 感谢 @RUIIIOVO（#1086）。

6. Claude 经 /v1/responses 时保留推理过程

• 原来的问题：通过 /v1/responses 使用 Claude 模型时，后续轮次会丢掉思考链：出站时丢了 thinking 签名，入站时丢了客户端回放的 reasoning。
• 修复：签名会被记录并输出，回放的 reasoning 会被接收，流式和非流式响应中 reasoning、工具和函数输出的顺序都得以保留。
• 感谢 @RUIIIOVO（#1104）。

7. Claude Sonnet 5.5

• 模型注册表加入 claude-sonnet-5-5，上下文 1M、输出上限 128k。
• Command Code 兜底列表也已加入，并补上 Bedrock 映射。
• 默认 Claude Code 指纹版本升到 2.1.284，这是第一个提供该模型的版本。
• 感谢 @RUIIIOVO（#1108）。

8. 启动不再等待上游模型列表

• 原来的问题：2026-09-25，一个节点连不上住宅代理后，HTTP 监听超过 200 秒才起来，因为启动时要逐个凭据去拉模型列表。
• 修复：凭据先用已保存的模型列表立即注册，实时列表在后台刷新。模型移除会持久化，并发注册也不会再互相覆盖。

9. Grok CLI 1.0.46

• cli-chat-proxy.grok.com 会拒绝低于 1.0.13 的客户端版本。默认 xAI 指纹和账号状态探测现在都声明 1.0.46，两处共用同一个常量。
• 感谢 @lovinrain（#1124）。

详细改动

• feat(usage)：监控中心概览与实时接口（#1129）。
• fix(usage)：Go 只给出 "Local" 时，用 UTC 偏移标注时区（#1130）。
• feat(oauth)：支持用已有凭据添加账号（#1128）。
• feat(oauth)：告诉面板每种登录如何完成（#1127）。
• fix(http2)：主动识别失效的复用连接（#1085，经 #1125 合入）。
• fix(translator)：工具结果中的图片在各转换器间保持为图片（#1120，源自 #1086、#1116）。
• fix(translator)：保留 Claude Responses 的推理内容与输出顺序（#1121，源自 #1104、#1117）。
• feat(registry)：Claude Sonnet 5.5、Claude Code 指纹 2.1.284、Bedrock 映射（#1112，源自 #1108）。
• fix(startup)：注册凭据不再等待上游模型列表，并持久化移除、防止注册竞争（#1118，源自 #1101、#1115）。
• fix(xai)：向 cli-chat-proxy 和计费探测声明 Grok CLI 1.0.46（#1124、#1126）。
• docs(readme)：围绕新版面板重写 README 与 README_CN，并更新截图（#1131）。

升级提示

• 先升级后端，再更新面板。CliRelay 大约每三小时会自动拉取最新的 codeProxy release。
  • 低于 v0.5.7 的后端仍可使用 v0.6.0 面板，但处于兼容模式：监控中心只显示按天视图，凭据导入会提示先更新后端。
• Claude Code 版本：低于 Claude Code 2.1.284 的客户端 User-Agent 会被替换为标准值（#1050 引入的行为）。如果依赖客户端自己的 User-Agent，请升级本地 Claude Code。
• 无需改动：配置和数据库都不需要变更。

Multi-arch binaries and the Docker image are published to GitHub Releases and GHCR. Released together with codeProxy v0.6.0.