feat(gateway): 支持 OpenAI Embeddings API

[tbphp]

关联 Issue / Related Issue

N/A（基于已确认的技术方案实施）

变更内容 / Change Content

• Bug 修复 / Bug fix

• 新功能 / New feature

• 其他改动 / Other changes

• 新增严格原生 POST /v1/embeddings，仅支持 OpenAI Embeddings wire，不做协议转换。

• 覆盖 OpenAI、OpenRouter、OpenAI Compatible 三类 API Key 渠道；订阅渠道保持不支持。

• 复用现有 Bifrost、DirectKey、调度、重试、健康、日志、usage 与定价流程，并为 embedding-only 模型增加有界 Probe fallback。

• 模型发现、AccessKey 过滤、Route Inspector、请求日志和三语管理 UI 同步支持 openai-embeddings / embeddings_create。

• 对大向量响应执行解码后限额、敏感字段扫描和零拷贝投影，避免向量内容进入日志或被额外物化。

• 更新中英文 README 的能力矩阵、渠道边界和 AccessKey 兼容性说明。

兼容性：无数据库迁移。未配置协议过滤的 AccessKey 会自动获得新协议；显式过滤仍按原配置生效。降级前应先移除显式 openai-embeddings 过滤值。

自查清单 / Checklist

• 我已运行 make check，或在说明中写明无法运行的原因和未验证范围。 / I ran make check, or documented why it could not run and what remains unverified.
• 本 PR 范围聚焦，未包含无关改动。 / This PR is focused and contains no unrelated changes.
• 我已更新必要的公开文档或发布说明。 / I updated any required public documentation or release notes.
• 我已确认提交、日志和测试数据不包含敏感信息。 / I confirmed that commits, logs, and fixtures contain no sensitive data.
• 如适用，我已说明兼容性或数据迁移影响。 / Where applicable, I documented compatibility or data-migration impact.

Summary by CodeRabbit

• 新功能

  • 新增 OpenAI Embeddings 客户端协议，支持通过 POST /v1/embeddings 创建文本向量。
  • 支持 OpenAI、OpenRouter 和 OpenAI Compatible API-key 渠道的原生 Embeddings 请求。
  • 支持向量用量统计、模型别名处理、请求日志记录及模型列表展示。
  • 凭据探测在模型不可用时可回退至 Embeddings 协议。

• 改进

  • 未设置协议过滤器的 AccessKey 升级后默认包含 Embeddings 访问能力。
  • 管理界面新增 Embeddings 协议、操作、路由检查及多语言显示支持。
  • Embeddings 暂不支持订阅渠道或协议转换。

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T15:32:14.834032Z	46c05aa	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: QUIET

Plan: Pro Plus

Run ID: fc60ebdb-6960-473b-9f51-8012323cd85f

📥 Commits

Reviewing files that changed from the base of the PR and between 909e83b and 46c05aa.

📒 Files selected for processing (4)

• internal/execution/bifrost/embeddings_probe_test.go
• internal/execution/bifrost/executor.go
• internal/gateway/embeddings_response_representation_test.go
• internal/gateway/response_representation.go

Included review availability: Your plan provides up to 8 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

新增 OpenAI Embeddings 协议和 POST /v1/embeddings 端点。系统支持请求校验、模型改写、非流式用量提取、原生 Bifrost 执行和探测回退。OpenAI、OpenRouter 与 OpenAI Compatible API-key channels 注册原生路由。网关更新响应表示、凭据保护、请求日志、模型索引和健康判定。管理界面、本地化文本及文档同步新增协议和操作。

Merge Risk: 🟡 Moderate · up to 46c05

The PR adds the embeddings endpoint and automatically enables it for existing AccessKeys without explicit protocol filters; additionally, credential probing may validate a different upstream target than actual requests, causing incorrect health results or routing decisions. Merge should wait for explicit acceptance or correction of the target-consistency risk and rollout ownership.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 3.65% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 137 functions across 50 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	标题“feat(gateway): 支持 OpenAI Embeddings API”准确概括了本次 PR 的主要变更，内容明确且简洁。
Description check	✅ Passed	PR 描述包含关联 Issue、变更内容、详细实现范围、兼容性影响和自查清单。新功能勾选正确，且所有自查项均已完成。关联 Issue 标记为 N/A，并说明了原因。

• Fix all pre-merge checks with AI

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch tbphp/openai-embeddings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Note

Quiet mode is enabled, so only the most important comments were posted inline. Other review comments are grouped below.

🟡 Other comments (2)

internal/gateway/response_representation.go-744-756 (1)

744-756: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Sensitive Data Exposure (CWE-200): Exposure of Sensitive Information to an Unauthorized Actor

Reachability: External · Exploitability: Difficult

收窄 embeddingsJSONOpaqueVector 的传播范围。

当 data[*].embedding 是对象时，当前逻辑会跳过其键和值的凭据扫描。上游可将凭据放入嵌套对象并原样转发。对象分支不要继承不透明状态；保留数组分支对向量元素的传播，并增加嵌套对象回归测试。

internal/execution/bifrost/executor.go-481-481 (1)

481-481: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

将 Embeddings 探针改用规范化的目标配置。

对于 ProviderOpenAI 和 ProviderOpenAICompatible，探针使用原始的 spec.TargetConfig，而创建请求使用 resolved.TargetConfig。ResolveExecutionTarget 会规范化 base_url，因此原始配置可能使探针解析失败或访问不同目标。

请将探针分支改为使用 resolved.TargetConfig。

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: QUIET

Plan: Pro Plus

Run ID: 9c232d39-7778-475f-9d6d-d719c559b5b6

📥 Commits

Reviewing files that changed from the base of the PR and between a58de8b and 909e83b.

📒 Files selected for processing (77)

• README.md
• README_CN.md
• internal/channel/compiler.go
• internal/channel/embeddings_module_test.go
• internal/channel/modules/openai.go
• internal/channel/modules/openai_compatible.go
• internal/channel/modules/openrouter.go
• internal/channel/route_golden_test.go
• internal/container/container.go
• internal/container/container_test.go
• internal/control/access_keys_test.go
• internal/control/credential_probe.go
• internal/control/credential_probe_test.go
• internal/control/route_inspect_test.go
• internal/control/validation.go
• internal/control/validation_test.go
• internal/dialect/openai_embeddings.go
• internal/dialect/openai_embeddings_test.go
• internal/dialect/openai_embeddings_usage.go
• internal/dialect/openai_embeddings_usage_test.go
• internal/dialect/standard_request.go
• internal/execution/bifrost/capabilities.go
• internal/execution/bifrost/embedding_wire_test.go
• internal/execution/bifrost/embeddings.go
• internal/execution/bifrost/embeddings_probe_test.go
• internal/execution/bifrost/embeddings_test.go
• internal/execution/bifrost/executor.go
• internal/execution/bifrost/list_models.go
• internal/execution/bifrost/list_models_test.go
• internal/execution/bifrost/runtime.go
• internal/execution/bifrost/runtime_manager_test.go
• internal/execution/contracts.go
• internal/execution/contracts_test.go
• internal/execution/resource_limits.go
• internal/execution/resource_limits_test.go
• internal/execution/responsealias/response_alias.go
• internal/execution/responsealias/response_alias_test.go
• internal/execution/validation.go
• internal/gateway/embeddings_response_representation_test.go
• internal/gateway/execution_forward.go
• internal/gateway/execution_forward_test.go
• internal/gateway/models.go
• internal/gateway/models_test.go
• internal/gateway/request_log.go
• internal/gateway/request_log_test.go
• internal/gateway/response_representation.go
• internal/gateway/router.go
• internal/gateway/router_test.go
• internal/health/execution_judge.go
• internal/health/execution_judge_v2_test.go
• internal/protocol/protocol.go
• internal/protocol/protocol_test.go
• internal/state/snapshot.go
• internal/state/snapshot_test.go
• web/src/api/control/protocols.ts
• web/src/app/resources/channels.ts
• web/src/app/resources/request-logs.ts
• web/src/app/resources/route-inspection.ts
• web/src/features/access-keys/AccessKeyCollection.vue
• web/src/features/access-keys/AccessKeyScopeEditor.vue
• web/src/features/groups/credentials/CredentialTestDialog.vue
• web/src/features/models/ModelSpecSheet.vue
• web/src/features/monitor/InspectorForm.vue
• web/src/features/monitor/InspectorTab.vue
• web/src/features/monitor/LogsAdvancedFilterDrawer.vue
• web/src/i18n/locales/en-US/access-keys.ts
• web/src/i18n/locales/en-US/core.ts
• web/src/i18n/locales/en-US/models.ts
• web/src/i18n/locales/en-US/monitor.ts
• web/src/i18n/locales/ja-JP/access-keys.ts
• web/src/i18n/locales/ja-JP/core.ts
• web/src/i18n/locales/ja-JP/models.ts
• web/src/i18n/locales/ja-JP/monitor.ts
• web/src/i18n/locales/zh-CN/access-keys.ts
• web/src/i18n/locales/zh-CN/core.ts
• web/src/i18n/locales/zh-CN/models.ts
• web/src/i18n/locales/zh-CN/monitor.ts

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.