v1.2.8 - Persistent Sessions and Account State

Persistent sessions, cooldowns and usage snapshots

Changes

• Preserve unexpired management sessions across restarts. Logout and API-key changes revoke persisted sessions; failed revocations are reported, and startup refuses to activate a new key when an obsolete snapshot cannot be removed (#34).
• Persist account authentication circuits and per-model cooldowns across restarts, without carrying stale blocks into refreshed or replaced credentials. Add a per-account Clear cooldown action in the WebUI and the local-only POST /admin/credentials/{id}/reset-cooldown endpoint (#35).
• Restore cached account usage before the first dashboard request, retain stale/partial indicators, and synchronize usage publication with credential removal and replacement (#35).
• Reorganize the English and Chinese onboarding and user guides, and add the Advanced CodeQL workflow.

Thanks to @moshouhot for #34 and #35.

Upgrade

• Back up and preserve your existing .env and entire writable data directory, including credentials, SQLite databases and reward ledgers. New state files are admin-sessions.json, credential-cooldowns.json and usage-snapshots.json; keep them private, especially the live management sessions.
• The first upgrade from an in-memory-session version still requires signing in once. Subsequent restarts preserve unexpired sessions under the same API key. Fix storage permissions if startup reports that an old session snapshot cannot be revoked; do not bypass the check.
• Restarting no longer clears persisted cooldowns. Use Clear cooldown after verifying the account has recovered; it does not refresh tokens, contact upstream or change account enablement. Cached usage remains historical data, not proof that an account is currently available.
• Native precedence remains CLI > environment > saved WebUI settings > defaults. Existing /v1/* and /admin/* addresses remain unchanged.
• Compose keeps container binding at 0.0.0.0:8787; update the image in your existing .env to ghcr.io/maiphucgiang/codebuddy2api:1.2.8, then run docker compose pull && docker compose up -d --no-build.

Distribution and validation

codebuddy2api-1.2.8.tar.gz includes source and prebuilt WebUI assets; SHA256SUMS verifies the download. It excludes credentials, databases, .env and dependency directories. Native use requires Python 3.12+ and the locked Python dependencies, but no frontend build.

All 57 backend test scripts and 133 frontend tests pass; frontend formatting, lint, type checking and production build also pass. The extracted distribution passed isolated startup, version, health, asset, environment and authentication checks. The tmux deployment passed real minimal requests through all three protocols and OpenAI SSE, retained its 8 accounts and automation preferences, and preserved its management session and CSRF token across restart.

Release-commit CI passed for 8ba7588c8c7dc1090b88befb4bcd567ec6de6c7f. Advanced CodeQL stored all three language analyses against that exact main commit; the independent query confirmed 0 open alerts.

Tag CI passed and automatically published linux/amd64 and linux/arm64 images. Both report version 1.2.8 and revision 8ba7588c8c7dc1090b88befb4bcd567ec6de6c7f; latest matches the versioned manifest.

Full changelog: v1.2.7...v1.2.8

v1.2.7 - Model Capability Guard and Trusted Management Origins

Model capability guard, shared catalogs and trusted management origins

Changes

• Publish safe upstream catalog metadata on /v1/models and /admin/models: capability states, token limits and per-profile declarations with catalog_source provenance; account identities, credentials and internal configuration are never exposed. The WebUI model page shows full details and shared-catalog sources (#32).
• Add model_capability_guard, default on and configurable via CLI, CODEBUDDY2API_MODEL_CAPABILITY_GUARD and a WebUI hot switch. Declared-unsupported images, tools or reasoning, out-of-range effort and over-cap output return 400 without an upstream call (#32).
• Deduplicate international CLI/WorkBuddy catalogs into a shared view with source tracking, and merge lossless consecutive image-bearing user messages for international profiles only; domestic backends keep native behavior (#25, #32).
• Fix management login behind HTTPS reverse proxies (#31, #33): trust exact browser origins via admin_allowed_origins (WebUI system settings, hot), CODEBUDDY2API_ADMIN_ORIGINS or --admin-allowed-origins. Bare domains mean HTTPS; strict same-origin matching, the Referer fallback and CSRF token requirements are unchanged.

Upgrade

• Back up and preserve your existing .env and entire writable data directory, including control.sqlite3, logs.sqlite3, credentials and reward ledgers.
• Native precedence is CLI > environment > saved WebUI settings > defaults. model_capability_guard and admin_allowed_origins are hot WebUI settings unless locked by an explicit CLI or environment value.
• Compose keeps container binding at 0.0.0.0:8787; update the image in your existing .env to ghcr.io/maiphucgiang/codebuddy2api:1.2.7, then run docker compose pull && docker compose up -d --no-build.
• If HTTPS domain login through a reverse proxy fails Origin checks, add the public address to admin_allowed_origins instead of disabling CSRF protection.
• Existing /v1/* and /admin/* addresses remain unchanged.

Distribution and validation

codebuddy2api-1.2.7.tar.gz includes source and prebuilt WebUI assets; SHA256SUMS verifies the download. It excludes credentials, databases, .env and dependency directories. Native use requires Python 3.12+ and the locked Python dependencies, but no frontend build.

All 55 backend test scripts pass, including new international-catalog, capability, message-normalization and origin-allowlist suites. The extracted distribution passed isolated startup, version, health, asset, environment and authentication checks. Reviewed changes: #32, #33.

Tag CI passed and published linux/amd64 and linux/arm64 images. Both report version 1.2.7 and revision 5d86db585190a8c1676c9fdb8759e5127befb7bf; latest matches the versioned manifest.

Full changelog: v1.2.6...v1.2.7

v1.2.6 - Reliable Buddy Travel and Configuration

Reliable Buddy travel and configuration

Changes

• Align domestic Buddy travel with the official protocol: accept empty successful reward receipts, load current destinations and verify state after writes.
• Add one-checkbox first-Buddy onboarding: complete the official starter task with one bounded real WorkBuddy conversation, verify completion, then adopt and dispatch. Global preauthorization is optional and off by default.
• Persist consent and write reservations across restarts. Unconfirmed adoption, reward claims and departures are not blindly replayed; definitely unsent conversations can resume after settings or models recover. Show safe diagnostics and one daily warning per blocked account.
• Honor CODEBUDDY2API_BIND/PORT in native launches, complete .env.example and forward resource limits, retries and the import directory through Compose.
• Stop upstream work when an inference client disconnects, including pending non-streaming requests.

Upgrade

• Back up and preserve your existing .env and entire writable data directory, including control.sqlite3, logs.sqlite3, credentials and reward ledgers. Do not clear reservations to retry uncertain operations.
• Native precedence is CLI > environment > saved WebUI settings > defaults. Remove explicit --host/--port if .env should control binding. Existing BIND/PORT values now take effect; non-loopback access still requires a key unless the unsafe override is explicitly enabled.
• Compose keeps container binding at 0.0.0.0:8787; BIND/PORT controls host exposure. Update the image in your existing .env to ghcr.io/maiphucgiang/codebuddy2api:1.2.6, then run docker compose pull && docker compose up -d --no-build.
• First-Buddy automation may use credits for one conversation requesting at most 32 output tokens. CODEBUDDY2API_AUTO_ACCEPT_BUDDY=false remains the default. International trial credits remain manual-only.
• Existing /v1/* and /admin/* addresses remain unchanged.

Distribution and validation

codebuddy2api-1.2.6.tar.gz includes source and prebuilt WebUI assets; SHA256SUMS verifies the download. It excludes credentials, databases, .env and dependency directories. Native use requires Python 3.12+ and the locked Python dependencies, but no frontend build.

The fixes passed local regression tests and deployment acceptance, including real official first-Buddy completion and dispatch. The extracted distribution passed isolated startup, version, health, asset, environment and authentication checks. Reviewed changes: #24, #26, #27.

Tag CI passed and published linux/amd64 and linux/arm64 images. Both report version 1.2.6 and revision 17cd4d842c127810543b688f824c78391eef0fbe; latest matches the versioned manifest.

Full changelog: v1.2.5...v1.2.6

v1.2.5 - WebUI Refinements and Gateway Reliability

WebUI refinements and gateway reliability

codebuddy2api 1.2.5 brings together the WebUI, routing and reliability improvements since 1.2.1, while keeping existing OpenAI and Anthropic client URLs unchanged.

Changes

• More capable model routing: create public model IDs independently of upstream IDs, bind to an account or region, and preserve strict routing constraints during retries. Models are discovered from each account's root catalog rather than only the client picker; unsupported backend/model combinations are temporarily avoided without borrowing another product's capabilities.
• Refined WebUI: a collapsible icon sidebar, stronger glass surfaces, animated drawers, background scroll locking and outside-click dismissal. Appearance controls offer light, dark and system modes, with palettes applied only to light mode. OAuth completion closes the credential drawer and refreshes the list without weakening authorization-tab isolation.
• Useful trends and diagnostics: choose automatic, hourly or daily chart granularity and inspect individual periods by hover, touch or keyboard. Structured cards replace raw JSON where practical; log-detail requests no longer race, and credential downloads handle UTF-8 filenames.
• Independent account actions: refresh a single credential, check in, synchronize balances or manage Buddy travel. Automatic check-in and travel have separate per-account switches; synchronization does not claim rewards. Domestic travel checks status, claims arrived rewards and dispatches only when idle and below the daily limit.
• Manual-only trial credits: international WorkBuddy accounts can confirm a one-time claim in the credential drawer. Safe errors, upstream status/business codes and retry times are visible, with administrative audit records and persistent deduplication. Startup, periodic maintenance and balance synchronization never claim trial credits.
• Protocol and streaming fixes: preserve incomplete-response reasons, Responses event identity and cached-token usage, Anthropic tool-result ordering, stop sequences and tool-error indicators. Unsupported stateful continuation and multiple-choice requests are explicitly rejected. Streaming failures before the first client-visible byte retain the real HTTP status; optional bounded credential failover preserves the original routing rules.
• Billing and resource safeguards: deduplicate balances by account identity, retain account-specific usage snapshots on refresh failure, expose incomplete synchronization and record generation attempts. Add request/response budgets, inference admission limits and early authentication; keep credential refresh off the event loop and reject non-finite credential timestamps.
• Reproducible setup: locked uv startup, hash-verified Python requirements, pinned multi-platform Docker inputs and the react-router security update. Published-image quick start no longer requires a local Docker build.

Community contributions

Thanks to @szbfwdy for PR #10, PR #11, PR #14 and PR #18: account-identity balance deduplication, unsupported-backend avoidance, root-catalog routing and streaming failure/failover handling.

Upgrade

Stop the gateway and back up the full writable auth/ directory and existing .env before upgrading. Preserve credentials, both SQLite databases, model policies and reward ledgers; do not delete claim records or share one data directory between instances. New management/audit state may require a matching backup when rolling back older code.

• All existing /v1/chat/completions, /v1/responses, /v1/messages and /v1/models URLs remain unchanged. Set stream: true explicitly for SSE; omitted stream now returns JSON. Stateful Responses continuation and n != 1 are not supported.
• Domestic automatic check-in and Buddy travel are enabled by default and can be disabled independently on the credential page. International automatic check-in defaults off and is opt-in; international accounts do not use domestic travel endpoints.
• CODEBUDDY2API_AUTO_TRIAL and --auto-trial are retired and ignored with a warning. Remove them from deployment configuration and use the manual claim drawer. Keep auth/trial-ledger.json: successful/already-claimed results are permanent, and failed attempts retain a minimum 24-hour backoff. Reverting to older code can reactivate old automatic settings, so check them first.
• --failover-max remains 0 and --retry-write-timeout remains false by default. Enabling replay can repeat an upstream request that was already processed; this risk is recorded in the audit trail.
• Keep the image's default startup command. Starting only uvicorn converter:app skips management initialization and can leave /dashboard unavailable. Native startup binds to loopback by default; non-loopback startup requires a nonempty API key unless an explicit unsafe override is supplied.

docker pull ghcr.io/maiphucgiang/codebuddy2api:1.2.5

For published-image Compose deployments, set CODEBUDDY2API_IMAGE=ghcr.io/maiphucgiang/codebuddy2api:1.2.5 in your existing .env, then run:

docker compose pull
docker compose up -d --no-build

Environment changes require recreating the container, not just docker compose restart. For source builds, rebuild before recreating the service.

Distribution

codebuddy2api-1.2.5.tar.gz contains the source and prebuilt web/dist assets, with SHA256SUMS for verification. Native deployment requires Python 3.12+ and the locked Python dependencies, but does not need a frontend build. Credentials, runtime databases, .env and dependency directories are excluded.

Validation

• 855 Python tests and 2769 subtests, 108 frontend tests, and two isolated browser flows against the real management API passed locally. Targeted release-version/lock verification passed 9 tests and 37 subtests; frontend checks and the production build passed.
• Release-commit CI passed for be319e3d39cb6765c081c3d6e9afcee06c44271c. CodeQL completed all three language analyses on that commit; the separate main-branch query confirmed 0 open alerts. The underlying manual-claim PR also completed Codex code and security review.
• An isolated smoke test of the extracted distribution verified version 1.2.5, /health, the bundled dashboard and assets, management authentication, the Cookie/inference boundary, model listing and the retired automatic-trial setting. No real credentials or upstream claims were used.
• Tag CI passed and published linux/amd64 and linux/arm64 images. Both architectures report version 1.2.5 and the release revision; tags 1.2.5, 1.2, 1 and latest share one manifest.
• The uploaded distribution and SHA256SUMS were downloaded back and verified byte-for-byte against the locally tested package.

Known limitations

A refreshed trial-status panel can show a broader error category than the immediate claim result; the original safe category remains in the administrative audit log, and backoff still applies. Manual claiming and visible feedback do not establish or resolve the cause of the host-level SSH stalls reported in issue #20.

Documentation

• Deployment: English / 中文
• WebUI: English / 中文
• Advanced reference: English / 中文

Full changelog: v1.2.1...v1.2.5

v1.2.1 - International Login Choices and Compatibility Fixes

International login choices and compatibility fixes

Changes

• Separate international logins: choose International WorkBuddy or International CodeBuddy in the WebUI. CLI login keeps --site intl for WorkBuddy and adds --site intl-codebuddy for CodeBuddy. The latter uses www.codebuddy.ai and the official CLI authentication platform. Existing domestic login and automatic backend routing are unchanged.
• Optional tool descriptions: enable --keep-tool-metadata, CODEBUDDY2API_KEEP_TOOL_METADATA=true, or the WebUI setting to retain supported tool descriptions and parameter-schema description/title annotations across Chat, Responses and Messages, including both Responses projection modes. The default stays off; desensitization, compaction, retry limits and request-size budgets remain in effect.
• Local OAuth compatibility: when GET/HEAD requests omit both Origin and Fetch Metadata, accept a strictly same-origin Referer while still requiring the OAuth polling CSRF token. Explicit origins and fetch-site decisions remain authoritative.
• Startup-only CSRF opt-out: --admin-csrf false / CODEBUDDY2API_ADMIN_CSRF=false can disable management Origin/CSRF checks for trusted local deployments. Protection remains on by default; API-key authentication, session validity, OAuth task ownership and dangerous-operation confirmation are not disabled. Do not disable this protection for an exposed deployment.
• Accurate streaming audit outcomes: a disconnect arriving after a complete response no longer marks it as cancelled. Actual interrupted requests remain cancelled, and upstream error responses remain errors.

Community contributions

• Thanks to @Good-design-999 for PR #7, fixing completed-stream cancellation accounting.
• Thanks also for the tool-description proposal and observations in issue #8, implemented with cross-protocol coverage in PR #9.

Upgrade

Back up the full auth/ directory and existing .env before upgrading. Keep credentials and both SQLite databases in the same writable data directory. Preserve your API key and saved model bindings; all existing /v1/* client URLs remain unchanged.

The new login option and compatibility controls require an updated application build. Environment changes in Docker require recreating the container, not just docker compose restart. An unset tool-metadata environment variable leaves the WebUI option editable; explicit CLI/environment values still override saved settings.

docker pull ghcr.io/maiphucgiang/codebuddy2api:1.2.1

For published-image Compose deployments, update CODEBUDDY2API_IMAGE in your existing .env, then run docker compose pull and docker compose up -d --no-build. For source builds, rebuild before recreating the service.

Distribution

codebuddy2api-1.2.1.tar.gz contains the source and prebuilt web/dist assets, with SHA256SUMS for verification. Native deployment still requires the documented Python dependencies, but does not need a frontend build. Credentials, runtime databases, .env and dependency directories are excluded.

Validation

• All 33 Python regression scripts, 28 frontend tests, and five isolated browser scenarios passed locally, along with frontend formatting/lint/type checks and the production build.
• Release-commit CI and tag CI passed for commit 18d2674874852240e0ada17a26cc3cceaea20e6a.
• CodeQL completed all three language analyses on the release commit; a separate main-branch alert query confirmed 0 open alerts.
• Native-deployment smoke checks verified version, bundled WebUI, management authentication, the Cookie/inference boundary, and actual OAuth state creation plus pending polling for both international products. No user authorization was completed on the official sites.
• The uploaded distribution and checksum file were downloaded back and verified; the extracted package passed version, imports, login mapping and bundled-frontend checks.
• Published image metadata confirms linux/amd64 and linux/arm64, version 1.2.1 and the release revision. Tags 1.2.1, 1.2, 1 and latest share one manifest.

Documentation

• Deployment: English / 中文
• WebUI: English / 中文
• Advanced reference: English / 中文

Full changelog: v1.2.0...v1.2.1

v1.2.0 - WebUI Management and Agent Compatibility

WebUI management and agent compatibility

codebuddy2api 1.2.0 adds a built-in management console and improves compatibility with coding-agent clients, while keeping existing OpenAI and Anthropic client URLs unchanged.

Highlights

• Built-in WebUI at /dashboard: add domestic or international accounts through browser login or .info/ZIP imports, manage credentials and models, and inspect requests, failures and historical statistics. Published Docker images include the frontend.
• Model and credential controls: public model IDs/aliases, enable/disable switches, and strict region/product/account bindings. Unavailable bindings never silently fall back to other accounts; the UI distinguishes manual disabling, authentication circuit breakers and model-level cooldowns.
• Persistent, authenticated management: use the gateway API key to establish an HttpOnly management session. Credentials remain official .info files; settings and metadata use control.sqlite3, and audits use a separate logs.sqlite3. Detail cleanup preserves historical aggregates; clearing all logs and statistics requires confirmation and key verification.
• Safer agent context handling: preserve real user instructions mixed with injected harness context in Chat and Responses, normalize developer messages to system without mutating the caller's payload, and support optional WorkBuddy CLI-template adaptation with bounded non-streaming content-filter fallback.
• Simpler documentation: both READMEs now focus on starting the gateway, signing in to the WebUI and connecting clients. Deployment, client examples, routing rules, request limits and troubleshooting live in bilingual guides under docs/.

External contributions

Thank you to the community contributors whose work is included in this release:

• @Good-design-999 — #3: preserve user text when harness metadata shares the same message. This contribution was incorporated through a local integration commit and strengthened with bounded context parsing and regression coverage.
• @moshouhot — #5: normalize developer to system for upstream compatibility, fixing the role-triggered 11128 rejection affecting pi and other OpenAI-compatible clients. The merged fix preserves the original payload and includes nine regression tests.

Upgrade notes

• Keep /v1/chat/completions, /v1/responses, /v1/messages and /v1/models. No /cn or /intl prefixes or new region parameters are required.
• Set a nonempty CODEBUDDY2API_KEY to use the WebUI and management APIs. Clients use the same key. Empty-key inference retains its legacy behavior, but management is locked; management Cookies do not authorize inference requests.
• Stop the gateway and back up the entire writable auth/ data directory and existing .env before upgrading. Mount the whole data directory on local storage, not individual SQLite files, and do not share it between instances. Credentials are not migrated into SQLite.
• Startup precedence remains explicit CLI flags > environment > persisted WebUI settings > defaults. The UI marks externally controlled options as locked; settings marked for restart require a manual restart.
• Models and multipliers depend on each account's own catalog. Existing zero-multiplier preference, cooldowns and no account-switch replay after an upstream POST remain in place.

Docker

docker pull ghcr.io/maiphucgiang/codebuddy2api:1.2.0

For published-image Compose deployments, set CODEBUDDY2API_IMAGE=ghcr.io/maiphucgiang/codebuddy2api:1.2.0 in your existing .env, configure the API key, then run:

docker compose pull
docker compose up -d --no-build

For the source-build workflow used by the template, run docker compose build followed by docker compose up -d instead.

Images support linux/amd64 and linux/arm64. Stable image tags are 1.2.0, 1.2, 1 and latest; edge follows main.

Documentation

• WebUI: English / 中文
• Deployment: English / 中文
• Clients: English / 中文
• Advanced reference: English / 中文

Validation

• Release-commit CI and tag CI passed: Python regressions, WebUI checks and browser tests, and multi-platform image builds.
• CodeQL completed for Python, JavaScript/TypeScript and Actions on the release commit. The separate default-branch alert check found 0 unresolved code-scanning alerts.
• Published linux/amd64 and linux/arm64 image metadata reports version 1.2.0 and revision e7caf5293adc8eb61c8a59f9e0028459cc0918cb. Tags 1.2.0, 1.2, 1 and latest share manifest sha256:b2080d09f5f6d807e302ad75bb87491156a8f55eae5d536208c7654d9b3224c2.
• A network-isolated smoke test of the published image verified application version, /health, the bundled dashboard/assets, model listing, and unauthenticated versus authenticated management access. No real credentials or upstream requests were used.

Full changelog: v1.1.2...v1.2.0

For personal learning only. Use only subscriptions and accounts you are authorized to access.

v1.1.2 - Zero-Cost Model Preference and Multiplier Discovery

Zero-cost model preference and multiplier discovery

codebuddy2api 1.1.2 routes same-name models to the cheapest known source and publishes each catalog multiplier on /v1/models, so clients can see which models are free on which backend.

Highlights

• Prefer accounts whose own catalog declares the requested model as zero-multiplier (credits: x0.00, for example deepseek-v4.1-flash on international WorkBuddy). Least-expiring-credit rotation still applies inside the preferred group, and a sticky session is rebound only when a better source becomes available.
• Drop accounts with a known zero balance from paid-model rotation instead of letting them fail on empty credit. They keep serving the zero-multiplier models their own catalog declares, and rejoin automatically once the balance recovers. Unknown balances keep the previous permissive behavior.
• Expose multipliers on /v1/models next to the standard OpenAI fields: credits is the lowest multiplier across eligible sources (0.0 means zero-cost, null means no parseable multiplier was declared) and credits_by_profile breaks it down per product, for example {"intl-work": 0.0, "cn-cli": 0.03}. Clients may ignore both extension fields.
• Keep /v1/chat/completions, /v1/responses, /v1/messages, and /v1/models unchanged. No client address, model name, or extra parameter changes are required.
• Cooldown semantics are unchanged: a 429 only cools the affected account and model until the upstream reset time, and an already-sent POST is never replayed against another account.

Upgrade

Use 1.1.2 rather than 1.1.1. Keep existing /v1 client configuration, the writable auth/ directory, and .env. Model catalogs and balances are read from the existing per-account state; no migration is needed.

Multiplier values come from each account's own cached catalog (auth/model-catalog.json, 6-hour TTL). A model shows null until a parseable multiplier is available, and zero-balance accounts contribute only their zero-multiplier entries.

Docker

docker pull ghcr.io/maiphucgiang/codebuddy2api:1.1.2

For published-image Compose deployments, set CODEBUDDY2API_IMAGE=ghcr.io/maiphucgiang/codebuddy2api:1.1.2 in .env, then run:

docker compose pull
docker compose up -d --no-build

The template defaults to a local source build; use docker compose up -d --build for that workflow.

Release tags: 1.1.2, 1.1, 1, and latest. Development builds use edge and do not overwrite latest.

Validation

• 346 regression tests across 21 scripts pass locally and in the Python 3.12 container, including new coverage for multiplier parsing, per-profile aggregation, zero-multiplier preference, sticky rebinding, and zero-balance eligibility.
• Live international requests confirm deepseek-v4.1-flash stays free: the upstream usage field, the official usage records, and the account balance all report zero credits, while paid models on the same account still deduct credits.
• Live routing checks show deepseek-v4.1-flash and other x0.00 models selecting the international WorkBuddy accounts first, and paid models (fast-model, glm-5.3) keeping their previous rotation.
• A live account-level frequency limit (code 6004) cools only that account and model until the reported reset time; the remaining international accounts keep serving the same model without interruption.
• /v1/models returns all 31 discovered models with multipliers resolved from the real account catalogs, including three zero-cost entries.
• GitHub Actions passed on the release tag and published linux/amd64 and linux/arm64. The published image reports version 1.1.2 and revision cd8fa8645ddf95ddaf818a4751b2b6ddf835c041, and the 1.1.2, 1.1, 1, and latest tags share the same manifest.
• The default branch has no unresolved code-scanning alerts at publication.

For personal learning only. Use only subscriptions and accounts you are authorized to access.

v1.1.1 - Automatic Backend Routing and Safe Log Previews

Automatic backend routing with unchanged client endpoints

codebuddy2api 1.1.1 keeps the original client URLs while selecting the correct domestic/international and CodeBuddy CLI/WorkBuddy backend automatically. It also hardens logging and request processing across all three protocols.

Highlights

• Keep /v1/chat/completions, /v1/responses, /v1/messages, and /v1/models. No region prefix, renamed model, or additional client parameter is required.
• Select credentials from their own declared model capabilities and use the selected account's matching backend and product identity headers. Shared models can rotate among eligible accounts; incompatible accounts never borrow another account's catalog or balance.
• Cache catalogs by account, tenant, region, product, and client version. Refresh newly imported credentials, preserve trusted same-account caches on transient failures, and reject unscoped legacy catalogs.
• Fix real token keepalive, persistent cooldowns, refresh/import races, and stale results after credential replacement. Model listings combine each account's own catalog with its own credit eligibility.
• Default to the newest 16 images per request, with configurable limits and an optional HTTP 413 rejection policy. Add a 32 MiB upstream request budget and bounded, redacted log previews.
• Replace the quadratic image-data URL log pattern with a linear scanner, preserving redaction behavior and byte budgets.
• Share transport and validation across Chat, Responses, and Messages. Retry connection establishment only once; do not replay an already-sent POST after an ambiguous disconnect or read/write timeout. Empty or incomplete upstream streams no longer appear as successful completions.
• Preserve reasoning and refusal text, support explicit non-streaming JSON responses, and normalize named tool choices without relaxing the selected-function constraint.
• Add optional one-time international WorkBuddy trial-credit claims, disabled by default, with persistent account-level completion and a minimum 24-hour retry interval.
• Provide .env.example with reasonable defaults and synchronized English/Chinese usage and deployment guides.

Upgrade

Use 1.1.1 rather than the earlier 1.1.0 image. Keep existing /v1 client configuration, the writable auth/ directory, and .env; no client address change is needed. Anthropic SDK base URLs remain the server root because the SDK appends /v1/messages.

Legacy unscoped catalogs and unidentified balances are refreshed before use. Affected requests may briefly return HTTP 503 with Retry-After during synchronization. Do not roll back credential files or delete persistent state when upgrading.

Set stream: false explicitly for JSON responses or stream: true for SSE. Trial claims require CODEBUDDY2API_AUTO_TRIAL=true; they are off by default. Eligibility and actual credits are determined by the upstream; preserve auth/trial-ledger.json after enabling this option.

Docker

docker pull ghcr.io/maiphucgiang/codebuddy2api:1.1.1

For published-image Compose deployments, set CODEBUDDY2API_IMAGE=ghcr.io/maiphucgiang/codebuddy2api:1.1.1 in .env, then run:

docker compose pull
docker compose up -d --no-build

The template defaults to a local source build; use docker compose up -d --build for that workflow.

Release tags: 1.1.1, 1.1, 1, and latest. Development builds use edge and do not overwrite latest.

Validation

• 344 regression tests across 21 scripts pass locally and in the Python 3.12 container, covering automatic routing, per-account isolation, credential concurrency, limits, streaming, tool choices, trial persistence, and adversarial log inputs.
• Live Chat, Responses, and Messages requests pass through the unchanged /v1 endpoints in streaming and non-streaming modes, including named native tool calls. No returned tools were executed.
• Live checks cover cn-cli, cn-work, and intl-work; intl-cli routing and identity behavior are covered by isolated tests, not a live CLI account.
• Verified combined model discovery, key rejection, local unknown-model rejection, default 17-to-16 image truncation, and release-image API paths.
• The reproduced 41.6 KB log input dropped from about 2 seconds to about 7 milliseconds; larger-input and operation-count regressions also pass.
• GitHub Actions passed and published linux/amd64 and linux/arm64. Anonymous inspection confirms that 1.1.1, 1.1, 1, and latest share the same manifest; the pulled image reports version 1.1.1 and revision faecc573e7fabb2982c7e369df9ea1a98c0e3947.
• CodeQL reanalysis marks alert #14 as fixed; the default branch has no unresolved code-scanning alerts at publication.
• Trial claims were tested with mocks; no live trial was claimed. Windows runtime behavior was not independently exercised.

Thanks to Maquer/workbuddy-checkin for documenting the trial endpoint.

For personal learning only. Use only subscriptions and accounts you are authorized to access.

v1.0.2 - Thinking Output Restored

Thinking output restored on every endpoint

codebuddy2api 1.0.2 fixes reasoning (thinking) content being dropped whenever the server aggregates the backend stream.

Highlights

• Non-streaming /v1/chat/completions responses now include reasoning_content when the model thinks.
• Streaming requests with tools replay reasoning deltas before content and tool calls (previously lost during tool-call aggregation).
• /v1/responses emits a reasoning output item (summary text) before the message item, and reports real reasoning_tokens in usage.
• /v1/messages (Claude Code / CC Switch) maps reasoning to Anthropic thinking content blocks, streamed as thinking_delta events.
• Direct streaming without tools was never affected and is unchanged.

Root cause

The backend only speaks SSE, so three code paths aggregate chunks into a final response. All of them merged only content and tool_calls and silently discarded reasoning_content; the Anthropic and Responses adapters also had no thinking/reasoning mapping at all.

Docker

docker pull ghcr.io/maiphucgiang/codebuddy2api:1.0.2

Release tags: 1.0.2, 1.0, 1, and latest. Development builds use edge and do not overwrite latest.

Validation

• New test_reasoning.py (10 tests) covers stream aggregation, pseudo-stream replay, Anthropic thinking blocks, and Responses reasoning items; all existing regression suites still pass.
• Verified live against the production backend with hy4-preview, deepseek-v4.1-flash, and glm-5.3-flash on all four endpoints, streaming and non-streaming.
• GitHub Actions built and published both architectures; anonymous manifest inspection confirmed matching 1.0.2, 1.0, 1, and latest tags.

For personal learning only. Use only subscriptions and accounts you are authorized to access.

v1.0.1 - Seamless Login CLI

Seamless login from the command line

codebuddy2api 1.0.1 adds a single command to open the login page, wait for QR authorization, and save your account automatically.

Highlights

• Run python3 converter.py login to add an account without starting the server or copying tokens and login IDs.
• The command opens your browser and polls until the account is saved. Login links expire after 10 minutes; press Ctrl+C to cancel.
• Use --site intl for the international site and --no-browser on servers or in containers.
• Updated English and Chinese quick-start guides with account login and Docker commands.

Security and reliability

• Command-line login and the admin API share credential validation and atomic writes with private file permissions.
• Logging in to the same account updates its existing credential file and preserves other account entries.
• Access and refresh tokens are not printed to the terminal. Failed or cancelled logins do not report a successful save.

Docker

docker pull ghcr.io/maiphucgiang/codebuddy2api:1.0.1

After updating and starting your container, add an account with:

docker exec -it codebuddy2api python3 converter.py login --no-browser

For Docker Compose, use docker compose exec codebuddy2api python3 converter.py login --no-browser.

Release tags: 1.0.1, 1.0, 1, and latest. Development builds use edge and do not overwrite latest.

Notes for existing users

• Existing accounts remain available after upgrading; there is no need to log in again.
• Keep the same credential directory for login and the server. Docker credentials remain in the mounted ./auth directory.
• With the default directory scan, newly saved accounts are loaded on the next request without restarting. Servers started with --auth-file only use the specified files.

Validation

• 90 regression tests passed inside the locally built Python 3.12 amd64 image.
• Version/tag consistency and Docker Compose configuration checks passed.
• GitHub Actions built and published both architectures. Anonymous pulls and manifest inspection confirmed matching 1.0.1, 1.0, 1, and latest tags; the published image reports version 1.0.1 and includes the login command.
• CodeQL completed. Two alerts that classified the returned credential file path as a password were reviewed and dismissed as false positives; no open code-scanning alerts remain.
• Login tests cover polling, account updates, cancellation, expiry, credential validation, and save failures. Browser authorization uses mocked responses; a real account QR login was not performed.

For personal learning only. Use only subscriptions and accounts you are authorized to access.