chore: bump version to 3.3.2

Co-authored-by: Codex <noreply@openai.com>

.github/workflows/_container.yml

@@ -45,7 +45,7 @@ jobs:
           ref: ${{ inputs.ref }}
 
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build runtime image
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
@@ -79,7 +79,7 @@ jobs:
           ${{ hashFiles('trivy-results.sarif') != '' &&
               (github.event_name != 'pull_request' ||
                github.event.pull_request.head.repo.full_name == github.repository) }}
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           sarif_file: trivy-results.sarif
           category: runtime-container

.github/workflows/release.yml

@@ -448,7 +448,7 @@ jobs:
           PY
 
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Login to GHCR
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -519,7 +519,7 @@ jobs:
           path: dist/release
 
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

README.md

@@ -16,9 +16,6 @@
 
 </div>
 
-Codex Proxy RS 在一个网关中管理 OpenAI 与 xAI 账号，为客户端提供统一鉴权、模型路由、额度状态、
-请求观测和管理控制面。
-
 > [!NOTE]
 > 数据面支持 OpenAI Responses、Images 和模型目录协议，不提供 `/v1/chat/completions`。
 

backend/Cargo.lock

@@ -216,9 +216,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-s3"
-version = "1.141.0"
+version = "1.142.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9f9420d3a2467eed22ed3635ca653653162c386a0b0f65c78189f9bd3c1379e"
+checksum = "f9e15a5c55e05f4b0b7e483160b3c85cccdf77cff02c95504f3e71d460855cd2"
 dependencies = [
  "arc-swap",
  "aws-credential-types",
@@ -308,9 +308,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-eventstream"
-version = "0.61.1"
+version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a9381123ab62d20c13082b151f30f962a3b112b727345394536dfa39a482944"
+checksum = "6de526c7b567420a31bc283657a7921b45c4cafe0827fdf2490713dcc770c28f"
 dependencies = [
  "aws-smithy-types",
  "bytes",
@@ -341,9 +341,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-http-client"
-version = "1.2.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "635d23afda0a6ab48d666c4d447c4873e8d1e83518a2be2093122397e50b838e"
+checksum = "3c1c8a04cb31ba74d0115af5a890bb8c0d48fba64b52812fa13929a6ef0cc83c"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
@@ -385,9 +385,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime"
-version = "1.12.1"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07505b34e8f4b3591a4fa69e9792b52289b95488dbbc68c3c0075b7bedb245e1"
+checksum = "483b858ff67522011c4786310c5cd8fd88d0be7ea3d5f1a48328446300c4269e"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-http",
@@ -411,9 +411,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.14.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b98f2e1fd67ec06618f9c291e5e495a468e60519e44c9c1979cd0521f3affdb"
+checksum = "954c563ce84507722d2679f07a35d21b9c6466b3872d513020d0281fc8112ac9"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api-macros",
@@ -1246,7 +1246,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2714,7 +2714,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2813,9 +2813,9 @@ dependencies = [
 
 [[package]]
 name = "redis"
-version = "1.5.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3257df217f7eab0044627a268c9cc6cdb60c0c421c88f83ac41c4e31520b6b84"
+checksum = "e37a4ca5c6ca42aa3e6df2fd32b987a65d32a4c2159a6f3fe0fd1df306a2658f"
 dependencies = [
  "arc-swap",
  "arcstr",
@@ -2984,7 +2984,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3628,7 +3628,7 @@ dependencies = [
  "getrandom 0.4.3",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4100,9 +4100,9 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
 [[package]]
 name = "uuid"
-version = "1.24.0"
+version = "1.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
+checksum = "2cefc03fd367c0c6d4305de1b312cf00248c4114f4a0418ce6a6af769e3b0bd9"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",

backend/crates/gateway-admin/src/model/provider_credentials.rs

@@ -3,7 +3,7 @@
 use std::fmt;
 
 use async_trait::async_trait;
-use chrono::{DateTime, Utc};
+use chrono::{DateTime, NaiveDate, Utc};
 use gateway_core::{
     engine::credential::{OpaqueProviderData, ProviderAccountId, ProviderAccountIdentity},
     routing::{ProviderKind, UpstreamModelId},
@@ -13,6 +13,7 @@ use uuid::Uuid;
 use super::{
     AdminError, MutationActor, MutationContext, PageSize, Revision,
     accounts::{AccountRecord, AccountSummary, AccountUsage, CredentialState},
+    observability::CurrencyCost,
 };
 
 /// Provider-owned JSON；公共层只搬运且 Debug 不输出值。
@@ -627,6 +628,122 @@ pub struct ProviderQuota {
     pub provider_data: Option<ProviderDocument>,
 }
 
+/// Provider 官方用量统计的账号形态。
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ProviderUsageStatisticsMode {
+    Workspace,
+    Personal,
+}
+
+impl ProviderUsageStatisticsMode {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Workspace => "workspace",
+            Self::Personal => "personal",
+        }
+    }
+}
+
+/// Provider 官方用量统计的目标额度周期。
+#[derive(Debug, Clone, PartialEq)]
+pub struct ProviderUsageStatisticsCycle {
+    pub offset: i8,
+    pub start_at: DateTime<Utc>,
+    pub end_at: DateTime<Utc>,
+    pub window_seconds: u64,
+    pub used_percent: Option<f64>,
+    pub is_current: bool,
+    pub can_go_previous: bool,
+    pub can_go_next: bool,
+}
+
+/// Provider 官方用量统计查询。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProviderUsageStatisticsRequest {
+    pub account_id: ProviderAccountId,
+    /// `0` 为当前周期，负数为历史周期。
+    pub cycle_offset: i8,
+    /// 客户端相对 UTC 的分钟偏移，例如 UTC+8 为 `480`。
+    pub utc_offset_minutes: i16,
+}
+
+/// 官方用量统计中的 Token 分类。
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct ProviderUsageStatisticsTokens {
+    pub uncached_input: u64,
+    pub cached_input: u64,
+    pub output: u64,
+    pub total: u64,
+}
+
+/// 官方模型报表中的服务档位。
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ProviderUsageStatisticsServiceTier {
+    Standard,
+    Fast,
+}
+
+impl ProviderUsageStatisticsServiceTier {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Standard => "standard",
+            Self::Fast => "fast",
+        }
+    }
+}
+
+/// 一个模型与服务档位在目标周期内的统计行。
+#[derive(Debug, Clone, PartialEq)]
+pub struct ProviderUsageStatisticsModel {
+    pub key: String,
+    pub model: String,
+    pub service_tier: ProviderUsageStatisticsServiceTier,
+    pub credit_share: Option<f64>,
+    pub quota_share: Option<f64>,
+    pub tokens: ProviderUsageStatisticsTokens,
+    pub estimated_cost: Option<CurrencyCost>,
+    pub has_unknown_pricing: bool,
+    pub has_estimated_allocation: bool,
+    pub has_rate_fallback: bool,
+    pub has_missing_token_data: bool,
+}
+
+/// 目标周期内的一天；官方日报只能提供本地日粒度。
+#[derive(Debug, Clone, PartialEq)]
+pub struct ProviderUsageStatisticsDay {
+    pub date: NaiveDate,
+    pub credit_share: Option<f64>,
+    pub tokens: ProviderUsageStatisticsTokens,
+    pub estimated_cost: Option<CurrencyCost>,
+    pub has_unknown_pricing: bool,
+    pub has_missing_token_data: bool,
+    pub is_boundary_day: bool,
+}
+
+/// 目标周期汇总。
+#[derive(Debug, Clone, PartialEq)]
+pub struct ProviderUsageStatisticsSummary {
+    pub tokens: ProviderUsageStatisticsTokens,
+    pub estimated_cost: Option<CurrencyCost>,
+    pub projected_tokens: Option<u64>,
+    pub projected_cost: Option<CurrencyCost>,
+    pub day_count: u32,
+    pub has_unknown_pricing: bool,
+    pub has_missing_token_data: bool,
+}
+
+/// Provider 已解释、计算并排序的官方用量统计。
+#[derive(Debug, Clone, PartialEq)]
+pub struct ProviderUsageStatistics {
+    pub mode: ProviderUsageStatisticsMode,
+    pub cycle: ProviderUsageStatisticsCycle,
+    pub summary: ProviderUsageStatisticsSummary,
+    pub models: Vec<ProviderUsageStatisticsModel>,
+    pub daily: Vec<ProviderUsageStatisticsDay>,
+}
+
 /// Provider 返回的一张安全主动额度重置卡。
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ProviderResetCredit {

backend/crates/gateway-admin/src/ports/provider.rs

@@ -18,6 +18,7 @@ use crate::model::provider_credentials::{
     PrepareCredentialRotation, PreparedAuthorizationCommit, PreparedCredentialImport,
     PreparedCredentialRotation, ProviderExport, ProviderExportCredentialInput, ProviderModels,
     ProviderQuota, ProviderQuotaRequest, ProviderResetCreditResult, ProviderResetCredits,
+    ProviderUsageStatistics, ProviderUsageStatisticsRequest,
 };
 
 /// Provider 管理失败的稳定分类。
@@ -146,6 +147,14 @@ pub trait ProviderAdmin: Send + Sync {
         request: ProviderQuotaRequest,
     ) -> Result<ProviderQuota, ProviderAdminError>;
 
+    /// 查询 Provider 官方用量统计；不支持该能力的 Provider 使用默认拒绝。
+    async fn usage_statistics(
+        &self,
+        _request: ProviderUsageStatisticsRequest,
+    ) -> Result<ProviderUsageStatistics, ProviderAdminError> {
+        Err(ProviderAdminError::new(ProviderAdminErrorKind::Unsupported))
+    }
+
     /// 查询 Provider 主动额度重置卡；不支持该能力的 Provider 使用默认拒绝。
     async fn reset_credits(
         &self,

backend/crates/gateway-admin/src/use_case/accounts.rs

@@ -26,7 +26,8 @@ use crate::{
             AccountDirectoryItem, AccountDirectoryPage, AccountExportBundle, AccountRefreshResult,
             ConsumeProviderResetCredit, PrepareCredentialRefresh, ProviderModels, ProviderQuota,
             ProviderQuotaRequest, ProviderQuotaWindow, ProviderResetCreditResult,
-            ProviderResetCredits, QuotaLocalUsageAttribution,
+            ProviderResetCredits, ProviderUsageStatistics, ProviderUsageStatisticsRequest,
+            QuotaLocalUsageAttribution,
         },
     },
     ports::{provider::ProviderAdminRegistry, store::AccountStore},
@@ -80,6 +81,15 @@ pub trait AccountsService: Send + Sync {
         refresh: bool,
     ) -> Result<AccountDirectoryItem, AdminError>;
 
+    async fn usage_statistics(
+        &self,
+        _request: ProviderUsageStatisticsRequest,
+    ) -> Result<ProviderUsageStatistics, AdminError> {
+        Err(AdminError::invalid(
+            "Provider usage statistics are not supported",
+        ))
+    }
+
     async fn reset_credits(
         &self,
         _context: &MutationContext,
@@ -538,6 +548,17 @@ impl AccountsService for DefaultAccountsService {
         self.load_directory_item(account_id, refresh).await
     }
 
+    async fn usage_statistics(
+        &self,
+        request: ProviderUsageStatisticsRequest,
+    ) -> Result<ProviderUsageStatistics, AdminError> {
+        let (_, provider) = self.provider_for_account(&request.account_id).await?;
+        provider
+            .usage_statistics(request)
+            .await
+            .map_err(|error| map_provider_error(error, "provider usage statistics"))
+    }
+
     async fn reset_credits(
         &self,
         context: &MutationContext,

backend/crates/gateway-api/src/admin/accounts.rs

@@ -29,7 +29,10 @@ use gateway_admin::model::{
         CredentialDeletion, CredentialDeletionResult, CredentialImportResult, CredentialMutation,
         CredentialMutationResult, ImportCredentials, ProviderDocument, ProviderModels,
         ProviderQuota, ProviderQuotaWindow, ProviderResetCredit, ProviderResetCreditResult,
-        ProviderResetCredits, RotateCredential, StartAuthorization,
+        ProviderResetCredits, ProviderUsageStatistics, ProviderUsageStatisticsDay,
+        ProviderUsageStatisticsModel, ProviderUsageStatisticsRequest,
+        ProviderUsageStatisticsSummary, ProviderUsageStatisticsTokens, RotateCredential,
+        StartAuthorization,
     },
 };
 use gateway_core::{
@@ -58,6 +61,8 @@ const MAX_ID_TOKEN_BYTES: usize = 16 * 1024;
 const MAX_CALLBACK_URL_BYTES: usize = 64 * 1024;
 const MAX_ACCOUNT_DELETE_BATCH: usize = 200;
 const MAX_ACCOUNT_GROUP_BATCH: usize = 1000;
+const MAX_USAGE_CYCLE_OFFSET: i8 = 8;
+const MAX_UTC_OFFSET_MINUTES: i16 = 14 * 60;
 
 /// 账号列表查询参数。
 #[derive(Debug, Clone, Default, Deserialize)]
@@ -420,6 +425,35 @@ impl AccountIdQuery {
     }
 }
 
+/// 官方每日用量统计查询。
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct AccountUsageStatisticsQuery {
+    pub account_id: String,
+    pub cycle_offset: Option<i8>,
+    pub utc_offset_minutes: Option<i16>,
+}
+
+impl AccountUsageStatisticsQuery {
+    pub fn into_request(self) -> Result<ProviderUsageStatisticsRequest, WireValidationError> {
+        require_account_id(&self.account_id, "accountId")?;
+        let cycle_offset = self.cycle_offset.unwrap_or_default();
+        if !(-MAX_USAGE_CYCLE_OFFSET..=0).contains(&cycle_offset) {
+            return Err(WireValidationError::new("cycleOffset"));
+        }
+        let utc_offset_minutes = self.utc_offset_minutes.unwrap_or_default();
+        if !(-MAX_UTC_OFFSET_MINUTES..=MAX_UTC_OFFSET_MINUTES).contains(&utc_offset_minutes) {
+            return Err(WireValidationError::new("utcOffsetMinutes"));
+        }
+        Ok(ProviderUsageStatisticsRequest {
+            account_id: ProviderAccountId::new(self.account_id)
+                .map_err(|_| WireValidationError::new("accountId"))?,
+            cycle_offset,
+            utc_offset_minutes,
+        })
+    }
+}
+
 /// 敏感导出的固定 query；IDs 使用逗号分隔，禁止隐式导出全部账号。
 #[derive(Debug, Clone, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -587,6 +621,185 @@ pub struct AccountQuotaData {
     pub account: AccountView,
 }
 
+/// Provider 官方每日用量统计响应。
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountUsageStatisticsData {
+    pub mode: String,
+    pub cycle: AccountUsageStatisticsCycleView,
+    pub summary: AccountUsageStatisticsSummaryView,
+    pub models: Vec<AccountUsageStatisticsModelView>,
+    pub daily: Vec<AccountUsageStatisticsDayView>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountUsageStatisticsCycleView {
+    pub offset: i8,
+    pub start_at: String,
+    pub end_at: String,
+    pub window_seconds: u64,
+    pub used_percent: Option<f64>,
+    pub is_current: bool,
+    pub can_go_previous: bool,
+    pub can_go_next: bool,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountUsageStatisticsTokensView {
+    pub uncached_input: u64,
+    pub cached_input: u64,
+    pub output: u64,
+    pub total: u64,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountUsageStatisticsCostView {
+    pub currency: String,
+    pub amount: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountUsageStatisticsSummaryView {
+    pub tokens: AccountUsageStatisticsTokensView,
+    pub estimated_cost: Option<AccountUsageStatisticsCostView>,
+    pub projected_tokens: Option<u64>,
+    pub projected_cost: Option<AccountUsageStatisticsCostView>,
+    pub day_count: u32,
+    pub has_unknown_pricing: bool,
+    pub has_missing_token_data: bool,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountUsageStatisticsModelView {
+    pub key: String,
+    pub model: String,
+    pub service_tier: String,
+    pub credit_share: Option<f64>,
+    pub quota_share: Option<f64>,
+    pub tokens: AccountUsageStatisticsTokensView,
+    pub estimated_cost: Option<AccountUsageStatisticsCostView>,
+    pub has_unknown_pricing: bool,
+    pub has_estimated_allocation: bool,
+    pub has_rate_fallback: bool,
+    pub has_missing_token_data: bool,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountUsageStatisticsDayView {
+    pub date: String,
+    pub credit_share: Option<f64>,
+    pub tokens: AccountUsageStatisticsTokensView,
+    pub estimated_cost: Option<AccountUsageStatisticsCostView>,
+    pub has_unknown_pricing: bool,
+    pub has_missing_token_data: bool,
+    pub is_boundary_day: bool,
+}
+
+impl From<ProviderUsageStatistics> for AccountUsageStatisticsData {
+    fn from(statistics: ProviderUsageStatistics) -> Self {
+        Self {
+            mode: statistics.mode.as_str().to_owned(),
+            cycle: AccountUsageStatisticsCycleView {
+                offset: statistics.cycle.offset,
+                start_at: statistics.cycle.start_at.to_rfc3339(),
+                end_at: statistics.cycle.end_at.to_rfc3339(),
+                window_seconds: statistics.cycle.window_seconds,
+                used_percent: statistics.cycle.used_percent,
+                is_current: statistics.cycle.is_current,
+                can_go_previous: statistics.cycle.can_go_previous,
+                can_go_next: statistics.cycle.can_go_next,
+            },
+            summary: account_usage_statistics_summary_view(statistics.summary),
+            models: statistics
+                .models
+                .into_iter()
+                .map(account_usage_statistics_model_view)
+                .collect(),
+            daily: statistics
+                .daily
+                .into_iter()
+                .map(account_usage_statistics_day_view)
+                .collect(),
+        }
+    }
+}
+
+fn account_usage_statistics_tokens_view(
+    tokens: ProviderUsageStatisticsTokens,
+) -> AccountUsageStatisticsTokensView {
+    AccountUsageStatisticsTokensView {
+        uncached_input: tokens.uncached_input,
+        cached_input: tokens.cached_input,
+        output: tokens.output,
+        total: tokens.total,
+    }
+}
+
+fn account_usage_statistics_cost_view(
+    cost: gateway_admin::model::observability::CurrencyCost,
+) -> AccountUsageStatisticsCostView {
+    AccountUsageStatisticsCostView {
+        currency: cost.currency,
+        amount: cost.amount.to_string(),
+    }
+}
+
+fn account_usage_statistics_summary_view(
+    summary: ProviderUsageStatisticsSummary,
+) -> AccountUsageStatisticsSummaryView {
+    AccountUsageStatisticsSummaryView {
+        tokens: account_usage_statistics_tokens_view(summary.tokens),
+        estimated_cost: summary
+            .estimated_cost
+            .map(account_usage_statistics_cost_view),
+        projected_tokens: summary.projected_tokens,
+        projected_cost: summary
+            .projected_cost
+            .map(account_usage_statistics_cost_view),
+        day_count: summary.day_count,
+        has_unknown_pricing: summary.has_unknown_pricing,
+        has_missing_token_data: summary.has_missing_token_data,
+    }
+}
+
+fn account_usage_statistics_model_view(
+    model: ProviderUsageStatisticsModel,
+) -> AccountUsageStatisticsModelView {
+    AccountUsageStatisticsModelView {
+        key: model.key,
+        model: model.model,
+        service_tier: model.service_tier.as_str().to_owned(),
+        credit_share: model.credit_share,
+        quota_share: model.quota_share,
+        tokens: account_usage_statistics_tokens_view(model.tokens),
+        estimated_cost: model.estimated_cost.map(account_usage_statistics_cost_view),
+        has_unknown_pricing: model.has_unknown_pricing,
+        has_estimated_allocation: model.has_estimated_allocation,
+        has_rate_fallback: model.has_rate_fallback,
+        has_missing_token_data: model.has_missing_token_data,
+    }
+}
+
+fn account_usage_statistics_day_view(
+    day: ProviderUsageStatisticsDay,
+) -> AccountUsageStatisticsDayView {
+    AccountUsageStatisticsDayView {
+        date: day.date.to_string(),
+        credit_share: day.credit_share,
+        tokens: account_usage_statistics_tokens_view(day.tokens),
+        estimated_cost: day.estimated_cost.map(account_usage_statistics_cost_view),
+        has_unknown_pricing: day.has_unknown_pricing,
+        has_missing_token_data: day.has_missing_token_data,
+        is_boundary_day: day.is_boundary_day,
+    }
+}
+
 /// 主动额度重置卡列表响应。
 #[derive(Debug, Clone, Serialize)]
 #[serde(rename_all = "camelCase")]
@@ -1160,6 +1373,10 @@ where
             post(batch_update_accounts::<S>),
         )
         .route("/api/admin/accounts/quota", get(account_quota::<S>))
+        .route(
+            "/api/admin/accounts/usage-statistics",
+            get(account_usage_statistics::<S>),
+        )
         .route(
             "/api/admin/accounts/reset-credits",
             get(account_reset_credits::<S>).post(consume_account_reset_credit::<S>),
@@ -1494,6 +1711,27 @@ where
     Ok(AdminResponse::new(StatusCode::OK, AdminEnvelope::ok(data)))
 }
 
+async fn account_usage_statistics<S>(
+    _auth: AdminAuth,
+    State(state): State<S>,
+    Query(query): Query<AccountUsageStatisticsQuery>,
+) -> Result<impl IntoResponse, AdminError>
+where
+    S: AdminSessionState + Send + Sync,
+{
+    let request = query.into_request().map_err(map_wire_error)?;
+    let result = state
+        .admin_services()
+        .accounts()
+        .usage_statistics(request)
+        .await
+        .map_err(map_service_error)?;
+    Ok(AdminResponse::new(
+        StatusCode::OK,
+        AdminEnvelope::ok(AccountUsageStatisticsData::from(result)),
+    ))
+}
+
 async fn refresh_account_quota<S>(
     _auth: AdminAuth,
     State(state): State<S>,

backend/crates/gateway-api/src/admin/observability/presenter.rs

@@ -142,11 +142,19 @@ pub(crate) fn format_service_tier(service_tier: Option<&str>) -> String {
     match service_tier {
         Some("priority" | "fast") => "Fast".to_owned(),
         Some("flex") => "Flex".to_owned(),
-        Some("default") | None => "Default".to_owned(),
-        Some(other) => other.to_owned(),
+        Some("default" | "standard") | None => "Standard".to_owned(),
+        Some(other) => capitalize_first(other),
     }
 }
 
+fn capitalize_first(value: &str) -> String {
+    let mut chars = value.chars();
+    chars
+        .next()
+        .map(|first| first.to_uppercase().chain(chars).collect())
+        .unwrap_or_default()
+}
+
 pub(crate) fn billing_view(billing: Option<&domain::UsageBilling>) -> Option<BillingView> {
     match billing? {
         domain::UsageBilling::Total { total, .. } => Some(BillingView {

backend/crates/gateway-api/tests/admin/accounts.rs

@@ -70,6 +70,148 @@ mod query {
     }
 }
 
+mod usage_statistics {
+    use std::str::FromStr as _;
+
+    use chrono::{NaiveDate, TimeZone as _, Utc};
+    use gateway_admin::model::{
+        observability::{CurrencyCost, DecimalAmount},
+        provider_credentials::{
+            ProviderUsageStatistics, ProviderUsageStatisticsCycle, ProviderUsageStatisticsDay,
+            ProviderUsageStatisticsMode, ProviderUsageStatisticsModel,
+            ProviderUsageStatisticsServiceTier, ProviderUsageStatisticsSummary,
+            ProviderUsageStatisticsTokens,
+        },
+    };
+    use gateway_api::admin::accounts::{AccountUsageStatisticsData, AccountUsageStatisticsQuery};
+    use serde_json::json;
+
+    fn tokens(total: u64) -> ProviderUsageStatisticsTokens {
+        ProviderUsageStatisticsTokens {
+            uncached_input: total / 4,
+            cached_input: total / 2,
+            output: total / 4,
+            total,
+        }
+    }
+
+    fn usd(amount: &str) -> CurrencyCost {
+        CurrencyCost {
+            currency: "USD".to_owned(),
+            amount: DecimalAmount::from_str(amount).expect("USD amount"),
+        }
+    }
+
+    #[test]
+    fn usage_statistics_query_accepts_only_current_or_bounded_history_offsets() {
+        let query: AccountUsageStatisticsQuery = serde_json::from_value(json!({
+            "accountId": "acct_openai",
+            "cycleOffset": -3,
+            "utcOffsetMinutes": 480
+        }))
+        .expect("decode usage-statistics query");
+        let request = query.into_request().expect("valid cycle offset");
+        assert_eq!(request.cycle_offset, -3);
+        assert_eq!(request.utc_offset_minutes, 480);
+
+        for (cycle_offset, field) in [(-9, "cycleOffset"), (1, "cycleOffset")] {
+            let query: AccountUsageStatisticsQuery = serde_json::from_value(json!({
+                "accountId": "acct_openai",
+                "cycleOffset": cycle_offset
+            }))
+            .expect("decode bounded integer");
+            assert_eq!(
+                query
+                    .into_request()
+                    .expect_err("reject cycle offset")
+                    .field(),
+                field
+            );
+        }
+        assert!(
+            serde_json::from_value::<AccountUsageStatisticsQuery>(json!({
+                "accountId": "acct_openai",
+                "historyCycles": 8
+            }))
+            .is_err()
+        );
+    }
+
+    #[test]
+    fn usage_statistics_response_serializes_calculated_rows_without_raw_documents() {
+        let start_at = Utc
+            .with_ymd_and_hms(2026, 8, 24, 7, 50, 0)
+            .single()
+            .expect("cycle start");
+        let end_at = Utc
+            .with_ymd_and_hms(2026, 8, 31, 7, 50, 0)
+            .single()
+            .expect("cycle end");
+        let response = AccountUsageStatisticsData::from(ProviderUsageStatistics {
+            mode: ProviderUsageStatisticsMode::Personal,
+            cycle: ProviderUsageStatisticsCycle {
+                offset: 0,
+                start_at,
+                end_at,
+                window_seconds: 604_800,
+                used_percent: Some(20.0),
+                is_current: true,
+                can_go_previous: true,
+                can_go_next: false,
+            },
+            summary: ProviderUsageStatisticsSummary {
+                tokens: tokens(100),
+                estimated_cost: Some(usd("1.25")),
+                projected_tokens: Some(500),
+                projected_cost: Some(usd("6.25")),
+                day_count: 1,
+                has_unknown_pricing: false,
+                has_missing_token_data: false,
+            },
+            models: vec![ProviderUsageStatisticsModel {
+                key: "gpt-5.6-sol::standard".to_owned(),
+                model: "gpt-5.6-sol".to_owned(),
+                service_tier: ProviderUsageStatisticsServiceTier::Standard,
+                credit_share: Some(1.0),
+                quota_share: Some(0.2),
+                tokens: tokens(100),
+                estimated_cost: Some(usd("1.25")),
+                has_unknown_pricing: false,
+                has_estimated_allocation: true,
+                has_rate_fallback: false,
+                has_missing_token_data: false,
+            }],
+            daily: vec![ProviderUsageStatisticsDay {
+                date: NaiveDate::from_ymd_opt(2026, 8, 25).expect("report date"),
+                credit_share: Some(1.0),
+                tokens: tokens(100),
+                estimated_cost: Some(usd("1.25")),
+                has_unknown_pricing: false,
+                has_missing_token_data: false,
+                is_boundary_day: true,
+            }],
+        });
+        let value = serde_json::to_value(response).expect("serialize usage statistics");
+
+        assert_eq!(value["cycle"]["offset"], 0);
+        assert_eq!(
+            value["summary"]["estimatedCost"],
+            json!({
+                "currency": "USD",
+                "amount": "1.25"
+            })
+        );
+        assert_eq!(value["models"][0]["serviceTier"], "standard");
+        assert!(value["models"][0].get("mode").is_none());
+        assert_eq!(value["daily"][0]["tokens"]["total"], 100);
+        assert_eq!(value["daily"][0]["isBoundaryDay"], true);
+        assert!(value["cycle"].get("deltaPercent").is_none());
+        assert!(value.get("modelBreakdown").is_none());
+        assert!(value.get("dailyTotals").is_none());
+        assert!(value.get("usage").is_none());
+    }
+}
+
 mod batch_update {
     use gateway_api::admin::accounts::{BatchUpdateAccountsRequest, UpdateAccountRequest};
     use serde_json::json;

backend/crates/gateway-api/tests/admin/observability/response.rs

@@ -832,7 +832,7 @@ async fn usage_route_should_expose_image_and_websocket_facts() {
             upstream_transport: Some("http_sse".to_owned()),
             http_version: Some("h2".to_owned()),
             websocket_pool: Some("reuse".to_owned()),
-            service_tier: Some("priority".to_owned()),
+            service_tier: Some("default".to_owned()),
             provider_metadata_json: Some(
                 serde_json::json!({
                     "effectiveModel": "grok-4.5",
@@ -877,7 +877,7 @@ async fn usage_route_should_expose_image_and_websocket_facts() {
                     output_price_per_million: usd("60.0000"),
                     cache_read_price_per_million: usd("1.0000"),
                     cache_write_price_per_million: usd("12.5000"),
-                    service_tier: Some("priority".to_owned()),
+                    service_tier: Some("default".to_owned()),
                     multiplier_percent: 100,
                 },
             ))),
@@ -933,6 +933,10 @@ async fn usage_route_should_expose_image_and_websocket_facts() {
         value["data"]["items"][0]["billing"]["cacheWritePriceDisplay"],
         "$12.5 / 1M Token"
     );
+    assert_eq!(
+        value["data"]["items"][0]["billing"]["serviceTierDisplay"],
+        "Standard"
+    );
 
     assert_eq!(
         serde_json::json!({
@@ -973,7 +977,7 @@ async fn usage_route_should_expose_image_and_websocket_facts() {
             "routingScope": "groups",
             "routingGroupRefs": ["grp_usage"],
             "routingGroupNamesSnapshot": ["Usage group"],
-            "serviceTier": "priority",
+            "serviceTier": "default",
             "accountId": "acct_snapshot",
             "accountName": "Snapshot Alpha",
             "accountEmail": "alpha@example.invalid",

backend/crates/gateway-core/src/provider_ports/mod.rs

@@ -231,6 +231,32 @@ pub trait ProviderSessionAffinityPort: Send + Sync {
         ttl: Duration,
     ) -> BoxFuture<'a, Result<(), ProviderStoreError>>;
 
+    /// 仅在亲和键尚未绑定时写入候选账号，并返回原子操作后的实际绑定。
+    ///
+    /// 已存在的绑定绝不会被候选账号覆盖；同一根会话的并发首次请求据此收敛到
+    /// 单一账号。TTL 只在首次写入时设置，已有绑定由成功反馈负责刷新。
+    fn claim_or_load<'a>(
+        &'a self,
+        provider_kind: &'a ProviderKind,
+        key: &'a ProviderSessionAffinityKey,
+        candidate_account_id: &'a ProviderAccountId,
+        ttl: Duration,
+    ) -> BoxFuture<'a, Result<ProviderAccountId, ProviderStoreError>>;
+
+    /// 仅当当前绑定等于 `expected_account_id`（或键已过期）时写入新账号，
+    /// 并返回原子操作后的实际绑定。
+    ///
+    /// Provider 用它迁移不可用账号，以及在成功后以 `expected == replacement`
+    /// 刷新 TTL；迟到的旧账号成功不能覆盖较新的会话 winner。
+    fn compare_and_bind<'a>(
+        &'a self,
+        provider_kind: &'a ProviderKind,
+        key: &'a ProviderSessionAffinityKey,
+        expected_account_id: &'a ProviderAccountId,
+        replacement_account_id: &'a ProviderAccountId,
+        ttl: Duration,
+    ) -> BoxFuture<'a, Result<ProviderAccountId, ProviderStoreError>>;
+
     fn clear<'a>(
         &'a self,
         provider_kind: &'a ProviderKind,

backend/crates/gateway-store/src/postgres/provider_accounts/admin_adapter.rs

@@ -682,8 +682,10 @@ impl AccountStore for PgAdminAccountStore {
     ) -> AdminStoreResult<CredentialMutationResult> {
         match command.credential {
             AuthorizationCredentialCommit::Create(credential) => {
-                let account_id = credential.account_id.clone();
-                let result = self
+                let CredentialImportResult {
+                    config_revision,
+                    credential_ids,
+                } = self
                     .commit_prepared_import(
                         PreparedCredentialImport {
                             provider_kind: credential.provider_kind.clone(),
@@ -693,6 +695,14 @@ impl AccountStore for PgAdminAccountStore {
                         "authorize",
                     )
                     .await?;
+                let [account_id]: [CoreProviderAccountId; 1] =
+                    credential_ids.try_into().map_err(|_| {
+                        AdminStoreError::new(
+                            AdminStoreErrorKind::Unavailable,
+                            ENTITY,
+                            "authorization import returned an unexpected account count",
+                        )
+                    })?;
                 let details = self
                     .accounts
                     .load_provider_account(account_id.as_str())
@@ -706,7 +716,7 @@ impl AccountStore for PgAdminAccountStore {
                         )
                     })?;
                 Ok(CredentialMutationResult {
-                    config_revision: result.config_revision,
+                    config_revision,
                     account_id,
                     credential_revision: Some(admin_revision(details.summary.credential_revision)?),
                 })

backend/crates/gateway-store/src/redis/provider_session_affinity.rs

@@ -16,6 +16,24 @@ use super::{namespace, resource_fingerprint};
 
 const MAX_SESSION_AFFINITY_TTL: Duration = Duration::from_secs(24 * 60 * 60);
 
+const CLAIM_OR_LOAD_SCRIPT: &str = r#"
+local current = redis.call('GET', KEYS[1])
+if current then
+  return current
+end
+redis.call('PSETEX', KEYS[1], tonumber(ARGV[2]), ARGV[1])
+return ARGV[1]
+"#;
+
+const COMPARE_AND_BIND_SCRIPT: &str = r#"
+local current = redis.call('GET', KEYS[1])
+if not current or current == ARGV[1] then
+  redis.call('PSETEX', KEYS[1], tonumber(ARGV[3]), ARGV[2])
+  return ARGV[2]
+end
+return current
+"#;
+
 #[derive(Clone)]
 pub struct RedisProviderSessionAffinityRepository {
     connection: ConnectionManager,
@@ -79,11 +97,7 @@ impl ProviderSessionAffinityPort for RedisProviderSessionAffinityRepository {
         ttl: Duration,
     ) -> futures::future::BoxFuture<'a, Result<(), ProviderStoreError>> {
         Box::pin(async move {
-            if ttl.is_zero() || ttl > MAX_SESSION_AFFINITY_TTL {
-                return Err(provider_invalid("validate provider session affinity TTL"));
-            }
-            let ttl_millis = u64::try_from(ttl.as_millis())
-                .map_err(|_| provider_invalid("validate provider session affinity TTL"))?;
+            let ttl_millis = session_affinity_ttl_millis(ttl)?;
             let mut connection = self.connection.clone();
             redis::cmd("PSETEX")
                 .arg(self.key(provider_kind, key)?)
@@ -95,6 +109,50 @@ impl ProviderSessionAffinityPort for RedisProviderSessionAffinityRepository {
         })
     }
 
+    fn claim_or_load<'a>(
+        &'a self,
+        provider_kind: &'a ProviderKind,
+        key: &'a ProviderSessionAffinityKey,
+        candidate_account_id: &'a ProviderAccountId,
+        ttl: Duration,
+    ) -> futures::future::BoxFuture<'a, Result<ProviderAccountId, ProviderStoreError>> {
+        Box::pin(async move {
+            let ttl_millis = session_affinity_ttl_millis(ttl)?;
+            let mut connection = self.connection.clone();
+            let effective_account_id = redis::Script::new(CLAIM_OR_LOAD_SCRIPT)
+                .key(self.key(provider_kind, key)?)
+                .arg(candidate_account_id.as_str())
+                .arg(ttl_millis)
+                .invoke_async::<String>(&mut connection)
+                .await
+                .map_err(|_| provider_unavailable("claim provider session affinity"))?;
+            decode_account_id(effective_account_id)
+        })
+    }
+
+    fn compare_and_bind<'a>(
+        &'a self,
+        provider_kind: &'a ProviderKind,
+        key: &'a ProviderSessionAffinityKey,
+        expected_account_id: &'a ProviderAccountId,
+        replacement_account_id: &'a ProviderAccountId,
+        ttl: Duration,
+    ) -> futures::future::BoxFuture<'a, Result<ProviderAccountId, ProviderStoreError>> {
+        Box::pin(async move {
+            let ttl_millis = session_affinity_ttl_millis(ttl)?;
+            let mut connection = self.connection.clone();
+            let effective_account_id = redis::Script::new(COMPARE_AND_BIND_SCRIPT)
+                .key(self.key(provider_kind, key)?)
+                .arg(expected_account_id.as_str())
+                .arg(replacement_account_id.as_str())
+                .arg(ttl_millis)
+                .invoke_async::<String>(&mut connection)
+                .await
+                .map_err(|_| provider_unavailable("compare provider session affinity"))?;
+            decode_account_id(effective_account_id)
+        })
+    }
+
     fn clear<'a>(
         &'a self,
         provider_kind: &'a ProviderKind,
@@ -112,6 +170,19 @@ impl ProviderSessionAffinityPort for RedisProviderSessionAffinityRepository {
     }
 }
 
+fn session_affinity_ttl_millis(ttl: Duration) -> Result<u64, ProviderStoreError> {
+    if ttl.is_zero() || ttl > MAX_SESSION_AFFINITY_TTL {
+        return Err(provider_invalid("validate provider session affinity TTL"));
+    }
+    u64::try_from(ttl.as_millis())
+        .map_err(|_| provider_invalid("validate provider session affinity TTL"))
+}
+
+fn decode_account_id(account_id: String) -> Result<ProviderAccountId, ProviderStoreError> {
+    ProviderAccountId::new(account_id)
+        .map_err(|_| provider_invalid("decode provider session affinity"))
+}
+
 fn provider_unavailable(operation: &'static str) -> ProviderStoreError {
     ProviderStoreError::new(ProviderStoreErrorKind::Unavailable, operation)
 }

backend/crates/gateway-store/tests/postgres/provider_accounts.rs

@@ -10,7 +10,12 @@ use gateway_admin::{
             UpdateAccount,
         },
         observability::TimeRange,
-        provider_credentials::{CredentialListQuery, CredentialListWindow, CredentialStateFilter},
+        provider_credentials::{
+            AuthorizationCommit, AuthorizationCredentialCommit, AuthorizationMutationTarget,
+            AuthorizationOwnerBinding, CredentialListQuery, CredentialListWindow,
+            CredentialStateFilter, PendingAuthorizationMutation, PreparedCredentialCreate,
+            ProviderDocument,
+        },
     },
     ports::store::AccountStore,
 };
@@ -1326,6 +1331,75 @@ async fn admin_import_updates_the_same_verified_identity_without_rebinding_it()
     database.close().await;
 }
 
+#[tokio::test]
+async fn authorization_create_returns_existing_account_id_when_identity_is_upserted() {
+    let Some(database) = TestDatabase::create("provider_account_authorization_upsert").await else {
+        return;
+    };
+    PgProviderAccountRepository::new(database.pool.clone())
+        .insert_provider_account(account(
+            "acct_authorization_existing",
+            "user-authorization-upsert",
+        ))
+        .await
+        .expect("seed existing authorized identity");
+    let context = MutationContext {
+        actor: MutationActor::System,
+        request_id: "request_authorization_upsert".to_owned(),
+    };
+    let provider_kind = ProviderKind::new("openai").expect("OpenAI Provider kind");
+    let serde_json::Value::Object(provider_material) =
+        json!({ "access_token": "authorized-secret" })
+    else {
+        unreachable!("credential fixture must be an object");
+    };
+
+    let result = PgAdminAccountStore::new(database.pool.clone(), None)
+        .commit_authorization(
+            AuthorizationCommit {
+                pending: PendingAuthorizationMutation::new(
+                    provider_kind.clone(),
+                    AuthorizationMutationTarget::Create {
+                        name: "authorized account".to_owned(),
+                    },
+                    AuthorizationOwnerBinding::from_context(&context),
+                ),
+                credential: AuthorizationCredentialCommit::Create(PreparedCredentialCreate {
+                    account_id: ProviderAccountId::new("acct_authorization_candidate")
+                        .expect("candidate account ID"),
+                    provider_kind,
+                    name: "authorized account".to_owned(),
+                    email: Some("authorized@example.invalid".to_owned()),
+                    upstream_user_id: Some("user-authorization-upsert".to_owned()),
+                    upstream_account_id: None,
+                    plan_type: Some("free".to_owned()),
+                    authentication_kind: "oauth".to_owned(),
+                    provider_material: ProviderDocument::new(OpaqueProviderData::new(
+                        provider_material,
+                    )),
+                    has_refresh_token: true,
+                    access_token_expires_at: Some(Utc::now() + TimeDelta::hours(1)),
+                    next_refresh_at: None,
+                    enabled: true,
+                    credential_state: CredentialState::Ready,
+                    credential_observed_at: Utc::now(),
+                }),
+            },
+            &context,
+        )
+        .await
+        .expect("authorize existing identity");
+
+    assert_eq!(
+        (
+            result.account_id.as_str(),
+            result.credential_revision.map(|revision| revision.get()),
+        ),
+        ("acct_authorization_existing", Some(2)),
+    );
+    database.close().await;
+}
+
 #[tokio::test]
 async fn core_refresh_cas_updates_profile_and_credential_under_one_revision() {
     let Some(database) = TestDatabase::create("provider_account_core_refresh").await else {

backend/crates/gateway-store/tests/redis/provider_session_affinity.rs

@@ -65,6 +65,55 @@ async fn session_affinity_should_overwrite_the_previous_account() {
     );
 }
 
+#[tokio::test]
+async fn session_affinity_claim_should_keep_the_first_account() {
+    let Some((repository, _connection, _namespace)) = affinity_repository().await else {
+        return;
+    };
+    let provider = ProviderKind::new("openai").expect("provider");
+    let key = ProviderSessionAffinityKey::try_new("claim-session").expect("affinity key");
+    let first = ProviderAccountId::new("acct_first").expect("first account");
+    let second = ProviderAccountId::new("acct_second").expect("second account");
+
+    let first_winner = repository
+        .claim_or_load(&provider, &key, &first, Duration::from_secs(60))
+        .await
+        .expect("claim first affinity");
+    let second_winner = repository
+        .claim_or_load(&provider, &key, &second, Duration::from_secs(60))
+        .await
+        .expect("load existing affinity");
+
+    assert_eq!((first_winner, second_winner), (first.clone(), first));
+}
+
+#[tokio::test]
+async fn session_affinity_compare_should_not_replace_a_newer_winner() {
+    let Some((repository, _connection, _namespace)) = affinity_repository().await else {
+        return;
+    };
+    let provider = ProviderKind::new("openai").expect("provider");
+    let key = ProviderSessionAffinityKey::try_new("compare-session").expect("affinity key");
+    let first = ProviderAccountId::new("acct_first").expect("first account");
+    let second = ProviderAccountId::new("acct_second").expect("second account");
+    let stale = ProviderAccountId::new("acct_stale").expect("stale account");
+    repository
+        .bind(&provider, &key, &first, Duration::from_secs(60))
+        .await
+        .expect("seed affinity");
+
+    let migrated = repository
+        .compare_and_bind(&provider, &key, &first, &second, Duration::from_secs(60))
+        .await
+        .expect("migrate expected affinity");
+    let stale_result = repository
+        .compare_and_bind(&provider, &key, &first, &stale, Duration::from_secs(60))
+        .await
+        .expect("reject stale affinity migration");
+
+    assert_eq!((migrated, stale_result), (second.clone(), second));
+}
+
 #[tokio::test]
 async fn session_affinity_should_apply_ttl_and_support_explicit_clear() {
     let Some((repository, mut connection, namespace)) = affinity_repository().await else {

backend/crates/providers/openai/src/admin.rs

@@ -20,7 +20,11 @@ use gateway_admin::model::provider_credentials::{
     PreparedCredentialRotationFacts, ProviderDocument, ProviderExport,
     ProviderExportCredentialInput, ProviderModel, ProviderModels, ProviderQuota,
     ProviderQuotaRequest, ProviderQuotaWindow, ProviderQuotaWindowRole, ProviderResetCredit,
-    ProviderResetCreditResult, ProviderResetCredits, QuotaLocalUsageAttribution,
+    ProviderResetCreditResult, ProviderResetCredits, ProviderUsageStatistics,
+    ProviderUsageStatisticsCycle, ProviderUsageStatisticsDay, ProviderUsageStatisticsMode,
+    ProviderUsageStatisticsModel, ProviderUsageStatisticsRequest,
+    ProviderUsageStatisticsServiceTier, ProviderUsageStatisticsSummary,
+    ProviderUsageStatisticsTokens, QuotaLocalUsageAttribution,
 };
 use gateway_admin::model::{MutationActor, MutationContext, Revision};
 use gateway_admin::ports::provider::{ProviderAdmin, ProviderAdminError, ProviderAdminErrorKind};
@@ -48,8 +52,10 @@ use crate::credential::{
     CodexCredentialQuotaError, CodexCredentialQuotaService, CodexOAuthAdmin, CodexOAuthAdminError,
     CodexOAuthPendingClaimOutcome, CodexOAuthPendingStore, CodexOAuthPendingStoreError,
     CodexPendingAuthorization, CodexQuotaWindow, CodexQuotaWindowKind, CodexQuotaWindowRole,
-    CodexResetCreditsError, CompleteCodexOAuthAuthorization, CompletedCodexOAuthCredential,
-    ExportManagedCodexCredential, StartCodexOAuthAuthorization, StoredCodexPendingAuthorization,
+    CodexResetCreditsError, CodexUsageStatistics, CodexUsageStatisticsError,
+    CodexUsageStatisticsMode, CodexUsageStatisticsServiceTier, CodexUsageStatisticsTokens,
+    CompleteCodexOAuthAuthorization, CompletedCodexOAuthCredential, ExportManagedCodexCredential,
+    StartCodexOAuthAuthorization, StoredCodexPendingAuthorization,
 };
 use crate::credential::{
     CodexCredentialCodec, CodexOAuthSecret, oauth_owner_ref, parse_access_token_expiration,
@@ -443,6 +449,23 @@ impl ProviderAdmin for OpenAiAdminProvider {
         Ok(project_quota(snapshot, &account))
     }
 
+    async fn usage_statistics(
+        &self,
+        request: ProviderUsageStatisticsRequest,
+    ) -> Result<ProviderUsageStatistics, ProviderAdminError> {
+        self.account(&request.account_id).await?;
+        let statistics = self
+            .quota
+            .usage_statistics(
+                &request.account_id,
+                request.cycle_offset,
+                request.utc_offset_minutes,
+            )
+            .await
+            .map_err(map_usage_statistics_error)?;
+        project_usage_statistics(statistics)
+    }
+
     async fn reset_credits(
         &self,
         account_id: &ProviderAccountId,
@@ -800,6 +823,98 @@ fn project_quota_snapshot(snapshot: CodexAccountQuotaSnapshot) -> ProviderQuota
     }
 }
 
+fn project_usage_statistics(
+    statistics: CodexUsageStatistics,
+) -> Result<ProviderUsageStatistics, ProviderAdminError> {
+    let models = statistics
+        .models
+        .into_iter()
+        .map(|model| {
+            Ok(ProviderUsageStatisticsModel {
+                key: model.key,
+                model: model.model,
+                service_tier: project_usage_service_tier(model.service_tier),
+                credit_share: model.credit_share,
+                quota_share: model.quota_share,
+                tokens: project_usage_tokens(model.tokens),
+                estimated_cost: model.estimated_cost.map(currency_cost).transpose()?,
+                has_unknown_pricing: model.has_unknown_pricing,
+                has_estimated_allocation: model.has_estimated_allocation,
+                has_rate_fallback: model.has_rate_fallback,
+                has_missing_token_data: model.has_missing_token_data,
+            })
+        })
+        .collect::<Result<Vec<_>, ProviderAdminError>>()?;
+    let daily = statistics
+        .daily
+        .into_iter()
+        .map(|day| {
+            Ok(ProviderUsageStatisticsDay {
+                date: day.date,
+                credit_share: day.credit_share,
+                tokens: project_usage_tokens(day.tokens),
+                estimated_cost: day.estimated_cost.map(currency_cost).transpose()?,
+                has_unknown_pricing: day.has_unknown_pricing,
+                has_missing_token_data: day.has_missing_token_data,
+                is_boundary_day: day.is_boundary_day,
+            })
+        })
+        .collect::<Result<Vec<_>, ProviderAdminError>>()?;
+    Ok(ProviderUsageStatistics {
+        mode: match statistics.mode {
+            CodexUsageStatisticsMode::Workspace => ProviderUsageStatisticsMode::Workspace,
+            CodexUsageStatisticsMode::Personal => ProviderUsageStatisticsMode::Personal,
+        },
+        cycle: ProviderUsageStatisticsCycle {
+            offset: statistics.cycle.offset,
+            start_at: statistics.cycle.start_at,
+            end_at: statistics.cycle.end_at,
+            window_seconds: statistics.cycle.window_seconds,
+            used_percent: statistics.cycle.used_percent,
+            is_current: statistics.cycle.is_current,
+            can_go_previous: statistics.cycle.can_go_previous,
+            can_go_next: statistics.cycle.can_go_next,
+        },
+        summary: ProviderUsageStatisticsSummary {
+            tokens: project_usage_tokens(statistics.summary.tokens),
+            estimated_cost: statistics
+                .summary
+                .estimated_cost
+                .map(currency_cost)
+                .transpose()?,
+            projected_tokens: statistics.summary.projected_tokens,
+            projected_cost: statistics
+                .summary
+                .projected_cost
+                .map(currency_cost)
+                .transpose()?,
+            day_count: statistics.summary.day_count,
+            has_unknown_pricing: statistics.summary.has_unknown_pricing,
+            has_missing_token_data: statistics.summary.has_missing_token_data,
+        },
+        models,
+        daily,
+    })
+}
+
+const fn project_usage_tokens(tokens: CodexUsageStatisticsTokens) -> ProviderUsageStatisticsTokens {
+    ProviderUsageStatisticsTokens {
+        uncached_input: tokens.uncached_input,
+        cached_input: tokens.cached_input,
+        output: tokens.output,
+        total: tokens.total,
+    }
+}
+
+const fn project_usage_service_tier(
+    service_tier: CodexUsageStatisticsServiceTier,
+) -> ProviderUsageStatisticsServiceTier {
+    match service_tier {
+        CodexUsageStatisticsServiceTier::Standard => ProviderUsageStatisticsServiceTier::Standard,
+        CodexUsageStatisticsServiceTier::Fast => ProviderUsageStatisticsServiceTier::Fast,
+    }
+}
+
 fn project_reset_credits(
     credits: crate::transport::CodexRateLimitResetCredits,
 ) -> ProviderResetCredits {
@@ -1397,6 +1512,45 @@ fn map_quota_error(error: CodexCredentialQuotaError) -> ProviderAdminError {
     })
 }
 
+fn map_usage_statistics_error(error: CodexUsageStatisticsError) -> ProviderAdminError {
+    use CodexUsageStatisticsError as Error;
+
+    match error {
+        Error::InvalidRequest | Error::InvalidCredentialData => {
+            provider_admin_error(ProviderAdminErrorKind::Invalid)
+        }
+        Error::NotFound => provider_admin_error(ProviderAdminErrorKind::NotFound),
+        Error::Store { .. } | Error::TransportUnavailable => {
+            provider_admin_error(ProviderAdminErrorKind::Unavailable)
+        }
+        Error::QuotaWindowUnavailable => provider_admin_error(ProviderAdminErrorKind::Conflict)
+            .with_message("OpenAI did not expose a resettable quota window for usage statistics"),
+        Error::CredentialRefreshRequired { upstream_body } => {
+            let mut error = provider_admin_error(ProviderAdminErrorKind::CredentialRefreshRequired);
+            if let Some(body) = upstream_body {
+                error = error.with_message(format!(
+                    "OpenAI usage-statistics upstream returned HTTP 401: {}",
+                    bounded_upstream_body(&body)
+                ));
+            }
+            error
+        }
+        Error::Upstream {
+            status,
+            body,
+            retry_after_seconds,
+        } => {
+            let retry_after = retry_after_seconds
+                .map(|seconds| format!("; retry-after={seconds}s"))
+                .unwrap_or_default();
+            provider_admin_error(ProviderAdminErrorKind::BadGateway).with_message(format!(
+                "OpenAI usage-statistics upstream returned HTTP {status}{retry_after}: {}",
+                bounded_upstream_body(&body)
+            ))
+        }
+    }
+}
+
 fn map_reset_credits_error(error: CodexResetCreditsError) -> ProviderAdminError {
     use CodexResetCreditsError as Error;
 

backend/crates/providers/openai/src/config.rs

@@ -155,8 +155,6 @@ impl CodexApiConfig {
 pub struct CodexWebSocketPoolSettings {
     pub enabled: bool,
     pub max_age_ms: u64,
-    pub max_per_account: usize,
-    pub max_total: usize,
     pub max_connecting: usize,
     pub initial_event_timeout_ms: u64,
 }
@@ -166,8 +164,6 @@ impl Default for CodexWebSocketPoolSettings {
         Self {
             enabled: true,
             max_age_ms: 55 * 60 * 1000,
-            max_per_account: 8,
-            max_total: 64,
             max_connecting: 8,
             initial_event_timeout_ms: 20_000,
         }
@@ -176,12 +172,7 @@ impl Default for CodexWebSocketPoolSettings {
 
 impl CodexWebSocketPoolSettings {
     fn validate(&self) -> Result<(), OpenAiConfigError> {
-        if self.max_age_ms == 0
-            || self.max_per_account == 0
-            || self.max_total == 0
-            || self.max_connecting == 0
-            || self.max_connecting > self.max_total
-        {
+        if self.max_age_ms == 0 || self.max_connecting == 0 {
             return Err(OpenAiConfigError::InvalidField("openai.ws_pool"));
         }
         Ok(())
@@ -191,8 +182,6 @@ impl CodexWebSocketPoolSettings {
         CodexWebSocketPoolConfig {
             enabled: self.enabled,
             max_age: Duration::from_millis(self.max_age_ms),
-            max_per_account: self.max_per_account,
-            max_total: self.max_total,
             max_connecting: self.max_connecting,
             initial_event_timeout: (self.initial_event_timeout_ms != 0)
                 .then(|| Duration::from_millis(self.initial_event_timeout_ms)),

backend/crates/providers/openai/src/credential/affinity.rs

@@ -1,4 +1,4 @@
-//! OpenAI 会话锚点到 Store 不透明亲和键的单向派生。
+//! OpenAI 根会话锚点到 Store 不透明账号亲和键的单向派生。
 
 use gateway_core::policy::ClientApiKeyId;
 use gateway_core::provider_ports::ProviderSessionAffinityKey;
@@ -11,34 +11,8 @@ pub(crate) fn derive_codex_session_affinity_key(
     request: &CodexResponsesRequest,
     client_api_key_id: &ClientApiKeyId,
 ) -> Option<ProviderSessionAffinityKey> {
-    let session_key = if let Some(conversation_id) = request
-        .local_conversation_id
-        .as_deref()
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-    {
-        if let Ok(key) = ProviderSessionAffinityKey::try_new(conversation_id.to_owned()) {
-            Some(key)
-        } else {
-            opaque_affinity_key("local-conversation", conversation_id)
-        }
-    } else {
-        let (domain, value) = derive_conversation_anchor(request)?;
-        opaque_affinity_key(domain, &value)
-    };
-
-    let session_discriminator = request.subagent_kind();
-    let session_key =
-        session_key.and_then(|session_key| match session_discriminator.as_deref() {
-            None => Some(session_key),
-            Some(discriminator) => {
-                // 仅扩展原会话锚点的键空间；后续查找、绑定和调度仍使用同一套亲和逻辑。
-                opaque_affinity_key(
-                    "subagent-session",
-                    &format!("{discriminator}\0{}", session_key.expose_to_store()),
-                )
-            }
-        })?;
+    let (domain, value) = derive_account_affinity_anchor(request)?;
+    let session_key = opaque_affinity_key(domain, &value)?;
     opaque_affinity_key(
         "client-session",
         &format!(
@@ -49,6 +23,33 @@ pub(crate) fn derive_codex_session_affinity_key(
     )
 }
 
+/// 账号选择优先使用根会话事实；`local_conversation_id` 仍可按 child thread 隔离
+/// WebSocket 与 continuation 状态，但 child 身份不再拆分账号首选项。账号不可调度时
+/// selector 仍可按既有策略切换，并由 request scope 清理账号绑定状态。
+fn derive_account_affinity_anchor(
+    request: &CodexResponsesRequest,
+) -> Option<(&'static str, String)> {
+    non_empty(request.client_session_id.as_deref())
+        .map(|value| ("root-session", value.to_owned()))
+        .or_else(|| {
+            non_empty(request.client_conversation_id.as_deref())
+                .map(|value| ("root-conversation", value.to_owned()))
+        })
+        .or_else(|| {
+            request
+                .explicit_prompt_cache_key
+                .then(|| request.prompt_cache_key())
+                .flatten()
+                .and_then(|value| non_empty(Some(value)))
+                .map(|value| ("root-prompt-cache", value.to_owned()))
+        })
+        .or_else(|| {
+            non_empty(request.local_conversation_id.as_deref())
+                .map(|value| ("local-conversation", value.to_owned()))
+        })
+        .or_else(|| derive_conversation_anchor(request))
+}
+
 fn opaque_affinity_key(domain: &str, value: &str) -> Option<ProviderSessionAffinityKey> {
     let mut hasher = Sha256::new();
     hasher.update(b"codex-session-affinity-v1\0");

backend/crates/providers/openai/src/credential/mod.rs

@@ -47,7 +47,10 @@ pub use oauth::{
 pub use quota::{
     CodexAccountQuotaSnapshot, CodexCredentialQuotaError, CodexCredentialQuotaService,
     CodexQuotaFact, CodexQuotaRefreshPolicy, CodexQuotaSyncSummary, CodexQuotaWindow,
-    CodexQuotaWindowKind, CodexQuotaWindowRole, CodexResetCreditsError, parse_codex_quota_usage,
+    CodexQuotaWindowKind, CodexQuotaWindowRole, CodexResetCreditsError, CodexUsageStatistics,
+    CodexUsageStatisticsCycle, CodexUsageStatisticsDay, CodexUsageStatisticsError,
+    CodexUsageStatisticsMode, CodexUsageStatisticsModel, CodexUsageStatisticsServiceTier,
+    CodexUsageStatisticsSummary, CodexUsageStatisticsTokens, parse_codex_quota_usage,
 };
 pub use refresh::{
     CodexCredentialRefreshError, CodexCredentialRefreshOutcome, CodexCredentialRefreshService,

backend/crates/providers/openai/src/credential/quota/mod.rs

@@ -7,17 +7,23 @@
 mod document;
 pub(crate) mod evidence;
 pub(crate) mod snapshot;
+mod usage_statistics;
 
 pub use snapshot::{
     CodexAccountQuotaSnapshot, CodexQuotaFact, CodexQuotaWindow, CodexQuotaWindowKind,
     CodexQuotaWindowRole, parse_codex_quota_usage,
 };
+pub use usage_statistics::{
+    CodexUsageStatistics, CodexUsageStatisticsCycle, CodexUsageStatisticsDay,
+    CodexUsageStatisticsMode, CodexUsageStatisticsModel, CodexUsageStatisticsServiceTier,
+    CodexUsageStatisticsSummary, CodexUsageStatisticsTokens,
+};
 
 use std::collections::{BTreeMap, BTreeSet, HashMap};
 use std::sync::{Arc, RwLock};
 use std::time::{Duration, Instant, SystemTime};
 
-use chrono::Utc;
+use chrono::{DateTime, FixedOffset, Utc};
 use gateway_core::engine::credential::{
     AccountErrorReason, AccountQuotaSignals, CredentialRevision, CredentialState,
     OpaqueProviderData, ProviderAccount, ProviderAccountId, ProviderAccountStore,
@@ -36,6 +42,7 @@ use tokio::sync::Mutex;
 use uuid::Uuid;
 
 use crate::transport::profile::CodexWireProfileState;
+use crate::transport::usage_statistics::CodexDailyUsageReport;
 use crate::transport::{
     CodexBackendClient, CodexClientError, CodexRateLimitResetCredits,
     CodexRateLimitResetCreditsConsumeResult, CodexRequestContext,
@@ -43,6 +50,7 @@ use crate::transport::{
 
 use super::agent_identity::{CodexAgentIdentityTaskService, PreparedCodexRuntimeCredential};
 use super::repository::{CodexCredentialRepository, CredentialRepositoryError};
+use super::types::CODEX_AUTHENTICATION_KIND_OAUTH;
 use document::{
     DEFAULT_CODEX_LIMIT_ID, RATE_LIMITS_BY_LIMIT_ID, RateLimitSnapshotsByLimitId,
     canonicalize_rate_limit_document,
@@ -144,6 +152,57 @@ pub enum CodexResetCreditsError {
     ConsumeResultUnknown,
 }
 
+/// 官方每日用量统计查询失败。
+#[derive(Error)]
+pub enum CodexUsageStatisticsError {
+    #[error("Codex usage-statistics request is invalid")]
+    InvalidRequest,
+    #[error("Codex usage-statistics credential data is invalid")]
+    InvalidCredentialData,
+    #[error("Codex OAuth access token must be refreshed before querying usage statistics")]
+    CredentialRefreshRequired { upstream_body: Option<String> },
+    #[error("Codex usage-statistics account was not found")]
+    NotFound,
+    #[error("provider account store is unavailable: {detail}")]
+    Store { detail: String },
+    #[error("Codex usage-statistics quota window is unavailable")]
+    QuotaWindowUnavailable,
+    #[error("Codex usage-statistics upstream returned HTTP {status}")]
+    Upstream {
+        status: u16,
+        body: String,
+        retry_after_seconds: Option<u64>,
+    },
+    #[error("Codex usage-statistics query transport is unavailable")]
+    TransportUnavailable,
+}
+
+impl std::fmt::Debug for CodexUsageStatisticsError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::InvalidRequest => formatter.write_str("InvalidRequest"),
+            Self::InvalidCredentialData => formatter.write_str("InvalidCredentialData"),
+            Self::CredentialRefreshRequired { .. } => {
+                formatter.write_str("CredentialRefreshRequired { upstream_body: <redacted> }")
+            }
+            Self::NotFound => formatter.write_str("NotFound"),
+            Self::Store { .. } => formatter.write_str("Store { detail: <redacted> }"),
+            Self::QuotaWindowUnavailable => formatter.write_str("QuotaWindowUnavailable"),
+            Self::Upstream {
+                status,
+                retry_after_seconds,
+                ..
+            } => formatter
+                .debug_struct("Upstream")
+                .field("status", status)
+                .field("body", &"<redacted>")
+                .field("retry_after_seconds", retry_after_seconds)
+                .finish(),
+            Self::TransportUnavailable => formatter.write_str("TransportUnavailable"),
+        }
+    }
+}
+
 impl std::fmt::Debug for CodexResetCreditsError {
     fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         match self {
@@ -246,6 +305,26 @@ enum ResetCreditAttemptError {
     Upstream(CodexClientError),
 }
 
+enum DailyUsageAttemptError {
+    InvalidCredential,
+    Upstream(CodexClientError),
+}
+
+enum DailyUsageFetchError {
+    InvalidCredential,
+    Recovery,
+    Upstream {
+        prepared: Box<PreparedCodexRuntimeCredential>,
+        error: CodexClientError,
+    },
+}
+
+struct FetchedDailyUsage {
+    mode: CodexUsageStatisticsMode,
+    model_breakdown: Value,
+    daily_totals: Option<Value>,
+}
+
 impl CodexQuotaSchedulingProjection {
     fn invalidate(&self, account_ids: &[ProviderAccountId]) {
         let mut state = self
@@ -509,6 +588,114 @@ impl CodexCredentialQuotaService {
         result.map_err(|error| map_reset_credit_attempt_error(error, &prepared, false))
     }
 
+    /// 查询当前账号的官方每日用量报表，并把报表范围锚定到最接近七天的额度窗口。
+    pub async fn usage_statistics(
+        &self,
+        account_id: &ProviderAccountId,
+        cycle_offset: i8,
+        utc_offset_minutes: i16,
+    ) -> Result<CodexUsageStatistics, CodexUsageStatisticsError> {
+        const MAX_CYCLE_OFFSET: u8 = 8;
+        const MAX_UTC_OFFSET_MINUTES: i16 = 14 * 60;
+        const TARGET_WINDOW_SECONDS: u64 = 7 * 24 * 60 * 60;
+
+        if !(-(MAX_CYCLE_OFFSET as i8)..=0).contains(&cycle_offset)
+            || !(-MAX_UTC_OFFSET_MINUTES..=MAX_UTC_OFFSET_MINUTES).contains(&utc_offset_minutes)
+        {
+            return Err(CodexUsageStatisticsError::InvalidRequest);
+        }
+        let account = self
+            .store
+            .get_account(account_id)
+            .await
+            .map_err(|error| CodexUsageStatisticsError::Store {
+                detail: error.to_string(),
+            })?
+            .filter(|account| account.provider().as_str() == "openai")
+            .ok_or(CodexUsageStatisticsError::NotFound)?;
+        let observed_at = SystemTime::now();
+        if !access_token_is_current(&account, observed_at) {
+            return Err(CodexUsageStatisticsError::CredentialRefreshRequired {
+                upstream_body: None,
+            });
+        }
+        let client = CodexBackendClient::new(
+            self.http.clone(),
+            self.base_url.clone(),
+            self.profile.clone(),
+        );
+        let FetchedCodexQuota { account, value } = self
+            .fetch_usage_with_recovery(&client, &account)
+            .await
+            .map_err(map_statistics_quota_fetch_error)?;
+        let snapshot = parse_account_quota_snapshot(
+            account.id().clone(),
+            account.revision(),
+            observed_at,
+            &value,
+        )
+        .map_err(|_| CodexUsageStatisticsError::InvalidCredentialData)?;
+        let window = snapshot
+            .windows()
+            .iter()
+            .filter(|window| window.is_account_wide())
+            .filter_map(|window| {
+                Some((
+                    window,
+                    window.window_seconds()?.abs_diff(TARGET_WINDOW_SECONDS),
+                ))
+            })
+            .min_by_key(|(_, distance)| *distance)
+            .map(|(window, _)| window)
+            .ok_or(CodexUsageStatisticsError::QuotaWindowUnavailable)?;
+        let window_seconds = window
+            .window_seconds()
+            .filter(|seconds| *seconds > 0)
+            .ok_or(CodexUsageStatisticsError::QuotaWindowUnavailable)?;
+        let end_at = window
+            .reset_at()
+            .ok_or(CodexUsageStatisticsError::QuotaWindowUnavailable)?;
+        let window_delta = chrono::TimeDelta::seconds(
+            i64::try_from(window_seconds)
+                .map_err(|_| CodexUsageStatisticsError::QuotaWindowUnavailable)?,
+        );
+        let current_start_at = end_at - window_delta;
+        let timezone = FixedOffset::east_opt(i32::from(utc_offset_minutes) * 60)
+            .ok_or(CodexUsageStatisticsError::InvalidRequest)?;
+        let now = DateTime::<Utc>::from(observed_at);
+        let period = usage_statistics::statistics_period(
+            current_start_at,
+            end_at,
+            window_seconds,
+            cycle_offset,
+            timezone,
+            now,
+        )
+        .ok_or(CodexUsageStatisticsError::InvalidRequest)?;
+        let fetched = self
+            .fetch_daily_usage_with_recovery(
+                &client,
+                &account,
+                period.query_start_date,
+                period.query_end_date,
+            )
+            .await
+            .map_err(map_daily_usage_fetch_error)?;
+
+        Ok(usage_statistics::build_usage_statistics(
+            usage_statistics::BuildUsageStatistics {
+                mode: fetched.mode,
+                period,
+                timezone,
+                current_used_percent: window.used_percent(),
+                now,
+                model_breakdown: &fetched.model_breakdown,
+                daily_totals: fetched.daily_totals.as_ref(),
+                max_cycle_offset: MAX_CYCLE_OFFSET,
+            },
+        ))
+    }
+
     /// 消费一张主动额度重置卡。相同账号在本进程内串行，且不做传输重试。
     pub async fn consume_reset_credit(
         &self,
@@ -1262,6 +1449,171 @@ impl CodexCredentialQuotaService {
             }
         }
     }
+
+    async fn fetch_daily_usage_with_recovery(
+        &self,
+        client: &CodexBackendClient,
+        account: &ProviderAccount,
+        start_date: chrono::NaiveDate,
+        end_date: chrono::NaiveDate,
+    ) -> Result<FetchedDailyUsage, DailyUsageFetchError> {
+        let mut prepared = self
+            .agent_identity
+            .prepare(account)
+            .await
+            .map_err(|_| DailyUsageFetchError::InvalidCredential)?;
+        let mut result = fetch_daily_usage_once(client, &prepared, start_date, end_date).await;
+        if let Err(DailyUsageAttemptError::Upstream(error)) = &result
+            && let Some(recovered) = self
+                .agent_identity
+                .recover_after_rejected_task(
+                    prepared.account.id(),
+                    &prepared.credential.authentication,
+                    error,
+                )
+                .await
+                .map_err(|_| DailyUsageFetchError::Recovery)?
+        {
+            prepared = recovered;
+            result = fetch_daily_usage_once(client, &prepared, start_date, end_date).await;
+        }
+        match result {
+            Ok(value) => Ok(value),
+            Err(DailyUsageAttemptError::InvalidCredential) => {
+                Err(DailyUsageFetchError::InvalidCredential)
+            }
+            Err(DailyUsageAttemptError::Upstream(error)) => Err(DailyUsageFetchError::Upstream {
+                prepared: Box::new(prepared),
+                error,
+            }),
+        }
+    }
+}
+
+async fn fetch_daily_usage_once(
+    client: &CodexBackendClient,
+    prepared: &PreparedCodexRuntimeCredential,
+    start_date: chrono::NaiveDate,
+    end_date: chrono::NaiveDate,
+) -> Result<FetchedDailyUsage, DailyUsageAttemptError> {
+    let authorization = prepared
+        .credential
+        .authentication
+        .authorization_header(Utc::now())
+        .map_err(|_| DailyUsageAttemptError::InvalidCredential)?;
+    let workspace_request_id = format!("usage_statistics_{}", Uuid::now_v7().simple());
+    let workspace = client
+        .fetch_daily_usage(
+            CodexRequestContext::auxiliary(
+                authorization.expose_secret(),
+                prepared.account.upstream_account_id(),
+                &workspace_request_id,
+                None,
+            ),
+            CodexDailyUsageReport::WorkspaceModelTokens,
+            start_date,
+            end_date,
+        )
+        .await;
+    match workspace {
+        Ok(model_breakdown) => {
+            return Ok(FetchedDailyUsage {
+                mode: CodexUsageStatisticsMode::Workspace,
+                model_breakdown,
+                daily_totals: None,
+            });
+        }
+        Err(error) if workspace_is_unavailable_for_account(&error) => {}
+        Err(error) => return Err(DailyUsageAttemptError::Upstream(error)),
+    }
+
+    let model_request_id = format!("usage_statistics_{}", Uuid::now_v7().simple());
+    let totals_request_id = format!("usage_statistics_{}", Uuid::now_v7().simple());
+    let model_breakdown = client.fetch_daily_usage(
+        CodexRequestContext::auxiliary(
+            authorization.expose_secret(),
+            prepared.account.upstream_account_id(),
+            &model_request_id,
+            None,
+        ),
+        CodexDailyUsageReport::PersonalModelCredits,
+        start_date,
+        end_date,
+    );
+    let daily_totals = client.fetch_daily_usage(
+        CodexRequestContext::auxiliary(
+            authorization.expose_secret(),
+            prepared.account.upstream_account_id(),
+            &totals_request_id,
+            None,
+        ),
+        CodexDailyUsageReport::PersonalTokenTotals,
+        start_date,
+        end_date,
+    );
+    let (model_breakdown, daily_totals) = tokio::try_join!(model_breakdown, daily_totals)
+        .map_err(DailyUsageAttemptError::Upstream)?;
+    Ok(FetchedDailyUsage {
+        mode: CodexUsageStatisticsMode::Personal,
+        model_breakdown,
+        daily_totals: Some(daily_totals),
+    })
+}
+
+fn workspace_is_unavailable_for_account(error: &CodexClientError) -> bool {
+    matches!(
+        error,
+        CodexClientError::Upstream { status, body, .. }
+            if *status == reqwest::StatusCode::BAD_REQUEST
+                && body.to_ascii_lowercase().contains("no active workspace")
+    )
+}
+
+fn map_statistics_quota_fetch_error(error: CodexQuotaFetchError) -> CodexUsageStatisticsError {
+    match error {
+        CodexQuotaFetchError::InvalidCredential => CodexUsageStatisticsError::InvalidCredentialData,
+        CodexQuotaFetchError::Recovery => CodexUsageStatisticsError::TransportUnavailable,
+        CodexQuotaFetchError::Upstream { account, error } => map_statistics_client_error(
+            error,
+            account.authentication_kind() == CODEX_AUTHENTICATION_KIND_OAUTH,
+        ),
+    }
+}
+
+fn map_daily_usage_fetch_error(error: DailyUsageFetchError) -> CodexUsageStatisticsError {
+    match error {
+        DailyUsageFetchError::InvalidCredential => CodexUsageStatisticsError::InvalidCredentialData,
+        DailyUsageFetchError::Recovery => CodexUsageStatisticsError::TransportUnavailable,
+        DailyUsageFetchError::Upstream { prepared, error } => {
+            map_statistics_client_error(error, prepared.credential.authentication.oauth().is_some())
+        }
+    }
+}
+
+fn map_statistics_client_error(
+    error: CodexClientError,
+    credential_can_refresh: bool,
+) -> CodexUsageStatisticsError {
+    match error {
+        CodexClientError::Upstream { status, body, .. }
+            if status == reqwest::StatusCode::UNAUTHORIZED && credential_can_refresh =>
+        {
+            CodexUsageStatisticsError::CredentialRefreshRequired {
+                upstream_body: Some(body),
+            }
+        }
+        CodexClientError::Upstream {
+            status,
+            body,
+            retry_after_seconds,
+            ..
+        } => CodexUsageStatisticsError::Upstream {
+            status: status.as_u16(),
+            body,
+            retry_after_seconds,
+        },
+        _ => CodexUsageStatisticsError::TransportUnavailable,
+    }
 }
 
 async fn list_reset_credits_once(

backend/crates/providers/openai/src/credential/quota/usage_statistics.rs

@@ -0,0 +1,970 @@
+use std::{
+    cmp::{Ordering, Reverse},
+    collections::BTreeMap,
+};
+
+use chrono::{DateTime, FixedOffset, NaiveDate, NaiveTime, TimeDelta, Utc};
+use gateway_core::accounting::{Decimal, Money};
+use serde_json::Value;
+
+use crate::transport::{OpenAiBillingUsage, openai_aggregate_billing_breakdown};
+
+const EPSILON: f64 = 1e-9;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum CodexUsageStatisticsMode {
+    Workspace,
+    Personal,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+pub enum CodexUsageStatisticsServiceTier {
+    Standard,
+    Fast,
+}
+
+impl CodexUsageStatisticsServiceTier {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Standard => "standard",
+            Self::Fast => "fast",
+        }
+    }
+
+    const fn billing_service_tier(self) -> &'static str {
+        match self {
+            Self::Standard => "default",
+            Self::Fast => "fast",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct CodexUsageStatisticsTokens {
+    pub uncached_input: u64,
+    pub cached_input: u64,
+    pub output: u64,
+    pub total: u64,
+}
+
+impl CodexUsageStatisticsTokens {
+    fn checked_add(self, other: Self) -> Option<Self> {
+        Some(Self {
+            uncached_input: self.uncached_input.checked_add(other.uncached_input)?,
+            cached_input: self.cached_input.checked_add(other.cached_input)?,
+            output: self.output.checked_add(other.output)?,
+            total: self.total.checked_add(other.total)?,
+        })
+    }
+
+    const fn is_empty(self) -> bool {
+        self.total == 0 && self.uncached_input == 0 && self.cached_input == 0 && self.output == 0
+    }
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct CodexUsageStatisticsCycle {
+    pub offset: i8,
+    pub start_at: DateTime<Utc>,
+    pub end_at: DateTime<Utc>,
+    pub window_seconds: u64,
+    pub used_percent: Option<f64>,
+    pub is_current: bool,
+    pub can_go_previous: bool,
+    pub can_go_next: bool,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct CodexUsageStatisticsModel {
+    pub key: String,
+    pub model: String,
+    pub service_tier: CodexUsageStatisticsServiceTier,
+    pub credit_share: Option<f64>,
+    pub quota_share: Option<f64>,
+    pub tokens: CodexUsageStatisticsTokens,
+    pub estimated_cost: Option<Money>,
+    pub has_unknown_pricing: bool,
+    pub has_estimated_allocation: bool,
+    pub has_rate_fallback: bool,
+    pub has_missing_token_data: bool,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct CodexUsageStatisticsDay {
+    pub date: NaiveDate,
+    pub credit_share: Option<f64>,
+    pub tokens: CodexUsageStatisticsTokens,
+    pub estimated_cost: Option<Money>,
+    pub has_unknown_pricing: bool,
+    pub has_missing_token_data: bool,
+    pub is_boundary_day: bool,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct CodexUsageStatisticsSummary {
+    pub tokens: CodexUsageStatisticsTokens,
+    pub estimated_cost: Option<Money>,
+    pub projected_tokens: Option<u64>,
+    pub projected_cost: Option<Money>,
+    pub day_count: u32,
+    pub has_unknown_pricing: bool,
+    pub has_missing_token_data: bool,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct CodexUsageStatistics {
+    pub mode: CodexUsageStatisticsMode,
+    pub cycle: CodexUsageStatisticsCycle,
+    pub summary: CodexUsageStatisticsSummary,
+    pub models: Vec<CodexUsageStatisticsModel>,
+    pub daily: Vec<CodexUsageStatisticsDay>,
+}
+
+#[derive(Debug, Clone, Copy)]
+pub struct CodexUsageStatisticsPeriod {
+    pub cycle_offset: i8,
+    pub start_at: DateTime<Utc>,
+    pub end_at: DateTime<Utc>,
+    pub window_seconds: u64,
+    pub query_start_date: NaiveDate,
+    pub query_end_date: NaiveDate,
+}
+
+pub fn statistics_period(
+    current_start_at: DateTime<Utc>,
+    current_end_at: DateTime<Utc>,
+    window_seconds: u64,
+    cycle_offset: i8,
+    timezone: FixedOffset,
+    now: DateTime<Utc>,
+) -> Option<CodexUsageStatisticsPeriod> {
+    let window_delta = TimeDelta::seconds(i64::try_from(window_seconds).ok()?);
+    let shift = window_delta.checked_mul(i32::from(cycle_offset))?;
+    let start_at = current_start_at.checked_add_signed(shift)?;
+    let end_at = current_end_at.checked_add_signed(shift)?;
+    let query_start_date = start_at
+        .checked_sub_signed(TimeDelta::days(1))?
+        .with_timezone(&timezone)
+        .date_naive();
+    let effective_end = end_at.min(now);
+    let query_end_date = effective_end
+        .checked_add_signed(TimeDelta::days(1))?
+        .with_timezone(&timezone)
+        .date_naive();
+    Some(CodexUsageStatisticsPeriod {
+        cycle_offset,
+        start_at,
+        end_at,
+        window_seconds,
+        query_start_date,
+        query_end_date,
+    })
+}
+
+pub(super) struct BuildUsageStatistics<'a> {
+    pub mode: CodexUsageStatisticsMode,
+    pub period: CodexUsageStatisticsPeriod,
+    pub timezone: FixedOffset,
+    pub current_used_percent: Option<f64>,
+    pub now: DateTime<Utc>,
+    pub model_breakdown: &'a Value,
+    pub daily_totals: Option<&'a Value>,
+    pub max_cycle_offset: u8,
+}
+
+pub(super) fn build_usage_statistics(input: BuildUsageStatistics<'_>) -> CodexUsageStatistics {
+    let BuildUsageStatistics {
+        mode,
+        period,
+        timezone,
+        current_used_percent,
+        now,
+        model_breakdown,
+        daily_totals,
+        max_cycle_offset,
+    } = input;
+    let all_days = match mode {
+        CodexUsageStatisticsMode::Workspace => build_workspace_days(model_breakdown),
+        CodexUsageStatisticsMode::Personal => {
+            build_personal_days(daily_totals.unwrap_or(&Value::Null), model_breakdown)
+        }
+    };
+    let selected_days = select_cycle_days(
+        &all_days,
+        period.start_at,
+        period.end_at,
+        timezone,
+        now,
+        true,
+    );
+    let is_current = period.cycle_offset == 0;
+    let used_percent = is_current
+        .then_some(current_used_percent)
+        .flatten()
+        .filter(|value| value.is_finite())
+        .map(|value| value.clamp(0.0, 100.0));
+    let used_ratio = used_percent
+        .map(|value| value.clamp(0.0, 100.0) / 100.0)
+        .unwrap_or_default();
+    let summary = summarize(&selected_days, used_ratio, is_current);
+    let models = aggregate_models(&selected_days, used_ratio, is_current);
+    let total_credits = selected_days
+        .iter()
+        .map(|day| day.credit_weight)
+        .sum::<f64>();
+    let mut daily = selected_days
+        .into_iter()
+        .map(|day| CodexUsageStatisticsDay {
+            date: day.date,
+            credit_share: (total_credits > EPSILON).then_some(day.credit_weight / total_credits),
+            tokens: day.tokens,
+            estimated_cost: day.estimated_cost,
+            has_unknown_pricing: day.has_unknown_pricing,
+            has_missing_token_data: day.has_missing_token_data,
+            is_boundary_day: day.is_boundary_day,
+        })
+        .collect::<Vec<_>>();
+    daily.sort_by_key(|day| Reverse(day.date));
+
+    CodexUsageStatistics {
+        mode,
+        cycle: CodexUsageStatisticsCycle {
+            offset: period.cycle_offset,
+            start_at: period.start_at,
+            end_at: period.end_at,
+            window_seconds: period.window_seconds,
+            used_percent,
+            is_current,
+            can_go_previous: period.cycle_offset > -(max_cycle_offset as i8),
+            can_go_next: period.cycle_offset < 0,
+        },
+        summary,
+        models,
+        daily,
+    }
+}
+
+#[derive(Debug, Clone)]
+struct DailyModelUsage {
+    model: String,
+    service_tier: CodexUsageStatisticsServiceTier,
+    credits: f64,
+    tokens: CodexUsageStatisticsTokens,
+    estimated_cost: Option<Money>,
+    has_unknown_pricing: bool,
+    has_estimated_allocation: bool,
+    has_rate_fallback: bool,
+    has_missing_token_data: bool,
+}
+
+#[derive(Debug, Clone)]
+struct DailyUsage {
+    date: NaiveDate,
+    credit_weight: f64,
+    tokens: CodexUsageStatisticsTokens,
+    estimated_cost: Option<Money>,
+    has_unknown_pricing: bool,
+    has_missing_token_data: bool,
+    is_boundary_day: bool,
+    models: Vec<DailyModelUsage>,
+}
+
+#[derive(Default)]
+struct MoneySum {
+    value: Option<Money>,
+    overflowed: bool,
+}
+
+impl MoneySum {
+    fn push(&mut self, value: Option<Money>) {
+        let Some(value) = value else {
+            return;
+        };
+        if self.overflowed {
+            return;
+        }
+        self.value = match self.value {
+            Some(current) => match current.checked_add(value) {
+                Some(total) => Some(total),
+                None => {
+                    self.overflowed = true;
+                    None
+                }
+            },
+            None => Some(value),
+        };
+    }
+
+    fn finish(self) -> Option<Money> {
+        (!self.overflowed).then_some(self.value).flatten()
+    }
+}
+
+fn build_workspace_days(payload: &Value) -> Vec<DailyUsage> {
+    extract_daily_list(payload)
+        .into_iter()
+        .filter_map(|row| {
+            let date = date_value(row.get("date")?)?;
+            let mut models = value_array(row.get("models"))
+                .iter()
+                .filter_map(direct_model_usage)
+                .collect::<Vec<_>>();
+            let model_tokens = sum_tokens(models.iter().map(|model| model.tokens));
+            let fallback_tokens = token_parts(row.get("totals").unwrap_or(row));
+            let tokens = if model_tokens.is_empty() {
+                fallback_tokens
+            } else {
+                model_tokens
+            };
+            let credit_weight = day_credit_weight(row);
+            if tokens.is_empty() && credit_weight <= EPSILON {
+                return None;
+            }
+            let has_missing_token_data = tokens.is_empty() && credit_weight > EPSILON;
+            if models.is_empty() && !tokens.is_empty() {
+                models.push(unknown_model(tokens, false));
+            }
+            if has_missing_token_data {
+                for model in &mut models {
+                    model.has_missing_token_data = true;
+                }
+            }
+            Some(finalize_day(
+                date,
+                credit_weight,
+                tokens,
+                models,
+                has_missing_token_data,
+            ))
+        })
+        .collect()
+}
+
+fn build_personal_days(totals_payload: &Value, breakdown_payload: &Value) -> Vec<DailyUsage> {
+    let totals_by_date = rows_by_date(totals_payload);
+    let breakdown_by_date = rows_by_date(breakdown_payload);
+    let mut dates = totals_by_date
+        .keys()
+        .chain(breakdown_by_date.keys())
+        .copied()
+        .collect::<Vec<_>>();
+    dates.sort_unstable();
+    dates.dedup();
+
+    dates
+        .into_iter()
+        .filter_map(|date| {
+            let totals_row = totals_by_date.get(&date).unwrap_or(&Value::Null);
+            let breakdown_row = breakdown_by_date.get(&date).unwrap_or(&Value::Null);
+            let totals = token_parts(totals_row.get("totals").unwrap_or(totals_row));
+            let credit_weight = day_credit_weight(breakdown_row);
+            let weighted = weighted_models(breakdown_row);
+            if totals.is_empty() {
+                if credit_weight <= EPSILON {
+                    return None;
+                }
+                let models = weighted
+                    .into_iter()
+                    .map(|model| DailyModelUsage {
+                        model: model.model,
+                        service_tier: model.service_tier,
+                        credits: model.weight,
+                        tokens: CodexUsageStatisticsTokens::default(),
+                        estimated_cost: None,
+                        has_unknown_pricing: false,
+                        has_estimated_allocation: false,
+                        has_rate_fallback: false,
+                        has_missing_token_data: true,
+                    })
+                    .collect();
+                return Some(finalize_day(date, credit_weight, totals, models, true));
+            }
+
+            let has_model_breakdown = !weighted.is_empty();
+            let weighted = if has_model_breakdown {
+                weighted
+            } else {
+                vec![WeightedModel {
+                    model: "unknown".to_owned(),
+                    service_tier: CodexUsageStatisticsServiceTier::Standard,
+                    weight: 1.0,
+                }]
+            };
+            let allocation = rate_adjusted_shares(&weighted, totals);
+            let uncached = allocate_integer_total(totals.uncached_input, &allocation.token_shares);
+            let cached = allocate_integer_total(totals.cached_input, &allocation.token_shares);
+            let output = allocate_integer_total(totals.output, &allocation.token_shares);
+            let total = allocate_integer_total(totals.total, &allocation.token_shares);
+            let estimated_allocation = weighted.len() > 1 || !has_model_breakdown;
+            let rate_fallback = allocation.has_rate_fallback || !has_model_breakdown;
+            let models = weighted
+                .into_iter()
+                .enumerate()
+                .map(|(index, model)| {
+                    let tokens = CodexUsageStatisticsTokens {
+                        uncached_input: uncached.get(index).copied().unwrap_or_default(),
+                        cached_input: cached.get(index).copied().unwrap_or_default(),
+                        output: output.get(index).copied().unwrap_or_default(),
+                        total: total.get(index).copied().unwrap_or_default(),
+                    };
+                    let estimated_cost = aggregate_cost(&model.model, model.service_tier, tokens);
+                    DailyModelUsage {
+                        model: model.model,
+                        service_tier: model.service_tier,
+                        credits: if has_model_breakdown {
+                            model.weight
+                        } else {
+                            0.0
+                        },
+                        tokens,
+                        has_unknown_pricing: estimated_cost.is_none() && !tokens.is_empty(),
+                        estimated_cost,
+                        has_estimated_allocation: estimated_allocation,
+                        has_rate_fallback: rate_fallback,
+                        has_missing_token_data: false,
+                    }
+                })
+                .collect();
+            Some(finalize_day(date, credit_weight, totals, models, false))
+        })
+        .collect()
+}
+
+fn direct_model_usage(value: &Value) -> Option<DailyModelUsage> {
+    let tokens = token_parts(value);
+    let credits = non_negative_f64(value.get("credits"));
+    if tokens.is_empty() && credits <= EPSILON {
+        return None;
+    }
+    let model = model_name(value);
+    let service_tier = model_service_tier(value.get("speed").or_else(|| value.get("mode")));
+    let estimated_cost = (!tokens.is_empty())
+        .then(|| aggregate_cost(&model, service_tier, tokens))
+        .flatten();
+    Some(DailyModelUsage {
+        model,
+        service_tier,
+        credits,
+        tokens,
+        has_unknown_pricing: estimated_cost.is_none() && !tokens.is_empty(),
+        estimated_cost,
+        has_estimated_allocation: false,
+        has_rate_fallback: false,
+        has_missing_token_data: tokens.is_empty() && credits > EPSILON,
+    })
+}
+
+fn unknown_model(
+    tokens: CodexUsageStatisticsTokens,
+    estimated_allocation: bool,
+) -> DailyModelUsage {
+    DailyModelUsage {
+        model: "unknown".to_owned(),
+        service_tier: CodexUsageStatisticsServiceTier::Standard,
+        credits: 0.0,
+        tokens,
+        estimated_cost: None,
+        has_unknown_pricing: !tokens.is_empty(),
+        has_estimated_allocation: estimated_allocation,
+        has_rate_fallback: estimated_allocation,
+        has_missing_token_data: false,
+    }
+}
+
+fn finalize_day(
+    date: NaiveDate,
+    credit_weight: f64,
+    tokens: CodexUsageStatisticsTokens,
+    models: Vec<DailyModelUsage>,
+    has_missing_token_data: bool,
+) -> DailyUsage {
+    let mut costs = MoneySum::default();
+    for model in &models {
+        costs.push(model.estimated_cost);
+    }
+    DailyUsage {
+        date,
+        credit_weight,
+        tokens,
+        estimated_cost: costs.finish(),
+        has_unknown_pricing: models.iter().any(|model| model.has_unknown_pricing),
+        has_missing_token_data,
+        is_boundary_day: false,
+        models,
+    }
+}
+
+#[derive(Debug)]
+struct WeightedModel {
+    model: String,
+    service_tier: CodexUsageStatisticsServiceTier,
+    weight: f64,
+}
+
+struct Allocation {
+    token_shares: Vec<f64>,
+    has_rate_fallback: bool,
+}
+
+fn weighted_models(row: &Value) -> Vec<WeightedModel> {
+    value_array(row.get("models"))
+        .iter()
+        .filter_map(|value| {
+            let weight = non_negative_f64(value.get("credits"));
+            (weight > EPSILON).then(|| WeightedModel {
+                model: model_name(value),
+                service_tier: model_service_tier(value.get("speed").or_else(|| value.get("mode"))),
+                weight,
+            })
+        })
+        .collect()
+}
+
+fn rate_adjusted_shares(
+    models: &[WeightedModel],
+    totals: CodexUsageStatisticsTokens,
+) -> Allocation {
+    let total_weight = models.iter().map(|model| model.weight).sum::<f64>();
+    let credit_shares = models
+        .iter()
+        .map(|model| model.weight / total_weight)
+        .collect::<Vec<_>>();
+    if models.len() == 1 {
+        return Allocation {
+            token_shares: vec![1.0],
+            has_rate_fallback: false,
+        };
+    }
+    let classified_tokens = totals
+        .uncached_input
+        .saturating_add(totals.cached_input)
+        .saturating_add(totals.output);
+    if classified_tokens == 0 {
+        return Allocation {
+            token_shares: credit_shares,
+            has_rate_fallback: true,
+        };
+    }
+    let rates = models
+        .iter()
+        .map(|model| blended_rate(&model.model, model.service_tier, totals, classified_tokens))
+        .collect::<Vec<_>>();
+    let known = rates
+        .iter()
+        .enumerate()
+        .filter_map(|(index, rate)| rate.map(|rate| (index, rate)))
+        .collect::<Vec<_>>();
+    if known.is_empty() {
+        return Allocation {
+            token_shares: credit_shares,
+            has_rate_fallback: true,
+        };
+    }
+    let known_weight = known
+        .iter()
+        .map(|(index, _)| models[*index].weight)
+        .sum::<f64>();
+    let fallback_rate = known
+        .iter()
+        .map(|(index, rate)| rate * models[*index].weight / known_weight)
+        .sum::<f64>();
+    let inverse = models
+        .iter()
+        .enumerate()
+        .map(|(index, model)| model.weight / rates[index].unwrap_or(fallback_rate))
+        .collect::<Vec<_>>();
+    let inverse_total = inverse.iter().sum::<f64>();
+    Allocation {
+        token_shares: inverse
+            .into_iter()
+            .map(|value| value / inverse_total)
+            .collect(),
+        has_rate_fallback: known.len() != models.len(),
+    }
+}
+
+#[allow(clippy::cast_precision_loss)]
+fn blended_rate(
+    model: &str,
+    service_tier: CodexUsageStatisticsServiceTier,
+    totals: CodexUsageStatisticsTokens,
+    classified_tokens: u64,
+) -> Option<f64> {
+    let cost = aggregate_cost(model, service_tier, totals)?;
+    let rate = cost.amount().scaled() as f64 / classified_tokens as f64;
+    (rate > EPSILON).then_some(rate)
+}
+
+fn aggregate_cost(
+    model: &str,
+    service_tier: CodexUsageStatisticsServiceTier,
+    tokens: CodexUsageStatisticsTokens,
+) -> Option<Money> {
+    let input = tokens.uncached_input.checked_add(tokens.cached_input)?;
+    openai_aggregate_billing_breakdown(
+        model,
+        OpenAiBillingUsage::new(input, tokens.output, tokens.cached_input, 0),
+        Some(service_tier.billing_service_tier()),
+    )
+    .map(|breakdown| breakdown.total_amount())
+}
+
+#[allow(clippy::cast_precision_loss, clippy::cast_possible_truncation)]
+fn allocate_integer_total(total: u64, shares: &[f64]) -> Vec<u64> {
+    if shares.is_empty() {
+        return Vec::new();
+    }
+    let share_total = shares.iter().copied().sum::<f64>();
+    if !share_total.is_finite() || share_total <= EPSILON {
+        return vec![0; shares.len()];
+    }
+    let raw = shares
+        .iter()
+        .map(|share| total as f64 * (share.max(0.0) / share_total))
+        .collect::<Vec<_>>();
+    let mut allocated = raw
+        .iter()
+        .map(|value| value.floor() as u64)
+        .collect::<Vec<_>>();
+    let allocated_total = allocated.iter().copied().sum::<u64>();
+    let mut remainder = total.saturating_sub(allocated_total);
+    let mut order = raw
+        .iter()
+        .enumerate()
+        .map(|(index, value)| (index, value - value.floor()))
+        .collect::<Vec<_>>();
+    order.sort_by(|left, right| {
+        right
+            .1
+            .total_cmp(&left.1)
+            .then_with(|| left.0.cmp(&right.0))
+    });
+    let mut index = 0_usize;
+    while remainder > 0 {
+        let target = order[index % order.len()].0;
+        allocated[target] = allocated[target].saturating_add(1);
+        remainder -= 1;
+        index += 1;
+    }
+    allocated
+}
+
+fn select_cycle_days(
+    days: &[DailyUsage],
+    start_at: DateTime<Utc>,
+    end_at: DateTime<Utc>,
+    timezone: FixedOffset,
+    now: DateTime<Utc>,
+    mark_boundary: bool,
+) -> Vec<DailyUsage> {
+    let local_start = start_at.with_timezone(&timezone);
+    let start_date = local_start.date_naive();
+    let effective_end = end_at.min(now);
+    let end_date = effective_end.with_timezone(&timezone).date_naive();
+    let exclude_end_date = end_at <= now && end_date > start_date;
+    let is_boundary = local_start.time() != NaiveTime::MIN;
+    days.iter()
+        .filter(|day| {
+            day.date >= start_date
+                && if exclude_end_date {
+                    day.date < end_date
+                } else {
+                    day.date <= end_date
+                }
+        })
+        .cloned()
+        .map(|mut day| {
+            day.is_boundary_day = mark_boundary && is_boundary && day.date == start_date;
+            day
+        })
+        .collect()
+}
+
+fn summarize(
+    days: &[DailyUsage],
+    used_ratio: f64,
+    is_current: bool,
+) -> CodexUsageStatisticsSummary {
+    let tokens = sum_tokens(days.iter().map(|day| day.tokens));
+    let mut costs = MoneySum::default();
+    for day in days {
+        costs.push(day.estimated_cost);
+    }
+    let estimated_cost = costs.finish();
+    let has_unknown_pricing = days.iter().any(|day| day.has_unknown_pricing);
+    let projected_tokens = (is_current && used_ratio > EPSILON && tokens.total > 0)
+        .then(|| project_u64(tokens.total, used_ratio))
+        .flatten();
+    let projected_cost = (is_current && !has_unknown_pricing && used_ratio > EPSILON)
+        .then(|| estimated_cost.and_then(|cost| project_money(cost, used_ratio)))
+        .flatten();
+    CodexUsageStatisticsSummary {
+        tokens,
+        estimated_cost,
+        projected_tokens,
+        projected_cost,
+        day_count: u32::try_from(days.len()).unwrap_or(u32::MAX),
+        has_unknown_pricing,
+        has_missing_token_data: days.iter().any(|day| day.has_missing_token_data),
+    }
+}
+
+#[derive(Default)]
+struct ModelAggregate {
+    credits: f64,
+    tokens: CodexUsageStatisticsTokens,
+    costs: MoneySum,
+    has_unknown_pricing: bool,
+    has_estimated_allocation: bool,
+    has_rate_fallback: bool,
+    has_missing_token_data: bool,
+}
+
+fn aggregate_models(
+    days: &[DailyUsage],
+    used_ratio: f64,
+    is_current: bool,
+) -> Vec<CodexUsageStatisticsModel> {
+    let mut aggregates =
+        BTreeMap::<(String, CodexUsageStatisticsServiceTier), ModelAggregate>::new();
+    for model in days.iter().flat_map(|day| &day.models) {
+        if model.tokens.is_empty() && model.credits <= EPSILON {
+            continue;
+        }
+        let aggregate = aggregates
+            .entry((model.model.clone(), model.service_tier))
+            .or_default();
+        aggregate.credits += model.credits;
+        aggregate.tokens =
+            aggregate
+                .tokens
+                .checked_add(model.tokens)
+                .unwrap_or(CodexUsageStatisticsTokens {
+                    uncached_input: u64::MAX,
+                    cached_input: u64::MAX,
+                    output: u64::MAX,
+                    total: u64::MAX,
+                });
+        aggregate.costs.push(model.estimated_cost);
+        aggregate.has_unknown_pricing |= model.has_unknown_pricing;
+        aggregate.has_estimated_allocation |= model.has_estimated_allocation;
+        aggregate.has_rate_fallback |= model.has_rate_fallback;
+        aggregate.has_missing_token_data |= model.has_missing_token_data;
+    }
+    let total_credits = aggregates
+        .values()
+        .map(|aggregate| aggregate.credits)
+        .sum::<f64>();
+    let mut rows = aggregates
+        .into_iter()
+        .map(|((model, service_tier), aggregate)| {
+            let credit_share =
+                (total_credits > EPSILON).then_some(aggregate.credits / total_credits);
+            let quota_share = (is_current && used_ratio > EPSILON)
+                .then(|| credit_share.map(|share| share * used_ratio))
+                .flatten();
+            CodexUsageStatisticsModel {
+                key: format!("{model}::{}", service_tier.as_str()),
+                model,
+                service_tier,
+                credit_share,
+                quota_share,
+                tokens: aggregate.tokens,
+                estimated_cost: aggregate.costs.finish(),
+                has_unknown_pricing: aggregate.has_unknown_pricing,
+                has_estimated_allocation: aggregate.has_estimated_allocation,
+                has_rate_fallback: aggregate.has_rate_fallback,
+                has_missing_token_data: aggregate.has_missing_token_data,
+            }
+        })
+        .collect::<Vec<_>>();
+    rows.sort_by(compare_model_rows);
+    rows
+}
+
+fn compare_model_rows(
+    left: &CodexUsageStatisticsModel,
+    right: &CodexUsageStatisticsModel,
+) -> Ordering {
+    right
+        .credit_share
+        .unwrap_or_default()
+        .total_cmp(&left.credit_share.unwrap_or_default())
+        .then_with(|| cost_ticks(right.estimated_cost).cmp(&cost_ticks(left.estimated_cost)))
+        .then_with(|| right.tokens.total.cmp(&left.tokens.total))
+        .then_with(|| left.model.cmp(&right.model))
+        .then_with(|| left.service_tier.cmp(&right.service_tier))
+}
+
+fn cost_ticks(cost: Option<Money>) -> u128 {
+    cost.map(|value| value.amount().scaled())
+        .unwrap_or_default()
+}
+
+#[allow(clippy::cast_precision_loss, clippy::cast_possible_truncation)]
+fn project_u64(value: u64, used_ratio: f64) -> Option<u64> {
+    let projected = value as f64 / used_ratio;
+    (projected.is_finite() && projected >= 0.0 && projected <= u64::MAX as f64)
+        .then(|| projected.round() as u64)
+}
+
+#[allow(clippy::cast_precision_loss, clippy::cast_possible_truncation)]
+fn project_money(cost: Money, used_ratio: f64) -> Option<Money> {
+    let projected = cost.amount().scaled() as f64 / used_ratio;
+    if !projected.is_finite() || projected < 0.0 || projected > u128::MAX as f64 {
+        return None;
+    }
+    let amount = Decimal::from_scaled(projected.round() as u128).ok()?;
+    Some(Money::new(amount, cost.currency()))
+}
+
+fn sum_tokens(
+    values: impl IntoIterator<Item = CodexUsageStatisticsTokens>,
+) -> CodexUsageStatisticsTokens {
+    values
+        .into_iter()
+        .fold(CodexUsageStatisticsTokens::default(), |total, value| {
+            total
+                .checked_add(value)
+                .unwrap_or(CodexUsageStatisticsTokens {
+                    uncached_input: u64::MAX,
+                    cached_input: u64::MAX,
+                    output: u64::MAX,
+                    total: u64::MAX,
+                })
+        })
+}
+
+fn rows_by_date(payload: &Value) -> BTreeMap<NaiveDate, Value> {
+    extract_daily_list(payload)
+        .into_iter()
+        .filter_map(|row| Some((date_value(row.get("date")?)?, row.clone())))
+        .collect()
+}
+
+fn extract_daily_list(payload: &Value) -> Vec<&Value> {
+    if let Some(rows) = payload.as_array() {
+        return rows.iter().collect();
+    }
+    [
+        "data",
+        "items",
+        "results",
+        "daily",
+        "daily_usage",
+        "dailyWorkspaceUsageCounts",
+        "daily_workspace_usage_counts",
+        "workspace_usage_counts",
+    ]
+    .into_iter()
+    .find_map(|key| payload.get(key).and_then(Value::as_array))
+    .map(|rows| rows.iter().collect())
+    .unwrap_or_default()
+}
+
+fn value_array(value: Option<&Value>) -> &[Value] {
+    value.and_then(Value::as_array).map_or(&[], Vec::as_slice)
+}
+
+fn token_parts(value: &Value) -> CodexUsageStatisticsTokens {
+    let uncached_input = non_negative_u64(value.get("uncached_text_input_tokens"));
+    let cached_input = non_negative_u64(value.get("cached_text_input_tokens"));
+    let output = non_negative_u64(value.get("text_output_tokens"));
+    let derived = uncached_input
+        .saturating_add(cached_input)
+        .saturating_add(output);
+    let reported = non_negative_u64(value.get("text_total_tokens"));
+    CodexUsageStatisticsTokens {
+        uncached_input,
+        cached_input,
+        output,
+        total: if reported > 0 { reported } else { derived },
+    }
+}
+
+fn day_credit_weight(value: &Value) -> f64 {
+    let model_credits = value_array(value.get("models"))
+        .iter()
+        .map(|model| non_negative_f64(model.get("credits")))
+        .sum::<f64>();
+    if model_credits > EPSILON {
+        return model_credits;
+    }
+    value
+        .get("product_surface_usage_values")
+        .and_then(Value::as_object)
+        .map(|values| {
+            values
+                .values()
+                .map(|value| non_negative_f64(Some(value)))
+                .sum()
+        })
+        .unwrap_or_default()
+}
+
+fn model_name(value: &Value) -> String {
+    ["model", "model_id", "model_name", "name", "id"]
+        .into_iter()
+        .find_map(|key| value.get(key).and_then(Value::as_str))
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .unwrap_or("unknown")
+        .to_ascii_lowercase()
+}
+
+fn model_service_tier(value: Option<&Value>) -> CodexUsageStatisticsServiceTier {
+    match value
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .map(str::to_ascii_lowercase)
+        .as_deref()
+    {
+        Some("fast" | "priority") => CodexUsageStatisticsServiceTier::Fast,
+        Some(_) | None => CodexUsageStatisticsServiceTier::Standard,
+    }
+}
+
+fn date_value(value: &Value) -> Option<NaiveDate> {
+    NaiveDate::parse_from_str(value.as_str()?.get(..10)?, "%Y-%m-%d").ok()
+}
+
+fn non_negative_u64(value: Option<&Value>) -> u64 {
+    let Some(value) = value else {
+        return 0;
+    };
+    if let Some(number) = value.as_u64() {
+        return number;
+    }
+    let normalized = value
+        .as_str()
+        .map(|raw| raw.replace(',', ""))
+        .unwrap_or_else(|| value.to_string());
+    normalized
+        .trim()
+        .parse::<u64>()
+        .ok()
+        .or_else(|| {
+            normalized
+                .trim()
+                .parse::<f64>()
+                .ok()
+                .filter(|number| number.is_finite() && *number >= 0.0)
+                .map(|number| number.round() as u64)
+        })
+        .unwrap_or_default()
+}
+
+fn non_negative_f64(value: Option<&Value>) -> f64 {
+    let Some(value) = value else {
+        return 0.0;
+    };
+    let parsed = value.as_f64().or_else(|| {
+        value
+            .as_str()
+            .map(|raw| raw.replace(',', ""))
+            .and_then(|raw| raw.trim().parse::<f64>().ok())
+    });
+    parsed
+        .filter(|number| number.is_finite() && *number >= 0.0)
+        .unwrap_or_default()
+}

backend/crates/providers/openai/src/credential/selector.rs

@@ -476,14 +476,16 @@ impl CodexCredentialSelector {
         {
             affinity.escape(AffinityEscapeReason::PinnedAccount);
         }
-        let preferred = pinned_account
-            .clone()
-            .or_else(|| affinity.preferred_account().cloned());
+        let mut observed_affinity_account = affinity.bound_account().cloned();
         let mut shortest_retry = None;
+        let policy = request.attempt.account_selection_policy();
 
         loop {
+            let preferred = pinned_account
+                .clone()
+                .or_else(|| affinity.preferred_account().cloned());
             let context = AccountSelectionContext {
-                policy: request.attempt.account_selection_policy(),
+                policy,
                 now: SystemTime::now(),
                 excluded_accounts: excluded.clone(),
                 preferred_account: preferred.clone(),
@@ -511,7 +513,6 @@ impl CodexCredentialSelector {
                 .map(|candidate| candidate.account.clone())
                 .ok_or(CredentialSelectionError::InvalidCredential)?;
             let allows_account_state_mutation = !diagnostic || account.enabled();
-            let policy = request.attempt.account_selection_policy();
             match self
                 .leases
                 .try_acquire(ProviderLeaseRequest::Scheduling(
@@ -532,6 +533,40 @@ impl CodexCredentialSelector {
                     excluded.insert(account.id().clone());
                 }
                 ProviderLeaseAcquisition::Acquired(guard) => {
+                    let initial_affinity_claim = if !diagnostic
+                        && observed_affinity_account.is_none()
+                        && let Some(key) = request.session_affinity_key
+                    {
+                        self.claim_initial_session_affinity(key, account.id()).await
+                    } else {
+                        None
+                    };
+                    // 原生 continuation/required account 比根亲和绑定更严格；它可以
+                    // 使用 owner 账号，但不能把已经迁移的根会话拉回旧号。
+                    if pinned_account.is_none()
+                        && let Some(effective_account) = initial_affinity_claim
+                        && &effective_account != account.id()
+                    {
+                        drop(guard);
+                        observed_affinity_account = Some(effective_account.clone());
+                        affinity = affinity_selection_for_bound_account(
+                            effective_account,
+                            &candidates,
+                            SystemTime::now(),
+                        );
+                        continue;
+                    }
+                    let affinity_expected_account_id = if pinned_account
+                        .as_ref()
+                        .zip(observed_affinity_account.as_ref())
+                        .is_some_and(|(pinned, bound)| pinned != bound)
+                    {
+                        account.id().clone()
+                    } else {
+                        observed_affinity_account
+                            .clone()
+                            .unwrap_or_else(|| account.id().clone())
+                    };
                     let affinity_telemetry = affinity.telemetry(account.id());
                     tracing::info!(
                         request_id = %request.attempt.request_id(),
@@ -583,6 +618,7 @@ impl CodexCredentialSelector {
                         cyber_policy_scope,
                         allows_account_state_mutation,
                         affinity_telemetry,
+                        affinity_expected_account_id,
                         _guard: guard,
                     });
                 }
@@ -603,24 +639,7 @@ impl CodexCredentialSelector {
         else {
             return AffinitySelection::default();
         };
-        let Some(candidate) = candidates
-            .iter()
-            .find(|candidate| candidate.account.id() == &account_id)
-        else {
-            self.clear_session_affinity(key).await;
-            return AffinitySelection::escaped(account_id, AffinityEscapeReason::HardUnavailable);
-        };
-        if candidate
-            .account
-            .status_projection(now, candidate.signals.rate_limited_until)
-            .status
-            == AccountStatus::Normal
-        {
-            return AffinitySelection::preferred(account_id);
-        }
-        let reason = affinity_unavailable_reason(candidate, now);
-        self.clear_session_affinity(key).await;
-        AffinitySelection::escaped(account_id, reason)
+        affinity_selection_for_bound_account(account_id, candidates, now)
     }
 
     async fn lookup_session_affinity(
@@ -649,22 +668,38 @@ impl CodexCredentialSelector {
         }
     }
 
-    async fn clear_session_affinity(&self, key: &ProviderSessionAffinityKey) {
+    async fn claim_initial_session_affinity(
+        &self,
+        key: &ProviderSessionAffinityKey,
+        selected_account_id: &ProviderAccountId,
+    ) -> Option<ProviderAccountId> {
         match tokio::time::timeout(
             SESSION_AFFINITY_TIMEOUT,
-            self.session_affinity.clear(&self.provider_kind, key),
+            self.session_affinity.claim_or_load(
+                &self.provider_kind,
+                key,
+                selected_account_id,
+                SESSION_AFFINITY_TTL,
+            ),
         )
         .await
         {
-            Ok(Ok(_)) => {}
+            Ok(Ok(account_id)) => Some(account_id),
             Ok(Err(error)) => {
-                tracing::warn!(error = %error, "OpenAI stale session affinity clear failed open");
+                tracing::warn!(
+                    account_id = %selected_account_id,
+                    error = %error,
+                    "OpenAI initial session affinity claim failed open"
+                );
+                None
             }
             Err(_) => {
                 tracing::warn!(
+                    account_id = %selected_account_id,
                     timeout_ms = SESSION_AFFINITY_TIMEOUT.as_millis(),
-                    "OpenAI stale session affinity clear timed out"
+                    "OpenAI initial session affinity claim timed out"
                 );
+                None
             }
         }
     }
@@ -901,6 +936,7 @@ impl CodexCredentialSelector {
         &self,
         account: &ProviderAccount,
         session_affinity_key: Option<&ProviderSessionAffinityKey>,
+        expected_affinity_account_id: &ProviderAccountId,
     ) {
         self.restore_recoverable_account_state(account).await;
         self.risk_recovery
@@ -910,24 +946,26 @@ impl CodexCredentialSelector {
         let Some(key) = session_affinity_key else {
             return;
         };
-        if matches!(
-            self.lookup_session_affinity(key).await,
-            SessionAffinityLookup::Unavailable
-        ) {
-            return;
-        }
         match tokio::time::timeout(
             SESSION_AFFINITY_TIMEOUT,
-            self.session_affinity.bind(
+            self.session_affinity.compare_and_bind(
                 &self.provider_kind,
                 key,
+                expected_affinity_account_id,
                 account.id(),
                 SESSION_AFFINITY_TTL,
             ),
         )
         .await
         {
-            Ok(Ok(())) => {}
+            Ok(Ok(effective_account)) if &effective_account == account.id() => {}
+            Ok(Ok(effective_account)) => {
+                tracing::debug!(
+                    account_id = %account.id(),
+                    effective_account_id = %effective_account,
+                    "OpenAI late success left the newer session affinity binding unchanged"
+                );
+            }
             Ok(Err(error)) => {
                 tracing::warn!(
                     account_id = %account.id(),
@@ -1104,6 +1142,32 @@ impl CodexCredentialSelector {
     }
 }
 
+fn affinity_selection_for_bound_account(
+    account_id: ProviderAccountId,
+    candidates: &[AccountCandidate],
+    now: SystemTime,
+) -> AffinitySelection {
+    let Some(candidate) = candidates
+        .iter()
+        .find(|candidate| candidate.account.id() == &account_id)
+    else {
+        return AffinitySelection::escaped(account_id, AffinityEscapeReason::HardUnavailable);
+    };
+    match candidate
+        .account
+        .status_projection(now, candidate.signals.rate_limited_until)
+        .status
+    {
+        AccountStatus::Normal => AffinitySelection::preferred(account_id),
+        AccountStatus::QuotaExhausted
+        | AccountStatus::RateLimited
+        | AccountStatus::Disabled
+        | AccountStatus::Error => {
+            AffinitySelection::escaped(account_id, affinity_unavailable_reason(candidate, now))
+        }
+    }
+}
+
 fn affinity_unavailable_reason(
     candidate: &AccountCandidate,
     now: SystemTime,
@@ -1159,6 +1223,7 @@ pub struct CodexCredentialLease {
     cyber_policy_scope: Option<CodexCyberPolicyScope>,
     allows_account_state_mutation: bool,
     affinity_telemetry: AffinityTelemetry,
+    affinity_expected_account_id: ProviderAccountId,
     _guard: Box<dyn ProviderLeaseGuard>,
 }
 
@@ -1216,6 +1281,12 @@ impl CodexCredentialLease {
     pub const fn account_switch(&self) -> bool {
         self.affinity_telemetry.account_switch
     }
+
+    /// 成功反馈只能从选择时观察到的绑定迁移，避免迟到请求覆盖较新 winner。
+    #[must_use]
+    pub(crate) const fn affinity_expected_account_id(&self) -> &ProviderAccountId {
+        &self.affinity_expected_account_id
+    }
 }
 
 impl fmt::Debug for CodexCredentialLease {

backend/crates/providers/openai/src/provider.rs

@@ -71,6 +71,9 @@ use crate::transport::profile::{
 use crate::transport::protocol::responses::{
     CodexResponsesRequest, PreviousResponseScope, ResponseEventSignals,
 };
+use crate::transport::protocol::websocket::{
+    PREVIOUS_RESPONSE_NOT_FOUND_CODE, PREVIOUS_RESPONSE_NOT_FOUND_MESSAGE,
+};
 use crate::transport::request::{
     CodexRequestEncodeError, RequestAccountScope, encode_generate_request, scope_request_to_account,
 };
@@ -318,8 +321,14 @@ impl Provider for CodexProvider {
                 .is_some_and(|state| state.account_id != lease.account_id().as_str());
         let has_explicit_state_owner =
             context.account_state_owner().is_some() || previous_session.is_some();
-        let cross_account =
-            state_owner_cross_account || (!has_explicit_state_owner && lease.account_switch());
+        let account_scope =
+            if state_owner_cross_account || (!has_explicit_state_owner && lease.account_switch()) {
+                RequestAccountScope::Different
+            } else if has_explicit_state_owner || lease.affinity_hit() {
+                RequestAccountScope::Same
+            } else {
+                RequestAccountScope::Unknown
+            };
         if context.continuation_attempt() != ContinuationAttempt::None
             && let Some(continuation) = context.continuation()
         {
@@ -366,13 +375,11 @@ impl Provider for CodexProvider {
                 }
             }
         }
-        let account_scope = if !cross_account {
-            RequestAccountScope::SameAccount
-        } else if upstream_request.previous_response_id().is_some() {
-            RequestAccountScope::CrossAccountContinuationProbe
-        } else {
-            RequestAccountScope::CrossAccountFullRequest
-        };
+        if upstream_request.previous_response_id().is_some()
+            && !account_scope.can_reuse_account_state()
+        {
+            return Err(continuation_replay_required_error());
+        }
         scope_request_to_account(
             &mut upstream_request,
             lease.installation_id(),
@@ -1178,7 +1185,11 @@ fn cold_response_stream(response: ColdResponse) -> EventStream {
                 // 完成事件一旦交给下游，Core 可以立刻停止轮询 Provider stream；
                 // 在此之前持久化亲和关系，保证成功请求不会因流被提前 drop 而丢失绑定。
                 selector
-                    .record_success(&active_account, session_affinity_key.as_ref())
+                    .record_success(
+                        &active_account,
+                        session_affinity_key.as_ref(),
+                        lease.affinity_expected_account_id(),
+                    )
                     .await;
                 selector
                     .observe_cyber_policy_success(cyber_policy_scope.as_ref())
@@ -1282,7 +1293,11 @@ fn cold_response_stream(response: ColdResponse) -> EventStream {
         if allows_account_state_mutation && completed && terminal_failure.is_none() {
             // 同上：尾部 finish() 也可能产出 completed，亲和记录必须先于任何下游 yield。
             selector
-                .record_success(&active_account, session_affinity_key.as_ref())
+                .record_success(
+                    &active_account,
+                    session_affinity_key.as_ref(),
+                    lease.affinity_expected_account_id(),
+                )
                 .await;
             selector
                 .observe_cyber_policy_success(cyber_policy_scope.as_ref())
@@ -2364,6 +2379,19 @@ fn map_handshake_error(error: CodexClientError) -> MappedProviderFailure {
     map_client_error(error, UpstreamSendState::Ambiguous, true)
 }
 
+fn continuation_replay_required_error() -> ProviderError {
+    ProviderError::new(
+        ProviderErrorKind::InvalidRequest,
+        UpstreamSendState::NotSent,
+    )
+    .with_continuation_failure(ContinuationFailure::HistoryUnavailable)
+    .with_client_visible_upstream_error(ClientVisibleUpstreamError::new(
+        PREVIOUS_RESPONSE_NOT_FOUND_MESSAGE,
+        Some(PREVIOUS_RESPONSE_NOT_FOUND_CODE.to_owned()),
+        Some("invalid_request_error".to_owned()),
+    ))
+}
+
 fn map_stream_error(error: CodexClientError) -> MappedProviderFailure {
     let allows_pre_delivery_retry = stream_transport_allows_pre_delivery_retry(&error);
     let mut failure = map_client_error(error, UpstreamSendState::Sent, false);

backend/crates/providers/openai/src/transport/endpoints.rs

@@ -8,6 +8,14 @@ pub const CODEX_IMAGE_EDITS_PATH: &str = "/codex/images/edits";
 pub const CODEX_USAGE_API_PATH: &str = "/api/codex/usage";
 /// `/wham/usage`
 pub const WHAM_USAGE_PATH: &str = "/wham/usage";
+/// Workspace 账号每日模型 Token 明细。
+pub const WHAM_DAILY_WORKSPACE_USER_TOKEN_USAGE_PATH: &str =
+    "/wham/usage/daily-workspace-user-token-usage-breakdown";
+/// 个人账号每日模型额度权重。
+pub const WHAM_DAILY_TOKEN_USAGE_PATH: &str = "/wham/usage/daily-token-usage-breakdown";
+/// 个人账号每日 Token 总量。
+pub const WHAM_DAILY_WORKSPACE_USAGE_COUNTS_PATH: &str =
+    "/wham/analytics/daily-workspace-usage-counts";
 /// Codex Desktop 主动额度重置卡列表。
 pub const WHAM_RATE_LIMIT_RESET_CREDITS_PATH: &str = "/wham/rate-limit-reset-credits";
 /// Codex Desktop 主动消费额度重置卡。

backend/crates/providers/openai/src/transport/mod.rs

@@ -17,6 +17,7 @@ pub(crate) mod session;
 mod time;
 pub mod tls;
 pub mod usage;
+pub(crate) mod usage_statistics;
 pub mod websocket;
 
 pub use self::{
@@ -35,7 +36,8 @@ pub use self::{
     diagnostics::{CodexUpstreamDiagnostics, CodexUpstreamSendPhase},
     endpoints::{
         CODEX_IMAGE_EDITS_PATH, CODEX_IMAGE_GENERATIONS_PATH, CODEX_RESPONSES_PATH,
-        CODEX_USAGE_API_PATH, WHAM_RATE_LIMIT_RESET_CREDITS_CONSUME_PATH,
+        CODEX_USAGE_API_PATH, WHAM_DAILY_TOKEN_USAGE_PATH, WHAM_DAILY_WORKSPACE_USAGE_COUNTS_PATH,
+        WHAM_DAILY_WORKSPACE_USER_TOKEN_USAGE_PATH, WHAM_RATE_LIMIT_RESET_CREDITS_CONSUME_PATH,
         WHAM_RATE_LIMIT_RESET_CREDITS_PATH, WHAM_USAGE_PATH, endpoint_url, usage_endpoint_url,
     },
     headers::build_codex_base_headers,
@@ -50,3 +52,5 @@ pub use self::{
         CodexWebSocketPool, CodexWebSocketPoolConfig, CodexWebSocketPoolKey, WebSocketPoolDecision,
     },
 };
+
+pub(crate) use self::usage::openai_aggregate_billing_breakdown;

backend/crates/providers/openai/src/transport/protocol/responses.rs

@@ -525,11 +525,6 @@ impl CodexResponsesRequest {
             .map_or(&[], Vec::as_slice)
     }
 
-    /// 替换输入条目（仅用于代理持有完整历史时的换号重放）。
-    pub fn set_input(&mut self, input: Vec<Value>) {
-        self.body.insert("input".to_string(), Value::Array(input));
-    }
-
     /// 是否流式返回。
     pub fn stream(&self) -> bool {
         self.body
@@ -617,11 +612,12 @@ impl CodexResponsesRequest {
         )
     }
 
-    /// 返回会话亲和所用的子代理区分值。
+    /// 返回请求语义与 child transport 隔离所用的子代理区分值。
     ///
     /// Codex 原生请求在 turn metadata 中声明 `subagent_kind`；网关的
     /// `/responses/review` 等入口则通过 `client_metadata.x-openai-subagent`
-    /// 传递给上游。该可选值仅参与会话亲和键派生。
+    /// 传递给上游。它不拆分根会话的账号首选项；`thread_spawn` 仍用它派生独立
+    /// WebSocket/continuation transport identity。
     pub fn subagent_kind(&self) -> Option<String> {
         self.semantics()
             .subagent_kind

backend/crates/providers/openai/src/transport/protocol/websocket.rs

@@ -5,7 +5,9 @@ use serde_json::{Map, Value};
 use crate::transport::protocol::responses::{CodexResponsesRequest, transport_requirement};
 
 const REDACTED_PAYLOAD_VALUE: &str = "<redacted>";
-const PREVIOUS_RESPONSE_NOT_FOUND_CODE: &str = "previous_response_not_found";
+pub(crate) const PREVIOUS_RESPONSE_NOT_FOUND_CODE: &str = "previous_response_not_found";
+pub(crate) const PREVIOUS_RESPONSE_NOT_FOUND_MESSAGE: &str =
+    "Previous response was not found. Retrying the full request.";
 const INVALID_PREVIOUS_RESPONSE_ID_MESSAGE: &str = "Invalid `previous_response_id`.";
 
 /// WebSocket 握手审计快照。

backend/crates/providers/openai/src/transport/request.rs

@@ -63,18 +63,14 @@ const INSTALLATION_ID_KEYS: &[&str] = &[
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(crate) enum RequestAccountScope {
-    SameAccount,
-    CrossAccountFullRequest,
-    CrossAccountContinuationProbe,
+    Same,
+    Different,
+    Unknown,
 }
 
 impl RequestAccountScope {
-    const fn is_cross_account(self) -> bool {
-        !matches!(self, Self::SameAccount)
-    }
-
-    const fn preserves_continuation(self) -> bool {
-        matches!(self, Self::CrossAccountContinuationProbe)
+    pub(crate) const fn can_reuse_account_state(self) -> bool {
+        matches!(self, Self::Same)
     }
 }
 
@@ -205,8 +201,9 @@ pub(crate) fn derive_conversation_anchor(
     })
 }
 
-/// A `thread_spawn` shares its parent session but is a separate child execution.
-/// Its child thread must therefore own the affinity and WebSocket pool identity.
+/// `thread_spawn` 与父任务共享根会话，但它本身是独立的子任务执行。
+/// 因此子线程必须拥有独立的 continuation/WebSocket 传输身份；账号亲和则从共享的
+/// 根会话单独派生。
 fn thread_spawn_conversation_anchor(
     request: &CodexResponsesRequest,
 ) -> Option<(&'static str, String)> {
@@ -306,21 +303,17 @@ fn normalize_conversation_anchor_text(text: &str) -> String {
 ///
 /// 真实 account ID 与 installation ID 由随后构造的 `CodexRequestContext` 注入
 /// 请求头；正文只替换客户端原本声明过的 installation 字段，绝不接受客户端
-/// 提供的 token、cookie 或账号身份。Continuation probe 保留 canonical
-/// previous-response 和原始增量 input，不能把它们误当成完整请求清理。
+/// 提供的 token、cookie 或账号身份。`input` 是 Responses 的可回放会话正文，
+/// item ID、encrypted content 和 compaction 都必须原样保留。
 pub(crate) fn scope_request_to_account(
     request: &mut CodexResponsesRequest,
     installation_id: &str,
     account_scope: RequestAccountScope,
 ) {
-    let cross_account = account_scope.is_cross_account();
-    let continuation = account_scope
-        .preserves_continuation()
-        .then(|| request.previous_response_id().map(ToOwned::to_owned))
-        .flatten();
+    let reset_account_state = !account_scope.can_reuse_account_state();
     let client_metadata_turn_state = metadata_string(request, "x-codex-turn-state");
-    let preserve_turn_state =
-        !cross_account && (request.turn_state.is_some() || client_metadata_turn_state.is_some());
+    let preserve_turn_state = !reset_account_state
+        && (request.turn_state.is_some() || client_metadata_turn_state.is_some());
     let turn_state = preserve_turn_state
         .then(|| request.turn_state.clone())
         .flatten();
@@ -329,38 +322,22 @@ pub(crate) fn scope_request_to_account(
     } else {
         None
     };
-    let turn_metadata = (!account_scope.preserves_continuation())
-        .then(|| {
-            request
-                .turn_metadata
-                .as_deref()
-                .and_then(|metadata| scope_turn_metadata(metadata, installation_id, cross_account))
-        })
-        .flatten();
-    let client_metadata_turn_metadata = (!account_scope.preserves_continuation())
-        .then(|| {
-            metadata_string(request, "x-codex-turn-metadata")
-                .and_then(|metadata| scope_turn_metadata(&metadata, installation_id, cross_account))
-        })
-        .flatten();
+    let turn_metadata = request
+        .turn_metadata
+        .as_deref()
+        .and_then(|metadata| scope_turn_metadata(metadata, installation_id, reset_account_state));
+    let client_metadata_turn_metadata = metadata_string(request, "x-codex-turn-metadata")
+        .and_then(|metadata| scope_turn_metadata(&metadata, installation_id, reset_account_state));
 
-    if cross_account {
+    if reset_account_state {
         request.passthrough_headers.remove("x-codex-turn-state");
         request.passthrough_headers.remove("x-codex-turn-metadata");
-        if !account_scope.preserves_continuation() {
-            sanitize_cross_account_input(request);
-        }
         for key in CROSS_ACCOUNT_IDENTITY_KEYS
             .iter()
             .chain(ACCOUNT_BOUND_STATE_KEYS)
         {
             request.body_mut().remove(*key);
         }
-        if account_scope.preserves_continuation() {
-            for key in TURN_METADATA_KEYS {
-                request.body_mut().remove(*key);
-            }
-        }
     }
 
     for key in INSTALLATION_ID_KEYS {
@@ -371,7 +348,7 @@ pub(crate) fn scope_request_to_account(
             .body()
             .get(*key)
             .and_then(Value::as_str)
-            .and_then(|value| scope_turn_metadata(value, installation_id, cross_account));
+            .and_then(|value| scope_turn_metadata(value, installation_id, reset_account_state));
         replace_existing_body_string(request, key, scoped.as_deref());
     }
 
@@ -383,22 +360,17 @@ pub(crate) fn scope_request_to_account(
                         (
                             key,
                             metadata.get(key).and_then(Value::as_str).and_then(|value| {
-                                scope_turn_metadata(value, installation_id, cross_account)
+                                scope_turn_metadata(value, installation_id, reset_account_state)
                             }),
                         )
                     });
-                if cross_account {
+                if reset_account_state {
                     for key in CROSS_ACCOUNT_IDENTITY_KEYS
                         .iter()
                         .chain(ACCOUNT_BOUND_STATE_KEYS)
                     {
                         metadata.remove(*key);
                     }
-                    if account_scope.preserves_continuation() {
-                        for key in TURN_METADATA_KEYS {
-                            metadata.remove(*key);
-                        }
-                    }
                 }
                 metadata.insert(
                     "x-codex-installation-id".to_owned(),
@@ -436,36 +408,6 @@ pub(crate) fn scope_request_to_account(
 
     request.turn_state = turn_state;
     request.turn_metadata = turn_metadata;
-    if let Some(continuation) = continuation {
-        request.set_previous_response_id(Some(continuation));
-    }
-}
-
-fn sanitize_cross_account_input(request: &mut CodexResponsesRequest) {
-    if request.input().is_empty() {
-        return;
-    }
-    let input = request
-        .input()
-        .iter()
-        .cloned()
-        .filter_map(sanitize_cross_account_item)
-        .collect();
-    request.set_input(input);
-}
-
-pub(crate) fn sanitize_cross_account_item(mut item: Value) -> Option<Value> {
-    if let Value::Object(object) = &mut item {
-        if matches!(
-            object.get("type").and_then(Value::as_str),
-            Some("compaction" | "compaction_summary" | "context_compaction")
-        ) {
-            return None;
-        }
-        object.remove("id");
-        object.remove("encrypted_content");
-    }
-    Some(item)
 }
 
 fn metadata_string(request: &CodexResponsesRequest, key: &str) -> Option<String> {

backend/crates/providers/openai/src/transport/usage.rs

@@ -412,6 +412,30 @@ pub fn openai_billing_breakdown(
     model: &str,
     usage: OpenAiBillingUsage,
     service_tier: Option<&str>,
+) -> Option<CalculatedCostBreakdown> {
+    openai_billing_breakdown_with_context(
+        model,
+        usage,
+        service_tier,
+        usage.input_tokens > LONG_CONTEXT_THRESHOLD,
+    )
+}
+
+/// 官方日报没有单次请求边界，不能把整日输入量套用长上下文阶梯。
+/// 聚合统计固定使用公开的短上下文价格，其余价格规则与请求级计费共用。
+pub(crate) fn openai_aggregate_billing_breakdown(
+    model: &str,
+    usage: OpenAiBillingUsage,
+    service_tier: Option<&str>,
+) -> Option<CalculatedCostBreakdown> {
+    openai_billing_breakdown_with_context(model, usage, service_tier, false)
+}
+
+fn openai_billing_breakdown_with_context(
+    model: &str,
+    usage: OpenAiBillingUsage,
+    service_tier: Option<&str>,
+    long_context: bool,
 ) -> Option<CalculatedCostBreakdown> {
     if usage.cached_tokens > usage.input_tokens
         || usage.image_input_tokens > 0
@@ -421,7 +445,6 @@ pub fn openai_billing_breakdown(
     }
     let web_search_ticks = web_search_amount_ticks(usage)?;
     let pricing = model_pricing(model)?;
-    let long_context = usage.input_tokens > LONG_CONTEXT_THRESHOLD;
     let normalized_tier = normalize_service_tier(service_tier);
     let tier = pricing_tier(normalized_tier.as_deref())?;
     let standard_rates = pricing.rates(PricingTier::Standard, long_context)?;

backend/crates/providers/openai/src/transport/usage_statistics.rs

@@ -0,0 +1,122 @@
+//! Codex 官方每日用量报表 transport。
+
+use chrono::NaiveDate;
+use gateway_protocol::openai::events::retry_after_seconds_from_body;
+use reqwest::StatusCode;
+use serde_json::Value;
+
+use super::{
+    CodexBackendClient, CodexClientError, CodexClientResult, CodexRequestContext,
+    client::{
+        CodexBackendTransport, CodexTransportMetrics, read_capped_response_body,
+        retry_after_seconds, truncate_for_error,
+    },
+    diagnostics::CodexUpstreamSendPhase,
+    endpoints::{
+        WHAM_DAILY_TOKEN_USAGE_PATH, WHAM_DAILY_WORKSPACE_USAGE_COUNTS_PATH,
+        WHAM_DAILY_WORKSPACE_USER_TOKEN_USAGE_PATH, endpoint_url,
+    },
+    response_meta,
+};
+
+const MAX_CODEX_DAILY_USAGE_BODY_BYTES: usize = 4 * 1024 * 1024;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum CodexDailyUsageReport {
+    WorkspaceModelTokens,
+    PersonalModelCredits,
+    PersonalTokenTotals,
+}
+
+impl CodexDailyUsageReport {
+    const fn path(self) -> &'static str {
+        match self {
+            Self::WorkspaceModelTokens => WHAM_DAILY_WORKSPACE_USER_TOKEN_USAGE_PATH,
+            Self::PersonalModelCredits => WHAM_DAILY_TOKEN_USAGE_PATH,
+            Self::PersonalTokenTotals => WHAM_DAILY_WORKSPACE_USAGE_COUNTS_PATH,
+        }
+    }
+
+    const fn workspace_user(self) -> bool {
+        matches!(self, Self::PersonalTokenTotals)
+    }
+}
+
+impl CodexBackendClient {
+    pub(crate) async fn fetch_daily_usage(
+        &self,
+        context: CodexRequestContext<'_>,
+        report: CodexDailyUsageReport,
+        start_date: NaiveDate,
+        end_date: NaiveDate,
+    ) -> CodexClientResult<Value> {
+        let headers = self.usage_request_headers(context)?;
+        let workspace_user = if report.workspace_user() {
+            "&workspace_user=true"
+        } else {
+            ""
+        };
+        let url = format!(
+            "{}?start_date={start_date}&end_date={end_date}&group_by=day{workspace_user}",
+            endpoint_url(&self.base_url, report.path()),
+        );
+        let response = self.client.get(url).headers(headers).send().await?;
+        let status = response.status();
+        let diagnostics = response_meta::diagnostics(Some(status.as_u16()), response.headers());
+        let retry_after_seconds = retry_after_seconds(response.headers(), None);
+        let body = read_capped_response_body(response, MAX_CODEX_DAILY_USAGE_BODY_BYTES).await?;
+        if body.limit_exceeded() {
+            return Err(upstream_error(
+                if status.is_success() {
+                    StatusCode::BAD_GATEWAY
+                } else {
+                    status
+                },
+                "upstream daily usage response exceeded the body limit".to_owned(),
+                retry_after_seconds,
+                diagnostics,
+            ));
+        }
+        let body = body.into_string();
+        if !status.is_success() {
+            return Err(upstream_error(
+                status,
+                body.clone(),
+                retry_after_seconds.or_else(|| retry_after_seconds_from_body(&body)),
+                diagnostics,
+            ));
+        }
+
+        serde_json::from_str::<Value>(&body).map_err(|_| {
+            upstream_error(
+                StatusCode::BAD_GATEWAY,
+                format!(
+                    "invalid daily usage response: {}",
+                    truncate_for_error(&body)
+                ),
+                None,
+                diagnostics,
+            )
+        })
+    }
+}
+
+fn upstream_error(
+    status: StatusCode,
+    body: String,
+    retry_after_seconds: Option<u64>,
+    diagnostics: super::CodexUpstreamDiagnostics,
+) -> CodexClientError {
+    CodexClientError::Upstream {
+        status,
+        body,
+        client_response: None,
+        retry_after_seconds,
+        diagnostics: Box::new(diagnostics),
+        set_cookie_headers: Vec::new(),
+        rate_limit_headers: Vec::new(),
+        transport: CodexBackendTransport::HttpSse,
+        transport_metrics: Box::<CodexTransportMetrics>::default(),
+        send_phase: CodexUpstreamSendPhase::AfterPayload,
+    }
+}

backend/crates/providers/openai/src/transport/websocket/pool/mod.rs

@@ -10,13 +10,13 @@ use std::{
     time::Duration,
 };
 
-use tokio::{sync::Semaphore, time::Instant};
+use tokio::sync::Semaphore;
 use tokio_util::{sync::CancellationToken, task::TaskTracker};
 use uuid::Uuid;
 
 use self::state::{
-    WebSocketPoolConnecting, WebSocketPoolSlot, WebSocketPoolState, account_slot_count,
-    close_pooled_connection, close_pooled_connections, take_lru_idle_connection,
+    WebSocketPoolConnecting, WebSocketPoolSlot, WebSocketPoolState, close_pooled_connection,
+    close_pooled_connections,
 };
 use super::pump::PumpKeepalive;
 
@@ -31,8 +31,6 @@ pub(crate) use self::{
     },
 };
 
-const DEFAULT_MAX_PER_ACCOUNT: usize = 8;
-const DEFAULT_MAX_TOTAL: usize = 64;
 const DEFAULT_MAX_CONNECTING: usize = 16;
 const DEFAULT_MAX_AGE: Duration = Duration::from_mins(55);
 const DEFAULT_MAINTENANCE_INTERVAL: Duration = Duration::from_secs(25);
@@ -64,10 +62,6 @@ pub struct CodexWebSocketPoolConfig {
     pub enabled: bool,
     /// 单个 socket 的最大生命周期。
     pub max_age: Duration,
-    /// 单个账号允许占用的最大池 slot 数。
-    pub max_per_account: usize,
-    /// 所有账号合计允许占用的最大池 slot 数。
-    pub max_total: usize,
     /// 所有账号合计允许并发执行的 opening 数。
     pub max_connecting: usize,
     /// 后台维护间隔；`None` 表示不启动后台任务。
@@ -87,8 +81,6 @@ impl Default for CodexWebSocketPoolConfig {
         Self {
             enabled: true,
             max_age: DEFAULT_MAX_AGE,
-            max_per_account: DEFAULT_MAX_PER_ACCOUNT,
-            max_total: DEFAULT_MAX_TOTAL,
             max_connecting: DEFAULT_MAX_CONNECTING,
             maintenance_interval: Some(DEFAULT_MAINTENANCE_INTERVAL),
             ping_interval: Some(DEFAULT_PING_INTERVAL),
@@ -113,10 +105,9 @@ impl CodexWebSocketPoolConfig {
 }
 
 impl CodexWebSocketPool {
-    /// 构造连接池策略和状态。
-    pub fn new(max_per_account: usize, max_age: Duration) -> Self {
+    /// 构造不限制累计 slot 数的连接池策略和状态。
+    pub fn new(max_age: Duration) -> Self {
         Self::with_config(CodexWebSocketPoolConfig {
-            max_per_account: max_per_account.max(1),
             max_age,
             maintenance_interval: None,
             ping_interval: None,
@@ -218,43 +209,25 @@ impl CodexWebSocketPool {
 
             let acquire = if required_response_id.is_some() {
                 WebSocketPoolAcquire::Bypass(WebSocketPoolBypassReason::ContinuationNotFound)
-            } else if self.config.max_per_account == 0
-                || account_slot_count(&state.slots, key.account_id()) >= self.config.max_per_account
-            {
-                WebSocketPoolAcquire::Bypass(WebSocketPoolBypassReason::Cap)
             } else {
                 let connect_permit = self.connect_semaphore.clone().try_acquire_owned().ok();
                 match connect_permit {
                     Some(connect_permit) => {
-                        let has_total_capacity = if self.config.max_total == 0 {
-                            false
-                        } else if state.slots.len() < self.config.max_total {
-                            true
-                        } else if let Some(connection) = take_lru_idle_connection(&mut state) {
-                            connections_to_close.push(connection);
-                            true
-                        } else {
-                            false
-                        };
-                        if has_total_capacity {
-                            let lease = WebSocketPoolConnectLease::reserve(
-                                self.clone(),
-                                key.clone(),
-                                connect_permit,
-                            );
-                            state.slots.insert(
-                                key,
-                                WebSocketPoolSlot::Connecting(WebSocketPoolConnecting {
-                                    id: lease.id,
-                                    started_at: lease.started_at,
-                                    outcome: lease.outcome.clone(),
-                                    cancellation: lease.cancellation.clone(),
-                                }),
-                            );
-                            WebSocketPoolAcquire::Connect(lease)
-                        } else {
-                            WebSocketPoolAcquire::Bypass(WebSocketPoolBypassReason::Cap)
-                        }
+                        let lease = WebSocketPoolConnectLease::reserve(
+                            self.clone(),
+                            key.clone(),
+                            connect_permit,
+                        );
+                        state.slots.insert(
+                            key,
+                            WebSocketPoolSlot::Connecting(WebSocketPoolConnecting {
+                                id: lease.id,
+                                started_at: lease.started_at,
+                                outcome: lease.outcome.clone(),
+                                cancellation: lease.cancellation.clone(),
+                            }),
+                        );
+                        WebSocketPoolAcquire::Connect(lease)
                     }
                     None => WebSocketPoolAcquire::Bypass(WebSocketPoolBypassReason::Cap),
                 }
@@ -292,7 +265,6 @@ impl CodexWebSocketPool {
                     key.clone(),
                     WebSocketPoolSlot::Idle {
                         connection: Box::new(connection),
-                        last_used_at: Instant::now(),
                     },
                 );
             }

backend/crates/providers/openai/src/transport/websocket/pool/state.rs

@@ -108,7 +108,6 @@ impl WebSocketContinuationState {
 pub(super) enum WebSocketPoolSlot {
     Idle {
         connection: Box<PooledWebSocketConnection>,
-        last_used_at: Instant,
     },
     Busy(WebSocketPoolReservation),
     Connecting(WebSocketPoolConnecting),
@@ -138,34 +137,6 @@ pub(super) struct WebSocketPoolReservation {
     pub(super) latest_response_id: Option<String>,
 }
 
-pub(super) fn account_slot_count(
-    slots: &HashMap<CodexWebSocketPoolKey, WebSocketPoolSlot>,
-    account_id: &str,
-) -> usize {
-    slots
-        .keys()
-        .filter(|key| key.account_id() == account_id)
-        .count()
-}
-
-pub(super) fn take_lru_idle_connection(
-    state: &mut WebSocketPoolState,
-) -> Option<PooledWebSocketConnection> {
-    let key = state
-        .slots
-        .iter()
-        .filter_map(|(key, slot)| match slot {
-            WebSocketPoolSlot::Idle { last_used_at, .. } => Some((key, *last_used_at)),
-            WebSocketPoolSlot::Busy(_) | WebSocketPoolSlot::Connecting(_) => None,
-        })
-        .min_by_key(|(_, last_used_at)| *last_used_at)
-        .map(|(key, _)| key.clone())?;
-    let Some(WebSocketPoolSlot::Idle { connection, .. }) = state.slots.remove(&key) else {
-        return None;
-    };
-    Some(*connection)
-}
-
 pub(super) async fn close_pooled_connection(connection: PooledWebSocketConnection) {
     connection.websocket.close().await;
 }

backend/crates/providers/openai/tests/admin.rs

@@ -1,11 +1,11 @@
-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, BTreeSet};
 use std::num::NonZeroU32;
 use std::sync::{Arc, Mutex};
 use std::time::{Duration, SystemTime};
 
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
 use chrono::{DateTime, TimeZone as _, Utc};
-use futures::future::BoxFuture;
+use futures::{StreamExt, future::BoxFuture};
 use gateway_admin::model::accounts::AccountRecord;
 use gateway_admin::model::observability::{
     CurrencyCost, DesktopReleaseStatus, ProviderBillingInput,
@@ -23,7 +23,12 @@ use gateway_core::engine::credential::{
     CredentialRevision, CredentialState, OpaqueProviderData, ProviderAccount, ProviderAccountId,
     ProviderAccountStore, QuotaAccessChange, QuotaEvidence, QuotaObservation, QuotaState,
 };
+use gateway_core::engine::provider::ProviderRequest;
+use gateway_core::engine::{
+    AccountAttemptContext, AttemptContext, CancellationToken, ModelRequestId, RequestAttemptContext,
+};
 use gateway_core::operation::{GenerateRequest, Operation, ProtocolPayload};
+use gateway_core::policy::ClientApiKeyId;
 use gateway_core::provider_ports::{
     NewOAuthPendingFlow, OAuthPendingClaimOutcome, OAuthPendingConsumeOutcome,
     OAuthPendingFlowPort, OAuthPendingPutOutcome, OAuthPendingReleaseOutcome,
@@ -32,7 +37,11 @@ use gateway_core::provider_ports::{
     ProviderCredentialState, ProviderCredentialStatePort, ProviderRefreshPolicy,
     ProviderRuntimePolicyPort, ProviderScopedCooldown, ProviderStoreError, ProviderStorePorts,
 };
-use gateway_core::routing::{ProviderKind, UpstreamModelId};
+use gateway_core::routing::{
+    ClientRoutingScope, ConfigRevision, FrozenAccountScope, ModelCapabilities, ProviderKind,
+    ProviderModel, PublicModelId, RoutingContext, RuntimeAccount, RuntimeAccountDirectory,
+    RuntimeSnapshot, UpstreamModelId,
+};
 use gateway_core::task::{WorkerContribution, WorkerKind, WorkerRunnable};
 use provider_openai::config::{CodexWireProfileConfig, OpenAiConfig};
 use provider_openai::credential::{CodexCredentialCodec, ImportCodexOAuthCredential};
@@ -46,9 +55,14 @@ use wiremock::{Mock, MockServer, ResponseTemplate};
 
 use crate::support::{
     MemoryAccountStore, MemorySessionAffinity, MemorySessionExclusions, TestLeaseCoordinator,
-    profile, secret,
+    account_policy, profile, secret,
 };
 
+const COMPLETED_SESSION_SSE: &str = concat!(
+    "event: response.completed\n",
+    "data: {\"type\":\"response.completed\",\"response\":{\"id\":\"resp_initialized_session\",\"model\":\"gpt-5.4\",\"status\":\"completed\",\"output\":[],\"usage\":{\"input_tokens\":1,\"output_tokens\":1,\"total_tokens\":2}}}\n\n"
+);
+
 #[tokio::test]
 async fn openai_bundle_exposes_one_core_provider_and_drains_worker_contributions_once() {
     let config = valid_config();
@@ -97,6 +111,84 @@ async fn openai_bundle_exposes_one_core_provider_and_drains_worker_contributions
     assert!(bundle.take_worker_contributions().is_empty());
 }
 
+#[tokio::test]
+async fn initialized_provider_keeps_thread_spawn_transport_conversations_distinct() {
+    let account_id = "acct_initialized_thread_spawn";
+    let store = Arc::new(MemoryAccountStore::default());
+    store
+        .seed_oauth_credential(ImportCodexOAuthCredential {
+            account_id: account_id.to_owned(),
+            name: account_id.to_owned(),
+            secret: secret("at-initialized-thread-spawn"),
+            verified_account: profile("chatgpt-initialized-thread-spawn"),
+            next_refresh_at: Some(Utc::now() + chrono::Duration::minutes(30)),
+            enabled: true,
+        })
+        .await;
+    let server = MockServer::start().await;
+    Mock::given(method("POST"))
+        .and(path("/codex/responses"))
+        .respond_with(
+            ResponseTemplate::new(200)
+                .insert_header("content-type", "text/event-stream")
+                .set_body_string(COMPLETED_SESSION_SSE),
+        )
+        .expect(2)
+        .mount(&server)
+        .await;
+    let mut config = valid_config();
+    config.config.api.base_url = server.uri();
+    let bundle = provider_openai::initialize(
+        config.config.clone(),
+        provider_ports_with(store, Arc::new(TestOAuthPending::default())),
+    )
+    .await
+    .expect("initialized OpenAI provider");
+    let provider = bundle.core_provider();
+    let thread_spawn = r#"{"subagent_kind":"thread_spawn"}"#;
+    let mut conversation_ids = Vec::new();
+
+    for (request_id, thread_id) in [
+        ("req_initialized_thread_spawn_first", "child-one"),
+        ("req_initialized_thread_spawn_second", "child-two"),
+    ] {
+        let payload = ProtocolPayload::json_object(
+            "openai",
+            Map::from_iter([
+                ("model".to_owned(), json!("gpt-5.4")),
+                ("input".to_owned(), json!("child task")),
+                ("session_id".to_owned(), json!("parent-session")),
+                ("thread_id".to_owned(), json!(thread_id)),
+                ("turnMetadata".to_owned(), json!(thread_spawn)),
+            ]),
+        )
+        .expect("OpenAI payload")
+        .with_context(Map::from_iter([("use_websocket".to_owned(), json!(false))]));
+        let operation = Operation::Generate(GenerateRequest::from_protocol_payload(payload));
+        let mut stream = provider
+            .execute(
+                initialized_provider_request(operation, account_id),
+                initialized_attempt_context(request_id, account_id),
+            )
+            .await
+            .expect("prepare child provider stream");
+        let mut conversation_id = None;
+        while let Some(event) = stream.next().await {
+            let event = event.expect("child provider response");
+            if let Some(update) = event.session_update() {
+                conversation_id = update
+                    .payload()
+                    .get("conversation_id")
+                    .and_then(Value::as_str)
+                    .map(ToOwned::to_owned);
+            }
+        }
+        conversation_ids.push(conversation_id.expect("child transport conversation id"));
+    }
+
+    assert_ne!(conversation_ids[0], conversation_ids[1]);
+}
+
 #[tokio::test]
 async fn openai_admin_provider_exposes_live_wire_profile_and_validated_billing() {
     let config = valid_config();
@@ -921,6 +1013,63 @@ fn reset_credit_command(account_id: ProviderAccountId) -> ConsumeProviderResetCr
     }
 }
 
+fn initialized_provider_request(operation: Operation, account_id: &str) -> ProviderRequest {
+    let provider = ProviderKind::new("openai").expect("provider");
+    let upstream_model = UpstreamModelId::new("gpt-5.4").expect("upstream model");
+    let public_model = PublicModelId::new(upstream_model.as_str()).expect("public model");
+    let account_scope = initialized_account_scope(account_id);
+    let snapshot = RuntimeSnapshot::new(
+        ConfigRevision::new(1).expect("revision"),
+        account_policy(),
+        vec![provider.clone()],
+        vec![ProviderModel::new(
+            provider,
+            upstream_model,
+            ModelCapabilities::new(BTreeSet::from([operation.kind()]), Some(32_000))
+                .with_upstream_feature_validation(),
+        )],
+        Vec::new(),
+    )
+    .expect("runtime snapshot");
+    let plan = snapshot
+        .plan(
+            &public_model,
+            &operation,
+            account_scope,
+            &RoutingContext::default(),
+        )
+        .expect("routing plan");
+
+    ProviderRequest::new(operation, plan.candidates()[0].clone())
+}
+
+fn initialized_attempt_context(request_id: &str, account_id: &str) -> AttemptContext {
+    AttemptContext::new(
+        RequestAttemptContext::new(
+            ModelRequestId::new(request_id).expect("request id"),
+            ClientApiKeyId::new("key_openai_initialized").expect("client key id"),
+        ),
+        NonZeroU32::new(1).expect("attempt"),
+        SystemTime::now() + Duration::from_secs(30),
+        account_policy(),
+        AccountAttemptContext::new(BTreeSet::new(), None, None)
+            .with_account_scope(initialized_account_scope(account_id)),
+        None,
+        CancellationToken::new(),
+    )
+}
+
+fn initialized_account_scope(account_id: &str) -> Arc<FrozenAccountScope> {
+    let provider = ProviderKind::new("openai").expect("provider");
+    Arc::new(FrozenAccountScope::new(
+        Arc::new(RuntimeAccountDirectory::new(BTreeMap::from([(
+            ProviderAccountId::new(account_id).expect("account id"),
+            RuntimeAccount::new(provider, BTreeSet::new()),
+        )]))),
+        ClientRoutingScope::all_accounts(),
+    ))
+}
+
 fn provider_ports() -> ProviderStorePorts {
     provider_ports_with(
         Arc::new(MemoryAccountStore::default()),

backend/crates/providers/openai/tests/config.rs

@@ -101,8 +101,6 @@ fn openai_config_defaults_to_the_provider_owned_operating_values() {
             config.api.base_url.as_str(),
             config.ws_pool.enabled,
             config.ws_pool.max_age_ms,
-            config.ws_pool.max_per_account,
-            config.ws_pool.max_total,
             config.ws_pool.max_connecting,
             config.ws_pool.initial_event_timeout_ms,
             config.quota.refresh_interval_minutes,
@@ -115,8 +113,6 @@ fn openai_config_defaults_to_the_provider_owned_operating_values() {
             true,
             3_300_000,
             8,
-            64,
-            8,
             20_000,
             15,
             true,

backend/crates/providers/openai/tests/credential/contract.rs

@@ -445,6 +445,74 @@ fn selector_round_robin_cursor_advances_across_requests() {
     );
 }
 
+#[tokio::test]
+async fn selector_should_claim_the_initial_session_account_before_upstream_send() {
+    let store = Arc::new(MemoryAccountStore::default());
+    create_account(&store, "acct_first", "at-first");
+    create_account(&store, "acct_second", "at-second");
+    let affinity = Arc::new(MemorySessionAffinity::default());
+    let selector = selector_with_affinity(
+        &store,
+        Arc::new(TestLeaseCoordinator::default()),
+        Arc::clone(&affinity),
+    );
+    let provider = ProviderKind::new("openai").expect("provider");
+    let key = ProviderSessionAffinityKey::try_new("initial-claim").expect("affinity key");
+    let request_attempt = attempt(BTreeSet::new());
+
+    let selected = selector
+        .select(&SelectCodexCredential {
+            upstream_model: "gpt-5.4",
+            request_url: &Url::parse("https://chatgpt.com/backend-api/codex/responses")
+                .expect("request URL"),
+            attempt: &request_attempt,
+            session_affinity_key: Some(&key),
+        })
+        .await
+        .expect("select initial account");
+
+    assert_eq!(
+        affinity
+            .load(&provider, &key)
+            .await
+            .expect("load claimed affinity"),
+        Some(selected.account_id().clone())
+    );
+}
+
+#[tokio::test]
+async fn record_success_should_not_overwrite_a_newer_session_winner() {
+    let store = Arc::new(MemoryAccountStore::default());
+    create_account(&store, "acct_first", "at-first");
+    create_account(&store, "acct_second", "at-second");
+    let affinity = Arc::new(MemorySessionAffinity::default());
+    let selector = selector_with_affinity(
+        &store,
+        Arc::new(TestLeaseCoordinator::default()),
+        Arc::clone(&affinity),
+    );
+    let provider = ProviderKind::new("openai").expect("provider");
+    let key = ProviderSessionAffinityKey::try_new("late-success").expect("affinity key");
+    let first = store.account("acct_first").expect("first account");
+    let second = ProviderAccountId::new("acct_second").expect("second account");
+    affinity
+        .bind(&provider, &key, &second, Duration::from_secs(60))
+        .await
+        .expect("seed newer affinity");
+
+    selector
+        .record_success(&first, Some(&key), first.id())
+        .await;
+
+    assert_eq!(
+        affinity
+            .load(&provider, &key)
+            .await
+            .expect("load preserved affinity"),
+        Some(second)
+    );
+}
+
 #[tokio::test]
 async fn selector_should_reuse_the_account_bound_to_the_same_session() {
     let store = Arc::new(MemoryAccountStore::default());
@@ -469,7 +537,9 @@ async fn selector_should_reuse_the_account_bound_to_the_same_session() {
         })
         .await
         .expect("select first account");
-    selector.record_success(first.account(), Some(&key)).await;
+    selector
+        .record_success(first.account(), Some(&key), first.account_id())
+        .await;
     let first_account = first.account_id().clone();
 
     let second_attempt = attempt(BTreeSet::new());
@@ -535,7 +605,7 @@ async fn selector_should_replace_a_busy_affinity_binding_after_the_fallback_succ
         .await
         .expect("select fallback account");
     selector
-        .record_success(selected.account(), Some(&key))
+        .record_success(selected.account(), Some(&key), &bound)
         .await;
 
     assert_eq!(
@@ -1005,7 +1075,7 @@ fn successful_upstream_response_recovers_non_quota_terminal_states() {
         let current = store.account("acct_primary").expect("stale account");
         let selector = selector(&store, Arc::new(TestLeaseCoordinator::default()));
 
-        block_on(selector.record_success(&current, None));
+        block_on(selector.record_success(&current, None, current.id()));
 
         assert_eq!(
             store
@@ -1289,7 +1359,7 @@ fn cloudflare_challenge_does_not_change_persisted_account_facts() {
             .credential_state(),
         CredentialState::Ready
     );
-    block_on(selector.record_success(lease.account(), None));
+    block_on(selector.record_success(lease.account(), None, lease.account_id()));
 }
 
 #[test]

backend/crates/providers/openai/tests/credential/quota/mod.rs

@@ -2,6 +2,7 @@
 
 mod recovery;
 mod snapshot;
+mod usage_statistics;
 
 use std::sync::Arc;
 use std::time::SystemTime;

backend/crates/providers/openai/tests/credential/quota/usage_statistics.rs

@@ -0,0 +1,307 @@
+use std::collections::BTreeMap;
+use std::sync::Arc;
+
+use chrono::{DateTime, Days, NaiveTime, TimeDelta, Utc};
+use gateway_core::engine::credential::ProviderAccountId;
+use provider_openai::credential::{
+    CodexUsageStatisticsError, CodexUsageStatisticsMode, CodexUsageStatisticsServiceTier,
+};
+use serde_json::json;
+use wiremock::matchers::{method, path};
+use wiremock::{Mock, MockServer, ResponseTemplate};
+
+use super::{create_account, quota_service_with_base_url};
+use crate::support::MemoryAccountStore;
+
+const WORKSPACE_REPORT_PATH: &str = "/wham/usage/daily-workspace-user-token-usage-breakdown";
+const PERSONAL_MODEL_REPORT_PATH: &str = "/wham/usage/daily-token-usage-breakdown";
+const PERSONAL_TOTALS_REPORT_PATH: &str = "/wham/analytics/daily-workspace-usage-counts";
+
+fn cycle_anchor() -> (DateTime<Utc>, DateTime<Utc>) {
+    let start_date = Utc::now()
+        .date_naive()
+        .checked_sub_days(Days::new(1))
+        .expect("cycle start date");
+    let start_at = DateTime::<Utc>::from_naive_utc_and_offset(
+        start_date.and_time(NaiveTime::from_hms_opt(15, 50, 0).expect("cycle time")),
+        Utc,
+    );
+    (
+        start_at,
+        start_at
+            .checked_add_signed(TimeDelta::days(7))
+            .expect("cycle end"),
+    )
+}
+
+async fn mount_quota(server: &MockServer, reset_at: DateTime<Utc>) {
+    Mock::given(method("GET"))
+        .and(path("/api/codex/usage"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "rate_limit": {
+                "allowed": true,
+                "primary_window": {
+                    "used_percent": 20,
+                    "reset_at": reset_at.timestamp(),
+                    "limit_window_seconds": 604800
+                }
+            }
+        })))
+        .mount(server)
+        .await;
+}
+
+async fn service(
+    account_id: &str,
+    server: &MockServer,
+    reset_at: DateTime<Utc>,
+) -> (
+    Arc<MemoryAccountStore>,
+    provider_openai::credential::CodexCredentialQuotaService,
+) {
+    let store = Arc::new(MemoryAccountStore::default());
+    create_account(&store, account_id).await;
+    mount_quota(server, reset_at).await;
+    let service = quota_service_with_base_url(
+        &store,
+        reqwest::Client::builder()
+            .no_proxy()
+            .build()
+            .expect("client"),
+        server.uri(),
+    );
+    (store, service)
+}
+
+#[tokio::test]
+async fn personal_report_allocates_tokens_on_the_server_and_preserves_official_totals() {
+    let server = MockServer::start().await;
+    let (start_at, end_at) = cycle_anchor();
+    let report_date = Utc::now().date_naive().to_string();
+    Mock::given(method("GET"))
+        .and(path(WORKSPACE_REPORT_PATH))
+        .respond_with(ResponseTemplate::new(400).set_body_string("no active workspace"))
+        .mount(&server)
+        .await;
+    Mock::given(method("GET"))
+        .and(path(PERSONAL_MODEL_REPORT_PATH))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({"data": [{
+            "date": report_date,
+            "models": [
+                {"model": "gpt-5.6-sol", "speed": "fast", "credits": 75},
+                {"model": "gpt-5.6-terra", "speed": "standard", "credits": 25}
+            ]
+        }]})))
+        .mount(&server)
+        .await;
+    Mock::given(method("GET"))
+        .and(path(PERSONAL_TOTALS_REPORT_PATH))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({"data": [{
+            "date": report_date,
+            "uncached_text_input_tokens": 101,
+            "cached_text_input_tokens": 203,
+            "text_output_tokens": 17,
+            "text_total_tokens": 321
+        }]})))
+        .mount(&server)
+        .await;
+    let (store, service) = service("acct_personal_statistics", &server, end_at).await;
+    let account = store
+        .account("acct_personal_statistics")
+        .expect("personal account");
+
+    let statistics = service
+        .usage_statistics(account.id(), 0, 0)
+        .await
+        .expect("personal statistics");
+
+    assert_eq!(statistics.mode, CodexUsageStatisticsMode::Personal);
+    assert_eq!(statistics.cycle.start_at, start_at);
+    assert_eq!(statistics.summary.tokens.uncached_input, 101);
+    assert_eq!(statistics.summary.tokens.cached_input, 203);
+    assert_eq!(statistics.summary.tokens.output, 17);
+    assert_eq!(statistics.summary.tokens.total, 321);
+    assert_eq!(
+        statistics
+            .models
+            .iter()
+            .map(|model| model.tokens.uncached_input)
+            .sum::<u64>(),
+        101
+    );
+    assert_eq!(
+        statistics
+            .models
+            .iter()
+            .map(|model| model.tokens.total)
+            .sum::<u64>(),
+        321
+    );
+    assert!(
+        statistics
+            .models
+            .iter()
+            .all(|model| model.has_estimated_allocation)
+    );
+    assert!(statistics.models.iter().any(|model| {
+        model.model == "gpt-5.6-sol" && model.service_tier == CodexUsageStatisticsServiceTier::Fast
+    }));
+    assert!(statistics.models.iter().any(|model| {
+        model.model == "gpt-5.6-terra"
+            && model.service_tier == CodexUsageStatisticsServiceTier::Standard
+    }));
+}
+
+#[tokio::test]
+async fn workspace_report_keeps_direct_rows_marks_boundary_and_never_prices_unknown_models() {
+    let server = MockServer::start().await;
+    let (start_at, end_at) = cycle_anchor();
+    let report_date = start_at.date_naive().to_string();
+    Mock::given(method("GET"))
+        .and(path(WORKSPACE_REPORT_PATH))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({"data": [{
+            "date": report_date,
+            "models": [
+                {
+                    "model": "gpt-5.6-sol",
+                    "speed": "fast",
+                    "uncached_text_input_tokens": 1000000,
+                    "cached_text_input_tokens": 1000000,
+                    "text_output_tokens": 1000000,
+                    "text_total_tokens": 3000000
+                },
+                {
+                    "model": "gpt-5.6-terra",
+                    "speed": "standard",
+                    "uncached_text_input_tokens": 1000000,
+                    "text_total_tokens": 1000000
+                },
+                {
+                    "model": "future-private-model",
+                    "speed": "fast",
+                    "uncached_text_input_tokens": 10,
+                    "text_total_tokens": 10
+                }
+            ]
+        }]})))
+        .mount(&server)
+        .await;
+    let (store, service) = service("acct_workspace_statistics", &server, end_at).await;
+    let account = store
+        .account("acct_workspace_statistics")
+        .expect("workspace account");
+
+    let statistics = service
+        .usage_statistics(account.id(), 0, 0)
+        .await
+        .expect("workspace statistics");
+
+    assert_eq!(statistics.mode, CodexUsageStatisticsMode::Workspace);
+    assert!(statistics.daily[0].is_boundary_day);
+    let sol = statistics
+        .models
+        .iter()
+        .find(|model| model.model == "gpt-5.6-sol")
+        .expect("Sol row");
+    assert_eq!(sol.service_tier, CodexUsageStatisticsServiceTier::Fast);
+    assert_eq!(
+        sol.estimated_cost
+            .expect("published Sol price")
+            .amount()
+            .canonical(),
+        "71"
+    );
+    let terra = statistics
+        .models
+        .iter()
+        .find(|model| model.model == "gpt-5.6-terra")
+        .expect("Terra row");
+    assert_eq!(
+        terra.service_tier,
+        CodexUsageStatisticsServiceTier::Standard
+    );
+    assert_eq!(
+        terra
+            .estimated_cost
+            .expect("published Terra price")
+            .amount()
+            .canonical(),
+        "2"
+    );
+    let unknown = statistics
+        .models
+        .iter()
+        .find(|model| model.model == "future-private-model")
+        .expect("unknown row");
+    assert_eq!(unknown.tokens.total, 10);
+    assert!(unknown.estimated_cost.is_none());
+    assert!(unknown.has_unknown_pricing);
+    assert!(statistics.summary.estimated_cost.is_some());
+    assert!(statistics.summary.has_unknown_pricing);
+    assert!(statistics.summary.projected_cost.is_none());
+}
+
+#[tokio::test]
+async fn cycle_offset_fetches_only_the_selected_cycle_with_boundary_padding() {
+    let server = MockServer::start().await;
+    let (current_start_at, current_end_at) = cycle_anchor();
+    let selected_date = current_start_at
+        .date_naive()
+        .checked_sub_days(Days::new(14))
+        .expect("selected date");
+    Mock::given(method("GET"))
+        .and(path(WORKSPACE_REPORT_PATH))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({"data": [{
+            "date": selected_date.to_string(),
+            "models": [{
+                "model": "gpt-5.6-terra",
+                "speed": "standard",
+                "uncached_text_input_tokens": 10,
+                "text_total_tokens": 10
+            }]
+        }]})))
+        .mount(&server)
+        .await;
+    let (store, service) = service("acct_offset_statistics", &server, current_end_at).await;
+    let account = store
+        .account("acct_offset_statistics")
+        .expect("offset account");
+
+    let statistics = service
+        .usage_statistics(account.id(), -2, 0)
+        .await
+        .expect("historical statistics");
+    assert_eq!(statistics.cycle.offset, -2);
+    assert!(!statistics.cycle.is_current);
+    assert!(statistics.cycle.can_go_next);
+    assert!(statistics.cycle.used_percent.is_none());
+    assert_eq!(statistics.daily[0].date, selected_date);
+
+    let requests = server.received_requests().await.expect("recorded requests");
+    let report = requests
+        .iter()
+        .find(|request| request.url.path() == WORKSPACE_REPORT_PATH)
+        .expect("workspace report request");
+    let query = report
+        .url
+        .query_pairs()
+        .map(|(key, value)| (key.into_owned(), value.into_owned()))
+        .collect::<BTreeMap<_, _>>();
+    let expected_start = current_start_at
+        .date_naive()
+        .checked_sub_days(Days::new(15))
+        .expect("query start");
+    let expected_end = current_start_at
+        .date_naive()
+        .checked_sub_days(Days::new(6))
+        .expect("query end");
+    assert_eq!(query.get("start_date"), Some(&expected_start.to_string()));
+    assert_eq!(query.get("end_date"), Some(&expected_end.to_string()));
+    assert_eq!(query.get("group_by").map(String::as_str), Some("day"));
+
+    let invalid_account = ProviderAccountId::new("acct_invalid_offset").expect("account ID");
+    assert!(matches!(
+        service.usage_statistics(&invalid_account, -9, 0).await,
+        Err(CodexUsageStatisticsError::InvalidRequest)
+    ));
+}

backend/crates/providers/openai/tests/provider/contract.rs

@@ -344,6 +344,8 @@ fn contract_account_scope() -> Arc<FrozenAccountScope> {
         "acct_local_affinity",
         "acct_metadata_new",
         "acct_metadata_old",
+        "acct_unknown_continuation",
+        "acct_unknown_turn_state",
         "acct_prefetch_limit",
         "acct_presentation",
         "acct_provider_contract",
@@ -352,7 +354,8 @@ fn contract_account_scope() -> Arc<FrozenAccountScope> {
         "acct_scope_same",
         "acct_semantic_failure",
         "acct_session_affinity",
-        "acct_subagent",
+        "acct_subagent_a",
+        "acct_subagent_b",
         "acct_success_exhausted",
         "acct_thread_spawn_affinity",
         "acct_truncated_stream",
@@ -456,6 +459,24 @@ fn replay_any_context(request_id: &str, owner_account_id: &str) -> AttemptContex
     .with_continuation_attempt(ContinuationAttempt::ReplayAny)
 }
 
+fn external_continuation_context(request_id: &str) -> AttemptContext {
+    AttemptContext::new(
+        RequestAttemptContext::new(
+            ModelRequestId::new(request_id).expect("request id"),
+            ClientApiKeyId::new("key_openai_contract").expect("client key id"),
+        ),
+        NonZeroU32::new(1).expect("attempt"),
+        SystemTime::now() + Duration::from_secs(30),
+        account_policy(),
+        AccountAttemptContext::new(BTreeSet::new(), None, None)
+            .with_account_scope(contract_account_scope()),
+        Some(ContinuationBinding::External(PreviousResponseId::new(
+            "external-previous-response",
+        ))),
+        CancellationToken::new(),
+    )
+}
+
 async fn capture_scoped_http_request(
     request_id: &str,
     selected_account_id: &str,
@@ -1319,6 +1340,53 @@ async fn cross_account_scope_removes_only_account_bound_body_fields() {
     );
 }
 
+#[tokio::test]
+async fn cross_account_full_replay_should_preserve_the_complete_transcript() {
+    let transcript = json!([
+        {
+            "type": "reasoning",
+            "id": "reasoning-item-id",
+            "encrypted_content": "reasoning-ciphertext",
+            "summary": []
+        },
+        {
+            "type": "compaction",
+            "id": "compaction-item-id",
+            "encrypted_content": "compaction-ciphertext"
+        },
+        {
+            "type": "agent_message",
+            "id": "agent-message-id",
+            "content": [
+                {"type": "output_text", "text": "visible"},
+                {"type": "encrypted_content", "encrypted_content": "nested-ciphertext"}
+            ]
+        },
+        {
+            "type": "function_call",
+            "id": "function-call-id",
+            "call_id": "call-id",
+            "name": "tool",
+            "arguments": "{}",
+            "encrypted_function_args": "function-args-ciphertext"
+        }
+    ]);
+    let request = capture_scoped_http_request(
+        "req_scope_transcript",
+        "acct_scope_new",
+        "acct_scope_old",
+        Map::from_iter([
+            ("model".to_owned(), json!("gpt-5.4")),
+            ("input".to_owned(), transcript.clone()),
+        ]),
+        Map::new(),
+    )
+    .await;
+    let body: Value = captured_request_body(&request);
+
+    assert_eq!(body.get("input"), Some(&transcript));
+}
+
 #[tokio::test]
 async fn cross_account_scope_sanitizes_only_known_turn_metadata_fields() {
     let request = capture_scoped_http_request(
@@ -1359,40 +1427,19 @@ async fn cross_account_scope_sanitizes_only_known_turn_metadata_fields() {
 }
 
 #[tokio::test]
-async fn cross_account_continuation_probe_should_preserve_delta_input_and_previous_response() {
+async fn cross_account_continuation_should_require_client_replay_without_an_upstream_probe() {
     let store = Arc::new(MemoryAccountStore::default());
     create_account(&store, "acct_scope_new").await;
     let server = MockServer::start().await;
-    Mock::given(method("POST"))
-        .and(path("/codex/responses"))
-        .respond_with(
-            ResponseTemplate::new(200)
-                .insert_header("content-type", "text/event-stream")
-                .set_body_string(CAPTURE_COMPLETED_SSE),
-        )
-        .expect(1)
-        .mount(&server)
-        .await;
-    let delta_input = json!([
-        {
-            "type": "message",
-            "id": "delta-message-id",
-            "encrypted_content": "opaque-delta-ciphertext",
-            "role": "user",
-            "content": "current turn only"
-        },
-        {
-            "type": "compaction",
-            "id": "delta-compaction-id",
-            "encrypted_content": "opaque-compaction-ciphertext"
-        }
-    ]);
     let generation = GenerateRequest::from_protocol_payload(
         ProtocolPayload::json_object(
             "openai",
             Map::from_iter([
                 ("model".to_owned(), json!("gpt-5.4")),
-                ("input".to_owned(), delta_input.clone()),
+                (
+                    "input".to_owned(),
+                    json!([{"role": "user", "content": "delta"}]),
+                ),
                 (
                     "previous_response_id".to_owned(),
                     json!("client-previous-response"),
@@ -1432,41 +1479,137 @@ async fn cross_account_continuation_probe_should_preserve_delta_input_and_previo
         )
         .expect("provider session state"),
     );
-    let mut stream = provider_with_base_url(&store, server.uri())
+    let result = provider_with_base_url(&store, server.uri())
         .execute(
             planned_request("openai", Operation::Generate(generation)),
             replay_any_context("req_cross_account_probe", "acct_scope_old"),
         )
+        .await;
+    let Err(error) = result else {
+        panic!("cross-account continuation must require a full client replay");
+    };
+    let detail = error
+        .client_visible_upstream_error()
+        .expect("client replay error detail");
+    let requests = server
+        .received_requests()
         .await
-        .expect("prepare continuation probe stream");
+        .expect("captured upstream requests");
+
+    assert_eq!(
+        (
+            error.kind(),
+            error.send_state(),
+            error.continuation_failure(),
+            detail.code(),
+            detail.error_type(),
+        ),
+        (
+            ProviderErrorKind::InvalidRequest,
+            UpstreamSendState::NotSent,
+            Some(ContinuationFailure::HistoryUnavailable),
+            Some("previous_response_not_found"),
+            Some("invalid_request_error"),
+        )
+    );
+    assert!(requests.is_empty());
+}
+
+#[tokio::test]
+async fn missing_affinity_continuation_should_require_client_replay_without_an_upstream_probe() {
+    let store = Arc::new(MemoryAccountStore::default());
+    create_account(&store, "acct_unknown_continuation").await;
+    let server = MockServer::start().await;
+    let generation = GenerateRequest::from_protocol_payload(
+        ProtocolPayload::json_object(
+            "openai",
+            Map::from_iter([
+                ("model".to_owned(), json!("gpt-5.4")),
+                (
+                    "input".to_owned(),
+                    json!([{"role": "user", "content": "delta"}]),
+                ),
+                (
+                    "previous_response_id".to_owned(),
+                    json!("external-previous-response"),
+                ),
+            ]),
+        )
+        .expect("OpenAI payload")
+        .with_context(Map::from_iter([
+            ("use_websocket".to_owned(), json!(false)),
+            ("session_id".to_owned(), json!("expired-affinity-session")),
+        ])),
+    );
+    let result = provider_with_base_url(&store, server.uri())
+        .execute(
+            planned_request("openai", Operation::Generate(generation)),
+            external_continuation_context("req_unknown_continuation"),
+        )
+        .await;
+    let Err(error) = result else {
+        panic!("unowned continuation must require a full client replay");
+    };
+    let requests = server
+        .received_requests()
+        .await
+        .expect("captured upstream requests");
+
+    assert_eq!(
+        error
+            .client_visible_upstream_error()
+            .and_then(|detail| detail.code()),
+        Some("previous_response_not_found")
+    );
+    assert!(requests.is_empty());
+}
+
+#[tokio::test]
+async fn missing_affinity_full_request_should_clear_unowned_turn_state() {
+    let store = Arc::new(MemoryAccountStore::default());
+    create_account(&store, "acct_unknown_turn_state").await;
+    let server = MockServer::start().await;
+    Mock::given(method("POST"))
+        .and(path("/codex/responses"))
+        .respond_with(
+            ResponseTemplate::new(200)
+                .insert_header("content-type", "text/event-stream")
+                .set_body_string(CAPTURE_COMPLETED_SSE),
+        )
+        .expect(1)
+        .mount(&server)
+        .await;
+    let generation = GenerateRequest::from_protocol_payload(
+        ProtocolPayload::json_object(
+            "openai",
+            Map::from_iter([
+                ("model".to_owned(), json!("gpt-5.4")),
+                ("input".to_owned(), json!("full transcript")),
+            ]),
+        )
+        .expect("OpenAI payload")
+        .with_context(Map::from_iter([
+            ("use_websocket".to_owned(), json!(false)),
+            ("session_id".to_owned(), json!("expired-turn-state-session")),
+            ("turn_id".to_owned(), json!("turn-after-affinity-expiry")),
+            ("turn_state".to_owned(), json!("unowned-turn-state")),
+        ])),
+    );
+    let mut stream = provider_with_base_url(&store, server.uri())
+        .execute(
+            planned_request("openai", Operation::Generate(generation)),
+            context("req_unknown_turn_state", CancellationToken::new()),
+        )
+        .await
+        .expect("prepare full replay stream");
     while let Some(event) = stream.next().await {
-        event.expect("continuation probe response");
+        event.expect("full replay response");
     }
     let requests = server
         .received_requests()
         .await
-        .expect("captured continuation probe request");
-    let body: Value = captured_request_body(&requests[0]);
+        .expect("captured full replay request");
 
-    assert_eq!(body.get("input"), Some(&delta_input));
-    assert_eq!(
-        body.get("previous_response_id"),
-        Some(&json!("upstream-previous-response"))
-    );
-    assert!(body.get("authorization").is_none());
-    assert!(body.get("turnMetadata").is_none());
-    assert!(
-        body.pointer("/client_metadata/x-codex-turn-state")
-            .is_none()
-    );
-    assert!(
-        body.pointer("/client_metadata/x-codex-turn-metadata")
-            .is_none()
-    );
-    assert_eq!(
-        body.pointer("/client_metadata/future"),
-        Some(&json!("keep"))
-    );
     assert!(captured_header_values(&requests[0], "x-codex-turn-state").is_empty());
 }
 
@@ -1637,9 +1780,10 @@ async fn prompt_cache_key_should_become_an_opaque_session_affinity_lookup_key()
 }
 
 #[tokio::test]
-async fn subagent_requests_should_use_an_affinity_key_isolated_from_the_root_session() {
+async fn subagent_requests_should_share_the_root_session_account_affinity_key() {
     let store = Arc::new(MemoryAccountStore::default());
-    create_account(&store, "acct_subagent").await;
+    create_account(&store, "acct_subagent_a").await;
+    create_account(&store, "acct_subagent_b").await;
     let affinity = Arc::new(MemorySessionAffinity::default());
     let server = MockServer::start().await;
     Mock::given(method("POST"))
@@ -1689,10 +1833,25 @@ async fn subagent_requests_should_use_an_affinity_key_isolated_from_the_root_ses
 
     let keys = affinity.lookup_keys();
     assert_eq!(keys.len(), 3);
-    assert_ne!(keys[0], keys[1], "subagent must not inherit the root key");
-    assert_eq!(
-        keys[1], keys[2],
-        "the same subagent should retain its own key"
+    assert!(
+        keys.iter().all(|key| key == &keys[0]),
+        "root and derived subagent requests must prefer the same account"
+    );
+    let requests = server
+        .received_requests()
+        .await
+        .expect("captured root and subagent requests");
+    let selected_accounts = requests
+        .iter()
+        .filter_map(|request| request.headers.get("chatgpt-account-id"))
+        .filter_map(|value| value.to_str().ok())
+        .collect::<Vec<_>>();
+    assert_eq!(selected_accounts.len(), 3);
+    assert!(
+        selected_accounts
+            .iter()
+            .all(|account| account == &selected_accounts[0]),
+        "root and subagents should route to the same preferred account"
     );
 }
 
@@ -1867,7 +2026,7 @@ async fn affinity_quota_switch_should_clear_old_turn_state_without_a_provider_st
 }
 
 #[tokio::test]
-async fn thread_spawn_children_should_have_independent_session_affinity_keys() {
+async fn thread_spawn_children_should_share_the_parent_account_affinity_key() {
     let store = Arc::new(MemoryAccountStore::default());
     create_account(&store, "acct_thread_spawn_affinity").await;
     let affinity = Arc::new(MemorySessionAffinity::default());
@@ -1912,10 +2071,10 @@ async fn thread_spawn_children_should_have_independent_session_affinity_keys() {
 
     let keys = affinity.lookup_keys();
     assert_eq!(keys.len(), 5);
-    assert_ne!(keys[0], keys[1]);
-    assert_eq!(keys[0], keys[2]);
-    assert_ne!(keys[3], keys[4]);
-    assert_ne!(keys[0], keys[3]);
+    assert!(
+        keys.iter().all(|key| key == &keys[0]),
+        "child thread transport identities must not split parent account affinity"
+    );
 }
 
 #[tokio::test]
@@ -2539,7 +2698,7 @@ async fn bare_response_failed_should_remain_an_atomic_replay_safe_failure() {
 }
 
 #[tokio::test]
-async fn previous_response_not_found_should_remain_client_visible_without_internal_replay_proof() {
+async fn same_account_previous_response_not_found_should_remain_client_visible() {
     let store = Arc::new(MemoryAccountStore::default());
     create_account(&store, "acct_client_history").await;
     let server = MockServer::start().await;
@@ -2578,7 +2737,7 @@ async fn previous_response_not_found_should_remain_client_visible_without_intern
                 "openai",
                 Operation::Generate(GenerateRequest::from_protocol_payload(payload)),
             ),
-            context("req_history_missing", CancellationToken::new()),
+            context_with_state_owner("req_history_missing", "acct_client_history"),
         )
         .await
         .expect("prepare missing-history stream");

backend/crates/providers/openai/tests/support.rs

@@ -678,6 +678,55 @@ impl ProviderSessionAffinityPort for MemorySessionAffinity {
         })
     }
 
+    fn claim_or_load<'a>(
+        &'a self,
+        provider_kind: &'a ProviderKind,
+        key: &'a ProviderSessionAffinityKey,
+        candidate_account_id: &'a ProviderAccountId,
+        _ttl: Duration,
+    ) -> BoxFuture<'a, Result<ProviderAccountId, ProviderStoreError>> {
+        Box::pin(async move {
+            let mut bindings = self.bindings.lock().expect("session affinity lock");
+            Ok(bindings
+                .entry((
+                    provider_kind.as_str().to_owned(),
+                    key.expose_to_store().to_owned(),
+                ))
+                .or_insert_with(|| candidate_account_id.clone())
+                .clone())
+        })
+    }
+
+    fn compare_and_bind<'a>(
+        &'a self,
+        provider_kind: &'a ProviderKind,
+        key: &'a ProviderSessionAffinityKey,
+        expected_account_id: &'a ProviderAccountId,
+        replacement_account_id: &'a ProviderAccountId,
+        _ttl: Duration,
+    ) -> BoxFuture<'a, Result<ProviderAccountId, ProviderStoreError>> {
+        Box::pin(async move {
+            let binding_key = (
+                provider_kind.as_str().to_owned(),
+                key.expose_to_store().to_owned(),
+            );
+            let mut bindings = self.bindings.lock().expect("session affinity lock");
+            if bindings
+                .get(&binding_key)
+                .is_none_or(|current| current == expected_account_id)
+            {
+                bindings.insert(binding_key, replacement_account_id.clone());
+                return Ok(replacement_account_id.clone());
+            }
+            bindings.get(&binding_key).cloned().ok_or_else(|| {
+                ProviderStoreError::new(
+                    gateway_core::provider_ports::ProviderStoreErrorKind::Unavailable,
+                    "resolve in-memory provider session affinity",
+                )
+            })
+        })
+    }
+
     fn clear<'a>(
         &'a self,
         provider_kind: &'a ProviderKind,

backend/crates/providers/openai/tests/transport/headers.rs

@@ -265,7 +265,7 @@ async fn backend_websocket_should_forward_context_headers_and_preserve_payload_f
         format!("http://{address}"),
         test_wire_profile(),
     )
-    .with_websocket_pool(Arc::new(CodexWebSocketPool::new(8, Duration::from_mins(1))));
+    .with_websocket_pool(Arc::new(CodexWebSocketPool::new(Duration::from_mins(1))));
 
     let response = backend
         .create_response(
@@ -480,7 +480,7 @@ async fn backend_websocket_should_drop_only_unrepresentable_opaque_header_values
         format!("http://{address}"),
         test_wire_profile(),
     )
-    .with_websocket_pool(Arc::new(CodexWebSocketPool::new(8, Duration::from_mins(1))));
+    .with_websocket_pool(Arc::new(CodexWebSocketPool::new(Duration::from_mins(1))));
 
     client
         .create_response(
@@ -932,7 +932,7 @@ async fn websocket_should_keep_an_exact_chain_while_new_connections_adopt_the_la
     });
 
     let profile = test_wire_profile();
-    let pool = Arc::new(CodexWebSocketPool::new(8, Duration::from_mins(1)));
+    let pool = Arc::new(CodexWebSocketPool::new(Duration::from_mins(1)));
     let client = CodexBackendClient::new(
         reqwest::Client::builder()
             .no_proxy()

backend/crates/providers/openai/tests/transport/latency.rs

@@ -300,7 +300,7 @@ async fn account_eviction_should_cancel_a_background_websocket_opening() {
             .await
             .unwrap();
     });
-    let pool = Arc::new(CodexWebSocketPool::new(8, Duration::from_mins(1)));
+    let pool = Arc::new(CodexWebSocketPool::new(Duration::from_mins(1)));
     let backend = CodexBackendClient::new(
         reqwest::Client::builder().no_proxy().build().unwrap(),
         format!("http://{addr}"),
@@ -354,7 +354,7 @@ async fn pool_shutdown_should_cancel_and_join_a_background_websocket_opening() {
             .unwrap();
         assert_eq!(read, 0);
     });
-    let pool = Arc::new(CodexWebSocketPool::new(8, Duration::from_mins(1)));
+    let pool = Arc::new(CodexWebSocketPool::new(Duration::from_mins(1)));
     let backend = CodexBackendClient::new(
         reqwest::Client::builder().no_proxy().build().unwrap(),
         format!("http://{addr}"),
@@ -733,7 +733,7 @@ async fn concurrent_multi_conversation_continuations_should_select_each_exact_so
         tokio::join!(first_continuation, second_continuation);
     });
 
-    let pool = Arc::new(CodexWebSocketPool::new(8, Duration::from_mins(1)));
+    let pool = Arc::new(CodexWebSocketPool::new(Duration::from_mins(1)));
     let backend = CodexBackendClient::new(
         reqwest::Client::builder().no_proxy().build().unwrap(),
         format!("http://{addr}"),
@@ -1190,7 +1190,7 @@ async fn cancelled_half_open_opening_should_allow_another_probe() {
             .await
             .unwrap();
     });
-    let pool = Arc::new(CodexWebSocketPool::new(8, Duration::from_mins(1)));
+    let pool = Arc::new(CodexWebSocketPool::new(Duration::from_mins(1)));
     let backend = CodexBackendClient::new(
         reqwest::Client::builder().no_proxy().build().unwrap(),
         format!("http://{addr}"),
@@ -1325,7 +1325,7 @@ async fn fast_path_miss_and_late_failure_should_count_as_one_breaker_failure() {
             write_completed_sse_response(&mut second_http).await;
         }
     });
-    let pool = Arc::new(CodexWebSocketPool::new(8, Duration::from_mins(1)));
+    let pool = Arc::new(CodexWebSocketPool::new(Duration::from_mins(1)));
     let backend = CodexBackendClient::new(
         reqwest::Client::builder().no_proxy().build().unwrap(),
         format!("http://{addr}"),

backend/crates/providers/openai/tests/transport/mod.rs

@@ -495,8 +495,6 @@ fn websocket_pool_config_for_tests(
     CodexWebSocketPoolConfig {
         enabled: true,
         max_age: Duration::from_mins(1),
-        max_per_account: 8,
-        max_total: 64,
         max_connecting: 16,
         maintenance_interval,
         ping_interval,

backend/crates/providers/openai/tests/transport/websocket.rs

@@ -126,7 +126,7 @@ async fn codex_backend_client_should_decode_permessage_deflate_context_takeover_
             websocket.send(Message::Text(payload.into())).await.unwrap();
         }
     });
-    let pool = Arc::new(CodexWebSocketPool::new(8, Duration::from_mins(1)));
+    let pool = Arc::new(CodexWebSocketPool::new(Duration::from_mins(1)));
     let backend = CodexBackendClient::new(
         reqwest::Client::builder().no_proxy().build().unwrap(),
         format!("http://{addr}"),
@@ -932,7 +932,7 @@ async fn codex_backend_client_should_not_reuse_websocket_rate_limit_headers() {
             .unwrap();
         websocket.close(None).await.unwrap();
     });
-    let pool = Arc::new(CodexWebSocketPool::new(8, Duration::from_mins(1)));
+    let pool = Arc::new(CodexWebSocketPool::new(Duration::from_mins(1)));
     let backend = CodexBackendClient::new(
         reqwest::Client::builder().no_proxy().build().unwrap(),
         format!("http://{addr}"),
@@ -1914,7 +1914,7 @@ async fn codex_backend_client_should_use_websocket_when_previous_response_id_is_
     let mut request = codex_request("gpt-5.5", "be brief", Vec::new());
     request.set_previous_response_id(Some("resp_previous".to_string()));
     request.previous_response_scope = Some(PreviousResponseScope::Persisted);
-    let pool = Arc::new(CodexWebSocketPool::new(8, Duration::from_mins(1)));
+    let pool = Arc::new(CodexWebSocketPool::new(Duration::from_mins(1)));
     let backend = CodexBackendClient::new(
         reqwest::Client::builder().no_proxy().build().unwrap(),
         format!("http://{addr}"),

backend/crates/providers/openai/tests/transport/websocket_pool.rs

@@ -35,7 +35,7 @@ async fn codex_backend_client_should_reuse_pooled_websocket_for_same_account_and
         }
         websocket.close(None).await.unwrap();
     });
-    let pool = Arc::new(CodexWebSocketPool::new(8, Duration::from_mins(1)));
+    let pool = Arc::new(CodexWebSocketPool::new(Duration::from_mins(1)));
     let backend = CodexBackendClient::new(
         reqwest::Client::builder().no_proxy().build().unwrap(),
         format!("http://{addr}"),
@@ -97,7 +97,7 @@ async fn exact_continuation_reuses_owning_socket_after_connection_profile_update
         format!("http://{addr}"),
         profile.clone(),
     )
-    .with_websocket_pool(Arc::new(CodexWebSocketPool::new(1, Duration::from_mins(1))));
+    .with_websocket_pool(Arc::new(CodexWebSocketPool::new(Duration::from_mins(1))));
     let first_request = pooled_websocket_request("wire-profile-continuation");
     let first = backend
         .create_response(
@@ -401,7 +401,7 @@ async fn codex_backend_client_stream_should_keep_reused_socket_after_structural_
 }
 
 #[tokio::test]
-async fn codex_backend_client_stream_should_use_http_when_pool_is_at_cap() {
+async fn codex_backend_client_stream_should_use_http_when_connecting_limit_is_exhausted() {
     let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
     let addr = listener.local_addr().unwrap();
     let accepted_connections = Arc::new(AtomicUsize::new(0));
@@ -414,7 +414,7 @@ async fn codex_backend_client_stream_should_use_http_when_pool_is_at_cap() {
         write_completed_sse_response(&mut first_stream).await;
     });
     let pool = Arc::new(CodexWebSocketPool::with_config(CodexWebSocketPoolConfig {
-        max_per_account: 0,
+        max_connecting: 0,
         initial_event_timeout: Some(Duration::from_millis(30)),
         ..websocket_pool_config_for_tests(None, None, None)
     }));
@@ -432,7 +432,7 @@ async fn codex_backend_client_stream_should_use_http_when_pool_is_at_cap() {
             request_context("req_structural_bypass", Some("chatgpt-account")),
         )
         .await
-        .expect("pool cap should select HTTP before sending payload");
+        .expect("exhausted connection-opening limit should select HTTP before sending payload");
     assert_eq!(response.transport, CodexBackendTransport::HttpSse);
     assert_eq!(
         response.transport_metrics.decision,
@@ -472,7 +472,7 @@ async fn codex_backend_client_should_not_reuse_pooled_websocket_across_local_acc
             websocket.close(None).await.unwrap();
         }
     });
-    let pool = Arc::new(CodexWebSocketPool::new(8, Duration::from_mins(1)));
+    let pool = Arc::new(CodexWebSocketPool::new(Duration::from_mins(1)));
     let backend = CodexBackendClient::new(
         reqwest::Client::builder().no_proxy().build().unwrap(),
         format!("http://{addr}"),
@@ -841,140 +841,32 @@ async fn websocket_pool_shutdown_should_cancel_and_join_active_stream() {
 }
 
 #[tokio::test]
-async fn websocket_pool_should_use_http_for_new_keys_after_account_cap() {
+async fn websocket_pool_should_keep_sixty_fifth_conversation_on_same_account_on_websocket() {
+    const REQUEST_COUNT: usize = 65;
+
     let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
     let addr = listener.local_addr().unwrap();
     let accepted_connections = Arc::new(AtomicUsize::new(0));
     let accepted_connections_for_server = Arc::clone(&accepted_connections);
     let server = tokio::spawn(async move {
-        let (first_stream, _) = listener.accept().await.unwrap();
-        accepted_connections_for_server.fetch_add(1, Ordering::SeqCst);
-        let mut first_websocket = accept_codex_test_websocket(first_stream).await;
-        let _first_message = first_websocket.next().await.unwrap().unwrap();
-        first_websocket
-            .send(Message::Text(
-                completed_websocket_response("resp_cap_first", 2, 1).into(),
-            ))
-            .await
-            .unwrap();
-
-        for _ in 0..2 {
-            let (mut stream, _) = listener.accept().await.unwrap();
+        let mut websockets = Vec::with_capacity(REQUEST_COUNT);
+        for index in 0..REQUEST_COUNT {
+            let (stream, _) = listener.accept().await.unwrap();
             accepted_connections_for_server.fetch_add(1, Ordering::SeqCst);
-            let request = read_http_request(&mut stream).await;
-            assert!(request.starts_with("POST /codex/responses HTTP/1.1"));
-            write_completed_sse_response(&mut stream).await;
+            let mut websocket = accept_codex_test_websocket(stream).await;
+            let _message = websocket.next().await.unwrap().unwrap();
+            websocket
+                .send(Message::Text(
+                    completed_websocket_response(&format!("resp_same_account_{index}"), 2, 1)
+                        .into(),
+                ))
+                .await
+                .unwrap();
+            websockets.push(websocket);
         }
-        drop(first_websocket);
-    });
-    let pool = Arc::new(CodexWebSocketPool::new(1, Duration::from_mins(1)));
-    let backend = CodexBackendClient::new(
-        reqwest::Client::builder().no_proxy().build().unwrap(),
-        format!("http://{addr}"),
-        test_wire_profile(),
-    )
-    .with_websocket_pool(pool);
-    let first_request = pooled_websocket_request("conversation-cap-one");
-    let second_request = pooled_websocket_request("conversation-cap-two");
-
-    let first = backend
-        .create_response(
-            &first_request,
-            request_context("req_cap_first", Some("chatgpt-account")),
-        )
-        .await
-        .expect("first capped websocket response should succeed");
-    let second = backend
-        .create_response(
-            &second_request,
-            request_context("req_cap_second", Some("chatgpt-account")),
-        )
-        .await
-        .expect("new key over account cap should use HTTP");
-    let third = backend
-        .create_response(
-            &second_request,
-            request_context("req_cap_third", Some("chatgpt-account")),
-        )
-        .await
-        .expect("capped key should keep using HTTP instead of opening one-shot sockets");
-    server.await.unwrap();
-
-    assert!(first.body.contains("resp_cap_first"));
-    assert!(second.body.contains("response.completed"));
-    assert!(third.body.contains("response.completed"));
-    assert_eq!(first.websocket_pool_decision.unwrap().kind(), "new");
-    assert_eq!(
-        second.transport_metrics.decision,
-        Some(CodexTransportDecision::Http2PoolUnavailable)
-    );
-    assert_eq!(
-        third.transport_metrics.decision,
-        Some(CodexTransportDecision::Http2PoolUnavailable)
-    );
-    assert_eq!(accepted_connections.load(Ordering::SeqCst), 3);
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn websocket_pool_should_bound_concurrent_openings_across_accounts() {
-    let (websockets, http) = concurrent_pool_transport_counts(8, 2).await;
-
-    assert_eq!((websockets, http), (2, 6));
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn websocket_pool_should_bound_total_slots_across_accounts() {
-    let (websockets, http) = concurrent_pool_transport_counts(3, 8).await;
-
-    assert_eq!((websockets, http), (3, 5));
-}
-
-#[tokio::test]
-async fn websocket_pool_should_evict_lru_idle_connection_at_total_cap() {
-    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-    let addr = listener.local_addr().unwrap();
-    let server = tokio::spawn(async move {
-        let (first_stream, _) = listener.accept().await.unwrap();
-        let mut first = accept_codex_test_websocket(first_stream).await;
-        let _ = first.next().await.unwrap().unwrap();
-        first
-            .send(Message::Text(
-                completed_websocket_response("resp_global_lru_first", 2, 1).into(),
-            ))
-            .await
-            .unwrap();
-
-        let (second_stream, _) = listener.accept().await.unwrap();
-        let mut second = accept_codex_test_websocket(second_stream).await;
-        let _ = second.next().await.unwrap().unwrap();
-        second
-            .send(Message::Text(
-                completed_websocket_response("resp_global_lru_second", 2, 1).into(),
-            ))
-            .await
-            .unwrap();
-
-        let close = timeout(Duration::from_secs(2), first.next())
-            .await
-            .expect("global LRU eviction should close the oldest idle socket")
-            .expect("oldest idle socket should emit a close frame")
-            .expect("oldest idle socket close should be valid");
-        std::assert_matches!(close, Message::Close(_));
-
-        let (third_stream, _) = listener.accept().await.unwrap();
-        let mut third = accept_codex_test_websocket(third_stream).await;
-        let _ = third.next().await.unwrap().unwrap();
-        third
-            .send(Message::Text(
-                completed_websocket_response("resp_global_lru_third", 2, 1).into(),
-            ))
-            .await
-            .unwrap();
     });
     let pool = Arc::new(CodexWebSocketPool::with_config(CodexWebSocketPoolConfig {
-        max_per_account: 8,
-        max_total: 2,
-        max_connecting: 2,
+        max_connecting: 1,
         ..websocket_pool_config_for_tests(None, None, None)
     }));
     let backend = CodexBackendClient::new(
@@ -983,36 +875,52 @@ async fn websocket_pool_should_evict_lru_idle_connection_at_total_cap() {
         test_wire_profile(),
     )
     .with_websocket_pool(Arc::clone(&pool));
-
-    let mut responses = Vec::new();
-    for index in 0..3 {
-        let request = pooled_websocket_request(&format!("conversation-global-lru-{index}"));
-        let account_id = format!("account-global-lru-{index}");
-        let request_id = format!("req_global_lru_{index}");
+    let mut responses = Vec::with_capacity(REQUEST_COUNT);
+    for index in 0..REQUEST_COUNT {
+        let request = pooled_websocket_request(&format!("conversation-same-account-{index}"));
         responses.push(
             backend
-                .create_response(&request, request_context(&request_id, Some(&account_id)))
+                .create_response(
+                    &request,
+                    request_context(
+                        &format!("req_same_account_{index}"),
+                        Some("chatgpt-account"),
+                    ),
+                )
                 .await
-                .expect("global LRU request should keep using websocket"),
+                .expect("same-account conversation should use websocket"),
         );
     }
     server.await.unwrap();
 
-    assert!(responses[0].body.contains("resp_global_lru_first"));
-    assert!(responses[1].body.contains("resp_global_lru_second"));
-    assert!(responses[2].body.contains("resp_global_lru_third"));
-    assert!(
-        responses
-            .iter()
-            .all(|response| response.transport == CodexBackendTransport::WebSocket)
+    assert_eq!(
+        (
+            responses
+                .iter()
+                .filter(|response| response.transport == CodexBackendTransport::WebSocket)
+                .count(),
+            accepted_connections.load(Ordering::SeqCst),
+        ),
+        (REQUEST_COUNT, REQUEST_COUNT)
     );
     pool.shutdown().await;
 }
 
-async fn concurrent_pool_transport_counts(
-    max_total: usize,
-    max_connecting: usize,
-) -> (usize, usize) {
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn websocket_pool_should_bound_concurrent_openings_across_accounts() {
+    let (websockets, http) = concurrent_pool_transport_counts(2).await;
+
+    assert_eq!((websockets, http), (2, 6));
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn websocket_pool_should_allow_all_openings_when_connect_permits_are_available() {
+    let (websockets, http) = concurrent_pool_transport_counts(8).await;
+
+    assert_eq!((websockets, http), (8, 0));
+}
+
+async fn concurrent_pool_transport_counts(max_connecting: usize) -> (usize, usize) {
     const REQUEST_COUNT: usize = 8;
 
     let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
@@ -1051,7 +959,7 @@ async fn concurrent_pool_transport_counts(
             websocket
                 .send(Message::Text(
                     completed_websocket_response(
-                        &format!("resp_global_cap_{max_total}_{max_connecting}_{index}"),
+                        &format!("resp_connecting_cap_{max_connecting}_{index}"),
                         2,
                         1,
                     )
@@ -1063,8 +971,6 @@ async fn concurrent_pool_transport_counts(
         (websocket_count, http_count)
     });
     let pool = Arc::new(CodexWebSocketPool::with_config(CodexWebSocketPoolConfig {
-        max_per_account: REQUEST_COUNT,
-        max_total,
         max_connecting,
         ..websocket_pool_config_for_tests(None, None, None)
     }));
@@ -1096,7 +1002,7 @@ async fn concurrent_pool_transport_counts(
         let response = request
             .await
             .unwrap()
-            .expect("globally capped request should complete");
+            .expect("concurrent request should complete");
         if response.transport == CodexBackendTransport::WebSocket {
             websocket_responses += 1;
         }
@@ -1910,7 +1816,7 @@ async fn codex_backend_client_should_discard_pooled_websocket_after_error_termin
             .unwrap();
         second_websocket.close(None).await.unwrap();
     });
-    let pool = Arc::new(CodexWebSocketPool::new(8, Duration::from_mins(1)));
+    let pool = Arc::new(CodexWebSocketPool::new(Duration::from_mins(1)));
     let backend = CodexBackendClient::new(
         reqwest::Client::builder().no_proxy().build().unwrap(),
         format!("http://{addr}"),
@@ -1987,7 +1893,7 @@ async fn codex_backend_client_should_discard_pooled_websocket_after_unknown_resp
             .unwrap();
         second_websocket.close(None).await.unwrap();
     });
-    let pool = Arc::new(CodexWebSocketPool::new(8, Duration::from_mins(1)));
+    let pool = Arc::new(CodexWebSocketPool::new(Duration::from_mins(1)));
     let backend = CodexBackendClient::new(
         reqwest::Client::builder().no_proxy().build().unwrap(),
         format!("http://{addr}"),

backend/crates/providers/xai/tests/support.rs

@@ -713,6 +713,27 @@ impl ProviderSessionAffinityPort for TestSessionAffinity {
         Box::pin(async { Ok(()) })
     }
 
+    fn claim_or_load<'a>(
+        &'a self,
+        _provider_kind: &'a ProviderKind,
+        _key: &'a ProviderSessionAffinityKey,
+        candidate_account_id: &'a ProviderAccountId,
+        _ttl: Duration,
+    ) -> futures::future::BoxFuture<'a, Result<ProviderAccountId, ProviderStoreError>> {
+        Box::pin(async move { Ok(candidate_account_id.clone()) })
+    }
+
+    fn compare_and_bind<'a>(
+        &'a self,
+        _provider_kind: &'a ProviderKind,
+        _key: &'a ProviderSessionAffinityKey,
+        _expected_account_id: &'a ProviderAccountId,
+        replacement_account_id: &'a ProviderAccountId,
+        _ttl: Duration,
+    ) -> futures::future::BoxFuture<'a, Result<ProviderAccountId, ProviderStoreError>> {
+        Box::pin(async move { Ok(replacement_account_id.clone()) })
+    }
+
     fn clear<'a>(
         &'a self,
         _provider_kind: &'a ProviderKind,

backend/migrations/.frozen-sha256

@@ -1,2 +1 @@
-bebf8c786b08ca3b2852d542d8d88049034a1fb566cc6efcc958dd3fc97241af  0001_initial.sql
-94f5a0c5e3ded48a18bd90e919d38b536f60055a997cd4b90435b874655febf0  0002_nullable_requested_model.sql
+60bcece284f2d6a2cd3e8dea67833dfc1c7da625cdd5f0b63884c725fa00a3d4  0001_initial.sql

backend/migrations/0001_initial.sql

@@ -315,7 +315,7 @@ create table model_requests (
   operation text not null,
   endpoint text not null,
   client_transport text not null,
-  requested_model_id text not null,
+  requested_model_id text,
   provider_kind text,
   upstream_model_id text,
   service_tier text,

backend/migrations/0002_nullable_requested_model.sql

@@ -1,2 +0,0 @@
-alter table model_requests
-  alter column requested_model_id drop not null;

backend/migrations/README.md

@@ -4,8 +4,7 @@ sqlx 在服务启动时（`serve` 监听之前）按编号顺序执行本目录
 文件的 checksum 记入 `_sqlx_migrations`。此后每次启动都会重新校验：**已应用
 迁移的文件字节与记录不一致时，服务直接拒绝启动**。
 
-当前大版本只有两份冻结迁移：`0001_initial.sql` 建立十二张业务表的完整新库基线，
-`0002_nullable_requested_model.sql` 允许 Images 等无模型端点把请求模型保存为 `NULL`。
+当前大版本只有一份冻结迁移：`0001_initial.sql` 作为完整的新库基线。
 
 ## 冻结规则
 

deploy/Dockerfile

@@ -13,7 +13,7 @@ RUN npm install --global pnpm@11.7.0 \
 COPY frontend ./
 RUN pnpm build
 
-FROM rust:1.97-bookworm@sha256:77fac8b98f9f46062bb680b6d25d5bcaabfc400143952ebc572e924bcbedc3fa AS backend-builder
+FROM rust:1.98-bookworm@sha256:e70e2eec3d495fd5c8e0be74adda86507dfac7f51a724fbf9813ff59b2b247c7 AS backend-builder
 
 WORKDIR /app/backend
 ARG TARGETARCH

docs/theme.md

@@ -0,0 +1,365 @@
+<!-- prettier-ignore -->
+<div align="center">
+
+<img src="../frontend/public/favicon.svg" alt="Codex Proxy RS" width="72" height="72" />
+
+# 管理端主题系统
+
+**基于 Seed、Map、Alias 与 Component Token 的运行时主题架构**
+
+[设计原则](#设计原则) · [Token 模型](#token-模型) · [运行时架构](#运行时架构) · [主题编辑器](#主题编辑器) · [扩展指南](#扩展指南)
+
+</div>
+
+主题系统为 Codex Proxy RS 管理端提供浅色、深色、预置配色与自定义配色能力。实现借鉴 Ant Design 的
+Token 分层与十阶色板算法，但不引入 `antd`、React、`ConfigProvider` 或 CSS-in-JS；Vue 组件继续通过
+CSS Variables 与 Tailwind CSS 4 utilities 消费主题。
+
+> [!IMPORTANT]
+> 主题的目标是调整颜色、密度、圆角与层级，不改变现有页面结构和产品语义。默认主题必须保持既有视觉基线，
+> 成功、警告、错误和业务数据色不会因为品牌色变化而失去原有含义。
+
+## 设计原则
+
+- **所选即所得**：`colorPrimary` 始终保留用户选择的 Seed 原色；浅色功能基础色沿用 Ant Design P6，
+  同样等于 Seed。只有深色适配、Hover、Active、弱背景和文字色使用派生值。
+- **主色与表面分离**：品牌色负责交互和强调，页面、容器、浮层与文字由独立的背景和文本 Seed 派生。
+- **语义独立**：`success`、`warning`、`error`、`info` 与 `link` 拥有各自 Seed，不随品牌色隐式改变。
+- **无边设计**：默认依靠表面色差、间距和轻阴影表达层级；边框只用于焦点、错误和必要分隔。
+- **运行时可定制**：用户输入在浏览器中实时派生，因此使用 CSS Variables，不使用构建时 SCSS 变量。
+- **单一事实源**：Store 只保存最小配置，所有 Map、Alias 与未覆盖的 Component Token 均由纯函数生成。
+- **可访问性优先**：文字、焦点和实心控件在 Alias 层执行对比度保护，并尊重 `prefers-reduced-motion`。
+
+## 架构概览
+
+```mermaid
+flowchart LR
+  A[Pinia 持久化配置] --> B[resolveTheme]
+  B --> C[Seed Token]
+  C --> D[Map Token]
+  D --> E[Alias Token]
+  E --> F[Component Token]
+  F --> G[#cp-runtime-theme]
+  G --> H[Vue / Tailwind / ECharts]
+
+  B --> I[Theme Editor 草稿]
+  I --> J[Shadow DOM 预览]
+  J --> K[首页画板 / 组件概览]
+```
+
+核心职责保持分离：
+
+| 层 | 文件 | 职责 |
+| --- | --- | --- |
+| 领域模型 | [`theme/index.ts`](../frontend/src/theme/index.ts) | 类型、规范化、纯派生算法与最终 Token 输出 |
+| 设计基线 | [`theme/constants.ts`](../frontend/src/theme/constants.ts) | 默认值、预置主题、中性色面、阴影与可编辑白名单 |
+| 浏览器适配 | [`theme/browser.ts`](../frontend/src/theme/browser.ts) | 将解析结果提交为根作用域运行时样式表 |
+| 状态 | [`stores/modules/theme.ts`](../frontend/src/stores/modules/theme.ts) | 持久化配置、系统明暗偏好、切换动作与动画 |
+| 编辑器状态 | [`useThemeEditor.ts`](../frontend/src/views/theme/composables/useThemeEditor.ts) | 草稿、修改计数、恢复与保存 |
+| 样式桥接 | [`styles/index.css`](../frontend/src/styles/index.css) | 将 CSS Token 暴露为 Tailwind CSS 4 utilities |
+| 稳定语义 | [`styles/tokens.css`](../frontend/src/styles/tokens.css) | 不参与主题派生的业务常量 |
+
+`theme/index.ts` 不访问 DOM，`theme/browser.ts` 不包含派生规则，Theme Store 不复制算法。类型与算法集中在
+`theme/index.ts`，不额外拆分 `types.ts`。
+
+## Token 模型
+
+主题采用四层模型：
+
+```text
+Seed Token → Map Token → Alias Token → Component Token
+```
+
+### Seed Token
+
+Seed 是用户配置与持久化的最小事实：
+
+```ts
+type ThemeMode = 'system' | 'light' | 'dark'
+type ThemeColorId = 'relay-blue' | 'deep-teal' | 'signal-violet' | 'graphite' | 'custom'
+
+interface ThemeCustomization {
+  seed?: Partial<ThemeSeedOverrides>
+  component?: Partial<ThemeComponentOverrides>
+  tokenOverrides?: Partial<ThemeTokens>
+}
+```
+
+| 类别 | Seed |
+| --- | --- |
+| 品牌 | `colorPrimary`，由预置 ID 或自定义 HEX 提供 |
+| 功能色 | `colorSuccess`、`colorWarning`、`colorError`、`colorInfo`、`colorLink` |
+| 中性色 | `colorTextBase`、`colorBgBase` |
+| 尺寸 | `fontSize`、`sizeUnit`、`sizeStep`、`controlHeight` |
+| 风格 | `borderRadius`、`shadowStrength` |
+| 组件尺寸 | `tableRowHeight`、`cardBorderRadius` |
+
+持久化键为 `codex-proxy-rs-theme`。Store 不保存完整色板或 CSS Variables，损坏的模式、颜色与自定义值会在
+初始化时规范化并回退到默认配置。
+
+### Map Token
+
+品牌色和功能色使用 `@ant-design/colors` 从一个 Seed 生成十阶色板。主色派生规则为：
+
+| 角色 | 规则 |
+| --- | --- |
+| `colorPrimary` | 始终使用 Seed 原色 |
+| Hover | 浅色取 P5，深色取暗色算法 P8 |
+| Active | 浅色取 P7，深色取暗色算法 P6 |
+| 实心 Hover | Seed 向白混合 6% |
+| 实心 Active | Seed 向黑混合 8% |
+| 弱背景 | 从当前容器表面与主色混合，避免低亮度 Seed 产生脏灰色块 |
+| 文字与描边 | 从色板取值后，对相邻 Surface 执行对比度校正 |
+
+功能色的基础 Map 对齐 Ant Design：`info`、`success`、`warning`、`error` 均固定取十阶色板 P6。浅色 P6
+就是用户选择的 Seed，因此 `--cp-color-info / success / warning / error` 不再经过额外对比度改写；深色 P6
+继续使用暗色色板对当前 Surface 做主题适配。功能色的 Hover、Active、弱背景、文字和描边仍按各自角色派生。
+
+背景与文本 Seed 进入独立的 Surface Map，生成：
+
+- `colorBgLayout / Container / Elevated / Spotlight / Mask`
+- `colorFillSecondary / Tertiary / Quaternary`
+- `colorText / Heading / Secondary / Tertiary / Quaternary / Disabled`
+- `colorBorder / BorderSecondary / Split / Shadow`
+
+默认中继蓝使用固定的石墨中性色基线。其他预置通过各自的浅色、深色 `colorBgBase` 与 `colorTextBase`
+建立完整气质。自定义主色只向中性表面注入少量色温：浅色混入 2.8%，深色从默认暗面与暗色色板背景混合；
+用户显式设置背景或文字 Seed 后，自动配套值立即让位。
+
+### Alias Token
+
+Alias 按视觉角色命名，使用 `--cp-` 命名空间，并优先对齐 Ant Design 的公开 Token 词汇：
+
+| 角色 | CSS Token | 主要消费者 |
+| --- | --- | --- |
+| 品牌交互 | `--cp-color-primary*` | 主操作、选中态、焦点与强调 |
+| 链接 | `--cp-color-link*` | 普通文本链接 |
+| 表面 | `--cp-color-bg-*` | 页面、容器、浮层和遮罩 |
+| 填充 | `--cp-color-fill-*` | 轨道、弱背景和静态层级 |
+| 文字 | `--cp-color-text*` | 标题、正文和辅助信息 |
+| 选择 | `--cp-control-item-bg-active*` | Segmented、Select 和选择控件 |
+| 焦点 | `--cp-control-outline` | 键盘焦点和输入反馈 |
+| 功能色 | `--cp-color-info / success / warning / error-*` | 系统反馈与状态 |
+
+Alias 层执行以下保护：
+
+- 普通文字与背景的目标对比度为 4.5:1。
+- 控件边界与相邻 Surface 的目标对比度为 3:1。
+- 极亮的实心按钮背景自动切换为深色文字，避免白底白字。
+- 校正只修改文字、描边和状态等具体角色 Alias，不反写用户保存的 Seed，也不改写基础功能色 Alias。
+
+### Component Token
+
+当组件需要独立演进时，使用 `component[-part][-variant][-state]-property` 命名，不创造含义重复的全局别名。
+
+| 组件 | 代表 Token |
+| --- | --- |
+| Button | `--cp-button-primary-color / bg / hover-bg / active-bg` |
+| Input | `--cp-input-bg / hover-bg / active-bg / error-active-bg` 与对应 Shadow |
+| Menu | `--cp-menu-item-selected-bg` |
+| Table | `--cp-table-row-bg / stripe-bg / hover-bg / selected-bg / height` |
+| Card | `--cp-card-bg / border-radius / shadow` |
+| Layout | `--cp-layout-sider-bg / shadow` |
+| Scrollbar | `--cp-scrollbar-thumb-bg / hover-bg` |
+| BrandMark | `--cp-brand-mark-bg` |
+
+应用内品牌图标使用 [`AppBrandMark.vue`](../frontend/src/components/AppBrandMark.vue)：浅色模式取
+`colorBgSpotlight`，深色模式取 `colorBgElevated`，保持中性暗面与白色图形；浏览器 favicon 继续使用固定黑白
+图标，不随主题改变。
+
+### 稳定业务语义
+
+下列颜色不属于通用主题皮肤，保留在 `styles/tokens.css`：
+
+- 账号“正常”状态 `colorStatusNormal*`
+- 推理标识色 `colorReasoning`
+- 账号套餐标识色 `accountPlan*`
+
+它们可以分别拥有浅色和深色值，但不会被品牌 Seed 重写。图表数据系列同样按数据语义管理，不把所有曲线染成
+主色。
+
+## 预置主题
+
+| ID | 名称 | 主色 | 表面方向 |
+| --- | --- | --- | --- |
+| `relay-blue` | 中继蓝 | `#5983F4` | 默认石墨控制面，清晰可信 |
+| `deep-teal` | 深海青 | `#0E7C72` | 氧化铜与深水玻璃，冷静低饱和 |
+| `signal-violet` | 古风色 | `#A0583D` | 赭石、宣纸与松烟墨，温厚克制 |
+| `graphite` | 石墨 | `#525B66` | 工作室灰纸与铅笔粉末，近单色层级 |
+
+预置主题只改变颜色画像，不改变字号、密度、圆角或布局。所有预置与自定义主题走同一条派生链路，不存在页面级
+特判。
+
+## 运行时架构
+
+### 启动顺序
+
+[`main.ts`](../frontend/src/main.ts) 在 Vue 挂载前初始化主题：
+
+```text
+createApp
+  → app.use(pinia)
+  → persistedstate 同步水合 Theme Store
+  → themeStore.initializeTheme()
+  → app.use(router / auth)
+  → app.mount('#app')
+```
+
+这样首个 Vue 组件渲染时已经具备正确主题，不需要在 `index.html` 增加 bootstrap 脚本，也不维护第二套本地存储
+解析逻辑。
+
+### CSS Variables 提交
+
+全局主题由 `<head>` 中唯一的运行时样式节点承载：
+
+```html
+<style id="cp-runtime-theme">
+:root[data-theme='dark'][data-theme-color='relay-blue'] {
+  color-scheme: dark;
+  --cp-color-bg-layout: #0B111C;
+  /* 其余 Map、Alias 与 Component Token */
+}
+</style>
+```
+
+根元素只保留 `data-theme` 与 `data-theme-color` 状态，不写整套内联 Token。运行时样式表比逐项调用
+`style.setProperty()` 更集中、可检查，也避免在 DOM 属性中形成超长变量串。全局弹窗通过 Teleport 挂到 `body`
+后仍继承根变量。
+
+> [!NOTE]
+> Theme Editor 预览是例外：草稿 Token 以内联变量写在影子环境的局部根节点上，仅影响预览，不污染已保存主题。
+
+### 切换与图表
+
+- 用户主动切换时，以点击位置为圆心运行 View Transition；不支持时使用 180ms 颜色过渡。
+- 初始化、系统主题变化或减少动态效果时直接提交，不播放扩散动画。
+- 每次有效提交只增加一次 `themeRevision`，相同签名不会重复刷新。
+- `useThemeColor()` 在正式页面读取根 CSS Variables，在影子预览中优先读取注入的局部 Token。
+- 图表 Option 在主题 revision 或预览 Token 改变后重算，`BaseChart` 通过 `setOption` 更新现有 Canvas。
+
+## 主题编辑器
+
+主题编辑器位于一级路由 `/theme`，采用一屏工作台：左侧编辑，右侧预览，顶部保留全局操作。桌面端高度固定为
+`100dvh - 3rem`，切换编辑层级或预览类型时不改变外框高度。窄屏头部操作允许自然换行；手机端隐藏实时预览，
+只保留 Token 编辑，避免在有限宽度内渲染不可操作的缩放画板。
+
+### 编辑能力
+
+| 区域 | 能力 |
+| --- | --- |
+| 全局 / 颜色 | 模式、预置、自定义主色、功能色、链接、基础文本与背景、派生变量查看 |
+| 全局 / 尺寸 | 字号、基础间距、尺寸步长、控件高度 |
+| 全局 / 风格 | 通用圆角、阴影强度 |
+| 组件 | Action、Form、Selection、Surface、Data Display、Feedback、Navigation、Layout |
+| 工作流 | 搜索、单项恢复、撤销草稿、恢复默认、保存并应用 |
+
+Component Token 只开放白名单字段。未覆盖项始终继续使用全局 Seed 与 Alias 算法，避免主题配置逐渐退化成一份
+无法维护的完整 CSS 快照。
+
+### 草稿与保存
+
+编辑器维护 `saved` 与 `draft` 两份状态：
+
+1. 输入只更新草稿和局部预览。
+2. 修改计数按模式、主题色、Seed、组件值和 Token override 分项统计。
+3. “撤销草稿”恢复到最近一次已保存配置。
+4. “保存并应用”先规范化草稿，再原子更新 Theme Store。
+
+### 隔离预览
+
+[`ThemePreviewScope.vue`](../frontend/src/views/theme/components/ThemePreviewScope.vue) 创建开放 Shadow Root，复制应用
+样式，并把预览内容 Teleport 到影子根中。预览可独立切换浅色和深色，不受外层主题影响。
+
+- **首页画板**复用真实 `DashboardContent` 和固定 fixture，不请求接口，也不启动自动刷新。
+- **组件概览**展示基础组件、表格、空状态、骨架、浮层和菜单等关键状态。
+- 画板固定为 `1600 × 1808`，使用 CSS `zoom` 重排，不使用 `transform: scale()` 长期缩放文字。
+- 空白区域可拖拽，滚轮以指针为锚点缩放，并提供缩小、100%、放大和适应画板操作。
+- 编辑面板和组件概览统一使用 `BaseScrollbar`，滚动条空闲时自动隐藏。
+
+## 样式与命名约定
+
+### CSS Token
+
+- 全局 Token：`--cp-color-bg-container`、`--cp-font-size`。
+- Component Token：`--cp-table-row-hover-bg`、`--cp-input-active-shadow`。
+- 业务 Token：命名中明确业务域，例如 `--cp-account-plan-pro-bg`。
+- 禁止继续引入 `accent`、`soft`、`current`、`subtle` 等与现有角色重叠的平行词汇。
+
+### Vue 与 Tailwind CSS 4
+
+组件优先使用 `bg-cp-*`、`text-cp-*`、`shadow-cp-*`、`rounded-cp-*` 等由 `@theme inline` 暴露的 utility：
+
+```vue
+<section class="rounded-cp-card bg-cp-bg-container text-cp-text shadow-cp-card">
+  ...
+</section>
+```
+
+仅当值需要在 CSS 函数、SVG 或局部派生中参与计算时，直接读取 `var(--cp-*)`。不在页面组件中重新实现色阶、
+对比度或明暗算法。
+
+### 视觉状态
+
+- 静态填充、Hover、Active 与 Selected 必须使用不同角色，不能复用一个变量制造所有层级。
+- Input 的 Hover 与 Active 只改变内部填充；外圈反馈保持同色同宽，错误状态使用独立 Error Token。
+- 表格斑马纹使用 `table-row-stripe-bg`，不借用 `row-hover-bg`。
+- Card 和选项默认不增加装饰性边框；键盘焦点必须保留可见反馈。
+- 阴影保持中性，`shadowStrength` 只调节层级强弱，不给阴影染品牌色。
+
+## 扩展指南
+
+### 增加预置主题
+
+1. 在 `ThemeColorPresetId` 增加稳定 ID。
+2. 在 `THEME_COLOR_PRESETS` 声明名称、描述、主色 Seed 与可选浅暗表面画像。
+3. 不新增页面特判，确认预置可通过同一 `resolveTheme()` 派生。
+4. 在浅色、深色和系统模式下检查文本、浮层、Input、表格与图表。
+
+### 增加全局 Seed 或 Alias
+
+1. 在 `theme/index.ts` 的领域类型中声明字段。
+2. 在规范化函数中定义合法输入边界。
+3. 在 Map 或 Alias 层集中派生，并加入 `ThemeTokens` 完整输出。
+4. 如需 Tailwind utility，在 `styles/index.css` 的 `@theme inline` 中映射。
+5. 只在确实需要用户控制时加入 Theme Editor；派生细节默认只读。
+
+### 增加 Component Token
+
+1. 先确认全局 Alias 无法准确表达组件职责。
+2. 使用 `component[-part][-variant][-state]-property` 命名。
+3. 在 `ThemeComponentMap` 和 `toThemeTokens()` 中提供默认派生值。
+4. 需要开放编辑时，加入对应组件目录和可编辑白名单。
+5. 基础组件消费 Token，页面不得再写第二套局部常量。
+
+> [!WARNING]
+> 不要把任意 HEX、阴影或尺寸加入 `styles/tokens.css` 作为“临时修复”。可换肤值必须进入派生链；只有稳定的
+> 业务语义与首帧安全 fallback 可以留在静态样式中。
+
+## 验证
+
+前端改动至少执行：
+
+```bash
+cd frontend
+pnpm run lint
+pnpm run typecheck
+pnpm run build
+git diff --check
+```
+
+视觉验收覆盖：
+
+- 四个预置、自定义 HEX、浅色、深色和跟随系统模式。
+- 页面、容器、浮层、输入框、表格、分页、主按钮、选中态、焦点和品牌图标。
+- 草稿隔离、保存刷新恢复与 Teleport 弹窗。
+- 首页画板缩放清晰度、组件概览滚动、ECharts 网格线和 Skeleton 动效。
+- 键盘操作、颜色之外的选中反馈和 `prefers-reduced-motion`。
+
+## 上游参考
+
+- [Ant Design 色彩规范](https://github.com/ant-design/ant-design/blob/977d8e037a4841bb847b8a40ffd1f79b23264826/docs/spec/colors.zh-CN.md)
+- [Ant Design 暗黑模式](https://github.com/ant-design/ant-design/blob/977d8e037a4841bb847b8a40ffd1f79b23264826/docs/spec/dark.zh-CN.md)
+- [Ant Design 主题定制](https://github.com/ant-design/ant-design/blob/977d8e037a4841bb847b8a40ffd1f79b23264826/docs/react/customize-theme.zh-CN.md)
+- [Seed 到 Map](https://github.com/ant-design/ant-design/blob/977d8e037a4841bb847b8a40ffd1f79b23264826/components/theme/themes/shared/genColorMapToken.ts)
+- [Map 到 Alias](https://github.com/ant-design/ant-design/blob/977d8e037a4841bb847b8a40ffd1f79b23264826/components/theme/util/alias.ts)
+- [`@ant-design/colors` 生成器](https://github.com/ant-design/ant-design-colors/blob/89b4a5b7e989b792610087abe855bf4a2fb1d322/src/generate.ts)

frontend/package.json

@@ -14,18 +14,19 @@
     "format:check": "pnpm run lint"
   },
   "dependencies": {
+    "@ant-design/colors": "^8.0.1",
     "@boxicons/vue": "1.0.1",
     "@fontsource-variable/inter": "^5.3.0",
     "@fontsource-variable/jetbrains-mono": "^5.3.0",
-    "@lucide/vue": "^1.31.0",
+    "@lucide/vue": "^1.33.0",
     "@vueuse/core": "^14.4.0",
     "axios": "^1.19.0",
-    "dayjs": "^1.11.21",
-    "dompurify": "^3.4.13",
+    "dayjs": "^1.11.23",
+    "dompurify": "^3.4.14",
     "echarts": "^6.1.0",
-    "es-toolkit": "^1.50.0",
+    "es-toolkit": "^1.51.0",
     "gsap": "^3.15.0",
-    "marked": "^18.0.9",
+    "marked": "^18.0.10",
     "pinia": "^4.0.3",
     "pinia-plugin-persistedstate": "^4.7.1",
     "vue": "^3.5.41",
@@ -37,12 +38,12 @@
     "@types/node": "^26.2.0",
     "@vitejs/plugin-vue": "^6.0.8",
     "@vue/tsconfig": "^0.9.1",
-    "eslint": "^10.8.1",
+    "eslint": "^10.9.0",
     "eslint-plugin-format": "^2.0.1",
     "eslint-plugin-vuejs-accessibility": "^2.6.0",
     "tailwindcss": "^4.3.3",
     "typescript": "^6.0.3",
-    "vite": "^8.2.1",
-    "vue-tsc": "^3.3.10"
+    "vite": "^8.2.2",
+    "vue-tsc": "^3.3.11"
   }
 }

frontend/src/App.vue

@@ -2,9 +2,6 @@
 import { RouterView } from 'vue-router'
 
 import { BaseToast } from '@/components/base/BaseToast'
-import { useUiStore } from '@/stores/modules/ui'
-
-useUiStore().initializeTheme()
 </script>
 
 <template>

frontend/src/api/modules/accounts.ts

@@ -170,6 +170,69 @@ export interface AccountQuotaResponse {
   account: Account
 }
 
+export type AccountUsageStatisticsMode = 'workspace' | 'personal'
+
+export interface AccountUsageStatisticsTokens {
+  uncachedInput: number
+  cachedInput: number
+  output: number
+  total: number
+}
+
+export interface AccountUsageStatisticsCost {
+  currency: string
+  amount: string
+}
+
+export interface AccountUsageStatisticsModel {
+  key: string
+  model: string
+  serviceTier: 'standard' | 'fast'
+  creditShare: number | null
+  quotaShare: number | null
+  tokens: AccountUsageStatisticsTokens
+  estimatedCost: AccountUsageStatisticsCost | null
+  hasUnknownPricing: boolean
+  hasEstimatedAllocation: boolean
+  hasRateFallback: boolean
+  hasMissingTokenData: boolean
+}
+
+export interface AccountUsageStatisticsDay {
+  date: string
+  creditShare: number | null
+  tokens: AccountUsageStatisticsTokens
+  estimatedCost: AccountUsageStatisticsCost | null
+  hasUnknownPricing: boolean
+  hasMissingTokenData: boolean
+  isBoundaryDay: boolean
+}
+
+export interface AccountUsageStatisticsResponse {
+  mode: AccountUsageStatisticsMode
+  cycle: {
+    offset: number
+    startAt: string
+    endAt: string
+    windowSeconds: number
+    usedPercent: number | null
+    isCurrent: boolean
+    canGoPrevious: boolean
+    canGoNext: boolean
+  }
+  summary: {
+    tokens: AccountUsageStatisticsTokens
+    estimatedCost: AccountUsageStatisticsCost | null
+    projectedTokens: number | null
+    projectedCost: AccountUsageStatisticsCost | null
+    dayCount: number
+    hasUnknownPricing: boolean
+    hasMissingTokenData: boolean
+  }
+  models: AccountUsageStatisticsModel[]
+  daily: AccountUsageStatisticsDay[]
+}
+
 export interface AccountResetCredit {
   id: string
   status: string | null
@@ -238,6 +301,11 @@ interface AccountIdParam {
   accountId: string
 }
 
+interface AccountUsageStatisticsParam extends AccountIdParam {
+  cycleOffset?: number
+  utcOffsetMinutes?: number
+}
+
 interface AccountResetCreditConsumeParam extends AccountIdParam {
   creditId?: string
   redeemRequestId: string
@@ -326,6 +394,14 @@ export function getAccountQuota(data: AccountIdParam) {
   })
 }
 
+export function getAccountUsageStatistics(data: AccountUsageStatisticsParam) {
+  return request<AccountUsageStatisticsResponse>({
+    url: '/api/admin/accounts/usage-statistics',
+    method: 'GET',
+    params: data,
+  })
+}
+
 export function refreshAccountQuota(data: AccountIdParam) {
   return request<AccountQuotaResponse>({
     url: '/api/admin/accounts/quota/refresh',

frontend/src/components/AccountGroupCheckboxGrid.vue

@@ -32,7 +32,7 @@ function updateGroup(groupId: string, selected: boolean) {
     <div
       v-for="group in groups"
       :key="group.id"
-      class="flex min-h-11 items-center justify-between gap-3 rounded-cp-control bg-cp-subtle px-3.5 py-2.5"
+      class="flex min-h-11 items-center justify-between gap-3 rounded-cp bg-cp-fill-quaternary px-3.5 py-2.5"
     >
       <span class="flex min-w-0 items-center gap-2.5">
         <span
@@ -50,7 +50,7 @@ function updateGroup(groupId: string, selected: boolean) {
       </span>
       <span
         v-if="!group.enabled"
-        class="shrink-0 text-[11px] font-emphasis text-cp-muted-text"
+        class="shrink-0 text-cp-xs font-emphasis text-cp-text-quaternary"
       >
         已禁用
       </span>
@@ -58,7 +58,7 @@ function updateGroup(groupId: string, selected: boolean) {
   </div>
   <p
     v-else
-    class="m-0 rounded-cp-control bg-cp-subtle px-3.5 py-3 text-[12px] font-emphasis text-cp-secondary"
+    class="m-0 rounded-cp bg-cp-fill-quaternary px-3.5 py-3 text-cp-sm font-emphasis text-cp-text-secondary"
   >
     {{ loading ? '正在加载分组...' : '暂无分组，请先在分组管理中创建。' }}
   </p>

frontend/src/components/AccountGroupMarks.vue

@@ -27,5 +27,5 @@ const fullNames = computed(() => props.groups
       aria-hidden="true"
     />
   </div>
-  <span v-else class="text-xs text-cp-muted-text">—</span>
+  <span v-else class="text-xs text-cp-text-quaternary">—</span>
 </template>

frontend/src/components/AccountGroupMultiSelect.vue

@@ -90,7 +90,7 @@ function providerSummary(group: AccountGroup) {
       :disabled="disabled || loading"
     >
       <template #prefix>
-        <Search class="size-4 text-cp-tertiary" />
+        <Search class="size-4 text-cp-text-tertiary" />
       </template>
     </BaseInput>
 
@@ -102,10 +102,10 @@ function providerSummary(group: AccountGroup) {
         <div
           v-for="group in visibleGroups"
           :key="group.id"
-          class="flex w-full items-start gap-3 rounded-cp-control border-0 px-3 py-3 text-left outline-none transition-colors focus-visible:ring-2 focus-visible:ring-cp-info-border"
+          class="flex w-full items-start gap-3 rounded-cp border-0 px-3 py-3 text-left outline-none transition-colors focus-visible:ring-2 focus-visible:ring-cp-control-outline"
           :class="selectedIds.includes(group.id)
-            ? 'bg-cp-info-bg'
-            : 'bg-cp-subtle hover:bg-cp-default-hover'"
+            ? 'bg-cp-control-item-bg-active'
+            : 'bg-cp-fill-quaternary hover:bg-cp-bg-text-hover'"
         >
           <BaseCheckbox
             :model-value="selectedIds.includes(group.id)"
@@ -115,7 +115,7 @@ function providerSummary(group: AccountGroup) {
           />
           <span class="min-w-0 flex-1">
             <span class="flex min-w-0 items-center gap-2">
-              <strong class="min-w-0 truncate text-[13px] text-cp-primary">
+              <strong class="min-w-0 truncate text-cp text-cp-text">
                 {{ group.name }}
               </strong>
               <span
@@ -125,7 +125,7 @@ function providerSummary(group: AccountGroup) {
                 已禁用
               </span>
             </span>
-            <span class="mt-1 block text-[11px] font-emphasis text-cp-secondary">
+            <span class="mt-1 block text-cp-xs font-emphasis text-cp-text-secondary">
               {{ group.memberCount }} 个账号<template v-if="providerSummary(group)"> · {{ providerSummary(group) }}</template>
             </span>
           </span>
@@ -148,15 +148,15 @@ function providerSummary(group: AccountGroup) {
 
     <div
       v-if="selectedIds.length === 0"
-      class="rounded-cp-control px-3.5 py-3"
+      class="rounded-cp px-3.5 py-3"
       :class="emptyCopy.tone === 'warning'
         ? 'bg-cp-warning-bg text-cp-warning-text'
-        : 'bg-cp-subtle text-cp-secondary'"
+        : 'bg-cp-fill-quaternary text-cp-text-secondary'"
     >
-      <p class="m-0 text-[12px] font-bold">
+      <p class="m-0 text-cp-sm font-bold">
         {{ emptyCopy.title }}
       </p>
-      <p class="mt-1 mb-0 text-[11px] leading-normal font-emphasis">
+      <p class="mt-1 mb-0 text-cp-xs leading-normal font-emphasis">
         {{ emptyCopy.description }}
       </p>
     </div>

frontend/src/components/AppBrandMark.vue

@@ -0,0 +1,117 @@
+<script setup lang="ts">
+import { useId } from 'vue'
+
+const id = useId().replaceAll(':', '')
+const noiseFilterId = `${id}-brand-noise`
+const wornFilterId = `${id}-brand-worn`
+const mistGradientId = `${id}-brand-mist`
+</script>
+
+<template>
+  <svg
+    class="app-brand-mark"
+    xmlns="http://www.w3.org/2000/svg"
+    viewBox="48 48 416 416"
+    aria-hidden="true"
+    focusable="false"
+  >
+    <defs>
+      <filter :id="noiseFilterId" x="0" y="0" width="100%" height="100%">
+        <feTurbulence
+          type="fractalNoise"
+          baseFrequency="1.7"
+          numOctaves="2"
+          seed="31"
+          result="noise"
+        />
+        <feColorMatrix
+          in="noise"
+          type="matrix"
+          values="0 0 0 0 1  0 0 0 0 1  0 0 0 0 1  2.56 2.56 2.56 0 -4.76"
+          result="speckle"
+        />
+        <feComposite operator="in" in="SourceGraphic" in2="speckle" />
+      </filter>
+      <filter :id="wornFilterId" x="-12%" y="-12%" width="124%" height="124%">
+        <feTurbulence
+          type="fractalNoise"
+          baseFrequency="0.12"
+          numOctaves="2"
+          seed="41"
+          result="noise"
+        />
+        <feDisplacementMap in="SourceGraphic" in2="noise" scale="2.2" />
+      </filter>
+      <radialGradient :id="mistGradientId" cx="0.5" cy="0.45" r="0.75">
+        <stop offset="0" stop-color="currentColor" stop-opacity="0.1" />
+        <stop offset="0.55" stop-color="currentColor" stop-opacity="0.045" />
+        <stop offset="1" stop-color="currentColor" stop-opacity="0.012" />
+      </radialGradient>
+    </defs>
+
+    <rect class="app-brand-mark__surface" x="48" y="48" width="416" height="416" rx="88" />
+    <g fill="none" stroke="currentColor" stroke-linecap="round" stroke-width="36">
+      <path d="M156 307A112 112 0 0 1 307 156" />
+      <path d="M356 205A112 112 0 0 1 205 356" />
+    </g>
+    <path d="m407 105-119 153-183 149 124-157Z" fill="currentColor" />
+
+    <g
+      :filter="`url(#${wornFilterId})`"
+      fill="none"
+      stroke="currentColor"
+      stroke-linecap="square"
+    >
+      <path d="M92 170 136 148" stroke-width="1" opacity="0.38" />
+      <path d="M98 178 142 156" stroke-width="0.5" opacity="0.3" />
+      <path d="M308 398 346 378" stroke-width="0.9" opacity="0.36" />
+      <path d="M314 406 352 386" stroke-width="0.5" opacity="0.3" />
+      <path d="M364 132 398 118" stroke-width="0.9" opacity="0.38" />
+      <path d="M402 118 410 126" stroke-width="0.5" opacity="0.28" />
+      <path d="M108 350 142 334" stroke-width="1" opacity="0.4" />
+      <path d="M158 238 190 226" stroke-width="0.8" opacity="0.34" />
+      <path d="M296 292 320 280" stroke-width="0.7" opacity="0.3" />
+      <path d="M126 118 136 110" stroke-width="0.6" opacity="0.26" />
+      <path d="M400 96 410 88" stroke-width="0.6" opacity="0.24" />
+    </g>
+    <g :filter="`url(#${wornFilterId})`" fill="currentColor">
+      <path
+        d="M98 176 104 173 108 175 114 170 118 173 124 167 130 170 136 164 142 167 148 161 154 164 160 158Z"
+        opacity="0.34"
+      />
+      <path
+        d="M314 395 320 392 324 394 330 389 336 392 342 386 348 389 354 383Z"
+        opacity="0.3"
+      />
+    </g>
+
+    <rect
+      x="48"
+      y="48"
+      width="416"
+      height="416"
+      rx="88"
+      fill="currentColor"
+      :filter="`url(#${noiseFilterId})`"
+      opacity="0.08"
+    />
+    <rect
+      x="48"
+      y="48"
+      width="416"
+      height="416"
+      rx="88"
+      :fill="`url(#${mistGradientId})`"
+    />
+  </svg>
+</template>
+
+<style scoped>
+.app-brand-mark {
+  color: var(--cp-color-text-light-solid);
+}
+
+.app-brand-mark__surface {
+  fill: var(--cp-brand-mark-bg);
+}
+</style>

frontend/src/components/ProviderIconGroup.vue

@@ -39,18 +39,18 @@ const authenticationLabel = computed(() => {
 <template>
   <span class="inline-flex items-center whitespace-nowrap" :class="groupGapClass">
     <span
-      class="inline-flex shrink-0 items-center justify-center bg-cp-muted text-cp-primary"
+      class="inline-flex shrink-0 items-center justify-center bg-cp-fill-tertiary text-cp-text"
       :class="iconContainerClass"
       :title="providerLabel"
     >
       <Openai v-if="normalizedProvider === 'openai'" :class="iconClass" aria-hidden="true" />
       <Xai v-else-if="normalizedProvider === 'xai'" :class="iconClass" aria-hidden="true" />
-      <span v-else class="text-[10px] font-heavy text-cp-muted-text">?</span>
+      <span v-else class="text-[10px] font-heavy text-cp-text-quaternary">?</span>
     </span>
 
     <span
       v-if="showAuthenticationKind"
-      class="inline-flex shrink-0 items-center justify-center bg-cp-muted text-cp-primary"
+      class="inline-flex shrink-0 items-center justify-center bg-cp-fill-tertiary text-cp-text"
       :class="iconContainerClass"
       :title="authenticationLabel"
     >
@@ -64,7 +64,7 @@ const authenticationLabel = computed(() => {
         :class="iconClass"
         aria-hidden="true"
       />
-      <span v-else class="text-[10px] font-heavy text-cp-muted-text">?</span>
+      <span v-else class="text-[10px] font-heavy text-cp-text-quaternary">?</span>
     </span>
 
     <span class="sr-only">

frontend/src/components/base/BaseButton.vue

@@ -30,19 +30,19 @@ defineSlots<{
 
 const variantClasses: Record<ButtonVariant, string> = {
   primary:
-    'bg-cp-accent text-cp-accent-on shadow-cp-control hover:bg-cp-accent-hover active:bg-cp-accent-pressed',
+    'bg-(--cp-button-primary-bg) text-(--cp-button-primary-color) shadow-cp-tertiary hover:bg-(--cp-button-primary-hover-bg) active:bg-(--cp-button-primary-active-bg)',
   secondary:
-    'bg-cp-muted text-cp-primary shadow-cp-control hover:bg-cp-default-active active:bg-cp-nav-active',
+    'bg-cp-fill-tertiary text-cp-text shadow-cp-tertiary hover:bg-cp-bg-text-active active:bg-cp-bg-text-active',
   ghost:
-    'bg-transparent text-cp-secondary shadow-none hover:bg-cp-subtle hover:text-cp-primary active:bg-cp-muted',
+    'bg-transparent text-cp-text-secondary shadow-none hover:bg-cp-fill-quaternary hover:text-cp-text active:bg-cp-fill-tertiary',
   destructive:
-    'bg-cp-danger-bg text-cp-danger-text shadow-none hover:bg-cp-danger-bg-hover active:bg-cp-danger-bg-active',
+    'bg-cp-error-bg text-cp-error-text shadow-none hover:bg-cp-error-bg-hover active:bg-cp-error-bg-active',
 }
 
 const sizeClasses: Record<ButtonSize, string> = {
   sm: 'h-cp-control-sm gap-1.5 px-3 text-xs',
-  md: 'h-cp-control-md gap-2 px-4 text-[13px]',
-  lg: 'h-cp-control-lg gap-2.5 px-5 text-[14px]',
+  md: 'h-cp-control gap-2 px-4 text-cp',
+  lg: 'h-cp-control-lg gap-2.5 px-5 text-cp-lg',
 }
 
 const spinnerSizes: Record<ButtonSize, number> = {
@@ -52,9 +52,9 @@ const spinnerSizes: Record<ButtonSize, number> = {
 }
 
 const classes = computed(() => [
-  'inline-flex shrink-0 touch-manipulation items-center justify-center rounded-cp-control-sm border-0 font-bold leading-none outline-none transition-[background-color,box-shadow,color,opacity,transform] duration-150 motion-safe:active:translate-y-px motion-safe:active:scale-[0.985] motion-reduce:transition-none',
-  'focus-visible:ring-2 focus-visible:ring-cp-accent-border focus-visible:ring-offset-2 focus-visible:ring-offset-cp-surface',
-  'disabled:cursor-not-allowed disabled:transform-none disabled:bg-cp-disabled disabled:text-cp-disabled-text disabled:shadow-none',
+  'inline-flex shrink-0 touch-manipulation items-center justify-center rounded-cp-sm border-0 font-bold leading-none outline-none transition-[background-color,box-shadow,color,opacity,transform] duration-150 motion-safe:active:translate-y-px motion-safe:active:scale-[0.985] motion-reduce:transition-none',
+  'focus-visible:ring-2 focus-visible:ring-cp-control-outline focus-visible:ring-offset-2 focus-visible:ring-offset-cp-bg-container',
+  'disabled:cursor-not-allowed disabled:transform-none disabled:bg-cp-bg-container-disabled disabled:text-cp-text-disabled disabled:shadow-none',
   sizeClasses[props.size],
   variantClasses[props.variant],
 ])

frontend/src/components/base/BaseCard.vue

@@ -45,7 +45,7 @@ const contentClasses = computed(() => [
 <template>
   <component
     :is="props.as"
-    class="[--cp-input-current-bg:var(--cp-input-soft-bg)] [--cp-input-current-bg-hover:var(--cp-input-soft-bg-hover)] overflow-hidden rounded-cp-surface bg-cp-surface shadow-cp-card"
+    class="overflow-hidden rounded-cp-card bg-(--cp-card-bg) shadow-cp-card"
     :class="[paddingClasses[padding], hasHeader ? 'flex min-h-0 flex-col' : undefined]"
   >
     <template v-if="$slots.header || hasManagedHeader || $slots.body">
@@ -55,7 +55,7 @@ const contentClasses = computed(() => [
             <div class="min-w-0 pt-0.5">
               <h2
                 v-if="props.title || $slots.title"
-                class="m-0 text-xl leading-[1.15] font-heavy text-cp-primary text-balance"
+                class="m-0 text-xl leading-[1.15] font-heavy text-cp-text text-balance"
               >
                 <slot name="title">
                   {{ props.title }}
@@ -63,7 +63,7 @@ const contentClasses = computed(() => [
               </h2>
               <p
                 v-if="props.description || $slots.description"
-                class="mt-1.75 mb-0 text-[13px] leading-[1.3] font-emphasis text-cp-secondary text-pretty"
+                class="mt-1.75 mb-0 text-cp leading-[1.3] font-emphasis text-cp-text-secondary text-pretty"
               >
                 <slot name="description">
                   {{ props.description }}

frontend/src/components/base/BaseCheckbox.vue

@@ -26,12 +26,12 @@ watchEffect(() => {
 })
 
 const boxClasses = computed(() => [
-  'relative inline-flex size-4 shrink-0 items-center justify-center rounded-cp-control-sm border-0 transition-[background-color,box-shadow,color] duration-150 motion-reduce:transition-none',
+  'relative inline-flex size-4 shrink-0 items-center justify-center rounded-cp-sm border-0 transition-[background-color,box-shadow,color] duration-150 motion-reduce:transition-none',
   props.disabled
-    ? 'bg-cp-disabled text-cp-disabled-icon'
+    ? 'bg-cp-bg-container-disabled text-cp-text-disabled'
     : checked.value
-      ? 'bg-cp-accent text-cp-accent-on'
-      : 'bg-cp-surface text-transparent shadow-[inset_0_0_0_1px_var(--cp-default-border-hover)]',
+      ? 'bg-cp-primary text-(--cp-button-primary-color)'
+      : 'bg-cp-bg-container text-transparent shadow-[inset_0_0_0_1px_var(--cp-color-border)]',
 ])
 </script>
 
@@ -39,7 +39,7 @@ const boxClasses = computed(() => [
   <!-- The native checkbox is nested; the rule does not resolve this Vue template pattern. -->
   <!-- eslint-disable-next-line vue-a11y/label-has-for -->
   <label
-    class="group relative inline-flex min-h-4 min-w-4 items-center gap-2.5 text-[13px] leading-none font-emphasis"
+    class="group relative inline-flex min-h-4 min-w-4 items-center gap-2.5 text-cp leading-none font-emphasis"
     :class="disabled ? 'cursor-not-allowed opacity-55' : 'cursor-pointer'"
   >
     <input
@@ -52,7 +52,7 @@ const boxClasses = computed(() => [
     >
     <span
       :class="boxClasses"
-      class="peer-focus-visible:ring-2 peer-focus-visible:ring-cp-accent-border peer-focus-visible:ring-offset-2 peer-focus-visible:ring-offset-cp-surface"
+      class="peer-focus-visible:ring-2 peer-focus-visible:ring-cp-control-outline peer-focus-visible:ring-offset-2 peer-focus-visible:ring-offset-cp-bg-container"
       aria-hidden="true"
     >
       <Minus
@@ -64,6 +64,6 @@ const boxClasses = computed(() => [
         :class="!indeterminate && model ? 'opacity-100' : 'opacity-0'"
       />
     </span>
-    <span v-if="showLabel" class="text-[13px] leading-none font-emphasis">{{ label }}</span>
+    <span v-if="showLabel" class="text-cp leading-none font-emphasis">{{ label }}</span>
   </label>
 </template>

frontend/src/components/base/BaseColorPicker/color.ts

@@ -1,9 +1,9 @@
-import { normalizeRgbaHexColor } from '@/utils/color'
+import { normalizeHexColor, normalizeRgbaHexColor } from '@/utils/color'
 
 const RGBA_COLOR_PATTERN
   = /^rgba\(\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(0(?:\.\d+)?|1(?:\.0+)?)\s*\)$/i
 
-interface HsvColor {
+export interface HsvaColor {
   h: number
   s: number
   v: number
@@ -17,8 +17,23 @@ interface RgbaColor {
   a: number
 }
 
-export function hexToHsv(value: string): HsvColor | null {
-  const normalized = normalizeRgbaHexColor(value)
+export function normalizePickerHexColor(value: string, allowAlpha: boolean) {
+  if (allowAlpha) {
+    const rgba = normalizeRgbaHexColor(value)
+    if (rgba)
+      return rgba
+    const rgb = normalizeHexColor(value)
+    return rgb ? `${rgb}FF` : null
+  }
+
+  const rgb = normalizeHexColor(value)
+  if (rgb)
+    return rgb
+  return normalizeRgbaHexColor(value)?.slice(0, 7) ?? null
+}
+
+export function hexToHsva(value: string): HsvaColor | null {
+  const normalized = normalizePickerHexColor(value, true)
   if (!normalized)
     return null
 
@@ -48,7 +63,7 @@ export function hexToHsv(value: string): HsvColor | null {
   }
 }
 
-export function hsvToHex(color: HsvColor) {
+export function hsvaToHex(color: HsvaColor, allowAlpha: boolean) {
   const hue = ((color.h % 360) + 360) % 360
   const saturation = clamp(color.s, 0, 100) / 100
   const brightness = clamp(color.v, 0, 100) / 100
@@ -71,7 +86,9 @@ export function hsvToHex(color: HsvColor) {
   const rgb = [red, green, blue]
     .map(channel => Math.round((channel + offset) * 255).toString(16).padStart(2, '0'))
     .join('')
-  const alpha = Math.round(clamp(color.a, 0, 1) * 255).toString(16).padStart(2, '0')
+  const alpha = allowAlpha
+    ? Math.round(clamp(color.a, 0, 1) * 255).toString(16).padStart(2, '0')
+    : ''
   return `#${rgb}${alpha}`.toUpperCase()
 }
 
@@ -97,7 +114,7 @@ export function rgbaToHexColor(color: RgbaColor) {
 }
 
 export function formatRgbaColor(value: string) {
-  const normalized = normalizeRgbaHexColor(value)
+  const normalized = normalizePickerHexColor(value, true)
   if (!normalized)
     return null
 

frontend/src/components/base/BaseColorPicker/index.vue

@@ -3,14 +3,15 @@ import { Check, ChevronDown } from '@lucide/vue'
 import { clamp } from 'es-toolkit'
 import { computed, shallowRef, useTemplateRef, watch } from 'vue'
 
-import { normalizeRgbaHexColor } from '@/utils/color'
+import { normalizeHexColor } from '@/utils/color'
 import BaseButton from '../BaseButton.vue'
 import BaseInput from '../BaseInput.vue'
 import BasePopover from '../BasePopover.vue'
 import {
   formatRgbaColor,
-  hexToHsv,
-  hsvToHex,
+  hexToHsva,
+  hsvaToHex,
+  normalizePickerHexColor,
   parseRgbaColor,
   rgbaToHexColor,
 } from './color'
@@ -20,11 +21,13 @@ const props = withDefaults(
     presets?: readonly string[]
     disabled?: boolean
     label?: string
+    allowAlpha?: boolean
   }>(),
   {
     presets: () => [],
     disabled: false,
     label: '选择颜色',
+    allowAlpha: true,
   },
 )
 
@@ -39,13 +42,22 @@ const svPanel = useTemplateRef<HTMLElement>('svPanel')
 const hueSlider = useTemplateRef<HTMLElement>('hueSlider')
 const alphaSlider = useTemplateRef<HTMLElement>('alphaSlider')
 
-const normalizedModel = computed(() => normalizeRgbaHexColor(model.value) ?? '#60A5FA80')
-const draftColor = computed(() => hsvToHex({
+const normalizedModel = computed(() =>
+  normalizePickerHexColor(model.value, props.allowAlpha)
+  ?? (props.allowAlpha ? '#60A5FA80' : '#2563EB'),
+)
+const triggerSwatchStyle = computed(() => props.allowAlpha
+  ? {
+      backgroundImage: `linear-gradient(${normalizedModel.value}, ${normalizedModel.value}), conic-gradient(#d8dee8 25%, #fff 0 50%, #d8dee8 0 75%, #fff 0)`,
+      backgroundSize: '100% 100%, 8px 8px',
+    }
+  : { backgroundColor: normalizedModel.value })
+const draftColor = computed(() => hsvaToHex({
   h: hue.value,
   s: saturation.value,
   v: brightness.value,
   a: alpha.value,
-}))
+}, props.allowAlpha))
 const hueColor = computed(() => `hsl(${hue.value} 100% 50%)`)
 const svCursorStyle = computed(() => ({
   left: `${saturation.value}%`,
@@ -63,8 +75,11 @@ const alphaTrackStyle = computed(() => {
     backgroundSize: '100% 100%, 8px 8px',
   }
 })
-const inputError = computed(() => customInput.value && !parseRgbaColor(customInput.value)
-  ? '请输入 rgba(r, g, b, a)'
+const inputValid = computed(() => props.allowAlpha
+  ? Boolean(parseRgbaColor(customInput.value))
+  : Boolean(normalizeHexColor(customInput.value)))
+const inputError = computed(() => customInput.value && !inputValid.value
+  ? props.allowAlpha ? '请输入 rgba(r, g, b, a)' : '请输入六位 HEX 颜色，例如 #2563EB'
   : undefined)
 
 watch(open, (isOpen) => {
@@ -78,16 +93,19 @@ watch(model, (value) => {
 })
 
 function resetDraft(value: string) {
-  const color = hexToHsv(value) ?? { h: 213, s: 62, v: 98, a: 0.5 }
+  const color = hexToHsva(normalizePickerHexColor(value, props.allowAlpha) ?? '')
+    ?? { h: 213, s: 62, v: 98, a: props.allowAlpha ? 0.5 : 1 }
   hue.value = color.h
   saturation.value = color.s
   brightness.value = color.v
-  alpha.value = color.a
-  customInput.value = formatRgbaColor(hsvToHex(color)) ?? ''
+  alpha.value = props.allowAlpha ? color.a : 1
+  syncInput()
 }
 
 function syncInput() {
-  customInput.value = formatRgbaColor(draftColor.value) ?? ''
+  customInput.value = props.allowAlpha
+    ? formatRgbaColor(draftColor.value) ?? ''
+    : normalizeHexColor(draftColor.value) ?? ''
 }
 
 function updateSaturationBrightness(event: PointerEvent) {
@@ -189,31 +207,31 @@ function handleAlphaKeydown(event: KeyboardEvent) {
 }
 
 function updateFromInput() {
-  const rgba = parseRgbaColor(customInput.value)
-  const color = rgba ? hexToHsv(rgbaToHexColor(rgba)) : null
+  const inputColor = normalizedInputColor()
+  const color = inputColor ? hexToHsva(inputColor) : null
   if (!color)
     return
 
   hue.value = color.h
   saturation.value = color.s
   brightness.value = color.v
-  alpha.value = color.a
-  customInput.value = formatRgbaColor(hsvToHex(color)) ?? ''
+  alpha.value = props.allowAlpha ? color.a : 1
+  syncInput()
 }
 
 function choosePreset(value: string) {
-  const normalized = normalizeRgbaHexColor(value)
+  const normalized = normalizePickerHexColor(value, props.allowAlpha)
   if (normalized)
     resetDraft(normalized)
 }
 
 function isPresetSelected(value: string) {
-  const normalized = normalizeRgbaHexColor(value)
+  const normalized = normalizePickerHexColor(value, props.allowAlpha)
   return normalized?.slice(0, 7) === draftColor.value.slice(0, 7)
 }
 
 function presetCheckClass(value: string) {
-  const normalized = normalizeRgbaHexColor(value)
+  const normalized = normalizePickerHexColor(value, props.allowAlpha)
   if (!normalized)
     return 'text-white'
 
@@ -227,13 +245,21 @@ function presetCheckClass(value: string) {
 
 function confirm() {
   updateFromInput()
-  const rgba = parseRgbaColor(customInput.value)
-  if (!rgba)
+  const normalized = normalizedInputColor()
+  if (!normalized)
     return
 
-  model.value = rgbaToHexColor(rgba)
+  model.value = normalized
   open.value = false
 }
+
+function normalizedInputColor() {
+  if (!props.allowAlpha)
+    return normalizeHexColor(customInput.value)
+
+  const rgba = parseRgbaColor(customInput.value)
+  return rgba ? rgbaToHexColor(rgba) : null
+}
 </script>
 
 <template>
@@ -246,14 +272,17 @@ function confirm() {
     <template #trigger>
       <button
         type="button"
-        class="group inline-flex size-8 items-center justify-center rounded-sm border-0 bg-transparent p-0 outline-none transition-opacity duration-150 hover:opacity-90 focus-visible:ring-2 focus-visible:ring-cp-info-border disabled:cursor-not-allowed disabled:opacity-60"
+        class="group inline-flex size-8 items-center justify-center rounded-sm border-0 bg-transparent p-0 outline-none transition-opacity duration-150 hover:opacity-90 focus-visible:ring-2 focus-visible:ring-cp-control-outline disabled:cursor-not-allowed disabled:opacity-60"
         :disabled="props.disabled"
         :aria-label="props.label"
         aria-haspopup="dialog"
         :aria-expanded="open"
       >
-        <span class="base-color-picker__checker relative flex size-full items-center justify-center overflow-hidden rounded-sm" aria-hidden="true">
-          <span class="absolute inset-0" :style="{ backgroundColor: normalizedModel }" />
+        <span
+          class="relative flex size-full items-center justify-center overflow-hidden rounded-sm"
+          :style="triggerSwatchStyle"
+          aria-hidden="true"
+        >
           <ChevronDown class="relative size-3.5 text-white drop-shadow-[0_1px_2px_rgb(0_0_0/0.65)]" />
         </span>
       </button>
@@ -263,7 +292,7 @@ function confirm() {
       <div class="grid h-43 grid-cols-[1fr_14px] gap-2">
         <div
           ref="svPanel"
-          class="base-color-picker__sv relative touch-none overflow-hidden rounded-sm outline-none focus-visible:ring-2 focus-visible:ring-cp-info-border"
+          class="base-color-picker__sv relative touch-none overflow-hidden rounded-sm outline-none focus-visible:ring-2 focus-visible:ring-cp-control-outline"
           :style="{ backgroundColor: hueColor }"
           role="slider"
           tabindex="0"
@@ -285,7 +314,7 @@ function confirm() {
 
         <div
           ref="hueSlider"
-          class="base-color-picker__hue relative touch-none rounded-sm outline-none focus-visible:ring-2 focus-visible:ring-cp-info-border"
+          class="base-color-picker__hue relative touch-none rounded-sm outline-none focus-visible:ring-2 focus-visible:ring-cp-control-outline"
           role="slider"
           tabindex="0"
           aria-label="色相"
@@ -305,10 +334,10 @@ function confirm() {
         </div>
       </div>
 
-      <div class="grid grid-cols-[1fr_36px] items-center gap-2">
+      <div v-if="props.allowAlpha" class="grid grid-cols-[1fr_36px] items-center gap-2">
         <div
           ref="alphaSlider"
-          class="base-color-picker__alpha relative h-3 touch-none rounded-sm outline-none focus-visible:ring-2 focus-visible:ring-cp-info-border"
+          class="base-color-picker__alpha relative h-3 touch-none rounded-sm outline-none focus-visible:ring-2 focus-visible:ring-cp-control-outline"
           :style="alphaTrackStyle"
           role="slider"
           tabindex="0"
@@ -328,7 +357,7 @@ function confirm() {
             aria-hidden="true"
           />
         </div>
-        <span class="text-right font-mono text-[11px] tabular-nums text-cp-secondary">
+        <span class="text-right font-mono text-cp-xs tabular-nums text-cp-text-secondary">
           {{ Math.round(alpha * 100) }}%
         </span>
       </div>
@@ -343,7 +372,7 @@ function confirm() {
           v-for="color in props.presets"
           :key="color"
           type="button"
-          class="relative flex size-6.5 items-center justify-center rounded-sm border-0 outline-none transition-transform duration-150 hover:scale-105 focus-visible:ring-2 focus-visible:ring-cp-info-border focus-visible:ring-offset-2 focus-visible:ring-offset-cp-surface"
+          class="relative flex size-6.5 items-center justify-center rounded-sm border-0 outline-none transition-transform duration-150 hover:scale-105 focus-visible:ring-2 focus-visible:ring-cp-control-outline focus-visible:ring-offset-2 focus-visible:ring-offset-cp-bg-container"
           :style="{ backgroundColor: color }"
           role="radio"
           :aria-label="color"
@@ -364,8 +393,9 @@ function confirm() {
         <div class="min-w-0 flex-1">
           <BaseInput
             v-model="customInput"
-            aria-label="RGBA 颜色"
-            placeholder="rgba(96, 165, 250, 1)"
+            class="rounded-cp bg-cp-fill-tertiary!"
+            :aria-label="props.allowAlpha ? 'RGBA 颜色' : 'HEX 颜色'"
+            :placeholder="props.allowAlpha ? 'rgba(96, 165, 250, 1)' : '#2563EB'"
             autocomplete="off"
             :disabled="props.disabled"
             :aria-invalid="Boolean(inputError) || undefined"
@@ -376,13 +406,13 @@ function confirm() {
           <p
             v-if="inputError"
             id="color-input-error"
-            class="mt-1.5 mb-0 text-xs font-emphasis text-cp-danger-text"
+            class="mt-1.5 mb-0 text-xs font-emphasis text-cp-error-text"
             aria-live="polite"
           >
             {{ inputError }}
           </p>
         </div>
-        <BaseButton size="md" variant="secondary" :disabled="!parseRgbaColor(customInput)" @click="confirm">
+        <BaseButton size="md" variant="secondary" :disabled="!inputValid" @click="confirm">
           确定
         </BaseButton>
       </div>
@@ -391,16 +421,6 @@ function confirm() {
 </template>
 
 <style scoped>
-.base-color-picker__checker,
-.base-color-picker__hue,
-.base-color-picker__sv {
-  --cp-color-picker-checker: conic-gradient(#d8dee8 25%, #fff 0 50%, #d8dee8 0 75%, #fff 0) 0 / 8px 8px;
-}
-
-.base-color-picker__checker {
-  background: var(--cp-color-picker-checker);
-}
-
 .base-color-picker__sv::before,
 .base-color-picker__sv::after {
   position: absolute;

frontend/src/components/base/BaseConfirmModal.vue

@@ -52,7 +52,7 @@ function handleConfirm() {
   >
     <div
       v-if="$slots.default"
-      class="text-[14px] leading-[1.55] font-emphasis text-cp-secondary"
+      class="text-cp-lg leading-[1.55] font-emphasis text-cp-text-secondary"
     >
       <slot />
     </div>

frontend/src/components/base/BaseEmpty.vue

@@ -28,22 +28,22 @@ const resolvedIcon = computed(() => props.icon ?? Inbox)
   <div
     class="grid justify-items-center text-center"
     :class="[
-      surface === 'none' ? 'bg-transparent' : 'rounded-cp-overlay bg-cp-subtle',
+      surface === 'none' ? 'bg-transparent' : 'rounded-cp-lg bg-cp-bg-elevated',
       size === 'sm' ? 'gap-2 px-4 py-5' : 'gap-3 px-6 py-8',
     ]"
   >
     <span
-      class="inline-flex items-center justify-center rounded-cp-control bg-cp-muted text-cp-muted-text"
+      class="inline-flex items-center justify-center rounded-cp bg-cp-fill-tertiary text-cp-text-quaternary"
       :class="size === 'sm' ? 'size-8' : 'size-10'"
     >
       <component :is="resolvedIcon" :size="size === 'sm' ? 16 : 18" />
     </span>
-    <p class="m-0 text-[13px] leading-[1.15] font-heavy text-cp-primary">
+    <p class="m-0 text-cp leading-[1.15] font-heavy text-cp-text">
       {{ resolvedTitle }}
     </p>
     <p
       v-if="description"
-      class="m-0 max-w-72 text-xs leading-[1.45] font-semibold text-cp-secondary"
+      class="m-0 max-w-72 text-xs leading-[1.45] font-semibold text-cp-text-secondary"
     >
       {{ description }}
     </p>

frontend/src/components/base/BaseForm/FormItem.vue

@@ -43,10 +43,10 @@ provide(formFieldKey, {
       <!-- eslint-disable-next-line vue-a11y/label-has-for -->
       <label
         :for="resolvedControlId"
-        class="flex min-w-0 items-center gap-1.5 text-[13px] leading-none font-medium text-cp-secondary"
+        class="flex min-w-0 items-center gap-1.5 text-cp leading-none font-medium text-cp-text-secondary"
       >
         <slot name="label">{{ label }}</slot>
-        <span v-if="required" class="font-bold text-cp-danger" aria-hidden="true">*</span>
+        <span v-if="required" class="font-bold text-cp-error" aria-hidden="true">*</span>
         <span v-if="required" class="sr-only">必填</span>
       </label>
       <div v-if="$slots.extra" class="inline-flex shrink-0 items-center">
@@ -56,7 +56,7 @@ provide(formFieldKey, {
     <p
       v-if="description"
       :id="descriptionId"
-      class="mt-0 mb-2 text-xs leading-[1.35] font-emphasis text-cp-muted-text"
+      class="mt-0 mb-2 text-xs leading-[1.35] font-emphasis text-cp-text-quaternary"
     >
       {{ description }}
     </p>
@@ -66,7 +66,7 @@ provide(formFieldKey, {
     <p
       v-if="error"
       :id="errorId"
-      class="mt-2 mb-0 text-xs leading-[1.35] font-emphasis text-cp-danger-text"
+      class="mt-2 mb-0 text-xs leading-[1.35] font-emphasis text-cp-error-text"
       aria-live="polite"
     >
       {{ error }}

frontend/src/components/base/BaseIconButton.vue

@@ -32,20 +32,20 @@ defineSlots<{
 
 const variantClasses: Record<IconButtonVariant, string> = {
   primary:
-    'bg-cp-accent text-cp-accent-on shadow-cp-control hover:bg-cp-accent-hover active:bg-cp-accent-pressed',
+    'bg-(--cp-button-primary-bg) text-(--cp-button-primary-color) shadow-cp-tertiary hover:bg-(--cp-button-primary-hover-bg) active:bg-(--cp-button-primary-active-bg)',
   secondary:
-    'bg-cp-surface text-cp-secondary shadow-cp-control hover:bg-cp-default-hover hover:text-cp-primary active:bg-cp-default-active',
+    'bg-cp-bg-container text-cp-text-secondary shadow-cp-tertiary hover:bg-cp-bg-text-hover hover:text-cp-text active:bg-cp-bg-text-active',
   success:
     'bg-cp-success-bg text-cp-success-text shadow-none hover:bg-cp-success-bg-hover active:bg-cp-success-bg-active',
   ghost:
-    'bg-transparent text-cp-secondary shadow-none hover:bg-cp-subtle hover:text-cp-primary active:bg-cp-muted',
+    'bg-transparent text-cp-text-secondary shadow-none hover:bg-cp-fill-quaternary hover:text-cp-text active:bg-cp-fill-tertiary',
   destructive:
-    'bg-transparent text-cp-danger-text shadow-none hover:bg-cp-danger-bg-hover active:bg-cp-danger-bg-active',
+    'bg-transparent text-cp-error-text shadow-none hover:bg-cp-error-bg-hover active:bg-cp-error-bg-active',
 }
 
 const sizeClasses: Record<IconButtonSize, string> = {
   sm: 'size-cp-control-sm [&>svg]:size-3.5',
-  md: 'size-cp-control-md [&>svg]:size-4',
+  md: 'size-cp-control [&>svg]:size-4',
   lg: 'size-cp-control-lg [&>svg]:size-4.5',
 }
 
@@ -56,12 +56,12 @@ const spinnerSizes: Record<IconButtonSize, number> = {
 }
 
 const classes = computed(() => [
-  'inline-grid shrink-0 touch-manipulation place-items-center rounded-cp-control border-0 leading-none outline-none transition-[background-color,box-shadow,color,opacity,transform] duration-150 motion-safe:active:scale-[0.96] motion-reduce:transition-none',
-  'focus-visible:ring-2 focus-visible:ring-cp-accent-border focus-visible:ring-offset-2 focus-visible:ring-offset-cp-surface',
-  'disabled:cursor-not-allowed disabled:transform-none disabled:bg-cp-disabled disabled:text-cp-disabled-text disabled:shadow-none',
+  'inline-grid shrink-0 touch-manipulation place-items-center rounded-cp border-0 leading-none outline-none transition-[background-color,box-shadow,color,opacity,transform] duration-150 motion-safe:active:scale-[0.96] motion-reduce:transition-none',
+  'focus-visible:ring-2 focus-visible:ring-cp-control-outline focus-visible:ring-offset-2 focus-visible:ring-offset-cp-bg-container',
+  'disabled:cursor-not-allowed disabled:transform-none disabled:bg-cp-bg-container-disabled disabled:text-cp-text-disabled disabled:shadow-none',
   sizeClasses[props.size],
   variantClasses[props.variant],
-  props.pressed ? 'bg-cp-default-active text-cp-primary' : undefined,
+  props.pressed ? 'bg-cp-bg-text-active text-cp-text' : undefined,
 ])
 </script>
 

frontend/src/components/base/BaseInput.vue

@@ -48,31 +48,31 @@ const controlAttrs = computed(() => Object.fromEntries(
 
 const sizeClasses: Record<InputSize, string> = {
   sm: 'h-cp-control-sm gap-2 px-3 text-xs',
-  md: 'h-cp-control-md gap-2.5 px-3.5 text-[13px]',
-  lg: 'h-cp-control-lg gap-3 px-4 text-[14px]',
+  md: 'h-cp-control gap-2.5 px-3.5 text-cp',
+  lg: 'h-cp-control-lg gap-3 px-4 text-cp-lg',
 }
 
 const containerClasses = computed(() => [
-  'relative inline-flex w-full min-w-0 items-center overflow-visible rounded-cp-control border-0 text-cp-primary shadow-cp-input transition-[background-color,box-shadow,color] duration-[160ms] motion-reduce:transition-none',
+  'relative inline-flex w-full min-w-0 items-center overflow-visible rounded-cp border-0 text-cp-text shadow-cp-input transition-[background-color,box-shadow,color] duration-[160ms] motion-reduce:transition-none',
   sizeClasses[props.size],
   props.disabled
-    ? 'cursor-not-allowed bg-cp-disabled text-cp-disabled-text shadow-none'
+    ? 'cursor-not-allowed bg-cp-bg-container-disabled text-cp-text-disabled shadow-none'
     : invalid.value
-      ? 'bg-(--cp-input-error-soft-bg) shadow-cp-input-error'
+      ? 'bg-(--cp-input-error-active-bg) shadow-cp-input-error-active'
       : [
-          'bg-[var(--cp-input-current-bg,var(--cp-input-context-bg))]',
-          'hover:bg-[var(--cp-input-current-bg-hover,var(--cp-input-context-bg-hover))] hover:shadow-cp-input-hover',
-          'focus-within:bg-(--cp-input-soft-bg-focus) focus-within:shadow-cp-input-focus',
+          'bg-[var(--cp-input-bg)]',
+          'hover:bg-[var(--cp-input-hover-bg)] hover:shadow-cp-input-hover',
+          'focus-within:bg-(--cp-input-active-bg) focus-within:shadow-cp-input-active',
         ],
 ])
 
 const iconClasses = computed(() => [
   'inline-flex shrink-0',
   props.disabled
-    ? 'text-cp-disabled-icon'
+    ? 'text-cp-text-disabled'
     : invalid.value
-      ? 'text-cp-danger'
-      : 'text-cp-muted-text',
+      ? 'text-cp-error'
+      : 'text-cp-text-quaternary',
 ])
 
 function updateModel(event: Event) {
@@ -90,7 +90,7 @@ function updateModel(event: Event) {
         v-bind="controlAttrs"
         :id="controlId"
         :value="model"
-        class="base-input__field h-full min-w-0 flex-1 border-0 bg-transparent font-emphasis leading-[1.15] text-cp-primary outline-0 placeholder:text-cp-muted-text disabled:cursor-not-allowed disabled:text-cp-disabled-text"
+        class="base-input__field h-full min-w-0 flex-1 border-0 bg-transparent font-emphasis leading-[1.15] text-cp-text outline-0 placeholder:text-cp-text-quaternary disabled:cursor-not-allowed disabled:text-cp-text-disabled"
         :placeholder="placeholder"
         :type="type"
         :disabled="disabled"
@@ -109,24 +109,35 @@ function updateModel(event: Event) {
 
 <style scoped>
 .base-input__control {
-  --base-input-autofill-bg: var(--cp-input-current-bg, var(--cp-input-context-bg));
+  --base-input-autofill-bg: var(--cp-input-bg);
 }
 
 .base-input__control:hover {
-  --base-input-autofill-bg: var(--cp-input-current-bg-hover, var(--cp-input-context-bg-hover));
+  --base-input-autofill-bg: var(--cp-input-hover-bg);
 }
 
 .base-input__control:focus-within {
-  --base-input-autofill-bg: var(--cp-input-soft-bg-focus);
+  --base-input-autofill-bg: var(--cp-input-active-bg);
 }
 
 .base-input__field:-webkit-autofill,
 .base-input__field:-webkit-autofill:hover,
 .base-input__field:-webkit-autofill:focus,
 .base-input__field:autofill {
-  caret-color: var(--cp-text-primary);
-  -webkit-text-fill-color: var(--cp-text-primary) !important;
+  caret-color: var(--cp-color-text);
+  -webkit-text-fill-color: var(--cp-color-text) !important;
   -webkit-box-shadow: 0 0 0 1000px var(--base-input-autofill-bg) inset !important;
   box-shadow: 0 0 0 1000px var(--base-input-autofill-bg) inset !important;
 }
+
+/* 普通数字表单保留键盘步进，但不混入浏览器原生微调器外观。 */
+.base-input__field[type='number'] {
+  appearance: textfield;
+}
+
+.base-input__field[type='number']::-webkit-inner-spin-button,
+.base-input__field[type='number']::-webkit-outer-spin-button {
+  margin: 0;
+  appearance: none;
+}
 </style>

frontend/src/components/base/BaseMenuItem.vue

@@ -22,12 +22,12 @@ defineSlots<{
 }>()
 
 const classes = computed(() => [
-  'flex min-h-9 w-full touch-manipulation items-center gap-2 rounded-cp-control-sm border-0 bg-transparent px-3 text-left text-[13px] leading-none font-emphasis outline-none transition-[background-color,color] duration-150 motion-reduce:transition-none',
-  'focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-cp-accent-border',
-  'disabled:cursor-not-allowed disabled:text-cp-disabled-text',
+  'flex min-h-9 w-full touch-manipulation items-center gap-2 rounded-cp-sm border-0 bg-transparent px-3 text-left text-cp leading-none font-emphasis outline-none transition-[background-color,color] duration-150 motion-reduce:transition-none',
+  'focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-cp-control-outline',
+  'disabled:cursor-not-allowed disabled:text-cp-text-disabled',
   props.tone === 'destructive'
-    ? 'text-cp-danger-text hover:bg-cp-danger-bg-hover'
-    : 'text-cp-primary hover:bg-cp-default-hover',
+    ? 'text-cp-error-text hover:bg-cp-error-bg-hover'
+    : 'text-cp-text hover:bg-cp-bg-text-hover',
 ])
 </script>
 

frontend/src/components/base/BaseModal/index.vue

@@ -72,8 +72,8 @@ const toneClasses: Record<ModalTone, { iconBg: string, icon: string }> = {
     icon: 'text-cp-warning',
   },
   danger: {
-    iconBg: 'bg-cp-danger-bg',
-    icon: 'text-cp-danger',
+    iconBg: 'bg-cp-error-bg',
+    icon: 'text-cp-error',
   },
   success: {
     iconBg: 'bg-cp-success-bg',
@@ -186,12 +186,12 @@ onBeforeUnmount(() => {
           type="button"
           tabindex="-1"
           aria-label="关闭弹窗"
-          class="absolute inset-0 cursor-default border-0 bg-cp-overlay p-0"
+          class="absolute inset-0 cursor-default border-0 bg-cp-bg-mask p-0"
           @click="closeModal"
         />
         <section
           ref="panel"
-          class="cp-modal-panel [--cp-input-current-bg:var(--cp-input-soft-bg)] [--cp-input-current-bg-hover:var(--cp-input-soft-bg-hover)] relative grid max-h-[calc(100dvh-1.5rem)] w-full min-w-0 overflow-hidden rounded-cp-surface bg-cp-surface shadow-cp-popover sm:max-h-[calc(100dvh-3rem)]"
+          class="cp-modal-panel relative grid max-h-[calc(100dvh-1.5rem)] w-full min-w-0 overflow-hidden rounded-cp-card bg-cp-bg-container shadow-cp sm:max-h-[calc(100dvh-3rem)]"
           :class="[
             sizeClasses[size],
             $slots.default ? 'grid-rows-[auto_minmax(0,1fr)_auto]' : 'grid-rows-[auto_auto]',
@@ -213,21 +213,21 @@ onBeforeUnmount(() => {
           >
             <span
               v-if="tone !== 'neutral'"
-              class="inline-flex size-11 items-center justify-center rounded-cp-control"
-              :class="$slots.icon ? 'bg-cp-subtle' : toneClasses[tone].iconBg"
+              class="inline-flex size-11 items-center justify-center rounded-cp"
+              :class="$slots.icon ? 'bg-cp-fill-quaternary' : toneClasses[tone].iconBg"
             >
               <slot name="icon">
                 <component :is="iconMap[tone]" :size="18" :class="toneClasses[tone].icon" />
               </slot>
             </span>
             <div class="min-w-0">
-              <h2 :id="titleId" class="m-0 text-lg leading-[1.15] font-heavy text-cp-primary">
+              <h2 :id="titleId" class="m-0 text-lg leading-[1.15] font-heavy text-cp-text">
                 {{ title }}
               </h2>
               <p
                 v-if="description"
                 :id="descriptionId"
-                class="mt-2 mb-0 text-[13px] leading-[1.45] font-semibold text-cp-secondary"
+                class="mt-2 mb-0 text-cp leading-[1.45] font-semibold text-cp-text-secondary"
               >
                 {{ description }}
               </p>
@@ -243,7 +243,9 @@ onBeforeUnmount(() => {
             </BaseIconButton>
           </header>
           <div v-if="$slots.default" class="min-h-0 overflow-hidden px-3.25 py-3.25 sm:px-5.25 sm:py-5.25">
-            <BaseScrollbar class="h-full">
+            <BaseScrollbar
+              class="h-full -mr-2 pr-2 sm:-mr-3 sm:pr-3"
+            >
               <div class="p-0.75">
                 <slot />
               </div>

frontend/src/components/base/BaseNumberInput.vue

@@ -0,0 +1,127 @@
+<script setup lang="ts">
+import { Minus, Plus } from '@lucide/vue'
+import { computed, useAttrs } from 'vue'
+
+import BaseIconButton from './BaseIconButton.vue'
+
+defineOptions({ inheritAttrs: false })
+
+const props = withDefaults(
+  defineProps<{
+    label: string
+    min?: number
+    max?: number
+    step?: number
+    unit?: string
+    disabled?: boolean
+  }>(),
+  {
+    min: undefined,
+    max: undefined,
+    step: 1,
+    unit: undefined,
+    disabled: false,
+  },
+)
+
+const model = defineModel<number>({ required: true })
+const attrs = useAttrs()
+
+const rootAttrs = computed(() => ({ class: attrs.class, style: attrs.style }))
+const controlAttrs = computed(() => Object.fromEntries(
+  Object.entries(attrs).filter(([key]) => !['class', 'style'].includes(key)),
+))
+const canDecrease = computed(() => !props.disabled && (props.min === undefined || model.value > props.min))
+const canIncrease = computed(() => !props.disabled && (props.max === undefined || model.value < props.max))
+
+function clampValue(value: number) {
+  return Math.min(props.max ?? Number.POSITIVE_INFINITY, Math.max(props.min ?? Number.NEGATIVE_INFINITY, value))
+}
+
+function stepPrecision() {
+  const decimal = String(props.step).split('.')[1]
+  return decimal?.length ?? 0
+}
+
+function updateModel(event: Event) {
+  const value = (event.target as HTMLInputElement).valueAsNumber
+  if (Number.isFinite(value))
+    model.value = clampValue(value)
+}
+
+function restoreValue(event: Event) {
+  const input = event.target as HTMLInputElement
+  input.value = String(model.value)
+}
+
+function stepBy(direction: -1 | 1) {
+  const next = clampValue(model.value + props.step * direction)
+  model.value = Number(next.toFixed(stepPrecision()))
+}
+</script>
+
+<template>
+  <div
+    v-bind="rootAttrs"
+    class="inline-flex h-8 items-center rounded-cp bg-cp-fill-tertiary p-0.5 text-cp-text transition-[background-color,box-shadow] duration-150 focus-within:bg-cp-bg-container focus-within:shadow-cp-input-active motion-reduce:transition-none"
+  >
+    <BaseIconButton
+      :label="`减少${label}`"
+      size="sm"
+      variant="ghost"
+      class="size-7!"
+      :disabled="!canDecrease"
+      @click="stepBy(-1)"
+    >
+      <Minus class="size-3" />
+    </BaseIconButton>
+
+    <span class="inline-flex min-w-0 items-baseline justify-center gap-1 px-1">
+      <input
+        v-bind="controlAttrs"
+        :value="model"
+        type="number"
+        inputmode="decimal"
+        :aria-label="label"
+        :min="min"
+        :max="max"
+        :step="step"
+        :disabled="disabled"
+        class="base-number-input__field w-9 min-w-0 border-0 bg-transparent p-0 text-right font-mono text-cp-xs font-bold tabular-nums text-cp-text outline-none disabled:text-cp-text-disabled"
+        @input="updateModel"
+        @blur="restoreValue"
+      >
+      <span
+        v-if="unit"
+        class="shrink-0 text-[9px] font-emphasis text-cp-text-quaternary"
+        aria-hidden="true"
+      >
+        {{ unit }}
+      </span>
+    </span>
+
+    <BaseIconButton
+      :label="`增加${label}`"
+      size="sm"
+      variant="ghost"
+      class="size-7!"
+      :disabled="!canIncrease"
+      @click="stepBy(1)"
+    >
+      <Plus class="size-3" />
+    </BaseIconButton>
+  </div>
+</template>
+
+<style scoped>
+/* 隐藏浏览器原生微调器，统一使用两侧的减号和加号。 */
+.base-number-input__field {
+  appearance: textfield;
+}
+
+.base-number-input__field::-webkit-inner-spin-button,
+.base-number-input__field::-webkit-outer-spin-button {
+  margin: 0;
+  appearance: none;
+}
+</style>

frontend/src/components/base/BasePageHeader.vue

@@ -10,12 +10,12 @@ defineProps<{
     class="flex min-h-17 shrink-0 flex-wrap items-start justify-between gap-x-4 gap-y-3"
   >
     <div class="min-w-0 flex-1 basis-64">
-      <h1 class="m-0 text-[34px] leading-[1.15] font-extrabold text-cp-primary">
+      <h1 class="m-0 text-[34px] leading-[1.15] font-extrabold text-cp-text">
         {{ title }}
       </h1>
       <p
         v-if="description || $slots.description"
-        class="mt-2.5 mb-0 flex items-center gap-2 text-[15px] leading-[1.15] font-semibold text-cp-secondary"
+        class="mt-2.5 mb-0 flex items-center gap-2 text-cp-xl leading-[1.15] font-semibold text-cp-text-secondary"
       >
         <slot name="description">
           {{ description }}

frontend/src/components/base/BasePopover.vue

@@ -56,7 +56,7 @@ const hoverOpenTimer = shallowRef<number>()
 const viewportTarget = computed(() => (open.value && typeof window !== 'undefined' ? window : null))
 
 const popoverClasses = computed(() => [
-  'fixed z-50 overflow-visible rounded-cp-overlay border-0 bg-cp-surface text-left text-cp-primary shadow-cp-popover',
+  'fixed z-50 overflow-visible rounded-cp-lg border-0 bg-cp-bg-container text-left text-cp-text shadow-cp',
   props.animatePosition
     ? 'transition-[left,top] duration-150 ease-out motion-reduce:transition-none'
     : undefined,

frontend/src/components/base/BaseRadio.vue

@@ -24,10 +24,10 @@ const checked = computed(() => model.value === props.value)
 const indicatorClasses = computed(() => [
   'relative inline-grid size-4 shrink-0 place-items-center rounded-full transition-colors duration-150 motion-reduce:transition-none',
   props.disabled
-    ? 'bg-cp-disabled text-cp-disabled-icon'
+    ? 'bg-cp-bg-container-disabled text-cp-text-disabled'
     : checked.value
-      ? 'bg-cp-accent text-cp-accent-on'
-      : 'bg-cp-muted text-transparent group-hover:bg-cp-default-active',
+      ? 'bg-cp-primary text-(--cp-button-primary-color)'
+      : 'bg-cp-fill-tertiary text-transparent group-hover:bg-cp-bg-text-active',
 ])
 </script>
 
@@ -49,7 +49,7 @@ const indicatorClasses = computed(() => [
     >
     <span
       :class="indicatorClasses"
-      class="peer-focus-visible:ring-2 peer-focus-visible:ring-cp-accent-border peer-focus-visible:ring-offset-2 peer-focus-visible:ring-offset-cp-surface"
+      class="peer-focus-visible:ring-2 peer-focus-visible:ring-cp-control-outline peer-focus-visible:ring-offset-2 peer-focus-visible:ring-offset-cp-bg-container"
       aria-hidden="true"
     >
       <span class="size-1.5 rounded-full bg-current" />
@@ -57,7 +57,7 @@ const indicatorClasses = computed(() => [
     <span v-if="$slots.default" class="min-w-0 flex-1">
       <slot />
     </span>
-    <span v-else-if="showLabel" class="text-[13px] leading-none font-emphasis">
+    <span v-else-if="showLabel" class="text-cp leading-none font-emphasis">
       {{ label }}
     </span>
   </label>

frontend/src/components/base/BaseRange.vue

@@ -0,0 +1,142 @@
+<script setup lang="ts">
+import type { CSSProperties } from 'vue'
+import { computed } from 'vue'
+
+const props = withDefaults(
+  defineProps<{
+    label: string
+    min?: number
+    max?: number
+    step?: number
+    unit?: string
+    disabled?: boolean
+  }>(),
+  {
+    min: 0,
+    max: 100,
+    step: 1,
+    unit: undefined,
+    disabled: false,
+  },
+)
+
+const model = defineModel<number>({ required: true })
+
+const rangeStyle = computed<CSSProperties>(() => {
+  const span = props.max - props.min
+  const progress = span > 0 ? ((model.value - props.min) / span) * 100 : 0
+  return {
+    '--base-range-progress': `${Math.min(100, Math.max(0, progress))}%`,
+  }
+})
+
+const valueText = computed(() => `${model.value}${props.unit ?? ''}`)
+
+function updateModel(event: Event) {
+  const value = (event.target as HTMLInputElement).valueAsNumber
+  if (Number.isFinite(value))
+    model.value = value
+}
+</script>
+
+<template>
+  <input
+    :value="model"
+    type="range"
+    :min="min"
+    :max="max"
+    :step="step"
+    :disabled="disabled"
+    :aria-label="label"
+    :aria-valuetext="valueText"
+    class="base-range h-5 w-full"
+    :style="rangeStyle"
+    @input="updateModel"
+  >
+</template>
+
+<style scoped>
+.base-range {
+  appearance: none;
+  cursor: pointer;
+  background: transparent;
+  outline: none;
+}
+
+.base-range::-webkit-slider-runnable-track {
+  height: 4px;
+  border-radius: 999px;
+  background: linear-gradient(
+    to right,
+    var(--cp-color-primary) 0 var(--base-range-progress),
+    var(--cp-color-fill-secondary) var(--base-range-progress) 100%
+  );
+}
+
+.base-range::-webkit-slider-thumb {
+  width: 14px;
+  height: 14px;
+  margin-top: -5px;
+  appearance: none;
+  border: 2px solid var(--cp-color-bg-container);
+  border-radius: 999px;
+  background: var(--cp-color-primary);
+  transition:
+    box-shadow 150ms ease,
+    transform 150ms ease;
+}
+
+.base-range::-moz-range-track {
+  height: 4px;
+  border-radius: 999px;
+  background: var(--cp-color-fill-secondary);
+}
+
+.base-range::-moz-range-progress {
+  height: 4px;
+  border-radius: 999px;
+  background: var(--cp-color-primary);
+}
+
+.base-range::-moz-range-thumb {
+  width: 10px;
+  height: 10px;
+  border: 2px solid var(--cp-color-bg-container);
+  border-radius: 999px;
+  background: var(--cp-color-primary);
+  transition:
+    box-shadow 150ms ease,
+    transform 150ms ease;
+}
+
+.base-range:hover::-webkit-slider-thumb {
+  transform: scale(1.08);
+}
+
+.base-range:hover::-moz-range-thumb {
+  transform: scale(1.08);
+}
+
+.base-range:focus-visible::-webkit-slider-thumb {
+  box-shadow: 0 0 0 3px var(--cp-color-primary-bg-hover);
+}
+
+.base-range:focus-visible::-moz-range-thumb {
+  box-shadow: 0 0 0 3px var(--cp-color-primary-bg-hover);
+}
+
+.base-range:disabled {
+  cursor: not-allowed;
+  opacity: 0.5;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .base-range::-webkit-slider-thumb {
+    transition: none;
+  }
+
+  .base-range::-moz-range-thumb {
+    transition: none;
+  }
+}
+</style>

frontend/src/components/base/BaseScrollbar.vue

@@ -9,12 +9,14 @@ const props = withDefaults(
     height?: string
     horizontal?: boolean
     vertical?: boolean
+    alwaysVisible?: boolean
   }>(),
   {
     maxHeight: undefined,
     height: undefined,
     horizontal: false,
     vertical: true,
+    alwaysVisible: false,
   },
 )
 
@@ -64,10 +66,10 @@ const { start: startHideTimer, stop: stopHideTimer } = useTimeoutFn(hideScrollba
 const canScrollY = computed(() => thumbHeight.value > 0)
 const canScrollX = computed(() => horizontalThumbWidth.value > 0)
 const verticalScrollbarVisible = computed(
-  () => dragging.value || verticalTrackHovering.value || visible.value,
+  () => props.alwaysVisible || dragging.value || verticalTrackHovering.value || visible.value,
 )
 const horizontalScrollbarVisible = computed(
-  () => horizontalDragging.value || horizontalTrackHovering.value || visible.value,
+  () => props.alwaysVisible || horizontalDragging.value || horizontalTrackHovering.value || visible.value,
 )
 const thumbStyle = computed(() => ({
   height: `${thumbHeight.value}px`,
@@ -510,8 +512,8 @@ defineExpose({
       ]"
     >
       <div
-        class="w-1.5 rounded-full bg-(--cp-scrollbar-thumb) transition-colors duration-200 hover:bg-(--cp-scrollbar-thumb-hover)"
-        :class="dragging ? 'bg-(--cp-scrollbar-thumb-hover)' : ''"
+        class="w-1.5 rounded-full bg-(--cp-scrollbar-thumb-bg) transition-colors duration-200 hover:bg-(--cp-scrollbar-thumb-hover-bg)"
+        :class="dragging ? 'bg-(--cp-scrollbar-thumb-hover-bg)' : ''"
         :style="thumbStyle"
         @pointerdown="handleThumbPointerDown"
       />
@@ -528,8 +530,8 @@ defineExpose({
       ]"
     >
       <div
-        class="h-1.5 rounded-full bg-(--cp-scrollbar-thumb) transition-colors duration-200 hover:bg-(--cp-scrollbar-thumb-hover)"
-        :class="horizontalDragging ? 'bg-(--cp-scrollbar-thumb-hover)' : ''"
+        class="h-1.5 rounded-full bg-(--cp-scrollbar-thumb-bg) transition-colors duration-200 hover:bg-(--cp-scrollbar-thumb-hover-bg)"
+        :class="horizontalDragging ? 'bg-(--cp-scrollbar-thumb-hover-bg)' : ''"
         :style="horizontalThumbStyle"
         @pointerdown="handleHorizontalThumbPointerDown"
       />
@@ -549,6 +551,6 @@ defineExpose({
 }
 
 .base-scrollbar-track-y {
-  top: var(--cp-scrollbar-track-top, 0.25rem);
+  top: var(--cp-scrollbar-track-inset-block-start, 0.25rem);
 }
 </style>

frontend/src/components/base/BaseSegmented.vue

@@ -45,13 +45,13 @@ const indicatorStyle = computed(() => ({
 
 const rootClasses: Record<SegmentedSize, string> = {
   sm: 'h-cp-control-sm',
-  md: 'h-cp-control-md',
+  md: 'h-cp-control',
   lg: 'h-cp-control-lg',
 }
 const optionClasses: Record<SegmentedSize, string> = {
-  sm: 'h-6.5 px-2 text-[11px]',
+  sm: 'h-6.5 px-2 text-cp-xs',
   md: 'h-8 px-3 text-xs',
-  lg: 'h-9.5 px-4 text-[13px]',
+  lg: 'h-9.5 px-4 text-cp',
 }
 
 function enabledIndexes() {
@@ -97,7 +97,7 @@ async function handleKeydown(event: KeyboardEvent, index: number) {
 
 <template>
   <div
-    class="relative inline-grid items-center rounded-cp-control bg-cp-muted p-0.75"
+    class="relative inline-grid items-center rounded-cp bg-cp-fill-tertiary p-0.75"
     :class="rootClasses[size]"
     :style="gridStyle"
     role="radiogroup"
@@ -106,20 +106,20 @@ async function handleKeydown(event: KeyboardEvent, index: number) {
   >
     <span
       v-if="options.length > 0"
-      class="pointer-events-none absolute inset-y-0.75 left-0.75 rounded-cp-control bg-cp-surface shadow-cp-control transition-transform duration-200 ease-out motion-reduce:transition-none"
+      class="pointer-events-none absolute inset-y-0.75 left-0.75 rounded-cp bg-cp-bg-container shadow-cp-tertiary transition-transform duration-200 ease-out motion-reduce:transition-none"
       :style="indicatorStyle"
       aria-hidden="true"
     />
     <button
       v-for="(option, index) in options"
       :key="option.value"
-      class="relative z-10 inline-flex min-w-0 touch-manipulation items-center justify-center gap-1.5 rounded-cp-control border-0 bg-transparent leading-none font-emphasis outline-none transition-colors duration-150 focus-visible:ring-2 focus-visible:ring-cp-accent-border motion-reduce:transition-none"
+      class="relative z-10 inline-flex min-w-0 touch-manipulation items-center justify-center gap-1.5 rounded-cp border-0 bg-transparent leading-none font-emphasis outline-none transition-colors duration-150 focus-visible:ring-2 focus-visible:ring-cp-control-outline motion-reduce:transition-none"
       :class="[
         optionClasses[size],
         model === option.value
-          ? 'text-cp-primary'
-          : 'text-cp-secondary hover:text-cp-primary',
-        disabled || option.disabled ? 'cursor-not-allowed opacity-60 hover:text-cp-secondary' : undefined,
+          ? 'text-cp-text'
+          : 'text-cp-text-secondary hover:text-cp-text',
+        disabled || option.disabled ? 'cursor-not-allowed opacity-60 hover:text-cp-text-secondary' : undefined,
         display === 'icon' ? 'px-0' : undefined,
       ]"
       type="button"

frontend/src/components/base/BaseSelect.vue

@@ -76,18 +76,18 @@ const sizeConfig: Record<
 > = {
   md: {
     trigger:
-      'h-cp-control-md px-3.5 pr-9 text-[13px] rounded-cp-control',
-    option: 'h-8.5 px-3 text-[13px]',
+      'h-cp-control px-3.5 pr-9 text-cp rounded-cp',
+    option: 'h-8.5 px-3 text-cp',
     icon: 16,
   },
   sm: {
-    trigger: 'h-cp-control-sm px-2.5 pr-7 text-xs rounded-cp-control',
+    trigger: 'h-cp-control-sm px-2.5 pr-7 text-xs rounded-cp',
     option: 'h-8 px-2.5 text-xs',
     icon: 14,
   },
   lg: {
-    trigger: 'h-cp-control-lg px-4 pr-10 text-[14px] rounded-cp-control',
-    option: 'h-10 px-3.5 text-[14px]',
+    trigger: 'h-cp-control-lg px-4 pr-10 text-cp-lg rounded-cp',
+    option: 'h-10 px-3.5 text-cp-lg',
     icon: 17,
   },
 }
@@ -98,20 +98,20 @@ const triggerClasses = computed(() => [
   'relative inline-flex w-full min-w-0 items-center gap-2 overflow-visible border-0 text-left font-emphasis leading-none shadow-cp-input outline-none transition-[background-color,box-shadow,color] duration-[160ms]',
   sizeConfig[props.size].trigger,
   props.disabled
-    ? 'cursor-not-allowed bg-cp-disabled text-cp-disabled-text shadow-none'
+    ? 'cursor-not-allowed bg-cp-bg-container-disabled text-cp-text-disabled shadow-none'
     : invalid.value
-      ? 'cursor-pointer bg-(--cp-input-error-soft-bg) text-cp-danger-text shadow-cp-input-error'
+      ? 'cursor-pointer bg-(--cp-input-error-active-bg) text-cp-error-text shadow-cp-input-error-active'
       : open.value
-        ? 'cursor-pointer bg-(--cp-input-soft-bg-focus) text-cp-primary shadow-cp-input-focus'
+        ? 'cursor-pointer bg-(--cp-input-active-bg) text-cp-text shadow-cp-input-active'
         : [
-            'cursor-pointer bg-[var(--cp-input-current-bg,var(--cp-input-context-bg))] text-cp-primary',
-            'hover:bg-[var(--cp-input-current-bg-hover,var(--cp-input-context-bg-hover))] hover:shadow-cp-input-hover',
-            'focus-visible:bg-(--cp-input-soft-bg-focus) focus-visible:shadow-cp-input-focus',
+            'cursor-pointer bg-[var(--cp-input-bg)] text-cp-text',
+            'hover:bg-[var(--cp-input-hover-bg)] hover:shadow-cp-input-hover',
+            'focus-visible:bg-(--cp-input-active-bg) focus-visible:shadow-cp-input-active',
           ],
 ])
 
 const popoverClasses = computed(() => [
-  'fixed z-50 flex flex-col gap-1 rounded-cp-overlay border-0 bg-cp-surface p-1 shadow-cp-popover',
+  'fixed z-50 flex flex-col gap-1 rounded-cp-lg border-0 bg-cp-bg-container p-1 shadow-cp',
   props.options.length > 6 ? 'cp-scrollbar overflow-y-auto' : 'overflow-visible',
 ])
 
@@ -255,15 +255,15 @@ function handleTriggerKeydown(event: KeyboardEvent) {
 
 function optionClasses(option: SelectOption, index: number) {
   return [
-    'flex w-full touch-manipulation items-center gap-2 rounded-cp-control-sm border-0 px-3 text-left font-emphasis leading-none outline-none transition-colors motion-reduce:transition-none',
+    'flex w-full touch-manipulation items-center gap-2 rounded-cp-sm border-0 px-3 text-left font-emphasis leading-none outline-none transition-colors motion-reduce:transition-none',
     sizeConfig[props.size].option,
     option.disabled
-      ? 'cursor-not-allowed bg-transparent text-cp-disabled-text'
+      ? 'cursor-not-allowed bg-transparent text-cp-text-disabled'
       : option.value === model.value
-        ? 'cursor-pointer bg-cp-info-bg text-cp-info-text'
+        ? 'cursor-pointer bg-cp-control-item-bg-active text-cp-primary-text'
         : activeIndex.value === index
-          ? 'cursor-pointer bg-cp-default-hover text-cp-primary'
-          : 'cursor-pointer bg-transparent text-cp-primary hover:bg-cp-default-hover',
+          ? 'cursor-pointer bg-cp-bg-text-hover text-cp-text'
+          : 'cursor-pointer bg-transparent text-cp-text hover:bg-cp-bg-text-hover',
   ]
 }
 
@@ -316,10 +316,10 @@ useEventListener(window, 'scroll', updatePopoverPositionThrottled, { capture: tr
         class="pointer-events-none absolute top-1/2 right-3 -translate-y-1/2 transition-transform"
         :class="
           disabled
-            ? 'text-cp-disabled-icon'
+            ? 'text-cp-text-disabled'
             : open
-              ? 'rotate-180 text-cp-info'
-              : 'text-cp-muted-text'
+              ? 'rotate-180 text-cp-primary-text'
+              : 'text-cp-text-quaternary'
         "
         :size="sizeConfig[size].icon"
         aria-hidden="true"
@@ -346,7 +346,7 @@ useEventListener(window, 'scroll', updatePopoverPositionThrottled, { capture: tr
         >
           <div
             v-if="options.length === 0"
-            class="flex h-8.5 items-center rounded-cp-control-sm px-3 text-[13px] leading-none font-emphasis text-cp-muted-text"
+            class="flex h-8.5 items-center rounded-cp-sm px-3 text-cp leading-none font-emphasis text-cp-text-quaternary"
           >
             {{ emptyText }}
           </div>
@@ -369,7 +369,7 @@ useEventListener(window, 'scroll', updatePopoverPositionThrottled, { capture: tr
               <span class="min-w-0 flex-1 truncate">{{ option.label }}</span>
               <Check
                 v-if="option.value === model"
-                class="shrink-0 text-cp-info"
+                class="shrink-0 text-cp-primary-text"
                 :size="size === 'sm' ? 13 : size === 'lg' ? 17 : 15"
                 aria-hidden="true"
               />

frontend/src/components/base/BaseSkeleton.vue

@@ -0,0 +1,38 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+
+type SkeletonShape = 'text' | 'block' | 'circle'
+
+const props = withDefaults(
+  defineProps<{
+    as?: keyof HTMLElementTagNameMap
+    shape?: SkeletonShape
+    animated?: boolean
+  }>(),
+  {
+    as: 'span',
+    shape: 'block',
+    animated: true,
+  },
+)
+
+const shapeClasses: Record<SkeletonShape, string> = {
+  text: 'h-3 rounded-full',
+  block: 'rounded-cp',
+  circle: 'rounded-full',
+}
+
+const classes = computed(() => [
+  'block bg-cp-fill-secondary',
+  shapeClasses[props.shape],
+  props.animated ? 'motion-safe:animate-cp-skeleton motion-reduce:animate-none' : undefined,
+])
+</script>
+
+<template>
+  <component
+    :is="as"
+    aria-hidden="true"
+    :class="classes"
+  />
+</template>

frontend/src/components/base/BaseSwitch.vue

@@ -18,10 +18,10 @@ const model = defineModel<boolean>({ default: false })
 const trackClasses = computed(() => [
   'relative inline-flex h-6 w-11 shrink-0 items-center rounded-full p-0.5 transition-[background-color,box-shadow] duration-180 motion-reduce:transition-none',
   props.disabled
-    ? 'bg-cp-disabled shadow-none'
+    ? 'bg-cp-bg-container-disabled shadow-none'
     : model.value
-      ? 'bg-cp-accent shadow-cp-control group-hover:bg-cp-accent-hover'
-      : 'bg-cp-muted shadow-cp-control group-hover:bg-cp-default-active',
+      ? 'bg-cp-primary shadow-cp-tertiary group-hover:bg-cp-primary-hover'
+      : 'bg-cp-fill-tertiary shadow-cp-tertiary group-hover:bg-cp-bg-text-active',
 ])
 </script>
 
@@ -42,14 +42,14 @@ const trackClasses = computed(() => [
     >
     <span
       :class="trackClasses"
-      class="peer-focus-visible:ring-2 peer-focus-visible:ring-cp-accent-border peer-focus-visible:ring-offset-2 peer-focus-visible:ring-offset-cp-surface"
+      class="peer-focus-visible:ring-2 peer-focus-visible:ring-cp-control-outline peer-focus-visible:ring-offset-2 peer-focus-visible:ring-offset-cp-bg-container"
       aria-hidden="true"
     >
       <span
-        class="size-5 rounded-full bg-cp-surface shadow-cp-control transition-transform duration-180 ease-out motion-reduce:transition-none"
+        class="size-5 rounded-full bg-cp-bg-container shadow-cp-tertiary transition-transform duration-180 ease-out motion-reduce:transition-none"
         :class="model ? 'translate-x-5' : 'translate-x-0'"
       />
     </span>
-    <span v-if="showLabel" class="text-[13px] font-emphasis text-cp-primary">{{ label }}</span>
+    <span v-if="showLabel" class="text-cp font-emphasis text-cp-text">{{ label }}</span>
   </label>
 </template>

frontend/src/components/base/BaseTable/BaseTablePagination.vue

@@ -51,10 +51,10 @@ function goToPage(page: number) {
 
 function paginationPageClass(page: number) {
   return [
-    'inline-flex size-8 items-center justify-center rounded-cp-control border-0 text-xs font-bold leading-none transition-colors duration-150 outline-none',
+    'inline-flex size-8 items-center justify-center rounded-cp border-0 text-xs font-bold leading-none transition-colors duration-150 outline-none',
     page === currentPage.value
-      ? 'cursor-default bg-cp-accent text-cp-accent-on'
-      : 'cursor-pointer bg-cp-subtle text-cp-primary hover:bg-cp-default-hover focus-visible:ring-2 focus-visible:ring-cp-accent-border focus-visible:ring-offset-2 focus-visible:ring-offset-cp-surface',
+      ? 'cursor-default bg-(--cp-button-primary-bg) text-(--cp-button-primary-color)'
+      : 'cursor-pointer bg-cp-fill-quaternary text-cp-text hover:bg-cp-bg-text-hover focus-visible:ring-2 focus-visible:ring-cp-control-outline focus-visible:ring-offset-2 focus-visible:ring-offset-cp-bg-container',
   ]
 }
 </script>
@@ -64,7 +64,7 @@ function paginationPageClass(page: number) {
     class="mt-2 flex min-h-10 shrink-0 flex-wrap items-center justify-between gap-3 px-0 py-1"
   >
     <div
-      class="flex min-w-0 items-center gap-2.5 text-[12px] font-emphasis text-cp-secondary"
+      class="flex min-w-0 items-center gap-2.5 text-cp-sm font-emphasis text-cp-text-secondary"
     >
       <span class="whitespace-nowrap">共 {{ pagination.total }} 条</span>
     </div>
@@ -93,7 +93,7 @@ function paginationPageClass(page: number) {
         <template v-for="(item, index) in pagerItems" :key="`${item}-${index}`">
           <span
             v-if="item === 'ellipsis'"
-            class="inline-flex size-8 items-center justify-center text-xs font-bold text-cp-muted-text"
+            class="inline-flex size-8 items-center justify-center text-xs font-bold text-cp-text-quaternary"
           >
             …
           </span>

frontend/src/components/base/BaseTable/columns.ts

@@ -44,6 +44,7 @@ export interface BaseTableProps<Row extends TableRow> {
   density?: 'compact' | 'default'
   loading?: boolean
   emptyText?: string
+  scrollbarAlwaysVisible?: boolean
   sort?: BaseTableSort
 }
 
@@ -83,7 +84,7 @@ const columnRecipes: Record<TableColumnKind, ColumnRecipe> = {
     size: 'lg',
     align: 'left',
     truncate: true,
-    contentClass: 'text-cp-secondary',
+    contentClass: 'text-cp-text-secondary',
   },
   status: {
     size: 'md',
@@ -94,25 +95,25 @@ const columnRecipes: Record<TableColumnKind, ColumnRecipe> = {
     size: 'md',
     align: 'right',
     truncate: false,
-    contentClass: 'font-mono tabular-nums text-cp-secondary',
+    contentClass: 'font-mono tabular-nums text-cp-text-secondary',
   },
   datetime: {
     size: 'xl',
     align: 'left',
     truncate: false,
-    contentClass: 'whitespace-nowrap font-mono text-[12px] tabular-nums text-cp-secondary',
+    contentClass: 'whitespace-nowrap font-mono text-cp-sm tabular-nums text-cp-text-secondary',
   },
   mono: {
     size: 'xl',
     align: 'left',
     truncate: true,
-    contentClass: 'font-mono text-[12px] font-emphasis',
+    contentClass: 'font-mono text-cp-sm font-emphasis',
   },
   index: {
     size: 'xs',
     align: 'center',
     truncate: false,
-    contentClass: 'font-mono tabular-nums text-cp-secondary',
+    contentClass: 'font-mono tabular-nums text-cp-text-secondary',
   },
   selection: {
     size: 'xs',

frontend/src/components/base/BaseTable/index.vue

@@ -26,6 +26,7 @@ const props = withDefaults(defineProps<BaseTableProps<Row>>(), {
   density: 'default',
   loading: false,
   emptyText: '暂无数据',
+  scrollbarAlwaysVisible: false,
   sort: undefined,
 })
 
@@ -85,14 +86,14 @@ watch([() => displayRows.value.length, () => props.columns], async () => {
 })
 
 const headerRowClass = computed(() => [
-  props.density === 'compact' ? 'h-8 text-[11px]' : 'h-10 text-[12px]',
-  'font-bold text-cp-secondary',
+  props.density === 'compact' ? 'h-8 text-cp-xs' : 'h-10 text-cp-sm',
+  'font-bold text-cp-text-secondary',
 ])
 const bodyRowClass = computed(() =>
-  props.density === 'compact' ? 'h-cp-table-row-min-compact' : 'h-cp-table-row-min',
+  props.density === 'compact' ? 'h-cp-table-row-sm' : 'h-cp-table-row',
 )
 const cellPaddingClass = computed(() => props.density === 'compact' ? 'px-3' : 'px-4')
-const bodyTextClass = computed(() => props.density === 'compact' ? 'text-[12px]' : 'text-[13px]')
+const bodyTextClass = computed(() => props.density === 'compact' ? 'text-cp-sm' : 'text-cp')
 const bodyCellFrameClass = computed(() => props.density === 'compact'
   ? 'border-y-2 border-transparent bg-clip-padding'
   : 'border-y-[3px] border-transparent bg-clip-padding')
@@ -100,8 +101,8 @@ const firstRowTopGapClass = computed(() =>
   props.density === 'compact' ? 'border-t-4' : 'border-t-[6px]',
 )
 const bodyCellContentClass = computed(() => props.density === 'compact'
-  ? 'min-h-[calc(var(--cp-table-row-min-height-compact)-4px)]'
-  : 'min-h-[calc(var(--cp-table-row-min-height)-6px)]')
+  ? 'min-h-[calc(var(--cp-table-row-height-sm)-4px)]'
+  : 'min-h-[calc(var(--cp-table-row-height)-6px)]')
 
 function getRowKey(row: Row, index: number) {
   if (typeof props.rowKey === 'function')
@@ -120,16 +121,16 @@ function isRowExpanded(row: Row, index: number) {
 
 function rowBackgroundClass(row: Row, index: number) {
   if (isRowSelected(row, index))
-    return 'bg-cp-tertiary-bg'
+    return 'bg-(--cp-table-row-selected-bg)'
   if (index % 2 === 1)
-    return 'bg-cp-subtle'
-  return 'bg-cp-surface'
+    return 'bg-(--cp-table-row-stripe-bg)'
+  return 'bg-(--cp-table-row-bg)'
 }
 
 function rowClass() {
   return [
     bodyRowClass.value,
-    'hover:[&>td]:bg-cp-default-hover',
+    'hover:[&>td]:bg-(--cp-table-row-hover-bg)',
   ]
 }
 
@@ -142,8 +143,8 @@ function stickyClass(column: ResolvedTableColumn<Row>, header = false) {
     header ? 'z-40' : 'z-20',
     showShadow
       ? column.sticky === 'left'
-        ? 'shadow-[8px_0_14px_-14px_var(--cp-shadow-sticky)]'
-        : 'shadow-[-8px_0_14px_-14px_var(--cp-shadow-sticky)]'
+        ? 'shadow-[8px_0_14px_-14px_var(--cp-color-shadow)]'
+        : 'shadow-[-8px_0_14px_-14px_var(--cp-color-shadow)]'
       : undefined,
   ]
 }
@@ -194,8 +195,9 @@ function sortButtonLabel(column: ResolvedTableColumn<Row>) {
         ref="scrollbar"
         class="min-h-0 flex-1"
         :class="density === 'compact'
-          ? '[--cp-scrollbar-track-top:2.25rem]'
-          : '[--cp-scrollbar-track-top:2.75rem]'"
+          ? '[--cp-scrollbar-track-inset-block-start:2.25rem]'
+          : '[--cp-scrollbar-track-inset-block-start:2.75rem]'"
+        :always-visible="scrollbarAlwaysVisible"
         horizontal
         @scroll="handleTableScroll"
       >
@@ -216,12 +218,12 @@ function sortButtonLabel(column: ResolvedTableColumn<Row>) {
               <th
                 v-for="(column, columnIndex) in computedColumns"
                 :key="column.key"
-                class="sticky top-0 z-30 whitespace-nowrap bg-cp-muted shadow-[0_10px_16px_-18px_var(--cp-shadow-sticky)]"
+                class="sticky top-0 z-30 whitespace-nowrap bg-(--cp-table-header-bg) shadow-[0_10px_16px_-18px_var(--cp-color-shadow)]"
                 :class="[
                   column.paddingClass ?? cellPaddingClass,
                   alignClass(column),
-                  columnIndex === 0 ? 'rounded-l-cp-control' : undefined,
-                  columnIndex === computedColumns.length - 1 ? 'rounded-r-cp-control' : undefined,
+                  columnIndex === 0 ? 'rounded-l-cp' : undefined,
+                  columnIndex === computedColumns.length - 1 ? 'rounded-r-cp' : undefined,
                   columnIndex === computedColumns.length - 1 ? 'pr-6' : undefined,
                   stickyClass(column, true),
                 ]"
@@ -233,7 +235,7 @@ function sortButtonLabel(column: ResolvedTableColumn<Row>) {
                   <button
                     v-if="column.sortable"
                     type="button"
-                    class="inline-flex max-w-full touch-manipulation items-center gap-1 border-0 bg-transparent p-0 text-inherit outline-none transition-colors hover:text-cp-primary focus-visible:text-cp-accent motion-reduce:transition-none"
+                    class="inline-flex max-w-full touch-manipulation items-center gap-1 border-0 bg-transparent p-0 text-inherit outline-none transition-colors hover:text-cp-text focus-visible:text-cp-primary-text motion-reduce:transition-none"
                     :aria-label="sortButtonLabel(column)"
                     :title="sortButtonLabel(column)"
                     @click="toggleColumnSort(column)"
@@ -244,12 +246,12 @@ function sortButtonLabel(column: ResolvedTableColumn<Row>) {
                     <span class="inline-flex shrink-0 -translate-y-px flex-col gap-px" aria-hidden="true">
                       <Triangle
                         class="size-1.25 fill-current"
-                        :class="columnSortDirection(column) === 'asc' ? 'text-cp-accent' : 'text-cp-tertiary'"
+                        :class="columnSortDirection(column) === 'asc' ? 'text-cp-primary-text' : 'text-cp-text-tertiary'"
                         :stroke-width="0"
                       />
                       <Triangle
                         class="size-1.25 rotate-180 fill-current"
-                        :class="columnSortDirection(column) === 'desc' ? 'text-cp-accent' : 'text-cp-tertiary'"
+                        :class="columnSortDirection(column) === 'desc' ? 'text-cp-primary-text' : 'text-cp-text-tertiary'"
                         :stroke-width="0"
                       />
                     </span>
@@ -275,8 +277,8 @@ function sortButtonLabel(column: ResolvedTableColumn<Row>) {
                     column.contentClass,
                     alignClass(column),
                     index === 0 ? firstRowTopGapClass : undefined,
-                    columnIndex === 0 ? 'rounded-l-cp-control' : undefined,
-                    columnIndex === computedColumns.length - 1 ? 'rounded-r-cp-control pr-6' : undefined,
+                    columnIndex === 0 ? 'rounded-l-cp' : undefined,
+                    columnIndex === computedColumns.length - 1 ? 'rounded-r-cp pr-6' : undefined,
                     stickyClass(column),
                     rowBackgroundClass(row, index),
                   ]"
@@ -300,7 +302,7 @@ function sortButtonLabel(column: ResolvedTableColumn<Row>) {
               <tr v-if="isRowExpanded(row, index)">
                 <td
                   :colspan="computedColumns.length"
-                  class="rounded-cp-control border-y-transparent bg-cp-subtle bg-clip-padding p-0"
+                  class="rounded-cp border-y-transparent bg-cp-fill-quaternary bg-clip-padding p-0"
                   :class="bodyCellFrameClass"
                 >
                   <slot name="expanded" :row="row" :index="index" />

frontend/src/components/base/BaseTextarea.vue

@@ -47,17 +47,17 @@ const controlAttrs = computed(() => Object.fromEntries(
 
 const sizeClasses: Record<TextareaSize, string> = {
   sm: 'px-3 py-2.5 text-xs',
-  md: 'px-3.5 py-3 text-[13px]',
-  lg: 'px-4 py-3.5 text-[14px]',
+  md: 'px-3.5 py-3 text-cp',
+  lg: 'px-4 py-3.5 text-cp-lg',
 }
 
 const textareaClasses = computed(() => [
-  'cp-scrollbar w-full resize-none rounded-cp-control border-0 bg-[var(--cp-input-current-bg,var(--cp-input-context-bg))] text-cp-primary shadow-cp-input outline-none transition-[background-color,box-shadow,color] duration-160 placeholder:text-cp-muted-text motion-reduce:transition-none',
-  'hover:bg-[var(--cp-input-current-bg-hover,var(--cp-input-context-bg-hover))] hover:shadow-cp-input-hover focus:bg-(--cp-input-soft-bg-focus) focus:shadow-cp-input-focus',
-  'disabled:cursor-not-allowed disabled:bg-cp-disabled disabled:text-cp-disabled-text disabled:shadow-none',
+  'cp-scrollbar w-full resize-none rounded-cp border-0 bg-[var(--cp-input-bg)] text-cp-text shadow-cp-input outline-none transition-[background-color,box-shadow,color] duration-160 placeholder:text-cp-text-quaternary motion-reduce:transition-none',
+  'hover:bg-[var(--cp-input-hover-bg)] hover:shadow-cp-input-hover focus:bg-(--cp-input-active-bg) focus:shadow-cp-input-active',
+  'disabled:cursor-not-allowed disabled:bg-cp-bg-container-disabled disabled:text-cp-text-disabled disabled:shadow-none',
   'leading-[1.55] font-emphasis',
   sizeClasses[props.size],
-  invalid.value ? 'bg-(--cp-input-error-soft-bg) shadow-cp-input-error' : undefined,
+  invalid.value ? 'bg-(--cp-input-error-active-bg) shadow-cp-input-error-active' : undefined,
 ])
 </script>
 

frontend/src/components/base/BaseToast/BaseToast.vue

@@ -24,8 +24,8 @@ const colorClasses = {
     icon: 'text-cp-success',
   },
   error: {
-    iconBg: 'bg-cp-danger-bg',
-    icon: 'text-cp-danger',
+    iconBg: 'bg-cp-error-bg',
+    icon: 'text-cp-error',
   },
   warning: {
     iconBg: 'bg-cp-warning-bg',
@@ -45,12 +45,12 @@ const colorClasses = {
         <article
           v-for="message in toast.messages"
           :key="message.id"
-          class="pointer-events-auto flex min-h-16 w-90 max-w-[calc(100vw-1.5rem)] items-center gap-3 rounded-cp-surface bg-cp-surface px-3.5 py-3 shadow-cp-popover"
+          class="pointer-events-auto flex min-h-16 w-90 max-w-[calc(100vw-1.5rem)] items-center gap-3 rounded-cp-card bg-cp-bg-container px-3.5 py-3 shadow-cp"
           :role="message.type === 'error' ? 'alert' : 'status'"
           aria-atomic="true"
         >
           <div
-            class="flex size-8.5 shrink-0 items-center justify-center rounded-cp-control"
+            class="flex size-8.5 shrink-0 items-center justify-center rounded-cp"
             :class="colorClasses[message.type].iconBg"
           >
             <component
@@ -61,11 +61,11 @@ const colorClasses = {
           </div>
 
           <div class="flex min-w-0 flex-1 flex-col gap-1">
-            <p class="m-0 truncate text-[13px] leading-[1.15] font-bold text-cp-primary">
+            <p class="m-0 truncate text-cp leading-[1.15] font-bold text-cp-text">
               {{ message.title ?? titleMap[message.type] }}
             </p>
             <p
-              class="m-0 max-h-8 overflow-hidden text-xs leading-tight font-semibold text-cp-secondary"
+              class="m-0 max-h-8 overflow-hidden text-xs leading-tight font-semibold text-cp-text-secondary"
             >
               {{ message.message }}
             </p>
@@ -77,7 +77,7 @@ const colorClasses = {
             :label="`关闭${message.title ?? titleMap[message.type]}通知`"
             @click="toast.remove(message.id)"
           >
-            <X :size="16" class="text-cp-muted-text" />
+            <X :size="16" class="text-cp-text-quaternary" />
           </BaseIconButton>
         </article>
       </TransitionGroup>

frontend/src/components/charts/BaseChart.vue

@@ -3,10 +3,8 @@ import type { EChartsOption } from 'echarts'
 import type { EChartsType } from 'echarts/core'
 import { useRafFn, useResizeObserver } from '@vueuse/core'
 import { init } from 'echarts/core'
-import { storeToRefs } from 'pinia'
-import { computed, nextTick, onBeforeUnmount, shallowRef, useTemplateRef, watch } from 'vue'
+import { computed, onBeforeUnmount, shallowRef, useTemplateRef, watch } from 'vue'
 
-import { useUiStore } from '@/stores/modules/ui'
 import '@/plugins/echarts'
 
 const props = withDefaults(
@@ -23,7 +21,6 @@ const chartElement = useTemplateRef<HTMLElement>('chart')
 const chartOption = shallowRef<EChartsOption>(props.option)
 const chart = shallowRef<EChartsType>()
 const pendingInitElement = shallowRef<HTMLElement>()
-const { themeRevision } = storeToRefs(useUiStore())
 
 const style = computed(() => ({
   height: `${props.height}px`,
@@ -71,18 +68,6 @@ function applyOption(option: EChartsOption) {
   chart.value.setOption(option, true)
 }
 
-async function recreateChartAfterThemeChange() {
-  await nextTick()
-  requestAnimationFrame(() => {
-    const element = chartElement.value
-    if (!element)
-      return
-    dispose()
-    ensureChart(element)
-    resize()
-  })
-}
-
 function dispose() {
   cancelPendingInit()
   chart.value?.dispose()
@@ -104,14 +89,6 @@ watch(
   { flush: 'post' },
 )
 
-watch(
-  themeRevision,
-  () => {
-    recreateChartAfterThemeChange()
-  },
-  { flush: 'post' },
-)
-
 watch(
   chartElement,
   (element) => {

frontend/src/components/charts/tooltip.ts

@@ -30,7 +30,7 @@ export function chartTooltipStyle(
       fontFamily: options.fontFamily ?? 'Inter Variable, Inter, system-ui, sans-serif',
       fontWeight: options.fontWeight ?? 650,
     },
-    extraCssText: 'border-radius: 12px; box-shadow: var(--cp-shadow-popover);',
+    extraCssText: 'border-radius: 12px; box-shadow: var(--cp-box-shadow);',
   }
 
   if (!options.axisPointer)

frontend/src/composables/useChartPalette.ts

@@ -5,21 +5,21 @@ import { useThemeColor } from '@/composables/useThemeColor'
 export function useChartPalette() {
   const color = useThemeColor()
   const palette = computed(() => ({
-    textPrimary: color('--cp-text-primary', '#0E1726'),
-    textSecondary: color('--cp-text-secondary', '#64748B'),
-    textMuted: color('--cp-text-muted', '#94A3B8'),
-    surface: color('--cp-bg-surface', '#FFFFFF'),
-    surfaceMuted: color('--cp-bg-muted', '#F1F5F9'),
-    grid: color('--cp-bg-muted', '#F1F5F9'),
-    divider: color('--cp-divider-subtle', '#E2E8F0'),
-    border: color('--cp-default-border', '#E2E8F0'),
-    pointer: color('--cp-default-border-hover', '#CBD5E1'),
-    info: color('--cp-info', '#2563EB'),
-    success: color('--cp-success', '#10B981'),
-    warning: color('--cp-warning', '#F59E0B'),
-    danger: color('--cp-danger', '#EF4444'),
-    normal: color('--cp-normal', '#0F9F9A'),
-    reasoning: color('--cp-reasoning', '#8B5CF6'),
+    textPrimary: color('--cp-color-text', '#0E1726'),
+    textSecondary: color('--cp-color-text-secondary', '#64748B'),
+    textMuted: color('--cp-color-text-quaternary', '#94A3B8'),
+    surface: color('--cp-color-bg-container', '#FFFFFF'),
+    surfaceMuted: color('--cp-color-fill-tertiary', '#F1F5F9'),
+    grid: color('--cp-color-fill-tertiary', '#F1F5F9'),
+    divider: color('--cp-color-split', '#E2E8F0'),
+    border: color('--cp-color-border-secondary', '#E2E8F0'),
+    pointer: color('--cp-color-border', '#CBD5E1'),
+    info: color('--cp-color-info', '#2563EB'),
+    success: color('--cp-color-success', '#10B981'),
+    warning: color('--cp-color-warning', '#F59E0B'),
+    danger: color('--cp-color-error', '#EF4444'),
+    normal: color('--cp-color-status-normal', '#0F9F9A'),
+    reasoning: color('--cp-color-reasoning', '#8B5CF6'),
   }))
 
   return { color, palette }

frontend/src/composables/useThemeColor.ts

@@ -1,12 +1,33 @@
-import { storeToRefs } from 'pinia'
+import type { InjectionKey, Ref } from 'vue'
 
-import { useUiStore } from '@/stores/modules/ui'
+import { storeToRefs } from 'pinia'
+import { inject, provide } from 'vue'
+
+import { useThemeStore } from '@/stores/modules/theme'
+
+export type ThemeColorTokens = Readonly<Record<string, string | number | undefined>>
+
+const themeColorTokensKey: InjectionKey<Readonly<Ref<ThemeColorTokens>>> = Symbol('theme-color-tokens')
+
+export function provideThemeColorTokens(tokens: Readonly<Ref<ThemeColorTokens>>) {
+  provide(themeColorTokensKey, tokens)
+}
 
 // 主题感知的 CSS 变量读取：themeRevision 作为响应式依赖，主题切换后
-// 引用该函数的 computed 会重算并读到新变量值。
+// 引用该函数的 computed 会重算并读到新变量值；影子预览优先读取其局部 Token。
 export function useThemeColor() {
-  const { themeRevision } = storeToRefs(useUiStore())
+  const scopedTokens = inject(themeColorTokensKey, null)
+  const { themeRevision } = storeToRefs(useThemeStore())
   return (name: string, fallback: string) => {
+    if (scopedTokens) {
+      const scopedValue = scopedTokens.value[name]
+      if (typeof scopedValue === 'string' && scopedValue.trim())
+        return scopedValue.trim()
+      if (typeof scopedValue === 'number')
+        return String(scopedValue)
+      return fallback
+    }
+
     void themeRevision.value
     return readCssVariable(name, fallback)
   }

frontend/src/directives/loading.ts

@@ -28,7 +28,7 @@ const OVERLAY_BASE_CLASS = [
   'place-items-center',
   'rounded-[inherit]',
 ].join(' ')
-const OVERLAY_MASK_CLASS = 'bg-cp-surface/82 backdrop-blur-[4px]'
+const OVERLAY_MASK_CLASS = 'bg-cp-bg-container/82 backdrop-blur-[4px]'
 const PANEL_CLASS = [
   'inline-flex',
   'min-h-10',
@@ -41,14 +41,14 @@ const PANEL_CLASS = [
   'text-xs',
   'leading-[1.15]',
   'font-heavy',
-  'text-cp-secondary',
+  'text-cp-text-secondary',
 ].join(' ')
 const MARK_CLASS = [
   'inline-block',
   'size-4',
   'rounded-full',
   'animate-spin',
-  'bg-[radial-gradient(circle_at_center,var(--cp-bg-surface)_0_44%,transparent_46%),conic-gradient(from_0deg,var(--cp-normal)_0deg_105deg,var(--cp-info)_105deg_200deg,var(--cp-bg-muted)_200deg_360deg)]',
+  'bg-[radial-gradient(circle_at_center,var(--cp-color-bg-container)_0_44%,transparent_46%),conic-gradient(from_0deg,var(--cp-color-status-normal)_0deg_105deg,var(--cp-color-info)_105deg_200deg,var(--cp-color-fill-tertiary)_200deg_360deg)]',
 ].join(' ')
 const LABEL_CLASS = 'whitespace-nowrap'
 

frontend/src/layout/components/AppAboutModal.vue

@@ -53,15 +53,15 @@ const linkItems = [
     <div class="grid gap-5">
       <section class="flex min-w-0 items-center gap-3">
         <span
-          class="inline-flex size-9 shrink-0 items-center justify-center rounded-cp-control bg-cp-subtle font-mono text-[15px] leading-none font-extrabold text-cp-primary"
+          class="inline-flex size-9 shrink-0 items-center justify-center rounded-cp bg-cp-fill-quaternary font-mono text-cp-xl leading-none font-extrabold text-cp-text"
         >
           Z
         </span>
         <div class="min-w-0">
-          <p class="m-0 truncate text-[15px] leading-none font-heavy text-cp-primary">
+          <p class="m-0 truncate text-cp-xl leading-none font-heavy text-cp-text">
             {{ author }}
           </p>
-          <p class="mt-1.5 mb-0 text-[12px] leading-none font-emphasis text-cp-secondary">
+          <p class="mt-1.5 mb-0 text-cp-sm leading-none font-emphasis text-cp-text-secondary">
             Built by Zyy · Codex Proxy RS
           </p>
         </div>
@@ -71,20 +71,20 @@ const linkItems = [
         <div
           v-for="item in linkItems"
           :key="item.label"
-          class="group flex min-w-0 items-center justify-between gap-3 rounded-cp-control px-1 py-2.5 transition-colors hover:bg-cp-subtle"
+          class="group flex min-w-0 items-center justify-between gap-3 rounded-cp px-1 py-2.5 transition-colors hover:bg-cp-fill-quaternary"
         >
           <div class="flex min-w-0 items-center gap-3">
             <span
-              class="inline-flex size-8 shrink-0 items-center justify-center rounded-cp-control bg-cp-muted text-cp-primary"
+              class="inline-flex size-8 shrink-0 items-center justify-center rounded-cp bg-cp-fill-tertiary text-cp-text"
             >
               <component :is="item.icon" class="size-5" />
             </span>
             <div class="min-w-0">
-              <p class="m-0 text-[11px] leading-none font-heavy text-cp-muted-text">
+              <p class="m-0 text-cp-xs leading-none font-heavy text-cp-text-quaternary">
                 {{ item.label }}
               </p>
               <p
-                class="mt-2 mb-0 truncate font-mono text-[12px] leading-none font-bold text-cp-primary"
+                class="mt-2 mb-0 truncate font-mono text-cp-sm leading-none font-bold text-cp-text"
                 :title="item.value"
               >
                 {{ item.value }}
@@ -96,7 +96,7 @@ const linkItems = [
             :href="item.href"
             target="_blank"
             rel="noreferrer"
-            class="inline-flex size-7 shrink-0 items-center justify-center rounded-cp-control text-cp-muted-text transition-colors hover:bg-cp-muted hover:text-cp-info"
+            class="inline-flex size-7 shrink-0 items-center justify-center rounded-cp text-cp-text-quaternary transition-colors hover:bg-cp-fill-tertiary hover:text-cp-link"
             :aria-label="`打开 ${item.label}`"
           >
             <ExternalLink class="size-3.5" />
@@ -104,7 +104,7 @@ const linkItems = [
         </div>
       </section>
 
-      <p class="m-0 font-mono text-[11px] leading-none font-emphasis text-cp-muted-text">
+      <p class="m-0 font-mono text-cp-xs leading-none font-emphasis text-cp-text-quaternary">
         {{ versionLine }}
       </p>
     </div>

frontend/src/layout/components/AppSidebar.vue

@@ -8,6 +8,7 @@ import {
   LayoutDashboard,
   LogOut,
   Moon,
+  Palette,
   PanelLeftClose,
   PanelLeftOpen,
   Settings,
@@ -29,11 +30,12 @@ import {
 } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
 
+import AppBrandMark from '@/components/AppBrandMark.vue'
 import BaseIconButton from '@/components/base/BaseIconButton.vue'
 import BaseMotionIcon from '@/components/base/BaseMotionIcon.vue'
 import { useAuthStore } from '@/stores/modules/auth'
 import { useSystemUpdateStore } from '@/stores/modules/system-update'
-import { useUiStore } from '@/stores/modules/ui'
+import { useThemeStore } from '@/stores/modules/theme'
 
 const props = withDefaults(
   defineProps<{
@@ -56,10 +58,10 @@ const route = useRoute()
 const router = useRouter()
 const authStore = useAuthStore()
 const systemUpdateStore = useSystemUpdateStore()
-const uiStore = useUiStore()
+const themeStore = useThemeStore()
 const { version, hasUpdate } = storeToRefs(systemUpdateStore)
-const { effectiveTheme } = storeToRefs(uiStore)
-const { toggleTheme } = uiStore
+const { effectiveTheme } = storeToRefs(themeStore)
+const { toggleTheme } = themeStore
 const preferredMotion = usePreferredReducedMotion()
 
 const navItems = [
@@ -68,6 +70,7 @@ const navItems = [
   { label: '分组管理', icon: FolderTree, path: '/account-groups' },
   { label: 'API 密钥', icon: KeyRound, path: '/api-keys' },
   { label: '使用统计', icon: ChartNoAxesColumn, path: '/usage' },
+  { label: '主题设置', icon: Palette, path: '/theme' },
   { label: '系统设置', icon: Settings, path: '/settings' },
 ]
 
@@ -328,7 +331,7 @@ onBeforeUnmount(() => {
 <template>
   <aside
     ref="sidebarEl"
-    class="z-20 h-dvh shrink-0 flex-col overflow-hidden bg-cp-surface px-4 shadow-cp-sidebar"
+    class="z-20 h-dvh shrink-0 flex-col overflow-hidden bg-(--cp-layout-sider-bg) px-4 shadow-cp-layout-sider"
     :class="[
       mobile ? 'flex' : 'hidden min-[961px]:flex',
       isCollapsed ? 'w-22 basis-22 items-center' : 'w-62.75 basis-62.75',
@@ -341,35 +344,30 @@ onBeforeUnmount(() => {
       <BaseMotionIcon
         aria-hidden="true"
         variant="brand"
-        class="inline-flex size-11 items-center justify-center relative -top-0.5 rounded-cp-control"
+        class="inline-flex size-11 items-center justify-center relative -top-0.5 rounded-cp"
       >
-        <img
-          src="/favicon.svg"
-          alt=""
-          class="block size-11 select-none"
-          draggable="false"
-        >
+        <AppBrandMark class="block size-11 select-none" />
       </BaseMotionIcon>
       <span
         v-show="brandLabelVisible"
         ref="brandLabelEl"
         class="grid min-w-33 content-center overflow-hidden"
       >
-        <strong class="text-base leading-[1.1] font-heavy text-cp-primary">
+        <strong class="text-base leading-[1.1] font-heavy text-cp-text">
           Codex Proxy
         </strong>
         <span class="mt-1.5 flex h-4.5 min-w-0 items-center gap-2">
-          <span class="shrink-0 text-xs leading-none font-emphasis text-cp-secondary">
+          <span class="shrink-0 text-xs leading-none font-emphasis text-cp-text-secondary">
             Rust build
           </span>
           <button
             v-if="hasVersionLabel"
             type="button"
-            class="inline-flex h-4.5 min-w-0 cursor-pointer items-center gap-1 rounded-cp-control-sm border-0 px-1.5 font-mono text-[10px] leading-none font-bold transition-colors outline-none focus-visible:ring-2 focus-visible:ring-cp-info-border focus-visible:ring-offset-2 focus-visible:ring-offset-cp-surface"
+            class="inline-flex h-4.5 min-w-0 cursor-pointer items-center gap-1 rounded-cp-sm border-0 px-1.5 font-mono text-[10px] leading-none font-bold transition-colors outline-none focus-visible:ring-2 focus-visible:ring-cp-control-outline focus-visible:ring-offset-2 focus-visible:ring-offset-cp-bg-container"
             :class="[
               hasUpdate
                 ? 'bg-cp-success-bg text-cp-success-text hover:bg-cp-success-bg-hover'
-                : 'bg-cp-subtle text-cp-muted-text hover:bg-cp-muted hover:text-cp-secondary',
+                : 'bg-cp-fill-quaternary text-cp-text-quaternary hover:bg-cp-fill-tertiary hover:text-cp-text-secondary',
             ]"
             :title="updateButtonLabel"
             @click="openSystemUpdate"
@@ -388,7 +386,7 @@ onBeforeUnmount(() => {
     >
       <span
         aria-hidden="true"
-        class="pointer-events-none absolute inset-x-0 top-0 h-11.5 overflow-hidden rounded-cp-control bg-cp-nav-active transition-transform duration-260 ease-[cubic-bezier(0.22,1,0.36,1)] motion-reduce:transition-none"
+        class="pointer-events-none absolute inset-x-0 top-0 h-11.5 overflow-hidden rounded-cp bg-cp-menu-item-selected-bg transition-transform duration-260 ease-[cubic-bezier(0.22,1,0.36,1)] motion-reduce:transition-none"
         :style="activeNavIndicatorStyle"
       >
         <span ref="navSignal" class="sidebar-active-signal absolute inset-y-0 left-0 w-2/3" />
@@ -397,16 +395,16 @@ onBeforeUnmount(() => {
         v-for="item in navItems"
         :key="item.label"
         type="button"
-        class="relative z-10 inline-flex h-11.5 cursor-pointer items-center rounded-cp-control border-0 text-sm leading-[1.15] outline-none focus-visible:ring-2 focus-visible:ring-cp-info-border focus-visible:ring-offset-2 focus-visible:ring-offset-cp-surface"
+        class="relative z-10 inline-flex h-11.5 cursor-pointer items-center rounded-cp border-0 text-sm leading-[1.15] outline-none focus-visible:ring-2 focus-visible:ring-cp-control-outline focus-visible:ring-offset-2 focus-visible:ring-offset-cp-bg-container"
         :class="[
           isCollapsed ? 'w-11.5 justify-center' : 'w-full gap-3 px-4',
           isActive(item.path)
             ? navFeedbackMuted
-              ? 'bg-transparent font-bold text-cp-primary transition-none'
-              : 'bg-transparent font-bold text-cp-primary transition-colors duration-200'
+              ? 'bg-transparent font-bold text-cp-text transition-none'
+              : 'bg-transparent font-bold text-cp-text transition-colors duration-200'
             : navFeedbackMuted
-              ? 'bg-transparent font-semibold text-cp-secondary transition-none'
-              : 'bg-transparent font-semibold text-cp-secondary transition-colors duration-200 hover:bg-cp-subtle hover:text-cp-primary',
+              ? 'bg-transparent font-semibold text-cp-text-secondary transition-none'
+              : 'bg-transparent font-semibold text-cp-text-secondary transition-colors duration-200 hover:bg-cp-fill-quaternary hover:text-cp-text',
         ]"
         @click="navigate(item.path)"
       >
@@ -422,11 +420,11 @@ onBeforeUnmount(() => {
 
     <div class="mt-auto mb-6" :class="isCollapsed ? 'w-11' : 'w-full'">
       <div
-        class="bg-cp-subtle"
+        class="bg-cp-fill-quaternary"
         :class="
           isCollapsed
-            ? 'grid gap-1 rounded-cp-control p-1'
-            : 'flex h-11 items-center justify-between rounded-cp-overlay px-2'
+            ? 'grid gap-1 rounded-cp p-1'
+            : 'flex h-11 items-center justify-between rounded-cp-lg px-2'
         "
       >
         <span
@@ -505,6 +503,11 @@ onBeforeUnmount(() => {
 
 <style scoped>
 .sidebar-active-signal {
-  background: linear-gradient(90deg, transparent, color-mix(in srgb, var(--cp-info) 9%, transparent), transparent);
+  background: linear-gradient(
+    90deg,
+    transparent,
+    color-mix(in srgb, var(--cp-color-info) 9%, transparent),
+    transparent
+  );
 }
 </style>

frontend/src/layout/components/FloatingSidebarToggle.vue

@@ -220,10 +220,10 @@ onScopeDispose(() => {
   >
     <button
       type="button"
-      class="inline-flex size-11.5 items-center justify-center rounded-cp-control border-0 bg-cp-surface text-cp-primary shadow-[0_18px_34px_-18px_var(--cp-shadow-sticky)] outline-none transition-[background-color,box-shadow,color,opacity,transform] duration-150 hover:bg-cp-default-hover hover:text-cp-normal active:scale-95 focus-visible:ring-2 focus-visible:ring-cp-info-border focus-visible:ring-offset-2 focus-visible:ring-offset-cp-page"
+      class="inline-flex size-11.5 items-center justify-center rounded-cp border-0 bg-cp-bg-container text-cp-text shadow-[0_18px_34px_-18px_var(--cp-color-shadow)] outline-none transition-[background-color,box-shadow,color,opacity,transform] duration-150 hover:bg-cp-bg-text-hover hover:text-cp-status-normal active:scale-95 focus-visible:ring-2 focus-visible:ring-cp-control-outline focus-visible:ring-offset-2 focus-visible:ring-offset-cp-bg-layout"
       :class="
         isDragging
-          ? 'scale-95 cursor-grabbing shadow-[0_14px_28px_-20px_var(--cp-shadow-sticky)]'
+          ? 'scale-95 cursor-grabbing shadow-[0_14px_28px_-20px_var(--cp-color-shadow)]'
           : 'cursor-grab'
       "
       aria-label="打开侧边栏"

frontend/src/layout/components/SystemUpdateModal/index.vue

@@ -198,18 +198,18 @@ watch(
     :dismissible="!updating && !restarting"
   >
     <div class="grid gap-3.5">
-      <section class="grid gap-4 rounded-cp-surface bg-cp-subtle px-4 py-4">
+      <section class="grid gap-4 rounded-cp-card bg-cp-fill-quaternary px-4 py-4">
         <div class="flex flex-wrap items-center justify-between gap-3">
           <div class="min-w-0">
-            <p class="m-0 text-[11px] leading-none font-heavy text-cp-muted-text">
+            <p class="m-0 text-cp-xs leading-none font-heavy text-cp-text-quaternary">
               Codex Proxy RS
             </p>
-            <p class="mt-2 mb-0 text-lg leading-none font-heavy text-cp-primary">
+            <p class="mt-2 mb-0 text-lg leading-none font-heavy text-cp-text">
               应用包更新
             </p>
           </div>
           <span
-            class="inline-flex h-7 shrink-0 items-center gap-1.5 rounded-full px-2.5 text-[12px] font-heavy"
+            class="inline-flex h-7 shrink-0 items-center gap-1.5 rounded-full px-2.5 text-cp-sm font-heavy"
             :class="presentation.status.badge"
           >
             <component
@@ -225,10 +225,10 @@ watch(
           <div
             v-for="item in presentation.summaryItems"
             :key="item.key"
-            class="min-w-0 rounded-cp-control bg-cp-surface px-3 py-2.5"
+            class="min-w-0 rounded-cp bg-cp-bg-container px-3 py-2.5"
           >
             <div class="flex min-w-0 items-center justify-between gap-2">
-              <p class="m-0 truncate text-[11px] leading-none font-heavy text-cp-muted-text">
+              <p class="m-0 truncate text-cp-xs leading-none font-heavy text-cp-text-quaternary">
                 {{ item.label }}
               </p>
               <a
@@ -236,14 +236,14 @@ watch(
                 :href="item.releaseUrl"
                 target="_blank"
                 rel="noreferrer"
-                class="inline-flex shrink-0 items-center gap-1 text-[11px] leading-none font-bold text-cp-info-text transition-colors hover:text-cp-info"
+                class="inline-flex shrink-0 items-center gap-1 text-cp-xs leading-none font-bold text-cp-link transition-colors hover:text-cp-link-hover"
               >
                 发布页
                 <ExternalLink class="size-3" />
               </a>
             </div>
             <p
-              class="mt-2 mb-0 truncate font-mono text-[13px] leading-none font-bold text-cp-primary"
+              class="mt-2 mb-0 truncate font-mono text-cp leading-none font-bold text-cp-text"
               :title="item.title || item.value"
             >
               {{ item.value }}
@@ -253,7 +253,7 @@ watch(
 
         <p
           v-if="updateError || updateInfo?.warning"
-          class="m-0 rounded-cp-control bg-cp-danger-bg px-3 py-2 text-[12px] leading-normal font-bold text-cp-danger-text"
+          class="m-0 rounded-cp bg-cp-error-bg px-3 py-2 text-cp-sm leading-normal font-bold text-cp-error-text"
         >
           {{ updateError || updateInfo?.warning }}
         </p>
@@ -261,13 +261,13 @@ watch(
 
       <section
         v-if="renderedReleaseNotes"
-        class="grid gap-2 rounded-cp-surface bg-cp-subtle px-4 py-3.5"
+        class="grid gap-2 rounded-cp-card bg-cp-fill-quaternary px-4 py-3.5"
       >
         <div class="flex items-center justify-between gap-3">
-          <p class="m-0 text-[13px] font-heavy text-cp-primary">
+          <p class="m-0 text-cp font-heavy text-cp-text">
             发布说明
           </p>
-          <span class="font-mono text-[11px] font-emphasis text-cp-muted-text">
+          <span class="font-mono text-cp-xs font-emphasis text-cp-text-quaternary">
             {{ presentation.releaseVersion }}
           </span>
         </div>
@@ -280,22 +280,22 @@ watch(
 
       <section
         v-if="showUpdateProgress"
-        class="overflow-hidden rounded-cp-surface bg-cp-subtle"
+        class="overflow-hidden rounded-cp-card bg-cp-fill-quaternary"
       >
         <header class="flex items-center justify-between gap-3 px-4 pt-3.5 pb-2.5">
           <div class="flex min-w-0 items-center gap-2">
             <Terminal class="size-4 shrink-0 text-cp-success" />
-            <p class="m-0 text-[13px] leading-none font-heavy text-cp-primary">
+            <p class="m-0 text-cp leading-none font-heavy text-cp-text">
               更新进度
             </p>
           </div>
           <span
-            class="inline-flex h-6 items-center gap-1.5 rounded-full bg-cp-subtle px-2 text-[11px] leading-none font-bold text-cp-secondary"
+            class="inline-flex h-6 items-center gap-1.5 rounded-full bg-cp-fill-quaternary px-2 text-cp-xs leading-none font-bold text-cp-text-secondary"
             :title="updateStreamError || presentation.streamStatusLabel"
           >
             <i
               class="size-1.5 rounded-full"
-              :class="updateStreaming ? 'bg-cp-success' : 'bg-cp-muted-text'"
+              :class="updateStreaming ? 'bg-cp-success' : 'bg-cp-text-quaternary'"
             />
             {{ presentation.streamStatusLabel }}
           </span>
@@ -310,16 +310,16 @@ watch(
             <div
               v-for="log in updateLogRows"
               :key="log.id"
-              class="grid grid-cols-[68px_14px_minmax(0,1fr)] items-start gap-2 rounded-cp-control bg-cp-surface px-3 py-2 font-mono text-[11px] leading-[1.55]"
+              class="grid grid-cols-[68px_14px_minmax(0,1fr)] items-start gap-2 rounded-cp bg-cp-bg-container px-3 py-2 font-mono text-cp-xs leading-[1.55]"
             >
-              <span class="tabular-nums text-cp-muted-text">{{ log.time }}</span>
+              <span class="tabular-nums text-cp-text-quaternary">{{ log.time }}</span>
               <Circle
                 class="mt-1 size-2.5"
                 :class="log.classes.marker"
                 fill="currentColor"
               />
               <p class="m-0 min-w-0 wrap-break-word" :class="log.classes.text">
-                <span v-if="log.step" class="mr-1 text-cp-muted-text">[{{ log.step }}]</span>
+                <span v-if="log.step" class="mr-1 text-cp-text-quaternary">[{{ log.step }}]</span>
                 {{ log.message }}
               </p>
             </div>
@@ -383,23 +383,23 @@ watch(
     @confirm="handleConfirmUpdate"
   >
     <div class="grid gap-3">
-      <div class="grid gap-2 rounded-cp-control bg-cp-subtle p-3">
+      <div class="grid gap-2 rounded-cp bg-cp-fill-quaternary p-3">
         <div
           v-for="item in presentation.confirmRows"
           :key="item.key"
           class="flex min-w-0 items-center justify-between gap-3"
         >
-          <span class="text-[12px] leading-none font-bold text-cp-muted-text">
+          <span class="text-cp-sm leading-none font-bold text-cp-text-quaternary">
             {{ item.label }}
           </span>
           <span
-            class="truncate font-mono text-[13px] leading-none font-heavy text-cp-primary"
+            class="truncate font-mono text-cp leading-none font-heavy text-cp-text"
           >
             {{ item.value }}
           </span>
         </div>
       </div>
-      <p class="m-0 text-[12px] leading-relaxed font-emphasis text-cp-muted-text">
+      <p class="m-0 text-cp-sm leading-relaxed font-emphasis text-cp-text-quaternary">
         点击确认后弹窗会关闭，并按远端最新目标版本开始更新
       </p>
     </div>
@@ -408,7 +408,7 @@ watch(
 
 <style scoped>
 .release-notes {
-  color: var(--cp-text-primary);
+  color: var(--cp-color-text);
   font-size: 12px;
   font-weight: var(--font-weight-emphasis);
   line-height: 1.65;
@@ -432,7 +432,7 @@ watch(
 .release-notes :deep(h3),
 .release-notes :deep(h4) {
   margin: 12px 0 6px;
-  color: var(--cp-text-primary);
+  color: var(--cp-color-text);
   font-size: 12px;
   font-weight: var(--font-weight-heavy);
   line-height: 1.4;
@@ -453,19 +453,19 @@ watch(
 }
 
 .release-notes :deep(a) {
-  color: var(--cp-info-text);
+  color: var(--cp-color-link);
   font-weight: 700;
   text-decoration: none;
 }
 
 .release-notes :deep(a:hover) {
-  color: var(--cp-info);
+  color: var(--cp-color-link-hover);
 }
 
 .release-notes :deep(code) {
   border-radius: 5px;
-  background: var(--cp-bg-muted);
-  color: var(--cp-text-primary);
+  background: var(--cp-color-fill-tertiary);
+  color: var(--cp-color-text);
   font-family: var(--font-mono);
   font-size: 11px;
   padding: 1px 5px;
@@ -474,8 +474,8 @@ watch(
 .release-notes :deep(pre) {
   margin: 8px 0;
   overflow-x: auto;
-  border-radius: var(--cp-radius-control);
-  background: var(--cp-bg-surface);
+  border-radius: var(--cp-border-radius);
+  background: var(--cp-color-bg-container);
   padding: 8px 10px;
 }
 
@@ -486,8 +486,8 @@ watch(
 
 .release-notes :deep(blockquote) {
   margin: 8px 0;
-  border-left: 3px solid var(--cp-divider-subtle);
-  color: var(--cp-text-secondary);
+  border-left: 3px solid var(--cp-color-split);
+  color: var(--cp-color-text-secondary);
   padding-left: 10px;
 }
 </style>

frontend/src/layout/components/SystemUpdateModal/presenter.ts

@@ -36,9 +36,9 @@ export function resolveSystemUpdateLogClasses(level: string) {
     case 'warning':
       return { marker: 'text-cp-warning', text: 'text-cp-warning' }
     case 'error':
-      return { marker: 'text-cp-danger', text: 'text-cp-danger' }
+      return { marker: 'text-cp-error', text: 'text-cp-error' }
     default:
-      return { marker: 'text-cp-info', text: 'text-cp-primary' }
+      return { marker: 'text-cp-info', text: 'text-cp-text' }
   }
 }
 
@@ -55,8 +55,8 @@ function resolveStatus(input: SystemUpdatePresentationInput) {
     return {
       label: '异常',
       icon: XCircle,
-      badge: 'bg-cp-danger-bg text-cp-danger-text',
-      iconClass: 'text-cp-danger',
+      badge: 'bg-cp-error-bg text-cp-error-text',
+      iconClass: 'text-cp-error',
     }
   }
   if (input.updateSuccess || input.hasUpdate || input.updateInfo) {
@@ -70,8 +70,8 @@ function resolveStatus(input: SystemUpdatePresentationInput) {
   return {
     label: '未检查',
     icon: CheckCircle2,
-    badge: 'bg-cp-muted text-cp-secondary',
-    iconClass: 'text-cp-muted-text',
+    badge: 'bg-cp-fill-tertiary text-cp-text-secondary',
+    iconClass: 'text-cp-text-quaternary',
   }
 }
 

frontend/src/layout/index.vue

@@ -70,7 +70,7 @@ watch(
 </script>
 
 <template>
-  <div class="relative flex h-dvh overflow-hidden bg-cp-page">
+  <div class="relative flex h-dvh overflow-hidden bg-cp-bg-layout">
     <AppSidebar
       :collapsed="sidebarCollapsed"
       @toggle="toggleSidebar"