HTExplicit · Oct 9, 2026 · Sep 29, 2026 · Sep 29, 2026 · Sep 29, 2026 · Sep 29, 2026
diff --git a/.downstream/upstream-base b/.downstream/upstream-base
@@ -1 +1 @@
-v0.2.14
+v0.2.15
diff --git a/.downstream/upstream-review-v0.2.15.md b/.downstream/upstream-review-v0.2.15.md
@@ -0,0 +1,27 @@
+# Official v0.2.15 integration
+
+- Official tag: `v0.2.15`, commit `f2669c8cf62555cd92389b3f55920e9e6e7c6ff2`.
+- Downstream starting commit: `d469422e94b0655b22dd9d0a826decda61ffb91e`.
+- The 40 initial conflicts cover dependency/CI compatibility, platform catalogs,
+  tests, account interfaces and OpenAI request/usage handling. Existing Go
+  1.27.2 and dependency security pins and narrow HTTP2 exceptions remain.
+- Cline, Command Code, catalog-driven platforms, protocol conversion, model
+  discovery, TPS and async UI fixes follow the official release. Each WS turn
+  uses its refreshed group pricing while retaining immutable usage snapshots.
+- OpenAI encrypted-content recovery and account retry rules follow official;
+  downstream recovery state, its admin API/page and special failovers are retired.
+  Historical settings and diagnostic data are retained. Claude recovery, Codex
+  identity/borrowing, Pelican observation, prompt injection, capacity evidence,
+  full administrator visibility and mapped test-model contracts remain.
+- Named standalone API-key tool outputs retain their namespace; official lazy
+  request reconstruction is used. Compact filters retain existing facets and
+  state. New platforms take prompt/effort extensions only on supported paths.
+- Official 242 and additive downstream 277 end both upgrade and fresh-install
+  paths without the two database platform CHECK constraints. 251/260/265 stay
+  byte-for-byte unchanged; 277 changes no rows. VERSION is 0.2.15.
+
+Local validation uses fake upstreams, UI fixtures and an isolated PostgreSQL
+18.1 database. It covers official recovery, namespace preservation, new-platform
+prompt/effort support, mapped models, filter disclosure and WS turn pricing.
+Required PR CI remains authoritative. Release and production status is recorded
+only by the operator workspace's production pointer.
diff --git a/.downstream/upstream-risk.json b/.downstream/upstream-risk.json
diff --git a/.github/scripts/test_reasoning_recovery.sh b/.github/scripts/test_reasoning_recovery.sh
diff --git a/.github/workflows/backend-ci.yml b/.github/workflows/backend-ci.yml
@@ -40,12 +40,6 @@ jobs:
       - name: Verify Go version
         run: |
           go version | grep -q 'go1.27.2'
-      - name: Verify Go modules
-        working-directory: backend
-        run: go mod verify
-      - name: Go vet
-        working-directory: backend
-        run: go vet ./...
       - name: Unit tests
         working-directory: backend
         run: make test-unit

diff --git a/.github/workflows/downstream-verify.yml b/.github/workflows/downstream-verify.yml
@@ -34,8 +34,6 @@ jobs:
           python3 .github/scripts/test_release_preflight.py
       - name: Agent protocol contracts
         run: bash .github/scripts/test_agent_protocol.sh
-      - name: Reasoning recovery contracts
-        run: bash .github/scripts/test_reasoning_recovery.sh
       - name: Model context capacity contracts
         run: bash .github/scripts/test_model_context_capacity.sh
       - name: Service tests
@@ -142,7 +140,6 @@ jobs:
             src/components/account/__tests__/CreateAccountModal.spec.ts \
             src/components/payment/__tests__/StripePaymentInline.contrast.spec.ts \
             src/views/user/__tests__/StripePaymentView.spec.ts \
-            src/views/admin/__tests__/ReasoningRecoveryView.spec.ts \
             src/views/admin/ops/components/__tests__/OpsErrorDetailModal.spec.ts \
             src/api/admin/__tests__/codexGatewayBorrow.spec.ts \
             src/components/admin/codex/__tests__/BorrowPelicanPreview.spec.ts \

diff --git a/DOWNSTREAM.md b/DOWNSTREAM.md
@@ -5,7 +5,7 @@ This fork maintains the `codexrip` patch set over official Sub2API releases.
 ## Source baseline
 
 - Integrated official baseline: the release recorded in `.downstream/upstream-base`.
-- Retained compatibility decisions: [upstream review](.downstream/upstream-review-v0.2.14.md).
+- Retained compatibility decisions: [upstream review](.downstream/upstream-review-v0.2.15.md).
 - The operator workspace `docs/sub2api.md` owns the production version and image digest. A source merge or Release does not establish deployment completion.
 
 ## Settings and account operations
@@ -159,15 +159,36 @@ identity and verified-replay checks remain in force.
   and manual routing stay within their existing configuration.
 - Container/public health confirms availability, not actual model functionality.
 
+## OpenAI encrypted-content recovery
+
+HTTP and WebSocket encrypted-content recovery follows official v0.2.15,
+including the official session lineage memory. The former downstream targeted
+stripping, persistent rejection memory, SSE repair, missing-item-id repair and
+special account failovers are retired. The global recovery page and its
+`GET/PUT /api/v1/admin/reasoning-recovery` interface are removed. Stored settings,
+historical SQL and diagnostic records remain intact; ordinary Claude thinking
+signature recovery is independent and remains available.
+
+Cline and Command Code share the existing system-prompt insertion points.
+Connection-test reasoning options require declared model support and a wire
+path that retains the chosen effort; unsupported and `ultra` options remain
+unavailable. The compact account filters retain multi-selection, tags, proxy,
+plan and count controls; hiding additional filters never resets their values.
+
+Official migration 242 removes platform CHECK constraints. Immutable downstream
+251, 260 and 265 restore the quota constraint during a fresh installation, so
+277 repeats the final removal after them. No historical checksum or existing
+quota/route row is changed by 242 or 277.
+
 ## Upstream updates
 
 Scheduled discovery may identify newer official releases. It cannot deploy
 production. Each integration records its selected official commit, conflicts and
 retained downstream contracts before a new immutable release is published.
 
-`.downstream/upstream-risk.json` records the v0.2.13-to-v0.2.14 integration against
-downstream commit `7132011d7a4275e7d6407c92db4ec205a1c14ad1`. The risk gate
-recomputes those exact inputs. `initial_conflict_files` lists the three dependency
+`.downstream/upstream-risk.json` records the v0.2.14-to-v0.2.15 integration against
+downstream commit `d469422e94b0655b22dd9d0a826decda61ffb91e`. The risk gate
+recomputes those exact inputs. `initial_conflict_files` lists the 40
 conflicts resolved during this merge; `merge_conflicts: []` records that none
 remain. A `review_required` candidate needs a real completed review and the
 `upstream-reviewed` label before promotion.
diff --git a/Makefile b/Makefile
@@ -8,6 +8,12 @@ FRONTEND_CRITICAL_VITEST := \
 	src/components/account/__tests__/OpenAIReferralCell.spec.ts \
 	src/components/account/__tests__/OpenAIReferralCell.transport.spec.ts \
 	src/components/account/__tests__/OpenAIQuotaResetCell.spark_shadow.spec.ts \
+	src/constants/__tests__/platforms.spec.ts \
+	src/components/account/__tests__/credentialsBuilder.platformCatalog.spec.ts \
+	src/components/account/__tests__/CreateAccountModal.spec.ts \
+	src/components/account/__tests__/EditAccountModal.spec.ts \
+	src/components/account/__tests__/credentialsBuilder.spec.ts \
+	src/components/account/__tests__/OpenCodeGoProtocolRulesEditor.spec.ts \
 	src/components/keys/__tests__/BulkEditKeysModal.spec.ts \
 	src/components/admin/user/__tests__/UserPlatformQuotaModal.spec.ts \
 	src/views/user/__tests__/KeysView.spec.ts \
@@ -18,14 +24,16 @@ FRONTEND_CRITICAL_VITEST := \
 	src/views/user/__tests__/PaymentResultView.spec.ts \
 	src/views/user/__tests__/ChannelStatusView.mode.spec.ts \
 	src/components/user/profile/__tests__/ProfileInfoCard.spec.ts \
+	src/components/user/profile/__tests__/ProfileIdentityBindingsSection.spec.ts \
 	src/views/admin/__tests__/SettingsView.spec.ts \
 	src/components/account/__tests__/EditAccountModal.spec.ts \
 	src/components/account/__tests__/ModelWhitelistSelector.spec.ts \
 	src/composables/__tests__/useModelWhitelist.spec.ts \
 	src/components/layout/__tests__/AppSidebar.simple-mode.spec.ts \
 	src/features/channel-monitor-v2/__tests__/designSystem.structure.spec.ts \
 	src/features/channel-monitor-v2/__tests__/monitorFormat.spec.ts \
-	src/features/channel-monitor-v2/__tests__/monitorZoom.spec.ts
+	src/features/channel-monitor-v2/__tests__/monitorZoom.spec.ts \
+	src/components/admin/channel/__tests__/PricingEntryCard.modelDefaultPrice.spec.ts
 
 # 一键编译前后端
 build: build-backend build-frontend

diff --git a/backend/cmd/server/VERSION b/backend/cmd/server/VERSION
@@ -1 +1 @@
-0.2.14
+0.2.15
diff --git a/backend/cmd/server/wire_gen.go b/backend/cmd/server/wire_gen.go
diff --git a/backend/ent/runtime/runtime.go b/backend/ent/runtime/runtime.go
diff --git a/backend/ent/schema/composite_model_route.go b/backend/ent/schema/composite_model_route.go
@@ -1,6 +1,8 @@
 package schema
 
 import (
+	"fmt"
+
 	"github.com/Wei-Shaw/sub2api/ent/schema/mixins"
 	"github.com/Wei-Shaw/sub2api/internal/domain"
 
@@ -45,6 +47,13 @@ func (CompositeModelRoute) Fields() []ent.Field {
 		field.String("target_platform").
 			MaxLen(50).
 			Default(domain.PlatformOpenAI).
+			Validate(func(s string) error {
+				// 目标平台须为平台清单中的具体平台；数据库不再维护 CHECK 约束。
+				if !domain.IsConcretePlatform(s) {
+					return fmt.Errorf("target_platform %q is not a concrete platform", s)
+				}
+				return nil
+			}).
 			Comment("Concrete provider platform."),
 		field.String("upstream_model").
 			MaxLen(200).

diff --git a/backend/ent/schema/user_platform_quota.go b/backend/ent/schema/user_platform_quota.go
@@ -11,6 +11,7 @@ import (
 	"entgo.io/ent/schema/field"
 	"entgo.io/ent/schema/index"
 	"github.com/Wei-Shaw/sub2api/ent/schema/mixins"
+	"github.com/Wei-Shaw/sub2api/internal/domain"
 )
 
 // UserPlatformQuota holds the schema definition for per-user per-platform quota.
@@ -38,15 +39,12 @@ func (UserPlatformQuota) Fields() []ent.Field {
 			MaxLen(32).
 			NotEmpty().
 			Validate(func(s string) error {
-				// 注意：平台列表的单一权威源为 service.AllowedQuotaPlatforms；
-				// 此处为 ent 构建期约束，需与 service.AllowedQuotaPlatforms 保持同步。
-				switch s {
-				case "anthropic", "openai", "gemini", "antigravity", "grok",
-					"kimi", "zhipu", "deepseek", "minimax", "opencode_go", "typesafe":
-					return nil
-				default:
+				// 平台白名单为平台清单（domain/platforms.go）中的全部具体平台，
+				// 与 service.AllowedQuotaPlatforms 同源；数据库不再维护 CHECK 约束。
+				if !domain.IsConcretePlatform(s) {
 					return fmt.Errorf("platform %q is not allowed", s)
 				}
+				return nil
 			}),
 
 		// 日 / 周 / 月 USD 上限：

diff --git a/backend/go.mod b/backend/go.mod
@@ -19,6 +19,7 @@ require (
 	github.com/coder/websocket v1.8.14
 	github.com/dgraph-io/ristretto v0.2.0
 	github.com/gin-gonic/gin v1.9.1
+	github.com/go-playground/validator/v10 v10.14.0
 	github.com/go-webauthn/webauthn v0.17.4
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/uuid v1.6.0
@@ -122,7 +123,6 @@ require (
 	github.com/go-openapi/inflect v0.19.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.14.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/go-webauthn/x v0.2.6 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect

diff --git a/backend/go.sum b/backend/go.sum
@@ -666,6 +666,7 @@ golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 h1:RJhm5l6Fo4rmEIcndxD
 golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959/go.mod h1:LV7u5Oco+Z/g6XI7PqN+EUUUGGkEcmB1uj2ceI0fOVg=
 golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5 h1:ZUSxONxc981v7AW7QUg+I9WwZzSTTJ019ENBYr5pV/Q=
 golang.org/x/telemetry v0.0.0-20260908163034-4bcc4b2ee518 h1:F5BWKvW126NXR74uxkxuc1jQHhm/rwm/J3rSiFyuRs4=
+golang.org/x/telemetry v0.0.0-20260908163034-4bcc4b2ee518/go.mod h1:i+ivNqjDnTF3WTElsdk5g9V5DTSBYgdNo7xTU9SDwYA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=

diff --git a/backend/internal/domain/constants.go b/backend/internal/domain/constants.go
@@ -30,9 +30,15 @@ const (
 	PlatformMiniMax  = "minimax"  // MiniMax (M 系列)
 	PlatformTypeSafe = "typesafe" // TypeSafe AI System One (Jev)
 	// PlatformOpenCodeGo 是 OpenCode 平台（账号类型 Zen 按量 / Go 订阅）。
-	// 值保持 opencode_go 以兼容已落库的分组、配额与 Composite 路由 CHECK。
+	// 值保持 opencode_go 以兼容已落库的账号、分组、配额与 Composite 路由。
 	PlatformOpenCodeGo = "opencode_go"
-	PlatformComposite  = "composite"
+	// PlatformCommandCode 是 Command Code Provider API（多模型聚合，积分计费，
+	// 订阅套餐另有 5 小时 / 每周滚动窗口）。
+	PlatformCommandCode = "command_code"
+	// PlatformCline 是 Cline API（多模型聚合，OpenAI 兼容 Chat Completions；按量积分计费，
+	// 另有 ClinePass 订阅）。
+	PlatformCline     = "cline"
+	PlatformComposite = "composite"
 )
 
 // Account mode constants 区分国产供应商的「按量付费（余额）」与「Coding Plan」两种接入方式。