Files
sub2api/backend/internal/service
alfadb-bot 4d145300c3 fixup! fix(openai-gateway): route APIKey accounts to /v1/chat/completions when upstream lacks Responses API
Address self-review findings:

R7: Use a narrow per-trust-domain header allowlist for CC raw forwarding.
The previously reused openaiAllowedHeaders contains Codex client-only headers
(originator/session_id/x-codex-turn-state/x-codex-turn-metadata/conversation_id)
that must not leak to third-party OpenAI-compatible upstreams (DeepSeek/Kimi/
GLM/Qwen). Strict upstreams may 400 with 'unknown parameter'; lenient ones
silently pollute their request statistics. New openaiCCRawAllowedHeaders only
allows generic HTTP headers (accept-language, user-agent); content-type/
authorization/accept are set explicitly by callers.

R4: Drop the dead includeUsage parameter from streamRawChatCompletions.
The CC pass-through path doesn't need to inspect the client's stream_options
flag — the upstream handles it and we only extract usage when it appears in
chunks. Killing the unused parameter removes a misleading 'parameter read
but discarded' code smell.

Sediment refs:
- pensieve/short-term/maxims/dont-reuse-shared-headers-whitelist-across-different-upstream-trust-domains
- pensieve/short-term/knowledge/openai-gateway-shared-state-quirks
- pensieve/short-term/pipelines/run-when-self-reviewing-forwarder-implementation
2026-04-30 20:16:44 +08:00
..
2026-03-13 17:00:16 +08:00
2026-03-13 19:15:27 +08:00
2026-03-13 19:15:27 +08:00
2026-04-23 17:28:01 +08:00
2026-01-05 17:07:29 +08:00
2026-04-23 16:34:37 +08:00
2026-01-15 15:14:44 +08:00
2026-01-15 15:14:44 +08:00
2026-01-15 15:14:44 +08:00
2026-02-02 22:13:50 +08:00
2026-04-23 16:34:37 +08:00