Release v1.2.1

Author: AuuCoder

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.2.1 - 2026-07-27
+
++ [新增] Grok OAuth 定时巡查接入自动恢复队列；检测到 `xAI CLI OAuth account needs reauthorization` 时直接使用账号现有身份重新授权，并在恢复成功后继续模型探测与外部投递。
++ [修复] OAuth 巡查只将 `invalid_grant`、`invalid_token` 和 `unauthorized_client` 判定为凭据失效；TLS、网络故障、普通 HTTP 错误及未知响应仅记录本次失败，不再误伤正常账号。
++ [修复] `402 personal-team-blocked` 不再触发重复授权，改为按 `60 / 120 / 300` 秒延迟复检 Grok 4.5 权限；探测恢复为有效或限流时同步清除历史错误并恢复账号状态。
++ [修复] OAuth Token 轮换后自动清除旧的重新授权错误，避免已恢复账号继续显示失效。
++ [修复] Device Code consent 的重定向必须实际到达授权完成状态才算成功，避免普通 2xx 或中间重定向被误判为授权完成。
+
 ## 1.2.0 - 2026-07-25
 
 + [新增] Grok 注册支持在同一有头浏览器会话内完成中文资料填写、邮箱确认、Turnstile 与账号创建，并增加页面状态诊断、截图和确认邮件兜底。

README.md

@@ -17,8 +17,8 @@ GPTGrok2API 是一个自托管的 GPT 与 Grok 统一网关，将已接入的订
 | 协议兼容 | 提供 Chat Completions、Responses、Images、Anthropic Messages 兼容入口，支持流式与非流式响应、工具调用、搜索和推理强度。 |
 | GPT 运行时 | 支持 GPT 文本对话、网页搜索、图片生成、图片编辑、会话复用、文件下载以及 PPT/PSD 等可编辑文件任务。 |
 | Grok SSO 运行时 | 内置 Grok 账号池、额度刷新、账号调度、聊天、Responses、Messages、图片生成、图片编辑、视频生成和媒体缓存。 |
-| Grok 后台探测与恢复 | 服务启动后自动探测已加入运行池的非禁用账号；明确失效时使用已保存邮箱和密码重新登录、验证并替换 SSO，无需手动操作。 |
-| Grok Build OAuth | 支持 Device Code 与公网版 Authorization Code + PKCE 授权、Access/Refresh Token 导入、自动刷新、模型探测以及独立 OAuth 凭据存储；新注册使用公网版 `redirect=cloud-console` 上下文，并在关闭客户端前复用同一个 live `curl_cffi Session` 完成 PKCE，Turnstile 沿用系统打码配置，临时 Cookie 与 OAuth Token 均不写入注册账号文件。 |
+| Grok 后台探测与恢复 | 服务启动后自动巡查已加入运行池的非禁用账号；SSO 明确失效时重新登录，OAuth 明确要求重新授权时进入自动恢复队列，网络和未知错误不改变账号有效状态。 |
+| Grok Build OAuth | 支持 Device Code 与公网版 Authorization Code + PKCE 授权、Access/Refresh Token 导入、自动刷新、模型探测以及独立 OAuth 凭据存储；新注册使用公网版 `redirect=cloud-console` 上下文，并在关闭客户端前复用同一个 live `curl_cffi Session` 完成 PKCE。Turnstile 沿用系统打码配置，Device Code 只有实际到达授权完成状态才会成功，临时 Cookie 与 OAuth Token 均不写入注册账号文件。 |
 | 账号生命周期 | 支持账号导入、分组、标签、额度同步、异常状态识别、限流恢复、无效账号清理、批量操作、代理绑定和运行状态监控。 |
 | iCloud Privacy Mail | 内置 sidecar；新接口负责 Apple 登录、2FA 和创建隐私邮箱，旧接口负责登录、2FA 和同步已有邮箱，IMAP App 专用密码负责取验证码。 |
 | iCloud 定时创建 | 按 Apple 账号定时创建邮箱；新接口每小时最多 20 个、旧接口每小时最多 5 个，每账号累计 750 个后自动停止。sidecar 使用 Compose 内部网络，不需要独立账号或宿主机端口。 |
@@ -66,6 +66,10 @@ Grok 账号探测随服务启动自动在后台运行，无需在账号管理页
 
 新 SSO 会先加入运行池并再次验证，确认有效后才删除旧 SSO并原子更新本地账号档案。恢复失败时保留旧档案，按 `1 / 2 / 4 / 8 / 16 / 24` 小时退避重试，最长间隔 `24` 小时。账号列表显示探测结果、恢复状态和恢复时间；恢复记录保存在 `data/grok_accounts.json`，调度完成记录保存在 `data/register.json`。
 
+OAuth 账号由同一套定时巡查负责分类和恢复。刷新接口明确返回 `invalid_grant`、`invalid_token`、`unauthorized_client`，或探测结果为 `xAI CLI OAuth account needs reauthorization` 时，账号才会标记为需要重新授权并进入自动恢复队列；授权获得新 Token 后会清除旧错误，再执行 Grok 4.5 探测与已配置的外部投递。
+
+`402 personal-team-blocked` 表示权限或额度尚未生效，不等同于 OAuth 凭据失效，因此不会重复授权，而是按 `60 / 120 / 300` 秒延迟复检。TLS、代理、网络错误、上游普通 HTTP 错误和无法分类的响应仅记录本次失败，保留账号原状态等待下一轮；探测结果恢复为有效或限流时，历史重新授权错误会自动清除。
+
 ## 内置 Captcha Solver
 
 本地打码源码已经并入主仓库的 `captcha-solver/`，包含 xAI 实页 `window.turnstile.render()`、callback token 采集和注册代理按请求透传修复。安装主项目后直接创建独立虚拟环境：

VERSION

@@ -1 +1 @@
-1.2.0
+1.2.1

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "chatgpt2api"
-version = "1.2.0"
+version = "1.2.1"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.13"

services/register_service.py

@@ -91,6 +91,7 @@
 _GROK_OAUTH_RECOVERY_STALE_MINUTES = 24 * 60
 _GROK_PERMISSION_RETRY_DELAYS_SECONDS = (60, 120, 300)
 _GROK_PERMISSION_RETRY_BATCH_SIZE = 3
+_XAI_CLI_REAUTHORIZATION_ERROR = "xAI CLI OAuth account needs reauthorization"
 _GROK_PENDING_STATUSES = {
     "submitting",
     "pending_submit",
@@ -314,6 +315,22 @@ def _grok_oauth_probe_recoverable(value: object) -> bool:
     )
 
 
+def _grok_oauth_permission_pending(value: object) -> bool:
+    probe = value if isinstance(value, dict) else {}
+    code = _clean_text(probe.get("code")).lower()
+    return code == "permission-denied" or (
+        code == "personal-team-blocked" or code.startswith("personal-team-blocked:")
+    )
+
+
+def _grok_oauth_reauthorization_required(value: object) -> bool:
+    item = value if isinstance(value, dict) else {}
+    return (
+        _clean_text(item.get("last_error")) == _XAI_CLI_REAUTHORIZATION_ERROR
+        or _grok_oauth_probe_recoverable(item.get("probe"))
+    )
+
+
 def _grok_oauth_authorizable(item: object) -> bool:
     """Return whether an SSO registration record is ready for OAuth."""
     if not isinstance(item, dict):
@@ -2283,8 +2300,7 @@ def _recover_grok_oauth_account(
         oauth_account_id = _clean_text(oauth_item.get("id"))
         if not oauth_account_id or _clean_text(oauth_item.get("status")).lower() == "disabled":
             return {"status": "deferred"}
-        probe = oauth_item.get("probe") if isinstance(oauth_item.get("probe"), dict) else {}
-        if not _grok_oauth_probe_recoverable(probe):
+        if not _grok_oauth_reauthorization_required(oauth_item):
             return {"status": "deferred"}
 
         now = datetime.now(timezone.utc)
@@ -2387,7 +2403,7 @@ def _grok_oauth_has_inflight_recovery() -> bool:
             return False
         return any(
             _clean_text(item.get("status")).lower() != "disabled"
-            and _grok_oauth_probe_recoverable(item.get("probe"))
+            and _grok_oauth_reauthorization_required(item)
             and _clean_text(
                 item.get("recovery", {}).get("status") if isinstance(item.get("recovery"), dict) else ""
             ).lower()
@@ -2405,7 +2421,7 @@ def _grok_oauth_has_due_invalid_recovery() -> bool:
         now = datetime.now(timezone.utc)
         return any(
             _clean_text(item.get("status")).lower() != "disabled"
-            and _grok_oauth_probe_recoverable(item.get("probe"))
+            and _grok_oauth_reauthorization_required(item)
             and RegisterService._grok_oauth_recovery_due(item, now=now)
             for item in items
             if isinstance(item, dict)
@@ -2660,7 +2676,7 @@ def _run_grok_permission_retry_once(
             if not isinstance(item, dict) or _clean_text(item.get("status")).lower() == "disabled":
                 continue
             probe = item.get("probe") if isinstance(item.get("probe"), dict) else {}
-            if _clean_text(probe.get("code")).lower() != "permission-denied":
+            if not _grok_oauth_permission_pending(probe):
                 continue
             probed_at = _parse_datetime(probe.get("at"))
             retry_delay = _grok_permission_retry_delay_seconds(item)
@@ -2696,7 +2712,7 @@ def _run_grok_permission_retry_once(
                 1 for item in results if _clean_text(item.get("status")).lower() == "valid"
             )
             summary["pending"] = sum(
-                1 for item in results if _clean_text(item.get("code")).lower() == "permission-denied"
+                1 for item in results if _grok_oauth_permission_pending(item)
             )
             summary["failed"] = max(0, summary["tested"] - summary["valid"] - summary["pending"])
             selected_by_id = {_clean_text(item.get("id")): item for item in selected}
@@ -2709,7 +2725,7 @@ def _run_grok_permission_retry_once(
                 metadata = source.get("metadata") if isinstance(source.get("metadata"), dict) else {}
                 retry = metadata.get("permission_retry") if isinstance(metadata.get("permission_retry"), dict) else {}
                 status = _clean_text(result.get("status")).lower()
-                pending = _clean_text(result.get("code")).lower() == "permission-denied"
+                pending = _grok_oauth_permission_pending(result)
                 attempts = max(0, _safe_int(retry.get("attempts"))) + (1 if pending else 0)
                 next_delay = (
                     _GROK_PERMISSION_RETRY_DELAYS_SECONDS[
@@ -2779,7 +2795,7 @@ def _run_grok_oauth_recovery_sweep(
                 item
                 for item in oauth_items
                 if _clean_text(item.get("status")).lower() != "disabled"
-                and _grok_oauth_probe_recoverable(item.get("probe"))
+                and _grok_oauth_reauthorization_required(item)
             ]
             candidates.sort(
                 key=lambda item: 0

services/register_service_grok2api_test.py

@@ -440,6 +440,35 @@ def test_invalid_oauth_probe_event_only_wakes_enabled_scheduler(self) -> None:
             )
             self.assertFalse(service._grok_probe_wake_event.is_set())
 
+    def test_oauth_patrol_classifies_reauthorization_and_permission_retry(self) -> None:
+        self.assertTrue(
+            register_service_module._grok_oauth_reauthorization_required(
+                {
+                    "last_error": "xAI CLI OAuth account needs reauthorization",
+                    "probe": {"status": "unknown"},
+                }
+            )
+        )
+        no_quota = {
+            "last_error": "No credits",
+            "probe": {
+                "status": "invalid",
+                "code": "personal-team-blocked:spending-limit",
+            },
+        }
+        self.assertFalse(register_service_module._grok_oauth_reauthorization_required(no_quota))
+        self.assertTrue(register_service_module._grok_oauth_permission_pending(no_quota["probe"]))
+        self.assertTrue(
+            register_service_module._grok_oauth_permission_pending(
+                {"status": "invalid", "code": "permission-denied"}
+            )
+        )
+        self.assertFalse(
+            register_service_module._grok_oauth_permission_pending(
+                {"status": "invalid", "code": "invalid_credentials"}
+            )
+        )
+
     def test_scheduler_runs_due_invalid_oauth_recovery_without_waiting_for_probe_interval(self) -> None:
         with tempfile.TemporaryDirectory() as temp_dir:
             service = self._service(temp_dir, probe_scheduler={"enabled": True})

services/xai_cli_oauth_service.py

@@ -1203,7 +1203,7 @@ async def _refresh_account(self, account: dict[str, Any]) -> dict[str, Any]:
         payload = self._json_body(response)
         if response.status_code != 200 or not _clean_text(payload.get("access_token")):
             error = _clean_text(payload.get("error"))
-            if error in {"invalid_grant", "invalid_token", "unauthorized_client"} or response.status_code in {400, 401, 403}:
+            if error in {"invalid_grant", "invalid_token", "unauthorized_client"}:
                 self.store.set_status([account_id], "invalid")
                 raise ValidationError("xAI CLI OAuth account needs reauthorization", code="invalid_credentials")
             raise UpstreamError("xAI CLI OAuth token refresh failed", status=502, body=_safe_error_body(response))

services/xai_cli_oauth_service_test.py

@@ -14,6 +14,7 @@
 
 import httpx
 
+from app.platform.errors import UpstreamError, ValidationError
 from services.xai_cli_oauth_service import XaiCliOAuthService, _billing_quota
 from services.xai_cli_oauth_store import XaiCliOAuthAccountStore
 
@@ -706,6 +707,20 @@ async def test_refresh_rotates_token_without_returning_credentials(self) -> None
         self.assertEqual(raw["refresh_token"], "rotated-refresh")
         self.assertEqual(raw["access_token"], access)
 
+    async def test_refresh_only_invalidates_explicit_oauth_credential_errors(self) -> None:
+        transient = self._account(expires_at="2000-01-01T00:00:00+00:00")
+        transient_response = httpx.Response(403, json={"error": "temporarily_unavailable"})
+        with patch.object(self.service, "_form_post", new=AsyncMock(return_value=transient_response)):
+            with self.assertRaises(UpstreamError):
+                await self.service.refresh_account(str(transient["id"]))
+        self.assertEqual(self.store.get(str(transient["id"]))["status"], "active")
+
+        terminal_response = httpx.Response(400, json={"error": "invalid_grant"})
+        with patch.object(self.service, "_form_post", new=AsyncMock(return_value=terminal_response)):
+            with self.assertRaises(ValidationError):
+                await self.service.refresh_account(str(transient["id"]))
+        self.assertEqual(self.store.get(str(transient["id"]))["status"], "invalid")
+
     async def test_nonstream_request_records_success_and_never_uses_cookie_headers(self) -> None:
         account = self._account()
         selected_accounts: list[dict[str, str]] = []

services/xai_cli_oauth_store.py

@@ -457,7 +457,11 @@ def _merge_account(existing: dict[str, Any], incoming: dict[str, Any]) -> dict[s
         merged["use_count"] = _non_negative_int(existing.get("use_count"))
         merged["fail_count"] = _non_negative_int(existing.get("fail_count"))
         merged["last_used_at"] = _clean_text(existing.get("last_used_at"))
-        merged["last_error"] = _safe_error(existing.get("last_error"), existing)
+        credentials_rotated = (
+            bool(_clean_text(incoming.get("access_token")))
+            and _clean_text(incoming.get("access_token")) != _clean_text(existing.get("access_token"))
+        )
+        merged["last_error"] = "" if credentials_rotated else _safe_error(existing.get("last_error"), existing)
         merged["updated_at"] = _now()
         return merged
 
@@ -677,6 +681,9 @@ def update_tokens(
                     item["email"] = _clean_text(email)
                 if models is not None:
                     item["models"] = _model_ids(models)
+                if _normalize_status(item.get("status")) != "disabled":
+                    item["status"] = "active"
+                item["last_error"] = ""
                 item["last_refresh_at"] = _now()
                 item["updated_at"] = _now()
                 self._save_unlocked(items)
@@ -820,6 +827,10 @@ def update_probe_results(self, results: list[dict[str, Any]]) -> list[dict[str,
                         item["status"] = "invalid"
                     elif normalized_status in {"valid", "limited"}:
                         item["status"] = "active"
+                if normalized_status in {"valid", "limited"}:
+                    item["last_error"] = ""
+                elif normalized_status == "invalid":
+                    item["last_error"] = _safe_error(result.get("error"), item)
                 item["updated_at"] = now
                 updated_items.append(item)
             if updated_items:

services/xai_cli_oauth_store_test.py

@@ -152,6 +152,7 @@ def test_recovery_state_is_safe_and_resolves_by_job_id(self) -> None:
     def test_subject_deduplicates_refresh_token_rotation_and_preserves_identity(self) -> None:
         first = self.store.upsert(self._payload("first@example.com", "stable-subject", "one"))
         first_created_at = self.store.get(first["item"]["id"])["created_at"]
+        self.store.record_result(first["item"]["id"], False, "OAuth account needs reauthorization")
         second = self.store.upsert(
             self._payload("renamed@example.com", "stable-subject", "two", expires_at="2030-01-01T00:00:00+00:00")
         )
@@ -163,8 +164,31 @@ def test_subject_deduplicates_refresh_token_rotation_and_preserves_identity(self
         self.assertEqual(raw["access_token"], "access-two")
         self.assertEqual(raw["refresh_token"], "refresh-two")
         self.assertEqual(raw["created_at"], first_created_at)
+        self.assertEqual(raw["last_error"], "")
         self.assertEqual(self.store.count(), 1)
 
+    def test_probe_result_replaces_stale_error_with_current_outcome(self) -> None:
+        saved = self.store.upsert(self._payload("person@example.com", "subject-one", "one"))["item"]
+        self.store.record_result(saved["id"], False, "OAuth account needs reauthorization")
+
+        invalid = self.store.update_probe_result(
+            saved["id"],
+            status="invalid",
+            model="grok-4.5",
+            http_status=402,
+            code="personal-team-blocked:spending-limit",
+            error="No credits",
+        )
+        self.assertEqual(invalid["last_error"], "No credits")
+
+        valid = self.store.update_probe_result(
+            saved["id"],
+            status="valid",
+            model="grok-4.5",
+            http_status=200,
+        )
+        self.assertEqual(valid["last_error"], "")
+
     def test_round_robin_skips_disabled_accounts_and_honors_exclusions(self) -> None:
         first = self.store.upsert(self._payload("one@example.com", "subject-one", "one"))["item"]
         second = self.store.upsert(self._payload("two@example.com", "subject-two", "two"))["item"]
@@ -181,6 +205,8 @@ def test_round_robin_skips_disabled_accounts_and_honors_exclusions(self) -> None
 
     def test_update_tokens_rotates_refresh_token_and_status_controls_selection(self) -> None:
         saved = self.store.upsert(self._payload("person@example.com", "subject-one", "one"))["item"]
+        self.store.record_result(saved["id"], False, "OAuth account needs reauthorization")
+        self.store.set_status([saved["id"]], "invalid")
 
         updated = self.store.update_tokens(
             saved["id"],
@@ -196,6 +222,8 @@ def test_update_tokens_rotates_refresh_token_and_status_controls_selection(self)
         self.assertEqual(raw["refresh_token"], "refresh-two")
         self.assertEqual(raw["id_token"], "id-two")
         self.assertEqual(raw["expires_at"], "2032-01-01T00:00:00+00:00")
+        self.assertEqual(raw["status"], "active")
+        self.assertEqual(raw["last_error"], "")
 
         self.assertEqual(self.store.set_disabled([saved["id"]], True)["updated"], 1)
         self.assertIsNone(self.store.select_next_account())